spinuptui 1.2.0-alpha.1 → 1.2.1

package/CHANGELOG.md

@@ -11,17 +11,16 @@ version; such changes are called out here.
 
 ## [Unreleased]
 
-## [1.2.0-alpha.1] - 2026-10-17
+## [1.2.1] - 2026-10-27
 
-A pre-release, published on npm's `next` tag (`bun add -g spinuptui@next --no-cache`). `@latest` and Homebrew stay on 1.1.2. The stable 1.2.0 will roll these notes up with the next modules.
+### Fixed
+- **WordPress versions no longer go stale.** The version shown for a site was read once, when the site was first identified, and never again, so sites updated outside SpinupTUI (auto-updates, wp-admin, deploys) kept showing the old version, and `r` didn't help. Versions older than a day are now re-checked in the background when the site list loads, one site at a time per server, stopping at a server's first failure so unattended SSH can't trip fail2ban. A reading that couldn't be refreshed shows its age in the Stacks list, and the Details pane always says when it was taken.
+- **`w` opens the site or server you picked, not the SpinupWP dashboard.** Deep links need the account slug, which SpinupWP's API doesn't provide and first-run setup never asked for, so unless you had added `accountSlug` to `config.json` by hand, `w` quietly fell back to the dashboard. Now `w` asks for the slug the first time it needs it (pasting any dashboard URL works), saves it to the current account and opens the right page. First-run setup also asks for it, as an optional step after the token.
 
-### Added
-- **Beacon: `spinuptui beacon send` pages you on Telegram.** One command any script, cron job or agent can use instead of its own `curl` to the Telegram API. Messages go out as plain text with link previews off; anything over Telegram's 4096-character limit is split into numbered parts instead of being rejected; sends are retried (honoring Telegram's rate-limit hints) and logged. Exit codes tell a caller what happened: `0` delivered, `1` not configured (nothing attempted), `2` delivery failed. No Telegram bot yet? `spinuptui beacon setup` walks you through making one with @BotFather, checks the token, and finds your chat by itself once you message the bot. No digging for a chat ID. It saves nothing until a test message has arrived. Scripts can use `spinuptui beacon add telegram <name> --env-file <path>` instead. `beacon test`, `beacon status` and `beacon remove` round it out. See [docs/beacon.md](docs/beacon.md).
-- **A Modules tab (`6`).** Everything SpinupTUI can keep doing after you close it, with its status on this machine and set up from the same place: select Beacon and press `⏎` for the guided Telegram setup, or `t` for a test page. Modules still on the way (Scheduler, Sentinel, Samurai) are listed as coming soon.
-- **`spinuptui modules`** lists SpinupTUI's modules (the features that keep working after the TUI is closed) and their status. Beacon is the first; the module contract is in [docs/2026-10-16_beacon-and-module-contract-spec.md](docs/2026-10-16_beacon-and-module-contract-spec.md).
+## [1.2.0] - 2026-10-21
 
-### Fixed
-- **The update hint understands pre-releases.** Someone running a pre-release (say `1.2.0-alpha.1`) is now told when the matching stable release ships; before, the two counted as the same version.
+### Added
+- **Take a server's sites offline, and bring them back.** For a vulnerability you can't patch yet: `spinuptui offline <server>… --yes` (or **Take all sites offline** in the `a` menu) disables every site on the server through SpinupWP, so nginx stops answering for them and no request reaches PHP. Files, databases and certificates are untouched. `spinuptui online <server>… --yes` re-enables exactly the sites it took down, never one disabled for another reason, and a re-run finishes anything that failed. Without `--yes` both print the plan. One site at a time works too: `O` on a site, or `--site <domain>` on either command; the confirmation says how many other sites on its server stay up, since PHP is shared. Uptime Kuma monitors for those sites sit in a maintenance window until they're back, and offline servers are flagged `⏻ off` in the Servers list and on the Overview. See [docs/taking-sites-offline.md](docs/taking-sites-offline.md).
 
 ## [1.1.2] - 2026-10-15
 
@@ -1497,8 +1496,9 @@ Initial tagged release.
 ### Notes
 - Read-only release: works with a SpinupWP **Read Only** API token.
 
