spinuptui 1.0.0 → 1.1.1

package/src/lib/cliSsh.ts

@@ -169,15 +169,17 @@ export async function resolveSshTargetInfo(
   }
 }
 
-export async function resolveSshAccess(
-  domain: string,
-  client: SpinupWPClientLike,
-  cfg: AppConfig,
-  opts?: { server?: string | null },
-): Promise<SshAccessResult> {
-  const resolution = await resolveSshTargetInfo(domain, client, cfg, opts)
-  if (!resolution.ok) return resolution.result
-  const { primaryDomain, sshTarget: target, port, server: serverName } = resolution.info
+// One BatchMode `ssh … true` against an already-resolved target, classified.
+// Shared by `ssh` (one domain) and `siblings --probe` (every site on a server)
+// so both read a refused key, an unreachable box and anything else the same way.
+export type SshProbeStatus = "ok" | "permission_denied" | "connection_failed" | "ssh_error"
+
+const PROBE_TIMEOUT_MS = 15_000
+
+export async function probeSshTarget(
+  target: string,
+  port: number | null,
+): Promise<{ status: SshProbeStatus; message?: string }> {
   const portOpt = port ? ["-p", String(port)] : []
 
   let proc: ReturnType<typeof Bun.spawn>
@@ -188,46 +190,58 @@ export async function resolveSshAccess(
       stdin: "ignore",
     })
   } catch (err) {
-    return { ok: false, domain, reason: "ssh_error", message: `Failed to launch ssh: ${(err as Error).message}` }
+    return { status: "ssh_error", message: `Failed to launch ssh: ${(err as Error).message}` }
   }
 
+  let timedOut = false
   const timeout = setTimeout(() => {
+    timedOut = true
     try {
       proc.kill()
     } catch {
       /* already gone */
     }
-  }, 15000)
+  }, PROBE_TIMEOUT_MS)
 
   const exitCode = await proc.exited
   clearTimeout(timeout)
-  const stderr = await new Response(proc.stderr as ReadableStream<Uint8Array>).text()
+  if (exitCode === 0) return { status: "ok" }
 
-  if (exitCode === 0) {
-    return { ok: true, domain, primaryDomain, sshTarget: target, port, server: serverName }
+  // Killed by our own timer: ssh never got to say why, so say it here rather
+  // than reporting the kill signal's exit code as an unexplained ssh error.
+  if (timedOut) {
+    return { status: "connection_failed", message: `ssh did not finish within ${PROBE_TIMEOUT_MS / 1000}s.` }
   }
 
-  if (/permission denied/i.test(stderr)) {
-    return {
-      ok: false,
-      domain,
-      reason: "permission_denied",
-      message: stderr.trim().split("\n").slice(-2).join(" ") || "Permission denied.",
-      remedy: GRANT_KEY_REMEDY,
-    }
-  }
+  const stderr = await new Response(proc.stderr as ReadableStream<Uint8Array>).text()
+  const tail = stderr.trim().split("\n").slice(-2).join(" ")
+
+  if (/permission denied/i.test(stderr)) return { status: "permission_denied", message: tail || "Permission denied." }
   if (/(connection timed out|operation timed out|connection refused|could not resolve)/i.test(stderr)) {
-    return {
-      ok: false,
-      domain,
-      reason: "connection_failed",
-      message: stderr.trim().split("\n").slice(-2).join(" ") || `ssh exited with code ${exitCode}`,
-    }
+    return { status: "connection_failed", message: tail || `ssh exited with code ${exitCode}` }
+  }
+  return { status: "ssh_error", message: tail || `ssh exited with code ${exitCode}` }
+}
+
+export async function resolveSshAccess(
+  domain: string,
+  client: SpinupWPClientLike,
+  cfg: AppConfig,
+  opts?: { server?: string | null },
+): Promise<SshAccessResult> {
+  const resolution = await resolveSshTargetInfo(domain, client, cfg, opts)
+  if (!resolution.ok) return resolution.result
+  const { primaryDomain, sshTarget: target, port, server: serverName } = resolution.info
+
+  const probe = await probeSshTarget(target, port)
+  if (probe.status === "ok") {
+    return { ok: true, domain, primaryDomain, sshTarget: target, port, server: serverName }
   }
   return {
     ok: false,
     domain,
-    reason: "ssh_error",
-    message: stderr.trim().split("\n").slice(-2).join(" ") || `ssh exited with code ${exitCode}`,
+    reason: probe.status,
+    message: probe.message ?? "ssh failed.",
+    ...(probe.status === "permission_denied" ? { remedy: GRANT_KEY_REMEDY } : {}),
   }
 }

