fix: make sync pull produce consistent wmill-lock.yaml hashes (#8854)

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

cli/src/commands/app/app_metadata.ts

@@ -92,7 +92,12 @@ async function generateAppHash(
     }
   }
 
-  return { ...hashes, [TOP_HASH]: await generateHash(JSON.stringify(hashes)) };
+  // Sort keys so the top hash is deterministic regardless of filesystem readdir order
+  const sortedHashes: Record<string, string> = {};
+  for (const k of Object.keys(hashes).sort()) {
+    sortedHashes[k] = hashes[k];
+  }
+  return { ...sortedHashes, [TOP_HASH]: await generateHash(JSON.stringify(sortedHashes)) };
 }
 
 /**

cli/src/commands/flow/flow_metadata.ts

@@ -51,7 +51,12 @@ async function generateFlowHash(
       );
     }
   }
-  return { ...hashes, [TOP_HASH]: await generateHash(JSON.stringify(hashes)) };
+  // Sort keys so the top hash is deterministic regardless of filesystem readdir order
+  const sortedHashes: Record<string, string> = {};
+  for (const k of Object.keys(hashes).sort()) {
+    sortedHashes[k] = hashes[k];
+  }
+  return { ...sortedHashes, [TOP_HASH]: await generateHash(JSON.stringify(sortedHashes)) };
 }
 /**
  * Result of generating flow locks, including which scripts were updated

cli/src/commands/sync/sync.ts

@@ -2553,6 +2553,7 @@ export async function pull(
       ),
     );
   }
+
 }
 
 function prettyChanges(

cli/src/utils/metadata.ts

@@ -380,7 +380,10 @@ export async function generateScriptMetadataInternal(
     }
   }
 
-  const metadataContentUsedForHash = newMetadataContent;
+  // When justUpdateMetadataLock (sync pull), the metadata file is NOT rewritten,
+  // so use the raw file content for hashing to avoid YAML round-trip differences
+  // (e.g. hand-edited YAML that serializes differently after parse + stringify).
+  const metadataContentUsedForHash = justUpdateMetadataLock ? metadataContent : newMetadataContent;
 
   hash = await generateScriptHash(
     depsForHash,