windmill-cli 1.508.0 → 1.509.0

package/esm/apps.js

@@ -1,5 +1,6 @@
 // deno-lint-ignore-file no-explicit-any
-import { requireLogin, resolveWorkspace, validatePath } from "./context.js";
+import { requireLogin } from "./auth.js";
+import { resolveWorkspace, validatePath } from "./context.js";
 import { colors, Command, log, SEP, Table, yamlParseFile } from "./deps.js";
 import * as wmill from "./gen/services.gen.js";
 import { isSuperset } from "./types.js";

package/esm/auth.js

@@ -0,0 +1,40 @@
+// deno-lint-ignore-file no-explicit-any
+import { log, setClient } from "./deps.js";
+import * as wmill from "./gen/services.gen.js";
+import { loginInteractive, tryGetLoginInfo } from "./login.js";
+import { addWorkspace, removeWorkspace } from "./workspace.js";
+/**
+ * Main authentication function - moved from context.ts to break circular dependencies
+ * This function maintains the original API signature from context.ts
+ */
+export async function requireLogin(opts) {
+    // Import resolveWorkspace to avoid circular dependency at module level
+    const { resolveWorkspace } = await import("./context.js");
+    const workspace = await resolveWorkspace(opts);
+    let token = await tryGetLoginInfo(opts);
+    if (!token) {
+        token = workspace.token;
+    }
+    setClient(token, workspace.remote.substring(0, workspace.remote.length - 1));
+    try {
+        return await wmill.globalWhoami();
+    }
+    catch (error) {
+        // Check for network errors and provide clearer messages
+        const errorMsg = error instanceof Error ? error.message : String(error);
+        if (errorMsg.includes('fetch') || errorMsg.includes('connection') || errorMsg.includes('ECONNREFUSED') || errorMsg.includes('refused')) {
+            throw new Error(`Network error: Could not connect to Windmill server at ${workspace.remote}`);
+        }
+        log.info("! Could not reach API given existing credentials. Attempting to reauth...");
+        const newToken = await loginInteractive(workspace.remote);
+        if (!newToken) {
+            throw new Error("Unauthorized: Could not authenticate with the provided credentials");
+        }
+        // Update workspace token
+        removeWorkspace(workspace.name, false, opts);
+        workspace.token = newToken;
+        addWorkspace(workspace, opts);
+        setClient(newToken, workspace.remote.substring(0, workspace.remote.length - 1));
+        return await wmill.globalWhoami();
+    }
+}

package/esm/conf.js

@@ -48,18 +48,31 @@ export function getEffectiveSettings(config, baseUrl, workspaceId, repo) {
         }
     });
     if (!config.overrides) {
+        if (repo) {
+            log.info(`No overrides found in wmill.yaml, using top-level settings (repository flag ignored)`);
+        }
         return effective;
     }
     // Construct override keys using the single format
     const workspaceKey = `${baseUrl}:${workspaceId}:*`;
     const repoKey = `${baseUrl}:${workspaceId}:${repo}`;
+    let appliedOverrides = [];
     // Apply workspace-level overrides
     if (config.overrides[workspaceKey]) {
         Object.assign(effective, config.overrides[workspaceKey]);
+        appliedOverrides.push("workspace-level");
     }
     // Apply repository-specific overrides (overrides workspace-level)
     if (config.overrides[repoKey]) {
         Object.assign(effective, config.overrides[repoKey]);
+        appliedOverrides.push("repository-specific");
+    }
+    else if (repo) {
+        // Repository was specified but no override found
+        log.info(`Repository override not found for "${repo}", using ${appliedOverrides.length > 0 ? appliedOverrides.join(" + ") : "top-level"} settings`);
+    }
+    if (appliedOverrides.length > 0) {
+        log.info(`Applied ${appliedOverrides.join(" + ")} overrides${repo ? ` for repository "${repo}"` : ""}`);
     }
     return effective;
 }

