Merge remote-tracking branch 'origin/main' into glm/edit-view-ai-sessions

# Conflicts:
#	frontend/src/routes/(root)/(logged)/flows/get/[...path]/+page.svelte
#	frontend/src/routes/(root)/(logged)/scripts/get/[...hash]/+page.svelte

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "1.812.0"
+  ".": "1.814.0"
 }

AGENTS.md

@@ -31,8 +31,9 @@ Open-source platform for internal tools, workflows, API integrations, background
   `cargo run`; a normal build cannot start one at all.
 - **Enterprise**: `docs/enterprise.md` — EE file conventions and PR workflow
 - **Auth surface**: `docs/auth-surface.md` — credential precedence, session/cache invalidation
-  scope, how OAuth login matches `login_type`, and that every superadmin route refuses `$WM_TOKEN`.
-  Read before designing anything that creates users, tokens or sessions.
+  scope, which token labels email their owner at expiry, how OAuth login matches `login_type`, and
+  that every superadmin route refuses `$WM_TOKEN`. Read before designing anything that creates
+  users, tokens or sessions.
 - **Product telemetry**: `docs/feature-telemetry.md` — when to instrument a new feature with
   `feature_usage`, and the four-step recipe. An unregistered `(feature, kind)` pair is dropped
   silently, so frontend-only instrumentation records nothing.

CHANGELOG.md

@@ -1,5 +1,57 @@
 # Changelog
 
+## [1.814.0](https://github.com/windmill-labs/windmill/compare/v1.813.0...v1.814.0) (2026-09-17)
+
+
+### Features
+
+* **ai-chat:** add list_workers and list_data_metrics global tools ([#11143](https://github.com/windmill-labs/windmill/issues/11143)) ([e954d33](https://github.com/windmill-labs/windmill/commit/e954d33613e4ff5027667eb8f646615d9bbd499d))
+* **ai-chat:** merge get_job_logs and get_flow_run_details into get_run ([#11172](https://github.com/windmill-labs/windmill/issues/11172)) ([5bb37ca](https://github.com/windmill-labs/windmill/commit/5bb37ca3388666fba72c55534e37f37bb3e9299e))
+* allow git sync auto-pull, promotion and PRs on Pro licenses ([#11173](https://github.com/windmill-labs/windmill/issues/11173)) ([02e47de](https://github.com/windmill-labs/windmill/commit/02e47de8b4c4f3f54753aabf8c67bc8e71ffb957))
+* badge chat-input flows on the home list ([#11164](https://github.com/windmill-labs/windmill/issues/11164)) ([3d08197](https://github.com/windmill-labs/windmill/commit/3d0819718221f885b61e73d02b43dcc853c7d02a))
+* collect flow conversations and agent memory once their last message goes ([#11178](https://github.com/windmill-labs/windmill/issues/11178)) ([23c24a9](https://github.com/windmill-labs/windmill/commit/23c24a9688d4c8c462f53221334d538280f16bca))
+* flow chat model picker on a shared model-settings component ([#11187](https://github.com/windmill-labs/windmill/issues/11187)) ([189793c](https://github.com/windmill-labs/windmill/commit/189793c2e4db7f1c853695ebcc895c1ec82ed19f))
+* keep flow inputs and seed the agent when chat mode is enabled ([#11177](https://github.com/windmill-labs/windmill/issues/11177)) ([68f2248](https://github.com/windmill-labs/windmill/commit/68f2248018fc218a090bf939e1eb22ff97d5bc22))
+* let plan mode search and read connected mcp servers ([#11205](https://github.com/windmill-labs/windmill/issues/11205)) ([5371519](https://github.com/windmill-labs/windmill/commit/5371519f0f5ce7750982dcdb374dca72115902e7))
+* let test_run_flow name the conversation of a chat-mode test run ([#11198](https://github.com/windmill-labs/windmill/issues/11198)) ([6e1ef93](https://github.com/windmill-labs/windmill/commit/6e1ef93f329cb396ffc3df3304d592e8fa0e0e71))
+* managed memory with an inherited or custom memory id per step ([#11118](https://github.com/windmill-labs/windmill/issues/11118)) ([c297ed0](https://github.com/windmill-labs/windmill/commit/c297ed0052d998fb8f063faa2a36c6eb03e327be))
+* render the flow chat through the shared session chat components ([#11175](https://github.com/windmill-labs/windmill/issues/11175)) ([a9ec0ae](https://github.com/windmill-labs/windmill/commit/a9ec0aec3ac0c6b0f7919d0eb2168816923826d7))
+* show flow step detail inside the graph tab on narrow detail layouts ([#11168](https://github.com/windmill-labs/windmill/issues/11168)) ([64dffe6](https://github.com/windmill-labs/windmill/commit/64dffe6106ad6a55b61a423c855a4b5b0cef533e))
+* store mcp tool call, result and reasoning on flow conversation rows ([#11176](https://github.com/windmill-labs/windmill/issues/11176)) ([a571117](https://github.com/windmill-labs/windmill/commit/a571117f3fd2cef14c920770645c60ee358fdfdd))
+* tell test flow conversations from deployed ones and rename a chat ([#11179](https://github.com/windmill-labs/windmill/issues/11179)) ([4eab995](https://github.com/windmill-labs/windmill/commit/4eab995cf7cf091a5e4640da4cb77e0921bb7fdf))
+
+
+### Bug Fixes
+
+* disable a schedule whose cron has no run left instead of panicking ([#11195](https://github.com/windmill-labs/windmill/issues/11195)) ([381d447](https://github.com/windmill-labs/windmill/commit/381d4470ef699ea82283742132e56556b95d2bd2))
+* skip expiry notifications for app embed and SDK tokens ([#11169](https://github.com/windmill-labs/windmill/issues/11169)) ([9d348f8](https://github.com/windmill-labs/windmill/commit/9d348f84c7830f36b6153472556fd70e3d84cd24))
+
+## [1.813.0](https://github.com/windmill-labs/windmill/compare/v1.812.0...v1.813.0) (2026-09-16)
+
+
+### Features
+
+* back AI sessions up to the workspace object storage ([#11116](https://github.com/windmill-labs/windmill/issues/11116)) ([796b6e5](https://github.com/windmill-labs/windmill/commit/796b6e5297d8cceb842ec097f33ec1c3115058bd))
+* delete a browser's copy of an AI session past its workspace retention ([#11156](https://github.com/windmill-labs/windmill/issues/11156)) ([a48ae65](https://github.com/windmill-labs/windmill/commit/a48ae656ae59d600311f81ef357d08df5226515a))
+* rename saved agents from the agent editor and flag broken links ([#11147](https://github.com/windmill-labs/windmill/issues/11147)) ([57a99f6](https://github.com/windmill-labs/windmill/commit/57a99f66a88f195cac8f583b59d69d627cc1ec1d))
+* retention for AI sessions on the object store and in the browser ([#11152](https://github.com/windmill-labs/windmill/issues/11152)) ([ee6d317](https://github.com/windmill-labs/windmill/commit/ee6d317e318fa8a1506fb18d51c45b627070627a))
+* return an ai agent step's thinking in its job result ([#11140](https://github.com/windmill-labs/windmill/issues/11140)) ([c4e878e](https://github.com/windmill-labs/windmill/commit/c4e878e8313a72a16bfbe81fbb3935ee7728ec6f))
+* stream reasoning summaries in AI agent Responses API steps ([#11124](https://github.com/windmill-labs/windmill/issues/11124)) ([b51c0ea](https://github.com/windmill-labs/windmill/commit/b51c0eabbe774c78a9cbf824a3df6528d970b8f6))
+
+
+### Bug Fixes
+
+* **apps:** re-check access in place after a password sign-in ([#11166](https://github.com/windmill-labs/windmill/issues/11166)) ([49d0310](https://github.com/windmill-labs/windmill/commit/49d0310ecc08040b6c6fa4f402584543d679e2e8))
+* **apps:** run-mode inline app component uses only pinned content ([#11135](https://github.com/windmill-labs/windmill/issues/11135)) ([781b5a5](https://github.com/windmill-labs/windmill/commit/781b5a57e81eb721d97d7b87e23dd84f23895400))
+* **cli:** keep the workspace color when settings are synced from git ([#11144](https://github.com/windmill-labs/windmill/issues/11144)) ([129c045](https://github.com/windmill-labs/windmill/commit/129c04559548cd1bcf67758ec416fb2a48e7b928))
+* **cli:** resolve lockgen imports through modules a push leaves alone ([#11160](https://github.com/windmill-labs/windmill/issues/11160)) ([54553b2](https://github.com/windmill-labs/windmill/commit/54553b2add6941395f03ca34ee24cf335a3b23c2))
+* dispatch workflow-as-code tasks from a deployed flow's inline step ([#11146](https://github.com/windmill-labs/windmill/issues/11146)) ([e8078f2](https://github.com/windmill-labs/windmill/commit/e8078f2a963166b09849650424583f5dcfd28a84))
+* keep sidebar confirmation dialogs from being confined to the rail ([#11158](https://github.com/windmill-labs/windmill/issues/11158)) ([b9b5988](https://github.com/windmill-labs/windmill/commit/b9b5988ebdf3edd75add445282977c516ef5ed51))
+* keep the instance users table's actions and header in view ([#11145](https://github.com/windmill-labs/windmill/issues/11145)) ([a9a9335](https://github.com/windmill-labs/windmill/commit/a9a9335a34a13ffd8cd2699adc92087b679548ca))
+* stop reading an array job result as wm_failure or http response ([#11154](https://github.com/windmill-labs/windmill/issues/11154)) ([9a8a9c4](https://github.com/windmill-labs/windmill/commit/9a8a9c480cf008761ec6ceaff694085a252a32ae))
+* walk the whole fork ancestry for app installations and fork conflicts ([#11151](https://github.com/windmill-labs/windmill/issues/11151)) ([73dc892](https://github.com/windmill-labs/windmill/commit/73dc892f9c9c840a5f0fb12fcbb28bbe0f38795f))
+* **worker:** bound cache transfers and import fetches in bun jobs ([#11138](https://github.com/windmill-labs/windmill/issues/11138)) ([31c4325](https://github.com/windmill-labs/windmill/commit/31c43255fdcc827c3fdf65e40238f8f3a83201cd))
+
 ## [1.812.0](https://github.com/windmill-labs/windmill/compare/v1.811.1...v1.812.0) (2026-09-15)
 
