@pipefy/pipefy-process-coder 0.1.2 → 0.1.3

package/AGENTS.md

@@ -83,6 +83,23 @@ webhooks", and conflating them licenses deleting a client's live integrations.
 Applies to iPaaS flows identically: a pipe whose iPaaS is off gets `unknown`, and
 its flows are not compared at all.
 
+**Rows and columns are covered separately.** `coverage` says whether every *row*
+of a group was read; `columns` (in `_meta.json`) whether every *column* was. A
+GraphQL reconstruction reads every phase, field and label and still lacks
+`color_uuid` or a label's `uuid`, so its rows are `complete` and its columns
+`partial`. The diff reads them for different questions: a missing column on a
+partial side is "unseen", never "set to null"; a missing *row* is only unseen
+when the rows are partial, and only then is a create or delete held back. These
+were once one flag, and a reconstruction marked everything `partial` — which,
+while the snapshot download was failing on every pipe, left every pull able to
+update and unable to create or delete anything.
+
+**And a held-back create or delete stops the plan.** Between a workspace and its
+own baseline each one is an edit someone made, so `plan` and `apply` refuse,
+naming them, rather than apply the rest (`suppressedEdits`, `--force` to apply
+the rest anyway). Applying 20 updates without the 2 phase creates they pointed
+at would have left a pipe with no final phase.
+
 ### Refuse rather than guess, per column
 
 `src/apply/registry.ts` records, for every entity and operation, whether a write
@@ -252,6 +269,9 @@ live running. Do not re-derive them. The shapes that bite most often:
 | `updateAutomation` | works, across every field map dimension. The recipes' delete-and-recreate was inherited, not measured |
 | internal `AutomationActionParams.aiBehaviorParams` | an **object** (`AiBehaviorParams`), the same type the public `aiAgents` read selects. Selected bare, the whole `loadAutomation` document fails validation — so *every* automation in the pipe loads without `action_params`, not only the AI ones. One selection, `AI_BEHAVIOR_PARAMS_SELECTION`, serves both reads |
 | a snapshot's `signedUrl` | `app.pipefy.com/storage/v1/signed/…`, and it can answer **HTTP 500** with Pipefy's own error page while `createRepoSnapshot` and the `UPLOADED` status both succeed — measured on two unrelated pipes, old snapshots and new. A pull falls back to reconstruction rather than write a workspace with no pipe in it; `--no-fallback` refuses instead |
+| internal `automations(organizationId:, repoId:)` | the organization must be **the pipe's own**. Asked under another organization the credential also belongs to, it answers `Couldn't find Repo with 'id'=…` about a pipe that exists — so a saved default org silently left every automation unknown on pipes from other orgs. The repo's `organization_id` wins; the default is only the fallback |
+| `Pipe.pipe_relations` | **does not exist** publicly. The relations are `parentsRelations` and `childrenRelations`, and their `parent` / `child` are a **union** (`RepoTypes`: Pipe \| Table) — `{ id }` is refused until spread with `... on Pipe { id } ... on Table { id }`. The reconstruction asked for the missing field for its whole life, so pipe_relations was always `unknown` without a snapshot |
+| reconstruction without a snapshot | every group the compiler can write now has a public read: `Phase.teamMembers`, `Pipe.preferences`, `Pipe.publicForm` (its `submitterEmailCollectionMethod` is the payload's `submitter_email_required`). With rows `complete`, a pull whose snapshot download fails supports the whole loop. Only read-only groups stay `unknown` |
 | iPaaS `IMPORT_FLOW` | migrates the tree it is given; never use it |
 | iPaaS connections | the host marks any credential `ACTIVE` **without validating it** |
 | `POST /app-connections/{id}` | accepts `scope` and `projectIds` and returns 200 ignoring both |

package/dist/apply/adopt.js

@@ -126,3 +126,55 @@ export const renderAdopted = (adopted) => {
         lines.push(`   …and ${adopted.length - 8} more`);
     return lines;
 };
+/**
+ * The baseline after an apply that verified, when the read-back was not a
+ * snapshot: the workspace for every group the baseline could see, the old
+ * baseline for every group it could not.
+ *
+ * Without this only created ids reached the baseline (mergeAdoptedIntoBaseline),
+ * so every update and delete an apply had just made stayed "pending" in the
+ * next diff. An update resent is harmless; a delete resent is refused by the
+ * API, about a field the apply itself removed. Found on the first real apply
+ * after snapshot downloads started failing, when this became the only path.
+ *
+ * Why the workspace is safe to adopt here, when a reconstruction is not (see
+ * the post-snapshot branch in apply.ts): verify has just confirmed that the
+ * live pipe satisfies everything the workspace states, and the workspace
+ * carries every row the baseline did unless the author removed it — which the
+ * apply has also done. A group `unknown` on the baseline was never diffed, so
+ * an edit there was never applied, and adopting it would mark unapplied work
+ * done. Those groups keep the baseline's copy.
+ */
+/**
+ * Phases carry two folded groups that may be unknown on their own. The phase
+ * and field rows come from the workspace; a folded list the baseline could not
+ * see keeps the baseline's copy, matched by phase id.
+ */
+const advancePhases = (baseline, applied, jumpsSeen, teamSeen) => {
+    if (jumpsSeen && teamSeen)
+        return applied.phases;
+    const before = new Map(baseline.phases.map((ph) => [String(ph['id']), ph]));
+    return applied.phases.map((ph) => {
+        const old = before.get(String(ph['id']));
+        return {
+            ...ph,
+            jump_target_ids: jumpsSeen ? ph.jump_target_ids : (old?.jump_target_ids ?? []),
+            team_member_ids: teamSeen ? ph.team_member_ids : (old?.team_member_ids ?? []),
+        };
+    });
+};
+export const advanceBaseline = (baseline, applied) => {
+    const seen = (...groups) => groups.every((g) => (baseline.meta.coverage[g] ?? 'unknown') !== 'unknown');
+    return {
+        ...baseline,
+        repo: applied.repo,
+        phases: seen('phases', 'fields') ? advancePhases(baseline, applied, seen('phase_jumps'), seen('phase_team_memberships')) : baseline.phases,
+        automations: seen('automations') ? applied.automations : baseline.automations,
+        field_conditions: seen('field_conditions') ? applied.field_conditions : baseline.field_conditions,
+        labels: seen('labels') ? applied.labels : baseline.labels,
+        webhooks: seen('webhooks') ? applied.webhooks : baseline.webhooks,
+        pipe_relations: seen('pipe_relations') ? applied.pipe_relations : baseline.pipe_relations,
+        public_form: seen('public_forms') ? applied.public_form : baseline.public_form,
+        preferences: seen('repo_preferences') ? applied.preferences : baseline.preferences,
+    };
+};

