Add sync - #18

Plugin

• Repository: https://github.com/lerd-env/plugin-sync
• Commit: 4f95cc8fe6bec79f20f7d893eb9f0f8fe1cc2edc
• Previously approved commit: none, new plugin

What it does

It keeps a Lerd site and the servers it runs on in step over SSH, with one environment per server, such as production and staging. It pulls a server's database into the site's Lerd database after a before-sync-pull snapshot, and the folders users upload into, rewriting a WordPress or Bedrock site's address both ways and, when the user turns it on, running a scrub SQL file that empties personal data from the pulled copy. It pushes the files the user picks, and the database after the environment's name is typed back, backing the server's database up first and putting that backup back if the import fails. Every file a transfer replaces is kept as a backup on the side it was replaced on, and backups and snapshots can be listed, viewed, restored and removed.

What it adds to Lerd

The commands lerd sync:setup, sync:pull, sync:push, sync:status, sync:diff and sync:backups, a Pull from server entry in every site's Commands menu, a Sync site tab (environments, a side by side tree of the project here and on the server, the database and the backups), and the MCP tools sync_pull, sync_status and sync_backups with a skill. Pushing, restoring and removing are left off MCP on purpose.

What it reads, changes and sends

• Reads: on the server, the project's .env or wp-config.php for the database settings, folder listings with find, a file with cat to show it, and the database dump. Locally, the site's wp-config.php or .env only for its database name and table prefix, and the site list from Lerd's API.
• Changes: locally, the site's Lerd database after a snapshot, through lerd db:create, db:snapshot, db:import, db:shell and wp search-replace, the files it pulls, and .lerd/scrub.sql when scrubbing is on. On the server, the files it pushes and, with --db, the database after a backup. Backups go to the plugin's data folder and to ~/.lerd-sync on the server, both readable only by the user. Each side's config files, .lerd/, .lerd.yaml and .git/ are never copied.
• Sends over the network: only to the server the user configures, over the user's own SSH. The database password reaches the server on SSH's input, never on a command line. Nothing else.

Requirements

Node, ssh, diff and rsync 3 or newer on the machine (macOS needs brew install rsync, and the plugin says so when it finds an older one), and a Linux server with rsync and the database's dump tool. lerd: ">=1.38"; the tab's diff and file viewer use lerd.diff and lerd.view from Lerd 1.39 and fall back to plain labels before that. No platforms; it has only been run on Linux so far.

Images

Checklist

• The repository is public and has an open source license.
• The README says what the plugin adds, reads, changes and sends.
• plugin.yaml declares lerd as a lower bound, and platforms if it runs on only one.
• Everything it runs is readable source in the commit, in shell, Python, Node or similar but not PHP: no binaries, no minified code without its source, nothing downloaded and run.
• It asks for no privilege and writes only to its own folder, its data folder and the sites it is run against, changing Lerd only through its API. Its pushes also write to the site's own server, which is the point of it.
• It reads no secrets it has no stated need for, and a site's .env only when the README says why.
• Lerd's token never leaves the machine and is never written outside the plugin's data folder.
• Hooks finish quickly and fail without leaving a site, service or database half changed.
• Nothing leaves the machine without an opt-in the user turns on, and there are no analytics, tracking, ads or mining.
• Any notifications are declared in plugin.yaml and only tell the user something they need to know or act on.
• Pages bundle their own assets, nothing loads from third-party servers, and page scripts talk only to the plugin's own endpoints.
• Any service image comes from a public registry, is pinned to a version tag or a digest, never latest, and is named in the README with its source.
• No service or framework reuses a name Lerd, its stores or another plugin already has.
• The name, description and images describe what it actually does.
• The images show the plugin itself, are mine to publish, and are at most 6, each a PNG, JPEG or WebP under 1 MB and at most 2560 px wide.
• I will acknowledge a reported security problem within 7 days and fix or answer it within 30.