wp-stage-syncLive

TL;DR: v0.6.0 turns wp-stage-sync into a true full-WordPress sync tool (not just WooCommerce), adds a --dry-run preview, makes failed imports recoverable, and tightens data fidelity, privacy, and supply-chain security across the board.

This is the biggest release since promote/restore shipped — a focused pass on correctness, safety, and trust. Here's what's new.

🚀 Headline features

Full WordPress sync — with or without WooCommerce.

Previously the tool assumed WooCommerce and would stop on a plain WordPress site. Now it detects WooCommerce automatically: WooCommerce stores get the smart order/customer filtering you know, and everything else gets a fast, complete copy of every table — no order filtering, nothing dropped. If you run plain WordPress, blogs, or brochure sites, wp-stage-sync now just works for you too.

Dry-run preview (-n / --dry-run).

See exactly what a sync would do before touching anything — which tables get exported (with row counts and filter rules), what rsync would transfer, and which WP-CLI commands would run — without writing a single byte. Perfect for sanity-checking a new site or wiring up automation. Works with -s/--site like the rest of the CLI.

🛟 Safer, more reliable syncs

Crash-safe imports. The staging import used to drop every table up front, so a failure mid-import left staging half-wiped. Now existing tables are moved aside first and automatically restored if the import fails — a failed sync no longer destroys your staging database.

Smarter guardrails. The "are live and stage actually the same place?" checks got real teeth: path validation now resolves symlinks, and the database check compares the actual connected server identity instead of just the configured host string — so writing the host two different ways (localhost vs 127.0.0.1) can no longer slip a production database past the guard.

🎯 More faithful copies

A batch of fixes so staging matches production more exactly:

• Comments & product reviews are now synced (previously only WooCommerce order notes came across).

• Generated/virtual columns no longer break the import.

• Binary/blob data is exported as proper hex literals instead of being mangled as text.

• DB passwords with special characters (@ : / ?, quotes, backslashes) now connect and parse correctly.

• Domain rewriting uses your real site URL from the database — not the folder name — and rewrites http://, https://, and protocol-relative (//host) URLs, so public_html/httpdocs setups and mixed-content sites map cleanly.

🔒 Privacy

Anonymization goes deeper. When enabled, it now also masks PII that lived in the HPOS wc_orders record (order email, IP, user-agent, customer note) and in order notes — not just users and addresses. And we've been upfront about its limits: anonymization covers standard WooCommerce/WordPress customer fields, and isn't a guarantee that every plugin's stored PII or secret is scrubbed. Treat staging as sensitive.

🛡️ Supply-chain security

• wp-stage-sync --update now verifies the downloaded binary's SHA-256 against the release checksums before replacing itself.

• The WP-CLI fallback downloads a pinned, hash-verified wp-cli build (stored 0700) instead of trusting whatever it fetched.

• Backup restore now rejects archive paths that would escape the extraction directory (path-traversal hardening).

✨ Polish

• Cleaner unattended output: the progress bar updates a single in-place line per step instead of scrolling dozens of lines — and stays quiet (final state only) when piped to logs/cron.

• First unit tests landed for the guardrail, export-classification, and config-parsing logic.

Upgrade

wp-stage-sync --update

Or grab it fresh:

curl -sSL https://ada.tools/wp-stage-sync/install.sh | bash

Full notes in the CHANGELOG.