package/esm/context.js

@@ -1,10 +1,8 @@
 // deno-lint-ignore-file no-explicit-any
 import * as dntShim from "./_dnt.shims.js";
-import { colors, log, setClient } from "./deps.js";
-import * as wmill from "./gen/services.gen.js";
-import { loginInteractive, tryGetLoginInfo } from "./login.js";
+import { colors, log } from "./deps.js";
 import { getHeaders } from "./utils.js";
-import { addWorkspace, getActiveWorkspace, getWorkspaceByName, removeWorkspace, } from "./workspace.js";
+import { getActiveWorkspace, getWorkspaceByName, } from "./workspace.js";
 async function tryResolveWorkspace(opts) {
     const cache = opts.__secret_workspace;
     if (cache)
@@ -82,34 +80,6 @@ export async function resolveWorkspace(opts) {
         return res.value;
     }
 }
-export async function requireLogin(opts) {
-    const workspace = await resolveWorkspace(opts);
-    let token = await tryGetLoginInfo(opts);
-    if (!token) {
-        token = workspace.token;
-    }
-    setClient(token, workspace.remote.substring(0, workspace.remote.length - 1));
-    try {
-        return await wmill.globalWhoami();
-    }
-    catch (error) {
-        // Check for network errors and provide clearer messages
-        const errorMsg = error instanceof Error ? error.message : String(error);
-        if (errorMsg.includes('fetch') || errorMsg.includes('connection') || errorMsg.includes('ECONNREFUSED') || errorMsg.includes('refused')) {
-            throw new Error(`Network error: Could not connect to Windmill server at ${workspace.remote}`);
-        }
-        log.info("! Could not reach API given existing credentials. Attempting to reauth...");
-        const newToken = await loginInteractive(workspace.remote);
-        if (!newToken) {
-            throw new Error("Unauthorized: Could not authenticate with the provided credentials");
-        }
-        removeWorkspace(workspace.name, false, opts);
-        workspace.token = newToken;
-        addWorkspace(workspace, opts);
-        setClient(newToken, workspace.remote.substring(0, workspace.remote.length - 1));
-        return await wmill.globalWhoami();
-    }
-}
 export async function fetchVersion(baseUrl) {
     const requestHeaders = new Headers();
     const extraHeaders = getHeaders();

package/esm/dev.js

@@ -2,7 +2,8 @@ import * as dntShim from "./_dnt.shims.js";
 import { Command, SEP, WebSocketServer, express, getPort, http, log, open, yamlParseFile, } from "./deps.js";
 import { getTypeStrFromPath } from "./types.js";
 import { ignoreF } from "./sync.js";
-import { requireLogin, resolveWorkspace } from "./context.js";
+import { requireLogin } from "./auth.js";
+import { resolveWorkspace } from "./context.js";
 import { mergeConfigWithConfigFile, readConfigFile, } from "./conf.js";
 import { exts, findGlobalDeps, removeExtensionToPath } from "./script.js";
 import { inferContentTypeFromFilePath } from "./script_common.js";

package/esm/flow.js

@@ -4,7 +4,8 @@ import { isSuperset } from "./types.js";
 import { Confirm, SEP, log, yamlStringify } from "./deps.js";
 import { colors, Command, Table, yamlParseFile } from "./deps.js";
 import * as wmill from "./gen/services.gen.js";
-import { requireLogin, resolveWorkspace, validatePath } from "./context.js";
+import { requireLogin } from "./auth.js";
+import { resolveWorkspace, validatePath } from "./context.js";
 import { resolve, track_job } from "./script.js";
 import { defaultFlowDefinition } from "./bootstrap/flow_bootstrap.js";
 import { generateFlowLockInternal } from "./metadata.js";
@@ -191,12 +192,13 @@ async function run(opts, path) {
     log.info(jobInfo.result ?? {});
 }
 async function generateLocks(opts, folder) {
+    const useRawReqs = opts.useRawRequirements || dntShim.Deno.env.get("USE_RAW_REQUIREMENTS") === "true";
     const workspace = await resolveWorkspace(opts);
     await requireLogin(opts);
     opts = await mergeConfigWithConfigFile(opts);
     if (folder) {
         // read script metadata file
-        await generateFlowLockInternal(folder, false, workspace);
+        await generateFlowLockInternal(folder, false, workspace, opts, undefined, undefined, useRawReqs);
     }
     else {
         const ignore = await ignoreF(opts);
@@ -208,7 +210,7 @@ async function generateLocks(opts, folder) {
         }, false, {})).map((x) => x.substring(0, x.lastIndexOf(SEP)));
         let hasAny = false;
         for (const folder of elems) {
-            const candidate = await generateFlowLockInternal(folder, true, workspace);
+            const candidate = await generateFlowLockInternal(folder, true, workspace, opts, undefined, undefined, useRawReqs);
             if (candidate) {
                 hasAny = true;
                 log.info(colors.green(`+ ${candidate}`));
@@ -228,7 +230,7 @@ async function generateLocks(opts, folder) {
             return;
         }
         for (const folder of elems) {
-            await generateFlowLockInternal(folder, false, workspace);
+            await generateFlowLockInternal(folder, false, workspace, opts, undefined, undefined, useRawReqs);
         }
     }
 }
@@ -264,6 +266,7 @@ const command = new Command()
     .command("generate-locks", "re-generate the lock files of all inline scripts of all updated flows")
     .arguments("[flow:file]")
     .option("--yes", "Skip confirmation prompt")
+    .option("-r --use-raw-requirements", "Use raw requirements (requirements.txt, go.mod, package.json, etc) instead of generating them on the server (can also be set with USE_RAW_REQUIREMENTS=true environment variable)")
     .option("-i --includes <patterns:file[]>", "Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string)")
     .option("-e --excludes <patterns:file[]>", "Comma separated patterns to specify which file to NOT take into account.")
     .action(generateLocks)

