uniweb 1.21.5 → 1.21.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "uniweb",
-  "version": "1.21.5",
+  "version": "1.21.7",
   "description": "Create structured Vite + React sites with content/code separation",
   "type": "module",
   "bin": {
@@ -41,13 +41,13 @@
     "js-yaml": "^4.3.2",
     "prompts": "^2.4.2",
     "tar": "^7.5.21",
+    "@uniweb/core": "~1.4.9",
     "@uniweb/content-writer": "~1.3.1",
     "@uniweb/schemas": "~1.6.5",
-    "@uniweb/semantic-parser": "~1.13.0",
-    "@uniweb/core": "~1.4.7"
+    "@uniweb/semantic-parser": "~1.13.0"
   },
   "peerDependencies": {
-    "@uniweb/build": "~1.10.5",
+    "@uniweb/build": "~1.10.6",
     "@uniweb/semantic-parser": "~1.13.0",
     "@uniweb/content-reader": "~1.5.7"
   },

package/partials/agents.md

@@ -67,7 +67,7 @@ https://uniweb.io/llms.txt
 
 It lists every documentation page with a one-line description and a fetchable link. Go there whenever your question isn't answered in this file — and *especially* when you don't know whether a feature exists at all. That's where guessing does the most damage: **a 404 on a path you invented tells you your guess was wrong, not that the feature is missing.** Concluding "the framework doesn't support X" from a failed fetch is a mistake worth actively guarding against; the index answers the existence question directly.
 
-Then **follow the link the index gives you** rather than constructing one yourself. The index is the source of truth for where pages live, so it stays correct when the site's URL conventions change. Each link it gives is the page as Markdown.
+Then **follow the link the index gives you** rather than constructing one yourself. The index is the source of truth for where pages live, so it stays correct when the site's URL conventions change. Each link it gives is the page as Markdown, and a page's own address returns the same Markdown to a request sent with `Accept: text/markdown`.
 
 **Clone the repo instead** when you expect several lookups, or may lose network access later:
 
@@ -2862,7 +2862,7 @@ uniweb <command> --help           # Per-command flags — no side effects. Prefe
 | Any static host at all | `uniweb export` | full control; no Uniweb account needed |
 | Uniweb Cloud | `uniweb publish` | teams with non-technical content authors, or client work |
 
-`uniweb deploy` never assumes a host: with nothing configured it opens a picker listing only destinations it can act on, and records the choice in `deploy.yml` so later runs go straight there. On Cloudflare Pages / Netlify / Vercel, `add ci` also adds per-PR previews that comment the URL. Adapters: `github-pages`, `cloudflare-pages`, `netlify`, `vercel`, plus `s3-cloudfront` for `deploy`. That record is `deploy.yml`, beside `site.yml` — **the CLI writes it, you don't create it**: the first successful deploy scaffolds the whole file, and later deploys rewrite only its `deploys:` block. Edit `targets:` when you want to change where a site ships. Host credentials come from the environment, never from that committed file.
+`uniweb deploy` never assumes a host: with nothing configured it opens a picker listing only destinations it can act on, and records the choice in `deploy.yml` so later runs go straight there. On Cloudflare Pages / Netlify / Vercel, `add ci` also adds per-PR previews that comment the URL. GitHub runs workflows only from the top of the repository: in a project that is a folder of a larger repository, the project's own `.github/` never runs, and `uniweb status` says so — as it says when a target in `deploy.yml` was never deployed from this copy. Adapters: `github-pages`, `cloudflare-pages`, `netlify`, `vercel`, plus `s3-cloudfront` for `deploy`. That record is `deploy.yml`, beside `site.yml` — **the CLI writes it, you don't create it**: the first successful deploy scaffolds the whole file, and later deploys rewrite only its `deploys:` block. Edit `targets:` when you want to change where a site ships. Host credentials come from the environment, never from that committed file.
 
 Foundations have their own free path too: `uniweb add ci --target foundation` publishes to permanent versioned URLs on GitHub Pages.
 
