@lumerahq/cli 0.13.2 → 0.15.0

package/README.md

@@ -23,12 +23,15 @@ lumera dev                 # Start dev server
 lumera apply app           # Deploy frontend
 lumera destroy app         # Delete app from Lumera
 
-lumera plan                # Preview infrastructure changes
-lumera apply               # Apply collections, automations, hooks
+lumera plan                # Preview changes (with inline diffs)
+lumera diff <resource>     # Full diff between local and remote
+lumera apply               # Apply collections, automations, hooks, agents
 lumera pull                # Pull remote state to local
+lumera list                # List resources with sync status
+lumera show <resource>     # Show resource details
 lumera destroy             # Delete remote resources
 
-lumera run <script>        # Run Python scripts locally
+lumera run <target>        # Run script, automation, or invoke agent
 ```
 
 ## Scaffolding Projects

package/dist/{chunk-7ZGIC6F7.js → chunk-NL6MEHA3.js}

@@ -5,10 +5,19 @@ import {
 // src/lib/api.ts
 import { readFileSync } from "fs";
 import { fileURLToPath } from "url";
-import { dirname, join } from "path";
+import { dirname, resolve } from "path";
 var __filename = fileURLToPath(import.meta.url);
-var __dirname = dirname(__filename);
-var pkg = JSON.parse(readFileSync(join(__dirname, "../../package.json"), "utf-8"));
+var __pkgDir = dirname(__filename);
+while (__pkgDir !== "/") {
+  try {
+    const candidate = resolve(__pkgDir, "package.json");
+    const parsed = JSON.parse(readFileSync(candidate, "utf-8"));
+    if (parsed.name === "@lumerahq/cli") break;
+  } catch {
+  }
+  __pkgDir = resolve(__pkgDir, "..");
+}
+var pkg = JSON.parse(readFileSync(resolve(__pkgDir, "package.json"), "utf-8"));
 var CLI_USER_AGENT = `lumera-cli/${pkg.version}`;
 var ApiClient = class {
   baseUrl;
@@ -190,10 +199,10 @@ function createApiClient(token, baseUrl) {
 // src/lib/env.ts
 import { config } from "dotenv";
 import { existsSync } from "fs";
-import { resolve } from "path";
+import { resolve as resolve2 } from "path";
 function loadEnv(cwd = process.cwd()) {
-  const envPath = resolve(cwd, ".env");
-  const envLocalPath = resolve(cwd, ".env.local");
+  const envPath = resolve2(cwd, ".env");
+  const envLocalPath = resolve2(cwd, ".env.local");
   if (existsSync(envPath)) {
     config({ path: envPath });
   }

package/dist/{dev-LBWA7G6T.js → dev-5EAZUQ2S.js}

@@ -4,7 +4,7 @@ import {
 import {
   createApiClient,
   loadEnv
-} from "./chunk-7ZGIC6F7.js";
+} from "./chunk-NL6MEHA3.js";
 import {
   getToken
 } from "./chunk-NDLYGKS6.js";

package/dist/index.js

@@ -81,6 +81,7 @@ var COMMANDS = [
   "destroy",
   "list",
   "show",
+  "diff",
   "dev",
   "run",
   "init",
@@ -136,6 +137,7 @@ ${pc.dim("Resource Commands:")}
   ${pc.cyan("destroy")} [resource]       Delete resources
   ${pc.cyan("list")} [type]              List resources with status
   ${pc.cyan("show")} <resource>          Show resource details
+  ${pc.cyan("diff")} <resource>          Show full diff between local and remote
 
 ${pc.dim("Development:")}
   ${pc.cyan("dev")}                      Start dev server
@@ -210,29 +212,32 @@ async function main() {
     switch (command) {
       // Resource commands
       case "plan":
-        await import("./resources-TCYJ5AEO.js").then((m) => m.plan(args.slice(1)));
+        await import("./resources-BFT7V6UR.js").then((m) => m.plan(args.slice(1)));
         break;
       case "apply":
-        await import("./resources-TCYJ5AEO.js").then((m) => m.apply(args.slice(1)));
+        await import("./resources-BFT7V6UR.js").then((m) => m.apply(args.slice(1)));
         break;
       case "pull":
-        await import("./resources-TCYJ5AEO.js").then((m) => m.pull(args.slice(1)));
+        await import("./resources-BFT7V6UR.js").then((m) => m.pull(args.slice(1)));
         break;
       case "destroy":
-        await import("./resources-TCYJ5AEO.js").then((m) => m.destroy(args.slice(1)));
+        await import("./resources-BFT7V6UR.js").then((m) => m.destroy(args.slice(1)));
         break;