package/esm/folder.js

@@ -2,7 +2,8 @@
 import * as dntShim from "./_dnt.shims.js";
 import { colors, Command, log, SEP, Table } from "./deps.js";
 import * as wmill from "./gen/services.gen.js";
-import { requireLogin, resolveWorkspace, validatePath } from "./context.js";
+import { requireLogin } from "./auth.js";
+import { resolveWorkspace, validatePath } from "./context.js";
 import { isSuperset, parseFromFile } from "./types.js";
 async function list(opts) {
     const workspace = await resolveWorkspace(opts);

package/esm/gen/core/OpenAPI.js

@@ -32,7 +32,7 @@ export const OpenAPI = {
     PASSWORD: undefined,
     TOKEN: getEnv("WM_TOKEN"),
     USERNAME: undefined,
-    VERSION: '1.508.0',
+    VERSION: '1.509.0',
     WITH_CREDENTIALS: true,
     interceptors: {
         request: new Interceptors(),

package/esm/gen/services.gen.js

@@ -1875,6 +1875,17 @@ export const usernameToEmail = (data) => {
         }
     });
 };
+/**
+ * list of available scopes
+ * @returns ScopeDomain list of available scopes
+ * @throws ApiError
+ */
+export const listAvailableScopes = () => {
+    return __request(OpenAPI, {
+        method: 'GET',
+        url: '/tokens/list/scopes'
+    });
+};
 /**
  * create token
  * @param data The data for the request.
@@ -5595,6 +5606,7 @@ export const countJobsByTag = (data = {}) => {
  * @param data.workspace
  * @param data.id
  * @param data.noLogs
+ * @param data.noCode
  * @returns Job job details
  * @throws ApiError
  */
@@ -5607,7 +5619,8 @@ export const getJob = (data) => {
             id: data.id
         },
         query: {
-            no_logs: data.noLogs
+            no_logs: data.noLogs,
+            no_code: data.noCode
         }
     });
 };
@@ -5691,6 +5704,34 @@ export const getJobUpdates = (data) => {
         }
     });
 };
+/**
+ * get job updates via server-sent events
+ * @param data The data for the request.
+ * @param data.workspace
+ * @param data.id
+ * @param data.running
+ * @param data.logOffset
+ * @param data.getProgress
+ * @param data.onlyResult
+ * @returns string server-sent events stream of job updates
+ * @throws ApiError
+ */
+export const getJobUpdatesSse = (data) => {
+    return __request(OpenAPI, {
+        method: 'GET',
+        url: '/w/{workspace}/jobs_u/getupdate_sse/{id}',
+        path: {
+            workspace: data.workspace,
+            id: data.id
+        },
+        query: {
+            running: data.running,
+            log_offset: data.logOffset,
+            get_progress: data.getProgress,
+            only_result: data.onlyResult
+        }
+    });
+};
 /**
  * get log file from object store
  * @param data The data for the request.

