@dypai-ai/mcp 1.7.1 → 1.7.3

package/src/tools/sync/pull.js

@@ -21,6 +21,7 @@ import { proxyToolCall } from "../proxy.js"
 import { api } from "../../api.js"
 import { serializeEndpoint } from "./codec.js"
 import { dumpPublicSchema } from "./schema-dump.js"
+import { findEndpointNameCollisions } from "./endpoint-names.js"
 // Codegen was removed from v1 — the agent reads dypai/schema.sql + endpoint YAMLs
 // directly instead of relying on auto-generated TS types. The codegen.js file
 // still lives on disk in case we resurface it later with a leaner design.
@@ -660,6 +661,10 @@ export function classifyFlowSourceWrite({ existingContent, remoteContent, clean
   return { action: "write" }
 }
 
+export function shouldSnapshotFlowSourceWrite(writeDecision) {
+  return writeDecision?.action === "write"
+}
+
 function parseMaybeJson(v) {
   if (v == null || typeof v !== "string") return v
   try { return JSON.parse(v) } catch { return v }
@@ -698,14 +703,23 @@ function renderYaml(doc) {
  *
  * Exported for unit testing.
  */
-export function buildStateSnapshot({ endpoints, successfullyPulledIds, projectId, now = new Date() }) {
+export function buildStateSnapshot({ endpoints, successfullyPulledIds, unresolvedEndpoints = [], projectId, now = new Date() }) {
   return {
     pulled_at: now.toISOString(),
     project_id: projectId,
     endpoints: Object.fromEntries(
       endpoints
         .filter(e => successfullyPulledIds.has(e.id))
-        .map(e => [e.name, { id: e.id, updated_at: e.updated_at }])
+        .map(e => [e.name, { id: e.id, updated_at: e.updated_at, revision: e.revision }])
+    ),
+    unresolved_endpoints: Object.fromEntries(
+      unresolvedEndpoints.map((item) => [item.endpoint, {
+        id: item.id,
+        remote_updated_at: item.remote_updated_at,
+        remote_revision: item.remote_revision,
+        file: item.file,
+        reason: item.reason || "local_source_differs",
+      }]),
     ),
   }
 }
@@ -787,7 +801,7 @@ export const dypaiPullTool = {
       execSql(project_id, `
         SELECT id, name, method, description, workflow_code, workflow, workflow_source,
                input, output, response_cardinality, allowed_roles, is_tool, tool_description,
-               group_id, is_active, updated_at
+               group_id, is_active, updated_at, revision
         FROM system.endpoints
         ORDER BY name
       `),
@@ -917,6 +931,7 @@ export const dypaiPullTool = {
     // conflict). Tracked by row id so endpoint renames at the same name
     // can't accidentally inherit a stale snapshot.
     const successfullyPulled = new Set()
+    const keptLocalEndpoints = []
 
     for (const rawRow of endpoints) {
       const row = hydrateRow(rawRow)
@@ -944,19 +959,29 @@ export const dypaiPullTool = {
             })
             if (writeDecision.action === "keep-local") {
               filesWritten.push(`(kept local ${relFlowPath})`)
+              keptLocalEndpoints.push({
+                endpoint: row.name,
+                id: row.id,
+                remote_updated_at: row.updated_at,
+                remote_revision: row.revision,
+                file: relFlowPath,
+                reason: "local_source_differs",
+              })
               errors.push({
                 endpoint: row.name,
                 error:
                   `Local ${relFlowPath} differs from persisted DYPAI source and was NOT overwritten. ` +
                   `Review/commit/stash local changes, or rerun dypai_pull with clean:true if you intentionally want the remote source.`,
               })
-              successfullyPulled.add(row.id)
+              // state.json is a baseline of bytes actually pulled from remote.
+              // Recording the remote timestamp while retaining stale local
+              // bytes would silence the next push conflict.
               continue
             }
 
             await writeFileEnsured(flowPath, flowContent)
             filesWritten.push(relFlowPath)
-            successfullyPulled.add(row.id)
+            if (shouldSnapshotFlowSourceWrite(writeDecision)) successfullyPulled.add(row.id)
             continue
           }
 