 

CONTEXT.md

@@ -37,6 +37,25 @@ _Avoid_: argument field, param
 Any other place a property can be picked into: the loop iterator, skip and early-stop predicates, the retry condition, a branch predicate, timeout. Its prop picker opens in a popover from the connect button rather than taking a pane.
 _Avoid_: JS field, code input
 
+### Flow chat
+
+**Conversation**:
+One thread of messages against one chat-enabled flow, with its own agent memory. A flow has
+many; the chat shows one at a time.
+_Avoid_: thread, session (that names an AI session, a different thing), chat (that names the surface)
+
+**Turn**:
+One question and the answer to it: the run the question started, the handle that stops it,
+and the rows it is writing. At most one per conversation, and the chat is held for its whole
+length — from the moment the question takes the chat, before it has a job, until it is ended.
+_Avoid_: request, exchange, message round
+
+**Transcript**:
+The rows a conversation's chat holds. Not the conversation: it is the newest page plus
+whatever older pages the reader has scrolled back through, so a question it cannot answer
+from what it holds is one to ask the server rather than to guess at.
+_Avoid_: history, messages (too easily read as "all of them")
+
 ### Permissions
 
 **Member**:

ai_evals/README.md

@@ -175,6 +175,10 @@ the decrypted value, exactly as against a real backend. The chat's read path pas
 Seed a recognizable secret (the existing fixture uses `sk_live_do_not_leak_me`) and
 assert it via `valueExcludes` to catch a leak.
 
+`toolExpect.toolCallArgs` entries support `sharedByAtLeast: <n>`: at least `n` recorded
+calls to that tool must carry the same non-blank string in the field. Use it for calls that
+have to share an identifier, like two test runs of one chat conversation.
+
 `toolExpect.toolCallArgs` entries additionally support `fieldMustBeAbsent: true`: no
 recorded call to that tool may pass the field at all (an explicit `null` counts as
 passing it). Use it for partial-update tools, where supplying a field the model could

ai_evals/adapters/frontend/backendPreview.ts

@@ -1,5 +1,5 @@
-import { randomUUID } from 'node:crypto'
 import type { BackendValidationSettings } from '../../core/backendValidation'
+import { buildWorkspaceId } from './workspaceId'
 
 interface CompletedJobResultMaybe {
 	completed: boolean
@@ -24,7 +24,6 @@ export interface CompletedPreviewJob {
 const tokenCache = new Map<string, Promise<string>>()
 const sharedWorkspaceQueue = new Map<string, Promise<void>>()
 const managedSharedWorkspacePrefixes = ['f/evals/']
-const DEFAULT_WORKSPACE_PREFIX = 'ai-evals'
 
 export class BackendPreviewClient {
 	constructor(private readonly settings: BackendValidationSettings) {}
@@ -441,16 +440,6 @@ async function withSharedWorkspaceLock<T>(workspaceId: string, body: () => Promi
 	}
 }
 
-function buildWorkspaceId(caseId: string, attempt: number): string {
-	const caseSlug = caseId
-		.toLowerCase()
-		.replace(/[^a-z0-9-]+/g, '-')
-		.replace(/^-+|-+$/g, '')
-		.slice(0, 30)
-	const suffix = randomUUID().slice(0, 8)
-	return `${DEFAULT_WORKSPACE_PREFIX}-${caseSlug || 'case'}-a${attempt}-${suffix}`
-}
-
 function extractFolderName(path: string): string | null {
 	if (!path.startsWith('f/')) {
 		return null

ai_evals/adapters/frontend/mockBackend.ts

@@ -11,6 +11,7 @@ import type {
 	Script
 } from '../../../frontend/src/lib/gen'
 import type {
+	DataMetric,
 	DataTableTables,
 	DataTableTableSchema,
 	EndpointTool,
@@ -92,7 +93,7 @@ export interface BenchmarkWorkspaceResource {
 }
 
 export interface BenchmarkWorkspaceJob {
-	/** Stable id so a case prompt can reference a specific run (e.g. for get_job_logs). */
+	/** Stable id so a case prompt can reference a specific run (e.g. for get_run). */
 	id?: string
 	jobKind?: CompletedJob['job_kind']
 	scriptPath?: string
@@ -100,6 +101,8 @@ export interface BenchmarkWorkspaceJob {
 	label?: string
 	success?: boolean
 	logs?: string
+	args?: Record<string, unknown>
+	result?: unknown
 }
 
 export interface BenchmarkWorkspaceRunnables {
@@ -110,6 +113,9 @@ export interface BenchmarkWorkspaceRunnables {
 	aiProviders?: BenchmarkWorkspaceAiProvider[]
 	resources?: BenchmarkWorkspaceResource[]
 	datatables?: BenchmarkDatatableSeed[]
+	/** DuckLake catalog names, as `list_ducklakes` reports them. */
+	ducklakes?: string[]
+	dataMetrics?: DataMetric[]
 	jobs?: BenchmarkWorkspaceJob[]
 }
 
@@ -156,7 +162,7 @@ export function registerBenchmarkWorkspaceRunnables(
 		...runnables,
 		datatables: runnables.datatables ? structuredClone(runnables.datatables) : undefined
 	})
-	// Seed any fixture jobs so list_runs / get_job_logs have data to return.
+	// Seed any fixture jobs so list_runs / get_run have data to return.
 	for (const seed of runnables.jobs ?? []) {
 		createBenchmarkCompletedJob({
 			workspace,
@@ -166,7 +172,9 @@ export function registerBenchmarkWorkspaceRunnables(
 			scriptPath: seed.scriptPath,
 			createdBy: seed.createdBy,
 			label: seed.label,
-			logs: seed.logs
+			logs: seed.logs,
+			args: seed.args,
+			result: seed.result
 		})
 	}
 }
@@ -481,6 +489,33 @@ export function getBenchmarkJobLogs(workspace: string, jobId: string): string {
 	return job.logs ?? ''
 }
 
+/**
+ * Mirror `JobService.getFlowAllResults`, which get_run calls for the execution
+ * tree. Fixture jobs are single runs with no steps, so only the root entry.
+ */
+export function getBenchmarkFlowAllResults(workspace: string, jobId: string) {
+	const job = getBenchmarkCompletedJob(workspace, jobId)
+	if (!job) {
+		throw new Error(`Job "${jobId}" not found in benchmark workspace`)
+	}
+	return {
+		entries: [
+			{
+				job_id: jobId,
+				label: 'Flow',
+				kind: job.job_kind ?? 'script',
+				depth: 0,
+				sibling_index: 1,
+				sibling_count: 1,
+				status: job.success ? 'success' : 'failure',
+				success: job.success
+			}
+		],
+		truncated: false,
+		scope_filtered: false
+	}
+}
+
 // ============= Drafts (per-user, DB-backed in production) =============
 
 /**
@@ -642,6 +677,27 @@ export function listBenchmarkDatatables(workspace: string): DataTableTables[] |
 	}))
 }
 
+// ============= DuckLake catalogs and declared metrics =============
+
+/** Seeded DuckLake names, or `null` for a non-benchmark workspace. */
+export function listBenchmarkDucklakes(workspace: string): string[] | null {
+	const runnables = benchmarkWorkspaceRunnables.get(workspace)
+	return runnables ? (runnables.ducklakes ?? []) : null
+}
+
+/**
+ * Seeded metric declarations, or `null` for a non-benchmark workspace.
+ *
+ * The `table` / `path_prefix` filters are ignored: which rows a filter selects is
+ * `canonical_table_path`'s business and is pinned by `ducklakeTools.test.ts`.
+ * Re-deriving it here would give the eval its own copy of that spec to drift from,
+ * and the case this serves measures whether the model reaches for the tool at all.
+ */
+export function listBenchmarkDataMetrics(workspace: string): DataMetric[] | null {
+	const runnables = benchmarkWorkspaceRunnables.get(workspace)
+	return runnables ? (runnables.dataMetrics ?? []) : null
+}
+
 export function getBenchmarkDatatableSchema(input: {
 	workspace: string
 	datatableName: string
@@ -809,6 +865,29 @@ export function runBenchmarkFlowByPath(input: {
 	})
 }
 
