kbagent sync: config `isDisabled` (enabled/disabled) state is not pulled or tracked — disabled flows/configs are invisible in the working tree and to `sync diff`

[DasaDama]

Summary

kbagent sync does not pull or track the configuration-level isDisabled (enabled/disabled) state. A config or flow that is disabled in production looks identical to an enabled one in the local working tree: sync diff / sync status report it as "in sync", and even a forced full re-pull produces byte-identical files. The disabled state is effectively invisible to the repo and to every sync/diff command — even though the Storage API exposes isDisabled.

Related to #466 (sync diff/status reliability), but this is a distinct root cause: the field is never pulled at all.

Environment

• kbagent v0.59.0
• Config-only sync trees (sync pull --no-jobs --no-storage), one .keboola/manifest.json per project.

Reproduction / evidence

1. In production, all legacy flows (component keboola.orchestrator) of a project are DISABLED (each flow shows a DISABLED badge in the Keboola UI).
2. The pulled config files contain no disabled flag, e.g. …/main/other/keboola.orchestrator/<flow>/_config.yml:

   version: 2
   name: Raw Data Processing
   description: ''
   _configuration_extra:
     phases: [ ... ]
     tasks:
       - id: 1
         name: ...
         enabled: true
         task: { mode: run, componentId: ..., configId: ... }
   _keboola:
     component_id: keboola.orchestrator

   There is no isDisabled at the config root (and a recursive search for disab* across the whole pulled project tree finds nothing in any config file).
3. kbagent sync diff --project <p> →

   No differences found. Local and remote are in sync.
   

4. Forcing a full fresh pull (back up .keboola/manifest.json, empty its configurations array, then sync pull) downloads the whole project again and produces byte-identical files — the disabled state is still not written.
5. The same isDisabled flag is returned by the Storage API / MCP for these configs, so the information exists upstream; kbagent simply doesn't include it when pulling.

Impact

• You cannot tell from the repo — or from sync diff / sync status — whether a flow/config is enabled or disabled in production. sync diff will report "in sync" while production flows are disabled and the repo implies they're enabled.
• The enabled/disabled state cannot be version-controlled or deployed: sync push carries no such flag.
• Auditing "which flows/configs are disabled in production" is impossible through kbagent; it requires querying the API directly.

Expected behavior

• sync pull should capture the config-level isDisabled state (e.g. an isDisabled: true field in _config.yml or in a meta/manifest entry).
• sync diff / sync status should report a difference when the disabled state differs between local and remote.
• sync push should be able to set/clear the disabled state on the remote config.

[padak]

Shipped in v0.72.0 (PR #506). Config-level isDisabled now round-trips through the whole sync engine:

• Pull writes a sparse is_disabled: true at the root of _config.yml for disabled configs (and rows). The key is emitted only when true and hashing treats "absent" == "false", so trees pulled before this release do not mass-diff after upgrading — only genuinely disabled configs surface.
• Diff surfaces the drift in both directions. Your exact scenario — flows disabled in production, local tree byte-identical — now reports the config as REMOTE MODIFIED with an is_disabled added detail instead of "No differences found". After a pull, the local file carries the flag and diff is clean.
• Push sends the state when the key is present: is_disabled: false re-enables a remote config, is_disabled: true disables it. An absent key leaves the remote state untouched, so pre-existing files cannot accidentally re-enable anything. config new --push and sync clone honor the flag on create as well.

Verified end-to-end against a live project (disable via push → config detail shows isDisabled: true → fresh pull writes the flag → removing it locally shows drift). Note this covers the modern isDisabled config/row field; your repro used legacy keboola.orchestrator flows whose per-task enabled: true flags were already serialized inside the config body — the invisible part was the config-level flag, which is what this fixes.

Upgrade note: if you are on v0.59.0 with the silent "Auto-update failed" (package rename #424), reinstall once manually — see the comment on #466 for the two commands — and auto-update will work again.