@@ -2916,6 +2916,8 @@ A site can be in more than one place — usually while it moves from one host to
 
 **Nobody's work is overwritten without asking.** `uniweb push` is refused if the site changed on the backend since your last pull — usually an author editing in the app — and reports what changed; nothing is written. Edits to different sections never collide. **In a git repository `uniweb pull` merges, like `git pull`:** it commits the backend's content (*"The site's content on …"*) and merges that commit into your branch, against the last state of the site your history shares with the backend. Your work, committed or not, and a teammate's arriving through git are kept; a file the backend never had is never deleted; changes to different parts of a file combine silently; and only a genuine overlap leaves conflict markers and a non-zero exit — so `uniweb pull && uniweb push` never ships markers. Settle a conflict as in any merge, then `git commit`; where your uncommitted changes overlap what the pull brought, the markers are theirs — settle them and `git add` each file, then `git stash drop` (git keeps them in the stash too). A push or publish is refused while a file under the site is in conflict. **In a git repository a push sends what you have committed:** with the site's content not committed it is refused before anything is sent, naming the files — commit them, or run `uniweb push --commit -m "…"` (it commits the site's content only, and leaves anything else staged as it is); `publish` and `sync` take `--commit` too. That commit is where the next pull merges from, which is how the pull tells your changes from the backend's. What the push writes back into the files — the ids the backend assigned — it commits itself, as `uniweb`. When the backend has nothing new, a pull says so and lists the files where yours hold changes it lacks. `uniweb refresh` runs `git pull` first, then the same pull. A push is also refused when your branch does not hold what this copy last took from the backend — after `git merge --abort`, or in a fresh clone that has not pulled — so pull, then push. Outside git — which includes a folder the repository around it ignores, such as a scratch directory — `uniweb pull` takes the backend's version over your files, asking first. `--force` is the deliberate overwrite (on `push` it replaces the backend's changes, on `pull` it discards yours); don't use it to get past a refusal. `uniweb sync` is `refresh` then `push`; neither publishes.
 
+**Moving a synced project to another repository.** Where the copy last met the backend is in its git history, and in `.uniweb/`, which git never holds — both stay behind; `sync.json` comes along, so the copy still knows its site. Move one this way: `uniweb sync` in the old copy, then copy the project in without its `.git/` and commit it, then sign in to the site's workspace and `uniweb pull` once — it records where the copy and the site meet, with nothing to settle when the old copy had synced. When it had not, `uniweb status` says the copy shares no history with the site's content and lists the files that say something else; the first pull makes each a conflict. Settle each by what you know: an edit made in the app since the last push is the backend's side, a change made in the copy and never pushed is yours — ask the person when you cannot tell. Never `--force` it in either direction: one side's edits would be gone from every file.
+
 **`sync.json` says which site this is, on each backend.** The first push to a backend records what that backend assigned — the site's id and owner, the ids of its records and uploaded files — in `sync.json` beside `site.yml`. In a git repository the push commits it; never edit it. **To make a new site from a copy of a project, run `uniweb forget --all` in the copy before its first push** — the copy carries the original's `sync.json`, so otherwise its push updates the original's site. When two projects in one workspace hold the same site, a push or publish from either is refused until that is done. `uniweb forget --server <url>` removes just one backend's records, such as a scratch server's. A record file's `$uuid` is its own id and stays in both cases. **`push`, `pull` and `publish` go to the backend you are logged in to** — the last `uniweb login --server <url>` — and never to one you are not logged in to. A bare `uniweb login` logs in to https://uniweb.app; for any other backend, name it — logging in is how you switch, and the backend commands take no `--server` of their own. When the project has no site on that backend but has one elsewhere, a push says so before creating a new one.
 
 **`services:` in `site.yml` is where a site says which services it uses** — site search, form

package/src/backend/site-sync.js

@@ -1012,6 +1012,8 @@ export function untakenBase(siteDir, backend) {
     }
     return {
       headline: "Not pushed — your branch does not hold the backend content this copy last took.",
+      // Never taken here — a fresh copy, or one brought from another repository — not lost.
+      ...(point && held ? {} : { never: true }),
       lines: [
         point && held
           ? 'The pull or push it came from is not in your history — a merge abandoned, or the branch moved.'
@@ -1980,6 +1982,24 @@ async function comparisonEmit(
   })
 }
 
+/**
+ * What a push would send from the files as they stand, every entity hashed — the same emit
+ * the banked hashes are compared with (`comparisonEmit`) — or null when the files do not emit
+ * (a key the build refuses, say). Two folders whose hashes agree say the same thing to the
+ * backend, however their files are written: a pull with no common history reads that to leave
+ * a file alone (`commands/pull.js`).
+ *
+ * @returns {Promise<Record<string,string>|null>}
+ */
+export async function entityHashes(siteDir, backend = null, { declarations, fields = null } = {}) {
+  try {
+    const pkg = await comparisonEmit(siteDir, { backend, sendAll: true, declarations, fields })
+    return pkg.hashes || {}
+  } catch {
+    return null
+  }
+}
+
 /**
  * Re-bank the send-only-changed hashes over the files as they NOW stand.
  *