+/**
+ * Mirror `JobService.runFlowPreview` for benchmark workspaces, including the server's
+ * refusal of a chat-enabled flow run that names no conversation (`memory_id`).
+ */
+export function runBenchmarkFlowPreview(input: {
+	workspace: string
+	memoryId?: string
+	requestBody?: { path?: string; value?: { chat_input_enabled?: boolean }; args?: unknown }
+}): string {
+	if (input.requestBody?.value?.chat_input_enabled && !input.memoryId) {
+		throw new Error('Bad request: memory_id is required for chat-enabled flows')
+	}
+	const args = (input.requestBody?.args ?? {}) as Record<string, unknown>
+	return createBenchmarkCompletedJob({
+		workspace: input.workspace,
+		jobKind: 'flowpreview',
+		success: true,
+		args,
+		result: { path: input.requestBody?.path, args, mocked: true },
+		logs: 'Mock benchmark flow preview completed successfully.'
+	})
+}
+
 export function previewBenchmarkSchedule(input: {
 	requestBody?: Record<string, unknown>
 }): Record<string, unknown> {

ai_evals/adapters/frontend/vitestAdapter.test.ts

@@ -62,6 +62,7 @@ vi.mock('$lib/gen', async () => {
 		getBenchmarkDatatableSchema,
 		getBenchmarkDraftForUser,
 		getBenchmarkFlowByPath,
+		getBenchmarkFlowAllResults,
 		getBenchmarkJobLogs,
 		getBenchmarkOwnDraft,
 		getBenchmarkScriptByHash,
@@ -75,7 +76,9 @@ vi.mock('$lib/gen', async () => {
 		listBenchmarkPlainResources,
 		listBenchmarkApps,
 		listBenchmarkDatatables,
+		listBenchmarkDataMetrics,
 		listBenchmarkDrafts,
+		listBenchmarkDucklakes,
 		listBenchmarkFlows,
 		listBenchmarkJobs,
 		listBenchmarkScripts,
@@ -86,6 +89,7 @@ vi.mock('$lib/gen', async () => {
 		previewBenchmarkSchedule,
 		runBenchmarkDatatableSql,
 		runBenchmarkFlowByPath,
+		runBenchmarkFlowPreview,
 		runBenchmarkScriptByPath,
 		runBenchmarkScriptPreview,
 		updateBenchmarkDraft,
@@ -292,6 +296,14 @@ vi.mock('$lib/gen', async () => {
 							args: data.requestBody
 						})
 					: actual.JobService.runScriptByPath(data),
+			runFlowPreview: async (data: {
+				workspace: string
+				memoryId?: string
+				requestBody?: { path?: string; value?: { chat_input_enabled?: boolean }; args?: unknown }
+			}) =>
+				hasBenchmarkWorkspace(data.workspace)
+					? runBenchmarkFlowPreview(data)
+					: actual.JobService.runFlowPreview(data as any),
 			runFlowByPath: async (data: {
 				workspace: string
 				path: string
@@ -325,7 +337,11 @@ vi.mock('$lib/gen', async () => {
 			getJobLogs: async (data: { workspace: string; id: string }) =>
 				hasBenchmarkWorkspace(data.workspace)
 					? getBenchmarkJobLogs(data.workspace, data.id)
-					: actual.JobService.getJobLogs(data)
+					: actual.JobService.getJobLogs(data),
+			getFlowAllResults: async (data: { workspace: string; id: string }) =>
+				hasBenchmarkWorkspace(data.workspace)
+					? getBenchmarkFlowAllResults(data.workspace, data.id)
+					: actual.JobService.getFlowAllResults(data)
 		}),
 		WorkspaceService: wrapService(actual.WorkspaceService, {
 			getCopilotInfo: async (data: { workspace: string }) =>
@@ -336,6 +352,10 @@ vi.mock('$lib/gen', async () => {
 				hasBenchmarkWorkspace(data.workspace)
 					? (listBenchmarkDatatables(data.workspace) ?? [])
 					: actual.WorkspaceService.listDataTableTables(data),
+			listDucklakes: async (data: { workspace: string }) =>
+				hasBenchmarkWorkspace(data.workspace)
+					? (listBenchmarkDucklakes(data.workspace) ?? [])
+					: actual.WorkspaceService.listDucklakes(data),
 			getDataTableTableSchema: async (data: {
 				workspace: string
 				datatableName: string
@@ -351,6 +371,12 @@ vi.mock('$lib/gen', async () => {
 						})
 					: actual.WorkspaceService.getDataTableTableSchema(data)
 		}),
+		DataMetricService: wrapService(actual.DataMetricService, {
+			listDataMetrics: async (data: { workspace: string }) =>
+				hasBenchmarkWorkspace(data.workspace)
+					? { metrics: listBenchmarkDataMetrics(data.workspace) ?? [] }
+					: actual.DataMetricService.listDataMetrics(data)
+		}),
 		ScheduleService: wrapService(actual.ScheduleService, {
 			existsSchedule: async (data: { workspace: string; path: string }) =>
 				hasBenchmarkWorkspace(data.workspace) ? false : actual.ScheduleService.existsSchedule(data),

ai_evals/adapters/frontend/windmillBackend.ts

@@ -1,9 +1,8 @@
-import { randomUUID } from "node:crypto";
 import type { WindmillBackendSettings } from "../../core/windmillBackendSettings";
+import { buildWorkspaceId } from "./workspaceId";
 
 const tokenCache = new Map<string, Promise<string>>();
 const sharedWorkspaceQueue = new Map<string, Promise<void>>();
-const DEFAULT_WORKSPACE_PREFIX = "ai-evals";
 
 export class WindmillBackendClient {
   constructor(private readonly settings: WindmillBackendSettings) {}
@@ -179,16 +178,6 @@ async function withSharedWorkspaceLock<T>(
   }
 }
 
-function buildWorkspaceId(caseId: string, attempt: number): string {
-  const caseSlug = caseId
-    .toLowerCase()
-    .replace(/[^a-z0-9-]+/g, "-")
-    .replace(/^-+|-+$/g, "")
-    .slice(0, 30);
-  const suffix = randomUUID().slice(0, 8);
-  return `${DEFAULT_WORKSPACE_PREFIX}-${caseSlug || "case"}-a${attempt}-${suffix}`;
-}
-
 async function expectOk(response: Response, context: string): Promise<void> {
   if (response.ok) {
     return;

ai_evals/adapters/frontend/workspaceId.test.ts

@@ -0,0 +1,21 @@
+import { describe, expect, it } from "bun:test";
+import { buildWorkspaceId } from "./workspaceId";
+
+describe("buildWorkspaceId", () => {
+  // `workspace.proper_id` rejects `--`, which a case id can carry itself and
+  // which truncating a slug on a hyphen produces once the suffix adds its own.
+  // One id per shape: cut landing on a hyphen, cut landing mid-word, no cut, and
+  // a doubled hyphen no cut ever reaches.
+  it("stays within the id length cap and the proper_id format", () => {
+    for (const caseId of [
+      "global-test6-secret-variable-draft",
+      "global-test23-datatable-query-select",
+      "short",
+      "global--test-foo",
+    ]) {
+      const id = buildWorkspaceId(caseId, 1);
+      expect(id.length).toBeLessThanOrEqual(50);
+      expect(id).toMatch(/^\w+(-\w+)*$/);
+    }
+  });
+});

ai_evals/adapters/frontend/workspaceId.ts

@@ -0,0 +1,22 @@
+import { randomUUID } from "node:crypto";
+
+const DEFAULT_WORKSPACE_PREFIX = "ai-evals";
+
+// A workspace id must be at most 50 characters AND match `^\w+(-\w+)*$`
+// (`workspace.proper_id`), so the case slug yields to the random suffix that
+// makes the id unique, and no hyphen may end up doubled — neither one already in
+// the case id nor one a truncation leaves for the suffix to follow.
+const MAX_WORKSPACE_ID_LENGTH = 50;
+
+export function buildWorkspaceId(caseId: string, attempt: number): string {
+  const caseSlug = caseId
+    .toLowerCase()
+    .replace(/[^a-z0-9-]+/g, "-")
+    .replace(/-{2,}/g, "-")
+    .replace(/^-+|-+$/g, "");
+  const suffix = `-a${attempt}-${randomUUID().slice(0, 8)}`;
+  const head = `${DEFAULT_WORKSPACE_PREFIX}-${caseSlug || "case"}`;
+  return `${head
+    .slice(0, MAX_WORKSPACE_ID_LENGTH - suffix.length)
+    .replace(/-+$/, "")}${suffix}`;
+}

ai_evals/cases/global.yaml

@@ -889,13 +889,13 @@
     draftCountExactly: 0
   toolExpect:
     requiredToolsUsed:
-      - get_job_logs
+      - get_run
     forbiddenToolsUsed:
       - deploy_workspace_item
       - delete_workspace_item
       - write_script
     toolCallArgs:
-      - tool: get_job_logs
+      - tool: get_run
         field: id
         stringIncludesAnyOf:
           - 01920000-0000-7000-8000-0000000000f1
@@ -906,6 +906,34 @@
     - fetches the logs for the requested job id
     - explains the failure from the returned logs (connection refused to the upstream API)
 
+- id: global-run-args-and-result
+  prompt: |-
+    What was the run 01920000-0000-7000-8000-0000000000f2 called with, and what did it return?
+  initial: ai_evals/fixtures/frontend/global/initial/jobs_seed.json
+  runtime:
+    maxTurns: 6
+  validate:
+    draftCountExactly: 0
+  toolExpect:
+    requiredToolsUsed:
+      - get_run
+    forbiddenToolsUsed:
+      - test_run_script
+      - run_script
+      - deploy_workspace_item
+    toolCallArgs:
+      - tool: get_run
+        field: id
+        stringIncludesAnyOf:
+          - 01920000-0000-7000-8000-0000000000f2
+  # Read-only, so no draft for the global judge to score — validated on tool use
+  # and the deterministic argument check, like the neighbouring run cases.
+  skipJudge: true
+  judgeChecklist:
+    - reports the arguments the run was called with (region emea, 12 recipients)
+    - reports what the run returned (12 sent, 3 skipped)
+    - does not start a new run to find out
+
 # --- Page navigation (open_page) ---
 # The assistant should take the user to a Windmill page (Runs/Schedules) with the
 # right filters via open_page, rather than describing where to click or dumping the
@@ -1891,10 +1919,11 @@
     - when the lookup fails, tells the user instead of inventing table names
     - does not write scripts or resources to answer a read-only question
 
-# --- API catalog (search_api_endpoints / call_api_get / call_api_endpoint) ---
-# The harness serves the catalog and the executed calls itself (mock
-# listMcpTools + benchmark fetch handlers in adapters/frontend), so these cases
-# do not require an mcp-enabled eval backend.
+# --- Dedicated tools preferred over the API catalog ---
+# The harness serves worker/queue reads itself (benchmark fetch handlers in
+# adapters/frontend), so these cases do not require an mcp-enabled eval backend.
+# The stale `api-catalog` in the id below is kept so results stay comparable
+# across benchmark runs.
 