@@ -1063,6 +1088,7 @@ export const dypaiPullTool = {
     const state = buildStateSnapshot({
       endpoints,
       successfullyPulledIds: successfullyPulled,
+      unresolvedEndpoints: keptLocalEndpoints,
       projectId: resolvedProjectId,
     })
     await writeFileEnsured(join(outDir, ".dypai", "state.json"), JSON.stringify(state, null, 2) + "\n")
@@ -1085,6 +1111,7 @@ export const dypaiPullTool = {
     const inactiveEndpoints = (endpoints || [])
       .filter(e => e.is_active === false)
       .map(e => e.name)
+    const endpointNameCollisions = findEndpointNameCollisions(endpoints)
 
     // `environment` is an internal flag we still surface in `overview.project`
     // for diagnostics / dashboard parity, but the agent-facing copy uses the
@@ -1142,6 +1169,11 @@ export const dypaiPullTool = {
         by_group: byGroup,
         tool_endpoints: toolEndpoints,
         inactive_endpoints: inactiveEndpoints.length > 0 ? inactiveEndpoints : undefined,
+        canonical_name_collisions: endpointNameCollisions.length > 0 ? {
+          count: endpointNameCollisions.length,
+          items: endpointNameCollisions.slice(0, 50),
+          truncated: endpointNameCollisions.length > 50,
+        } : undefined,
       },
       credentials: (credentials || []).map(c => ({ name: c.name, type: c.type })),
       realtime_policies: (realtimePolicies || []).length,
@@ -1163,6 +1195,9 @@ export const dypaiPullTool = {
       success: errors.length === 0,
       endpoints: endpoints.length,
       files_written: filesWritten.length,
+      files_kept_local: keptLocalEndpoints.length,
+      kept_local_endpoints: keptLocalEndpoints.length ? keptLocalEndpoints : undefined,
+      name_collisions: endpointNameCollisions.length,
       output_dir: outDir,
       out_dir_resolved_via: outDirSource,
       // Surface count at top level too — agents that ignore `overview` (e.g.
@@ -1171,8 +1206,16 @@ export const dypaiPullTool = {
       overview,
       errors: errors.length ? errors : undefined,
       warning: suspiciousWarning || undefined,
+      safety_warnings: endpointNameCollisions.length ? [{
+        type: "canonical_endpoint_name_collisions",
+        count: endpointNameCollisions.length,
+        examples: endpointNameCollisions.slice(0, 10),
+        hint: "Legacy underscore and canonical hyphen slugs coexist. Treat them as separate live APIs; audit traffic and migrate/delete deliberately.",
+      }] : undefined,
       hint: errors.length
-        ? "Some endpoints failed to serialize. Check errors[] — usually malformed workflow_code."
+        ? keptLocalEndpoints.length
+          ? `${keptLocalEndpoints.length} local Flow file(s) differed and were kept. They were excluded from .dypai/state.json, so a later push will continue to block on remote drift. Review the files or rerun with clean:true only when remote is intentionally authoritative.`
+          : "Some endpoints failed to serialize. Check errors[] — usually malformed workflow_code."
         : suspiciousWarning
           ? "Files were written but the path looks wrong. See `warning` above and re-run with an absolute out_dir."
         : draftsTotal > 0

package/src/tools/sync/push.js

@@ -81,14 +81,16 @@ function isCheckpointTextPath(path) {
   return BACKEND_SOURCE_CHECKPOINT_EXTS.has(extOfPath(path))
 }
 
-async function collectBackendSourceCheckpointFiles(rootDir) {
+async function collectBackendSourceCheckpointFiles(rootDir, allowedPaths = null) {
   const files = []
 
   async function addFile(absPath, relPath) {
+    const sourcePath = `dypai/${relPath}`
+    if (allowedPaths && !allowedPaths.has(sourcePath)) return
     if (!isCheckpointTextPath(relPath)) return
     const content = await readFile(absPath, "utf8")
     files.push({
-      path: `dypai/${relPath}`,
+      path: sourcePath,
       content: Buffer.from(content, "utf8").toString("base64"),
     })
   }
@@ -165,7 +167,7 @@ function deletedBackendSourcePathsFromPlan(plan, remote) {
   return [...deleted].sort()
 }
 
