@xano/cli 1.0.2-beta.1 → 1.0.2-beta.3

package/README.md

@@ -30,6 +30,15 @@ npm install -g @xano/cli
 
 ## Commands
 
+### Safety warnings in command help
+
+Destructive commands include imperative safety prefixes in their help text and flag descriptions so automated agents (e.g. Claude Code, Cursor) pause before running them in auto-accept mode:
+
+- **`[CRITICAL]`** — Agents must STOP and confirm with the user before running. Used for irreversible or high-blast-radius operations, including (but not limited to) `--force` deletions, `workspace edit --allow-push`, `workspace push --records`, `workspace/sandbox push --truncate`, `--no-transaction`, `--sync --delete`, backup restore/delete, cluster delete, `env set_all`, `sandbox reset`, `sandbox delete`, `profile delete`, and tenant deploys.
+- **`[IMPORTANT]`** — Agents should confirm with the user (and prefer `--dry-run` previews where applicable). Used for base `workspace push` and `sandbox push`, `branch set_live`, `release import`, `release push`, `release deploy`, and single-variable env / workflow-test deletes.
+
+These warnings are layer 1 of broader push-safety work; ephemeral sandbox environments and push preview remain the structural safeguards.
+
 ### Authentication
 
 ```bash
@@ -482,8 +491,6 @@ xano sandbox push --records --env                        # Include records and e
 xano sandbox push --truncate                             # Truncate tables before import
 xano sandbox push --no-guids                             # Skip writing GUIDs back to local files
 xano sandbox push --force                                # Skip preview and confirmation
-xano sandbox push -i "function/*"                        # Push only matching files
-xano sandbox push -e "table/*"                           # Push all files except tables
 xano sandbox push --review                               # Push and open sandbox review in the browser
 
 # Review (open in browser)

package/dist/commands/branch/delete/index.js

@@ -30,7 +30,7 @@ Deleted branch: dev
         force: Flags.boolean({
             char: 'f',
             default: false,
-            description: 'Skip confirmation prompt',
+            description: '[CRITICAL] NEVER run without explicit user confirmation. Skips the confirmation prompt.',
             required: false,
         }),
         output: Flags.string({

package/dist/commands/branch/set_live/index.js

@@ -9,7 +9,7 @@ export default class BranchSetLive extends BaseCommand {
             required: true,
         }),
     };
-    static description = 'Set a branch as the live (active) branch for API requests';
+    static description = '[IMPORTANT] ALWAYS confirm with the user before changing the live branch. Sets a branch as the live (active) branch for API requests.';
     static examples = [
         `$ xano branch set-live staging
 Are you sure you want to set 'staging' as the live branch? (y/N) y
@@ -32,7 +32,7 @@ Branch 'v1' is now live
         force: Flags.boolean({
             char: 'f',
             default: false,
-            description: 'Skip confirmation prompt',
+            description: '[IMPORTANT] NEVER run without explicit user confirmation. Skips the confirmation prompt.',
             required: false,
         }),
         output: Flags.string({

package/dist/commands/profile/delete/index.js

@@ -9,7 +9,7 @@ export default class ProfileDelete extends Command {
             required: true,
         }),
     };
-    static description = 'Delete a profile configuration';
+    static description = '[CRITICAL] NEVER run without explicit user confirmation; this removes saved credentials from the local config. Deletes a profile configuration.';
     static examples = [
         `$ xano profile:delete old-profile
 Are you sure you want to delete profile 'old-profile'? (y/n): y
@@ -32,7 +32,7 @@ Profile 'old-profile' deleted successfully from ~/.xano/credentials.yaml
         force: Flags.boolean({
             char: 'f',
