primitive-admin 1.0.50 → 1.0.52

package/dist/src/commands/sync.js

@@ -12,6 +12,7 @@ import { createSnapshot, listSnapshots, resolveSnapshot, restoreSnapshot, pruneS
 import { validateWorkflowToml, formatWorkflowTomlErrors, } from "../lib/workflow-toml-validator.js";
 import { expandWorkflowTomlData } from "../lib/workflow-fragments.js";
 import { success, error, info, warn, keyValue, json, divider, } from "../lib/output.js";
+import { confirmPrompt } from "../lib/confirm-prompt.js";
 import chalk from "chalk";
 function ensureDir(dirPath) {
     if (!existsSync(dirPath)) {
@@ -130,6 +131,74 @@ export function shouldPushExpandedFile(parsed, storedHash) {
         return true;
     return computeExpandedContentHash(parsed) !== storedHash;
 }
+/**
+ * Model defaults for the *exact five* workflow-level fields that
+ * `serializeWorkflow` emits unconditionally (`sync.ts` workflow serializer:
+ * `perUserMaxRunning`, `perUserMaxQueued`, `dequeueOrder`,
+ * `requiresClientApply`, `syncCallable`). These mirror `models.yaml`
+ * (`WorkflowDefinition`): `perUserMaxRunning=4`, `perUserMaxQueued=100`,
+ * `dequeueOrder="fifo"`, `requiresClientApply=true`, `syncCallable=false`.
+ *
+ * This is deliberately NOT a generic models.yaml default importer — the model
+ * carries many defaults the serializer never writes (`perAppMax*`,
+ * `queueTtlSeconds`, …). Only the serializer-emitted surface matters for a
+ * content comparison, because the remote side is hashed via `serializeWorkflow`
+ * and therefore only ever contains these five.
+ */
+const WORKFLOW_SERIALIZER_DEFAULTS = {
+    perUserMaxRunning: 4,
+    perUserMaxQueued: 100,
+    dequeueOrder: "fifo",
+    requiresClientApply: true,
+    syncCallable: false,
+};
+/**
+ * Normalize a parsed workflow TOML object so that any of the five
+ * serializer-emitted fields the *local* file omits are filled in with the
+ * model default. Used by `diff` so a hand-authored workflow that omits e.g.
+ * `perUserMaxRunning` compares equal to a server that defaulted it to 4
+ * (the #1175 false-positive guard) — while a server value that was
+ * *explicitly set* to a non-default (e.g. 8) still shows as Modified.
+ *
+ * Returns a shallow clone with a normalized `workflow` table; the input is
+ * not mutated. Non-workflow TOML (no `workflow` table) is returned unchanged.
+ */
+export function normalizeWorkflowTomlDefaults(parsed) {
+    if (!parsed || typeof parsed !== "object" || !parsed.workflow) {
+        return parsed;
+    }
+    const workflow = { ...parsed.workflow };
+    for (const [field, defaultValue] of Object.entries(WORKFLOW_SERIALIZER_DEFAULTS)) {
+        if (workflow[field] === undefined || workflow[field] === null) {
+            workflow[field] = defaultValue;
+        }
+    }
+    return { ...parsed, workflow };
+}
+/**
+ * Canonical content hash of a workflow TOML for `diff`'s content comparison.
+ * Applies `normalizeWorkflowTomlDefaults` first so omitted-vs-defaulted fields
+ * don't spuriously diff, then runs the same `computeExpandedContentHash` that
+ * pull stores and push compares. Both the local file and the
+ * `serializeWorkflow`-produced remote form flow through this single function,
+ * so the two sides are normalized identically by construction.
+ */
+export function hashWorkflowTomlForDiff(parsed) {
+    return computeExpandedContentHash(normalizeWorkflowTomlDefaults(parsed));
+}
+/**
+ * Build the canonical content hash for a *server* workflow (as returned by
+ * `getWorkflow` + active `getWorkflowConfig`), mirroring exactly what a fresh
+ * `sync pull` would write to disk. Serializes via `serializeWorkflow`, parses
+ * the resulting TOML (remote serialized TOML never carries `include`s, so a
+ * plain `TOML.parse` is sufficient — no fragment path needed), then hashes
+ * through `hashWorkflowTomlForDiff` so it lines up with the local-file hash.