       case "list":
-        await import("./resources-TCYJ5AEO.js").then((m) => m.list(args.slice(1)));
+        await import("./resources-BFT7V6UR.js").then((m) => m.list(args.slice(1)));
         break;
       case "show":
-        await import("./resources-TCYJ5AEO.js").then((m) => m.show(args.slice(1)));
+        await import("./resources-BFT7V6UR.js").then((m) => m.show(args.slice(1)));
+        break;
+      case "diff":
+        await import("./resources-BFT7V6UR.js").then((m) => m.diff(args.slice(1)));
         break;
       // Development
       case "dev":
-        await import("./dev-LBWA7G6T.js").then((m) => m.dev(args.slice(1)));
+        await import("./dev-5EAZUQ2S.js").then((m) => m.dev(args.slice(1)));
         break;
       case "run":
-        await import("./run-3UBV3SVA.js").then((m) => m.run(args.slice(1)));
+        await import("./run-SPC4YXWR.js").then((m) => m.run(args.slice(1)));
         break;
       // Project
       case "init":

package/dist/{resources-TCYJ5AEO.js → resources-BFT7V6UR.js}

@@ -4,7 +4,7 @@ import {
 import {
   createApiClient,
   loadEnv
-} from "./chunk-7ZGIC6F7.js";
+} from "./chunk-NL6MEHA3.js";
 import {
   getToken
 } from "./chunk-NDLYGKS6.js";
@@ -31,6 +31,55 @@ function detectPackageManager() {
   }
   return "npm";
 }
+function computeLineDiff(oldText, newText) {
+  const oldLines = (oldText || "").trimEnd().split("\n");
+  const newLines = (newText || "").trimEnd().split("\n");
+  const m = oldLines.length;
+  const n = newLines.length;
+  const dp = Array.from({ length: m + 1 }, () => Array(n + 1).fill(0));
+  for (let i2 = 1; i2 <= m; i2++) {
+    for (let j2 = 1; j2 <= n; j2++) {
+      dp[i2][j2] = oldLines[i2 - 1] === newLines[j2 - 1] ? dp[i2 - 1][j2 - 1] + 1 : Math.max(dp[i2 - 1][j2], dp[i2][j2 - 1]);
+    }
+  }
+  const result = [];
+  let i = m, j = n;
+  const stack = [];
+  while (i > 0 || j > 0) {
+    if (i > 0 && j > 0 && oldLines[i - 1] === newLines[j - 1]) {
+      stack.push({ type: " ", line: oldLines[i - 1] });
+      i--;
+      j--;
+    } else if (j > 0 && (i === 0 || dp[i][j - 1] >= dp[i - 1][j])) {
+      stack.push({ type: "+", line: newLines[j - 1] });
+      j--;
+    } else {
+      stack.push({ type: "-", line: oldLines[i - 1] });
+      i--;
+    }
+  }
+  stack.reverse();
+  const contextLines = 2;
+  const changeIndices = /* @__PURE__ */ new Set();
+  stack.forEach((entry, idx) => {
+    if (entry.type !== " ") {
+      for (let c = Math.max(0, idx - contextLines); c <= Math.min(stack.length - 1, idx + contextLines); c++) {
+        changeIndices.add(c);
+      }
+    }
+  });
+  let lastIncluded = -2;
+  for (let idx = 0; idx < stack.length; idx++) {
+    if (changeIndices.has(idx)) {
+      if (lastIncluded < idx - 1) {
+        result.push({ type: " ", line: "..." });
+      }
+      result.push(stack[idx]);
+      lastIncluded = idx;
+    }
+  }
+  return result;
+}
 function showPlanHelp() {
   console.log(`
 ${pc.dim("Usage:")}
@@ -76,12 +125,14 @@ ${pc.dim("Resources:")}
   app                 Deploy the frontend app
 
 ${pc.dim("Options:")}
+  --yes, -y           Skip confirmation prompt (for CI/CD)
   --skip-build        Skip build step when applying app
 
 ${pc.dim("Examples:")}
-  lumera apply                       # Apply everything
+  lumera apply                       # Apply everything (shows plan, asks to confirm)
   lumera apply collections           # Apply all collections
   lumera apply collections/users     # Apply single collection
+  lumera apply agents -y             # Apply agents without confirmation
   lumera apply app                   # Deploy frontend
   lumera apply app --skip-build      # Deploy without rebuilding
 `);
@@ -89,10 +140,15 @@ ${pc.dim("Examples:")}
 function showPullHelp() {
   console.log(`
 ${pc.dim("Usage:")}
-  lumera pull [resource]
+  lumera pull [resource] [--force]
 
 ${pc.dim("Description:")}
   Download remote state to local files.
+  Refuses to overwrite local files that have uncommitted changes
+  (use --force to override, or 'lumera diff' to inspect first).