             default: false,
-            description: 'Skip confirmation prompt',
+            description: '[CRITICAL] NEVER run without explicit user confirmation. Skips the confirmation prompt.',
             required: false,
         }),
     };

package/dist/commands/release/delete/index.js

@@ -25,7 +25,7 @@ Deleted release 'v1.0'
         force: Flags.boolean({
             char: 'f',
             default: false,
-            description: 'Skip confirmation prompt',
+            description: '[CRITICAL] NEVER run without explicit user confirmation. Skips the confirmation prompt.',
             required: false,
         }),
         output: Flags.string({

package/dist/commands/release/deploy/index.js

@@ -7,7 +7,7 @@ export default class ReleaseDeploy extends BaseCommand {
             required: true,
         }),
     };
-    static description = 'Deploy a release to its workspace as a new branch';
+    static description = '[IMPORTANT] ALWAYS confirm with the user before deploying a release. Deploys a release to its workspace as a new branch.';
     static examples = [
         `$ xano release deploy "v1.0"
 Are you sure you want to deploy release "v1.0"? (y/N) y
@@ -29,7 +29,7 @@ Deployed release "v1.0" to workspace 40 (branch: v1.0)
         force: Flags.boolean({
             char: 'f',
             default: false,
-            description: 'Skip confirmation prompt',
+            description: '[IMPORTANT] NEVER run without explicit user confirmation. Skips the confirmation prompt.',
             required: false,
         }),
         output: Flags.string({
@@ -41,7 +41,7 @@ Deployed release "v1.0" to workspace 40 (branch: v1.0)
         }),
         set_live: Flags.boolean({
             default: false,
-            description: 'Set the new branch as live',
+            description: '[CRITICAL] STOP and confirm with the user before setting the deployed branch as live.',
             required: false,
         }),
         workspace: Flags.string({

package/dist/commands/release/import/index.js

@@ -5,7 +5,7 @@ import * as yaml from 'js-yaml';
 import BaseCommand from '../../../base-command.js';
 export default class ReleaseImport extends BaseCommand {
     static args = {};
-    static description = 'Import a release file into a workspace';
+    static description = '[IMPORTANT] ALWAYS confirm with the user before importing a release. Imports a release file into a workspace.';
     static examples = [
         `$ xano release import --file ./my-release.tar.gz
 Imported release as #15

package/dist/commands/release/push/index.js

@@ -5,7 +5,7 @@ import * as path from 'node:path';
 import BaseCommand from '../../../base-command.js';
 import { findFilesWithGuid } from '../../../utils/document-parser.js';
 export default class ReleasePush extends BaseCommand {
-    static description = 'Create a new release from local XanoScript files via the multidoc endpoint';
+    static description = '[IMPORTANT] ALWAYS confirm with the user before creating a release from local files. Creates a new release from local XanoScript files via the multidoc endpoint.';
     static examples = [
         `$ xano release push -n "v1.0"
 Created release: v1.0 - ID: 10 (from current directory)

package/dist/commands/sandbox/delete/index.js

@@ -1,7 +1,7 @@
 import { Flags } from '@oclif/core';
 import BaseCommand from '../../../base-command.js';
 export default class SandboxDelete extends BaseCommand {
-    static description = 'Delete your sandbox environment completely (debugging only — it will be re-created on next access)';
+    static description = '[CRITICAL] NEVER run without explicit user confirmation; this destroys all sandbox data. Deletes your sandbox environment completely (debugging only — it will be re-created on next access).';
     static examples = [
         `$ xano sandbox delete
 Are you sure you want to DELETE your sandbox environment? This destroys all data. (y/N) y
@@ -14,7 +14,7 @@ Sandbox environment deleted.
