feat(forks): opt-in fork sync for new workflows

Workspace forks gain a lineage-wide policy for whether a NEWLY created
workflow joins fork sync. Today a workflow joins the moment it is
deployed, so deploying something experimental in a parent pushes it into
every fork on the next sync with no step where anyone chose that.

Opt-out remains the default, so no existing or new workspace changes
behaviour until someone flips the toggle.

The policy lives on workspace.fork_sync_new_workflows_excluded (default
false, the historical behaviour); workflow.fork_sync_excluded is
untouched including its default. It is uniform across a fork lineage:
settable from any member, fanning out to every ancestor and descendant
under an advisory lock keyed on the lineage root, which fork creation and
unlink also take. It is forward-only - flipping it never rewrites an
existing workflow's sync state - and each changed member records its own
audit entry naming where the change was issued from.

Genuinely new workflows (create, duplicate, admin/superuser import, a
fork's starter) take the workspace policy. A copy (fork creation,
promote-create) inherits the SOURCE workflow's flag, because it is the
same logical workflow in another workspace; without that an opted-in
workflow would copy into a fork already excluded and never sync again.

The fork modal gains "Copy unsynced workflows" (off by default, shown
only when the source has unsynced deployed workflows, disabled when the
combined set would exceed the fork ceiling) so forking an opt-in
workspace cannot silently produce an empty fork.

The settings section becomes "Synced workflows" with the polarity
flipped - checked means the workflow syncs - above a "Sync new workflows
by default" toggle row that states its lineage-wide reach. The wire field
stays forkSyncExcluded, so the tree owns the single inversion.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: mzxchandra

apps/docs/content/docs/platform/enterprise/forks.mdx

@@ -54,10 +54,12 @@ Everything under **Copy resources** starts **selected**. That is usually what yo
 
 <Image src="/static/enterprise/forks-create-warning.png" alt="Fork workspace modal showing a warning that deselected resources will clear references in the fork" width={900} height={953} className="mx-auto h-auto w-full max-w-md" />
 
+If the source has deployed workflows that are **not** in fork sync (see [Synced workflows](#synced-workflows)), a **Workflows** section appears with a **Copy unsynced workflows** toggle. It is **off**, so a fork carries exactly what the Forks page shows as synced. Turn it on to copy every deployed workflow instead — the unsynced ones arrive in the child still unsynced, so they never sync back. Either way the line under the toggle names the counts.
+
 Click **Fork**. The child workspace is created immediately. Deployed workflows land as **drafts** in the child. Large content (table rows, knowledge base files, file blobs) may finish copying in the background — watch **Activity** on the source workspace.
 
 <Callout type="info">
-  Only **deployed** workflows are forked. Drafts and undeployed work stay in the parent. If the parent has nothing deployed, the child starts with a blank starter workflow.
+  Only **deployed** workflows are forked, and by default only the ones that are [synced](#synced-workflows). Drafts and undeployed work stay in the parent. If there is nothing to copy, the child starts with a blank starter workflow.
 </Callout>
 
 ### 3. Open the parent edge (from the child)
@@ -117,16 +119,35 @@ On success you will see a toast such as **Pushed to "…"** or **Pulled from "
 
 ---
 
-## Excluded workflows
+## Synced workflows
+
+The **Synced workflows** section on the Forks page lists this workspace's deployed workflows in their sidebar folder structure, each with a checkbox. **Checked means the workflow syncs.** Uncheck one — or a whole folder at once — to keep it out of forking entirely. Think of an unchecked workflow as `.gitignore`d:
+
+- **Never sent** — pushes from this workspace do not carry it, the other side pulling from this workspace does not receive it, and creating a new fork does not copy it (unless you turn on **Copy unsynced workflows** in the fork modal)
+- **Never touched** — a sync into this workspace will not overwrite or archive it, even if its counterpart was deleted on the other side. It stays deployed and keeps serving, and a previously-synced counterpart on the other side keeps running on its last deployed version.
+
+The checkbox list belongs to **this workspace's copy** only. Unchecking a workflow here does not unsync its counterpart in the parent or a fork — each workspace manages its own list. If the pair has synced before, the link between them is kept, so re-checking later resumes updating the same counterpart instead of creating a duplicate.
+
+On the sync page, unsynced workflows still appear in the **Deployed workflows** list, greyed out, with a tooltip naming which workspace they are unsynced in. The sync will not touch them.
+
+**Example:** a staging fork leaves `Scratch experiment` unchecked so it can never reach production, and production leaves `Billing hotfix` unchecked so no push from staging can ever overwrite it.
+
+### Sync new workflows by default
+
+Above the list, **Sync new workflows by default** decides where a **newly created** workflow starts:
 