+
+${pc.dim("Options:")}
+  --force, -f         Overwrite local files even if they have changes
 
 ${pc.dim("Resources:")}
   (none)              Pull all resources
@@ -105,9 +161,10 @@ ${pc.dim("Resources:")}
   agents/<name>       Pull single agent
 
 ${pc.dim("Examples:")}
-  lumera pull                        # Pull all resources
-  lumera pull collections            # Pull only collections
-  lumera pull automations/sync       # Pull single automation
+  lumera pull                        # Pull all (safe \u2014 warns on conflicts)
+  lumera pull agents                 # Pull only agents
+  lumera pull --force                # Pull all, overwrite local changes
+  lumera diff agents/my_agent        # Inspect before pulling
 `);
 }
 function showDestroyHelp() {
@@ -427,6 +484,30 @@ function mapFieldType(type) {
   };
   return typeMap[type] || type;
 }
+function fieldsDiffer(local, remote) {
+  if (mapFieldType(local.type) !== remote.type) return true;
+  if ((local.required || false) !== (remote.required || false)) return true;
+  const opts = remote.options || {};
+  if (local.type === "select") {
+    const localValues = [...local.values || []].sort();
+    const remoteValues = [...opts.values || []].sort();
+    if (localValues.join(",") !== remoteValues.join(",")) return true;
+    const localMultiple = local.multiple || false;
+    const remoteMaxSelect = opts.maxSelect || 1;
+    if (localMultiple && remoteMaxSelect <= 1) return true;
+    if (!localMultiple && remoteMaxSelect > 1) return true;
+  }
+  if (local.type === "relation") {
+    if (local.collection && local.collection !== opts.collectionId) return true;
+    const localMultiple = local.multiple || false;
+    const remoteMaxSelect = opts.maxSelect || 1;
+    if (localMultiple && remoteMaxSelect <= 1) return true;
+    if (!localMultiple && remoteMaxSelect > 1) return true;
+  }
+  if (local.min !== void 0 && local.min !== opts.min) return true;
+  if (local.max !== void 0 && local.max !== opts.max) return true;
+  return false;
+}
 async function planCollections(api, localCollections) {
   const changes = [];
   const remoteCollections = await api.listCollections();
@@ -454,10 +535,20 @@ async function planCollections(api, localCollections) {
       const remoteFieldMap = new Map(remote.schema.map((f) => [f.name, f]));
       const added = [...localFieldNames].filter((n) => !remoteFieldNames.has(n));
       const removed = [...remoteFieldNames].filter((n) => !localFieldNames.has(n));
-      if (added.length > 0 || removed.length > 0) {
+      const modified = [];
+      for (const name of localFieldNames) {
+        if (!remoteFieldNames.has(name)) continue;
+        const localField = localFieldMap.get(name);
+        const remoteField = remoteFieldMap.get(name);
+        if (fieldsDiffer(localField, remoteField)) {
+          modified.push(name);
+        }
+      }
+      if (added.length > 0 || removed.length > 0 || modified.length > 0) {
         const details = [];
         if (added.length > 0) details.push(`+${added.length} field${added.length > 1 ? "s" : ""}`);
         if (removed.length > 0) details.push(`-${removed.length} field${removed.length > 1 ? "s" : ""}`);
+        if (modified.length > 0) details.push(`~${modified.length} field${modified.length > 1 ? "s" : ""} (${modified.join(", ")})`);
         const fieldDetails = [];
         for (const name of added) {
           const f = localFieldMap.get(name);
@@ -502,12 +593,17 @@ async function planAutomations(api, localAutomations) {
         if (codeChanged) details.push("code");
         if (nameChanged) details.push("name");
         if (descChanged) details.push("description");
+        const textDiffs = [];
+        if (codeChanged) {
+          textDiffs.push({ field: "main.py", oldText: remote.code || "", newText: code });
+        }
         changes.push({
           type: "update",
           resource: "automation",
           id: automation.external_id,
           name: automation.name,
-          details: `changed: ${details.join(", ")}`
+          details: `changed: ${details.join(", ")}`,
+          textDiffs
         });
       }
     }
@@ -539,12 +635,17 @@ async function planHooks(api, localHooks, collections) {
         const details = [];
         if (scriptChanged) details.push("script");
         if (eventChanged) details.push("trigger");
+        const textDiffs = [];
+        if (scriptChanged) {
+          textDiffs.push({ field: fileName, oldText: remote.script || "", newText: script });
+        }
         changes.push({
           type: "update",
           resource: "hook",
           id: hook.external_id,
           name: `${hook.collection}.${hook.trigger}`,
-          details: `changed: ${details.join(", ")}`
+          details: `changed: ${details.join(", ")}`,
+          textDiffs
         });
       }
     }
@@ -854,6 +955,7 @@ function loadLocalAgents(platformDir, filterName, appName) {