         force: Flags.boolean({
             char: 'f',
             default: false,
-            description: 'Skip confirmation prompt',
+            description: '[CRITICAL] Skips the confirmation prompt.',
             required: false,
         }),
     };

package/dist/commands/sandbox/env/delete/index.js

@@ -15,7 +15,7 @@ Environment variable 'DATABASE_URL' deleted
         force: Flags.boolean({
             char: 'f',
             default: false,
-            description: 'Skip confirmation prompt',
+            description: '[IMPORTANT] NEVER run without explicit user confirmation. Skips the confirmation prompt.',
             required: false,
         }),
         name: Flags.string({

package/dist/commands/sandbox/env/set_all/index.js

@@ -4,7 +4,7 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import BaseCommand from '../../../../base-command.js';
 export default class SandboxEnvSetAll extends BaseCommand {
-    static description = 'Set all environment variables for a sandbox environment from a YAML file (replaces all existing)';
+    static description = '[CRITICAL] STOP and confirm with the user; this replaces all environment variables with the imported file. Sets all environment variables for a sandbox environment from a YAML file.';
     static examples = [
         `$ xano sandbox env set_all
 Reads from env_<tenant>.yaml

package/dist/commands/sandbox/license/set/index.js

@@ -16,7 +16,7 @@ Reads from license_<tenant>.yaml
         ...BaseCommand.baseFlags,
         clean: Flags.boolean({
             default: false,
-            description: 'Remove the source file after successful upload',
+            description: '[IMPORTANT] ALWAYS confirm with the user before deleting the source license file after upload. Removes the source file after successful upload.',
             exclusive: ['value'],
             required: false,
         }),

package/dist/commands/sandbox/push/index.d.ts

@@ -7,10 +7,8 @@ export default class SandboxPush extends BaseCommand {
         delete: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         'dry-run': import("@oclif/core/interfaces").BooleanFlag<boolean>;
         env: import("@oclif/core/interfaces").BooleanFlag<boolean>;
-        exclude: import("@oclif/core/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/interfaces").CustomOptions>;
         force: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         guids: import("@oclif/core/interfaces").BooleanFlag<boolean>;
-        include: import("@oclif/core/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/interfaces").CustomOptions>;
         records: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         review: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         sync: import("@oclif/core/interfaces").BooleanFlag<boolean>;

package/dist/commands/sandbox/push/index.js

@@ -5,7 +5,7 @@ import open from 'open';
 import BaseCommand from '../../../base-command.js';
 import { executePush } from '../../../utils/multidoc-push.js';
 export default class SandboxPush extends BaseCommand {
-    static description = 'Push local documents to your sandbox environment via multidoc import. By default, only changed files are pushed (partial mode). Use --sync to push all files. Shows a preview of changes before pushing unless --force is specified. Use --dry-run to preview only.';
+    static description = '[IMPORTANT] ALWAYS run --dry-run first and show the user the output before pushing. Push local documents to your sandbox environment via multidoc import. By default, only changed files are pushed (partial mode). Use --sync to push all files. Shows a preview of changes before pushing unless --force is specified. Use --dry-run to preview only. Include/exclude glob filters are intentionally not supported on sandbox push — partial pushes can hide deletions during review and lead to data loss when promoted to the workspace. Large pushes against a sandbox loaded with a different workspace will prompt for confirmation; run `xano sandbox reset` first to start clean.';
     static examples = [
         `$ xano sandbox push
 Push from current directory (default partial mode)
@@ -27,15 +27,6 @@ Skip preview and push immediately
 `,
         `$ xano sandbox push --records --env`,
         `$ xano sandbox push --truncate`,
-        `$ xano sandbox push -i "**/func*"
-Push only files matching the glob pattern
-`,
-        `$ xano sandbox push -i "function/*" -i "table/*"
-Push files matching multiple patterns
-`,
-        `$ xano sandbox push -e "table/*"
-Push all files except tables
-`,
         `$ xano sandbox push --review
 Push and open sandbox review in the browser
 `,
@@ -63,12 +54,6 @@ Push and open sandbox review in the browser
             description: 'Include environment variables in import',