package/dist/codec/pack.js

@@ -83,6 +83,8 @@ export const packEnvelope = (tree) => ({
     readAt: tree.meta.readAt,
     repoKind: tree.meta.repoKind,
     coverage: tree.meta.coverage,
+    ...(tree.meta.columns ? { columns: tree.meta.columns } : {}),
+    repo_columns: tree.meta.repo_columns,
     notes: tree.meta.notes,
     payload: pack(tree),
 });

package/dist/codec/unpack.js

@@ -155,6 +155,7 @@ export const unpack = (env) => {
             readAt: env.readAt,
             repoKind: env.repoKind,
             coverage: env.coverage,
+            ...(env.columns ? { columns: env.columns } : {}),
             repo_columns: env.repo_columns ?? 'complete',
             notes: env.notes,
         },

package/dist/commands/apply.js

@@ -10,7 +10,7 @@ import { unpack } from "../codec/unpack.js";
 import { packEnvelope } from "../codec/pack.js";
 import { upsertRepo, writeLock } from "../workspace/lock.js";
 import { renderStamp, stampCreated } from "../workspace/stamp.js";
-import { adoptCreatedIds, mergeAdoptedIntoBaseline, renderAdopted } from "../apply/adopt.js";
+import { adoptCreatedIds, advanceBaseline, mergeAdoptedIntoBaseline, renderAdopted } from "../apply/adopt.js";
 import { baselineFile, planFile, planFileFor, findPlanFile } from "../workspace/layout.js";
 import { diffTrees } from "../diff/diff.js";
 import { compile } from "../apply/compile.js";
@@ -19,7 +19,7 @@ import { execute } from "../apply/execute.js";
 import { validateTree, blockingErrors } from "../validate/index.js";
 import { connect, openWorkspace, resolveWorkspace } from "./context.js";
 import { checkGit } from "../util/git.js";
-import { loadBaseline, loadBaselineEnvelope, refFor } from "./diff.js";
+import { loadBaseline, loadBaselineEnvelope, refFor, refuseSuppressedEdits } from "./diff.js";
 import { loadPlan, renderPlan, warnUnverifiedSteps } from "./plan.js";
 import { verifyRepo } from "./verify.js";
 import { restoreToVersion } from "./misc.js";
@@ -438,6 +438,7 @@ const applyOneRepo = async (p) => {
         }
         rec?.before(await loadBaselineEnvelope(root, repo.id));
         const changeSet = diffTrees(baseline, edited);
+        refuseSuppressedEdits(changeSet, bool(p, 'force'));
         if (!changeSet.changes.length) {
             /**
              * The pipe half is clean. That is not the same as nothing to apply: flows
@@ -702,6 +703,7 @@ const applyOneRepo = async (p) => {
          */
         const takeSnapshot = caps.snapshots && (bool(p, 'post-snapshot') || (await confirmPostSnapshot(p)));
         const verified = await verifyRepo({
+            parsed: p,
             net,
             root,
             lock,
@@ -710,8 +712,15 @@ const applyOneRepo = async (p) => {
             idMap: result.idMap,
             preferReconstruct: !takeSnapshot,
         });
+        /**
+         * What was actually read, not what was asked for. A requested snapshot can
+         * come back as a reconstruction when the download fails (readLive), and
+         * everything below that adopts the read-back wholesale is only safe on a
+         * real snapshot — so it keys on this, never on takeSnapshot.
+         */
+        const realRead = verified.envelope.source === 'snapshot';
         if (!verified.ok) {
-            warn(takeSnapshot
+            warn(realRead
                 ? 'verification found differences between what was applied and what the workspace asks for:'
                 : 'a free, GraphQL-reconstructed comparison found differences — coverage gaps may hide more (see below):');
             out(verified.render);
@@ -730,7 +739,7 @@ const applyOneRepo = async (p) => {
              * GraphQL reconstruction's partial coverage risks the same "adopt an
              * absence as a deletion" mistake the coverage doctrine exists to avoid.
              */
-            if (takeSnapshot) {
+            if (realRead) {
                 const authored = await readTree(dir);
                 const previous = await loadBaselineEnvelope(root, repo.id);
                 const stamp = stampCreated(authored, unpack(verified.envelope), previous ? unpack(previous) : null);
@@ -754,10 +763,20 @@ const applyOneRepo = async (p) => {
             await reportRun(rec, 'partial', `all ${result.done} steps applied, but verification found differences`);
             return 1;
         }
-        ok(takeSnapshot ? 'verified — the pipe now matches the workspace' : 'verified against a free GraphQL reconstruction — the pipe matches the workspace');
+        ok(realRead ? 'verified — the pipe now matches the workspace' : 'verified against a free GraphQL reconstruction — the pipe matches the workspace');
         rec?.after(verified.envelope);
         rec?.verified(true);
-        if (takeSnapshot) {
+        if (!realRead) {
+            // The read-back is not adopted (see advanceBaseline); the verified
+            // workspace is, for every group the baseline could see.
+            const previousEnvelope = await loadBaselineEnvelope(root, repo.id);
+            if (previousEnvelope) {
+                const next = advanceBaseline(unpack(previousEnvelope), await readTree(dir));
+                await writeJson(baselineFile(root, repo.id), { ...packEnvelope(next), readAt: new Date().toISOString() });
+                info(dim('   baseline advanced to the applied workspace — the next diff starts from what is now live'));
+            }
+        }
+        if (realRead) {
             /**
              * Adopt the live state as both the workspace and the baseline —
              * strictly more complete than the id-only adoption above, since it also

package/dist/commands/context.js

@@ -1,7 +1,7 @@
 import { dirname, isAbsolute, join, resolve } from 'node:path';
 import { LIMITS, credentialProvider, readOrgId } from "../config.js";
 import { exists } from "../util/fsx.js";
-import { UserError, debug } from "../util/log.js";
+import { UserError, debug, warn } from "../util/log.js";
 import { PipefyClient } from "../pipefy/client.js";
 import { InternalApi } from "../pipefy/internal.js";
 import { SnapshotClient } from "../pipefy/snapshot.js";
@@ -10,7 +10,8 @@ import { IpaasClient } from "../pipefy/ipaas.js";
 import { detect } from "../pipefy/capability.js";
 import { paths } from "../workspace/layout.js";
 import { readLock } from "../workspace/lock.js";
-import { str } from "../cli/args.js";
+import { bool, str } from "../cli/args.js";
+import { fullCoverage } from "../model/payload.js";
 export const connect = async (p) => {
     /**
      * One credential, shared by the public client and the internal adapter, and
@@ -77,3 +78,40 @@ export const openWorkspace = async (p, positionalIndex = 0) => {
     return { root, lock, repo, repoDir: join(root, repo.dir) };
 };
 export const readConcurrency = () => LIMITS.readConcurrency;
+/**
+ * Read one repo live: a snapshot when the endpoint has them and the caller
+ * wants one, a GraphQL reconstruction otherwise — and a reconstruction when
+ * the snapshot read fails.
+ *
+ * The fallback is the point. Pipefy's storage answered every signed snapshot
+ * URL with HTTP 500 for days while creation and the UPLOADED status were
+ * fine, and every command that read live through a snapshot — verify, diff
+ * --against live, a cross-repo diff, export — failed outright, after `pull`
+ * had already learned to carry on. Reconstruction says per group what it
+ * could not see, so falling back never makes absence look like deletion.
+ * `--no-fallback` keeps the old refusal.
+ */
+export const readLive = async (net, p, repoId, opts = {}) => {
+    const caps = await net.capabilities();
+    const reconstruct = () => net.reconstructor.reconstruct(repoId, { organizationId: opts.organizationId ?? net.organizationId, noInternal: opts.noInternal });
+    if (!caps.snapshots || opts.preferSnapshot === false)
+        return reconstruct();
+    try {
+        const { payload, versionId } = await net.snapshots.pull(repoId, opts.label);
+        return {
+            source: 'snapshot',
+            versionId,
+            readAt: new Date().toISOString(),
+            repoKind: opts.kind ?? 'pipe',
+            coverage: fullCoverage('complete'),
+            notes: [],
+            payload,
+        };
+    }
+    catch (e) {
+        if (bool(p, 'no-fallback'))
+            throw e;
+        warn(`snapshot read failed for repo ${repoId}: ${e.message} — reading it over GraphQL instead (--no-fallback to stop here)`);
+        return reconstruct();
+    }
+};