     const agentDir = join(agentsDir, entry.name);
     const configPath = join(agentDir, "config.json");
     const promptPath = join(agentDir, "system_prompt.md");
+    const policyPath = join(agentDir, "policy.js");
     if (!existsSync(configPath)) {
       errors.push(`${entry.name}: missing config.json`);
       continue;
@@ -880,7 +982,8 @@ function loadLocalAgents(platformDir, filterName, appName) {
         continue;
       }
       const systemPrompt = readFileSync(promptPath, "utf-8");
-      agents.push({ agent: config, systemPrompt });
+      const policyScript = existsSync(policyPath) ? readFileSync(policyPath, "utf-8") : "";
+      agents.push({ agent: config, systemPrompt, policyScript });
     } catch (e) {
       errors.push(`${entry.name}: failed to parse config.json - ${e}`);
     }
@@ -900,7 +1003,18 @@ async function planAgents(api, localAgents) {
   const remoteByExternalId = new Map(
     remoteAgents.filter((a) => a.external_id && !a.managed).map((a) => [a.external_id, a])
   );
-  for (const { agent, systemPrompt } of localAgents) {
+  let skillSlugToId = /* @__PURE__ */ new Map();
+  let skillIdToSlug = /* @__PURE__ */ new Map();
+  const hasSkillRefs = localAgents.some((a) => a.agent.skills && a.agent.skills.length > 0) || remoteAgents.some((a) => a.skill_ids && a.skill_ids.length > 0);
+  if (hasSkillRefs) {
+    try {
+      const skills = await api.listAgentSkills();
+      skillSlugToId = new Map(skills.map((s) => [s.slug, s.id]));
+      skillIdToSlug = new Map(skills.map((s) => [s.id, s.slug]));
+    } catch {
+    }
+  }
+  for (const { agent, systemPrompt, policyScript } of localAgents) {
     const remote = remoteByExternalId.get(agent.external_id);
     if (!remote) {
       changes.push({ type: "create", resource: "agent", id: agent.external_id, name: agent.name });
@@ -910,8 +1024,27 @@ async function planAgents(api, localAgents) {
       if ((remote.description || "") !== (agent.description || "")) diffs.push("description");
       if ((remote.system_prompt || "").trim() !== systemPrompt.trim()) diffs.push("system_prompt");
       if ((remote.model || "") !== (agent.model || "")) diffs.push("model");
+      if ((remote.policy_script || "").trim() !== (policyScript || "").trim()) diffs.push("policy_script");
+      if ((remote.policy_enabled || false) !== (agent.policy_enabled || false)) diffs.push("policy_enabled");
+      const localSkillIds = (agent.skills || []).map((s) => skillSlugToId.get(s) || s).sort();
+      const remoteSkillIds = [...remote.skill_ids || []].sort();
+      if (localSkillIds.join(",") !== remoteSkillIds.join(",")) {
+        const addedSlugs = localSkillIds.filter((id) => !remoteSkillIds.includes(id)).map((id) => skillIdToSlug.get(id) || id);
+        const removedSlugs = remoteSkillIds.filter((id) => !localSkillIds.includes(id)).map((id) => skillIdToSlug.get(id) || id);
+        const parts = [];
+        if (addedSlugs.length) parts.push(`+${addedSlugs.join(", +")}`);
+        if (removedSlugs.length) parts.push(`-${removedSlugs.join(", -")}`);
+        diffs.push(`skills (${parts.join(", ")})`);
+      }
       if (diffs.length > 0) {
-        changes.push({ type: "update", resource: "agent", id: agent.external_id, name: agent.name, details: `changed: ${diffs.join(", ")}` });
+        const textDiffs = [];
+        if (diffs.includes("system_prompt")) {
+          textDiffs.push({ field: "system_prompt.md", oldText: remote.system_prompt || "", newText: systemPrompt });
+        }
+        if (diffs.includes("policy_script")) {
+          textDiffs.push({ field: "policy.js", oldText: remote.policy_script || "", newText: policyScript });
+        }
+        changes.push({ type: "update", resource: "agent", id: agent.external_id, name: agent.name, details: `changed: ${diffs.join(", ")}`, textDiffs });
       }
     }
   }
@@ -933,7 +1066,7 @@ async function applyAgents(api, localAgents) {
       console.log(pc.yellow(`    \u26A0 Could not fetch skills for resolution: ${e}`));
     }
   }
-  for (const { agent, systemPrompt } of localAgents) {
+  for (const { agent, systemPrompt, policyScript } of localAgents) {
     const remote = remoteByExternalId.get(agent.external_id);
     const skillIds = [];
     if (agent.skills) {
@@ -952,7 +1085,9 @@ async function applyAgents(api, localAgents) {
       description: agent.description || "",
       system_prompt: systemPrompt,
       model: agent.model || "",
-      skill_ids: skillIds
+      skill_ids: skillIds,
+      policy_script: policyScript || "",
+      policy_enabled: agent.policy_enabled || false
     };
     try {
       if (remote) {
@@ -999,9 +1134,14 @@ async function pullAgents(api, platformDir, filterName) {
       name: agent.name
     };
     if (agent.description) config.description = agent.description;
+    if (agent.model) config.model = agent.model;
     if (skillSlugs.length > 0) config.skills = skillSlugs;