+ */
+export function hashRemoteWorkflowForDiff(workflow, draft, configs) {
+    const serialized = serializeWorkflow(workflow, draft, configs || []);
+    const parsed = TOML.parse(serialized);
+    return hashWorkflowTomlForDiff(parsed);
+}
 // TOML serialization helpers
 function serializeAppSettings(settings) {
     const data = {
@@ -260,7 +329,13 @@ function serializeBlobBucket(bucket) {
             name: bucket.name,
             description: bucket.description || undefined,
             ttlTier: bucket.ttlTier,
-            accessPolicy: bucket.accessPolicy,
+            // #1020: `preset` is the honest key; a custom bucket carries ruleSetId
+            // instead. Omit preset for custom buckets (preset === "custom").
+            preset: bucket.preset && bucket.preset !== "custom"
+                ? bucket.preset
+                : bucket.ruleSetId
+                    ? undefined
+                    : bucket.preset,
         },
     };
     if (bucket.ruleSetId) {
@@ -313,6 +388,9 @@ function serializeWorkflow(workflow, draft, configs) {
             status: workflow.status,
             activeConfigName: activeConfigName,
             accessRule: workflow.accessRule || undefined,
+            // #1081 — workflow principal mode. Emit only when set so a fresh
+            // pull → push round-trips it without writing a noisy `runAs = ""`.
+            runAs: workflow.runAs || undefined,
             perUserMaxRunning: workflow.perUserMaxRunning,
             perUserMaxQueued: workflow.perUserMaxQueued,
             dequeueOrder: workflow.dequeueOrder,
@@ -734,56 +812,6 @@ export async function pullScripts(client, appId, configDir, logger = () => { })
     }
     return { scriptEntities, count: items.length };
 }
-/**
- * Issue #973 — format the "stale referencing workflows" warning for a script
- * push. Pure (no I/O) so it can be unit-tested directly.
- *
- * `staleWorkflows` is the server's report of active workflows whose frozen
- * snapshot still pins a DIFFERENT (old) body hash for `scriptName` — i.e. the
- * workflows that will keep running the previous script body until republished.
- * Returns `null` when nothing is stale (no warning to print). When `dryRun` is
- * true the wording reflects that nothing was mutated yet.
- */
-export function formatStaleWorkflowsWarning(scriptName, staleWorkflows, dryRun = false) {
-    if (!staleWorkflows || staleWorkflows.length === 0)
-        return null;
-    const labels = staleWorkflows.map((w) => w.workflowKey || w.name || "(unknown workflow)");
-    const count = labels.length;
-    const noun = count === 1 ? "workflow" : "workflows";
-    const verb = dryRun ? "would still run" : "still run";
-    return (`Script "${scriptName}" ${dryRun ? "would be updated" : "updated"}, but ` +
-        `${count} ${noun} ${verb} the previous body until re-pushed: ` +
-        `${labels.join(", ")}. ` +
-        `Re-push (or republish) ${count === 1 ? "it" : "them"} to pick up the change ` +
-        `(the run path reads each workflow's frozen snapshot, not the live script).`);
-}
-/**
- * Issue #973 — query the server for active workflows left stale by a script
- * push and print a warning naming them. Best-effort: a missing route (older
- * server) or any transport error is swallowed so it never fails the sync.
- *
- * `contentHash` is the body hash being pushed (the server's authoritative hash
- * after a real push, or the locally-computed would-be hash for `--dry-run`).
- */
-async function warnStaleWorkflowsForScript(client, appId, scriptId, contentHash, dryRun) {
-    let report;
-    try {
-        report = await client.getStaleWorkflowsForScript(appId, scriptId, contentHash);
-    }
-    catch {
-        // Older server without the route, or a transient failure — staleness
-        // info is advisory, so we stay silent rather than break the push.