package/src/commands/doctor.js

@@ -1928,6 +1928,38 @@ async function runDoctor(args = []) {
     try {
       deployYml = await loadDeployYml(sitePath)
     } catch (err) {
+      // `saveDeploys:` holding a value of the retired `autoSave:` — the key renamed by hand, its
+      // value kept (measured 2026-10-26 on a copied project) — is the retired key's to repair.
+      let kept = null
+      try {
+        const v = yaml.load(readFileSync(deployYmlPath, 'utf8'))?.saveDeploys
+        kept = v === 'lastDeploy' || v === 'off' ? v : null
+      } catch {
+        kept = null
+      }
+      if (kept) {
+        const id = 'deploy-yml-retired-key'
+        const issue = { id, type: 'error', site: siteName, message: `deploy.yml has \`saveDeploys: ${kept}\`, a value of the retired \`autoSave:\`` }
+        issues.push(issue)
+        error(`[${id}] ${siteName}: deploy.yml has \`saveDeploys: ${kept}\` — a value of the retired \`autoSave:\`, where \`saveDeploys\` is true or false.`)
+        log(
+          `    ${colors.dim}${kept === 'off' ? '`autoSave: off` is `saveDeploys: false`.' : '`autoSave: lastDeploy` is what happens anyway — deploys are recorded — so the line goes.'}${colors.reset}`
+        )
+        if (shouldFix(id)) {
+          try {
+            const { retireDeployYmlKeys } = await import('@uniweb/build/site')
+            if (await retireDeployYmlKeys(sitePath)) {
+              issue.fixed = true
+              fixed(`${relative(workspaceDir, deployYmlPath)}: ${kept === 'off' ? 'wrote `saveDeploys: false`' : 'removed `saveDeploys: lastDeploy`'}`)
+            }
+          } catch (fixErr) {
+            warn(`[${id}] could not rewrite ${relative(workspaceDir, deployYmlPath)}: ${fixErr.message}`)
+          }
+        } else {
+          log(`    ${colors.dim}Run \`uniweb doctor --fix ${id}\` to write what it meant, keeping your comments.${colors.reset}`)
+        }
+        continue
+      }
       issues.push({
         id: 'deploy-yml-malformed',
         type: 'error',
@@ -2013,10 +2045,13 @@ async function runDoctor(args = []) {
         if (names.length) lost.push(`the last deploy of ${names.map((n) => `\`${n}\``).join(', ')} is recorded only there, where nothing sees it`)
       }
       if (String(deployYml.autoSave) === 'off') lost.push('`autoSave: off` is ignored, so deploys are recorded')
-      const renamed = { lastDeploy: 'deploys', autoSave: 'saveDeploys' }
-      log(
-        `    ${colors.dim}${retired.map((k) => `\`${k}:\` is \`${renamed[k]}:\``).join(' and ')} now${lost.length ? ` — ${lost.join('; ')}` : ''}.${colors.reset}`
-      )
+      // What each one means now — said by value, not as a rename: "`autoSave:` is `saveDeploys:`"
+      // read as one, and a copy came back holding `saveDeploys: lastDeploy` (2026-10-26).
+      const means = {
+        lastDeploy: '`lastDeploy:` is `deploys:` now',
+        autoSave: '`autoSave:` goes — `autoSave: off` is `saveDeploys: false`, and `autoSave: lastDeploy` is what happens anyway'
+      }
+      log(`    ${colors.dim}${retired.map((k) => means[k]).join('; ')}${lost.length ? ` — ${lost.join('; ')}` : ''}.${colors.reset}`)
       if (shouldFix(id)) {
         try {
           const { retireDeployYmlKeys } = await import('@uniweb/build/site')

package/src/commands/pull.js

@@ -97,6 +97,7 @@ import {
   makeModelResolver,
   ensureRegisteredFoundation,
   deploymentFields,
+  entityHashes,
   rebankSyncHashes,
   writeQueryUuids,
   mergeBaseVersions,
@@ -118,6 +119,7 @@ import {
   madeOnto,
   baseFor,
   openStandIn,
+  fileAt,
   mergeSyncPoint,
   takeSyncPoint,
   snapshotFiles,
@@ -565,6 +567,100 @@ function restore(path, bytes) {
   else writeFileSync(path, bytes)
 }
 