+    if (agent.policy_enabled) config.policy_enabled = true;
     writeFileSync(join(agentDir, "config.json"), JSON.stringify(config, null, 2) + "\n");
     writeFileSync(join(agentDir, "system_prompt.md"), agent.system_prompt || "");
+    if (agent.policy_script) {
+      writeFileSync(join(agentDir, "policy.js"), agent.policy_script);
+    }
     console.log(pc.green("  \u2713"), `${agent.name} \u2192 agents/${dirName}/`);
   }
 }
@@ -1621,6 +1761,26 @@ async function plan(args) {
       }
       console.log();
     }
+    if (change.textDiffs && change.textDiffs.length > 0) {
+      const maxDiffLines = 20;
+      for (const td of change.textDiffs) {
+        const diffLines = computeLineDiff(td.oldText, td.newText);
+        if (diffLines.length > 0) {
+          console.log(pc.dim(`      --- ${td.field}`));
+          const shown = diffLines.slice(0, maxDiffLines);
+          for (const dl of shown) {
+            if (dl.type === "+") console.log(pc.green(`      + ${dl.line}`));
+            else if (dl.type === "-") console.log(pc.red(`      - ${dl.line}`));
+            else console.log(pc.dim(`        ${dl.line}`));
+          }
+          if (diffLines.length > maxDiffLines) {
+            const remaining = diffLines.length - maxDiffLines;
+            console.log(pc.dim(`      ... ${remaining} more lines \u2014 use ${pc.cyan(`lumera diff ${change.resource}s/${change.name}`)} for full diff`));
+          }
+          console.log();
+        }
+      }
+    }
   }
   console.log();
   console.log(pc.dim(`  Run 'lumera apply' to apply these changes.`));
@@ -1636,11 +1796,12 @@ async function apply(args) {
   const platformDir = getPlatformDir();
   const api = createApiClient();
   const appName = getAppName(projectRoot);
-  const { type, name } = parseResource(args[0]);
-  console.log();
-  console.log(pc.cyan(pc.bold("  Apply")));
-  console.log();
+  const { type, name } = parseResource(args.filter((a) => a !== "--yes" && a !== "-y")[0]);
+  const autoConfirm = args.includes("--yes") || args.includes("-y") || !!process.env.CI;
   if (type === "app") {
+    console.log();
+    console.log(pc.cyan(pc.bold("  Apply")));
+    console.log();
     console.log(pc.bold("  App:"));
     await applyApp(args);
     console.log();
@@ -1649,77 +1810,131 @@ async function apply(args) {
     return;
   }
   let collections;
-  let totalErrors = 0;
-  if (!type || type === "collections") {
-    const localCollections = loadLocalCollections(platformDir, name || void 0);
-    if (localCollections.length > 0) {
-      console.log(pc.bold("  Collections:"));
-      totalErrors += await applyCollections(api, localCollections);
-      console.log();
-    } else if (name) {
-      console.log(pc.red(`  Collection "${name}" not found locally`));
-      process.exit(1);
-    }
-  }
   try {
     const remoteCollections = await api.listCollections();
     collections = new Map(remoteCollections.map((c) => [c.name, c.id]));
-    for (const c of remoteCollections) {
-      collections.set(c.id, c.id);
-    }
+    for (const c of remoteCollections) collections.set(c.id, c.id);
   } catch {
     collections = /* @__PURE__ */ new Map();
   }
-  if (!type || type === "automations") {
-    const localAutomations = loadLocalAutomations(platformDir, name || void 0, appName);
-    if (localAutomations.length > 0) {
-      console.log(pc.bold("  Automations:"));
-      totalErrors += await applyAutomations(api, localAutomations);
-      console.log();
-    } else if (name) {
-      console.log(pc.red(`  Automation "${name}" not found locally`));
-      process.exit(1);
-    }
-  }
-  if (!type || type === "hooks") {
-    const localHooks = loadLocalHooks(platformDir, name || void 0, appName);
-    if (localHooks.length > 0) {
-      console.log(pc.bold("  Hooks:"));
-      totalErrors += await applyHooks(api, localHooks, collections);
-      console.log();
-    } else if (name) {
-      console.log(pc.red(`  Hook "${name}" not found locally`));
-      process.exit(1);
-    }
-  }
-  if (!type || type === "agents") {
-    const localAgents = loadLocalAgents(platformDir, name || void 0, appName);
-    if (localAgents.length > 0) {
-      console.log(pc.bold("  Agents:"));
-      totalErrors += await applyAgents(api, localAgents);
+  const allChanges = [];
+  const localCollections = !type || type === "collections" ? loadLocalCollections(platformDir, name || void 0) : [];
+  const localAutomations = !type || type === "automations" ? loadLocalAutomations(platformDir, name || void 0, appName) : [];
+  const localHooks = !type || type === "hooks" ? loadLocalHooks(platformDir, name || void 0, appName) : [];
+  const localAgents = !type || type === "agents" ? loadLocalAgents(platformDir, name || void 0, appName) : [];
+  if (localCollections.length > 0) allChanges.push(...await planCollections(api, localCollections));
+  if (localAutomations.length > 0) allChanges.push(...await planAutomations(api, localAutomations));
