runwork 0.25.0 → 0.25.1

package/bundled-types/core-routes.d.ts

@@ -24,6 +24,31 @@ export interface ClientErrorReport {
     level?: 'error' | 'warning' | 'info';
     category?: string;
 }
+/**
+ * Decide whether to send the permissive `Permissions-Policy` header for an app
+ * that is being embedded in an iframe.
+ *
+ * A document's own Permissions-Policy can only restrict, never grant: the grant
+ * comes from the embedding page's policy plus the iframe `allow` attribute. This
+ * header's job is therefore to stop the app self-restricting the features the
+ * platform preview delegates to it, and this predicate decides who is trusted
+ * enough to be handed that.
+ *
+ * Hostnames are parsed and compared exactly, never substring-matched against the
+ * raw header. The difference is not cosmetic: `origin.endsWith('runwork.ai')`
+ * also matches `https://notrunwork.ai`, and `origin.includes(domain)` matches
+ * `https://evil-acme.com.attacker.net` against a tenant's `acme.com`, which would
+ * hand an attacker's page camera, microphone, geolocation and screen capture over
+ * an embedded app.
+ *
+ * @param origin  The `Origin` header, or the `Referer` as a fallback. Origin is a
+ *                bare origin and Referer is a full URL; both parse the same way.
+ *                Empty means direct (non-embedded) access.
+ * @param allowedOrigins Comma-separated exact hostnames from `ALLOWED_ORIGINS`,
+ *                injected by the platform as the workspace's active custom
+ *                domains. Matched exactly; subdomains are deliberately excluded.
+ */
+export declare function shouldGrantIframePermissions(origin: string, allowedOrigins?: string): boolean;
 /**
  * Mount all core platform routes on the Hono app
  * Called from index.ts before user-defined routes

package/dist/index.js

@@ -1380,8 +1380,154 @@ var init_identity = __esm(() => {
   init_subprocess();
 });
 
+// src/utils/ignore-matcher.ts
+import { existsSync as existsSync4, readFileSync as readFileSync4 } from "fs";
+import { basename, join as join4 } from "path";
+function defaultIgnoreSets() {
+  return {
+    dirs: new Set(DEFAULT_DIR_NAMES),
+    files: new Set(DEFAULT_FILE_NAMES),
+    extensions: new Set(DEFAULT_EXTENSIONS)
+  };
+}
+function parseGitignoreContent(content) {
+  const dirs = new Set;
+  const files = new Set;
+  for (const rawLine of content.split(`
+`)) {
+    const line = rawLine.trim();
+    if (!line || line.startsWith("#"))
+      continue;
+    if (line.startsWith("!"))
+      continue;
+    if (GLOB_CHARS.test(line))
+      continue;
+    let pattern = line;
+    const isDirOnly = pattern.endsWith("/");
+    if (isDirOnly)
+      pattern = pattern.slice(0, -1);
+    if (pattern.startsWith("/"))
+      pattern = pattern.slice(1);
+    if (!pattern)
+      continue;
+    if (pattern.includes("/"))
+      continue;
+    if (isDirOnly) {
+      dirs.add(pattern);
+    } else {
+      dirs.add(pattern);
+      files.add(pattern);
+    }
+  }
+  return { dirs, files };
+}
+function loadGitignoreFromDir(dir) {
+  const path = join4(dir, ".gitignore");
+  if (!existsSync4(path))
+    return { dirs: new Set, files: new Set };
+  try {
+    return parseGitignoreContent(readFileSync4(path, "utf-8"));
+  } catch {
+    return { dirs: new Set, files: new Set };
+  }
+}
+function buildIgnoreSets(dir) {
+  const sets = defaultIgnoreSets();
+  const parsed = loadGitignoreFromDir(dir);
+  for (const name of parsed.dirs)
+    sets.dirs.add(name);
+  for (const name of parsed.files)
+    sets.files.add(name);
+  return sets;
+}
+function isPathIgnored(filePath, sets) {
+  const name = basename(filePath);
+  if (sets.dirs.has(name))
+    return true;
+  if (sets.files.has(name))
+    return true;
+  const dotIndex = name.lastIndexOf(".");