package/esm/gitsync-settings.js

@@ -1,6 +1,7 @@
 import * as dntShim from "./_dnt.shims.js";
-import { colors, Command, log, yamlStringify } from "./deps.js";
-import { requireLogin, resolveWorkspace } from "./context.js";
+import { colors, Command, Confirm, log, yamlStringify } from "./deps.js";
+import { requireLogin } from "./auth.js";
+import { resolveWorkspace } from "./context.js";
 import * as wmill from "./gen/services.gen.js";
 import { DEFAULT_SYNC_OPTIONS, getEffectiveSettings, readConfigFile, } from "./conf.js";
 import { deepEqual, selectRepository } from "./utils.js";
@@ -125,6 +126,122 @@ function includeTypeToSyncOptions(includeTypes) {
         includeKey: includeTypes.includes("key"),
     };
 }
+// Shared migration function for legacy repositories
+async function handleLegacyRepositoryMigration(selectedRepo, gitSyncSettings, workspace, opts, operationName = "operation") {
+    if (selectedRepo.settings) {
+        return selectedRepo; // Already migrated
+    }
+    // This repository is in legacy format - handle migration
+    if (!gitSyncSettings.include_path || !gitSyncSettings.include_type) {
+        throw new Error(`Repository "${selectedRepo.git_repo_resource_path}" has legacy format but workspace-level include_path or include_type is missing. This indicates corrupted git-sync settings.`);
+    }
+    const workspaceIncludePath = gitSyncSettings.include_path;
+    const workspaceIncludeType = gitSyncSettings.include_type;
+    if (dntShim.Deno.stdout.isTerminal() && !opts.yes) {
+        // Interactive mode - show migration prompt
+        console.log(colors.yellow('\n⚠️  Legacy git-sync settings detected!'));
+        console.log(`\nRepository "${selectedRepo.git_repo_resource_path}" has legacy settings format.`);
+        console.log('The new format allows per-repository filter configuration.');
+        if (operationName === "push") {
+            console.log('This repository must be migrated before pushing settings.\n');
+        }
+        else {
+            console.log('\n');
+        }
+        console.log(colors.bold('Current workspace-level settings:'));
+        console.log(`  Include paths: ${workspaceIncludePath.join(', ')}`);
+        console.log(`  Include types: ${workspaceIncludeType.join(', ')}\n`);
+        // Show what the migration will do
+        let finalIncludeType = [...workspaceIncludeType];
+        if (selectedRepo.exclude_types_override && selectedRepo.exclude_types_override.length > 0) {
+            const originalCount = finalIncludeType.length;
+            finalIncludeType = finalIncludeType.filter(type => !selectedRepo.exclude_types_override.includes(type));
+            const excludedCount = originalCount - finalIncludeType.length;
+            console.log(colors.yellow(`Repository excludes ${excludedCount} types: ${selectedRepo.exclude_types_override.join(', ')}`));
+        }
+        console.log(colors.bold('\nAfter migration, repository will have:'));
+        console.log(`  Include paths: ${workspaceIncludePath.join(', ')}`);
+        console.log(`  Include types: ${finalIncludeType.join(', ')}\n`);
+        const confirm = await Confirm.prompt({
+            message: operationName === "push"
+                ? 'Do you want to migrate this repository before pushing?'
+                : 'Do you want to migrate this repository?',
+            default: true
+        });
+        if (!confirm) {
+            const message = operationName === "push"
+                ? '\n⚠️  Migration skipped. Cannot push to legacy repository.'
+                : '\n⚠️  Migration skipped. You can migrate later via the UI.';
+            console.log(colors.yellow(message));
+            if (operationName === "push") {
+                return null; // Signal to exit push operation
+            }
+            throw new Error('Migration cancelled by user');
+        }
+        // Perform the migration
+        let migratedIncludeType = [...workspaceIncludeType];
+        if (selectedRepo.exclude_types_override && selectedRepo.exclude_types_override.length > 0) {
+            migratedIncludeType = migratedIncludeType.filter(type => !selectedRepo.exclude_types_override.includes(type));
+        }
+        const migratedRepo = {
+            ...selectedRepo,
+            settings: {
+                include_path: [...workspaceIncludePath],
+                include_type: migratedIncludeType,
+                exclude_path: [],
+                extra_include_path: []
+            }
+        };
+        // Remove the old field
+        delete migratedRepo.exclude_types_override;
+        // Update the backend with migrated repository
+        const updatedRepositories = gitSyncSettings.repositories.map((repo) => {
+            if (repo.git_repo_resource_path === selectedRepo.git_repo_resource_path) {
+                return migratedRepo;