package/dist/commands/diff.js

@@ -6,10 +6,10 @@ import { UserError, bold, dim, info, ok, out, warn } from "../util/log.js";
 import { unpack } from "../codec/unpack.js";
 import { readTree } from "../workspace/read.js";
 import { baselineFile, repoDir } from "../workspace/layout.js";
-import { diffTrees } from "../diff/diff.js";
+import { diffTrees, suppressedEdits } from "../diff/diff.js";
 import { renderChangeSet, toJson } from "../diff/render.js";
 import { renderHtml } from "../diff/html.js";
-import { connect, openWorkspace } from "./context.js";
+import { connect, openWorkspace, readLive } from "./context.js";
 import { diffFlowsFor } from "./flows.js";
 import { renderFlowChanges } from "../diff/flow.js";
 import { diffAgentsFor } from "./agents.js";
@@ -43,9 +43,7 @@ export const run = async (p) => {
         const net = await connect(p);
         const caps = await net.capabilities();
         info(dim(`re-reading pipe ${repo.id} (${caps.snapshots ? 'snapshot' : 'GraphQL reconstruction'})`));
-        const env = caps.snapshots
-            ? await liveSnapshot(net, repo.id)
-            : await net.reconstructor.reconstruct(repo.id, { organizationId: lock.organizationId });
+        const env = await readLive(net, p, repo.id, { kind: repo.kind, organizationId: lock.organizationId });
         baseline = unpack(env);
     }
     else if (against !== 'baseline') {
@@ -61,9 +59,9 @@ export const run = async (p) => {
         }
         else {
             const net = await connect(p);
-            const caps = await net.capabilities();
             info(dim(`reading pipe ${otherId} live for a cross-repo diff`));
-            const env = caps.snapshots ? await liveSnapshot(net, otherId) : await net.reconstructor.reconstruct(otherId, { organizationId: lock.organizationId });
+            // The other pipe's own organization, not this workspace's (readLive -> reconstruct).
+            const env = await readLive(net, p, otherId, { organizationId: null });
             baseline = unpack(env);
         }
     }
@@ -219,6 +217,23 @@ export const run = async (p) => {
  * report does not: a report keeps the payload verbatim so the run folder is a
  * usable copy of the pipe, not a reshaped one.
  */
+/**
+ * Refuse a plan that would apply only part of what the workspace asks for.
+ * See suppressedEdits. `--force` keeps its meaning elsewhere — apply what can
+ * be applied — and says out loud what it is leaving behind.
+ */
+export const refuseSuppressedEdits = (cs, force) => {
+    const left = suppressedEdits(cs);
+    if (!left.length)
+        return;
+    const list = left.map((s) => `  ${s.op} ${s.entity}: ${s.label}`).join('\n');
+    if (force) {
+        warn(`--force: ${left.length} create/delete(s) in the workspace are left out of this plan:\n${list}`);
+        return;
+    }
+    throw new UserError(`${left.length} create/delete(s) in the workspace cannot be planned, because the baseline read those rows only partially:\n${list}\n` +
+        'Planning the rest without them would apply part of what was asked for.', 're-pull to refresh the baseline, or pass --force to apply the rest anyway');
+};
 export const loadBaselineEnvelope = async (root, repoId) => {
     try {
         return await readJson(baselineFile(root, repoId));
@@ -246,19 +261,6 @@ export const loadBaselineQuiet = async (root, repoId) => {
         return null;
     }
 };
-const liveSnapshot = async (net, repoId) => {
-    const { payload, versionId } = await net.snapshots.pull(repoId);
-    const { fullCoverage } = await import("../model/payload.js");
-    return {
-        source: 'snapshot',
-        versionId,
-        readAt: new Date().toISOString(),
-        repoKind: 'pipe',
-        coverage: fullCoverage('complete'),
-        notes: [],
-        payload,
-    };
-};
 export const writeHtml = async (path, changeSet, workspace, plan) => {
     const html = renderHtml({ changeSet, plan, workspace, generatedAt: new Date().toISOString() });
     await writeFile(path, html);

package/dist/commands/misc.js

@@ -13,7 +13,7 @@ import { RECONSTRUCTION_GAPS } from "../pipefy/reconstruct.js";
 import { readTree } from "../workspace/read.js";
 import { registryRows } from "../apply/registry.js";
 import { validateTree, renderFindings, blockingErrors } from "../validate/index.js";
-import { connect, openWorkspace } from "./context.js";
+import { connect, openWorkspace, readLive } from "./context.js";
 // ── login ────────────────────────────────────────────────────────────────────
 export const loginHelp = `pipe login [options]
 