-        return;
-    }
-    const message = formatStaleWorkflowsWarning(report.scriptName, report.staleWorkflows, dryRun);
-    if (message) {
-        warn(`  ${message}`);
-    }
-}
-/** SHA-256 hex of a string body, matching the server's script `contentHash`. */
-function sha256HexString(body) {
-    return createHash("sha256").update(body, "utf-8").digest("hex");
-}
 async function pullTestCasesForBlock(client, appId, blockType, blockId, blockKey, configDir, testCaseEntities, lookupMaps) {
     let testCases;
     try {
@@ -2273,8 +2301,29 @@ Directory Structure:
                         continue;
                     }
                     if (existingId) {
-                        // Blob buckets don't have an update API - skip if already exists
-                        info(`  Blob bucket already exists, skipping: ${key}`);
+                        // #1020 (D8): idempotently apply preset/ruleSet/name/description
+                        // changes via PATCH. bucketKey/ttlTier are immutable and not sent.
+                        const updatePayload = {};
+                        if (bucket.preset)
+                            updatePayload.preset = bucket.preset;
+                        else if (bucket.accessPolicy)
+                            updatePayload.accessPolicy = bucket.accessPolicy;
+                        if (bucket.ruleSetId)
+                            updatePayload.ruleSetId = bucket.ruleSetId;
+                        if (bucket.name)
+                            updatePayload.name = bucket.name;
+                        if (bucket.description !== undefined)
+                            updatePayload.description = bucket.description || null;
+                        changes.push({ type: "blob-bucket", action: "update", key });
+                        if (!options.dryRun) {
+                            try {
+                                await client.updateBlobBucket(resolvedAppId, existingId, updatePayload);
+                                info(`  Updated blob bucket: ${key}`);
+                            }
+                            catch (err) {
+                                warn(`  Failed to update blob bucket ${key}: ${String(err?.message || err)}`);
+                            }
+                        }
                         if (syncState?.entities?.blobBuckets?.[key]) {
                             syncState.entities.blobBuckets[key].contentHash = computeFileHash(filePath);
                         }
@@ -2284,8 +2333,11 @@ Directory Structure:
                             bucketKey: key,
                             name: bucket.name || key,
                             ttlTier: bucket.ttlTier,
-                            accessPolicy: bucket.accessPolicy,
                         };
+                        if (bucket.preset)
+                            payload.preset = bucket.preset;
+                        else if (bucket.accessPolicy)
+                            payload.accessPolicy = bucket.accessPolicy;
                         if (bucket.description)
                             payload.description = bucket.description;
                         if (bucket.ruleSetId)
@@ -2578,7 +2630,10 @@ Directory Structure:
                         changes.push({ type: "script", action: "update", key: name });
                         if (!options.dryRun) {
                             try {
-                                const updated = await client.updateScript(resolvedAppId, existingId, { body });
+                                // #1000 — push a new ScriptConfig + activate it. Referencing
+                                // workflows pick up the new body on their next run (no
+                                // fan-out, no re-push needed).
+                                await client.pushScriptBody(resolvedAppId, existingId, body);
                                 info(`  Updated script: ${name}`);
                                 if (syncState) {
                                     if (!syncState.entities.scripts) {
@@ -2586,24 +2641,16 @@ Directory Structure:
                                     }
                                     syncState.entities.scripts[name] = {
                                         id: existingId,
-                                        modifiedAt: updated?.modifiedAt ||
-                                            syncState.entities.scripts[name]?.modifiedAt ||
+                                        modifiedAt: syncState.entities.scripts[name]?.modifiedAt ||
                                             new Date().toISOString(),
                                         contentHash: computeFileHash(filePath),
                                     };
                                 }
-                                // Issue #973 — warn if active workflows still pin the OLD
-                                // body. Use the server's authoritative post-push hash.
-                                await warnStaleWorkflowsForScript(client, resolvedAppId, existingId, updated?.contentHash || sha256HexString(body), false);
                             }
                             catch (err) {
                                 throw wrapEntityError(err, "update", "script", name);
                             }
                         }
-                        else {
-                            // Dry-run: surface the would-be stale set without mutating.
-                            await warnStaleWorkflowsForScript(client, resolvedAppId, existingId, sha256HexString(body), true);
-                        }
                     }
                     else {
                         // No id in local state — could be brand new OR could be
@@ -2616,7 +2663,7 @@ Directory Structure:
                             changes.push({ type: "script", action: "update", key: name });
                             if (!options.dryRun) {
                                 try {
-                                    const updated = await client.updateScript(resolvedAppId, match.scriptId, { body });
+                                    await client.pushScriptBody(resolvedAppId, match.scriptId, body);
                                     info(`  Updated script: ${name} (adopted from server)`);
                                     if (syncState) {
                                         if (!syncState.entities.scripts) {
@@ -2624,21 +2671,15 @@ Directory Structure:
                                         }
                                         syncState.entities.scripts[name] = {
                                             id: match.scriptId,
-                                            modifiedAt: updated?.modifiedAt || new Date().toISOString(),
+                                            modifiedAt: new Date().toISOString(),
                                             contentHash: computeFileHash(filePath),
                                         };
                                     }
-                                    // Issue #973 — same staleness warning on the adopt path.