             required: false,
         }),
-        exclude: Flags.string({
-            char: 'e',
-            description: 'Glob pattern to exclude files (e.g. "table/*", "**/test*"). Matched against relative paths from the push directory.',
-            multiple: true,
-            required: false,
-        }),
         force: Flags.boolean({
             default: false,
             description: 'Skip preview and confirmation prompt (for CI/CD pipelines)',
@@ -80,12 +65,6 @@ Push and open sandbox review in the browser
             description: 'Write server-assigned GUIDs back to local files (use --no-guids to skip)',
             required: false,
         }),
-        include: Flags.string({
-            char: 'i',
-            description: 'Glob pattern to include files (e.g. "**/func*", "table/*.xs"). Matched against relative paths from the push directory.',
-            multiple: true,
-            required: false,
-        }),
         records: Flags.boolean({
             default: false,
             description: 'Include records in import',
@@ -104,12 +83,12 @@ Push and open sandbox review in the browser
         transaction: Flags.boolean({
             allowNo: true,
             default: true,
-            description: 'Wrap import in a database transaction (use --no-transaction for debugging purposes)',
+            description: '[CRITICAL] DO NOT run with --no-transaction without explicit user confirmation; this disables rollback. Wraps import in a database transaction (use --no-transaction for debugging purposes).',
             required: false,
         }),
         truncate: Flags.boolean({
             default: false,
-            description: 'Truncate all table records before importing',
+            description: '[CRITICAL] STOP and confirm with the user; this truncates live tables before importing.',
             required: false,
         }),
     };
@@ -132,15 +111,14 @@ Push and open sandbox review in the browser
             label: 'sandbox environment',
             supportsBranches: false,
             supportsPartial: true,
+            warnOnWorkspaceMismatch: true,
         };
         const pushFlags = {
             delete: flags.delete,
             'dry-run': flags['dry-run'],
             env: flags.env,
-            exclude: flags.exclude,
             force: flags.force,
             guids: flags.guids,
-            include: flags.include,
             records: flags.records,
             sync: flags.sync,
             transaction: flags.transaction,

package/dist/commands/sandbox/reset/index.js

@@ -1,7 +1,7 @@
 import { Flags } from '@oclif/core';
 import BaseCommand from '../../../base-command.js';
 export default class SandboxReset extends BaseCommand {
-    static description = 'Reset your sandbox environment (clears all workspace data and drafts)';
+    static description = '[CRITICAL] NEVER run without explicit user confirmation; this clears all workspace data and drafts. Resets your sandbox environment.';
     static examples = [
         `$ xano sandbox reset
 Are you sure you want to reset your sandbox environment? All workspace data and drafts will be cleared. (y/N) y
@@ -14,7 +14,7 @@ Sandbox environment has been reset.
         force: Flags.boolean({
             char: 'f',
             default: false,
-            description: 'Skip confirmation prompt',
+            description: '[CRITICAL] Skips the confirmation prompt.',
             required: false,
         }),
     };

package/dist/commands/tenant/backup/delete/index.js

@@ -10,7 +10,7 @@ export default class TenantBackupDelete extends BaseCommand {
             required: true,
         }),
     };
-    static description = 'Delete a tenant backup permanently. This action cannot be undone.';
+    static description = '[CRITICAL] NEVER delete a backup without explicit user confirmation; this removes your restore point. Deletes a tenant backup permanently.';
     static examples = [
         `$ xano tenant backup delete t1234-abcd-xyz1 --backup_id 10
 Are you sure you want to delete backup #10? This action cannot be undone. (y/N) y
@@ -28,7 +28,7 @@ Deleted backup #10
         force: Flags.boolean({
             char: 'f',
             default: false,
-            description: 'Skip confirmation prompt',
+            description: '[CRITICAL] Skips the confirmation prompt.',
             required: false,
         }),
         output: Flags.string({

package/dist/commands/tenant/backup/restore/index.js

@@ -9,7 +9,7 @@ export default class TenantRestore extends BaseCommand {
             required: true,
         }),
     };
-    static description = 'Restore a tenant from a backup. This replaces the current tenant data.';