-[Unreleased]: https://github.com/mwender/spinupwp-tui/compare/v1.2.0-alpha.1...HEAD
-[1.2.0-alpha.1]: https://github.com/mwender/spinupwp-tui/compare/v1.1.2...v1.2.0-alpha.1
+[Unreleased]: https://github.com/mwender/spinupwp-tui/compare/v1.2.1...HEAD
+[1.2.1]: https://github.com/mwender/spinupwp-tui/compare/v1.2.0...v1.2.1
+[1.2.0]: https://github.com/mwender/spinupwp-tui/compare/v1.1.2...v1.2.0
 [1.1.2]: https://github.com/mwender/spinupwp-tui/compare/v1.1.1...v1.1.2
 [1.1.1]: https://github.com/mwender/spinupwp-tui/compare/v1.1.0...v1.1.1
 [1.1.0]: https://github.com/mwender/spinupwp-tui/compare/v1.0.0...v1.1.0

package/README.md

@@ -60,6 +60,7 @@
 - **Purge cache** (`P`) — clear page + object cache together.
 - **Server actions** (`a`) — reboot or restart a service, with the real reason a
   reboot is pending. → [docs/server-actions.md](docs/server-actions.md)
+- **Take sites offline** (`a` for a whole server, `O` for one site, or `spinuptui offline`) — for a vulnerability you can't patch yet: nginx stops answering for those sites, so no request reaches PHP through them. Bringing them back re-enables exactly those sites, and Uptime Kuma stays quiet meanwhile. → [docs/taking-sites-offline.md](docs/taking-sites-offline.md)
 - **Create & connect a server** (`c` / `V`) — provision a server, then wire it up
   end-to-end (DNS, a vanity site, HTTPS, SSH-key handoff).
   → [docs/creating-connecting-servers.md](docs/creating-connecting-servers.md)
@@ -76,11 +77,6 @@
   register/recalibrate/remove it — plus a cache/outage doctor and alert
   wiring. → [docs/site-monitoring.md](docs/site-monitoring.md) ·
   [docs/uptime-kuma.md](docs/uptime-kuma.md)
-- **Modules** (`6`, pre-release: `bun add -g spinuptui@next --no-cache`) — the parts of SpinupTUI that keep working after you close it,
-  each set up from the same screen. First up, **Beacon**: `spinuptui beacon send`
-  pages you on Telegram from any cron job, watcher or agent, with retries, long
-  messages split instead of dropped, and a send log. A guided setup creates the
-  bot connection for you. → [docs/beacon.md](docs/beacon.md)
 - **Non-interactive CLI subcommands for external tooling** — `spinuptui ssh <domain>`
   resolves a domain to a live SSH target with a live connectivity probe;
   `spinuptui ssh-exec <domain> -- <command>` runs a command over SSH, but only
@@ -309,8 +305,9 @@ These can be set in `config.json` or via an environment variable:
 - **`accountSlug`** / `SPINUPWP_ACCOUNT_SLUG` — your SpinupWP account/team slug
   (the first path segment in a SpinupWP URL, e.g. `acme-agency` in
   `https://spinupwp.app/acme-agency/servers/12345`). The API
-  doesn't expose it, so set it to enable the `w` deep links into the web app.
-  Without it, `w` opens the SpinupWP dashboard root.
+  doesn't expose it, so it's needed for the `w` deep links into the web app.
+  You don't have to set it by hand: first-run setup asks for it (optional), and
+  `w` asks the first time it's needed, then saves it to the current account.
 - **`sshUser`** / `SPINUPWP_SSH_USER` — override the SSH user for the health view
   and stack probes (see "Server health" below).
 - **`localSync`** / `SPINUPWP_LOCAL_SYNC` — opt-in for the **Pull production →
@@ -338,7 +335,7 @@ These can be set in `config.json` or via an environment variable:
 