+  if (dotIndex >= 0) {
+    const ext = name.slice(dotIndex);
+    if (sets.extensions.has(ext))
+      return true;
+  }
+  return false;
+}
+function isRelPathIgnored(relPath, sets) {
+  const segments = relPath.split("/");
+  for (let i = 0;i < segments.length - 1; i++) {
+    if (sets.dirs.has(segments[i]))
+      return true;
+  }
+  return isPathIgnored(relPath, sets);
+}
+var ALWAYS_IGNORED_DIRS, DEFAULT_DIR_NAMES, DEFAULT_FILE_NAMES, DEFAULT_EXTENSIONS, GLOB_CHARS;
+var init_ignore_matcher = __esm(() => {
+  ALWAYS_IGNORED_DIRS = [
+    ".git",
+    "node_modules",
+    ".runwork",
+    ".bun-cache",
+    ".npm-cache",
+    ".pnpm-store",
+    ".turbo",
+    ".vite",
+    ".cache",
+    "coverage",
+    "dist"
+  ];
+  DEFAULT_DIR_NAMES = ALWAYS_IGNORED_DIRS;
+  DEFAULT_FILE_NAMES = [
+    ".dev.vars",
+    ".env"
+  ];
+  DEFAULT_EXTENSIONS = [
+    ".log"
+  ];
+  GLOB_CHARS = /[*?\[\]]/;
+});
+
+// src/git/repo-config.ts
+function hardenRepoForRestrictedFs(cwd) {
+  for (const [key, value] of HARDENING) {
+    try {
+      execFileSync("git", ["config", key, value], { cwd, stdio: "pipe" });
+    } catch {}
+  }
+}
+function buildInitialGitignore() {
+  const dirs = ALWAYS_IGNORED_DIRS.filter((dir) => dir !== ".git").map((dir) => `${dir}/`);
+  return [
+    "# Dependencies, caches and build output",
+    ...dirs,
+    "",
+    "# Local secrets. Never commit these.",
+    ".dev.vars",
+    ".dev.vars*",
+    ".env",
+    ".env.*",
+    "",
+    "# Logs and tool state",
+    "*.log",
+    "*.tsbuildinfo",
+    ".eslintcache",
+    ""
+  ].join(`
+`);
+}
+var HARDENING;
+var init_repo_config = __esm(() => {
+  init_subprocess();
+  init_ignore_matcher();
+  HARDENING = [
+    ["gc.auto", "0"],
+    ["maintenance.auto", "false"]
+  ];
+});
+
 // src/git/preflight.ts
-import { existsSync as existsSync4 } from "fs";
+import { existsSync as existsSync5 } from "fs";
 import { win32 as winPath } from "path";
 import { homedir as homedir3 } from "os";
 function tryRun(bin) {
@@ -1403,9 +1549,9 @@ function whereGit() {
     const out = buf.toString("utf-8");
     const lines = out.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
     const exe = lines.find((line) => /\.exe$/i.test(line));
-    if (exe && existsSync4(exe))
+    if (exe && existsSync5(exe))
       return exe;
-    const fallback = lines.find((line) => existsSync4(line));
+    const fallback = lines.find((line) => existsSync5(line));
     return fallback ?? null;
   } catch {
     return null;
@@ -1430,7 +1576,7 @@ function registryGit() {
         continue;
       const installRoot = match[1].trim();
       const gitExe = winPath.join(installRoot, "cmd", "git.exe");
-      if (existsSync4(gitExe))
+      if (existsSync5(gitExe))
         return gitExe;
     } catch {}
   }
@@ -1498,7 +1644,7 @@ function probeGit() {
       }
     }
     for (const candidate of canonicalGitCandidates()) {
-      if (!existsSync4(candidate))
+      if (!existsSync5(candidate))
         continue;
       const verify = tryRun(candidate);
       if (verify.ok) {
@@ -1636,106 +1782,6 @@ async function resolveApp(client, nameOrId, workspaceId) {
   process.exit(1);
 }
 
-// src/utils/ignore-matcher.ts
-import { existsSync as existsSync5, readFileSync as readFileSync4 } from "fs";
-import { basename, join as join4 } from "path";
-function defaultIgnoreSets() {
-  return {
-    dirs: new Set(DEFAULT_DIR_NAMES),
-    files: new Set(DEFAULT_FILE_NAMES),
-    extensions: new Set(DEFAULT_EXTENSIONS)
-  };
-}
-function parseGitignoreContent(content) {
-  const dirs = new Set;
-  const files = new Set;
-  for (const rawLine of content.split(`
-`)) {
-    const line = rawLine.trim();
-    if (!line || line.startsWith("#"))
-      continue;
-    if (line.startsWith("!"))