-                                    await warnStaleWorkflowsForScript(client, resolvedAppId, match.scriptId, updated?.contentHash || sha256HexString(body), false);
                                 }
                                 catch (err) {
                                     throw wrapEntityError(err, "update", "script", name);
                                 }
                             }
-                            else {
-                                // Dry-run on the adopt path.
-                                await warnStaleWorkflowsForScript(client, resolvedAppId, match.scriptId, sha256HexString(body), true);
-                            }
                         }
                         else {
                             changes.push({ type: "script", action: "create", key: name });
@@ -2738,6 +2779,10 @@ Directory Structure:
                                     description: workflow.description,
                                     status: workflow.status,
                                     accessRule: workflow.accessRule !== undefined ? (workflow.accessRule || null) : undefined,
+                                    // #1081 — workflow principal mode. Absent key → undefined
+                                    // (server leaves it untouched); explicit value/empty is
+                                    // forwarded so it round-trips.
+                                    runAs: workflow.runAs !== undefined ? (workflow.runAs || null) : undefined,
                                     perUserMaxRunning: workflow.perUserMaxRunning,
                                     perUserMaxQueued: workflow.perUserMaxQueued,
                                     dequeueOrder: workflow.dequeueOrder,
@@ -2832,6 +2877,8 @@ Directory Structure:
                                     inputSchema: workflow.inputSchema ? safeJsonParse(workflow.inputSchema) : undefined,
                                     outputSchema: workflow.outputSchema ? safeJsonParse(workflow.outputSchema) : undefined,
                                     accessRule: workflow.accessRule || undefined,
+                                    // #1081 — workflow principal mode (absent → server default).
+                                    runAs: workflow.runAs || undefined,
                                     perUserMaxRunning: workflow.perUserMaxRunning,
                                     perUserMaxQueued: workflow.perUserMaxQueued,
                                     dequeueOrder: workflow.dequeueOrder,
@@ -2946,6 +2993,15 @@ Directory Structure:
                             `\nAborting push: ${validation.errors.length} unresolved $params reference(s) in ${file}.`);
                     }
                     const existingEntry = syncState?.entities?.databaseTypes?.[dbType];
+                    // Issue #915 (defect b): track whether the apply path rejected any
+                    // op for THIS file via the schema gate (OperationRefError /
+                    // SchemaRequiredError). On a non-transactional fresh-type push the
+                    // db-type lands but the bad op is blocked and the loop continues; if
+                    // we then wrote the file-level contentHash, the next push's
+                    // `shouldPushFile` would short-circuit and the missing op would be
+                    // invisible drift. When this flag is set we skip the contentHash
+                    // write so the drift stays visible and a corrected re-push converges.
+                    let fileHadGateRejectedOp = false;
                     // Skip if file hasn't changed since last sync
                     if (!options.force && existingEntry && !shouldPushFile(filePath, existingEntry.contentHash)) {
                         skippedCount++;
@@ -3032,8 +3088,7 @@ Directory Structure:
                         }
                         // 2. Op-edit gate (op create/update dry-run) for every op in the
                         //    TOML. The server runs `runSchemaGate` and short-circuits
-                        //    before persisting. Skipped for a fresh type (no schema on the
-                        //    server yet → gate is a no-op anyway).
+                        //    before persisting.
                         //
                         //    The op gate is run against the schema THIS push is landing
                         //    (`schemaOverride`), not the stale stored schema — the real
@@ -3043,11 +3098,36 @@ Directory Structure:
                         //    a schema landed earlier in the same push"). When the push
                         //    isn't changing the schema, leave the override unset so the
                         //    server uses the stored schema.
