fix: keep the perpetual-run opt-in across relocks and check the new version's tag

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

cli/src/commands/script/script.ts

@@ -706,6 +706,13 @@ export async function handleFile(
             deepEqual(modules ?? null, remote.modules ?? null))
         ) {
           log.info(colors.green(`Script ${remotePath} is up to date`));
+          if (opts?.applyToPerpetualRuns) {
+            log.warn(
+              colors.yellow(
+                `No new version of ${remotePath} was deployed, so --apply-to-perpetual-runs moves no runs`
+              )
+            );
+          }
           // Even when the body is unchanged, perms may still drift — sync them
           // independently before returning.
           await applyExtraPermsDiff(
@@ -2226,7 +2233,7 @@ const command = new Command()
   .option("--message <message:string>", "Deployment message")
   .option(
     "--apply-to-perpetual-runs",
-    "Move running perpetual runs of this script to the new version once their current run finishes",
+    "Move running perpetual runs of this script to the new version once their current run finishes, or stop them if the new version is not perpetual",
   )
   .action(push as any)
   .command("get", "get a script's details")

cli/src/commands/sync/sync.ts

@@ -6873,7 +6873,7 @@ const command = new Command()
   )
   .option(
     "--apply-to-perpetual-runs",
-    "Move running perpetual runs of the scripts this push deploys to their new version once their current run finishes",
+    "Move running perpetual runs of the scripts this push deploys to their new version once their current run finishes, or stop them if the new version is not perpetual",
   )
   .action(push as any)
   // Internal: invoked only by the git-sync hub script. Hidden from help and

cli/src/guidance/skills.gen.ts

@@ -7697,7 +7697,7 @@ script related commands
   - \`--json\` - Output as JSON (for piping to jq)
 - \`script push <path:file>\` - push a local script spec. This overrides any remote versions. Use the script file (.ts, .js, .py, .sh)
   - \`--message <message:string>\` - Deployment message
-  - \`--apply-to-perpetual-runs\` - Move running perpetual runs of this script to the new version once their current run finishes
+  - \`--apply-to-perpetual-runs\` - Move running perpetual runs of this script to the new version once their current run finishes, or stop them if the new version is not perpetual
 - \`script get <path:file>\` - get a script's details
   - \`--json\` - Output as JSON (for piping to jq)
 - \`script show <path:file>\` - show a script's content (alias for get)
@@ -7793,7 +7793,7 @@ sync local with a remote workspaces or the opposite (push or pull)
   - \`--locks-required\` - Fail if scripts or flow inline scripts that need locks have no locks
   - \`--auto-metadata\` - Automatically regenerate stale metadata (locks and schemas) before pushing
   - \`--accept-overriding-permissioned-as-with-self\` - Accept that items with a different permissioned_as will be updated with your own user
-  - \`--apply-to-perpetual-runs\` - Move running perpetual runs of the scripts this push deploys to their new version once their current run finishes
+  - \`--apply-to-perpetual-runs\` - Move running perpetual runs of the scripts this push deploys to their new version once their current run finishes, or stop them if the new version is not perpetual
 
 ### token