fix(workflows): scope the fork preview to one workflow and close review gaps

- Fork "View changes" now loads only the previewed workflow: its deployed
  state, its identity mapping, its target row and its block pairs, instead of
  every deployed state in the source workspace plus the full promote plan.
  The plan item comes from the same buildForkPromotePlanItems decision the
  promote uses. The route gets a per-user rate limit.
- Word marks give up past 64 edits per line pair, so many long rewritten
  lines cannot stall the tab.
- Agent tool params that their block marks as password fields are masked
  whatever their name.
- A list item whose label changed but whose body did not is no longer
  flagged as a masked value change.
- Hoist double casts under their annotations, make sourceWorkflowId
  optional on the wire for rollout, lazy-load both diff modals, and
  re-record the settings module baseline: the block registry the diff canvas
  needs is reached only through the lazy chunk opened on click.

Author: mzxchandra

apps/sim/app/api/workspaces/[id]/fork/workflow-diff/route.test.ts

@@ -17,25 +17,25 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 
 const mocks = vi.hoisted(() => ({
-  loadSourceDeployedStates: vi.fn(),
+  loadSourceDeployedWorkflow: vi.fn(),
   loadTargetDraftState: vi.fn(),
   loadForkBlockMap: vi.fn(),
-  computeForkPromotePlan: vi.fn(),
+  resolveForkPlanItem: vi.fn(),
 }))
 
 vi.mock('@/lib/core/application/workspace-authorization', () => workspaceAuthorizationMock)
 vi.mock('@/lib/workspaces/permissions/utils', () => permissionsMock)
 vi.mock('@/ee/workspace-forking/lib/lineage/authz', () => workspaceForkingAuthzMock)
 vi.mock('@/ee/workspace-forking/lib/lineage/lineage', () => workspaceForkingLineageMock)
 vi.mock('@/ee/workspace-forking/lib/copy/deploy-bridge', () => ({
-  loadSourceDeployedStates: mocks.loadSourceDeployedStates,
+  loadSourceDeployedWorkflow: mocks.loadSourceDeployedWorkflow,
   loadTargetDraftState: mocks.loadTargetDraftState,
 }))
 vi.mock('@/ee/workspace-forking/lib/mapping/block-map-store', () => ({
   loadForkBlockMap: mocks.loadForkBlockMap,
 }))
 vi.mock('@/ee/workspace-forking/lib/promote/promote-plan', () => ({
-  computeForkPromotePlan: mocks.computeForkPromotePlan,
+  resolveForkPlanItem: mocks.resolveForkPlanItem,
 }))
 
 import { GET } from '@/app/api/workspaces/[id]/fork/workflow-diff/route'
@@ -70,20 +70,15 @@ describe('fork workflow-diff route', () => {
       childWorkspaceId: 'child',
     })
     mocks.loadForkBlockMap.mockResolvedValue({ parentToChild: new Map(), childToParent: new Map() })
-    mocks.loadSourceDeployedStates.mockResolvedValue({
-      deployedWorkflows: [{ id: 'wf-src' }],
-      sourceStates: new Map([['wf-src', emptyState]]),
-    })
-    mocks.computeForkPromotePlan.mockResolvedValue({
-      items: [
-        {
-          sourceWorkflowId: 'wf-src',
-          targetWorkflowId: 'wf-tgt',
-          mode: 'create',
-          sourceMeta: { name: 'Ask Biz' },
-        },
-      ],
-      archivedTargets: [],
+    mocks.loadSourceDeployedWorkflow.mockImplementation(async (_ws: string, id: string) =>
+      id === 'wf-src' ? { summary: { id, name: 'Ask Biz' }, state: emptyState } : null
+    )
+    mocks.resolveForkPlanItem.mockResolvedValue({
+      sourceWorkflowId: 'wf-src',
+      targetWorkflowId: 'wf-tgt',
+      targetName: null,
+      mode: 'create',
+      sourceMeta: { name: 'Ask Biz' },
     })
   })
 