+    static description = '[CRITICAL] STOP and confirm with the user; this overwrites current tenant state. Restores a tenant from a backup, replacing current tenant data.';
     static examples = [
         `$ xano tenant backup restore t1234-abcd-xyz1 --backup_id 10
 Are you sure you want to restore tenant t1234-abcd-xyz1 from backup 10? This will replace current data. (y/N) y
@@ -26,7 +26,7 @@ Restored tenant t1234-abcd-xyz1 from backup #10
         force: Flags.boolean({
             char: 'f',
             default: false,
-            description: 'Skip confirmation prompt',
+            description: '[CRITICAL] Skips the confirmation prompt.',
             required: false,
         }),
         output: Flags.string({

package/dist/commands/tenant/cluster/delete/index.js

@@ -9,7 +9,7 @@ export default class TenantClusterDelete extends BaseCommand {
             required: true,
         }),
     };
-    static description = 'Delete a tenant cluster. This action cannot be undone.';
+    static description = '[CRITICAL] NEVER run without explicit user confirmation; this removes an entire cluster. Deletes a tenant cluster permanently.';
     static examples = [
         `$ xano tenant cluster delete 3
 Are you sure you want to delete tenant cluster 3? This action cannot be undone. (y/N) y
@@ -25,7 +25,7 @@ Tenant cluster 3 deleted successfully
         force: Flags.boolean({
             char: 'f',
             default: false,
-            description: 'Skip confirmation prompt',
+            description: '[CRITICAL] Skips the confirmation prompt.',
             required: false,
         }),
         output: Flags.string({

package/dist/commands/tenant/cluster/license/set/index.js

@@ -23,7 +23,7 @@ Reads from kubeconfig-1.yaml
         ...BaseCommand.baseFlags,
         clean: Flags.boolean({
             default: false,
-            description: 'Remove the source file after successful upload',
+            description: '[IMPORTANT] ALWAYS confirm with the user before deleting the source kubeconfig file after upload. Removes the source file after successful upload.',
             exclusive: ['value'],
             required: false,
         }),

package/dist/commands/tenant/create/index.js

@@ -10,7 +10,7 @@ export default class TenantCreate extends BaseCommand {
             required: true,
         }),
     };
-    static description = 'Create a new tenant in a workspace';
+    static description = '[IMPORTANT] ALWAYS confirm with the user before creating a tier2/tier3 tenant; this provisions billable infrastructure on a cluster. Creates a new tenant in a workspace.';
     static examples = [
         `$ xano tenant create "Production"
 Created tenant: Production (production) - ID: 42

package/dist/commands/tenant/delete/index.js

@@ -25,7 +25,7 @@ Deleted tenant t1234-abcd-xyz1
         force: Flags.boolean({
             char: 'f',
             default: false,
-            description: 'Skip confirmation prompt',
+            description: '[CRITICAL] NEVER run without explicit user confirmation. Skips the confirmation prompt.',
             required: false,
         }),
         output: Flags.string({

package/dist/commands/tenant/deploy_platform/index.js

@@ -10,7 +10,7 @@ export default class TenantDeployPlatform extends BaseCommand {
             required: true,
         }),
     };
-    static description = 'Deploy a platform version to a tenant';
+    static description = '[CRITICAL] STOP and confirm with the user before deploying a platform version to a tenant; this mutates the live tenant. Deploys a platform version to a tenant.';
     static examples = [
         `$ xano tenant deploy_platform t1234-abcd-xyz1 --platform_id 5
 Deployed platform 5 to tenant: My Tenant (my-tenant)

package/dist/commands/tenant/deploy_release/index.js

@@ -9,7 +9,7 @@ export default class TenantDeployRelease extends BaseCommand {
             required: true,
         }),
     };
-    static description = 'Deploy a release to a tenant';
+    static description = '[CRITICAL] STOP and confirm with the user before deploying a release to a tenant; this mutates the live tenant. Deploys a release to a tenant.';
     static examples = [
         `$ xano tenant deploy_release t1234-abcd-xyz1 --release v1.0
 Deployed release "v1.0" to tenant: My Tenant (my-tenant)

package/dist/commands/tenant/edit/index.js

@@ -33,7 +33,7 @@ Updated tenant: New Name (my-tenant) - ID: 42
         }),
         ingress: Flags.boolean({
             allowNo: true,
-            description: 'Enable/disable ingress',
+            description: '[IMPORTANT] ALWAYS confirm with the user before disabling ingress; this takes the tenant offline from the public network. Enables/disables ingress.',
             required: false,
         }),
         output: Flags.string({