-async function checkpointBackendSource(projectId, rootDir, plan, remote) {
+async function checkpointBackendSource(projectId, rootDir, plan, remote, allowedPaths = null) {
   if (!projectId) {
     return {
       ok: false,
@@ -173,7 +175,7 @@ async function checkpointBackendSource(projectId, rootDir, plan, remote) {
       reason: "project_id_missing",
     }
   }
-  const files = await collectBackendSourceCheckpointFiles(rootDir)
+  const files = await collectBackendSourceCheckpointFiles(rootDir, allowedPaths)
   const deleted_paths = deletedBackendSourcePathsFromPlan(plan, remote)
   if (!files.length && !deleted_paths.length) {
     return {
@@ -264,6 +266,50 @@ function endpointPayload(row) {
   return p
 }
 
+/**
+ * Splits the "error" severity diagnostics from a `dypai_validate` run into
+ * project-level errors (no `.endpoint` — can't be scoped, must block the
+ * whole push) vs. per-endpoint errors (can be isolated so the rest of the
+ * push still goes through). Returns everything the caller needs to decide
+ * whether to block or to do a partial push.
+ */
+function partitionValidationErrors(diagnostics) {
+  const errorDiags = (diagnostics || []).filter((d) => d.severity === "error")
+  const projectLevel = errorDiags.filter((d) => !d.endpoint)
+  const erroringEndpoints = new Set(errorDiags.map((d) => d.endpoint).filter(Boolean))
+  return { errorDiags, projectLevel, erroringEndpoints }
+}
+
+/**
+ * Partial push: drops any `plan.create`/`plan.update` item whose endpoint
+ * name is in `erroringEndpoints` (mutates `plan` in place, matching the
+ * previous inline behavior) so it keeps its live version instead of being
+ * pushed. `plan.delete` is left untouched — a broken local flow shouldn't
+ * block removing an endpoint. Returns the `skipped_endpoints` summary (with
+ * up to 5 errors per endpoint drawn from `skippedDiagnostics`), or
+ * `undefined` when nothing was dropped.
+ */
+function dropErroringFromPlan(plan, erroringEndpoints, skippedDiagnostics) {
+  const skippedNames = []
+  if (erroringEndpoints.size) {
+    const drop = (arr) => (arr || []).filter((item) => {
+      if (erroringEndpoints.has(item.name)) { skippedNames.push(item.name); return false }
+      return true
+    })
+    plan.create = drop(plan.create)
+    plan.update = drop(plan.update)
+  }
+  return skippedNames.length
+    ? [...new Set(skippedNames)].map((name) => ({
+        endpoint: name,
+        errors: skippedDiagnostics
+          .filter((d) => d.endpoint === name)
+          .slice(0, 5)
+          .map((d) => ({ rule: d.rule, message: d.message, file: d.file, loc: d.loc })),
+      }))
+    : undefined
+}
+
 function splitBlockingConflicts(plan, conflicts) {
   const touched = new Set([
     ...(plan.update || []).map((item) => item.name),
@@ -278,6 +324,68 @@ function splitBlockingConflicts(plan, conflicts) {
   return { blocking, non_blocking }
 }
 