+/**
+ * ⭐ WITH NO COMMON HISTORY, A FILE THAT SAYS WHAT THE BACKEND HOLDS IS LEFT AS IT IS.
+ *
+ * A project copied into another repository leaves its sync points in the old history, so its
+ * first pull merges two histories that share nothing: every file the projection rewrites is a
+ * conflict, this copy's against the backend's. The writer already keeps an author's text where it
+ * would write the same document (`project-writer.js`, "an unchanged body keeps the author's own
+ * text"); what it rewrites, this tries once more, two ways. Every hash a push would send, with the
+ * backend's file put in among this copy's (`entityHashes`): where none moves, the two say the
+ * same. And the same asset written two ways, which a push sends as different data
+ * (`sameButAssetForms`). Either way this copy's text goes into the backend's commit, and the merge
+ * has nothing to settle there. A backend file that does not emit at all — a key the build
+ * refuses — says something else, and stays the backend's.
+ *
+ * Measured 2026-10-26 on two sites copied out of their own repositories: six conflicts, three of
+ * them content — a logo added in the app, a key the copy had renamed on both sites — and three
+ * gallery records naming their images by URL where the backend's files name them by path.
+ *
+ * @returns {Promise<string[]>} the files left as this copy writes them
+ */
+async function keepWhatMeansTheSame({ standIn, repo, origin, declarations, fields }) {
+  const dir = standIn.siteDir
+  const ours = new Map()
+  const theirs = new Map()
+  for (const [status, path] of standIn.changes()) {
+    if (status !== 'M') continue
+    const head = fileAt(repo, 'HEAD', path)
+    const now = bytesOf(join(dir, path))
+    if (head && now) {
+      ours.set(path, head)
+      theirs.set(path, now)
+    }
+  }
+  if (!ours.size) return []
+  const opts = { ...(declarations?.size ? { declarations } : {}), fields }
+  const kept = []
+  // What the emits print is a comparison's, not this pull's to say.
+  const said = { warn: console.warn, log: console.log, info: console.info }
+  console.warn = console.log = console.info = () => {}
+  try {
+    // This copy's text everywhere: the files each backend one is tried among.
+    for (const [path, bytes] of ours) writeFileSync(join(dir, path), bytes)
+    const mine = await entityHashes(dir, origin, opts)
+    if (mine) {
+      for (const [path, bytes] of theirs) {
+        writeFileSync(join(dir, path), bytes)
+        const tried = await entityHashes(dir, origin, opts)
+        if ((tried && sameHashes(tried, mine)) || sameButAssetForms(path, ours.get(path), bytes)) kept.push(path)
+        writeFileSync(join(dir, path), ours.get(path))
+      }
+    }
+  } finally {
+    Object.assign(console, said)
+    // The backend's text back wherever it says something else.
+    for (const [path, bytes] of theirs) if (!kept.includes(path)) writeFileSync(join(dir, path), bytes)
+  }
+  return kept
+}
+
+function sameHashes(a, b) {
+  const keys = Object.keys(a)
+  return keys.length === Object.keys(b).length && keys.every((k) => a[k] === b[k])
+}
+
+/**
+ * Two versions of a file that differ only in how they name the same assets: a URL to the
+ * backend's copy (`https://…/assets/<sha256>/base.jpeg`) where the other has the site's own path
+ * (`/assets/<sha256>.jpeg`). A push sends different data from each — a URL, an asset reference —
+ * so the hashes differ, but the asset is one, by its content hash. This copy's text is kept: the
+ * banked hash is its own, so a push leaves the file alone, and the next pull from this base writes
+ * the backend's way (ours unchanged, theirs different). Measured 2026-10-26: three gallery records
+ * an older pull had written with URLs.
+ */
+export function sameButAssetForms(path, a, b) {
+  const asset = (s) => s.replace(/(?:https?:\/\/[^\s"'()]+)?\/assets\/([0-9a-f]{64})(?:\/[^\s"'()]*?)?(?:\.[A-Za-z0-9]+)?(?=[\s"'()]|$)/g, 'asset:$1')
+  const read = (bytes) => {
+    const text = bytes.toString('utf8')
+    if (!/\.ya?ml$/.test(path)) return asset(text)
+    try {
+      return JSON.stringify(sortedDeep(yaml.load(text)), (_, v) => (typeof v === 'string' ? asset(v) : v))
+    } catch {
+      return asset(text)
+    }
+  }
+  const [x, y] = [read(a), read(b)]
+  return x === y && a.toString('utf8') !== b.toString('utf8')
+}
+
+function sortedDeep(v) {
+  if (Array.isArray(v)) return v.map(sortedDeep)
+  if (v && typeof v === 'object' && !(v instanceof Date)) return Object.fromEntries(Object.keys(v).sort().map((k) => [k, sortedDeep(v[k])]))
+  return v
+}
+
 // The sync point's subject line, and the merge's.
 const pulledFrom = (origin) => `The site's content on ${origin}`
 const mergedFrom = (origin) => `Merge the site's content from ${origin}`
@@ -999,9 +1095,9 @@ export async function pull(args = [], deps = {}) {
       origin: client.origin,
       siteUuid: siteContentUuid
     })
-    // A probe with no base has no way to tell the backend's changes from this copy's: onto
-    // HEAD, every difference would read as the backend's.
-    if (probe && !base) return { exitCode: 0, probe: null }
+    // A probe with no base cannot tell the backend's changes from this copy's: onto HEAD, it says
+    // what differs, and which way is the person's to read (`noBase`, below). ⛔ Until 2026-10-26
+    // it said nothing at all, and status could not size a copied project's first pull.
     onto = force || !base ? repo.head : base
     try {
       standIn = openStandIn(repo, { roots, rev: onto })
@@ -1158,10 +1254,20 @@ export async function pull(args = [], deps = {}) {
       for (const w of report.warnings) note(`! ${w}`)
     }
 