@@ -49,12 +49,12 @@ Updated tenant: New Name (my-tenant) - ID: 42
         }),
         rbac: Flags.boolean({
             allowNo: true,
-            description: 'Enable/disable RBAC',
+            description: '[CRITICAL] NEVER disable RBAC without explicit user confirmation; this removes role-based access controls on the tenant. Enables/disables RBAC.',
             required: false,
         }),
         tasks: Flags.boolean({
             allowNo: true,
-            description: 'Enable/disable background tasks',
+            description: '[IMPORTANT] ALWAYS confirm with the user before disabling background tasks; this stops scheduled jobs on the tenant. Enables/disables background tasks.',
             required: false,
         }),
         workspace: Flags.string({

package/dist/commands/tenant/env/delete/index.js

@@ -25,7 +25,7 @@ Environment variable 'DATABASE_URL' deleted from tenant my-tenant
         force: Flags.boolean({
             char: 'f',
             default: false,
-            description: 'Skip confirmation prompt',
+            description: '[IMPORTANT] NEVER run without explicit user confirmation. Skips the confirmation prompt.',
             required: false,
         }),
         name: Flags.string({

package/dist/commands/tenant/env/set_all/index.js

@@ -10,7 +10,7 @@ export default class TenantEnvSetAll extends BaseCommand {
             required: true,
         }),
     };
-    static description = 'Set all environment variables for a tenant from a YAML file (replaces all existing)';
+    static description = '[CRITICAL] STOP and confirm with the user; this replaces all environment variables with the imported file. Sets all environment variables for a tenant from a YAML file.';
     static examples = [
         `$ xano tenant env set_all my-tenant
 Reads from env_my-tenant.yaml

package/dist/commands/tenant/license/set/index.js

@@ -23,7 +23,7 @@ Reads from license_my-tenant.yaml
         ...BaseCommand.baseFlags,
         clean: Flags.boolean({
             default: false,
-            description: 'Remove the source file after successful upload',
+            description: '[IMPORTANT] ALWAYS confirm with the user before deleting the source license file after upload. Removes the source file after successful upload.',
             exclusive: ['value'],
             required: false,
         }),

package/dist/commands/tenant/push/index.js

@@ -1,6 +1,6 @@
 import { Command } from '@oclif/core';
 export default class Push extends Command {
-    static description = 'Direct tenant push is not supported. Deploy through a release or use the sandbox (xano sandbox push).';
+    static description = 'Direct tenant push is not supported — deploy through a release or use the sandbox (xano sandbox push).';
     async run() {
         this.error('Direct tenant push is not supported.\n' +
             'To deploy changes, use one of the following:\n' +

package/dist/commands/workflow_test/delete/index.js

@@ -23,7 +23,7 @@ Deleted workflow test 1
         force: Flags.boolean({
             char: 'f',
             default: false,
-            description: 'Skip confirmation prompt',
+            description: '[IMPORTANT] NEVER run without explicit user confirmation. Skips the confirmation prompt.',
             required: false,
         }),
         output: Flags.string({

package/dist/commands/workspace/delete/index.js

@@ -24,7 +24,7 @@ Deleted workspace 123
         force: Flags.boolean({
             char: 'f',
             default: false,
-            description: 'Skip confirmation prompt',
+            description: '[CRITICAL] NEVER run without explicit user confirmation. Skips the confirmation prompt.',
             required: false,
         }),
         output: Flags.string({

package/dist/commands/workspace/edit/index.js

@@ -29,7 +29,7 @@ Updated workspace: my-workspace (ID: 123)
         ...BaseCommand.baseFlags,
         'allow-push': Flags.boolean({
             allowNo: true,
-            description: 'Enable or disable direct CLI push to this workspace (not applicable on Free plan)',
+            description: '[CRITICAL] NEVER enable without explicit user confirmation; this unlocks direct CLI push to the workspace and is the gate that protects production from destructive push operations. Enables or disables direct CLI push to this workspace (not applicable on Free plan).',
             required: false,
         }),
         description: Flags.string({

package/dist/commands/workspace/push/index.js

@@ -4,7 +4,7 @@ import { resolve } from 'node:path';
 import BaseCommand from '../../../base-command.js';
 import { executePush } from '../../../utils/multidoc-push.js';
 export default class Push extends BaseCommand {