package/src/lib/cloneSettings.ts

@@ -0,0 +1,180 @@
+// Carry a site's SpinupWP settings onto its clone: page cache (on/off, duration,
+// exclusions), the nginx security toggles, path redirects, and the server-level WP
+// cron interval. The create payload can only say "page cache on", so without this
+// a clone comes out with SpinupWP's defaults for everything else. Each setting is
+// compared first and only a difference is written, so a retry re-runs it safely.
+//
+// Not carried here: basic auth (the password can't be read from the API — the
+// result flags it instead) and backups (stored per DOMAIN in the bucket, so a clone
+// backing up before DNS cutover would write over production's files; they're
+// applied at cutover).
+
+import type { SpinupWPClientLike } from "../api/client.ts"
+import { WP_CRON_INTERVALS, type NginxSettings, type PageCachePayload, type PageCacheSettings, type PathRedirect, type Site } from "../api/types.ts"
+import { pollEvent } from "./cloneDomains.ts"
+
+export interface SettingsCarryResult {
+  carried: string[] // short labels for what was written ("page cache", "3 redirects", …)
+  failed: { what: string; error: string }[]
+  basicAuthMissing: boolean // the source is password-protected, the clone isn't
+}
+
+type Log = (entry: Record<string, unknown>) => void
+
+// Page-cache exclusion lists read back as one pipe-joined regex but are written one
+// entry per line. Split on top-level pipes only, so an alternation inside a group
+// or class — "(a|b)", "[|]" — stays one entry. Exported for the test harness.
+export function splitCacheList(joined: string): string[] {
+  const out: string[] = []
+  let depth = 0
+  let cur = ""
+  for (let i = 0; i < joined.length; i++) {
+    const ch = joined[i]!
+    if (ch === "\\") {
+      cur += ch + (joined[i + 1] ?? "")
+      i++
+      continue
+    }
+    if (ch === "(" || ch === "[" || ch === "{") depth++
+    else if ((ch === ")" || ch === "]" || ch === "}") && depth > 0) depth--
+    if (ch === "|" && depth === 0) {
+      out.push(cur)
+      cur = ""
+      continue
+    }
+    cur += ch
+  }
+  out.push(cur)
+  return out.filter((e) => e !== "")
+}
+
+const CACHE_LISTS = ["path_exclusions", "cookie_exclusions", "ignored_query_params"] as const
+
+// What to send so the dest's page cache matches the source's: only the fields that
+// differ, and never a list the source leaves unset (null reads as "SpinupWP's
+// default", which the dest already has).
+function pageCacheDiff(src: PageCacheSettings, dst: PageCacheSettings | undefined): PageCachePayload {
+  const out: PageCachePayload = {}
+  if (src.duration != null && src.duration_unit != null && (src.duration !== dst?.duration || src.duration_unit !== dst?.duration_unit)) {
+    out.duration = src.duration
+    out.duration_unit = src.duration_unit
+  }
+  for (const k of CACHE_LISTS) {
+    const v = src[k]
+    if (v != null && v !== dst?.[k]) out[k] = splitCacheList(v).join("\n")
+  }
+  return out
+}
+
+// Wait for each event and turn the outcome into an error string (undefined = done).
+async function settle(client: SpinupWPClientLike, eventIds: number[]): Promise<string | undefined> {
+  for (const id of eventIds) {
+    const r = await pollEvent(client, id)
+    if (r.outcome === "failed") return `event ${id} failed on SpinupWP`
+    if (r.outcome === "timeout") return `gave up waiting for event ${id}${r.lastStatus ? ` (still "${r.lastStatus}")` : ""} — retry the site to re-check`
+  }
+  return undefined
+}
+
+const redirectKey = (r: Pick<PathRedirect, "from" | "to">) => `${r.from}\u0000${r.to}`
+
+export async function carrySiteSettings(
+  client: SpinupWPClientLike,
+  sourceSiteId: number,
+  destSiteId: number,
+  wpCron: { source?: number | null; dest?: number | null },
+  log?: Log,
+): Promise<SettingsCarryResult> {
+  const result: SettingsCarryResult = { carried: [], failed: [], basicAuthMissing: false }
+  let src: Site
+  let dst: Site
+  try {