@@ -167,10 +167,13 @@ export const doctor = async (p) => {
     if (repoId) {
         out('');
         out(bold(`probing repo ${repoId}`));
-        const jumps = await net.internal.getPhaseSettings(await firstPhaseId(net, repoId));
+        const repo = await probeRepo(net, repoId);
+        const jumps = await net.internal.getPhaseSettings(repo.firstPhaseId);
         out(`  internal settings endpoint  ${jumps ? green('answers') : red('no answer')}`);
-        const autos = net.organizationId ? await net.internal.listAutomations(net.organizationId, repoId) : null;
-        out(`  internal automations query   ${autos ? green(`answers (${autos.length} automations)`) : net.organizationId ? red('no answer') : yellow('needs --org')}`);
+        // The repo's own organization, as a pull uses — not the saved default.
+        const orgId = repo.organizationId ?? net.organizationId;
+        const autos = orgId ? await net.internal.listAutomations(orgId, repoId) : null;
+        out(`  internal automations query   ${autos ? green(`answers (${autos.length} automations)`) : orgId ? red('no answer') : yellow('needs --org')}`);
     }
     out('');
     out(bold('internal API'));
@@ -203,9 +206,12 @@ export const doctor = async (p) => {
     }
     return 0;
 };
-const firstPhaseId = async (net, repoId) => {
-    const data = await net.client.tryRaw('query($id: ID!) { pipe(id: $id) { phases { id } } }', { id: repoId }, 'first phase');
-    return data?.pipe?.phases?.[0]?.id ?? '0';
+const probeRepo = async (net, repoId) => {
+    const data = await net.client.tryRaw('query($id: ID!) { pipe(id: $id) { organizationId phases { id } } }', { id: repoId }, 'probe repo');
+    return {
+        firstPhaseId: data?.pipe?.phases?.[0]?.id ?? '0',
+        organizationId: data?.pipe?.organizationId ? String(data.pipe.organizationId) : null,
+    };
 };
 // ── export ───────────────────────────────────────────────────────────────────
 export const exportHelp = `pipe export <pipeId> [options]
@@ -225,26 +231,7 @@ export const exportCmd = async (p) => {
     const net = await connect(p);
     const caps = await net.capabilities();
     const useSnapshot = caps.snapshots && !bool(p, 'no-snapshot');
-    let env;
-    if (useSnapshot) {
-        const { payload, versionId } = await net.snapshots.pull(repoId);
-        const { fullCoverage } = await import("../model/payload.js");
-        env = {
-            source: 'snapshot',
-            versionId,
-            readAt: new Date().toISOString(),
-            repoKind: 'pipe',
-            coverage: fullCoverage('complete'),
-            notes: [],
-            payload,
-        };
-    }
-    else {
-        env = await net.reconstructor.reconstruct(repoId, {
-            organizationId: net.organizationId,
-            noInternal: bool(p, 'no-internal'),
-        });
-    }
+    const env = await readLive(net, p, repoId, { preferSnapshot: useSnapshot, noInternal: bool(p, 'no-internal') });
     /**
      * A bare payload has no provenance, and for a reconstructed read that matters.
      *

package/dist/commands/plan.js

@@ -10,7 +10,7 @@ import { compile } from "../apply/compile.js";
 import { readAutomationCatalogue } from "../pipefy/automations.js";
 import { validateTree, renderFindings, blockingErrors } from "../validate/index.js";
 import { connect, openWorkspace } from "./context.js";
-import { loadBaseline, writeHtml, openViewer } from "./diff.js";
+import { loadBaseline, writeHtml, openViewer, refuseSuppressedEdits } from "./diff.js";
 export const help = `pipe plan [workspace] [options]
 
   --repo <id>            which repo in the workspace (default: the root pipe)
@@ -115,6 +115,8 @@ export const run = async (p) => {
         throw new UserError(`${blocking.length} validation error${blocking.length === 1 ? '' : 's'} — fix these before planning`);
     }
     const changeSet = diffTrees(baseline, edited);
+    // Before the empty check: edits that were all left out are not "nothing to do".
+    refuseSuppressedEdits(changeSet, bool(p, 'force'));
     if (!changeSet.changes.length) {
         /**
          * The pipe half is clean, which is not the same as nothing to do: a flow-only

package/dist/commands/pull.js

@@ -196,14 +196,23 @@ export const run = async (p) => {
      * the next diff had no baseline. This used to finish with exit code 0 and a
      * "next: pipe validate", which scripts and agents believed.
      */
-    if (!(await readRepo(rootRef))) {
+    const rootEnvelope = await readRepo(rootRef);
+    if (!rootEnvelope) {
         ui.stop();
         throw new UserError(`could not read the root repo ${rootRepoId}${rootRef.name ? ` (${rootRef.name})` : ''} — nothing was written to ${outDir}`, useSnapshots && noFallback
             ? 'drop --no-fallback to read it over GraphQL, or run with --verbose for the cause'
             : 'run with --verbose for the cause');
     }
     await mkdirp(outDir);
-    const lock = emptyLock(rootRepoId, net.organizationId, depth);
+    /**
+     * The workspace's organization is the root pipe's, not the credential's
+     * default: `plan` hands this to the compiler, and a token can belong to
+     * several organizations. The default is only the fallback for a payload
+     * that does not say.
+     */
+    const rootOrg = rootEnvelope.payload['organization_id'];
+    const organizationId = rootOrg ? String(rootOrg) : net.organizationId;
+    const lock = emptyLock(rootRepoId, organizationId, depth);
     lock.edges = discovery.edges;
     const trees = [];
     const sources = new Set();
@@ -308,7 +317,8 @@ export const run = async (p) => {
         const detail = ref.kind === 'table'
             ? `${fieldCount} fields, ${Math.max(0, tree.phases.length - 1)} record statuses, ${written.length} files`
             : `${tree.phases.length} phases, ${fieldCount} fields, ` +
-                `${tree.automations.length} automations, ${written.length} files`;
+                // "0 automations" beside an unknown group read as "this pipe has none".
+                `${env.coverage.automations === 'unknown' ? 'automations unknown' : `${tree.automations.length} automations`}, ${written.length} files`;
         ui.update(task, {
             state: 'done',
             detail: detail + (gaps.length ? `, ${gaps.length} groups partial or unknown` : ''),
@@ -319,7 +329,7 @@ export const run = async (p) => {
         name: rootRef.name ?? String(rootRepoId),
         createdAt: new Date().toISOString(),
         rootRepoId,
-        organizationId: net.organizationId,
+        organizationId,
         depth,
         lastPullSource: sources.size > 1 ? 'mixed' : (sources.values().next().value ?? 'reconstructed'),
         tool: { ...TOOL },

package/dist/commands/verify.js

@@ -1,13 +1,12 @@
 import { bool } from "../cli/args.js";
 import { writeJson } from "../util/fsx.js";
 import { dim, info, ok, out, stripAnsi, warn } from "../util/log.js";
-import { fullCoverage } from "../model/payload.js";
 import { unpack } from "../codec/unpack.js";
 import { readTree } from "../workspace/read.js";
 import { baselineFile } from "../workspace/layout.js";
 import { diffTrees } from "../diff/diff.js";
 import { renderChangeSet } from "../diff/render.js";
-import { connect, openWorkspace } from "./context.js";
+import { connect, openWorkspace, readLive } from "./context.js";
 import { RunRecorder, invocation } from "../report/run.js";
 export const help = `pipe verify [workspace] [options]
 