-      continue;
-    if (GLOB_CHARS.test(line))
-      continue;
-    let pattern = line;
-    const isDirOnly = pattern.endsWith("/");
-    if (isDirOnly)
-      pattern = pattern.slice(0, -1);
-    if (pattern.startsWith("/"))
-      pattern = pattern.slice(1);
-    if (!pattern)
-      continue;
-    if (pattern.includes("/"))
-      continue;
-    if (isDirOnly) {
-      dirs.add(pattern);
-    } else {
-      dirs.add(pattern);
-      files.add(pattern);
-    }
-  }
-  return { dirs, files };
-}
-function loadGitignoreFromDir(dir) {
-  const path = join4(dir, ".gitignore");
-  if (!existsSync5(path))
-    return { dirs: new Set, files: new Set };
-  try {
-    return parseGitignoreContent(readFileSync4(path, "utf-8"));
-  } catch {
-    return { dirs: new Set, files: new Set };
-  }
-}
-function buildIgnoreSets(dir) {
-  const sets = defaultIgnoreSets();
-  const parsed = loadGitignoreFromDir(dir);
-  for (const name of parsed.dirs)
-    sets.dirs.add(name);
-  for (const name of parsed.files)
-    sets.files.add(name);
-  return sets;
-}
-function isPathIgnored(filePath, sets) {
-  const name = basename(filePath);
-  if (sets.dirs.has(name))
-    return true;
-  if (sets.files.has(name))
-    return true;
-  const dotIndex = name.lastIndexOf(".");
-  if (dotIndex >= 0) {
-    const ext = name.slice(dotIndex);
-    if (sets.extensions.has(ext))
-      return true;
-  }
-  return false;
-}
-function isRelPathIgnored(relPath, sets) {
-  const segments = relPath.split("/");
-  for (let i = 0;i < segments.length - 1; i++) {
-    if (sets.dirs.has(segments[i]))
-      return true;
-  }
-  return isPathIgnored(relPath, sets);
-}
-var DEFAULT_DIR_NAMES, DEFAULT_FILE_NAMES, DEFAULT_EXTENSIONS, GLOB_CHARS;
-var init_ignore_matcher = __esm(() => {
-  DEFAULT_DIR_NAMES = [
-    ".git",
-    "node_modules",
-    ".runwork",
-    ".bun-cache"
-  ];
-  DEFAULT_FILE_NAMES = [
-    ".dev.vars",
-    ".env"
-  ];
-  DEFAULT_EXTENSIONS = [
-    ".log"
-  ];
-  GLOB_CHARS = /[*?\[\]]/;
-});
-
 // src/template/manifest.ts
 import { createHash } from "crypto";
 import { readFileSync as readFileSync5, writeFileSync as writeFileSync2, existsSync as existsSync6, readdirSync, mkdirSync as mkdirSync2 } from "fs";
@@ -1782,17 +1828,39 @@ async function saveManifest(dir, manifest) {
   }
   writeFileSync2(join5(manifestDir, "template-manifest.json"), JSON.stringify(manifest, null, 2));
 }
+function loadManifestSync(dir) {
+  const manifestPath = join5(dir, ".runwork", "template-manifest.json");
+  if (!existsSync6(manifestPath))
+    return null;
+  try {
+    return normalizeManifest(JSON.parse(readFileSync5(manifestPath, "utf-8")));
+  } catch {
+    return null;
+  }
+}
+function isPristineTemplateFile(dir, relPath, manifest) {
+  const expectedHash = manifest?.files[relPath];
+  if (!expectedHash)
+    return false;
+  try {
+    return sha256(readFileSync5(join5(dir, relPath))) === expectedHash;
+  } catch {
+    return false;
+  }
+}
+function normalizeManifest(manifest) {
+  const files = {};
+  for (const [relPath, hash] of Object.entries(manifest.files)) {
+    files[relPath.split("\\").join("/")] = hash;
+  }
+  return { ...manifest, files };
+}
 async function loadManifest(dir) {
   const manifestPath = join5(dir, ".runwork", "template-manifest.json");
   if (!existsSync6(manifestPath))
     return null;
   try {
-    const manifest = JSON.parse(readFileSync5(manifestPath, "utf-8"));
-    const files = {};
-    for (const [relPath, hash] of Object.entries(manifest.files)) {
-      files[relPath.split("\\").join("/")] = hash;
-    }
-    return { ...manifest, files };
+    return normalizeManifest(JSON.parse(readFileSync5(manifestPath, "utf-8")));
   } catch {
     return null;
   }
@@ -2251,10 +2319,7 @@ async function execInit(client, appName, workspace, options = {}, creds) {
     execFileSync("git", ["remote", "set-url", "runwork", remoteUrl], { cwd: dir, stdio: "pipe" });
   }
   if (!existsSync7(join8(dir, ".gitignore"))) {