+    ;[src, dst] = await Promise.all([client.getSite(sourceSiteId), client.getSite(destSiteId)])
+  } catch (err) {
+    result.failed.push({ what: "settings", error: `couldn't read the sites: ${(err as Error).message}` })
+    return result
+  }
+
+  // Each step records its own outcome; one failing never stops the rest.
+  const step = async (what: string, run: () => Promise<number[] | null>) => {
+    try {
+      const events = await run()
+      if (events == null) return // nothing to change
+      const error = await settle(client, events)
+      if (error) {
+        result.failed.push({ what, error })
+        log?.({ event: "settings-carry", what, ok: false, error })
+      } else {
+        result.carried.push(what)
+        log?.({ event: "settings-carry", what, ok: true })
+      }
+    } catch (err) {
+      const error = (err as Error).message
+      result.failed.push({ what, error })
+      log?.({ event: "settings-carry", what, ok: false, error })
+    }
+  }
+
+  // Page cache
+  const sc = src.page_cache
+  if (sc) {
+    await step("page cache", async () => {
+      if (!sc.enabled) return dst.page_cache?.enabled ? [(await client.disablePageCache(destSiteId)).event_id] : null
+      const diff = pageCacheDiff(sc, dst.page_cache)
+      if (!dst.page_cache?.enabled) return [(await client.enablePageCache(destSiteId, diff)).event_id]
+      return Object.keys(diff).length > 0 ? [(await client.updatePageCache(destSiteId, diff)).event_id] : null
+    })
+  }
+
+  // Nginx security toggles (public_folder is set at create and handled by the pull)
+  const sn = src.nginx ?? {}
+  const nginx: NginxSettings = {}
+  for (const k of ["uploads_directory_protected", "xmlrpc_protected", "subdirectory_rewrite_in_place"] as const) {
+    if (sn[k] != null && sn[k] !== dst.nginx?.[k]) nginx[k] = sn[k]
+  }
+  if (Object.keys(nginx).length > 0) {
+    await step("security settings", async () => (await client.updateNginx(destSiteId, nginx)).event_ids)
+  }
+
+  // Path redirects: add the source's that the dest lacks. The dest's own extras
+  // are left alone (a clone shouldn't delete anything).
+  let srcRedirects: PathRedirect[] = []
+  try {
+    srcRedirects = await client.listPathRedirects(sourceSiteId)
+  } catch (err) {
+    result.failed.push({ what: "redirects", error: `couldn't list the source's redirects: ${(err as Error).message}` })
+  }
+  if (srcRedirects.length > 0) {
+    let have = new Set<string>()
+    try {
+      have = new Set((await client.listPathRedirects(destSiteId)).map(redirectKey))
+    } catch {
+      /* add them all; a duplicate is rejected per redirect and reported */
+    }
+    const missing = srcRedirects.filter((r) => !have.has(redirectKey(r)))
+    if (missing.length > 0) {
+      await step(`${missing.length} redirect${missing.length === 1 ? "" : "s"}`, async () => {
+        const events: number[] = []
+        for (const r of missing) events.push((await client.addPathRedirect(destSiteId, { from: r.from, to: r.to, type: r.type })).event_id)
+        return events
+      })
+    }
+  }
+
+  // WP cron: both ends' intervals come from their crontabs (undefined = unread,
+  // null = no managed job recognized). Only an interval is ever carried: a source
+  // with no recognizable job might have WP cron off, or a line shape we don't
+  // parse, and switching the clone's off on a guess is worse than leaving it.
+  const want = wpCron.source
+  const have = wpCron.dest
+  if (want != null && have !== undefined && want !== have) {
+    if (!(WP_CRON_INTERVALS as readonly number[]).includes(want)) {
+      result.failed.push({ what: "WP cron", error: `the source runs WP cron every ${want} min, which SpinupWP's API doesn't offer` })
+    } else {
+      await step(`WP cron every ${want} min`, async () => [(have == null ? await client.enableWpCron(destSiteId, want) : await client.updateWpCron(destSiteId, want)).event_id])
+    }
+  }
+
+  result.basicAuthMissing = !!src.basic_auth?.enabled && !dst.basic_auth?.enabled
+  return result
+}