@@ -98,7 +93,7 @@ describe('fork workflow-diff route', () => {
     )
 
     expect(response.status).toBe(403)
-    expect(mocks.loadSourceDeployedStates).not.toHaveBeenCalled()
+    expect(mocks.loadSourceDeployedWorkflow).not.toHaveBeenCalled()
   })
 
   it('rejects a request without the source workflow id', async () => {
@@ -108,7 +103,7 @@ describe('fork workflow-diff route', () => {
     )
 
     expect(response.status).toBe(400)
-    expect(mocks.loadSourceDeployedStates).not.toHaveBeenCalled()
+    expect(mocks.loadSourceDeployedWorkflow).not.toHaveBeenCalled()
   })
 
   it('rejects workspaces that are not a direct fork edge without reading state', async () => {
@@ -120,7 +115,7 @@ describe('fork workflow-diff route', () => {
     )
 
     expect(response.status).toBe(400)
-    expect(mocks.loadSourceDeployedStates).not.toHaveBeenCalled()
+    expect(mocks.loadSourceDeployedWorkflow).not.toHaveBeenCalled()
   })
 
   it('maps a workflow outside the sync plan to 404', async () => {
@@ -147,4 +142,46 @@ describe('fork workflow-diff route', () => {
       afterLabel: 'Ask Biz (deployed)',
     })
   })
+  it('maps a workflow whose target is excluded from sync to 404', async () => {
+    mocks.resolveForkPlanItem.mockResolvedValue(null)
+
+    const response = await GET(
+      request({ otherWorkspaceId: 'parent', direction: 'push', sourceWorkflowId: 'wf-src' }),
+      routeContext
+    )
+
+    expect(response.status).toBe(404)
+  })
+
+  it('reads the target draft and only its block pairs when the sync replaces a workflow', async () => {
+    const targetState = {
+      ...emptyState,
+      blocks: {},
+    }
+    mocks.resolveForkPlanItem.mockResolvedValue({
+      sourceWorkflowId: 'wf-src',
+      targetWorkflowId: 'wf-tgt',
+      targetName: 'Ask Biz prod',
+      mode: 'replace',
+      sourceMeta: { name: 'Ask Biz' },
+    })
+    mocks.loadTargetDraftState.mockResolvedValue(targetState)
+
+    const response = await GET(
+      request({ otherWorkspaceId: 'parent', direction: 'push', sourceWorkflowId: 'wf-src' }),
+      routeContext
+    )
+
+    expect(response.status).toBe(200)
+    expect(mocks.loadTargetDraftState).toHaveBeenCalledWith('wf-tgt', 'parent')
+    expect(mocks.loadForkBlockMap).toHaveBeenCalledWith(expect.anything(), 'child', {
+      side: 'parent',
+      workflowId: 'wf-tgt',
+    })
+    await expect(response.json()).resolves.toMatchObject({
+      targetWorkflowId: 'wf-tgt',
+      before: targetState,
+      beforeLabel: 'Ask Biz prod (current)',
+    })
+  })
 })

apps/sim/app/api/workspaces/[id]/fork/workflow-diff/route.ts

@@ -12,7 +12,7 @@ export const GET = defineInternalJsonRoute({
   contract: getForkWorkflowDiffContract,
   auth: internalSessionAuth,
   operation: forkOperations.syncPreview,
-  rateLimit: internalRateLimits.none({ reason: 'Preserve existing internal fork request policy' }),
+  rateLimit: internalRateLimits.user({ bucketName: 'workspace-fork-workflow-diff' }),
   errorPolicy: internalForkErrorPolicy,
   mapInput: ({ params, query }) => ({ workspaceId: params.id, ...query }),
   useCase: getWorkspaceSyncWorkflowDiff,

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/deploy/components/deploy-modal/components/general/components/index.ts

@@ -1,2 +1,2 @@
-export { type CompareSide, CompareVersionsModal } from './compare-versions-modal'
+export type { CompareSide } from './compare-versions-modal'
 export { Versions } from './versions'

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/deploy/components/deploy-modal/components/general/general.tsx

@@ -1,6 +1,6 @@
 'use client'
 
-import { useId, useState } from 'react'
+import { lazy, Suspense, useId, useState } from 'react'
 import {
   Button,
   ChipButtonGroup,
@@ -17,17 +17,27 @@ import {
 } from '@sim/emcn'
 import { createLogger } from '@sim/logger'
 import type { WorkflowDeploymentVersionResponse } from '@/lib/workflows/persistence/utils'
+import {
+  type ComparePair,
+  resolveComparePair,
+} from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/deploy/components/deploy-modal/components/general/compare-pair'
 import type { DeployReadiness } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/deploy/hooks/use-deploy-readiness'
 import { Preview, PreviewWorkflow } from '@/app/workspace/[workspaceId]/w/components/preview'
 import { useDeploymentVersionState, useRevertToVersion } from '@/hooks/queries/workflows'
 import { useWorkflowRegistry } from '@/stores/workflows/registry/store'
 import type { WorkflowState } from '@/stores/workflows/workflow/types'
-import { type ComparePair, resolveComparePair } from './compare-pair'
-import { CompareVersionsModal, Versions } from './components'
+import { Versions } from './components'
 import { formatVersionLabel } from './format-version-label'
 
 const logger = createLogger('GeneralDeploy')
 