-    writeFileSync4(join8(dir, ".gitignore"), `node_modules/
-.runwork/
-.dev.vars
-`);
+    writeFileSync4(join8(dir, ".gitignore"), buildInitialGitignore());
   }
   execFileSync("git", ["add", "--", ".runwork.json", ".gitignore"], { cwd: dir, stdio: "pipe" });
   try {
@@ -2335,6 +2400,7 @@ var init_init = __esm(() => {
   init_store();
   init_client();
   init_identity();
+  init_repo_config();
   init_preflight();
   init_prompt();
   init_manifest();
@@ -2396,23 +2462,6 @@ var init_remote = __esm(() => {
   init_subprocess();
 });
 
-// src/git/repo-config.ts
-function hardenRepoForRestrictedFs(cwd) {
-  for (const [key, value] of HARDENING) {
-    try {
-      execFileSync("git", ["config", key, value], { cwd, stdio: "pipe" });
-    } catch {}
-  }
-}
-var HARDENING;
-var init_repo_config = __esm(() => {
-  init_subprocess();
-  HARDENING = [
-    ["gc.auto", "0"],
-    ["maintenance.auto", "false"]
-  ];
-});
-
 // src/git/classify-sync-error.ts
 function classifySyncError(raw) {
   if (!raw)
@@ -2420,6 +2469,9 @@ function classifySyncError(raw) {
   const s = raw.toLowerCase();
   if (raw === STASH_CONFLICT)
     return "conflict";
+  if (s.includes("[remote rejected]") || s.includes("[rejected]") || s.includes("pre-receive hook declined") || s.includes("push declined")) {
+    return "rejected";
+  }
   if (s.includes("does not appear to be a git repository") || s.includes("'runwork' does not appear") || s.includes("no such remote") || s.includes("remote") && s.includes("not found")) {
     return "no-remote";
   }
@@ -2467,6 +2519,19 @@ function diagnoseSyncError(raw) {
           "Confirm outbound access to runwork.ai, then run `runwork dev` again"
         ]
       };
+    case "rejected":
+      return {
+        reason,
+        message: "the server refused the push",
+        diagnosis: `The runwork remote rejected this push, so nothing was updated on the server. It said:
+${(raw ?? "").trim()}`,
+        suggestions: [
+          'Read the "remote:" lines above: they name the exact reason and the fix',
+          "If an oversized file was rejected, remove it from the commit and add it to .gitignore",
+          "If the history is reported as damaged, contact support to rebuild it",
+          "Retrying without changing anything will fail the same way"
+        ]
+      };
     case "conflict":
       return {
         reason,
@@ -2942,26 +3007,61 @@ function hasTrackedChanges(cwd) {
   }
 }
 function removeConflictingUntrackedFiles(cwd) {
+  const kept = [];
   try {
     const remoteFiles = execFileSync("git", ["ls-tree", "-r", "--name-only", "runwork/main"], {
       cwd,
       encoding: "utf-8"
     }).trim().split(`
 `);
-    const untrackedOutput = execFileSync("git", ["ls-files", "--others", "--exclude-standard"], {
+    const untrackedOutput = execFileSync("git", ["-c", "core.quotePath=false", "ls-files", "--others", "--exclude-standard"], {
       cwd,
       encoding: "utf-8"
     }).trim();
     const untracked = new Set(untrackedOutput.split(`
 `).filter(Boolean));
+    const manifest = loadManifestSync(cwd);
     for (const file of remoteFiles) {
-      if (untracked.has(file)) {
+      if (!untracked.has(file))
+        continue;
+      if (matchesRemote(cwd, file) || isPristineTemplateFile(cwd, file, manifest)) {
         try {
           unlinkSync2(join11(cwd, file));
         } catch {}
+      } else {
+        kept.push(file);
       }
     }
   } catch {}
+  return { kept };
+}
+function matchesRemote(cwd, file) {
+  try {
+    const remoteOid = execFileSync("git", ["rev-parse", `runwork/main:${file}`], {
+      cwd,
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+    const localOid = execFileSync("git", ["hash-object", "--", file], {
+      cwd,
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+    return Boolean(remoteOid) && remoteOid === localOid;
+  } catch {
+    return false;
+  }
+}
+function conflictedPaths(cwd) {
+  try {