+    // ⭐ With no common history, each file that says what the backend holds is left as this copy
+    // writes it (`keepWhatMeansTheSame`): only a difference in content is a conflict.
+    if (standIn && !base && !force) {
+      merge.keptAsWritten = await keepWhatMeansTheSame({ standIn, repo, origin: client.origin, declarations, fields })
+    }
+
     // ⭐ A PROBE STOPS HERE, the stand-in holding what this pull would take: what differs
-    // from the base is what the backend changed. Nothing is banked; `finally` closes it.
+    // from the base is what the backend changed — or, with no base, what differs at all, which
+    // way unknown (`noBase`). Nothing is banked; `finally` closes it.
     if (probe) {
-      return { exitCode: 0, probe: { files: standIn.changes(), recordsNotPlaced: Boolean(recordsNotPlaced) } }
+      return {
+        exitCode: 0,
+        probe: { files: standIn.changes(), recordsNotPlaced: Boolean(recordsNotPlaced), ...(base ? {} : { noBase: true }) }
+      }
     }
 
     // Outside git: what this pull wrote, so the next one can tell its own output from the
@@ -1369,6 +1475,11 @@ export async function pull(args = [], deps = {}) {
         if (ahead.length > 12) note(`  … and ${ahead.length - 12} more`)
       }
     }
+    if (merge.keptAsWritten?.length) {
+      note(`${merge.keptAsWritten.length} file(s) differ from ${client.origin}'s only in how they are written, and are left as they are:`)
+      for (const p of merge.keptAsWritten.slice(0, 12)) note(`  ${repo.prefix}${p}`)
+      if (merge.keptAsWritten.length > 12) note(`  … and ${merge.keptAsWritten.length - 12} more`)
+    }
     if (merge.conflicted.length) {
       error(`${merge.conflicted.length} file(s) have conflicts to resolve:`)
       for (const f of merge.conflicted) note(`  ${f}`)
@@ -1379,7 +1490,7 @@ export async function pull(args = [], deps = {}) {
       } else {
         if (merge.noBase) {
           note(`No commit in this history is one ${client.origin}'s content came from, so nothing tells`)
-          note("your changes from the backend's: each file where they differ is a conflict, yours against the backend's.")
+          note("your changes from the backend's: each file that says something else is a conflict, yours against the backend's.")
           note('Once this merge is committed, later pulls merge from it.')
         }
         note(

package/src/commands/status.js

@@ -43,7 +43,7 @@
  */
 
 import { execFileSync } from 'node:child_process'
-import { existsSync, readFileSync, statSync } from 'node:fs'
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs'
 import { basename, dirname, join, relative, resolve, sep } from 'node:path'
 import yaml from 'js-yaml'
 
@@ -467,7 +467,11 @@ async function appChecks(siteDir, siteYml, { offline, args, git }) {
     checks.push({
       id: 'app.base',
       state: 'blocking',
-      summary: base.headline.replace(/^Not pushed — /, '').replace(/^./, (ch) => ch.toUpperCase()),
+      // ⛔ Not "does not hold what this copy last took" for a copy that took nothing here — a fresh
+      // copy, or a project brought from another repository, whose sync points stayed there.
+      summary: base.never
+        ? 'This copy has not taken the site from the backend yet: a push waits until a pull has merged its content.'
+        : base.headline.replace(/^Not pushed — /, '').replace(/^./, (ch) => ch.toUpperCase()),
       blocks: ['push', 'publish']
     })
     proposals.push({ step: 'pull', command: 'npx uniweb pull', why: "merge the backend's content with yours" })
@@ -502,6 +506,14 @@ async function appChecks(siteDir, siteYml, { offline, args, git }) {
           }
         : { id: 'app.unpushed', state: 'ok', summary: 'Nothing waiting to be pushed.' }
     )
+  } else if (base?.never && git.repo) {
+    // ⛔ A copy that took nothing here has no record of what it last sent, so every entity would
+    // count as unsent — "holds changes" is a guess, and a push step before the pull it needs.
+    checks.push({
+      id: 'app.unpushed',
+      state: 'unknown',
+      summary: "What this copy holds that the backend lacks is known once a pull has merged the site's content here."
+    })
   } else {
     try {
       const probe = await probeUnpushed(siteDir, { backend: origin })
@@ -575,8 +587,9 @@ async function appChecks(siteDir, siteYml, { offline, args, git }) {
 