+/** The comparison canvas is heavy and rarely opened, so it stays out of the editor's initial bundle. */
+const CompareVersionsModal = lazy(() =>
+  import(
+    '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/deploy/components/deploy-modal/components/general/components/compare-versions-modal'
+  ).then((module) => ({ default: module.CompareVersionsModal }))
+)
+
 interface GeneralDeployProps {
   workflowId: string | null
   deployedState?: WorkflowState | null
@@ -350,17 +360,19 @@ export function GeneralDeploy({
       />
 
       {workflowId && comparePair && (
-        <CompareVersionsModal
-          key={JSON.stringify(comparePair)}
-          open
-          onOpenChange={(open) => {
-            if (!open) setComparePair(null)
-          }}
-          workflowId={workflowId}
-          versions={versions}
-          initialBase={comparePair.base}
-          initialTarget={comparePair.target}
-        />
+        <Suspense fallback={null}>
+          <CompareVersionsModal
+            key={JSON.stringify(comparePair)}
+            open
+            onOpenChange={(open) => {
+              if (!open) setComparePair(null)
+            }}
+            workflowId={workflowId}
+            versions={versions}
+            initialBase={comparePair.base}
+            initialTarget={comparePair.target}
+          />
+        </Suspense>
       )}
 
       {workflowToShow && (

apps/sim/app/workspace/[workspaceId]/w/components/preview/components/preview-workflow/components/diff-label/diff-label.tsx

@@ -3,7 +3,8 @@
 import { cn } from '@sim/emcn'
 import type { BlockDiffStatus } from '@/lib/workflows/comparison'
 
-const DIFF_LABEL: Record<BlockDiffStatus, string> = {
+/** The word for each comparison status, shared by the canvas label and the change list badge. */
+export const DIFF_LABEL: Record<BlockDiffStatus, string> = {
   added: 'Added',
   modified: 'Modified',
   removed: 'Removed',

apps/sim/app/workspace/[workspaceId]/w/components/workflow-diff/components/change-list/binding-change-row.tsx

@@ -34,13 +34,15 @@ export function BindingChangeRow({ blockType, field, oldValue, newValue }: Bindi
         <span className='text-[var(--text-muted)]'>Differs between workspaces</span>
       ) : (
         <>
-          <span className='min-w-0 truncate text-[var(--text-muted)]'>
-            {formatScalar(blockType, field, oldValue)}
-          </span>
+          <OverflowText
+            label={formatScalar(blockType, field, oldValue)}
+            className='min-w-0 flex-1 text-[var(--text-muted)]'
+          />
           <ArrowRight className='size-[12px] shrink-0 text-[var(--text-icon)]' />
-          <span className='min-w-0 truncate text-[var(--text-tertiary)]'>
-            {formatScalar(blockType, field, newValue)}
-          </span>
+          <OverflowText
+            label={formatScalar(blockType, field, newValue)}
+            className='min-w-0 flex-1 text-[var(--text-tertiary)]'
+          />
         </>
       )}
     </div>

apps/sim/app/workspace/[workspaceId]/w/components/workflow-diff/components/change-list/change-list.tsx

@@ -14,6 +14,7 @@ import { Badge, cn, OverflowText } from '@sim/emcn'
 import { ChevronDown } from '@sim/emcn/icons'
 import { humanizeBlockName } from '@sim/workflow-renderer'
 import type { BlockDiffStatus, WorkflowDiffSummary } from '@/lib/workflows/comparison'
+import { DIFF_LABEL } from '@/app/workspace/[workspaceId]/w/components/preview/components/preview-workflow/components/diff-label/diff-label'
 import { BindingChangeRow } from '@/app/workspace/[workspaceId]/w/components/workflow-diff/components/change-list/binding-change-row'
 import {
   DIFF_SIGN,
@@ -36,12 +37,6 @@ const STATUS_BADGE_VARIANT: Record<BlockDiffStatus, 'green' | 'amber' | 'red'> =
   removed: 'red',
 }
 