+            }
+            return repo;
+        });
+        await wmill.editWorkspaceGitSyncConfig({
+            workspace: workspace.workspaceId,
+            requestBody: {
+                git_sync_settings: {
+                    repositories: updatedRepositories,
+                    // Keep workspace-level settings if other repos are still legacy
+                    ...(gitSyncSettings.repositories.some((r) => r.git_repo_resource_path !== selectedRepo.git_repo_resource_path && !r.settings) && {
+                        include_path: workspaceIncludePath,
+                        include_type: workspaceIncludeType
+                    })
+                }
+            }
+        });
+        console.log(colors.green('\n✓ Repository migration completed successfully!'));
+        if (operationName === "push") {
+            console.log('Now proceeding with push operation...\n');
+        }
+        return migratedRepo;
+    }
+    else {
+        // Non-interactive mode - show error
+        console.error(colors.red('\n❌ Legacy git-sync settings detected!'));
+        console.error(`\nRepository "${selectedRepo.git_repo_resource_path}" has legacy settings format.`);
+        if (operationName === "push") {
+            console.error('This repository must be migrated before pushing settings.');
+        }
+        console.error('Please choose one of the following options:\n');
+        console.error('1. Go to the Windmill UI > Workspace Settings > Git Sync');
+        console.error('   Review and save this repository to migrate to the new format.\n');
+        console.error('2. Run this command in interactive mode (with TTY) to migrate.');
+        console.error(`   Example: wmill gitsync-settings ${operationName}\n`);
+        if (operationName === "push") {
+            console.error('3. Pull settings first to migrate: wmill gitsync-settings pull\n');
+        }
+        else {
+            console.error('3. Push local settings to override backend settings:');
+            console.error('   wmill gitsync-settings push\n');
+        }
+        dntShim.Deno.exit(1);
+    }
+}
 // Convert SyncOptions boolean flags to backend include_type array
 function syncOptionsToIncludeType(opts) {
     const includeTypes = [];
@@ -217,6 +334,23 @@ function displayChanges(changes) {
         }
     }
 }
+async function selectAndLogRepository(repositories, repository) {
+    let selectedRepo;
+    if (repository) {
+        const found = repositories.find((r) => r.git_repo_resource_path === repository ||
+            r.git_repo_resource_path === `$res:${repository}`);
+        if (!found) {
+            throw new Error(`Repository ${repository} not found`);
+        }
+        selectedRepo = found;
+        const repoPath = selectedRepo.git_repo_resource_path.replace(/^\$res:/, "");
+        log.info(colors.cyan(`Using repository: ${colors.bold(repoPath)}`));
+    }
+    else {
+        selectedRepo = await selectRepository(repositories);
+    }
+    return selectedRepo;
+}
 async function pullGitSyncSettings(opts) {
     const workspace = await resolveWorkspace(opts);
     await requireLogin(opts);
@@ -300,18 +434,9 @@ async function pullGitSyncSettings(opts) {
             return;
         }
         // Find the repository to work with
-        let selectedRepo;
-        if (opts.repository) {
-            const found = settings.git_sync.repositories.find((r) => r.git_repo_resource_path === opts.repository ||
-                r.git_repo_resource_path === `$res:${opts.repository}`);
-            if (!found) {
-                throw new Error(`Repository ${opts.repository} not found`);
-            }
-            selectedRepo = found;
-        }
-        else {
-            selectedRepo = await selectRepository(settings.git_sync.repositories);
-        }
+        let selectedRepo = await selectAndLogRepository(settings.git_sync.repositories, opts.repository);
+        // Check if the selected repository needs migration and handle it
+        selectedRepo = await handleLegacyRepositoryMigration(selectedRepo, settings.git_sync, workspace, opts, "pull");
         // Convert backend settings to SyncOptions format
         const backendSyncOptions = {
             includes: selectedRepo.settings.include_path || [],
@@ -392,7 +517,7 @@ async function pullGitSyncSettings(opts) {
             }
             else {
                 if (hasChanges) {
-                    log.info("Changes that would be made:");
+                    log.info("Changes that would be applied locally:");
                     const changes = generateChanges(normalizedCurrent, normalizedBackend);
                     if (Object.keys(changes).length === 0) {
                         log.info(colors.green("No differences found"));
@@ -419,7 +544,13 @@ async function pullGitSyncSettings(opts) {