+function normalizeEndpointSelection(value) {
+  if (value == null) return null
+  if (!Array.isArray(value) || value.length === 0) {
+    throw new Error("only_endpoints must be a non-empty array of endpoint slugs")
+  }
+  const names = [...new Set(value.map((item) => typeof item === "string" ? item.trim() : ""))]
+  const invalid = names.filter((name) => !/^[a-z][a-z0-9]*(?:[-_][a-z0-9]+)*$/.test(name))
+  if (invalid.length) {
+    throw new Error(`only_endpoints contains invalid endpoint slug(s): ${invalid.join(", ")}`)
+  }
+  return names.sort()
+}
+
+function scopePlanToEndpoints(plan, selectedNames, local) {
+  if (!selectedNames) return plan
+  const selected = new Set(selectedNames)
+  const keepItem = (item) => selected.has(typeof item === "string" ? item : item?.name)
+
+  plan.create = (plan.create || []).filter(keepItem)
+  plan.update = (plan.update || []).filter(keepItem)
+  plan.delete = (plan.delete || []).filter(keepItem)
+  plan.unchanged = (plan.unchanged || []).filter(keepItem)
+  plan.orphansIgnored = (plan.orphansIgnored || []).filter((name) => selected.has(name))
+
+  const selectedGroups = new Set()
+  for (const name of selected) {
+    const entry = local?.byName?.[name]
+    const group = entry?.group || entry?.doc?.group || entry?.pushPayload?.group_name
+    if (group) selectedGroups.add(group)
+  }
+  plan.groups = {
+    create: (plan.groups?.create || []).filter((name) => selectedGroups.has(name)),
+    // Endpoint-scoped pushes never delete groups: group deletion is a
+    // project-wide reconciliation and could affect unselected endpoints.
+    delete: [],
+    unchanged: (plan.groups?.unchanged || []).filter((name) => selectedGroups.has(name)),
+  }
+  plan.selection = { only_endpoints: selectedNames }
+  return plan
+}
+
+function backendSourcePathsForEndpointSelection(local, selectedNames) {
+  if (!selectedNames) return null
+  const paths = new Set()
+  for (const name of selectedNames) {
+    const entry = local?.byName?.[name]
+    if (!entry) continue
+    if (entry.source === "flow") {
+      const raw = entry.pushPayload?.workflow_source?.file || entry.file
+      if (typeof raw === "string" && raw) {
+        paths.add(raw.startsWith("dypai/") ? raw : `dypai/${raw}`)
+      }
+      continue
+    }
+    if (entry.file) paths.add(`dypai/endpoints/${entry.file}`)
+    for (const refPath of Object.keys(entry.fileMap || {})) {
+      paths.add(refPath.startsWith("dypai/") ? refPath : `dypai/${refPath}`)
+    }
+  }
+  return paths
+}
+
 /**
  * Treat a remote tool response as a definite success only when it has at
  * least one of the markers we expect from a real mutation. Anything else
@@ -329,20 +437,36 @@ async function applyCreate(canonicalRow, projectId) {
   return assertMutationOK(res, "create", canonicalRow.name)
 }
 
-async function applyUpdate(canonicalRow, endpointId, projectId) {
+function endpointUpdatesForRemote(canonicalRow, expectedRevision = null) {
+  const updates = endpointPayload(canonicalRow)
+  if (expectedRevision != null) updates.expected_revision = Number(expectedRevision)
+  return updates
+}
+
+async function applyUpdate(canonicalRow, endpointId, projectId, expectedRevision = null) {
+  const updates = endpointUpdatesForRemote(canonicalRow, expectedRevision)
   const res = await proxyToolCallWithRetry("update_endpoint", {
     ...(projectId ? { project_id: projectId } : {}),
     endpoint_id: endpointId,
-    updates: endpointPayload(canonicalRow),
+    updates,
   })
   return assertMutationOK(res, "update", canonicalRow.name)
 }
 
-async function applyDelete(endpointId, projectId) {
-  const res = await proxyToolCallWithRetry("delete_endpoint", {
+function endpointDeleteArgs(endpointId, projectId, expectedRevision = null) {
+  return {
     ...(projectId ? { project_id: projectId } : {}),
     endpoint_id: endpointId,
-  })
+    ...(expectedRevision != null ? { expected_revision: Number(expectedRevision) } : {}),
+  }
+}
+
+async function applyDelete(endpointId, projectId, expectedRevision = null) {
+  const res = await proxyToolCallWithRetry("delete_endpoint", endpointDeleteArgs(
+    endpointId,
+    projectId,
+    expectedRevision,
+  ))
   return assertMutationOK(res, "delete", endpointId)
 }
 
@@ -483,7 +607,9 @@ export const dypaiPushTool = {
     "After validation, regenerates `dypai/types/endpoints.gen.ts` from effective Flow/YAML contracts (check the `types` field in the response). " +
     "ALWAYS run dypai_diff first to preview what will be staged. " +
     "The public dypai_push wrapper also saves frontend source to Studio. " +
-    "By default, endpoints in remote but missing locally are kept (safe). Pass delete_orphans: true to stage their deletion as a draft as well.",
+    "By default, endpoints in remote but missing locally are kept (safe). Pass delete_orphans: true to stage their deletion as a draft as well. " +
+    "For endpoint-scoped work, pass only_endpoints: ['slug-a', 'slug-b']; unrelated endpoints, groups, realtime policies, automations, and source files are left untouched. " +
+    "PARTIAL PUSH: an endpoint whose flow has errors is SKIPPED (it keeps its live version) and the rest are pushed — one broken endpoint no longer blocks the whole push. Skipped ones are listed in `skipped_endpoints` (with their errors) and `partial_success` is set. A project-level error still blocks. Use skip_validation:true to push everything, errors included.",
   inputSchema: {
     type: "object",
     properties: {
@@ -513,14 +639,32 @@ export const dypaiPushTool = {
       },
       skip_validation: {
         type: "boolean",
-        description: "Skip the dypai_validate pre-flight check. Use only when you know the validator is wrong. Default: false.",
+        description: "Skip the dypai_validate pre-flight check and push EVERY endpoint, including ones with errors (no per-endpoint skipping). By default the push already applies the valid endpoints and only skips the erroring ones — so use this only when you know the validator is wrong. Default: false.",
         default: false,
       },
+      only_endpoints: {
+        type: "array",
+        minItems: 1,
+        uniqueItems: true,
+        items: { type: "string" },
+        description: "Optional explicit endpoint allowlist. Only these endpoint slugs may be created, updated, or deleted; project-wide realtime/automation reconciliation is skipped.",
+      },
     },
   },
 