-const STATUS_LABEL: Record<BlockDiffStatus, string> = {
-  added: 'Added',
-  modified: 'Modified',
-  removed: 'Removed',
-}
-
 interface ChangeListProps {
   summary: WorkflowDiffSummary
   /** The two sides, so cards can show an added or removed block's fields and detect moves */
@@ -166,14 +161,14 @@ export function ChangeList({
           }
         >
           <div className='flex flex-col gap-1.5 rounded-md border border-[var(--border)] bg-[var(--surface-2)] p-3 text-small'>
-            {summary.variableChanges.addedNames.map((name) => (
-              <NamedRow key={`a-${name}`} kind='added' name={name} />
+            {summary.variableChanges.addedNames.map((name, index) => (
+              <NamedRow key={`a-${index}-${name}`} kind='added' name={name} />
             ))}
-            {summary.variableChanges.modifiedNames.map((name) => (
-              <NamedRow key={`m-${name}`} kind='changed' name={name} />
+            {summary.variableChanges.modifiedNames.map((name, index) => (
+              <NamedRow key={`m-${index}-${name}`} kind='changed' name={name} />
             ))}
-            {summary.variableChanges.removedNames.map((name) => (
-              <NamedRow key={`r-${name}`} kind='removed' name={name} />
+            {summary.variableChanges.removedNames.map((name, index) => (
+              <NamedRow key={`r-${index}-${name}`} kind='removed' name={name} />
             ))}
           </div>
         </Section>
@@ -293,7 +288,7 @@ const BlockCard = memo(function BlockCard({
           className='flex-1 font-medium text-[var(--text-primary)] text-small'
         />
         <Badge variant={bindingsOnly ? 'gray' : STATUS_BADGE_VARIANT[entry.status]} size='sm'>
-          {bindingsOnly ? 'Bindings only' : STATUS_LABEL[entry.status]}
+          {bindingsOnly ? 'Bindings only' : DIFF_LABEL[entry.status]}
         </Badge>
         {hasBody && (
           <ChevronDown
@@ -371,16 +366,16 @@ const BlockCard = memo(function BlockCard({
                   nested
                 />
               ))}
-              {entry.membership?.added.map((row) => (
+              {entry.membership?.added.map((row, index) => (
                 <NamedRow
-                  key={`a-${row.name}`}
+                  key={`a-${index}-${row.name}`}
                   kind='added'
                   name={`${humanizeBlockName(row.name)}${row.moved ? ' (moved in)' : ''}`}
                 />
               ))}
-              {entry.membership?.removed.map((row) => (
+              {entry.membership?.removed.map((row, index) => (
                 <NamedRow
-                  key={`r-${row.name}`}
+                  key={`r-${index}-${row.name}`}
                   kind='removed'
                   name={`${humanizeBlockName(row.name)}${row.moved ? ' (moved out)' : ''}`}
                 />

apps/sim/app/workspace/[workspaceId]/w/components/workflow-diff/components/change-list/index.ts

@@ -1,5 +1 @@
-export { BindingChangeRow } from './binding-change-row'
 export { ChangeList } from './change-list'
-export { FieldChangeRow } from './field-change-row'
-export { KeyedListDiff } from './keyed-list-diff'
-export { InlineDiff, TextDiff } from './text-diff'

apps/sim/app/workspace/[workspaceId]/w/components/workflow-diff/components/change-list/keyed-list-diff.tsx

@@ -58,6 +58,9 @@ export function KeyedListDiff({ blockType, field, oldValue, newValue }: KeyedLis
               {row.oldLabel && (
                 <span className='text-[var(--text-muted)]'> (was {row.oldLabel})</span>
               )}
+              {row.secretChanged && (
+                <span className='text-[var(--text-muted)]'> (a masked value changed)</span>
+              )}
             </span>
             {row.kind === 'changed' && row.oldText !== row.newText ? (
               <TextDiff oldText={row.oldText} newText={row.newText} />

apps/sim/app/workspace/[workspaceId]/w/components/workflow-diff/components/change-list/text-diff-lines.test.ts

@@ -152,4 +152,12 @@ describe('buildDiffRows', () => {
       { type: 'oversized', oldLines: MAX_DIFF_LINES, newLines: MAX_DIFF_LINES + 1 },
     ])
   })
+  it('gives up on word marks for a heavily rewritten pair instead of diffing it word by word', () => {
+    const before = Array.from({ length: 150 }, (_, i) => `alpha${i}`).join(' ')
+    const after = Array.from({ length: 150 }, (_, i) => `beta${i}`).join(' ')
+    const lines = markWordChanges(toLines(before, after))
+
+    expect(lines.map((line) => line.kind)).toEqual(['removed', 'added'])
+    expect(lines.every((line) => line.parts === undefined)).toBe(true)
+  })
 })