   // ⭐ WHAT CHANGED ON THE BACKEND, AS A PULL WOULD TAKE IT. In a repository, the pull itself,
   // stopped before it takes anything (`probePull`): the files it would change, translations
-  // and records included. Where it cannot answer — outside git, no sync point to merge from —
-  // the backend's units against this copy's last sync (`backend/app-changes.js`).
+  // and records included — with no sync point in this history, the files that differ, which way
+  // unknown (`noBaseChanges`). Outside git, the backend's units against this copy's last sync
+  // (`backend/app-changes.js`).
   const readChanges = async () => {
     if (git.repo) {
       const org = readOrgFlag(args)
@@ -712,7 +725,7 @@ function changeChecks(siteDir, changes, unpushedFiles, proposals) {
   if (!moved) {
     return [
       unknown.length
-        ? { id: 'app.changes', state: 'unknown', summary: `Could not tell what changed on the backend: ${unknown.map((l) => l.detail).join('; ')}.` }
+        ? { id: 'app.changes', state: 'unknown', summary: `Could not tell what changed on the backend: ${[...new Set(unknown.map((l) => l.detail))].join('; ')}.` }
         : { id: 'app.changes', state: 'ok', summary: 'Nothing changed on the backend since this copy last synced.', detail: { source: 'units' } }
     ]
   }
@@ -746,7 +759,8 @@ function changeChecks(siteDir, changes, unpushedFiles, proposals) {
  * `app.changes` from the pull's own answer (`probePull`): the files it would change, each
  * as the pull would write it.
  */
-function probedChanges({ files: list, recordsNotPlaced }, unpushedFiles, proposals) {
+function probedChanges({ files: list, recordsNotPlaced, noBase }, unpushedFiles, proposals) {
+  if (noBase) return noBaseChanges(list, recordsNotPlaced)
   if (!list.length) {
     return [{ id: 'app.changes', state: 'ok', summary: 'Nothing changed on the backend since this copy last synced.', detail: { source: 'pull', files: [] } }]
   }
@@ -776,6 +790,34 @@ function probedChanges({ files: list, recordsNotPlaced }, unpushedFiles, proposa
   ]
 }
 