-The **Excluded workflows** section on the Forks page lists this workspace's deployed workflows in their sidebar folder structure. Check a workflow — or a whole folder at once — to keep it out of forking entirely. Think of it as a `.gitignore` for syncs:
+| Setting | A new workflow… |
+|---------|-----------------|
+| **On** (default) | joins fork sync — it arrives checked and syncs as soon as you deploy it |
+| **Off** | starts outside fork sync — it arrives unchecked and only syncs after you check it |
 
-- **Never sent** — pushes from this workspace do not carry it, the other side pulling from this workspace does not receive it, and creating a new fork does not copy it
-- **Never touched** — a sync into this workspace will not overwrite or archive it, even if its counterpart was deleted on the other side
+Three things to know:
 
-The setting belongs to **this workspace's copy** only. Excluding a workflow here does not exclude its counterpart in the parent or a fork — each workspace manages its own list. If the pair has synced before, the link between them is kept, so un-excluding later resumes updating the same counterpart instead of creating a duplicate.
+- **It applies to the whole fork lineage.** The toggle writes every workspace in the lineage — the root, every ancestor, every descendant — so a parent and its forks can never disagree about what "new" means. Any workspace admin in the lineage can change it, and each member gets its own audit entry naming the workspace the change came from. A new fork inherits the value at creation.
+- **It is forward-only.** Flipping it never moves an existing workflow in or out of sync. The checkbox list above stays the record of what syncs.
+- **"New" means genuinely new.** Creating, duplicating, or importing a workflow takes this setting, as does the blank starter workflow a fork gets when there is nothing to copy. A workflow that arrives as a **copy** — from a fork, or from a push or pull — inherits its source's own checkbox instead, so a workflow you deliberately synced never lands unsynced in the child.
 
-**Example:** a staging fork excludes `Scratch experiment` so it can never reach production, and production excludes `Billing hotfix` so no push from staging can ever overwrite it.
+**Example:** a template workspace turns this off so every scratch workflow the team creates stays local, then checks only the handful meant to reach the forks.
 
 ---
 
@@ -155,6 +176,8 @@ Expand a row for names of workflows and resources that were created, updated, or
 |--------|-----|
 | See Forks / create a fork | Admin on this workspace (+ feature available) |
 | Sync / edit mappings | Admin on **both** sides of the edge |
+| Check / uncheck **Synced workflows** | Admin on the workspace those workflows live in |
+| Change **Sync new workflows by default** | Admin on any one workspace in the lineage — the change applies to every member |
 | Rollback | Admin on the workspace the sync landed in |
 | Disconnect | Admin on **this** side only (you can disconnect even without access to the other workspace) |
 | Open the other workspace | You must be a member of that workspace |
@@ -169,9 +192,9 @@ How each resource behaves at **fork** time vs **sync** time. Use this when you a
 
 | Resource | Fork | Sync |
 |----------|------|------|
-| Deployed workflows | Copied as drafts (unless excluded) | Updated / created / archived (force overwrite) |
+| Deployed workflows | Copied as drafts when [synced](#synced-workflows) | Updated / created / archived (force overwrite) |
 | Undeployed workflows | Not copied | Not synced |
-| [Excluded workflows](#excluded-workflows) | Never | Never — not sent, not overwritten, not archived |
+| [Unsynced workflows](#synced-workflows) | Only via **Copy unsynced workflows**, and the copy lands unsynced | Never — not sent, not overwritten, not archived |
 | Files | Optional copy (default on) | Map or copy |
 | File folders referenced by workflows | Mirrored with their ancestor folders, even when empty | Map by canonical path |
 | Tables | Optional copy (default on) | Map or copy |
@@ -191,11 +214,11 @@ How each resource behaves at **fork** time vs **sync** time. Use this when you a
 
