From 2ac66a0e142a798f7f88de95829fb3939e1b93a2 Mon Sep 17 00:00:00 2001
From: jared <jaredmswanson@gmail.com>
Date: Thu, 16 Jul 2026 10:54:29 -0400
Subject: [PATCH] vault: session notes 2026-07-16

---
 ...stdin-eval-and-wpengine-gateway-quoting.md | 56 +++++++++++++++++++
 journal/2026-07-16.md                         |  7 +++
 2 files changed, 63 insertions(+)
 create mode 100644 howto/wp-cli-stdin-eval-and-wpengine-gateway-quoting.md

diff --git a/howto/wp-cli-stdin-eval-and-wpengine-gateway-quoting.md b/howto/wp-cli-stdin-eval-and-wpengine-gateway-quoting.md
new file mode 100644
index 0000000..3ae159b
--- /dev/null
+++ b/howto/wp-cli-stdin-eval-and-wpengine-gateway-quoting.md
@@ -0,0 +1,56 @@
+---
+summary: "How to pipe PHP/SQL to wp-cli over the WP Engine SSH gateway — wp eval - does not read stdin (use wp eval-file - with a <?php tag), and the gateway strips one quoting layer off argv, so payloads must ride stdin."
+tags:
+  - type/howto
+  - tool/wp-cli
+  - tool/wpengine
+  - domain/wordpress
+  - client/lento-law
+scope: global
+type: howto
+date: 2026-07-16
+last_updated: 2026-07-16
+source: llf-schema deploy.sh live debugging (verified on both PLD and SDD production gateways)
+---
+
+# wp-cli stdin eval + WP Engine SSH gateway quoting
+
+Two independent behaviors, verified live 2026-07-16 on WP Engine's SSH gateway (wp-cli 2.x phar at `/usr/local/bin/wp`):
+
+## 1. `wp eval -` does NOT read stdin
+
+wp-cli's `eval` command takes its argument as literal PHP code — `-` is not a stdin marker. `wp eval -` evaluates the string `-` and dies with:
+
+```
+Parse error: syntax error, unexpected end of file in ... Eval_Command.php(39) : eval()'d code on line 1
+```
+
+The stdin-capable form is **`wp eval-file -`**, and because the payload is parsed as a *file* (not an eval string) it **must start with `<?php`**:
+
+```bash
+printf '<?php echo get_option("home");' | ssh <site> 'wp eval-file -'
+```
+
+## 2. WP Engine gateway strips one quoting layer from argv
+
+The gateway wraps the ssh command string in an extra `bash -c` evaluation. One layer of quotes/escapes is consumed before the command runs, so argv-embedded PHP/SQL — even `printf %q`-escaped — gets word-split or syntax-errors remotely. Diagnostic signature:
+
+```
+$ ssh pld 'echo "echo 1;" | wp eval -'
+bash: -c: line 1: syntax error near unexpected token `|'
+bash: -c: line 1: `echo echo 1; | wp eval -'    # ← quotes already gone
+```
+
+**Rule: payloads ride stdin, never argv.** Stdin passes through untouched:
+
+```bash
+printf '<?php update_field("field_x", "value", 123);' | ssh pld 'wp eval-file -'
+
+ssh pld 'wp db query --skip-column-names' <<'SQL'
+SELECT post_id, meta_value FROM wp_postmeta WHERE meta_key = 'x';
+SQL
+```
+
+Simple quote-free commands (`wp plugin list`, `cat -`) are unaffected; only quoted/escaped argv payloads break.
+
+Repo-local record: llf-schema `docs/wp-cli-access.md` gotcha A and `scripts/lib/deploy_lib.sh` (`remote_exec_stdin`).
diff --git a/journal/2026-07-16.md b/journal/2026-07-16.md
index 207fe04..55040d5 100644
--- a/journal/2026-07-16.md
+++ b/journal/2026-07-16.md
@@ -2,3 +2,10 @@
 summary: Daily session log
 tags: [scope/global, type/log]
 ---
+
+## Session — 2026-07-16T12:12:27Z
+
+**Project:** /home/jared/dev/cc-os
+**Reason:** prompt_input_exit
+**Vault notes touched:**
+(none)