package/src/lib/serverClone.ts

@@ -757,6 +757,10 @@ export interface CrontabSyncResult {
   ok: boolean
   added: string[] // the lines appended to the dest crontab (empty = nothing to carry)
   error?: string
+  // SpinupWP's server-level WP cron on each end, in minutes (see wpCronInterval):
+  // null = no managed WP cron job, undefined = that crontab wasn't read.
+  sourceWpCron?: number | null
+  destWpCron?: number | null
 }
 
 // The owner-added lines of a crontab: everything except SpinupWP's `#Ansible:`
@@ -778,6 +782,27 @@ export function ownerCrontabLines(crontab: string): string[] {
   return out
 }
 
+// The interval, in minutes, of SpinupWP's managed WP cron job — the line after the
+// `#Ansible:` marker. The API doesn't report it, so the crontab is the only place
+// to read it. SpinupWP staggers the start minute per site, so every-5 is written
+// "4,9,14,…,59 * * * *": the gap between the first two minutes is the interval, a
+// single minute is hourly, "*" every minute. null = no managed WP cron job (or one
+// in a shape we don't recognize). Exported for the test harness.
+export function wpCronInterval(crontab: string): number | null {
+  const lines = crontab.split("\n").map((l) => l.replace(/\r$/, ""))
+  const at = lines.findIndex((l) => /^#Ansible:/.test(l))
+  const job = at >= 0 ? lines[at + 1] : undefined
+  if (!job || !/wp cron event run/.test(job)) return null
+  const [minute, hour] = job.trim().split(/\s+/)
+  if (hour !== "*" || !minute) return null
+  if (minute === "*") return 1
+  const step = minute.match(/^\*\/(\d+)$/)
+  if (step) return Number(step[1])
+  const mins = minute.split(",").map(Number)
+  if (mins.some((m) => !Number.isInteger(m))) return null
+  return mins.length === 1 ? 60 : mins[1]! - mins[0]!
+}
+
 const envName = (line: string): string | null => line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)\s*=/)?.[1] ?? null
 
 export async function syncCrontab(
@@ -796,15 +821,18 @@ export async function syncCrontab(
   const src = await read(source, spec.sourceSiteUser)
   if (!src.ok) return { ok: false, added: [], error: src.stderr.trim() || "couldn't read the source crontab" }
   const wanted = ownerCrontabLines(src.stdout)
-  if (wanted.length === 0) return { ok: true, added: [] }
+  const sourceWpCron = wpCronInterval(src.stdout)
 
+  // Read even when there's nothing to append: the caller compares WP cron intervals.
   const dst = await read(dest, spec.destSiteUser)
-  if (!dst.ok) return { ok: false, added: [], error: dst.stderr.trim() || "couldn't read the destination crontab" }
+  if (!dst.ok) return { ok: false, added: [], error: dst.stderr.trim() || "couldn't read the destination crontab", sourceWpCron }
+  const destWpCron = wpCronInterval(dst.stdout)
+  if (wanted.length === 0) return { ok: true, added: [], sourceWpCron, destWpCron }
   const have = new Set(dst.stdout.split("\n").map((l) => l.replace(/\r$/, "")))
   const haveEnv = new Set([...have].map(envName).filter((n): n is string => n != null))
   // An env line the dest already sets (SpinupWP's own PATH, typically) stays the dest's.
   const added = wanted.filter((l) => !have.has(l) && !(envName(l) && haveEnv.has(envName(l)!)))
-  if (added.length === 0) return { ok: true, added: [] }
+  if (added.length === 0) return { ok: true, added: [], sourceWpCron, destWpCron }
 