+  if (localHooks.length > 0) allChanges.push(...await planHooks(api, localHooks, collections));
+  if (localAgents.length > 0) allChanges.push(...await planAgents(api, localAgents));
+  if (name) {
+    const hasLocal = localCollections.length > 0 || localAutomations.length > 0 || localHooks.length > 0 || localAgents.length > 0;
+    if (!hasLocal) {
       console.log();
-    } else if (name) {
-      console.log(pc.red(`  Agent "${name}" not found locally`));
+      console.log(pc.red(`  Resource "${name}" not found locally`));
       process.exit(1);
     }
   }
+  let willDeployApp = false;
   if (!type) {
     try {
-      const projectRoot2 = findProjectRoot();
-      if (existsSync(join(projectRoot2, "dist")) || existsSync(join(projectRoot2, "src"))) {
-        console.log(pc.bold("  App:"));
-        await applyApp(args);
-        console.log();
+      if (existsSync(join(projectRoot, "dist")) || existsSync(join(projectRoot, "src"))) {
+        willDeployApp = true;
       }
     } catch {
     }
   }
+  if (allChanges.length === 0 && !willDeployApp) {
+    console.log();
+    console.log(pc.green("  \u2713 Nothing to apply \u2014 local and remote are in sync."));
+    console.log();
+    return;
+  }
+  console.log();
+  console.log(pc.cyan(pc.bold("  Apply")));
+  console.log();
+  const creates = allChanges.filter((c) => c.type === "create");
+  const updates = allChanges.filter((c) => c.type === "update");
+  if (allChanges.length > 0) {
+    console.log(pc.bold("  Plan:"));
+    for (const change of allChanges) {
+      const icon = change.type === "create" ? "+" : "~";
+      const color = change.type === "create" ? pc.green : pc.yellow;
+      const details = change.details ? ` (${change.details})` : "";
+      console.log(`  ${color(icon)} ${change.resource}: ${change.name}${pc.dim(details)}`);
+    }
+    if (willDeployApp) console.log(`  ${pc.blue("\u25CF")} app: frontend build + deploy`);
+    console.log();
+    const parts = [];
+    if (creates.length > 0) parts.push(pc.green(`${creates.length} create`));
+    if (updates.length > 0) parts.push(pc.yellow(`${updates.length} update`));
+    if (willDeployApp) parts.push(pc.blue("1 app deploy"));
+    console.log(`  ${parts.join(", ")}`);
+    console.log();
+  } else if (willDeployApp) {
+    console.log(pc.dim("  No infrastructure changes \u2014 deploying app only."));
+    console.log();
+  }
+  if (!autoConfirm && allChanges.length > 0) {
+    const { confirm } = await prompts({
+      type: "confirm",
+      name: "confirm",
+      message: "  Proceed with apply?",
+      initial: true
+    });
+    if (!confirm) {
+      console.log(pc.dim("  Cancelled."));
+      console.log();
+      return;
+    }
+    console.log();
+  }
+  let totalErrors = 0;
+  let totalCreated = 0;
+  let totalUpdated = 0;
+  let totalSkipped = 0;
+  if (localCollections.length > 0) {
+    console.log(pc.bold("  Collections:"));
+    totalErrors += await applyCollections(api, localCollections);
+    console.log();
+  }
+  try {
+    const remoteCollections = await api.listCollections();
+    collections = new Map(remoteCollections.map((c) => [c.name, c.id]));
+    for (const c of remoteCollections) collections.set(c.id, c.id);
+  } catch {
+  }
+  if (localAutomations.length > 0) {
+    console.log(pc.bold("  Automations:"));
+    totalErrors += await applyAutomations(api, localAutomations);
+    console.log();
+  }
+  if (localHooks.length > 0) {
+    console.log(pc.bold("  Hooks:"));
+    totalErrors += await applyHooks(api, localHooks, collections);
+    console.log();
+  }
+  if (localAgents.length > 0) {
+    console.log(pc.bold("  Agents:"));
+    totalErrors += await applyAgents(api, localAgents);
+    console.log();
+  }
+  if (willDeployApp) {
+    console.log(pc.bold("  App:"));
+    await applyApp(args);
+    console.log();
+  }
+  totalCreated = creates.length;
+  totalUpdated = updates.length;
   if (totalErrors > 0) {
-    console.log(pc.red(`  Failed with ${totalErrors} error${totalErrors > 1 ? "s" : ""}.`));
+    console.log(pc.red(`  \u2717 ${totalErrors} error${totalErrors > 1 ? "s" : ""} during apply.`));
     console.log();
     process.exit(1);
   }
-  console.log(pc.green("  Done!"));
+  const summary = [];
+  if (totalCreated > 0) summary.push(pc.green(`${totalCreated} created`));
+  if (totalUpdated > 0) summary.push(pc.yellow(`${totalUpdated} updated`));
+  if (willDeployApp) summary.push(pc.blue("app deployed"));
+  console.log(pc.green("  \u2713 Done!") + (summary.length > 0 ? ` ${pc.dim("\u2014")} ${summary.join(", ")}` : ""));
   console.log();
 }
 async function pull(args) {
@@ -1727,10 +1942,63 @@ async function pull(args) {
     showPullHelp();
     return;
   }
-  loadEnv();
+  const force = args.includes("--force") || args.includes("-f");
+  const filteredArgs = args.filter((a) => a !== "--force" && a !== "-f");
+  const projectRoot = findProjectRoot();