-                        if (existingEntry) {
-                            const validateUpdateData = computeTypeUpdateData();
-                            const proposedSchema = "schema" in validateUpdateData
-                                ? validateUpdateData.schema
-                                : undefined;
+                        //
+                        //    Issue #915 (defect a): this gate now runs for FRESH types too
+                        //    (previously guarded by `if (existingEntry)`). For a brand-new
+                        //    db-type the server has no stored config, so we gate the op
+                        //    against the PROPOSED local schema via `schemaOverride`. The
+                        //    server's op-create dry-run accepts a missing type when a
+                        //    `schemaOverride` is present (see
+                        //    database-type-operations-controller.ts). A fresh schemaless
+                        //    type (#666 bootstrap) sends an empty/absent override, and
+                        //    `runSchemaGate` is a no-op without a schema — so that path
+                        //    still succeeds.
+                        {
+                            const localHasSchema = typeof typeConfig.schema === "string" &&
+                                typeConfig.schema.trim().length > 0;
+                            let proposedSchema;
+                            if (existingEntry) {
+                                const validateUpdateData = computeTypeUpdateData();
+                                proposedSchema =
+                                    "schema" in validateUpdateData
+                                        ? validateUpdateData.schema
+                                        : undefined;
+                            }
+                            else {
+                                // Fresh type: the proposed schema is whatever the local TOML
+                                // declares. A schemaless fresh type (no `[models.*]`) sends an
+                                // empty-string override so the server takes the no-schema =
+                                // no-op gate path rather than falling back to a (nonexistent)
+                                // stored config — keeping the #666 bootstrap convergent.
+                                proposedSchema = localHasSchema ? typeConfig.schema : "";
+                            }
                             for (const op of operations) {
                                 const existingOp = existingOpsForType[op.name];
                                 opGateContext = {
@@ -3071,7 +3151,20 @@ Directory Structure:
                                         access: op.access,
                                         definition: op.definition,
                                         params: op.params,
-                                    }, { dryRun: true, schemaOverride: proposedSchema });
+                                    }, {
+                                        dryRun: true,
+                                        schemaOverride: proposedSchema,
+                                        // Issue #915 (defect a, follow-up): for a fresh type the
+                                        // server has no stored config to read `defaultAccess`
+                                        // from, so an op that omits `access` to inherit the
+                                        // TOML-declared type-level `defaultAccess` would be
+                                        // falsely rejected. Thread the proposed value so the
+                                        // fresh-type dry-run gates the same way the real push
+                                        // (which lands the type first) will.
+                                        defaultAccess: typeof typeConfig.defaultAccess === "string"
+                                            ? typeConfig.defaultAccess
+                                            : undefined,
+                                    });
                                 }
                             }
                             // Every op gate passed; clear the context so a later (non-op)
@@ -3563,6 +3656,10 @@ Directory Structure:
                                             key: `${dbType}/${op.name}`,
                                             message: err.message,
                                         });
+                                        // Issue #915 (defect b): a gate-rejected op means this
+                                        // file's state did NOT fully land — don't poison the
+                                        // content hash (see the contentHash write below).
+                                        fileHadGateRejectedOp = true;
                                     }
                                     else if (err instanceof OperationRefError) {
                                         schemaErrors.opRefs.push({
@@ -3571,6 +3668,7 @@ Directory Structure:
                                             refs: err.refs,
                                             message: err.message,
                                         });
+                                        fileHadGateRejectedOp = true;
                                     }
                                     else {
                                         throw wrapEntityError(err, "update", "operation", `${dbType}/${op.name}`);
@@ -3608,6 +3706,10 @@ Directory Structure:
                                             key: `${dbType}/${op.name}`,
                                             message: err.message,
                                         });
+                                        // Issue #915 (defect b): a gate-rejected op means this
+                                        // file's state did NOT fully land — don't poison the
+                                        // content hash (see the contentHash write below).
+                                        fileHadGateRejectedOp = true;
                                     }
                                     else if (err instanceof OperationRefError) {
                                         schemaErrors.opRefs.push({
@@ -3616,6 +3718,7 @@ Directory Structure:
                                             refs: err.refs,
                                             message: err.message,
                                         });
+                                        fileHadGateRejectedOp = true;
                                     }
                                     else {
                                         throw wrapEntityError(err, "create", "operation", `${dbType}/${op.name}`);
@@ -3747,9 +3850,27 @@ Directory Structure:
                     // file. Recompute here so a truly-unchanged subsequent push skips
                     // the whole file via `shouldPushFile`. `--force` bypasses that
                     // skip, so forced re-pushes are unaffected.