+    return execFileSync("git", ["-c", "core.quotePath=false", "diff", "--name-only", "--diff-filter=U"], {
+      cwd,
+      encoding: "utf-8"
+    }).trim().split(`
+`).filter(Boolean);
+  } catch {
+    return [];
+  }
 }
 function extractGitError(err) {
   if (err && typeof err === "object") {
@@ -2996,9 +3096,11 @@ function syncWithRemote(cwd) {
   }
   let status = "synced";
   let syncError;
+  let keptUntracked = [];
+  let remoteOverwrote = [];
   try {
     execFileSync("git", ["fetch", "runwork", "main"], { cwd, stdio: "pipe" });
-    removeConflictingUntrackedFiles(cwd);
+    keptUntracked = removeConflictingUntrackedFiles(cwd).kept;
     try {
       execFileSync("git", ["rebase", "runwork/main"], { cwd, stdio: "pipe" });
     } catch (rebaseErr) {
@@ -3009,6 +3111,7 @@ function syncWithRemote(cwd) {
         execFileSync("git", ["merge", "runwork/main", "--allow-unrelated-histories", "--no-edit"], { cwd, stdio: "pipe" });
         status = "merged";
       } catch {
+        remoteOverwrote = conflictedPaths(cwd);
         try {
           execFileSync("git", ["merge", "--abort"], { cwd, stdio: "pipe" });
         } catch {}
@@ -3019,6 +3122,7 @@ function syncWithRemote(cwd) {
           try {
             execFileSync("git", ["merge", "--abort"], { cwd, stdio: "pipe" });
           } catch {}
+          remoteOverwrote = [];
           status = "sync-failed";
           syncError = extractGitError(mergeErr);
         }
@@ -3032,21 +3136,25 @@ function syncWithRemote(cwd) {
     try {
       execFileSync("git", ["stash", "pop"], { cwd, stdio: "pipe" });
     } catch {
-      return { status, pushed: false, error: "stash-conflict" };
+      return { status, pushed: false, error: "stash-conflict", keptUntracked, remoteOverwrote };
     }
   }
   if (status === "sync-failed") {
-    return { status, pushed: false, error: syncError };
+    return { status, pushed: false, error: syncError, keptUntracked, remoteOverwrote };
   }
   let pushed = false;
+  let pushError;
   try {
     execFileSync("git", ["push", "runwork", "HEAD:main"], { cwd, stdio: "pipe" });
     pushed = true;
-  } catch {}
-  return { status, pushed };
+  } catch (pushErr) {
+    pushError = extractGitError(pushErr);
+  }
+  return { status, pushed, pushError, keptUntracked, remoteOverwrote };
 }
 var init_sync = __esm(() => {
   init_subprocess();
+  init_manifest();
 });
 
 // src/git/critical-files.ts
@@ -4982,6 +5090,31 @@ export interface ClientErrorReport {
     level?: 'error' | 'warning' | 'info';
     category?: string;
 }
+/**
+ * Decide whether to send the permissive \`Permissions-Policy\` header for an app
+ * that is being embedded in an iframe.
+ *
+ * A document's own Permissions-Policy can only restrict, never grant: the grant
+ * comes from the embedding page's policy plus the iframe \`allow\` attribute. This
+ * header's job is therefore to stop the app self-restricting the features the
+ * platform preview delegates to it, and this predicate decides who is trusted
+ * enough to be handed that.
+ *
+ * Hostnames are parsed and compared exactly, never substring-matched against the
+ * raw header. The difference is not cosmetic: \`origin.endsWith('runwork.ai')\`
+ * also matches \`https://notrunwork.ai\`, and \`origin.includes(domain)\` matches
+ * \`https://evil-acme.com.attacker.net\` against a tenant's \`acme.com\`, which would
+ * hand an attacker's page camera, microphone, geolocation and screen capture over
+ * an embedded app.
+ *
+ * @param origin  The \`Origin\` header, or the \`Referer\` as a fallback. Origin is a
+ *                bare origin and Referer is a full URL; both parse the same way.
+ *                Empty means direct (non-embedded) access.
+ * @param allowedOrigins Comma-separated exact hostnames from \`ALLOWED_ORIGINS\`,
+ *                injected by the platform as the workspace's active custom
+ *                domains. Matched exactly; subdomains are deliberately excluded.