 ### Workflows
 
-Only **deployed** workflows move. Deploy is the commit; sync is the force push/pull of those commits. Workflows marked [excluded](#excluded-workflows) never move in either direction.
+Only **deployed** workflows move, and only the ones checked under [Synced workflows](#synced-workflows). An unsynced workflow never moves in either direction — the one exception is the fork modal's **Copy unsynced workflows** override, which copies it once and leaves it unsynced in the child.
 
 | Feature | Behavior |
 |---|----------|
-| **Fork** | Each deployed workflow becomes a **draft** in the child. Run history is not copied. Only folders that contain a copied workflow are kept. |
+| **Fork** | Each synced deployed workflow becomes a **draft** in the child. Run history is not copied. Only folders that contain a copied workflow are kept. |
 | **Sync** | The change list shows what will be updated, created, or archived. The target is overwritten for those workflows. |
 
 **Example:** Parent has `Support triage` deployed and `WIP experiment` as a draft. The fork gets only `Support triage` as a draft. A later push updates the child from the parent’s latest deploy of `Support triage`.
@@ -370,13 +393,16 @@ Schedules, webhooks, and triggers are not live in the child until you **deploy**
 - **Rollback ≠ undo copies** — Workflow versions roll back; copied resources can remain as orphans.
 - **Disconnect is permanent** — You cannot “reconnect” the same edge; you would fork again into a new workspace.
 - **No grandparent sync** — Only the direct parent↔child pair.
+- **The sync default is lineage-wide** — **Sync new workflows by default** is one shared setting for the whole lineage, so changing it from a fork also changes it in the parent and every sibling fork.
 
 ---
 
 <FAQ items={[
   { question: "Why is Sync greyed out?", answer: "Usually a blocking reference, an unmapped credential or secret, or a required dependent field (label, channel, document, …) still empty. Open Blocking sync and the mapping sections — each row explains what to fix. Sync also stays disabled while details are loading or if loading failed (reload the page)." },
   { question: "Is sync a merge?", answer: "No. Deploy is like a commit; sync is a force push or force pull of deployed workflows onto the target. Use Rollback only for the last sync into a workspace, and remember copied resources may remain." },
-  { question: "Who can disconnect a fork I cannot open?", answer: "Any admin on your side of the edge. Disconnect does not require access to the other workspace — so you are not stuck if the other side lost membership." }
+  { question: "Who can disconnect a fork I cannot open?", answer: "Any admin on your side of the edge. Disconnect does not require access to the other workspace — so you are not stuck if the other side lost membership." },
+  { question: "I deployed a new workflow and sync ignored it. Why?", answer: "Sync new workflows by default is off for this fork lineage, so the workflow was created outside fork sync. Open Settings → Organization → Workspace forks and check it under Synced workflows. Turning the toggle back on only affects workflows created after that — it never moves an existing one." },
+  { question: "Does turning Sync new workflows by default off stop my current syncs?", answer: "No. It is forward-only and never rewrites an existing workflow's checkbox, so everything already synced keeps syncing. It also applies to every workspace in the fork lineage, not just the one you changed it from." }
 ]} />
 
 ---

apps/sim/app/api/superuser/import-workflow/route.ts

@@ -18,6 +18,7 @@ import {
 } from '@/lib/workflows/persistence/utils'
 import { sanitizeForExport } from '@/lib/workflows/sanitization/json-sanitizer'
 import { deduplicateWorkflowName } from '@/lib/workflows/utils'
+import { resolveForkSyncExclusionForNewWorkflow } from '@/ee/workspace-forking/lib/sync-default'
 
 const logger = createLogger('SuperUserImportWorkflow')
 
@@ -149,6 +150,9 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
       isDeployed: false, // Never copy deployment status
       runCount: 0,
       variables: sourceWorkflow.variables || {},
+      // An imported workflow is a NEW workflow in the target workspace, so it takes that
+      // workspace's fork-sync policy rather than the column default.
+      forkSyncExcluded: await resolveForkSyncExclusionForNewWorkflow(db, targetWorkspaceId),
     })
 