 - id: global-test30-api-catalog-workers
   prompt: |-
@@ -1906,23 +1935,42 @@
     draftCountExactly: 0
   toolExpect:
     requiredToolsUsed:
-      - search_api_endpoints
-      - call_api_get
+      - list_workers
     forbiddenToolsUsed:
+      - call_api_get
       - call_api_endpoint
       - write_script
       - deploy_workspace_item
-    toolCallArgs:
-      - tool: call_api_get
-        field: name
-        stringIncludesAnyOf:
-          - listWorkers
   # Read-only workspace inspection produces no draft; validate via tool use.
   skipJudge: true
   judgeChecklist:
-    - discovers the workers endpoint through the API catalog instead of guessing or fabricating
+    - reads worker state through list_workers instead of guessing or fabricating
     - reports worker status from the returned data
 
+- id: global-test37-ducklake-declared-measure
+  prompt: |-
+    We track orders in the main ducklake. Write me a duckdb script that reports total
+    revenue by month. Keep it as a draft, don't deploy it.
+  initial: ai_evals/fixtures/frontend/global/initial/ducklake_orders_metrics.json
+  runtime:
+    maxTurns: 8
+  validate:
+    draftCountExactly: 1
+  toolExpect:
+    requiredToolsUsed:
+      - list_data_metrics
+    forbiddenToolsUsed:
+      - deploy_workspace_item
+      - delete_workspace_item
+  # The judge runs: the point is not that the tool was called but that the number it
+  # describes is the declared one. `revenue` excludes test rows, so an aggregate that
+  # reproduces it without the filter is plausible, runnable and wrong.
+  judgeChecklist:
+    - totals revenue with the declared sum over the amount column rather than an invented aggregate over a guessed column
+    - excludes test orders from the total, as the declared revenue measure does
+    - groups by month using the declared order_month expression over order_date
+    - does not introduce column names absent from the declarations
+
 - id: global-test31-draft-test-run-not-deployed
   prompt: |-
     Update `f/evals/global/format_greeting` so the provided name is uppercased in the greeting, then run it with name "ada" to check it works.
@@ -2112,6 +2160,32 @@
     - creates an AI draft of f/evals/global/process_invoice applying 8% tax
     - does not deploy or save the draft
 
+- id: global-test38-chat-flow-follow-up-same-conversation
+  prompt: |-
+    I want to check that my support chat flow `f/evals/global/support_chat` remembers what was said.
+    Test it: first send "My name is Ada", then send "What is my name?" as a follow-up in the same chat.
+  initial: ai_evals/fixtures/frontend/global/initial/support_chat_flow.json
+  runtime:
+    maxTurns: 8
+  validate:
+    draftCountExactly: 0
+  toolExpect:
+    requiredToolsUsed:
+      - test_run_flow
+    # A chat flow's memory lives in its conversation, so a follow-up only reaches the first
+    # turn's history when both test runs name the same conversation.
+    toolCallArgs:
+      - tool: test_run_flow
+        field: memory_id
+        sharedByAtLeast: 2
+    forbiddenToolsUsed:
+      - run_flow
+      - deploy_workspace_item
+  # The judge cannot observe runs; what this case guards is the conversation the runs share.
+  skipJudge: true
+  judgeChecklist:
+    - test-runs the chat flow twice, the second message as a follow-up in the first run's conversation
+
 - id: global-undo-created-draft
   prompt: |-
     Create a draft Postgres resource at `u/admin/scratch_db` for host db.example.com port 5432, database `orders`, user `app`, and tell me what fields it ended up with.

ai_evals/core/types.ts

@@ -182,6 +182,13 @@ export interface ToolCallArgumentRule {
    * the point is that the model filled it in at all rather than what it said.
    */
   nonEmpty?: boolean;
+  /**
+   * Existential over calls: at least this many recorded calls to `tool` carry the
+   * same non-blank string in `field`. Use when calls have to share an identifier —
+   * e.g. test runs that continue one conversation — while a retry with a rejected
+   * value in between is still acceptable.
+   */
+  sharedByAtLeast?: number;
   /**
    * Universal over calls: no recorded call to `tool` may pass `field` at all.
    * For partial-update tools, where supplying a field the model could not have

ai_evals/core/validators.test.ts

@@ -396,6 +396,32 @@ describe("validateToolExpectations", () => {
     expect(nonEmptyCheck?.details).toContain("blank on 1 of 2");
   });
 
+  it("requires sharedByAtLeast calls to carry one value, not merely a value each", () => {
+    const run = (ids: (string | undefined)[]) =>
+      validateToolExpectations({
+        run: {
+          success: true,
+          actual: {},
+          assistantMessageCount: 1,
+          toolCallCount: ids.length,
+          toolsUsed: ["test_run_flow"],
+          toolCallDetails: ids.map((memory_id) => ({
+            name: "test_run_flow",
+            arguments: { path: "f/chat", memory_id },
+          })),
+          skillsInvoked: [],
+        },
+        toolExpect: {
+          toolCallArgs: [{ tool: "test_run_flow", field: "memory_id", sharedByAtLeast: 2 }],
+        },
+      }).find((c) => c.name.includes("is shared by at least 2 calls"))?.passed;
+
+    expect(run(["a", "b"])).toBe(false);
+    expect(run(["a"])).toBe(false);
+    expect(run([undefined, undefined])).toBe(false);
+    expect(run(["rejected", "a", "a"])).toBe(true);
+  });
+
   it("passes nonEmpty when every call filled the field", () => {
     const checks = validateToolExpectations({
       run: {

ai_evals/core/validators.ts

@@ -320,6 +320,23 @@ export function validateToolExpectations(input: {
       );
     }
 
+    if (rule.sharedByAtLeast !== undefined) {
+      const counts = new Map<string, number>();
+      for (const value of values) {
+        if (typeof value === "string" && value.trim().length > 0) {
+          counts.set(value, (counts.get(value) ?? 0) + 1);
+        }
+      }
+      const mostShared = Math.max(0, ...counts.values());
+      checks.push(
+        check(
+          `${rule.tool}.${rule.field} is shared by at least ${rule.sharedByAtLeast} calls`,
+          mostShared >= rule.sharedByAtLeast,
+          `most calls sharing one value: ${mostShared}; values: ${summarizeToolValues(values)}`
+        )
+      );
+    }
+
     if (rule.fieldMustBeAbsent) {
       // Anything other than `undefined` was supplied — an explicit `null` is the
       // model passing the field, not omitting it.

ai_evals/fixtures/frontend/global/initial/ducklake_orders_metrics.json

@@ -0,0 +1,36 @@
+{
+  "workspace": {
+    "ducklakes": ["main"],
+    "dataMetrics": [
+      {
+        "script_path": "f/analytics/orders_pipeline",
+        "table_path": "main/main.orders",
+        "kind": "measure",
+        "name": "revenue",
+        "expr": "sum(amount)",
+        "filter": "not is_test"
+      },
+      {
+        "script_path": "f/analytics/orders_pipeline",
+        "table_path": "main/main.orders",
+        "kind": "measure",
+        "name": "order_count",
+        "expr": "count(*)"
+      },
+      {
+        "script_path": "f/analytics/orders_pipeline",
+        "table_path": "main/main.orders",
+        "kind": "dimension",
+        "name": "order_month",
+        "expr": "date_trunc('month', order_date)"
+      },
+      {
+        "script_path": "f/analytics/orders_pipeline",
+        "table_path": "main/main.orders",
+        "kind": "dimension",
+        "name": "region",
+        "expr": "region"
+      }
+    ]
+  }
+}

ai_evals/fixtures/frontend/global/initial/jobs_seed.json

@@ -15,6 +15,8 @@
         "jobKind": "script",
         "createdBy": "bob",
         "success": true,
+        "args": { "region": "emea", "dry_run": false, "recipients": 12 },
+        "result": { "sent": 12, "skipped": 3, "digest_url": "https://reports.example.com/d/2026-06-09" },
         "logs": "Generating daily digest...\nDigest emailed to 12 recipients\nDone in 1.2s"
       },
       {

ai_evals/fixtures/frontend/global/initial/support_chat_flow.json

@@ -0,0 +1,59 @@
+{
+  "workspace": {
+    "flows": [
+      {
+        "path": "f/evals/global/support_chat",
+        "summary": "Support chat",
+        "description": "Answers customer questions in a chat, remembering earlier messages.",
+        "schema": {
+          "$schema": "https://json-schema.org/draft/2020-12/schema",
+          "type": "object",
+          "properties": {
+            "user_message": {
+              "type": "string",
+              "description": "Message from user"
+            }
+          },
+          "required": ["user_message"]
+        },
+        "value": {
+          "chat_input_enabled": true,
+          "modules": [
+            {
+              "id": "assistant",
+              "summary": "Support assistant",
+              "value": {
+                "type": "aiagent",
+                "tools": [],
+                "input_transforms": {
+                  "provider": {
+                    "type": "static",
+                    "value": {
+                      "kind": "anthropic",
+                      "model": "claude-haiku-4-5-20251001",
+                      "resource": "$res:f/evals/ai/anthropic"
+                    }
+                  },
+                  "user_message": {
+                    "type": "javascript",
+                    "expr": "flow_input.user_message"
+                  },
+                  "system_prompt": {
+                    "type": "static",
+                    "value": "You are a friendly support assistant. Keep answers short."
+                  },
+                  "memory": {
+                    "type": "static",
+                    "value": { "kind": "auto", "context_length": 10 }
+                  },
+                  "streaming": { "type": "static", "value": true },
+                  "output_type": { "type": "static", "value": "text" }
+                }
+              }
+            }
+          ]
+        }
+      }
+    ]
+  }
+}

backend/.sqlx/query-07a005f0f9e80a156cd2a5a0ae39a1fabeaa167818206a25abfe31d5582f942a.json