-    static description = 'Push local documents to a workspace. By default, only changed files are pushed (partial mode). Use --sync to push all files. Shows a preview of changes before pushing unless --force is specified. Use --dry-run to preview only.';
+    static description = '[IMPORTANT] ALWAYS run --dry-run first and show the user the output before pushing. Push local documents to a workspace. By default, only changed files are pushed (partial mode). Use --sync to push all files. Shows a preview of changes before pushing unless --force is specified. Use --dry-run to preview only.';
     static examples = [
         `$ xano workspace push
 Push from current directory (default partial mode)
@@ -70,7 +70,7 @@ Push functions but exclude test files
         }),
         delete: Flags.boolean({
             default: false,
-            description: 'Delete workspace objects not included in the push (requires --sync)',
+            description: '[CRITICAL] STOP and confirm with the user before running. Delete workspace objects not included in the push (requires --sync).',
             required: false,
         }),
         'dry-run': Flags.boolean({
@@ -91,7 +91,7 @@ Push functions but exclude test files
         }),
         force: Flags.boolean({
             default: false,
-            description: 'Skip preview and confirmation prompt (for CI/CD pipelines)',
+            description: '[CRITICAL] NEVER run without explicit user confirmation. Skips preview and confirmation prompt (for CI/CD pipelines).',
             required: false,
         }),
         guids: Flags.boolean({
@@ -108,7 +108,7 @@ Push functions but exclude test files
         }),
         records: Flags.boolean({
             default: false,
-            description: 'Include records in import',
+            description: '[CRITICAL] STOP and ALWAYS run --dry-run first to show the user a preview before pushing live table records. Includes table records in import.',
             required: false,
         }),
         sync: Flags.boolean({
@@ -119,12 +119,12 @@ Push functions but exclude test files
         transaction: Flags.boolean({
             allowNo: true,
             default: true,
-            description: 'Wrap import in a database transaction (use --no-transaction for debugging purposes)',
+            description: '[CRITICAL] DO NOT run with --no-transaction without explicit user confirmation; this disables rollback. Wraps import in a database transaction (use --no-transaction for debugging purposes).',
             required: false,
         }),
         truncate: Flags.boolean({
             default: false,
-            description: 'Truncate all table records before importing',
+            description: '[CRITICAL] STOP and confirm with the user; this truncates live tables before importing.',
             required: false,
         }),
         workspace: Flags.string({

package/dist/utils/multidoc-push.d.ts

@@ -29,6 +29,12 @@ export interface PushTarget {
     supportsBranches: boolean;
     /** Does this target support the partial query param? */
     supportsPartial: boolean;
+    /**
+     * Warn when the workspace embedded in the local push differs from the workspace currently
+     * loaded on the target (per dry-run). Used by sandbox push because the sandbox is shared
+     * across workspaces and pushing onto a different workspace can leave stale state behind.
+     */
+    warnOnWorkspaceMismatch?: boolean;
 }
 export interface PushContext {
     accessToken: string;
@@ -37,6 +43,17 @@ export interface PushContext {
     inputDir: string;
     verboseFetch: (url: string, options: RequestInit, verbose: boolean, authToken?: string) => Promise<Response>;
 }
+export declare const WORKSPACE_MISMATCH_THRESHOLD = 10;
+/**
+ * Sum all impactful operations in a dry-run summary. `deleted` is only counted when the
+ * caller actually intends to apply deletions (sync mode), matching what the user will see.
+ */
+export declare function countSummaryChanges(summary: Record<string, {
+    created: number;
+    deleted: number;
+    truncated: number;
+    updated: number;
+}>, shouldDelete: boolean): number;
 /**
  * Recursively collect all .xs files from a directory, sorted for deterministic ordering.
  */
@@ -55,6 +72,10 @@ export declare function readDocuments(files: string[]): Array<{
 }>;
 export declare function renderBadReferences(badRefs: BadReference[], log: (msg: string) => void): void;
 export declare function renderBadIndexes(badIndexes: BadIndex[], log: (msg: string) => void): void;
+export declare function findLocalWorkspaceName(entries: Array<{
+    content: string;
+    filePath: string;
+}>): null | string;
 export declare function confirm(message: string): Promise<boolean>;
 /**
  * Execute a multidoc push with preview, validation, partial mode, and GUID sync.