     // Save using existing persistence logic

apps/sim/app/api/v1/admin/workflows/import/route.ts

@@ -41,6 +41,7 @@ import {
   notFoundResponse,
 } from '@/app/api/v1/admin/responses'
 import { extractWorkflowMetadata, type WorkflowImportRequest } from '@/app/api/v1/admin/types'
+import { resolveForkSyncExclusionForNewWorkflow } from '@/ee/workspace-forking/lib/sync-default'
 
 const logger = createLogger('AdminWorkflowImportAPI')
 
@@ -128,6 +129,10 @@ export const POST = withRouteHandler(
         isDeployed: false,
         runCount: 0,
         variables: {},
+        // An imported workflow is a NEW workflow in this workspace, so it takes the
+        // workspace's fork-sync policy. Without this it lands on the column default and
+        // silently joins fork sync in a workspace that opted out.
+        forkSyncExcluded: await resolveForkSyncExclusionForNewWorkflow(db, workspaceId),
       })
 
       /**

apps/sim/app/api/v1/admin/workspaces/[id]/import/route.ts

@@ -62,6 +62,7 @@ import type {
   WorkspaceImportRequest,
   WorkspaceImportResponse,
 } from '@/app/api/v1/admin/types'
+import { resolveForkSyncExclusionForNewWorkflow } from '@/ee/workspace-forking/lib/sync-default'
 
 const logger = createLogger('AdminWorkspaceImportAPI')
 
@@ -363,6 +364,10 @@ async function importSingleWorkflow(
       isDeployed: false,
       runCount: 0,
       variables: {},
+      // An imported workflow is a NEW workflow in this workspace, so it takes the
+      // workspace's fork-sync policy. Without this it lands on the column default and
+      // silently joins fork sync in a workspace that opted out.
+      forkSyncExcluded: await resolveForkSyncExclusionForNewWorkflow(db, workspaceId),
     })
 
     /**

apps/sim/app/api/workspaces/[id]/fork/sync-default/route.ts

@@ -0,0 +1,29 @@
+import { updateForkSyncDefaultContract } from '@/lib/api/contracts/workspace-fork'
+import {
+  defineInternalJsonRoute,
+  internalRateLimits,
+  internalSessionAuth,
+} from '@/lib/api/server/routes'
+import { internalForkErrorPolicy } from '@/ee/workspace-forking/api/route-policies'
+import { forkOperations } from '@/ee/workspace-forking/application/operations'
+import { setForkSyncDefault } from '@/ee/workspace-forking/application/sync-default'
+
+export const PUT = defineInternalJsonRoute({
+  contract: updateForkSyncDefaultContract,
+  auth: internalSessionAuth,
+  operation: forkOperations.syncDefault,
+  /**
+   * Rated, unlike its sibling fork routes. This is the one that writes workspaces the
+   * caller may not administer, under the feature's coarsest advisory lock, so an admin of
+   * any single lineage member could otherwise loop it and starve fork creation across the
+   * whole lineage.
+   */
+  rateLimit: internalRateLimits.user({ bucketName: 'workspace-fork-sync-default' }),
+  errorPolicy: internalForkErrorPolicy,
+  mapInput: ({ params, body }) => ({ workspaceId: params.id, ...body }),
+  present: ({ excludeNewWorkflows, workspacesUpdated }) => ({
+    excludeNewWorkflows,
+    workspacesUpdated,
+  }),
+  useCase: setForkSyncDefault,
+})

apps/sim/ee/workspace-forking/application/create-and-sync.ts

@@ -25,6 +25,8 @@ export interface ForkInput {
   workspaceId: string
   name?: string
   copy?: Partial<ForkResourceSelection>
+  /** Also copy deployed workflows the source has not opted into fork sync. */
+  copyUnsyncedWorkflows?: boolean
   requestId?: string
   previewFingerprint?: string
 }
@@ -60,6 +62,7 @@ function forkChoices(input: ForkInput) {
           workflowMcpServers: input.copy.workflowMcpServers ?? [],
         }
       : undefined,
+    copyUnsyncedWorkflows: input.copyUnsyncedWorkflows ?? false,
   }
 }
 