   const block = ["", `# Carried over from ${source.server.name} by the SpinupTUI clone`, ...added].join("\n") + "\n"
   const b64 = Buffer.from(block).toString("base64")
@@ -812,8 +840,8 @@ export async function syncCrontab(
   const t0 = Date.now()
   const w = await exec(dest, script, 30_000)
   onExec?.({ domain: spec.domain, stage: "config", host: dest.server.name, ok: w.ok, code: w.code, ms: Date.now() - t0, script, stdout: w.stdout, stderr: w.stderr })
-  if (!w.ok) return { ok: false, added: [], error: w.stderr.trim() || "couldn't write the destination crontab" }
-  return { ok: true, added }
+  if (!w.ok) return { ok: false, added: [], error: w.stderr.trim() || "couldn't write the destination crontab", sourceWpCron, destWpCron }
+  return { ok: true, added, sourceWpCron, destWpCron }
 }
 
 // ---- Files-only pull chain (non-WP sites: redirect shells, static/PHP sites) --

package/src/lib/sshExecPolicy.ts

@@ -8,13 +8,6 @@ const DANGEROUS_PATTERNS: RegExp[] = [
   /\b(rm|mv|chmod|chown|reboot|shutdown|kill|truncate)\b/i,
   /systemctl\s+(restart|stop|reload)\b/i,
   /service\s+\S+\s+restart\b/i,
-  /wp\s+plugin\s+(activate|deactivate|install|update|delete)\b/i,
-  /wp\s+theme\s+(activate|delete|install)\b/i,
-  /wp\s+db\s+(query|import|reset)\b/i,
-  /wp\s+option\s+(update|delete|add)\b/i,
-  /wp\s+user\b/i,
-  /wp\s+core\s+(update|install)\b/i,
-  /wp\s+(rewrite\s+flush|cache\s+flush)\b/i,
   /crontab\s+-[re]\b/i,
   /sed\s+-i\b/i,
   /\b(DROP\s+TABLE|INSERT\s+INTO|DELETE\s+FROM)\b/i,
@@ -32,12 +25,131 @@ function hasUnsafeRedirect(cmd: string): boolean {
   return />/.test(stripped)
 }
 