@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM flow_conversation c\n              WHERE c.id = ANY($1)\n                AND c.workspace_id = $2\n                AND NOT EXISTS (\n                    SELECT 1 FROM flow_conversation_message m WHERE m.conversation_id = c.id\n                )",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "UuidArray",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "07a005f0f9e80a156cd2a5a0ae39a1fabeaa167818206a25abfe31d5582f942a"
+}

backend/.sqlx/query-12329c3359a7944ab5fa3aa27ddca1b26f340ccf574b9fa07641fe88b2d2987c.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "INSERT INTO flow_conversation_message (conversation_id, message_type, content, job_id, step_name, success)\n         VALUES ($1, $2, $3, $4, $5, $6)",
+  "query": "INSERT INTO flow_conversation_message (conversation_id, message_type, content, job_id, step_name, success, tool_arguments, tool_result, reasoning, attachments)\n         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)",
   "describe": {
     "columns": [],
     "parameters": {
@@ -21,10 +21,14 @@
         "Text",
         "Uuid",
         "Varchar",
-        "Bool"
+        "Bool",
+        "Text",
+        "Text",
+        "Text",
+        "Jsonb"
       ]
     },
     "nullable": []
   },
-  "hash": "b1a9a433e577133869c067b2ce383fc6ce4e9df307feb5fd3edc0d1276d61ff1"
+  "hash": "12329c3359a7944ab5fa3aa27ddca1b26f340ccf574b9fa07641fe88b2d2987c"
 }

backend/.sqlx/query-462d2b2822b185a6f51fafcfa957cb3b31ee6b69abae79a214dddba0dee4425c.json

@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "DELETE FROM flow_conversation_message m\n         USING flow_conversation c\n         WHERE m.conversation_id = c.id AND c.workspace_id = $1 AND m.job_id = ANY($2)",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        "UuidArray"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "462d2b2822b185a6f51fafcfa957cb3b31ee6b69abae79a214dddba0dee4425c"
-}

backend/.sqlx/query-48c8522a4fed219c5011f4ba63c81cfe028a8b2a32bd790840cef65c452a8c31.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT id, workspace_id, flow_path, title, created_at, updated_at, created_by\n         FROM flow_conversation\n         WHERE id = $1 AND workspace_id = $2",
+  "query": "SELECT id, workspace_id, flow_path, title, created_at, updated_at, created_by, is_test\n         FROM flow_conversation\n         WHERE id = $1 AND workspace_id = $2",
   "describe": {
     "columns": [
       {
@@ -37,6 +37,11 @@
         "ordinal": 6,
         "name": "created_by",
         "type_info": "Varchar"
+      },
+      {
+        "ordinal": 7,
+        "name": "is_test",
+        "type_info": "Bool"
       }
     ],
     "parameters": {
@@ -52,8 +57,9 @@
       true,
       false,
       false,
+      false,
       false
     ]
   },
-  "hash": "c383cc023714b361d10c10e8fef1fc148ab1da942951ee9ffdddaecee76a6be9"
+  "hash": "48c8522a4fed219c5011f4ba63c81cfe028a8b2a32bd790840cef65c452a8c31"
 }

backend/.sqlx/query-4f52bf546579f26a1d22c239b8b0054b753cfbeb5dad1e8120fd5e8a672d50ef.json

@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT id FROM flow_conversation WHERE id = ANY($1) AND workspace_id = $2 ORDER BY id FOR UPDATE",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Uuid"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "UuidArray",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "4f52bf546579f26a1d22c239b8b0054b753cfbeb5dad1e8120fd5e8a672d50ef"
+}

backend/.sqlx/query-5b9c9eb64051f291fed4be9bc0b0cc0aef2e7bde732899976eddac36a2da7658.json

@@ -0,0 +1,24 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE flow_conversation SET title = $1, updated_at = updated_at\n         WHERE id = $2 AND workspace_id = $3\n         RETURNING id",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Uuid"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Uuid",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "5b9c9eb64051f291fed4be9bc0b0cc0aef2e7bde732899976eddac36a2da7658"
+}

backend/.sqlx/query-69bfbe9b39414b724488532cc3b3659915d9fcb3d58f16532aaffe06c44ec976.json

@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM flow_conversation_message m\n         USING flow_conversation c\n         WHERE m.conversation_id = c.id AND c.workspace_id = $1 AND m.job_id = ANY($2)\n         RETURNING m.conversation_id",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "conversation_id",
+        "type_info": "Uuid"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "UuidArray"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "69bfbe9b39414b724488532cc3b3659915d9fcb3d58f16532aaffe06c44ec976"
+}

backend/.sqlx/query-6d259b8cce5da5fecefe4ce322789b6b2cc43b51f2056c677d58f39c31fb26cb.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "INSERT INTO flow_conversation (id, workspace_id, flow_path, created_by, title)\n         VALUES ($1, $2, $3, $4, $5)\n         RETURNING id, workspace_id, flow_path, title, created_at, updated_at, created_by",
+  "query": "INSERT INTO flow_conversation (id, workspace_id, flow_path, created_by, title, is_test)\n         VALUES ($1, $2, $3, $4, $5, $6)\n         ON CONFLICT (id) DO NOTHING\n         RETURNING id, workspace_id, flow_path, title, created_at, updated_at, created_by, is_test",
   "describe": {
     "columns": [
       {
@@ -37,6 +37,11 @@
         "ordinal": 6,
         "name": "created_by",
         "type_info": "Varchar"
+      },
+      {
+        "ordinal": 7,
+        "name": "is_test",
+        "type_info": "Bool"
       }
     ],
     "parameters": {
@@ -45,7 +50,8 @@
         "Varchar",
         "Varchar",
         "Varchar",
-        "Varchar"
+        "Varchar",
+        "Bool"
       ]
     },
     "nullable": [
@@ -55,8 +61,9 @@
       true,
       false,
       false,
+      false,
       false
     ]
   },
-  "hash": "6bd23a98838e3eec309e6b696edc776bd56fc9dae1238b3272557d1562400dbe"
+  "hash": "6d259b8cce5da5fecefe4ce322789b6b2cc43b51f2056c677d58f39c31fb26cb"
 }

backend/.sqlx/query-89ea81b765550cf665e30533efc9672f8c98d2579fc72c07752361cc5fd683dc.json

@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM ai_agent_memory a\n               USING flow_conversation c\n              WHERE c.id = ANY($1)\n                AND c.workspace_id = $2\n                AND a.conversation_id = c.id\n                AND a.workspace_id = c.workspace_id\n                AND NOT EXISTS (\n                    SELECT 1 FROM flow_conversation_message m WHERE m.conversation_id = c.id\n                )",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "UuidArray",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "89ea81b765550cf665e30533efc9672f8c98d2579fc72c07752361cc5fd683dc"
+}

backend/.sqlx/query-9008f9abb70a9a07e38acb20bea6a710d0efd77dac4aedeb88d72240e816530b.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n        SELECT\n            j.args as \"args: Json<HashMap<String, Box<RawValue>>>\",\n            js.flow_status as \"flow_status: Json<windmill_common::flow_status::FlowStatus>\"\n        FROM v2_job_status js\n        INNER JOIN v2_job j ON j.id = js.id\n        WHERE js.id = $1\n        ",
+  "query": "\n        SELECT\n            j.args as \"args: Json<HashMap<String, Box<RawValue>>>\",\n            js.flow_status as \"flow_status: Json<windmill_common::flow_status::FlowStatus>\",\n            j.runnable_path\n        FROM v2_job_status js\n        INNER JOIN v2_job j ON j.id = js.id\n        WHERE js.id = $1\n        ",
   "describe": {
     "columns": [
       {
@@ -12,6 +12,11 @@
         "ordinal": 1,
         "name": "flow_status: Json<windmill_common::flow_status::FlowStatus>",
         "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 2,
+        "name": "runnable_path",
+        "type_info": "Varchar"
       }
     ],
     "parameters": {
@@ -20,9 +25,10 @@
       ]
     },
     "nullable": [
+      true,
       true,
       true
     ]
   },
-  "hash": "dd89d652154748d6d7e625e31778f6885d0ee62d29a4b8894a4b459dd215a103"
+  "hash": "9008f9abb70a9a07e38acb20bea6a710d0efd77dac4aedeb88d72240e816530b"
 }

backend/.sqlx/query-90b910da8d00a7c7bcf29c167e38e44eb1c0062a8241dc8fe0ed3dd95b65f89a.json

@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM flow_conversation c\n              WHERE c.id = ANY($1)\n                AND NOT EXISTS (\n                    SELECT 1 FROM flow_conversation_message m WHERE m.conversation_id = c.id\n                )",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "UuidArray"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "90b910da8d00a7c7bcf29c167e38e44eb1c0062a8241dc8fe0ed3dd95b65f89a"
+}

backend/.sqlx/query-967f52005f4a044b3a2e9f02ceadf90dad5246681bde6caaa633b85a5e8b2352.json

@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM flow_conversation_message WHERE job_id = ANY($1) RETURNING conversation_id",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "conversation_id",
+        "type_info": "Uuid"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "UuidArray"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "967f52005f4a044b3a2e9f02ceadf90dad5246681bde6caaa633b85a5e8b2352"
+}

backend/.sqlx/query-a1b23f3e62c6433d95cdac58215741a51ca0ce66bf1c674097705cf2e1b72eff.json