+  loadEnv(projectRoot);
   const platformDir = getPlatformDir();
   const api = createApiClient();
-  const { type, name } = parseResource(args[0]);
+  const appName = getAppName(projectRoot);
+  const { type, name } = parseResource(filteredArgs[0]);
+  if (!force) {
+    const conflicts = [];
+    let collections;
+    try {
+      const remoteCollections = await api.listCollections();
+      collections = new Map(remoteCollections.map((c) => [c.name, c.id]));
+    } catch {
+      collections = /* @__PURE__ */ new Map();
+    }
+    if (!type || type === "agents") {
+      const localAgents = loadLocalAgents(platformDir, name || void 0, appName);
+      if (localAgents.length > 0) {
+        const changes = await planAgents(api, localAgents);
+        for (const c of changes) {
+          if (c.type === "update") conflicts.push(`agents/${c.name}`);
+        }
+      }
+    }
+    if (!type || type === "automations") {
+      const localAutomations = loadLocalAutomations(platformDir, name || void 0, appName);
+      if (localAutomations.length > 0) {
+        const changes = await planAutomations(api, localAutomations);
+        for (const c of changes) {
+          if (c.type === "update") conflicts.push(`automations/${c.name}`);
+        }
+      }
+    }
+    if (!type || type === "hooks") {
+      const localHooks = loadLocalHooks(platformDir, name || void 0, appName);
+      if (localHooks.length > 0) {
+        const changes = await planHooks(api, localHooks, collections);
+        for (const c of changes) {
+          if (c.type === "update") conflicts.push(`hooks/${c.name}`);
+        }
+      }
+    }
+    if (conflicts.length > 0) {
+      console.log();
+      console.log(pc.yellow(`  \u26A0 ${conflicts.length} local file${conflicts.length > 1 ? "s have" : " has"} changes that would be lost:`));
+      for (const f of conflicts) {
+        console.log(pc.dim(`    ${f}`));
+      }
+      console.log();
+      console.log(pc.dim(`  Use ${pc.cyan("lumera diff <resource>")} to inspect changes.`));
+      console.log(pc.dim(`  Use ${pc.cyan("lumera pull --force")} to overwrite local files.`));
+      console.log();
+      process.exit(1);
+    }
+  }
   console.log();
   console.log(pc.cyan(pc.bold("  Pull")));
   console.log(pc.dim(`  Downloading remote state to ${platformDir}/...`));
@@ -1887,9 +2155,164 @@ async function show(args) {
     await showResource(api, platformDir, type, name, appName);
   }
 }
+function showDiffHelp() {
+  console.log(`
+${pc.bold("lumera diff")} - Show full diff between local and remote state
+
+${pc.dim("Usage:")}
+  lumera diff <resource>
+
+${pc.dim("Resources:")}
+  agents/<name>       Diff agent (system_prompt, policy_script)
+  automations/<name>  Diff automation code
+  hooks/<name>        Diff hook script
+
+${pc.dim("Examples:")}
+  lumera diff agents/bank_activity_matcher
+  lumera diff automations/sync
+  lumera diff hooks/encoding_protect_create
+`);
+}
+function renderFullDiff(field, oldText, newText) {
+  const diffLines = computeLineDiff(oldText, newText);
+  if (diffLines.length === 0) {
+    console.log(pc.dim(`  ${field}: no changes`));
+    return;
+  }
+  console.log(pc.bold(`  --- ${field}`));
+  for (const dl of diffLines) {
+    if (dl.type === "+") console.log(pc.green(`  + ${dl.line}`));
+    else if (dl.type === "-") console.log(pc.red(`  - ${dl.line}`));
+    else console.log(pc.dim(`    ${dl.line}`));
+  }
+  console.log();
+}
+async function diff(args) {
+  if (args.includes("--help") || args.includes("-h") || args.length === 0) {
+    showDiffHelp();
+    if (args.length === 0) process.exit(1);
+    return;
+  }
+  const projectRoot = findProjectRoot();
+  loadEnv(projectRoot);
+  const platformDir = getPlatformDir();
+  const api = createApiClient();
+  const appName = getAppName(projectRoot);
+  const { type, name } = parseResource(args[0]);
+  if (!type || !name) {
+    console.log(pc.red(`  Invalid resource path: ${args[0]}`));
+    console.log(pc.dim("  Use format: <type>/<name> (e.g., agents/bank_activity_matcher)"));
+    process.exit(1);
+  }
+  console.log();
+  if (type === "agents") {
+    const localAgents = loadLocalAgents(platformDir, name, appName);
+    const remoteAgents = await api.listAgents();
+    const local = localAgents[0];
+    const localExtId = local?.agent.external_id;
+    const remote = remoteAgents.find(
+      (a) => a.external_id === name || a.name === name || localExtId && a.external_id === localExtId
+    );
+    if (!local && !remote) {
+      console.log(pc.red(`  Agent "${name}" not found locally or remotely`));
+      process.exit(1);
+    }
+    if (!local) {
+      console.log(pc.cyan(`  Agent "${name}" exists only remotely (not in local files)`));
+      process.exit(0);
+    }
+    if (!remote) {
+      console.log(pc.yellow(`  Agent "${name}" exists only locally (not yet deployed)`));
+      process.exit(0);
+    }
+    console.log(pc.bold(`  Agent: ${local.agent.name}`));