+/**
+ * `app.changes` for a copy whose history shares no commit with the site's content — a project
+ * brought into another repository, whose sync points stayed in the old one. What differs is
+ * said, which way unknown: the first pull makes each such file a conflict, yours against the
+ * backend's, and records where the two meet; one that says what the backend holds, written
+ * another way, it leaves alone, and it is not listed (`keepWhatMeansTheSame`, `commands/pull.js`).
+ * The pull itself is `app.base`'s step.
+ */
+function noBaseChanges(list, recordsNotPlaced) {
+  const differ = list.filter(([s]) => s === 'M').map(([, p]) => p)
+  const added = list.filter(([s]) => s === 'A').map(([, p]) => p)
+  const lines = []
+  if (added.length) lines.push(`${count(added.length, 'file')} only the backend has — the pull adds ${added.length === 1 ? 'it' : 'them'}.`)
+  if (recordsNotPlaced) lines.push('Some records could not be placed in files — `npx uniweb pull` says which, and why.')
+  return [
+    {
+      id: 'app.changes',
+      state: 'attention',
+      summary: differ.length
+        ? `This copy shares no history with the site's content on the backend — brought from another repository, most likely. ${count(differ.length, 'file')} here ${differ.length === 1 ? 'says' : 'say'} something else, and the first pull makes ${differ.length === 1 ? 'it a conflict' : 'each a conflict'} to settle, yours against the backend's.`
+        : "This copy shares no history with the site's content on the backend, and its files say what the site holds: the first pull records where they meet, with nothing to settle.",
+      files: differ,
+      lines,
+      detail: { source: 'pull', noBase: true, files: list.map(([s, p]) => ({ path: p, change: CHANGE[s] || s })) }
+    }
+  ]
+}
+
 /**
  * `app.foundation`: the local foundation against its registered version — what the next
  * push or publish does with it (`backend/foundation-bring-along.js`).
@@ -1215,18 +1257,34 @@ async function deployChecks(siteDir) {
       host: t.host,
       title,
       default: name === defaultName,
+      deployed: Boolean(ci || receipt || retired),
       ci: ci ? { file: ci.file, branches: ci.branches } : null,
       last: receipt ? { at: receipt.at ?? null, sha: receipt.git?.sha ?? null, url: receipt.url ?? null } : null,
       behind,
       ...(retired ? { retired: true } : {})
     })
   }
+  // ⭐ A TARGET IS A DESTINATION, NOT A DEPLOY. Only CI or a receipt says the site went there;
+  // a target with neither is named as what it is. ⛔ Until 2026-10-26 every target was "Also
+  // deployed to", and the status opened with it — on a project copied from a repository whose
+  // CI deployed it, after the site had moved to Uniweb Cloud.
+  const deployed = targets.filter((t) => t.deployed)
+  const never = targets.filter((t) => !t.deployed)
+  const parts = []
+  if (deployed.length) parts.push(`Also deployed to ${deployed.map((t) => t.title).join(' and ')}.`)
+  if (never.length) {
+    parts.push(`deploy.yml names ${never.map((t) => t.title).join(' and ')}, never deployed from this copy.`)
+    attention = true
+    lines.push(
+      'A target never deployed from here is a host the site has not gone to yet, or one it left — when it left, remove the target from deploy.yml, and `default:` when it names it.'
+    )
+  }
   return {
     checks: [
       {
         id: 'hosting.deploys',
         state: attention ? 'attention' : 'ok',
-        summary: `Also deployed to ${targets.map((t) => t.title).join(' and ')}.`,
+        summary: parts.join(' '),
         lines,
         detail: { targets }
       }
@@ -1236,6 +1294,40 @@ async function deployChecks(siteDir) {
   }
 }
 
+/**
+ * `hosting.workflows`: GitHub Actions workflows between this site and the top of its
+ * repository — a project's own `.github/workflows` — which GitHub never runs: it runs the
+ * repository's top-level workflows alone, so these are files, not CI.
+ *
+ * ⭐ A project copied into another repository brings its `.github/` along (`uniweb add ci`
+ * writes one). Measured 2026-10-26 on a repository of client projects: a site that had moved to
+ * Uniweb Cloud still carried the GitHub Pages workflow that used to deploy it.
+ */
+function workflowsCheck(siteDir) {
+  const repo = repoOf(siteDir)
+  if (!repo) return null
+  const found = []
+  for (let d = siteDir; d !== repo.top && d.startsWith(repo.top + sep); d = dirname(d)) {
+    const dir = join(d, '.github', 'workflows')
+    let names
+    try {
+      names = readdirSync(dir).filter((n) => /\.ya?ml$/.test(n))
+    } catch {
+      continue
+    }
+    for (const n of names.sort()) found.push(relative(siteDir, join(dir, n)))
+  }
+  if (!found.length) return { id: 'hosting.workflows', state: 'ok', summary: 'No workflow here that GitHub would not run.', quiet: true }
+  const n = found.length
+  return {
+    id: 'hosting.workflows',
+    state: 'attention',
+    summary: `${count(n, 'workflow')} here never ${n === 1 ? 'runs' : 'run'}: GitHub runs workflows only from the top of the repository, ${relative(siteDir, join(repo.top, '.github', 'workflows'))}.`,
+    files: found,
+    lines: ['Most likely left from the repository this project came from. When the site no longer deploys that way, the folder can go — ask the person first.']
+  }
+}
+
 const list = (names) => names.map((n) => `\`${n}\``).join(', ')
 
