feat: db push prefix-safety + URL remap, sync mirror/webroot, exec shell & MOTD fix

[vikasiwp]

Addresses validated feedback from a real LocalWP → cloud mirror-overwrite workflow (each item was checked against the source and adversarially re-reviewed before implementing).

Changes

Feedback	Change
db push silently accepts a table-prefix mismatch (High, data-safety)	Detects when the dump's prefix ≠ the remote site's $table_prefix; warns loudly and offers to rewrite. --rewrite-prefix remaps the dump's table identifiers (streamed; leaves data values untouched) and, post-import, remaps the prefix-bound role/capability keys ({prefix}capabilities, {prefix}user_level, {prefix}user_roles) so admin login survives. Under --force/--json it warns and proceeds (back-compat).
db push doesn't rewrite URLs	--search-replace <from> <to> runs serialization-safe wp search-replace --all-tables after import.
MOTD leaks into wp/exec stdout	Emits a unique marker before the remote command and slices stdout after it — clean output in both text and --json modes. Exit code unaffected.
exec runs argv with no shell; misleading help	exec --shell '<cmdline>' wraps args in bash -lc (pipes/;/>/globs). Replaced the deceptive -- ps aux | grep php example (which piped locally) and added a metacharacter note.
sync push is additive only	--delete on push/pull (true mirror), confirmation-guarded (--yes to skip, --dry-run to preview); additive stays default; errors clearly on Windows/SFTP.
No transfer outside wp-content	--remote-path <path> / --webroot on sync push/pull.
Inconsistent site identifier	versions create echoes the restore/list hint with the identifier you typed.

Implementation notes

• Pure logic extracted into side-effect-free, directly-testable lib modules: lib/sql-dump.ts (prefix detect/rewrite), lib/remote-command.ts (command build + MOTD slice), and buildRemotePath → lib/paths.ts — matching the existing paths.ts/local-instance.ts pattern.
• The --rewrite-prefix flow reuses the same role/capability-key remap that local push --with-db already does.

Tests

• 27 new unit tests (sql-dump, remote-command, sync-remote-path), tsc clean, help output verified.
• Pre-existing suite failures (sqlite-to-mysql) are environmental — better-sqlite3 built against a different Node version (npm rebuild better-sqlite3), unrelated to this PR.

Deliberately deferred

• exec stdin forwarding — needs a transport redesign (spawnSync's input already owns ssh's stdin to deliver the command); separate, riskier change.
• A narrow --json argv-strip bug in index.ts (a bare --json meant for WP-CLI is stripped globally) — left untouched to keep scope tight.

🤖 Generated with Claude Code

[claude]

Claude encountered an error —— View job

---

I'll analyze this and get back to you.

[claude]

Claude encountered an error —— View job

---

I'll analyze this and get back to you.

[vikasprogrammer]

Re-test update (2026-06-23)

The tester rebuilt from this branch and re-ran against a real LocalWP → cloud mirror-overwrite. 7 of 10 validated fixed, including the High-severity #1 (real push: detected mismatch, rewrote prefix, remapped cap keys, 0 orphan tables) and #6 (235 replacements, 0 residual localhost).

Two new minor findings from the re-test are now fixed in 205f4aa:

• #11 (cosmetic): db push success summary printed rewrote_prefix: [object Object] → now prints wp_ -> iwpa4c7_ and from -> to for search-replace.
• #12: --search-replace rewrote guid (216 of 235 replacements were posts.guid) → now passes --skip-columns=guid (WP best practice); same applied to local push --with-db.

Remaining from the original 10:

• feat: db push prefix-safety + URL remap, sync mirror/webroot, exec shell & MOTD fix #4 (exec stdin streaming) — still open, intentionally deferred. The tester downgraded priority since the main use case (webroot uploads) is solved by feat: db push transport + progress polish (large-DB feedback #13–#15) #5's --webroot. It needs a transport redesign (spawnSync's input already owns ssh's stdin to deliver the command).
• feat: v0.0.1-beta.4 — Local dev, clone, zero-install Windows #2 (MOTD leak) — addressed by design: a unique marker is emitted before the remote command and stdout is sliced after it (works warm or cold, text and --json). The tester couldn't force a cold connection on demand to independently confirm, but the mechanism is cold-path-agnostic.
• #10 — not retested (never deterministically reproducible).

[claude]

Claude encountered an error —— View job

---

I'll analyze this and get back to you.

[claude]

Claude encountered an error —— View job

---

I'll analyze this and get back to you.