@@ -40,20 +39,7 @@ export const run = async (p) => {
         const { writeTree } = await import("../workspace/write.js");
         const caps = await net.capabilities();
         info(dim(`reading pipe ${repo.id} to match against (${caps.snapshots ? 'snapshot' : 'GraphQL reconstruction'})`));
-        const envelope = caps.snapshots
-            ? await (async () => {
-                const { payload, versionId } = await net.snapshots.pull(repo.id);
-                return {
-                    source: 'snapshot',
-                    versionId,
-                    readAt: new Date().toISOString(),
-                    repoKind: repo.kind,
-                    coverage: fullCoverage('complete'),
-                    notes: [],
-                    payload,
-                };
-            })()
-            : await net.reconstructor.reconstruct(repo.id, { organizationId: lock.organizationId });
+        const envelope = await readLive(net, p, repo.id, { kind: repo.kind, organizationId: lock.organizationId });
         const authored = await readTree(dir);
         const { loadBaselineEnvelope } = await import("./diff.js");
         const previous = await loadBaselineEnvelope(root, repo.id);
@@ -88,7 +74,7 @@ export const run = async (p) => {
         return 0;
     }
     const rec = recorderFor(p, root, repo, 'verify');
-    const result = await verifyRepo({ net, root, lock, repo, expectedTreeDir: dir });
+    const result = await verifyRepo({ net, parsed: p, root, lock, repo, expectedTreeDir: dir });
     rec?.after(result.envelope);
     rec?.verified(result.ok, result.ok ? undefined : `${result.changeCount} difference(s) remain`);
     if (bool(p, 'json')) {
@@ -143,6 +129,8 @@ const write = async (rec, outcome, summary) => {
     else if (res)
         info(dim(`   run recorded in runs/${rec.id}/`));
 };
+/** No flags: a caller that passes none gets the defaults, fallback included. */
+const EMPTY_ARGS = { command: 'verify', positionals: [], flags: {} };
 export const verifyRepo = async (args) => {
     const { net, lock, repo, expectedTreeDir, idMap, preferReconstruct } = args;
     const caps = await net.capabilities();
@@ -159,21 +147,12 @@ export const verifyRepo = async (args) => {
      * comparison and a verified-clean apply proves less than it appears to.
      * `preferReconstruct` trades that away deliberately — see its doc comment.
      */
-    if (useSnapshot) {
-        const { payload, versionId } = await net.snapshots.pull(repo.id, `post-apply/${new Date().toISOString()}`);
-        envelope = {
-            source: 'snapshot',
-            versionId,
-            readAt: new Date().toISOString(),
-            repoKind: repo.kind,
-            coverage: fullCoverage('complete'),
-            notes: [],
-            payload,
-        };
-    }
-    else {
-        envelope = await net.reconstructor.reconstruct(repo.id, { organizationId: lock.organizationId });
-    }
+    envelope = await readLive(net, args.parsed ?? EMPTY_ARGS, repo.id, {
+        kind: repo.kind,
+        label: `post-apply/${new Date().toISOString()}`,
+        organizationId: lock.organizationId,
+        preferSnapshot: useSnapshot,
+    });
     const live = unpack(envelope);
     /**
      * Direction matters: live -> expected. A change in this diff means "the pipe

package/dist/diff/diff.js

@@ -378,8 +378,19 @@ export const diffTrees = (before, after, opts = {}) => {
      * second would be catastrophic.
      */
     const skipSet = new Set(opts.skipEntities ?? []);
-    /** Which sides read this group only partially. See deltasOf. */
+    /**
+     * Which sides read this group's *columns* only partially. See deltasOf.
+     * `meta.columns` when the read recorded it, otherwise the group's coverage —
+     * what a snapshot, and every workspace pulled before the two were split,
+     * carry.
+     */
+    const columnCoverage = (tree, entity) => tree.meta.columns?.[entity] ?? tree.meta.coverage?.[entity] ?? 'unknown';
     const partialSides = (entity) => ({
+        before: columnCoverage(before, entity) === 'partial',
+        after: columnCoverage(after, entity) === 'partial',
+    });
+    /** Which sides read this group's *rows* only partially — the row rule below. */
+    const partialRows = (entity) => ({
         before: (before.meta.coverage?.[entity] ?? 'unknown') === 'partial',
         after: (after.meta.coverage?.[entity] ?? 'unknown') === 'partial',
     });
@@ -392,12 +403,14 @@ export const diffTrees = (before, after, opts = {}) => {
      * "deletes" — and an apply would have deleted two live automations because one
      * read path could not see them.
      *
-     * So on a partial side, absence means unseen: a delete is suppressed when the
-     * *after* side is partial, and a create when the *before* side is partial.
+     * So on a side whose *rows* are partial, absence means unseen: a delete is
+     * suppressed when the *after* side is partial, and a create when the *before*
+     * side is partial. Missing columns say nothing about rows, so they do not
+     * enter into this (see Coverage on TreeMeta.columns).
      */
     const suppressed = [];
     const rowAbsenceIsUnknown = (entity, op, label) => {
-        const sides = partialSides(entity);
+        const sides = partialRows(entity);
         const unknown = op === 'delete' ? sides.after : sides.before;
         if (unknown)
             suppressed.push({ entity, op, label });
@@ -963,6 +976,7 @@ export const diffTrees = (before, after, opts = {}) => {
             entity: s.entity,
             reason: `"${s.label}" would read as a ${s.op}, but that side's coverage is partial — ` +
                 `absence there is unseen, not gone. Re-read from a snapshot to decide.`,
+            suppressed: { op: s.op, label: s.label },
         });
     }
     return {
@@ -975,6 +989,16 @@ export const diffTrees = (before, after, opts = {}) => {
     };
 };
 export const isEmpty = (cs) => cs.changes.length === 0;
+/**
+ * The creates and deletes this change set had to leave out.
+ *
+ * Between a workspace and its own baseline every one of these is an edit
+ * someone made, and planning the rest without them is applying half of what
+ * was asked for. Found in a field run: 20 updates would have gone through and
+ * the 2 phase creates they pointed at would not, leaving a pipe with no final
+ * phase. `plan` and `apply` refuse on these unless told otherwise.
+ */
+export const suppressedEdits = (cs) => cs.skipped.flatMap((s) => (s.suppressed ? [{ entity: s.entity, ...s.suppressed }] : []));
 export const countByOp = (cs) => {
     const out = { create: 0, update: 0, delete: 0, reorder: 0, archive: 0, unarchive: 0 };
     for (const c of cs.changes)