@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM ai_agent_memory a\n               USING flow_conversation c\n              WHERE c.id = ANY($1)\n                AND a.conversation_id = c.id\n                AND a.workspace_id = c.workspace_id\n                AND NOT EXISTS (\n                    SELECT 1 FROM flow_conversation_message m WHERE m.conversation_id = c.id\n                )",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "UuidArray"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "a1b23f3e62c6433d95cdac58215741a51ca0ce66bf1c674097705cf2e1b72eff"
+}

backend/.sqlx/query-a4a823f70b3dbe6aaf4a61c98345e94c5042fd5e6351fea139a66ecb1fb812ab.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT id, conversation_id, message_type as \"message_type: MessageType\", content, job_id, created_at, created_seq, step_name, success\n             FROM flow_conversation_message\n             WHERE conversation_id = $1\n               AND created_seq > $2\n             ORDER BY created_seq ASC\n             LIMIT $3\n             ",
+  "query": "SELECT id, conversation_id, message_type as \"message_type: MessageType\", content, job_id, created_at, created_seq, step_name, success, tool_arguments, tool_result, reasoning, attachments\n             FROM (\n                SELECT id, conversation_id, message_type, content, job_id, created_at, created_seq, step_name, success, tool_arguments, tool_result, reasoning, attachments\n                FROM flow_conversation_message\n                WHERE conversation_id = $1\n                ORDER BY created_seq DESC\n                LIMIT $2 OFFSET $3\n             ) AS messages\n             ORDER BY created_seq ASC\n             ",
   "describe": {
     "columns": [
       {
@@ -58,6 +58,26 @@
         "ordinal": 8,
         "name": "success",
         "type_info": "Bool"
+      },
+      {
+        "ordinal": 9,
+        "name": "tool_arguments",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 10,
+        "name": "tool_result",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 11,
+        "name": "reasoning",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 12,
+        "name": "attachments",
+        "type_info": "Jsonb"
       }
     ],
     "parameters": {
@@ -76,8 +96,12 @@
       false,
       false,
       true,
-      false
+      false,
+      true,
+      true,
+      true,
+      true
     ]
   },
-  "hash": "e8802be9203c1e88a06e337260ccca029380139f89a01a89033e36a6ed9ac082"
+  "hash": "a4a823f70b3dbe6aaf4a61c98345e94c5042fd5e6351fea139a66ecb1fb812ab"
 }

backend/.sqlx/query-bfdd60b42e32bd81e2d20b327462893147b4e5ff078531de36147d908132d636.json

@@ -1,14 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "DELETE FROM flow_conversation_message WHERE job_id = ANY($1)",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "UuidArray"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "bfdd60b42e32bd81e2d20b327462893147b4e5ff078531de36147d908132d636"
-}

backend/.sqlx/query-d631a26e5531589ff37e677f91a4f1d9f850e3e46c17130dd580426cda7a9f65.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "UPDATE token SET label = $1\n           WHERE email = $2 AND token_prefix = $3\n             AND (label IS NULL OR (\n                 label <> 'session'\n                 AND label <> 'guest_session'\n                 AND lower(label) NOT LIKE 'ephemeral%'\n                 AND label <> 'debugger-token'\n                 AND label NOT LIKE 'mcp-oauth-%'\n             ))\n           RETURNING token_prefix",
+  "query": "UPDATE token SET label = $1\n           WHERE email = $2 AND token_prefix = $3\n             AND (label IS NULL OR (\n                 label <> 'session'\n                 AND label <> 'guest_session'\n                 AND lower(label) NOT LIKE 'ephemeral%'\n                 AND label <> 'debugger-token'\n                 AND label NOT LIKE 'mcp-oauth-%'\n                 AND NOT starts_with(label, 'embed_app:')\n                 AND NOT starts_with(label, 'sdk_app:')\n                 AND NOT starts_with(label, 'impersonation:')\n             ))\n           RETURNING token_prefix",
   "describe": {
     "columns": [
       {
@@ -20,5 +20,5 @@
       false
     ]
   },
-  "hash": "31ed2fb85c0c726e3cf6392be2a73c62bae004b2842a4828c6807232570f83a1"
+  "hash": "d631a26e5531589ff37e677f91a4f1d9f850e3e46c17130dd580426cda7a9f65"
 }

backend/.sqlx/query-d6fa78c43b6c5f8040d7bccb29ad8627be1dac6fbe0097735a52f47c173f51c9.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT id, conversation_id, message_type as \"message_type: MessageType\", content, job_id, created_at, created_seq, step_name, success\n             FROM (\n                SELECT id, conversation_id, message_type, content, job_id, created_at, created_seq, step_name, success\n                FROM flow_conversation_message\n                WHERE conversation_id = $1\n                ORDER BY created_seq DESC\n                LIMIT $2 OFFSET $3\n             ) AS messages\n             ORDER BY created_seq ASC\n             ",
+  "query": "SELECT id, conversation_id, message_type as \"message_type: MessageType\", content, job_id, created_at, created_seq, step_name, success, tool_arguments, tool_result, reasoning, attachments\n             FROM flow_conversation_message\n             WHERE conversation_id = $1\n               AND created_seq > $2\n             ORDER BY created_seq ASC\n             LIMIT $3\n             ",
   "describe": {
     "columns": [
       {
@@ -58,6 +58,26 @@
         "ordinal": 8,
         "name": "success",
         "type_info": "Bool"
+      },
+      {
+        "ordinal": 9,
+        "name": "tool_arguments",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 10,
+        "name": "tool_result",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 11,
+        "name": "reasoning",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 12,
+        "name": "attachments",
+        "type_info": "Jsonb"
       }
     ],
     "parameters": {
@@ -76,8 +96,12 @@
       false,
       false,
       true,
-      false
+      false,
+      true,
+      true,
+      true,
+      true
     ]
   },
-  "hash": "1c3473a0f9f6b6148b2c975f9f05bdefedf8a51c4e6ddf0eca367b9cc778d051"
+  "hash": "d6fa78c43b6c5f8040d7bccb29ad8627be1dac6fbe0097735a52f47c173f51c9"
 }

backend/.sqlx/query-dd84f9dfb238d18cb74f9e43228345427131bf8008eba6920021d6a449791534.json

@@ -0,0 +1,65 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT id, workspace_id, flow_path, title, created_at, updated_at, created_by, is_test\n         FROM flow_conversation\n         WHERE id = $1 AND workspace_id = $2\n         FOR UPDATE",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Uuid"
+      },
+      {
+        "ordinal": 1,
+        "name": "workspace_id",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "flow_path",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 3,
+        "name": "title",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 4,
+        "name": "created_at",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 5,
+        "name": "updated_at",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 6,
+        "name": "created_by",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 7,
+        "name": "is_test",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      false,
+      true,
+      false,
+      false,
+      false,
+      false
+    ]
+  },
+  "hash": "dd84f9dfb238d18cb74f9e43228345427131bf8008eba6920021d6a449791534"
+}

backend/.sqlx/query-ec295b3890a0018475ec0a3774c7a30d71a5689efe72daf58bd1e8f6cf90c410.json

@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT id FROM flow_conversation WHERE id = ANY($1) ORDER BY id FOR UPDATE",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Uuid"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "UuidArray"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "ec295b3890a0018475ec0a3774c7a30d71a5689efe72daf58bd1e8f6cf90c410"
+}

backend/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.812.0"
+version = "1.814.0"
 authors.workspace = true
 edition.workspace = true
 
@@ -88,7 +88,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal", "./parsers/windmill-parser-wasm"]
 
 [workspace.package]
-version = "1.812.0"
+version = "1.814.0"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 

backend/migrations/20260916144653_flow_conversation_message_tool_call.down.sql

@@ -0,0 +1,3 @@
+ALTER TABLE flow_conversation_message DROP COLUMN tool_arguments;
+ALTER TABLE flow_conversation_message DROP COLUMN tool_result;
+ALTER TABLE flow_conversation_message DROP COLUMN reasoning;

backend/migrations/20260916144653_flow_conversation_message_tool_call.up.sql

@@ -0,0 +1,12 @@
+-- A chat is rebuilt from its rows without reading jobs, so every tool row carries its call:
+-- the arguments the model wrote and the text the model got back, or what the call failed
+-- with. A script or flow tool's job holds the args its input transforms produced, not the
+-- model's; an MCP tool runs inside the agent's job, whose result lists every call of the
+-- turn with nothing tying one to a row. A provider-native web search carries only its
+-- citations, the provider never returning the query.
+ALTER TABLE flow_conversation_message ADD COLUMN tool_arguments TEXT;
+ALTER TABLE flow_conversation_message ADD COLUMN tool_result TEXT;
+
+-- The thinking behind this row. The agent job keeps the turn's thinking as one string;
+-- the rows keep it per iteration, next to the answer or tool call it led to.
+ALTER TABLE flow_conversation_message ADD COLUMN reasoning TEXT;

backend/migrations/20260916155738_flow_conversation_is_test.down.sql

@@ -0,0 +1 @@
+ALTER TABLE flow_conversation DROP COLUMN is_test;

backend/migrations/20260916155738_flow_conversation_is_test.up.sql

@@ -0,0 +1,26 @@
+-- A chat run from the flow editor's test panel is stored exactly like one from the
+-- deployed flow, so the two were indistinguishable once written. Marking them lets the
+-- lists tell a trial apart from a real conversation.
+ALTER TABLE flow_conversation ADD COLUMN is_test BOOLEAN NOT NULL DEFAULT false;
+
+-- Existing rows: a conversation whose messages came from a flowpreview run was a test.
+-- Derived once here because the job is purged on retention, after which the origin of an
+-- old conversation is unknowable.
+--
+-- Walked to the root job rather than matched directly: an existing message row never holds
+-- the flow job itself. The rows point at the step that produced them — the AI agent's job
+-- for an answer, the tool's own job for a tool call — whose kind is never 'flowpreview'.
+--
+-- `root_job` first, matching `get_root_job_id` (windmill-worker/src/common.rs): only it
+-- reaches the top of the run. `flow_innermost_root_job` stops at the closest flow scope by
+-- design, so an agent inside a subflow would land on that subflow's 'flow' row and the
+-- conversation would read as deployed.
+UPDATE flow_conversation c
+SET is_test = true
+WHERE EXISTS (
+    SELECT 1 FROM flow_conversation_message m
+    JOIN v2_job j ON j.id = m.job_id
+    JOIN v2_job root
+      ON root.id = coalesce(j.root_job, j.flow_innermost_root_job, j.parent_job, j.id)
+    WHERE m.conversation_id = c.id AND root.kind = 'flowpreview'
+);