-  async execute({ project_id, root_dir = "./dypai", delete_orphans = false, dry_run = false, force = false, skip_validation = false } = {}) {
+  async execute({ project_id, root_dir = "./dypai", delete_orphans = false, dry_run = false, force = false, skip_validation = false, only_endpoints = null } = {}) {
     const rootDir = resolvePath(process.cwd(), root_dir)
+    let selectedNames
+    try {
+      selectedNames = normalizeEndpointSelection(only_endpoints)
+    } catch (error) {
+      return {
+        success: false,
+        applied: false,
+        reason: "invalid_endpoint_selection",
+        error: error.message,
+      }
+    }
 
     // Resolve the target project via dypai.config.yaml if the caller didn't
     // pass an explicit project_id. If both are provided and disagree, refuse —
@@ -529,19 +673,30 @@ export const dypaiPushTool = {
     const configProjectId = config?.project_id || null
     const targetProjectId = project_id || configProjectId
 
-    // Pre-flight validation (lint). Blocks the push unless skip_validation is set.
+    // Pre-flight validation (lint). Partial push: endpoints whose flow has an
+    // error are SKIPPED (they keep their live version) and the rest is pushed —
+    // one broken endpoint no longer tanks the whole push. A project-level error
+    // (no endpoint to isolate it to) still blocks, since it can't be scoped out.
+    // skip_validation bypasses all of this and pushes everything.
+    let erroringEndpoints = new Set()
+    let skippedDiagnostics = []
     if (!skip_validation && !dry_run) {
       try {
         const validation = await runValidation(rootDir, project_id || configProjectId)
         if (!validation.success) {
-          return {
-            success: false,
-            applied: false,
-            reason: "validation_failed",
-            summary: validation.summary,
-            diagnostics: validation.diagnostics.filter(d => d.severity === "error").slice(0, 20),
-            hint: `${validation.summary.errors} error(s) would cause runtime failures. Fix them, or retry with skip_validation: true to override.`,
+          const { errorDiags, projectLevel, erroringEndpoints: partitioned } = partitionValidationErrors(validation.diagnostics)
+          if (projectLevel.length) {
+            return {
+              success: false,
+              applied: false,
+              reason: "validation_failed",
+              summary: validation.summary,
+              diagnostics: projectLevel.slice(0, 20),
+              hint: `${projectLevel.length} project-level error(s) can't be isolated to a single endpoint. Fix them, or retry with skip_validation: true to override.`,
+            }
           }
+          skippedDiagnostics = errorDiags
+          erroringEndpoints = partitioned
         }
       } catch (e) {
         // Don't block the push on a validator crash — just warn
@@ -640,6 +795,30 @@ export const dypaiPushTool = {
       stateSnapshot,
       liveRemote: remote,
     })
+    if (selectedNames) {
+      const unavailable = selectedNames.filter((name) => {
+        if (local.byName[name]) return false
+        return !(delete_orphans && effectiveRemote.byName?.[name])
+      })
+      if (unavailable.length) {
+        return {
+          success: false,
+          applied: false,
+          reason: "endpoint_selection_not_found",
+          unavailable_endpoints: unavailable,
+          hint: "Each only_endpoints slug must exist locally. A remote-only slug is accepted only with delete_orphans:true for an explicit deletion.",
+        }
+      }
+      scopePlanToEndpoints(plan, selectedNames, local)
+    }
+    const selectedSourcePaths = backendSourcePathsForEndpointSelection(local, selectedNames)
+
+    // Partial push: drop endpoints that failed validation from create/update so
+    // they aren't pushed (they keep their live version). Deletes stay — a broken
+    // local flow shouldn't block removing endpoints. skip_validation leaves
+    // erroringEndpoints empty, so nothing is dropped.
+    const skipped_endpoints = dropErroringFromPlan(plan, erroringEndpoints, skippedDiagnostics)
+
     const groupChanges = (plan.groups?.create?.length || 0) + (plan.groups?.delete?.length || 0)
     const totalChanges = plan.create.length + plan.update.length + plan.delete.length + groupChanges
 