 | Key | Action |
 | --- | --- |
-| `1`…`6` | Switch tabs: Dashboard · Servers · Stacks · Search · Events · Modules |
+| `1`…`5` | Switch tabs: Dashboard · Servers · Stacks · Search · Events |
 | `↑`/`↓` or `j`/`k` | Move selection |
 | `Enter` / `→` | Drill in (server → its sites) |
 | `←` / `Esc` | Go back / collapse |
@@ -374,8 +371,6 @@ These can be set in `config.json` or via an environment variable:
 | `w` | Open the selected server/site in the SpinupWP web app |
 | `/` | Jump to global search |
 | `A` | Accounts — switch, add, rename, or remove SpinupWP accounts (from anywhere) |
-| `⏎` / `s` | Set up the selected module — Beacon opens its guided Telegram setup (Modules tab) |
-| `t` | Send a test page through Beacon (Modules tab, once Beacon is set up) |
 | `r` | Refresh data from the API |
 | `i` | Explain the current screen (what each pane and key does) |
 | `?` | Toggle the help overlay |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spinuptui",
-  "version": "1.2.0-alpha.1",
+  "version": "1.2.1",
   "description": "SpinupTUI — a terminal dashboard for browsing, monitoring, and managing your SpinupWP servers and sites.",
   "type": "module",
   "bin": {

package/src/api/client.ts

@@ -109,6 +109,8 @@ export interface SpinupWPClientLike {
   upgradeSitePhp(siteId: number, phpVersion: string): Promise<{ event_id: number }>
   rebootServer(serverId: number): Promise<{ event_id: number }>
   restartService(serverId: number, service: ServerService): Promise<{ event_id: number }>
+  disableSite(siteId: number): Promise<{ event_id: number }>
+  enableSite(siteId: number): Promise<{ event_id: number }>
 }
 
 const MAX_PAGES = 100 // hard safety cap when auto-paginating
@@ -482,4 +484,17 @@ export class SpinupWPClient implements SpinupWPClientLike {
   restartService(serverId: number, service: ServerService): Promise<{ event_id: number }> {
     return this.mutate<{ event_id: number }>(`/servers/${serverId}/services/${service}/restart`, "POST")
   }
+
+  // Take a site offline without touching its files, database or certificate.
+  // Verified on a test box: nginx drops the site's server block, so port 80
+  // returns an empty reply and 443 fails the TLS handshake — no request reaches
+  // PHP. The site's PHP-FPM pool and cron stay in place. Async → event_id.
+  disableSite(siteId: number): Promise<{ event_id: number }> {
+    return this.mutate<{ event_id: number }>(`/sites/${siteId}/disable`, "POST")
+  }
+
+  // Undo disableSite: the site serves traffic again exactly as before.
+  enableSite(siteId: number): Promise<{ event_id: number }> {
+    return this.mutate<{ event_id: number }>(`/sites/${siteId}/enable`, "POST")
+  }
 }

package/src/api/types.ts

@@ -120,6 +120,9 @@ export interface Site {
   } | null
   basic_auth?: { enabled: boolean; username?: string | null } | null
   subdomain?: { enabled: boolean; url: string | null } | null
+  // Set while the site is disabled (POST /sites/{id}/disable): nginx stops
+  // serving every domain on it, so no request reaches PHP. Null when live.
+  disabled_at?: string | null
   created_at: string
   status: string
 }

package/src/config.ts

@@ -103,27 +103,6 @@ export interface AppConfig {
   // running version with no notes shown — nothing meaningful to announce). A
   // mismatch against the running version is what triggers the overlay.
   lastSeenVersion: string | null
-  // Beacon's notification channels (see lib/beacon.ts and
-  // docs/2026-10-16_beacon-and-module-contract-spec.md). Machine-level like the
-  // Kuma login: one operator's pager serves every account. Holds bot tokens, so
-  // it relies on the file's 600 mode. The env channel (SPINUPTUI_BEACON_*) is
-  // resolved in lib/beacon.ts, not here, so this is only what's stored.
-  beacon: BeaconStored | null
-}
-
-export interface BeaconTelegramChannel {
-  type: "telegram"
-  botToken: string
-  chatId: string
-}
-
-// A union so later transports (Slack, ntfy, a client-facing Basecamp channel)
-// are additive.
-export type BeaconChannel = BeaconTelegramChannel
-
-export interface BeaconStored {
-  defaultChannel?: string
-  channels?: Record<string, BeaconChannel>
 }
 
 export interface ServerProviderRef {
@@ -223,7 +202,6 @@ export interface StoredConfig {
   uptimeKuma?: UptimeKumaConn
   kumaMonitors?: Record<string, KumaMonitorRef>
   lastSeenVersion?: string
-  beacon?: BeaconStored
 }
 