 /**
@@ -1305,7 +1397,8 @@ function summaryLine({ name, synced, live, targets, origin }) {
   const parts = [synced.length ? `synced with ${synced.join(' and ')}` : 'not synced with a backend']
   if (live?.published) parts.push(`live on ${cloudName(origin)}${live.url ? ` at ${live.url}` : ''}`)
   else if (live) parts.push(`not live on ${cloudName(origin)} yet`)
-  if (targets.length) parts.push(`${live?.published ? 'also deployed' : 'deployed'} to ${targets.map((t) => t.title).join(' and ')}`)
+  const deployed = targets.filter((t) => t.deployed)
+  if (deployed.length) parts.push(`${live?.published ? 'also deployed' : 'deployed'} to ${deployed.map((t) => t.title).join(' and ')}`)
   else if (!synced.length) parts.push('not hosted anywhere yet')
   return `${name} — ${parts.join(' · ')}`
 }
@@ -1399,7 +1492,8 @@ async function workspaceOverview(root, { json }) {
     })
     const languages = normalizeLanguageList(yml.languages)
     const parts = [synced.length ? `synced with ${synced.join(' and ')}` : 'not synced']
-    if (targets.length) parts.push(`deployed to ${targets.map((t) => t.title).join(' and ')}`)
+    const deployed = targets.filter((t) => t.deployed)
+    if (deployed.length) parts.push(`deployed to ${deployed.map((t) => t.title).join(' and ')}`)
     parts.push(
       fnd.kind === 'local'
         ? `foundation ${fnd.name}`
@@ -1414,7 +1508,7 @@ async function workspaceOverview(root, { json }) {
       name: s.name,
       summary: `${s.path} — ${parts.join(' · ')}`,
       synced,
-      deploys: targets.map(({ name, host, title, default: isDefault, ci }) => ({ name, host, title, default: isDefault, ci })),
+      deploys: targets.map(({ name, host, title, default: isDefault, deployed: was, ci }) => ({ name, host, title, default: isDefault, deployed: was, ci })),
       foundation: { kind: fnd.kind, name: fnd.name ?? null, path: fnd.path ?? null },
       mounts,
       languages
@@ -1508,7 +1602,18 @@ export async function status(args = []) {
   } finally {
     Object.assign(console, saved)
   }
-  const checks = [...project.checks, ...git.checks, ...app.checks, ...deploys.checks, ...services.checks, ...version.checks, ...health.checks, dev]
+  const workflows = workflowsCheck(siteDir)
+  const checks = [
+    ...project.checks,
+    ...git.checks,
+    ...app.checks,
+    ...deploys.checks,
+    ...(workflows ? [workflows] : []),
+    ...services.checks,
+    ...version.checks,
+    ...health.checks,
+    dev
+  ]
   const next = planNext([...git.proposals, ...app.proposals, ...deploys.proposals, ...services.proposals, ...version.proposals, ...health.proposals])
 
   const root = findWorkspaceRoot(siteDir) || siteDir

package/src/framework-index.json

@@ -1,12 +1,12 @@
 {
   "schemaVersion": 1,
-  "generatedAt": "2026-10-26T19:45:51.544Z",
+  "generatedAt": "2026-10-26T22:50:14.357Z",
   "packages": {
     "@uniweb/api": {
       "version": "1.6.4"
     },
     "@uniweb/build": {
-      "version": "1.10.5"
+      "version": "1.10.6"
     },
     "@uniweb/content-reader": {
       "version": "1.5.7"
@@ -15,7 +15,7 @@
       "version": "1.3.1"
     },
     "@uniweb/core": {
-      "version": "1.4.7"
+      "version": "1.4.9"
     },
     "@uniweb/frame-bridge": {
       "version": "1.0.2"
@@ -33,10 +33,10 @@
       "version": "1.1.4"
     },
     "@uniweb/projections": {
-      "version": "1.2.1"
+      "version": "1.2.3"
     },
     "@uniweb/runtime": {
-      "version": "1.2.3"
+      "version": "1.2.5"
     },
     "@uniweb/scene": {
       "version": "1.0.1"

package/src/index.js

@@ -1789,8 +1789,9 @@ where, live where, deployed where — and checks:
   app      the session, what changed on the backend since this copy last synced —
            the files a pull would change — what is not pushed, who has the site
            open in the app, the foundation
-  hosting  where the site is live, the other hosts deploy.yml lists (by CI or by
-           hand, and how far behind), and the services the live site has
+  hosting  where the site is live, the other hosts deploy.yml lists (by CI, by hand
+           and how far behind, or never from this copy), workflows GitHub never runs
+           (a project's own .github/), and the services the live site has
   uniweb   whether a newer release is out
   health   doctor's findings
   dev      the dev server

package/src/utils/sync-point.js

@@ -759,6 +759,15 @@ export function uncommittedPaths(repo, roots) {
   return [...new Set(out.map((p) => siteRelative(repo, p)))]
 }
 
+/** A site file's bytes as `rev` holds it — `path` relative to the site — or null when it holds none. */
+export function fileAt(repo, rev, path) {
+  try {
+    return git(repo.top, ['cat-file', 'blob', `${rev}:${repo.prefix}${path}`])
+  } catch {
+    return null
+  }
+}
+
 /**
  * The files under the roots that differ from what `rev` holds there — changed, deleted, or
  * new and not ignored — relative to the site.