@@ -660,11 +839,13 @@ export const dypaiPushTool = {
     if (dry_run || totalChanges === 0) {
       const sourceCheckpoint = dry_run
         ? null
-        : await checkpointBackendSource(targetProjectId, rootDir, plan, remote)
+        : await checkpointBackendSource(targetProjectId, rootDir, plan, remote, selectedSourcePaths)
       const sourceCheckpointFailed = sourceCheckpoint?.ok === false && sourceCheckpoint?.skipped !== true
       const automationSync = dry_run
         ? { skipped: true, reason: "dry_run" }
-        : await syncAutomationMetadata(targetProjectId, local.automations)
+        : selectedNames
+          ? { skipped: true, reason: "endpoint_scoped_push" }
+          : await syncAutomationMetadata(targetProjectId, local.automations)
       const automationSyncHasFailed = automationSyncFailed(automationSync)
       const sourceBaseline = !dry_run && !sourceCheckpointFailed
         ? await refreshBackendSourceBaseline(targetProjectId, rootDir, sourceCheckpoint)
@@ -676,14 +857,17 @@ export const dypaiPushTool = {
           ? "source_checkpoint_failed"
           : automationSyncHasFailed
             ? "automation_sync_failed"
+            : skipped_endpoints && totalChanges === 0 ? "all_skipped"
             : totalChanges === 0 ? "no_changes" : "dry_run",
         summary: summaryFromPlan(plan),
+        skipped_endpoints,
         plan,
         non_blocking_conflicts: conflictSplit.non_blocking.length ? conflictSplit.non_blocking : undefined,
         types: typesGenerated,
         automation_sync: automationSync,
         source_checkpoint: sourceCheckpoint || undefined,
         source_baseline: sourceBaseline,
+        selection: selectedNames ? { only_endpoints: selectedNames } : undefined,
         hint: automationSyncHasFailed
           ? "Backend runtime/source was unchanged, but DYPAI could not sync automation setup metadata. Retry after the API is updated/restarted; file requirements may be missing until this succeeds."
           : sourceCheckpointFailed
@@ -748,7 +932,7 @@ export const dypaiPushTool = {
         const canonical = localToCanonical(local.byName[item.name], remote.mapsCtx)
         const endpointId = remote.byName[item.name]?.id
         const res = endpointId
-          ? await applyUpdate(canonical, endpointId, targetProjectId)
+          ? await applyUpdate(canonical, endpointId, targetProjectId, remote.byName[item.name]?.revision)
           : await applyCreate(canonical, targetProjectId)
         applied.updated.push({ name: item.name, changed_fields: item.changedFields })
         if (isDraftResponse(res)) applied.updated_drafts.push(item.name)
@@ -766,7 +950,11 @@ export const dypaiPushTool = {
       try {
         const endpointId = remote.byName[item.name]?.id
         if (!endpointId) throw new Error("endpoint_id missing from remote state")
-        const res = await applyDelete(endpointId, targetProjectId)
+        const res = await applyDelete(
+          endpointId,
+          targetProjectId,
+          remote.byName[item.name]?.revision,
+        )
         applied.deleted.push(item.name)
         if (isDraftResponse(res)) applied.deleted_drafts.push(item.name)
         endpoint_results.push(endpointResult("delete", item.name, "applied", {
@@ -795,10 +983,14 @@ export const dypaiPushTool = {
 