 // ---- Accounts (profiles) -------------------------------------------------------
@@ -509,7 +487,6 @@ export function loadConfig(): AppConfig {
     })(),
     kumaMonitors: stored.kumaMonitors ?? {},
     lastSeenVersion: stored.lastSeenVersion?.trim() || null,
-    beacon: stored.beacon ?? null,
   }
 }
 

package/src/dev/mockClient.ts

@@ -45,6 +45,16 @@ export function createMockClient(): SpinupWPClientLike {
   let nextEventId = nextIdAfter(events, 9100)
   const eventPolls = new Map<number, number>()
 
+  function advance(e: Event): void {
+    if (e.status !== "running") return
+    const polls = (eventPolls.get(e.id) ?? 0) + 1
+    eventPolls.set(e.id, polls)
+    if (polls >= EVENT_POLLS_BEFORE_DONE) {
+      e.status = "deployed"
+      e.finished_at = new Date().toISOString()
+    }
+  }
+
   function pushEvent(name: string, serverId: number | null, output: string): number {
     const id = nextEventId++
     const now = new Date().toISOString()
@@ -230,20 +240,19 @@ export function createMockClient(): SpinupWPClientLike {
       return { event_id }
     },
 
+    // Reading an event (singly or in the list) counts as a poll, so callers
+    // that batch-check via listEvents see events finish too.
     async listEvents(maxPages) {
       const limit = (maxPages ?? 3) * 100
-      return events.slice(0, limit).map((e) => ({ ...e }))
+      const page = events.slice(0, limit)
+      for (const e of page) advance(e)
+      return page.map((e) => ({ ...e }))
     },
 
     async getEvent(id) {
       const found = events.find((e) => e.id === id)
       if (!found) throw new Error(`dev mode: no such event ${id}`)
-      const polls = (eventPolls.get(id) ?? 0) + 1
-      eventPolls.set(id, polls)
-      if (polls >= EVENT_POLLS_BEFORE_DONE && found.status === "running") {
-        found.status = "deployed"
-        found.finished_at = new Date().toISOString()
-      }
+      advance(found)
       return { ...found }
     },
 
@@ -266,5 +275,19 @@ export function createMockClient(): SpinupWPClientLike {
       const event_id = pushEvent(`server.service.${service}.restarted`, serverId, `${service} restarted on ${server?.name ?? serverId}`)
       return { event_id }
     },
+
+    async disableSite(siteId) {
+      const site = sites.find((s) => s.id === siteId)
+      if (site) site.disabled_at = new Date().toISOString()
+      const event_id = pushEvent("site.disabled", site?.server_id ?? null, `Disabling ${site?.domain ?? siteId}`)
+      return { event_id }
+    },
+
+    async enableSite(siteId) {
+      const site = sites.find((s) => s.id === siteId)
+      if (site) site.disabled_at = null
+      const event_id = pushEvent("site.enabled", site?.server_id ?? null, `Enabling ${site?.domain ?? siteId}`)
+      return { event_id }
+    },
   }
 }

package/src/index.tsx

@@ -23,7 +23,7 @@ import { resolveIncidents } from "./lib/cliIncidents.ts"
 import { resolveSiblings } from "./lib/cliSiblings.ts"
 import { execSshCommand } from "./lib/sshExec.ts"
 import { runPullFiles, runPullDb } from "./lib/cliPull.ts"
-import { runBeacon, runModules } from "./lib/cliBeacon.ts"
+import { runOffline, runOnline } from "./lib/cliOffline.ts"
 