package/dist/pipefy/internal.js

@@ -132,7 +132,11 @@ export class InternalApi {
             this.status = 'unavailable';
         if (!this.warned) {
             this.warned = true;
-            warn(`internal API unavailable (${reason}). Automation details and phase jumps ` +
+            warn(
+            // "Unavailable" read as an outage for answers like "Permission denied"
+            // or "Couldn't find Repo", which are the endpoint answering about this
+            // pipe and this credential. The reason says which.
+            `internal API call failed (${reason}). Automation details and phase jumps ` +
                 `will be reported as unknown rather than empty — see PLAN.md §2.1.`);
         }
     }
@@ -188,8 +192,19 @@ export class InternalApi {
         this.status = results.every((r) => r.ok) ? 'ok' : 'incompatible';
         return results;
     }
-    /** GraphQL over the internal endpoint. Returns null when the endpoint fails. */
-    async gql(query, variables, label) {
+    /** The message of the last failed `gql` call, for a caller that reports it itself. */
+    lastError = null;
+    /**
+     * GraphQL over the internal endpoint. Returns null when the endpoint fails.
+     *
+     * `soft` is for a call whose failure is an answer about this pipe rather than
+     * about the endpoint — the iPaaS token, refused with "iPaaS is disabled for
+     * your organization". It used to mark the adapter unavailable and print that
+     * automation details and phase jumps would be unknown, on a pull where both
+     * had just been read. The caller reports it, from `lastError`.
+     */
+    async gql(query, variables, label, opts = {}) {
+        this.lastError = null;
         try {
             const data = await retry(async () => {
                 this.requestCount++;
@@ -225,6 +240,9 @@ export class InternalApi {
         }
         catch (e) {
             debug(`internal gql ${label} failed: ${e.message}`);
+            this.lastError = e.message;
+            if (opts.soft && !e.invalidQuery)
+                return null;
             if (e.invalidQuery)
                 this.markIncompatible(label, e.message);
             else

package/dist/pipefy/ipaas.js

@@ -86,11 +86,12 @@ export class IpaasClient {
             return hit.session;
         const minted = await this.internal.gql(`query GetAdvancedAutomationsToken($repoId: ID!) {
          advancedAutomationsToken(repoId: $repoId) { token }
-       }`, { repoId: String(pipeId) }, 'GetAdvancedAutomationsToken');
+       }`, { repoId: String(pipeId) }, 'GetAdvancedAutomationsToken', { soft: true });
         const token = minted?.advancedAutomationsToken?.token;
         if (!token) {
-            throw new IpaasUnavailable(pipeId, `no advanced-automations token for pipe ${pipeId} — iPaaS may be off for this organization, ` +
-                'or this credential may not be allowed to create automations on the pipe');
+            const said = this.internal.lastError;
+            throw new IpaasUnavailable(pipeId, `no advanced-automations token for pipe ${pipeId} — ` +
+                (said ?? 'iPaaS may be off for this organization, or this credential may not be allowed to create automations on the pipe'));
         }
         const res = await fetch(`${this.base}/managed-authn/external-token`, {
             method: 'POST',