+// redis-cli has a verb grammar a deny-list can't enumerate (CONFIG SET, FLUSHALL,
+// CLIENT PAUSE, plain SET/DEL/EXPIRE, …), and generic patterns like /\bset\b/
+// would collide with awk in ordinary log analysis. So it is allowlisted instead:
+// every redis-cli in the command must name a known read, and anything else is
+// denied — an unknown verb, an unknown flag (--pipe, --eval, --rdb, --cluster and
+// --lru-test all write), or no verb at all (bare redis-cli takes commands on stdin).
+// Deliberately left out though read-only: KEYS and MONITOR (both can stall a busy
+// instance) and GET (dumps cached values into the log).
+const REDIS_READ_VERBS = new Set([
+  "ping", "info", "dbsize", "lastsave", "time", "role",
+  "scan", "type", "ttl", "pttl", "exists", "strlen",
+])
+const REDIS_READ_SUBVERBS: Record<string, Set<string>> = {
+  config: new Set(["get"]),
+  memory: new Set(["doctor", "stats", "usage", "malloc-stats"]),
+  latency: new Set(["latest", "history", "doctor"]),
+  slowlog: new Set(["get", "len"]),
+  client: new Set(["list", "info"]),
+}
+const REDIS_VALUE_FLAGS = new Set(["-h", "-p", "-s", "-a", "-n", "-u", "--user", "--pass"])
+const REDIS_BARE_FLAGS = new Set(["--no-auth-warning", "--raw", "--no-raw", "--tls", "-c", "-e", "-2", "-3"])
+
+// Shared by the per-tool allowlists below. A segment is what follows the tool
+// name up to the next shell operator.
+const SEGMENT = "([^|;&()`<>\\n]*)"
+// Drop a quote pair around a token, and a stray closing quote left by an
+// enclosing `ssh host '…'` / `bash -c "…"`.
+const clean = (t: string) => t.replace(/^(['"])(.*)\1$/, "$2").replace(/['"]+$/, "").toLowerCase()
+// A token that opens a quote it doesn't close (`-a 'pw ping' flushall`) would
+// shift which later token we read as the verb.
+const hasOpenQuote = (t: string) => /['"]/.test(t) && !/^[^'"]*(['"])[^'"]*\1$/.test(t)
+
+// Returns why the command is unsafe, or null. Looks at every `redis-cli` in the
+// string, wherever it appears — including inside `bash -c '…'`, `sudo`, `xargs`,
+// or a grep pattern — so a mention that isn't an invocation (`which redis-cli`)
+// is denied too; that is the price of not having to recognise command position.
+function unsafeRedisCli(cmd: string): string | null {
+  for (const m of cmd.matchAll(new RegExp(`\\bredis-cli\\b${SEGMENT}`, "g"))) {
+    const tokens = (m[1] ?? "").trim().split(/\s+/).filter(Boolean)
+    if (tokens.length === 1 && /^(-v|--version)$/.test(clean(tokens[0]!))) continue
+    let i = 0
+    for (; i < tokens.length; i++) {
+      const flag = clean(tokens[i]!)
+      if (!flag.startsWith("-")) break
+      if (REDIS_BARE_FLAGS.has(flag)) continue
+      if (!REDIS_VALUE_FLAGS.has(flag)) return `redis-cli option \`${flag}\` is not on the read-only allowlist`
+      if (hasOpenQuote(tokens[++i] ?? "")) return "redis-cli option value has quoting this guard can't read safely"
+    }
+    const verb = clean(tokens[i] ?? "")
+    if (!verb) return "redis-cli with no command reads commands from stdin"
+    if (REDIS_READ_VERBS.has(verb)) continue
+    const sub = clean(tokens[i + 1] ?? "")
+    if (REDIS_READ_SUBVERBS[verb]?.has(sub)) continue
+    return `redis-cli \`${[verb, sub].filter(Boolean).join(" ")}\` is not on the read-only allowlist`
+  }
+  return null
+}
+
+// WP-CLI gets the same treatment: the deny patterns this replaces listed a dozen
+// writes and missed the rest (`transient delete`, `search-replace`, `eval`, …),
+// while blanket-denying reads like `wp user list`. Each entry is a full command
+// path. Left out on purpose: `db query`/`eval`/`shell` (arbitrary SQL or PHP),
+// `db export` (writes a file), `config get|list` (prints the DB password) and
+// `cron test` (spawns a cron run).
+const WP_READ_COMMANDS = new Set([
+  "core version", "core is-installed", "core verify-checksums", "core check-update",
+  "plugin list", "plugin get", "plugin status", "plugin is-active", "plugin is-installed", "plugin path", "plugin verify-checksums",
+  "theme list", "theme get", "theme status", "theme is-active", "theme is-installed", "theme path",
+  "option get", "option list", "transient get", "transient list", "cache type",
+  "user list", "user get", "user list-caps", "role list", "cap list",
+  "post list", "post get", "site list", "rewrite list",
+  "cron event list", "cron schedule list",
+  "db size", "db tables", "db prefix", "db check",
+  "config path", "config has", "maintenance-mode status", "maintenance-mode is-active",
+  "cli version", "cli info", "cli check-update",
+  "doctor list", "doctor check", "profile stage", "profile hook",
+])
+// Global flags that run code or send the command somewhere else. Per-command
+// flags (--format, --field, --status, …) are too many to allowlist.
+const WP_UNSAFE_FLAGS = /(^|\s)['"]?--(exec|require|ssh|http)\b/
+
+// Unlike redis-cli, `wp` is only treated as an invocation when it stands alone
+// and is followed by a word — a bare `wp` just prints help, and this keeps paths
+// (`wp-content`, Bedrock's `web/wp`) from tripping it.
+function unsafeWpCli(cmd: string): string | null {
+  // `wp 2>/dev/null plugin delete x` must not end the segment at the redirect.
+  const stripped = cmd.replace(/\d?>{1,2}\s*(\/dev\/null\b|&\d+)/g, "")
+  for (const m of stripped.matchAll(new RegExp(`(?<![\\w.$-])wp(?:-cli\\.phar)?(?=\\s)${SEGMENT}(.?)`, "gs"))) {
+    const segment = m[1] ?? ""
+    if (WP_UNSAFE_FLAGS.test(segment)) return "wp --exec/--require/--ssh/--http can run code or target another host"
+    const tokens = segment.trim().split(/\s+/).filter(Boolean)
+    let i = 0
+    for (; i < tokens.length && tokens[i]!.replace(/^['"]/, "").startsWith("-"); i++) {
+      if (hasOpenQuote(tokens[i]!)) return "wp option value has quoting this guard can't read safely"
+    }
+    const words: string[] = []
+    for (; i < tokens.length && words.length < 3; i++) {
+      const word = clean(tokens[i]!)
+      if (word.startsWith("-")) break
+      if (word) words.push(word)
+    }
+    if (words.length === 0) {
+      // `wp </dev/stdin plugin delete` — the command sits past a redirect we stopped at.
+      if (m[2] === "<" || m[2] === ">") return "wp followed by a redirect hides its command from this guard"
+      continue
+    }
+    if ([3, 2].some((n) => words.length >= n && WP_READ_COMMANDS.has(words.slice(0, n).join(" ")))) continue
+    return `wp \`${words.slice(0, 2).join(" ")}\` is not on the read-only allowlist`
+  }
+  return null
+}
+
 export interface SshCommandVerdict {
   decision: "allow" | "deny"
   reason: string
 }
 