+                    //
+                    // Issue #915 (defect b): when the gate rejected an op for this
+                    // file, do NOT record a matching content hash. The db-type itself
+                    // may have been created (the push is non-transactional), but the
+                    // blocked op never landed — a matching hash would make
+                    // `shouldPushFile` short-circuit the next push and hide the missing
+                    // op as "in sync". Clear the hash instead of writing it: an empty
+                    // hash forces `shouldPushFile` to re-evaluate the file, so a
+                    // subsequent `sync push --dry-run` still surfaces the op as drift
+                    // and a corrected re-push converges without manual file edits. We
+                    // clear (rather than merely skip) so the fresh-type create path's
+                    // earlier optimistic hash write (see `createDatabaseTypeConfig`
+                    // above) is also invalidated.
                     if (!options.dryRun && syncState?.entities?.databaseTypes?.[dbType]) {
-                        syncState.entities.databaseTypes[dbType].contentHash =
-                            computeFileHash(filePath);
+                        if (fileHadGateRejectedOp) {
+                            syncState.entities.databaseTypes[dbType].contentHash = "";
+                        }
+                        else {
+                            syncState.entities.databaseTypes[dbType].contentHash =
+                                computeFileHash(filePath);
+                        }
                     }
                 }
             }
@@ -4167,12 +4288,17 @@ Directory Structure:
                     localPrompts.add(key);
                 }
             }
+            // #1175: capture the parsed (fragment-expanded) local workflow TOML
+            // per key so the content-aware comparison below can hash it without a
+            // second read.
+            const localWorkflowParsed = new Map();
             const workflowsDir = join(configDir, "workflows");
             if (existsSync(workflowsDir)) {
                 for (const file of readdirSync(workflowsDir).filter((f) => f.endsWith(".toml"))) {
                     const tomlData = parseTomlFile(join(workflowsDir, file));
                     const key = tomlData.workflow?.key || basename(file, ".toml");
                     localWorkflows.add(key);
+                    localWorkflowParsed.set(key, tomlData);
                 }
             }
             const emailTemplatesDirPath = join(configDir, "email-templates");
@@ -4255,14 +4381,69 @@ Directory Structure:
                     differences.push({ type: "prompt", key, status: "remote only" });
                 }
             }
-            // Workflows
+            // Workflows — #1175: content-aware comparison.
+            //
+            // For workflows present on BOTH sides we no longer stop at key
+            // existence. We fetch the full remote workflow (mirroring `sync pull`:
+            // `getWorkflow` + active `getWorkflowConfig` for steps), serialize it
+            // through the SAME `serializeWorkflow` pull writes to disk, and hash
+            // both sides through the canonical pull/push hash. A difference is
+            // reported as `modified`, which `diff` frames as a preview of
+            // `sync pull` (pull would rewrite the local file to match running
+            // state). It is NOT framed as "push would send": push *preserves*
+            // omitted remote values (sync.ts updateWorkflow), so a remote
+            // non-default vs a local omission shows Modified even though push
+            // wouldn't change it.
+            //
+            // Default-normalization (see `hashWorkflowTomlForDiff`) means a local
+            // file that omits perUserMaxRunning/Queued etc. reads as Synced when
+            // the server holds the model defaults (4/100/…), and only an
+            // explicitly-set non-default server value reads as Modified.
+            const remoteWorkflowIds = new Map(workflowItems.map((w) => [w.workflowKey, w.workflowId]));
             for (const key of localWorkflows) {
                 if (!remoteWorkflows.has(key)) {
                     differences.push({ type: "workflow", key, status: "local only" });
+                    continue;
                 }
-                else {
-                    differences.push({ type: "workflow", key, status: "exists" });
+                // Present on both sides → compare content.
+                const workflowId = remoteWorkflowIds.get(key);
+                const localParsed = localWorkflowParsed.get(key);
+                let status = "exists";
+                let hint;
+                try {
+                    if (!workflowId || !localParsed) {
+                        throw new Error("missing workflow id or local parse");
+                    }
+                    const remoteData = await client.getWorkflow(resolvedAppId, workflowId);
+                    // Fetch active config steps (mirrors pull at the workflows hydrate
+                    // block). Failure here is non-fatal — we degrade to key-only.