 const args = process.argv.slice(2)
 const positionals = args.filter((a) => !a.startsWith("-"))
@@ -90,17 +90,18 @@ Usage:
                        Import production's database into the linked local copy,
                        rewriting URLs. OVERWRITES your local database: needs
                        both --yes and "localSync": true in the config.
-  spinuptui beacon setup  Guided Telegram setup: make a bot, find your chat,
-                       send a test (interactive; also in the app's Modules tab, 6)
-  spinuptui beacon send [--to <channel>] [--silent] [<message> | -]
-                       Page yourself through Beacon (Telegram). Reads the
-                       message from stdin when it's \`-\` or absent. Exit 0 sent,
-                       1 not configured / usage, 2 delivery failed.
-  spinuptui beacon add telegram <name> --env-file <path> [--default]
-                       Add a channel from a file holding TELEGRAM_BOT_TOKEN and
-                       TELEGRAM_CHAT_ID; sends a test message before saving.
-  spinuptui beacon test | status | remove <name>
-  spinuptui modules    List SpinupTUI's modules and their status (--json)
+  spinuptui offline    List servers with sites offline (--json)
+  spinuptui offline <server>… | --all --yes
+                       Take every site on those servers offline: nginx stops
+                       answering, so no request reaches PHP. Files, databases
+                       and certificates are untouched. Without --yes, prints
+                       the plan and changes nothing.
+  spinuptui offline --site <domain> [--server <name>] --yes
+                       Just that site. Its server's other sites (and PHP) stay
+                       up, so this protects the site, not the server.
+  spinuptui online <server>… | --all | --site <domain> --yes
+                       Bring back exactly the sites \`offline\` took down.
+                       Servers are matched by exact name, IP or id.
   spinuptui --version  Print the version
   spinuptui --help     Show this help
 
@@ -284,12 +285,12 @@ if (command === "pull") {
   process.exit(result.ok ? 0 : 1)
 }
 
-if (command === "beacon") {
-  process.exit(await runBeacon(args.slice(args.indexOf("beacon") + 1)))
+if (command === "offline") {
+  process.exit(await runOffline(args.slice(args.indexOf("offline") + 1)))
 }
 
-if (command === "modules") {
-  process.exit(await runModules(args.slice(1)))
+if (command === "online") {
+  process.exit(await runOnline(args.slice(args.indexOf("online") + 1)))
 }
 
 // `spinuptui login` forces the onboarding wizard even when a token already exists,

package/src/lib/appUpdate.ts

@@ -35,47 +35,21 @@ function cachePath(): string {
   return join(configDir(), "update-check.json")
 }
 
-// Parse "v1.2.3" / "1.2.3" / "1.2.3-alpha.1" → numbers + pre-release tag; null
-// when it doesn't look like a version.
-function parseVersion(s: string): { nums: [number, number, number]; pre: string | null } | null {
-  const m = s.trim().replace(/^v/i, "").match(/^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?/)
-  return m ? { nums: [Number(m[1]), Number(m[2]), Number(m[3])], pre: m[4] ?? null } : null
-}
-
-// SemVer pre-release precedence: dot-separated identifiers compared left to
-// right, numeric ones numerically and below alphanumeric ones; a shorter set of
-// otherwise-equal identifiers sorts first.
-function comparePre(a: string, b: string): number {
-  const x = a.split(".")
-  const y = b.split(".")
-  for (let i = 0; i < Math.max(x.length, y.length); i++) {
-    if (x[i] === undefined) return -1
-    if (y[i] === undefined) return 1
-    const nx = /^\d+$/.test(x[i]!)
-    const ny = /^\d+$/.test(y[i]!)
-    if (nx && ny) {
-      const d = Number(x[i]) - Number(y[i])
-      if (d) return d
-    } else if (nx !== ny) return nx ? -1 : 1
-    else if (x[i] !== y[i]) return x[i]! < y[i]! ? -1 : 1
-  }
-  return 0
+// Parse "v1.2.3" / "1.2.3" → [1,2,3]; null when it doesn't look like a version.
+function parseVersion(s: string): [number, number, number] | null {
+  const m = s.trim().replace(/^v/i, "").match(/^(\d+)\.(\d+)\.(\d+)/)
+  return m ? [Number(m[1]), Number(m[2]), Number(m[3])] : null
 }
 
 // Strictly-newer comparison (latest > current). Unparseable → false (never nag).
-// A release outranks its own pre-releases, so someone on 1.2.0-alpha.1 is told
-// when 1.2.0 ships.
-export function isNewer(latest: string, current: string): boolean {
+function isNewer(latest: string, current: string): boolean {
   const a = parseVersion(latest)
   const b = parseVersion(current)
   if (!a || !b) return false
   for (let i = 0; i < 3; i++) {
-    if (a.nums[i] !== b.nums[i]) return a.nums[i]! > b.nums[i]!
+    if (a[i] !== b[i]) return a[i] > b[i]
   }
-  if (a.pre === b.pre) return false
-  if (a.pre === null) return true
-  if (b.pre === null) return false
-  return comparePre(a.pre, b.pre) > 0
+  return false
 }
 
 function readCache(): CacheFile | null {