+ */
+export declare function shouldGrantIframePermissions(origin: string, allowedOrigins?: string): boolean;
 /**
  * Mount all core platform routes on the Hono app
  * Called from index.ts before user-defined routes
@@ -7840,7 +7973,7 @@ function createKeyboardListener() {
 }
 
 // src/generated/version.ts
-var VERSION = "0.25.0";
+var VERSION = "0.25.1";
 
 // src/commands/dev.ts
 var exports_dev = {};
@@ -8068,6 +8201,36 @@ async function execDev(options) {
         }
       }
     }
+    if (syncResult.remoteOverwrote && syncResult.remoteOverwrote.length > 0) {
+      if (useJson) {
+        jsonLine({ event: "sync_remote_overwrote", files: syncResult.remoteOverwrote, timestamp: ts() });
+      } else {
+        console.warn(yellow(`  Sync resolved conflicts in the remote's favour; local changes were replaced in: ${syncResult.remoteOverwrote.join(", ")}`));
+        console.warn(dim("  Recover them with `git reflog` / `git diff ORIG_HEAD` if that was wrong."));
+      }
+    }
+    if (syncResult.keptUntracked && syncResult.keptUntracked.length > 0) {
+      if (useJson) {
+        jsonLine({ event: "sync_kept_untracked", files: syncResult.keptUntracked, timestamp: ts() });
+      } else {
+        console.warn(yellow(`  Kept your untracked file(s) over the remote's copy: ${syncResult.keptUntracked.join(", ")}`));
+        console.warn(dim("  Commit or remove them so the sync can reconcile that path."));
+      }
+    }
+    if (!syncResult.pushed && syncResult.pushError) {
+      const diag = diagnoseSyncError(syncResult.pushError);
+      if (useJson) {
+        jsonLine({
+          event: "error",
+          phase: "push",
+          timestamp: ts(),
+          error: { reason: diag.reason, message: diag.message, diagnosis: diag.diagnosis, suggestions: diag.suggestions }
+        });
+      } else {
+        console.warn(yellow(`  Push failed: ${diag.message}`));
+        console.warn(dim(`  ${diag.diagnosis}`));
+      }
+    }
     if (useJson) {
       jsonLine({ event: "startup", phase: "sync", status: syncResult.status, pushed: syncResult.pushed, timestamp: ts() });
       if (syncResult.status === "sync-failed") {
@@ -17964,12 +18127,28 @@ var deployCommand = new Command5("deploy").description("Deploy the current app t
       console.error(`  - ${s}`);
     process.exit(1);
   }
+  if (syncResult.remoteOverwrote && syncResult.remoteOverwrote.length > 0) {
+    const files = syncResult.remoteOverwrote.join(", ");
+    if (useJson) {
+      jsonLine({ event: "sync_remote_overwrote", files: syncResult.remoteOverwrote, timestamp: new Date().toISOString() });
+    } else {
+      console.warn(`Sync resolved conflicts in the remote's favour; local changes were replaced in: ${files}`);
+      console.warn("  Recover them with `git reflog` / `git diff ORIG_HEAD` before deploying again if that was wrong.");
+    }
+  }
+  if (syncResult.keptUntracked && syncResult.keptUntracked.length > 0 && !useJson) {
+    console.warn(`Kept your untracked file(s) over the remote's copy: ${syncResult.keptUntracked.join(", ")}`);
+  }
   if (!syncResult.pushed) {
+    const diag = diagnoseSyncError(syncResult.pushError ?? syncResult.error);
     if (useJson) {
-      jsonOut(buildErrorResponse("deploy", "Failed to push before deployment", "Local commits were synced but could not be pushed to the remote.", ["Check your network connection", "Run runwork dev to retry syncing", "Then retry runwork deploy"]));
+      jsonOut(buildErrorResponse("deploy", `Failed to push before deployment: ${diag.message}`, diag.diagnosis, [...diag.suggestions, "Then retry runwork deploy"]));
       process.exit(1);
     }
-    console.error("Push failed. Check your connection and retry `runwork deploy`.");
+    console.error(`Push failed: ${diag.message}`);
+    console.error(diag.diagnosis);
+    for (const suggestion of diag.suggestions)
+      console.error(`  - ${suggestion}`);
     process.exit(1);
   }
   if (!useJson)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "runwork",
-  "version": "0.25.0",
+  "version": "0.25.1",
   "description": "CLI for Runwork: develop, preview, and deploy Runwork apps from your local machine.",
   "license": "UNLICENSED",
   "author": "Runwork, Inc. <info@runwork.ai> (https://www.runwork.ai)",