+                    const activeConfigId = remoteData.workflow?.activeConfigId;
+                    if (activeConfigId && Array.isArray(remoteData.configs)) {
+                        try {
+                            const activeConfig = await client.getWorkflowConfig(resolvedAppId, workflowId, activeConfigId);
+                            const idx = remoteData.configs.findIndex((c) => c.configId === activeConfigId);
+                            if (idx >= 0 && activeConfig) {
+                                remoteData.configs[idx] = activeConfig;
+                            }
+                        }
+                        catch {
+                            // Ignore — fall back to whatever steps the workflow GET carried.
+                        }
+                    }
+                    const remoteHash = hashRemoteWorkflowForDiff(remoteData.workflow, remoteData.draft, remoteData.configs || []);
+                    const localHash = hashWorkflowTomlForDiff(localParsed);
+                    if (remoteHash !== localHash) {
+                        status = "modified";
+                        hint = "run `sync pull` to rewrite the local TOML to match running state";
+                    }
                 }
+                catch {
+                    // Per-workflow fetch failure must not abort the whole diff. Degrade
+                    // gracefully to a key-only "Synced (content not compared)" caveat.
+                    status = "exists";
+                    hint = "content not compared (fetch failed)";
+                }
+                differences.push({ type: "workflow", key, status, hint });
             }
             for (const key of remoteWorkflows) {
                 if (!localWorkflows.has(key)) {
@@ -4333,6 +4514,7 @@ Directory Structure:
             divider();
             const localOnly = differences.filter((d) => d.status === "local only");
             const remoteOnly = differences.filter((d) => d.status === "remote only");
+            const modified = differences.filter((d) => d.status === "modified");
             const existing = differences.filter((d) => d.status === "exists");
             if (localOnly.length > 0) {
                 info("Local only (will be created on push):");
@@ -4348,10 +4530,22 @@ Directory Structure:
                 }
                 console.log();
             }
+            // #1175: workflows whose deployed content differs from the local TOML.
+            // Framed as a preview of `sync pull` — pull would rewrite these files
+            // to match what's actually running (NOT "push would send").
+            if (modified.length > 0) {
+                warn("Modified — `sync pull` would rewrite these to match running state:");
+                for (const d of modified) {
+                    const hint = d.hint ? ` ${chalk.dim(`(${d.hint})`)}` : "";
+                    console.log(`  ${chalk.yellow("~")} ${d.type}: ${d.key}${hint}`);
+                }
+                console.log();
+            }
             if (existing.length > 0) {
                 info("Synced:");
                 for (const d of existing) {
-                    console.log(`  ${chalk.dim("=")} ${d.type}: ${d.key}`);
+                    const hint = d.hint ? ` ${chalk.dim(`(${d.hint})`)}` : "";
+                    console.log(`  ${chalk.dim("=")} ${d.type}: ${d.key}${hint}`);
                 }
             }
             // Show test case differences
@@ -4374,6 +4568,7 @@ Directory Structure:
             divider();
             keyValue("Local only", localOnly.length);
             keyValue("Remote only", remoteOnly.length);
+            keyValue("Modified", modified.length);
             keyValue("Synced", existing.length);
             if (testCaseDiffs.length > 0) {
                 keyValue("Test Cases (local only)", tcLocalOnly.length);
@@ -4572,15 +4767,14 @@ Directory Structure:
                 warn(`You have uncommitted git changes under ${configDir}. ` +
                     "Reverting will overwrite them.");
             }
-            const inquirer = await import("inquirer");
-            const { confirm } = await inquirer.default.prompt([
-                {
-                    type: "confirm",
-                    name: "confirm",
-                    message: `Restore snapshot ${target.id} into ${configDir}? This overwrites the current sync directory.`,
-                    default: false,
-                },
-            ]);
+            let confirm;
+            try {
+                confirm = await confirmPrompt(`Restore snapshot ${target.id} into ${configDir}? This overwrites the current sync directory.`);
+            }
+            catch (err) {
+                error(err.message);
+                process.exit(1);
+            }
             if (!confirm) {
                 info("Cancelled.");
                 return;