package/dist/pipefy/reconstruct.js

@@ -236,7 +236,8 @@ export class Reconstructor {
                 p['index'] = i;
         });
         relations.phases = phaseRows;
-        mark('phases', phase.missing ? 'partial' : 'complete');
+        // Every phase comes back; what can be missing is columns, recorded below.
+        mark('phases', 'complete');
         /**
          * `Phase.next_phase_ids` is public, but it is **not** the payload's
          * `phase_jumps`. Checked against a snapshot of the same pipe:
@@ -291,7 +292,7 @@ export class Reconstructor {
         for (const p of gqlPhases)
             pushFields(p['fields'] ?? [], numOrNull(p['id']));
         relations.fields = fieldRows;
-        mark('fields', field.missing ? 'partial' : 'complete');
+        mark('fields', 'complete');
         if (field.missing)
             notes.push(`field columns not in this schema: ${field.skipped.join(', ')}`);
         // ── labels ──────────────────────────────────────────────────────────────
@@ -303,9 +304,9 @@ export class Reconstructor {
                 color: l['color'],
                 repo_id: root['id'],
             }));
-            // No `uuid` over the public API, and uuid is how labels are identified in
-            // a snapshot — so this is partial, not complete.
-            mark('labels', 'partial');
+            // Every label comes back. No `uuid` over the public API — and uuid is how
+            // a snapshot identifies labels — but that is a column, recorded below.
+            mark('labels', 'complete');
         }
         else {
             notes.push('labels: not readable over this endpoint');
@@ -329,27 +330,115 @@ export class Reconstructor {
             notes.push('webhooks: not readable over this endpoint');
         }
         // ── pipe_relations ──────────────────────────────────────────────────────
-        const prSel = await this.client.prune('Pipe', [
-            ['pipe_relations', '{ id name parent { id } child { id } canCreateNewItems canConnectExistingItems canConnectMultipleItems childMustExistToMoveParent childMustExistToFinishParent allChildrenMustBeDoneToMoveParent allChildrenMustBeDoneToFinishParent }'],
-        ]);
-        if (prSel) {
-            const pr = await this.client.tryRaw(`query($id: ID!) { pipe(id: $id) { ${prSel} } }`, { id: String(repoId) }, 'pipe_relations');
-            if (pr?.pipe?.pipe_relations) {
-                relations.pipe_relations = pr.pipe.pipe_relations.map((r) => ({
-                    id: numOrNull(r['id']),
-                    name: r['name'],
-                    parent_id: numOrNull(firstId(r['parent'])),
-                    child_id: numOrNull(firstId(r['child'])),
-                    can_create_new_items: r['canCreateNewItems'],
-                    can_connect_existing_items: r['canConnectExistingItems'],
-                    can_connect_multiple_items: r['canConnectMultipleItems'],
-                    child_must_exist_to_move_parent: r['childMustExistToMoveParent'],
-                    child_must_exist_to_finish_parent: r['childMustExistToFinishParent'],
-                    all_children_must_be_done_to_move_parent: r['allChildrenMustBeDoneToMoveParent'],
-                    all_children_must_be_done_to_finish_parent: r['allChildrenMustBeDoneToFinishParent'],
-                }));
-                mark('pipe_relations', 'partial');
-            }
+        /**
+         * `Pipe.pipe_relations` does not exist — this used to ask for it, the prune
+         * dropped it, and every reconstructed pull had pipe_relations `unknown`.
+         * The public names are `parentsRelations` and `childrenRelations`, and their
+         * `parent` / `child` are a union (Pipe | Table), so `{ id }` is refused
+         * until it is spread per type. Both directions are read and merged by id:
+         * which of them a snapshot carries has not been measured, and a superset
+         * can only add a row a snapshot lacks, never hide one this pipe has.
+         */
+        const REL = `{ id name
+      parent { ... on Pipe { id } ... on Table { id } }
+      child { ... on Pipe { id } ... on Table { id } }
+      canCreateNewItems canConnectExistingItems canConnectMultipleItems
+      childMustExistToMoveParent childMustExistToFinishParent
+      allChildrenMustBeDoneToMoveParent allChildrenMustBeDoneToFinishParent }`;
+        const pr = await this.client.tryRaw(`query($id: ID!) { pipe(id: $id) { parentsRelations ${REL} childrenRelations ${REL} } }`, { id: String(repoId) }, 'pipe_relations');
+        if (pr?.pipe && Array.isArray(pr.pipe.parentsRelations) && Array.isArray(pr.pipe.childrenRelations)) {
+            const byId = new Map();
+            for (const r of [...pr.pipe.parentsRelations, ...pr.pipe.childrenRelations])
+                byId.set(String(r['id']), r);
+            relations.pipe_relations = [...byId.values()].map((r) => ({
+                id: numOrNull(r['id']),
+                name: r['name'],
+                parent_id: numOrNull(firstId(r['parent'])),
+                child_id: numOrNull(firstId(r['child'])),
+                can_create_new_items: r['canCreateNewItems'],
+                can_connect_existing_items: r['canConnectExistingItems'],
+                can_connect_multiple_items: r['canConnectMultipleItems'],
+                child_must_exist_to_move_parent: r['childMustExistToMoveParent'],
+                child_must_exist_to_finish_parent: r['childMustExistToFinishParent'],
+                all_children_must_be_done_to_move_parent: r['allChildrenMustBeDoneToMoveParent'],
+                all_children_must_be_done_to_finish_parent: r['allChildrenMustBeDoneToFinishParent'],
+            }));
+            mark('pipe_relations', 'complete');
+        }
+        else {
+            notes.push('pipe_relations: parentsRelations / childrenRelations did not answer');
+        }
+        // ── phase team members ──────────────────────────────────────────────────
+        // `Phase.teamMembers` is public; the payload holds one row per member.
+        const tm = await this.client.tryRaw(`query($id: ID!) { pipe(id: $id) { phases { id teamMembers { id } } } }`, { id: String(repoId) }, 'phase team members');
+        if (tm?.pipe?.phases?.every((ph) => Array.isArray(ph.teamMembers))) {
+            relations.phase_team_memberships = tm.pipe.phases.flatMap((ph) => (ph.teamMembers ?? []).map((u) => ({ phase_id: numOrNull(ph.id), user_id: numOrNull(u['id']) })));
+            mark('phase_team_memberships', 'complete');
+        }
+        else {
+            notes.push('phase_team_memberships: Phase.teamMembers did not answer');
+        }
+        // ── repo preferences and the public form ────────────────────────────────
+        /**
+         * One row each, both public. Fewer columns than a snapshot's (no id, no
+         * custom sorting, no guests settings) — columns are partial, as for every
+         * reconstructed group — but every column the compiler can write is here.
+         * `submitterEmailCollectionMethod` is the payload's `submitter_email_required`:
+         * both read "required" on the same pipe.
+         */
+        const prefs = await this.client.tryRaw(`query($id: ID!) { pipe(id: $id) { preferences {
+        aiAgentsEnabled aiCopilotEnabled findable hiddenStartFormAttributes
+        hiddenTopButtons inboxEmailEnabled mainTabViews startFormTitle } } }`, { id: String(repoId) }, 'repo_preferences');
+        if (prefs?.pipe) {
+            const r = prefs.pipe.preferences;
+            relations.repo_preferences = r
+                ? [
+                    {
+                        repo_id: root['id'],
+                        ai_agents_enabled: r['aiAgentsEnabled'],
+                        ai_copilot_enabled: r['aiCopilotEnabled'],
+                        findable: r['findable'],
+                        hidden_start_form_attributes: r['hiddenStartFormAttributes'] ?? [],
+                        hidden_top_buttons: r['hiddenTopButtons'] ?? [],
+                        inbox_email_enabled: r['inboxEmailEnabled'],
+                        main_tab_views: r['mainTabViews'] ?? [],
+                        start_form_title: r['startFormTitle'] ?? null,
+                    },
+                ]
+                : [];
+            mark('repo_preferences', 'complete');
+        }
+        const pf = await this.client.tryRaw(`query($id: ID!) { pipe(id: $id) { publicForm {
+        id active title description submitButtonText afterSubmitMessage brandColor
+        backgroundColor backgroundImage logo displayPipefyLogo showSubmitAnotherResponseButton
+        reuseLastSubmissionResponse submitterEmailCollectionEnabled
+        submitterEmailCollectionMethod submitterEmailField { id } } } }`, { id: String(repoId) }, 'public_forms');
+        if (pf?.pipe) {
+            const f = pf.pipe.publicForm;
+            relations.public_forms = f
+                ? [
+                    {
+                        id: numOrNull(f['id']),
+                        repo_id: root['id'],
+                        active: f['active'],
+                        title: f['title'] ?? null,
+                        description: f['description'] ?? null,
+                        submit_button_text: f['submitButtonText'] ?? null,
+                        after_submit_message: f['afterSubmitMessage'] ?? null,
+                        brand_color: f['brandColor'] ?? null,
+                        background_color: f['backgroundColor'] ?? null,
+                        background_image: f['backgroundImage'] ?? null,
+                        logo: f['logo'] ?? null,
+                        display_pipefy_logo: f['displayPipefyLogo'],
+                        show_submit_another_response_button: f['showSubmitAnotherResponseButton'],
+                        reuse_last_submission_response: f['reuseLastSubmissionResponse'],
+                        submitter_email_collection_enabled: f['submitterEmailCollectionEnabled'],
+                        submitter_email_required: f['submitterEmailCollectionMethod'] ?? null,
+                        submitter_email_field_id: numOrNull(firstId(f['submitterEmailField'])),
+                    },
+                ]
+                : [];
+            mark('public_forms', 'complete');
         }
         // ── field conditions (+ actions, condition, expressions) ────────────────
         await this.readFieldConditions(repoId, root, relations, mark, notes);
@@ -367,19 +456,27 @@ export class Reconstructor {
             }
         }
         /**
-         * No reconstructed group is ever 'complete'.
+         * No reconstructed group has every *column*; most have every *row*.
          *
-         * Row coverage and *column* coverage are different things: the public API
+         * Row coverage and column coverage are different things: the public API
          * returns every phase, but not `color_uuid`, `only_admin_can_move_to_previous`
-         * or `repo_id`. Marking such a group complete made a snapshot-vs-reconstruction
-         * diff report ten phantom changes per phase, each one a proposal to null a
-         * column that had simply not been read. 'partial' is the honest ceiling, and it
-         * is what tells the diff to treat absence here as no information.
+         * or `repo_id`. Marking such a group's columns complete made a
+         * snapshot-vs-reconstruction diff report ten phantom changes per phase, each
+         * one a proposal to null a column that had simply not been read — so every
+         * group that was read has its columns marked partial.
+         *
+         * Rows are another matter, and they used to be marked partial too. That
+         * made the diff refuse every create and delete on a reconstructed pull,
+         * which was every pull while the snapshot download answered 500: a new
+         * phase could not be created because the read had not seen `color_uuid`.
+         * `coverage` now says what was measured about rows — complete where the
+         * API returns the whole list, partial where it is known not to
+         * (phase_jumps read forward-only, pipe_relations never compared against a
+         * snapshot, automations that would not load).
          */
-        for (const name of ENTITY_NAMES) {
-            if (coverage[name] === 'complete')
-                coverage[name] = 'partial';
-        }
+        const columns = {};
+        for (const name of ENTITY_NAMES)
+            columns[name] = coverage[name] === 'unknown' ? 'unknown' : 'partial';
         const payload = { ...root, id: Number(root['id']), relations };
         return {
             source: 'reconstructed',
@@ -387,6 +484,7 @@ export class Reconstructor {
             readAt: new Date().toISOString(),
             repoKind: 'pipe',
             coverage,
+            columns,
             repo_columns: pipe.missing ? 'partial' : 'complete',
             notes,
             payload,
@@ -472,7 +570,16 @@ export class Reconstructor {
      * shortcut — this is N+1 by necessity, bounded by readConcurrency.
      */
     async readAutomations(repoId, root, relations, mark, notes, organizationId) {
-        const orgId = organizationId ?? (root['organization_id'] ? String(root['organization_id']) : null);
+        /**
+         * The repo's own organization first. The one passed in is the caller's
+         * default — `--org`, or whatever `pipe login --token` saved — and a token
+         * that belongs to several organizations pulls pipes from all of them. Sent
+         * a pipe from another organization, the internal query answers "Couldn't
+         * find Repo with 'id'=…" about a pipe that plainly exists, and every
+         * automation is left unknown. Seen in a field run, reproduced here with
+         * one pipe under its own organization (32 automations) and under another.
+         */
+        const orgId = (root['organization_id'] ? String(root['organization_id']) : null) ?? organizationId;
         if (!orgId) {
             notes.push('automations: no organization id available for the internal automations query');
             return;
@@ -664,8 +771,7 @@ const snakeParams = (v) => {
 };
 /** Reported by `pipe doctor` so an FDE knows what a reconstructed pull cannot see. */
 export const RECONSTRUCTION_GAPS = [
-    'public_forms — no public read path',
-    'repo_preferences — no public read path',
+    'public_forms / repo_preferences — read, with fewer columns than a snapshot (no ids for preferences, no custom sorting)',
     'visibilities — no public read path (read-only anyway)',
     'email_templates / email_inboxes — no public read path (read-only anyway)',
     'labels.uuid — not exposed publicly, so labels are matched by id and name',