@@ -103,12 +106,15 @@ export const previewWorkspaceFork = defineForkUseCase({
   operation: forkOperations.preview,
   async execute({ input, context }: { input: ForkInput; context: ForkApplicationContext }) {
     await creationPolicy(context.workspace, context.userId)
+    const choices = forkChoices(input)
     const revision = await loadForkPreviewRevision(
       db,
       { sourceWorkspaceId: context.workspaceId },
-      forkChoices(input)
+      choices
     )
-    const { deployedWorkflows } = await loadSourceDeployedStates(context.workspaceId)
+    const { deployedWorkflows } = await loadSourceDeployedStates(context.workspaceId, {
+      includeSyncExcluded: choices.copyUnsyncedWorkflows,
+    })
     return {
       previewFingerprint: revision.fingerprint,
       sourceWorkspaceId: context.workspaceId,
@@ -159,6 +165,7 @@ export const forkWorkspace = defineForkUseCase<
         actorName: await loadActorName(context.userId),
         name: input.name,
         selection: choices.copy,
+        copyUnsyncedWorkflows: choices.copyUnsyncedWorkflows,
         requestId: input.requestId ?? request?.headers.get('x-request-id') ?? generateShortId(),
         admission,
       })

apps/sim/ee/workspace-forking/application/discovery.ts

@@ -155,7 +155,12 @@ export const listWorkspaceForkResources = defineForkUseCase({
   async execute({
     input,
   }: {
-    input: PageInput & { kind: keyof Omit<ForkCopyableResources, 'deployedWorkflowCount'> }
+    input: PageInput & {
+      kind: keyof Omit<
+        ForkCopyableResources,
+        'deployedWorkflowCount' | 'unsyncedDeployedWorkflowCount'
+      >
+    }
   }) {
     const cursor = readCursor(input, { collection: 'copyable_resources', kind: input.kind })
     const rows = await listForkCopyableResourcePage(db, input.workspaceId, input.kind, {

apps/sim/ee/workspace-forking/application/lineage-details.ts

@@ -4,6 +4,7 @@ import { eq } from 'drizzle-orm'
 import { getEffectiveWorkspacePermission } from '@/lib/workspaces/permissions/utils'
 import { getForkChildren, getForkParent } from '@/ee/workspace-forking/lib/lineage/lineage'
 import { getUndoableRunForTarget } from '@/ee/workspace-forking/lib/promote/promote-run-store'
+import { resolveForkSyncExclusionForNewWorkflow } from '@/ee/workspace-forking/lib/sync-default'
 
 /**
  * Annotates a lineage node with whether the viewer holds any access to it (explicit
@@ -34,10 +35,12 @@ export const getWorkspaceForkLineageDetails = defineForkUseCase({
     context: { userId: string }
   }) {
     const { workspaceId } = input
-    const [rawParent, rawChildren, run] = await Promise.all([
+    const [rawParent, rawChildren, run, forkSyncNewWorkflowsExcluded] = await Promise.all([
       getForkParent(workspaceId),
       getForkChildren(workspaceId),
       getUndoableRunForTarget(db, workspaceId),
+      // Lineage-uniform, so this workspace's own value is the lineage's value.
+      resolveForkSyncExclusionForNewWorkflow(db, workspaceId),
     ])
 
     const [parent, children] = await Promise.all([
@@ -71,6 +74,7 @@ export const getWorkspaceForkLineageDetails = defineForkUseCase({
         createdAt: child.createdAt.toISOString(),
       })),
       undoableRun,
+      forkSyncNewWorkflowsExcluded,
     }
   },
 })

apps/sim/ee/workspace-forking/application/operations.ts

@@ -98,4 +98,20 @@ export const forkOperations = {
     id: 'workspaces.fork.exclusions',
     oauthScope: 'api:write',
   }),
+  /**
+   * Admin on the CALLING workspace is sufficient, and the write then fans out to every
+   * ancestor and descendant, because the default is meaningless unless it is uniform
+   * across a lineage. Flipping it to "sync new workflows" restores the historical
+   * behaviour rather than granting anything new, and it never moves an existing workflow
+   * in or out of sync - so each member records its own audit entry rather than the write
+   * being restricted to one workspace.
+   *
+   * permission-group-exempt: the new-workflow fork-sync default is workspace configuration governed by the admin role.
+   */
+  syncDefault: defineWorkspaceOperation({
+    ...adminPolicy,
+    capability: 'none',
+    id: 'workspaces.fork.sync_default',
+    oauthScope: 'api:write',
+  }),
 } as const