+    console.log();
+    if (remote.name !== local.agent.name)
+      console.log(`  name: ${pc.red(remote.name)} \u2192 ${pc.green(local.agent.name)}`);
+    if ((remote.description || "") !== (local.agent.description || ""))
+      console.log(`  description: ${pc.red(remote.description || "(empty)")} \u2192 ${pc.green(local.agent.description || "(empty)")}`);
+    if ((remote.model || "") !== (local.agent.model || ""))
+      console.log(`  model: ${pc.red(remote.model || "(default)")} \u2192 ${pc.green(local.agent.model || "(default)")}`);
+    if ((remote.policy_enabled || false) !== (local.agent.policy_enabled || false))
+      console.log(`  policy_enabled: ${pc.red(String(remote.policy_enabled || false))} \u2192 ${pc.green(String(local.agent.policy_enabled || false))}`);
+    const promptChanged = (remote.system_prompt || "").trim() !== local.systemPrompt.trim();
+    const policyChanged = (remote.policy_script || "").trim() !== (local.policyScript || "").trim();
+    if (!promptChanged && !policyChanged && remote.name === local.agent.name && (remote.description || "") === (local.agent.description || "") && (remote.model || "") === (local.agent.model || "") && (remote.policy_enabled || false) === (local.agent.policy_enabled || false)) {
+      console.log(pc.green(`  \u2713 No changes`));
+    } else {
+      if (promptChanged) renderFullDiff("system_prompt.md", remote.system_prompt || "", local.systemPrompt);
+      if (policyChanged) renderFullDiff("policy.js", remote.policy_script || "", local.policyScript);
+    }
+  } else if (type === "automations") {
+    const localAutomations = loadLocalAutomations(platformDir, name, appName);
+    const remoteAutomations = await api.listAutomations({ include_code: true });
+    const local = localAutomations[0];
+    const localExtId = local?.automation.external_id;
+    const remote = remoteAutomations.find(
+      (a) => a.external_id === name || a.name === name || localExtId && a.external_id === localExtId
+    );
+    if (!local && !remote) {
+      console.log(pc.red(`  Automation "${name}" not found locally or remotely`));
+      process.exit(1);
+    }
+    if (!local) {
+      console.log(pc.cyan(`  Automation "${name}" exists only remotely`));
+      process.exit(0);
+    }
+    if (!remote) {
+      console.log(pc.yellow(`  Automation "${name}" exists only locally (not yet deployed)`));
+      process.exit(0);
+    }
+    console.log(pc.bold(`  Automation: ${local.automation.name}`));
+    console.log();
+    if (remote.name !== local.automation.name)
+      console.log(`  name: ${pc.red(remote.name)} \u2192 ${pc.green(local.automation.name)}`);
+    const codeChanged = (remote.code || "") !== local.code;
+    if (!codeChanged && remote.name === local.automation.name) {
+      console.log(pc.green(`  \u2713 No changes`));
+    } else if (codeChanged) {
+      renderFullDiff("main.py", remote.code || "", local.code);
+    }
+  } else if (type === "hooks") {
+    const localHooks = loadLocalHooks(platformDir, name, appName);
+    const remoteHooks = await api.listHooks();
+    const local = localHooks[0];
+    const localExtId = local?.hook.external_id;
+    const remote = remoteHooks.find(
+      (h) => h.external_id === name || h.name === name || localExtId && h.external_id === localExtId
+    );
+    if (!local && !remote) {
+      console.log(pc.red(`  Hook "${name}" not found locally or remotely`));
+      process.exit(1);
+    }
+    if (!local) {
+      console.log(pc.cyan(`  Hook "${name}" exists only remotely`));
+      process.exit(0);
+    }
+    if (!remote) {
+      console.log(pc.yellow(`  Hook "${name}" exists only locally (not yet deployed)`));
+      process.exit(0);
+    }
+    console.log(pc.bold(`  Hook: ${local.hook.external_id}`));
+    console.log();
+    if (remote.event !== local.hook.trigger)
+      console.log(`  trigger: ${pc.red(remote.event)} \u2192 ${pc.green(local.hook.trigger)}`);
+    const scriptChanged = (remote.script || "").trim() !== local.script.trim();
+    if (!scriptChanged && remote.event === local.hook.trigger) {
+      console.log(pc.green(`  \u2713 No changes`));
+    } else if (scriptChanged) {
+      renderFullDiff(local.fileName, remote.script || "", local.script);
+    }
+  } else {
+    console.log(pc.red(`  Diff not supported for "${type}" \u2014 use agents, automations, or hooks`));
+    process.exit(1);
+  }
+  console.log();
+}
 export {
   apply,
   destroy,
+  diff,
   list,
   plan,
   pull,

package/dist/{run-3UBV3SVA.js → run-SPC4YXWR.js}

@@ -1,7 +1,7 @@
 import {
   createApiClient,
   loadEnv
-} from "./chunk-7ZGIC6F7.js";
+} from "./chunk-NL6MEHA3.js";
 import {
   getToken
 } from "./chunk-NDLYGKS6.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lumerahq/cli",
-  "version": "0.13.2",
+  "version": "0.15.0",
   "description": "CLI for building and deploying Lumera apps",
   "type": "module",
   "engines": {