     // Also reconcile realtime policies if realtime.yaml exists
     let realtime = null
-    try {
-      realtime = await syncRealtimePolicies(targetProjectId, rootDir, false)
-    } catch (e) {
-      errors.push({ op: "realtime", error: e.message })
+    if (selectedNames) {
+      realtime = { skipped: true, reason: "endpoint_scoped_push" }
+    } else {
+      try {
+        realtime = await syncRealtimePolicies(targetProjectId, rootDir, false)
+      } catch (e) {
+        errors.push({ op: "realtime", error: e.message })
+      }
     }
 
     // Names of endpoints that actually changed this run — drives the follow-up
@@ -829,7 +1021,7 @@ export const dypaiPushTool = {
     const isDraftMode = draftCount > 0
       && draftCount === endpointTotal + realtimeTotal
     const sourceCheckpoint = errors.length === 0
-      ? await checkpointBackendSource(targetProjectId, rootDir, plan, remote)
+      ? await checkpointBackendSource(targetProjectId, rootDir, plan, remote, selectedSourcePaths)
       : {
           ok: true,
           skipped: true,
@@ -837,7 +1029,9 @@ export const dypaiPushTool = {
         }
     const sourceCheckpointFailed = sourceCheckpoint?.ok === false && sourceCheckpoint?.skipped !== true
     const automationSync = errors.length === 0
-      ? await syncAutomationMetadata(targetProjectId, local.automations)
+      ? selectedNames
+        ? { skipped: true, reason: "endpoint_scoped_push" }
+        : await syncAutomationMetadata(targetProjectId, local.automations)
       : { skipped: true, reason: "push_had_errors" }
     const automationSyncHasFailed = automationSyncFailed(automationSync)
     const sourceBaseline = errors.length === 0 && !sourceCheckpointFailed
@@ -847,7 +1041,7 @@ export const dypaiPushTool = {
     return {
       success: errors.length === 0 && !sourceCheckpointFailed && !automationSyncHasFailed,
       applied: endpointTotal > 0 || (realtime && !realtime.skipped),
-      partial_success: partialSuccess || sourceCheckpointFailed || automationSyncHasFailed,
+      partial_success: partialSuccess || sourceCheckpointFailed || automationSyncHasFailed || !!skipped_endpoints,
       reason: sourceCheckpointFailed
         ? "source_checkpoint_failed"
         : automationSyncHasFailed
@@ -878,16 +1072,20 @@ export const dypaiPushTool = {
       },
       details: applied,
       endpoint_results,
+      skipped_endpoints,
       non_blocking_conflicts: conflictSplit.non_blocking.length ? conflictSplit.non_blocking : undefined,
       errors: errors.length ? errors : undefined,
       types: typesGenerated,
       automation_sync: automationSync,
       source_checkpoint: sourceCheckpoint,
       source_baseline: sourceBaseline,
+      selection: selectedNames ? { only_endpoints: selectedNames } : undefined,
       // Only one next_step — and only when it's non-obvious. Drafts win
       // over the test suggestion because tests against live won't see
       // the change until the drafts are promoted.
-      next_step: errors.length
+      next_step: skipped_endpoints
+        ? `⚠️ ${skipped_endpoints.length} endpoint(s) SKIPPED (they keep their live version) because their flow has errors: ${skipped_endpoints.map(s => s.endpoint).slice(0, 5).join(", ")}${skipped_endpoints.length > 5 ? "…" : ""}. Everything else was pushed. Fix the skipped ones (see skipped_endpoints[].errors) and push again — or use skip_validation:true to push them anyway.`
+        : errors.length
         ? partialSuccess
           ? `${endpointTotal} endpoint(s) saved, ${failedTotal} failed. Fix failed endpoints and push again. Failed: ${errors.slice(0, 3).map((item) => item.endpoint || item.group || item.op).join(", ")}${errors.length > 3 ? "…" : ""}`
           : "Fix the offending YAMLs and push again."
@@ -925,9 +1123,16 @@ function summaryFromPlan(plan) {
 export const __testing = {
   normalizeResponseCardinality,
   endpointPayload,
+  endpointUpdatesForRemote,
+  endpointDeleteArgs,
   splitBlockingConflicts,
   collectBackendSourceCheckpointFiles,
   deletedBackendSourcePathsFromPlan,
   syncAutomationMetadata,
+  partitionValidationErrors,
+  dropErroringFromPlan,
+  normalizeEndpointSelection,
+  scopePlanToEndpoints,
+  backendSourcePathsForEndpointSelection,
   PUSH_CONCURRENCY,
 }