 export function classifySshCommand(cmd: string): SshCommandVerdict {
+  const unsafeTool = unsafeRedisCli(cmd) ?? unsafeWpCli(cmd)
+  if (unsafeTool) {
+    return {
+      decision: "deny",
+      reason: `${unsafeTool} — spinuptui ssh-exec only runs read-only diagnostic commands.`,
+    }
+  }
   if (DANGEROUS_PATTERNS.some((re) => re.test(cmd)) || hasUnsafeRedirect(cmd)) {
     return {
       decision: "deny",

package/src/ui/Help.tsx

@@ -129,6 +129,24 @@ function SectionBlock({ section }: { section: Section }) {
   )
 }
 
+// Greedy word wrap for a shell command, so a line never breaks inside a flag.
+// Continuation lines are indented two columns by the caller, hence `width - 2`.
+function wrapAtSpaces(text: string, width: number): string[] {
+  const lines: string[] = []
+  let cur = ""
+  for (const word of text.split(" ")) {
+    const limit = lines.length === 0 ? width : width - 2
+    if (cur && cur.length + 1 + word.length > limit) {
+      lines.push(cur)
+      cur = word
+    } else {
+      cur = cur ? `${cur} ${word}` : word
+    }
+  }
+  if (cur) lines.push(cur)
+  return lines
+}
+
 function ShortcutColumn({ sections, width }: { sections: Section[]; width: number }) {
   return (
     <box style={{ flexDirection: "column", width, flexShrink: 0 }}>
@@ -194,7 +212,11 @@ function AboutColumn({
       {installChannel() !== "git" ? (
         <>
           {line("Manual:")}
-          {line(updateCommand() ?? "", theme.text)}
+          {/* Broken at spaces by hand: the package command is wider than the
+              About column, and OpenTUI's own wrap splits "--no-cache" at its hyphen. */}
+          {wrapAtSpaces(updateCommand() ?? "", width).map((l, i) => (
+            <text key={i} content={i === 0 ? l : `  ${l}`} fg={theme.text} wrapMode="none" />
+          ))}
         </>
       ) : (
         <>