             const gitSyncBackend = extractGitSyncFields(normalizeSyncOptions(backendSyncOptions));
             const gitSyncCurrent = extractGitSyncFields(normalizeSyncOptions(currentSettings));
             const hasConflict = !deepEqual(gitSyncBackend, gitSyncCurrent);
-            if (hasConflict && dntShim.Deno.stdin.isTerminal()) {
+            if (hasConflict && !opts.yes && dntShim.Deno.stdin.isTerminal()) {
+                // Show the diff first
+                log.info("Changes that would be applied locally:");
+                const changes = generateChanges(currentSettings, backendSyncOptions);
+                if (Object.keys(changes).length > 0) {
+                    displayChanges(changes);
+                }
                 // Interactive mode - ask user
                 const { Select } = await import("./deps.js");
                 const choice = await Select.prompt({
@@ -446,6 +577,13 @@ async function pullGitSyncSettings(opts) {
                     overrideKey = constructOverrideKey(workspace.remote, workspace.workspaceId, repoPath);
                 }
             }
+            else if (hasConflict && opts.yes) {
+                // --yes flag: default to override behavior for conflicts
+                writeMode = "override";
+                const repoPath = normalizeRepoPath(selectedRepo.git_repo_resource_path);
+                overrideKey = constructOverrideKey(workspace.remote, workspace.workspaceId, repoPath);
+                log.info(colors.yellow("Settings conflict detected. Using --override behavior (default for --yes)."));
+            }
             else if (hasConflict) {
                 // Non-interactive mode with conflicts - show message and exit
                 if (opts.jsonOutput) {
@@ -482,11 +620,19 @@ async function pullGitSyncSettings(opts) {
         }
         // Apply the settings based on write mode
         let updatedConfig;
+        // Log which settings mode is being used
+        const repoPath = selectedRepo.git_repo_resource_path.replace(/^\$res:/, "");
+        if (writeMode === "override") {
+            log.info(`Applied repository-specific overrides for repository "${repoPath}"`);
+        }
+        else {
+            log.info(`Applied settings for repository "${repoPath}"`);
+        }
         if (writeMode === "replace") {
             // Preserve existing local config and update only git-sync fields
             updatedConfig = { ...localConfig };
-            // Remove overrides since we're in replace mode
-            delete updatedConfig.overrides;
+            // Clear overrides since we're in replace mode, but keep empty object for consistency
+            updatedConfig.overrides = {};
             // Update with backend git-sync settings
             Object.assign(updatedConfig, backendSyncOptions);
         }
@@ -648,17 +794,12 @@ async function pushGitSyncSettings(opts) {
             return;
         }
         // Find the repository to work with
-        let selectedRepo;
-        if (opts.repository) {
-            const found = settings.git_sync.repositories.find((r) => r.git_repo_resource_path === opts.repository ||
-                r.git_repo_resource_path === `$res:${opts.repository}`);
-            if (!found) {
-                throw new Error(`Repository ${opts.repository} not found`);
-            }
-            selectedRepo = found;
-        }
-        else {
-            selectedRepo = await selectRepository(settings.git_sync.repositories);
+        let selectedRepo = await selectAndLogRepository(settings.git_sync.repositories, opts.repository);
+        // Check if the selected repository needs migration and handle it
+        selectedRepo = await handleLegacyRepositoryMigration(selectedRepo, settings.git_sync, workspace, opts, "push");
+        // If migration was cancelled, exit
+        if (selectedRepo === null) {
+            return;
         }
         // Get effective settings for this workspace/repo
         const repoPath = normalizeRepoPath(selectedRepo.git_repo_resource_path);
@@ -670,21 +811,22 @@ async function pushGitSyncSettings(opts) {
             exclude_path: effectiveSettings.excludes || [],
             extra_include_path: effectiveSettings.extraIncludes || [],
         };
+        // Calculate diff for all modes
+        const currentBackend = selectedRepo.settings;
+        // Convert current backend settings to SyncOptions for user-friendly display
+        const currentSyncOptions = {
+            includes: currentBackend.include_path || [],
+            excludes: currentBackend.exclude_path || [],
+            extraIncludes: currentBackend.extra_include_path || [],
+            ...includeTypeToSyncOptions(currentBackend.include_type || []),
+        };
+        const normalizedCurrent = normalizeSyncOptions(currentSyncOptions);