backend/migrations/20260917074040_flow_conversation_message_attachments.down.sql

@@ -0,0 +1 @@
+ALTER TABLE flow_conversation_message DROP COLUMN attachments;

backend/migrations/20260917074040_flow_conversation_message_attachments.up.sql

@@ -0,0 +1,4 @@
+-- The files a user message carried, as object-storage references: `[{input, s3, storage?,
+-- filename?}]`. Only references, never file bytes and never a presigned URL, so a
+-- transcript can show a message's files without reading its run's args.
+ALTER TABLE flow_conversation_message ADD COLUMN attachments JSONB;

backend/parsers/windmill-parser-wasm/Cargo.lock

@@ -6191,7 +6191,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windmill-common"
-version = "1.812.0"
+version = "1.814.0"
 dependencies = [
  "aho-corasick",
  "anyhow",
@@ -6274,7 +6274,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.812.0"
+version = "1.814.0"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -6286,7 +6286,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.812.0"
+version = "1.814.0"
 dependencies = [
  "convert_case",
  "serde",
@@ -6295,7 +6295,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.812.0"
+version = "1.814.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6307,7 +6307,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.812.0"
+version = "1.814.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6319,7 +6319,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.812.0"
+version = "1.814.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -6331,7 +6331,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.812.0"
+version = "1.814.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6343,7 +6343,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.812.0"
+version = "1.814.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6355,7 +6355,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.812.0"
+version = "1.814.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -6366,7 +6366,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.812.0"
+version = "1.814.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6377,7 +6377,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.812.0"
+version = "1.814.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6389,7 +6389,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.812.0"
+version = "1.814.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6400,7 +6400,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.812.0"
+version = "1.814.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -6422,7 +6422,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.812.0"
+version = "1.814.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6434,7 +6434,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.812.0"
+version = "1.814.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6448,7 +6448,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.812.0"
+version = "1.814.0"
 dependencies = [
  "anyhow",
  "convert_case",
@@ -6465,7 +6465,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.812.0"
+version = "1.814.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6478,7 +6478,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.812.0"
+version = "1.814.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -6490,7 +6490,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.812.0"
+version = "1.814.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6508,7 +6508,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.812.0"
+version = "1.814.0"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -6524,7 +6524,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.812.0"
+version = "1.814.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6540,7 +6540,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wasm"
-version = "1.812.0"
+version = "1.814.0"
 dependencies = [
  "anyhow",
  "getrandom 0.2.17",
@@ -6572,7 +6572,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.812.0"
+version = "1.814.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6586,7 +6586,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.812.0"
+version = "1.814.0"
 dependencies = [
  "anyhow",
  "bitflags",

backend/parsers/windmill-parser-wasm/Cargo.toml

@@ -12,7 +12,7 @@ resolver = "2"
 members = ["."]
 
 [workspace.package]
-version = "1.812.0"
+version = "1.814.0"
 edition = "2021"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 

backend/src/monitor.rs

@@ -4712,17 +4712,11 @@ const GIT_AUTO_PULL_LOCK_ID: i64 = 737_483_921;
 /// Poll every git-sync repository with auto-pull enabled and enqueue a pull when
 /// the tracked branch has new commits (repo → Windmill direction).
 ///
-/// Runs on a single replica at a time (advisory lock) and only on
-/// Enterprise-licensed instances. Detection is `git ls-remote`; GitHub-App
-/// repositories are skipped here and sync via webhooks instead (phase 2).
+/// Runs on a single replica at a time (advisory lock). Detection is
+/// `git ls-remote`; GitHub-App repositories are skipped here and sync via
+/// webhooks instead (phase 2).
 #[cfg(feature = "private")]
 pub async fn poll_git_auto_pull(db: &Pool<Postgres>) {
-    use windmill_common::ee_oss::{get_license_plan, LicensePlan};
-
-    if !matches!(get_license_plan().await, LicensePlan::Enterprise) {
-        return;
-    }
-
     let mut lock_conn = match db.acquire().await {
         Ok(c) => c,
         Err(e) => {
@@ -4792,12 +4786,6 @@ const GIT_CREDENTIAL_LOCK_ID: i64 = 737_483_923;
 /// sync down on its expiry date.
 #[cfg(all(feature = "enterprise", feature = "private"))]
 async fn maintain_git_credentials(db: &Pool<Postgres>) {
-    use windmill_common::ee_oss::{get_license_plan, LicensePlan};
-
-    if !matches!(get_license_plan().await, LicensePlan::Enterprise) {
-        return;
-    }
-
     // Transaction-scoped advisory lock, as for the schedule reconcile above: a
     // session lock on a pooled connection would ride back into the pool still
     // held if the sweep died before unlocking, and wedge the pass on every

backend/summarized_schema.txt

@@ -99,9 +99,9 @@ email_trigger: path(char), local_part(char), workspaced_local_part(bool), script
 favorite: usr(char), workspace_id(char), path(char), favorite_kind(favorite_kind)
 flow: workspace_id(char), path(char), summary(text), description(text), value(jsonb), edited_by(char), edited_at(ts), archived(bool), schema(json), extra_perms(jsonb), dependency_job(uuid), draft_only(bool), tag(char), ws_error_handler_muted(bool), dedicated_worker(bool), timeout(int), visible_to_runner_only(bool), concurrency_key(char), versions(bigint[]), on_behalf_of(varchar), on_behalf_of_email(text), lock_error_logs(text), labels(text[])
   FK: (workspace_id) -> workspace(id)
-flow_conversation: id(uuid), workspace_id(char), flow_path(char), title(char), created_at(ts), updated_at(ts), created_by(char)
+flow_conversation: id(uuid), workspace_id(char), flow_path(char), title(char), created_at(ts), updated_at(ts), created_by(char), is_test(bool)
   FK: (workspace_id) -> workspace(id)
-flow_conversation_message: id(uuid), conversation_id(uuid), message_type(message_type), content(text), job_id(uuid), created_at(ts), created_seq(int8), step_name(char), success(bool)
+flow_conversation_message: id(uuid), conversation_id(uuid), message_type(message_type), content(text), job_id(uuid), created_at(ts), created_seq(int8), step_name(char), success(bool), tool_arguments(text), tool_result(text), reasoning(text), attachments(jsonb)
   FK: (conversation_id) -> flow_conversation(id) | (job_id) -> v2_job(id)
 flow_iterator_data: job_id(uuid), itered(jsonb)
 flow_node: id(bigint), workspace_id(char), hash(bigint), path(char), lock(text), code(text), flow(jsonb), hash_v2(char(64))

backend/tests/list_jobs.rs

@@ -1199,3 +1199,63 @@ async fn test_wm_labels_from_result_merged_with_static_labels(
 
     Ok(())
 }
+
+/// `tag` lives only on `v2_job`, which count_jobs joins only when `tags` is set.
+#[sqlx::test(fixtures("base"))]
+async fn test_count_completed_jobs_tags_filter(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let client = windmill_api_client::create_client(
+        &format!("http://localhost:{port}"),
+        "SECRET_TOKEN".to_string(),
+    );
+
+    for (ws, tag, status) in [
+        ("test-workspace", "deno", "success"),
+        ("test-workspace", "deno", "failure"),
+        ("test-workspace", "python3", "success"),
+        ("other-workspace", "deno", "success"),
+    ] {
+        let id = uuid::Uuid::new_v4();
+        sqlx::query("INSERT INTO v2_job (id, workspace_id, tag) VALUES ($1, $2, $3)")
+            .bind(id)
+            .bind(ws)
+            .bind(tag)
+            .execute(&db)
+            .await?;
+        sqlx::query(
+            "INSERT INTO v2_job_completed (id, workspace_id, status, duration_ms) VALUES ($1, $2, $3::job_status, 0)",
+        )
+        .bind(id)
+        .bind(ws)
+        .bind(status)
+        .execute(&db)
+        .await?;
+    }
+
+    for (query, expected) in [
+        ("", 3),
+        ("tags=deno", 2),
+        ("tags=deno&success=true", 1),
+        ("tags=deno,python3&completed_after_s_ago=3600", 3),
+    ] {
+        let response = client
+            .client()
+            .get(format!(
+                "{}/w/test-workspace/jobs/completed/count_jobs?{query}",
+                client.baseurl()
+            ))
+            .send()
+            .await?;
+        assert!(
+            response.status().is_success(),
+            "{query}: {}",
+            response.text().await?
+        );
+        assert_eq!(response.json::<i64>().await?, expected, "{query}");
+    }
+
+    Ok(())
+}

backend/tests/v2_job_delete_orphans.rs

@@ -37,7 +37,7 @@ async fn seed_side_rows(db: &Pool<Postgres>, ws: &str, job_id: Uuid) -> anyhow::
     .bind(ws)
     .execute(db)
     .await?;
-    // created_seq is assigned by a trigger; inserting a value is rejected.
+    // created_seq is an identity column; supplying a value is rejected.
     sqlx::query(
         "INSERT INTO flow_conversation_message (conversation_id, message_type, content, job_id)
          VALUES ($1, 'assistant', 'hi', $2)",
@@ -121,6 +121,186 @@ async fn test_delete_jobs_removes_side_rows(db: Pool<Postgres>) -> anyhow::Resul
     Ok(())
 }
 
