[fredrikekelund]

Related issues

• Related to the paused pull-reprint project (still hidden behind STUDIO_ENABLE_PULL_REPRINT)

How AI was used in this PR

Claude Code made the changes, ran the checks and drove manual pulls against a WordPress.com staging site. I steered the scope, the module split and the cleanup of comments and tests, and reviewed the diff.

Proposed Changes

Reprint has switched from HMAC shared secrets to public-key authentication. From v0.11 on, hosts with the openssl extension, which every Atomic site has, only accept signed requests, so the current pull-reprint can't authenticate against WordPress.com or Pressable sites at all.

• Bundles Reprint v0.11.3.
• Before a pull, Studio checks whether Reprint has a key stored for the remote. If none exists, it generates one with reprint keygen and installs the public key on the site through Jetpack's new jetpack/v4/reprint/install-public-key endpoint. Reprint then finds the private key on its own, so Studio never handles credentials.
• Drops the secret-based flow, the wpcomsh/v1 fallback and support for older Jetpack versions. The site config no longer stores a Reprint secret.
• If Jetpack on the site is too old to have the endpoint, the user is told to update Jetpack.
• Splits pull-reprint.ts into smaller modules (source resolution, session paths, selection, the pulled-site server) and shortens comments. No behavior changes there.

Depends on Jetpack 16.4, which isn't released yet. Until then, the remote site needs Jetpack trunk.

One key per site: Jetpack stores a single key per site, so a pull from another machine (or another local site) pulling the same remote replaces this machine's key. When the site rejects the stored key, Studio reinstalls it and retries the command once, so pulls that take turns keep working. Two pulls running at the same time can still interrupt each other; supporting several keys per site in Jetpack would fix that and is deferred.

Testing Instructions

You need a WordPress.com or Pressable site running Jetpack trunk.

1. npm run cli:build && node apps/cli/dist/cli/main.mjs auth login
2. STUDIO_ENABLE_PULL_REPRINT=1 node apps/cli/dist/cli/main.mjs pull-reprint <site-url>. Check that a key is generated and installed, and that the site pulls and starts.
3. Run the pull again. It should reuse the stored key and do a delta pull.
4. Delete key.pem under the pull's state dir (~/.studio/pulls/<id>/state/remotes/*/) and pull again. A new key should be generated and installed.
5. Try --only plugins/<slug>, both on an existing pulled site and on a first pull into a new one.

Pre-merge Checklist

• Have you checked for TypeScript, React or other console errors?

🤖 Generated with Claude Code