package/dist/util/log.js

@@ -51,13 +51,23 @@ export const step = (s) => {
     process.stderr.write(blue('> ') + s + '\n');
 };
 const CLEAR_LINE = `\r${ESC}2K`;
-/** Single-line progress that collapses to nothing on a non-tty. */
+/**
+ * Single-line progress that collapses to nothing on a non-tty.
+ *
+ * Dropped while a display holds the screen, like `step`: it wrote beneath the
+ * live frame without the frame knowing, and a long automation name wrapped to
+ * a second row, so the next repaint landed a row short. Clipped to the
+ * terminal otherwise, because a `\r` rewrite only reaches back one row too.
+ */
 export const progress = (s) => {
-    if (!process.stderr.isTTY)
+    if (!process.stderr.isTTY || sink)
         return;
-    process.stderr.write(CLEAR_LINE + dim('  ' + s));
+    const line = '  ' + s;
+    const width = process.stderr.columns;
+    const cut = width && [...line].length > width - 1 ? [...line].slice(0, width - 2).join('') + '…' : line;
+    process.stderr.write(CLEAR_LINE + dim(cut));
 };
-export const progressDone = () => { if (process.stderr.isTTY)
+export const progressDone = () => { if (process.stderr.isTTY && !sink)
     process.stderr.write(CLEAR_LINE); };
 export class UserError extends Error {
     hint;

package/dist/util/tui.js

@@ -17,6 +17,42 @@ const HIDE_CURSOR = `${ESC}?25l`;
 const SHOW_CURSOR = `${ESC}?25h`;
 const CLEAR_LINE = `${ESC}2K`;
 const cursorUp = (n) => (n > 0 ? `${ESC}${n}A` : '');
+/**
+ * Cut a line to `max` visible columns, keeping its colour codes intact.
+ *
+ * The repaint moves up as many rows as it drew last time, counting one row per
+ * line. A line wider than the terminal wraps onto two, the cursor then lands
+ * one row short, and every frame leaves its top line behind — on a narrow
+ * PowerShell window a pull scrolled hundreds of copies of its header and cut
+ * the repo line off mid-word. Clipping is what keeps the count true. Every
+ * code point is taken as one column, which holds for everything this tool
+ * prints (the spinner, the dashes, Portuguese pipe names).
+ */
+const ANSI = /\x1b\[[0-9;?]*[A-Za-z]/y;
+export const clipToWidth = (line, max) => {
+    if (max <= 0)
+        return '';
+    if ([...line.replace(new RegExp(ANSI.source, 'g'), '')].length <= max)
+        return line;
+    let out = '';
+    let visible = 0;
+    for (let i = 0; i < line.length;) {
+        ANSI.lastIndex = i;
+        const m = ANSI.exec(line);
+        if (m) {
+            out += m[0];
+            i += m[0].length;
+            continue;
+        }
+        if (visible === max - 1)
+            break;
+        const ch = String.fromCodePoint(line.codePointAt(i));
+        out += ch;
+        visible++;
+        i += ch.length;
+    }
+    return `${out}…${ESC}0m`;
+};
 /** Braille spinner: 8 frames, reads as motion even at 80ms. */
 const FRAMES = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧'];
 const MARK = {
@@ -256,8 +292,13 @@ export class Progress {
             ...(hiddenBelow > 0 ? [dim(`   … ${hiddenBelow} more`)] : []),
             ...this.notes.map((n) => `   ${n}`),
         ];
-        // Repaint in place: up N lines, then clear-and-write each one.
-        const out = cursorUp(this.linesDrawn) + body.map((l) => CLEAR_LINE + l).join('\n') + '\n';
+        // Repaint in place: up N lines, then clear-and-write each one. Each line is
+        // clipped to the terminal so it occupies exactly one row (see clipToWidth);
+        // the final frame is not, since nothing repaints over it and a warning
+        // should be readable in full.
+        const width = this.stream.columns;
+        const fit = (l) => (final || !width ? l : clipToWidth(l, width - 1));
+        const out = cursorUp(this.linesDrawn) + body.map((l) => CLEAR_LINE + fit(l)).join('\n') + '\n';
         this.stream.write(out);
         this.linesDrawn = final ? 0 : body.length;
     }

package/dist/workspace/read.js

@@ -146,6 +146,7 @@ export const readTree = async (dir) => {
             readAt: meta.readAt ?? new Date().toISOString(),
             repoKind: meta.repoKind ?? 'pipe',
             coverage: meta.coverage ?? fullCoverage('unknown'),
+            ...(meta.columns ? { columns: meta.columns } : {}),
             repo_columns: meta.repo_columns ?? 'complete',
             notes: meta.notes ?? [],
         },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pipefy/pipefy-process-coder",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "Pull a Pipefy pipe to disk as readable JSON, edit it with an agent, diff it, push it back.",
   "type": "module",
   "license": "Apache-2.0",