+        const normalizedEffective = normalizeSyncOptions(effectiveSettings);
+        const gitSyncCurrent = extractGitSyncFields(normalizedCurrent);
+        const gitSyncEffective = extractGitSyncFields(normalizedEffective);
+        const hasChanges = !deepEqual(gitSyncEffective, gitSyncCurrent);
         if (opts.diff) {
-            // Show what would be pushed
-            const currentBackend = selectedRepo.settings;
-            // Convert current backend settings to SyncOptions for user-friendly display
-            const currentSyncOptions = {
-                includes: currentBackend.include_path || [],
-                excludes: currentBackend.exclude_path || [],
-                extraIncludes: currentBackend.extra_include_path || [],
-                ...includeTypeToSyncOptions(currentBackend.include_type || []),
-            };
-            const normalizedCurrent = normalizeSyncOptions(currentSyncOptions);
-            const normalizedEffective = normalizeSyncOptions(effectiveSettings);
-            const gitSyncCurrent = extractGitSyncFields(normalizedCurrent);
-            const gitSyncEffective = extractGitSyncFields(normalizedEffective);
-            const hasChanges = !deepEqual(gitSyncEffective, gitSyncCurrent);
+            // --diff flag: show differences and exit
             if (opts.jsonOutput) {
                 // Generate structured diff using the same normalized objects
                 const structuredDiff = hasChanges
@@ -701,7 +843,7 @@ async function pushGitSyncSettings(opts) {
             }
             else {
                 if (hasChanges) {
-                    log.info("Changes that would be pushed:");
+                    log.info("Changes that would be pushed to Windmill:");
                     const changes = generateChanges(normalizedCurrent, normalizedEffective);
                     if (Object.keys(changes).length === 0) {
                         log.info(colors.green("No changes to push"));
@@ -716,6 +858,34 @@ async function pushGitSyncSettings(opts) {
             }
             return;
         }
+        // Default behavior: show changes and ask for confirmation (unless --yes is passed)
+        if (hasChanges) {
+            if (!opts.jsonOutput) {
+                const changes = generateChanges(normalizedCurrent, normalizedEffective);
+                if (Object.keys(changes).length === 0) {
+                    log.info(colors.green("No changes to push"));
+                    return;
+                }
+                else {
+                    log.info("Changes that would be pushed to Windmill:");
+                    displayChanges(changes);
+                }
+            }
+            // Ask for confirmation unless --yes is passed or not in TTY
+            if (!opts.yes && dntShim.Deno.stdin.isTerminal()) {
+                const confirmed = await Confirm.prompt({
+                    message: `Do you want to apply these changes to the remote?`,
+                    default: true,
+                });
+                if (!confirmed) {
+                    return;
+                }
+            }
+        }
+        else {
+            log.info(colors.green("No changes to push"));
+            return;
+        }
         if (opts.withBackendSettings) {
             // Skip backend update when using simulated settings
             if (opts.jsonOutput) {
@@ -800,6 +970,7 @@ const command = new Command()
     .option("--diff", "Show differences without applying changes")
     .option("--json-output", "Output in JSON format")
     .option("--with-backend-settings <json:string>", "Use provided JSON settings instead of querying backend (for testing)")
+    .option("--yes", "Skip interactive prompts and use default behavior")
     .action(pullGitSyncSettings)
     .command("push")
     .description("Push git-sync settings from local wmill.yaml to Windmill backend")
@@ -807,6 +978,7 @@ const command = new Command()
     .option("--diff", "Show what would be pushed without applying changes")
     .option("--json-output", "Output in JSON format")
     .option("--with-backend-settings <json:string>", "Use provided JSON settings instead of querying backend (for testing)")
+    .option("--yes", "Skip interactive prompts and use default behavior")
     .action(pushGitSyncSettings);
 export { pullGitSyncSettings, pushGitSyncSettings };
 export default command;

package/esm/hub.js

@@ -1,7 +1,8 @@
 // deno-lint-ignore-file no-explicit-any
 import { Command, log } from "./deps.js";
 import * as wmill from "./gen/services.gen.js";
-import { requireLogin, resolveWorkspace } from "./context.js";
+import { requireLogin } from "./auth.js";
+import { resolveWorkspace } from "./context.js";
 import { pushResourceType } from "./resource-type.js";
 import { deepEqual } from "./utils.js";
 const DEFAULT_HUB_BASE_URL = "https://hub.windmill.dev";