+/// (conversation rows, agent-memory rows) for one conversation.
+async fn conversation_and_memory_counts(
+    db: &Pool<Postgres>,
+    conversation_id: Uuid,
+) -> anyhow::Result<(i64, i64)> {
+    Ok((
+        count(
+            db,
+            "SELECT count(*) FROM flow_conversation WHERE id = $1",
+            conversation_id,
+        )
+        .await?,
+        count(
+            db,
+            "SELECT count(*) FROM ai_agent_memory WHERE conversation_id = $1",
+            conversation_id,
+        )
+        .await?,
+    ))
+}
+
+/// A conversation outlives the jobs behind its messages until the last one goes: only then
+/// are the row and the agent's memory for it left with nothing, and only then are they
+/// deleted. Both halves matter — the surviving half is what a single data-modifying CTE
+/// would break, since its emptiness check would read the snapshot from before the delete.
+#[sqlx::test(fixtures("base"))]
+async fn test_delete_jobs_removes_a_conversation_once_its_last_message_goes(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+
+    let first_job = Uuid::new_v4();
+    let second_job = Uuid::new_v4();
+    insert_job(&db, WS, first_job).await?;
+    insert_job(&db, WS, second_job).await?;
+
+    let conv_id = Uuid::new_v4();
+    sqlx::query(
+        "INSERT INTO flow_conversation (id, workspace_id, flow_path, created_by)
+         VALUES ($1, $2, 'f/flow', 'test-user')",
+    )
+    .bind(conv_id)
+    .bind(WS)
+    .execute(&db)
+    .await?;
+    for job_id in [first_job, second_job] {
+        sqlx::query(
+            "INSERT INTO flow_conversation_message (conversation_id, message_type, content, job_id)
+             VALUES ($1, 'assistant', 'hi', $2)",
+        )
+        .bind(conv_id)
+        .bind(job_id)
+        .execute(&db)
+        .await?;
+    }
+    sqlx::query(
+        "INSERT INTO ai_agent_memory (workspace_id, conversation_id, step_id, messages)
+         VALUES ($1, $2, 'a', '[]'::jsonb)",
+    )
+    .bind(WS)
+    .bind(conv_id)
+    .execute(&db)
+    .await?;
+
+    let mut conn = db.acquire().await?;
+    windmill_common::jobs::delete_jobs(&mut conn, &[first_job]).await?;
+    drop(conn);
+    assert_eq!(
+        conversation_and_memory_counts(&db, conv_id).await?,
+        (1, 1),
+        "a conversation with a message left must survive, memory included"
+    );
+
+    let mut conn = db.acquire().await?;
+    windmill_common::jobs::delete_jobs(&mut conn, &[second_job]).await?;
+    drop(conn);
+    assert_eq!(
+        conversation_and_memory_counts(&db, conv_id).await?,
+        (0, 0),
+        "the last message going should take the conversation and its memory"
+    );
+    Ok(())
+}
+
+/// Turns that start while retention is collecting their conversation must land, not fail:
+/// the conversation lookup locks the row, so each turn waits for the collector's commit,
+/// finds the conversation gone, and creates it again — the first insert wins and the other
+/// reads its row. Without the lock a turn's message insert is what waits, on the parent
+/// row's key lock, and fails its FK check afterwards.
+#[sqlx::test(fixtures("base"))]
+async fn test_new_turns_wait_for_conversation_cleanup_and_recreate(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+
+    let old_job = Uuid::new_v4();
+    let new_jobs = [Uuid::new_v4(), Uuid::new_v4()];
+    insert_job(&db, WS, old_job).await?;
+    for job in new_jobs {
+        insert_job(&db, WS, job).await?;
+    }
+
+    let conv_id = Uuid::new_v4();
+    sqlx::query(
+        "INSERT INTO flow_conversation (id, workspace_id, flow_path, created_by)
+         VALUES ($1, $2, 'f/flow', 'test-user')",
+    )
+    .bind(conv_id)
+    .bind(WS)
+    .execute(&db)
+    .await?;
+    sqlx::query(
+        "INSERT INTO flow_conversation_message (conversation_id, message_type, content, job_id)
+         VALUES ($1, 'user', 'hi', $2)",
+    )
+    .bind(conv_id)
+    .bind(old_job)
+    .execute(&db)
+    .await?;
+
+    // The collector holds the conversation row locked and deleted, uncommitted.
+    let mut cleanup = db.begin().await?;
+    windmill_common::jobs::delete_jobs(&mut *cleanup, &[old_job]).await?;
+
+    let turns: Vec<_> = new_jobs
+        .into_iter()
+        .map(|new_job| {
+            let db = db.clone();
+            tokio::spawn(async move {
+                let mut tx = db.begin().await?;
+                windmill_common::flow_conversations::get_or_create_conversation_with_id(
+                    &mut tx,
+                    WS,
+                    "f/flow",
+                    "test-user",
+                    "hi again",
+                    conv_id,
+                    false,
+                )
+                .await?;
+                windmill_common::flow_conversations::add_message_to_conversation_tx(
+                    &mut tx,
+                    conv_id,
+                    Some(new_job),
+                    "hi again",
+                    windmill_common::flow_conversations::MessageType::User,
+                    None,
+                    true,
+                    None,
+                )
+                .await?;
+                tx.commit().await?;
+                anyhow::Ok(())
+            })
+        })
+        .collect();
+    tokio::time::sleep(std::time::Duration::from_millis(300)).await;
+    cleanup.commit().await?;
+    for turn in turns {
+        turn.await??;
+    }
+
+    assert_eq!(
+        conversation_and_memory_counts(&db, conv_id).await?.0,
+        1,
+        "the turns must have created the conversation again, once"
+    );
+    assert_eq!(
+        count(
+            &db,
+            "SELECT count(*) FROM flow_conversation_message WHERE conversation_id = $1",
+            conv_id,
+        )
+        .await?,
+        2,
+        "both turns' messages should be there"
+    );
+    Ok(())
+}
+
 #[sqlx::test(fixtures("base"))]
 async fn test_clear_schedule_removes_side_rows(db: Pool<Postgres>) -> anyhow::Result<()> {
     initialize_tracing().await;
@@ -192,6 +372,74 @@ async fn test_workspace_delete_removes_side_rows(db: Pool<Postgres>) -> anyhow::
     Ok(())
 }
 
+/// The purge endpoint carries its own copy of the emptied-conversation rule, so it gets the
+/// same guard: the conversation and its memory go with the last message, and not before.
+#[sqlx::test(fixtures("base"))]
+async fn test_jobs_export_delete_removes_a_conversation_once_its_last_message_goes(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+
+    let first_job = Uuid::new_v4();
+    let second_job = Uuid::new_v4();
+    insert_job(&db, WS, first_job).await?;
+    insert_job(&db, WS, second_job).await?;
+
+    let conv_id = Uuid::new_v4();
+    sqlx::query(
+        "INSERT INTO flow_conversation (id, workspace_id, flow_path, created_by)
+         VALUES ($1, $2, 'f/flow', 'test-user')",
+    )
+    .bind(conv_id)
+    .bind(WS)
+    .execute(&db)
+    .await?;
+    for job_id in [first_job, second_job] {
+        sqlx::query(
+            "INSERT INTO flow_conversation_message (conversation_id, message_type, content, job_id)
+             VALUES ($1, 'assistant', 'hi', $2)",
+        )
+        .bind(conv_id)
+        .bind(job_id)
+        .execute(&db)
+        .await?;
+    }
+    sqlx::query(
+        "INSERT INTO ai_agent_memory (workspace_id, conversation_id, step_id, messages)
+         VALUES ($1, $2, 'a', '[]'::jsonb)",
+    )
+    .bind(WS)
+    .bind(conv_id)
+    .execute(&db)
+    .await?;
+
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let purge = |job_id: Uuid| async move {
+        reqwest::Client::new()
+            .post(format!("http://localhost:{port}/api/w/{WS}/jobs/delete"))
+            .header("Authorization", "Bearer SECRET_TOKEN")
+            .json(&[job_id])
+            .send()
+            .await
+    };
+
+    assert!(purge(first_job).await?.status().is_success());
+    assert_eq!(
+        conversation_and_memory_counts(&db, conv_id).await?,
+        (1, 1),
+        "a conversation with a message left must survive the purge endpoint too"
+    );
+
+    assert!(purge(second_job).await?.status().is_success());
+    assert_eq!(
+        conversation_and_memory_counts(&db, conv_id).await?,
+        (0, 0),
+        "the last message going should take the conversation and its memory"
+    );
+    Ok(())
+}
+
 /// The `/jobs/delete` purge endpoint must scope every side-table delete to the path
 /// workspace. A `test-workspace` admin passing a job id from another workspace must not be
 /// able to delete that workspace's job or side rows (the side tables no longer cascade, so

backend/windmill-ai/Cargo.toml

@@ -23,6 +23,7 @@ async-trait.workspace = true
 async-stream.workspace = true
 base64.workspace = true
 bytes.workspace = true
+indexmap.workspace = true
 eventsource-stream.workspace = true
 futures.workspace = true
 http.workspace = true

backend/windmill-ai/src/providers/bedrock.rs

@@ -1074,7 +1074,8 @@ impl BedrockQueryBuilder {
 
         let mut accumulated_text = String::new();
         let mut events_str = String::new();
-        let mut accumulated_tool_calls: HashMap<String, StreamingToolCall> = HashMap::new();
+        let mut accumulated_tool_calls: indexmap::IndexMap<String, StreamingToolCall> =
+            indexmap::IndexMap::new();
         let mut current_tool_use_id: Option<String> = None;
         let mut usage: Option<TokenUsage> = None;
         // Claude reasoning block for the turn (only populated when thinking is on),
@@ -1263,7 +1264,10 @@ mod tests {
         // recovers the uncached share by subtracting the details back out.
         assert_eq!(usage["usage"]["prompt_tokens"], 1010);
         assert_eq!(usage["usage"]["completion_tokens"], 7);
-        assert_eq!(usage["usage"]["prompt_tokens_details"]["cached_tokens"], 900);
+        assert_eq!(
+            usage["usage"]["prompt_tokens_details"]["cached_tokens"],
+            900
+        );
         assert_eq!(
             usage["usage"]["prompt_tokens_details"]["cache_write_tokens"],
             100

backend/windmill-ai/src/sse.rs

@@ -1,6 +1,7 @@
 use std::collections::HashMap;
 
 use eventsource_stream::Eventsource;
+use indexmap::IndexMap;
 use reqwest::Response;
 use serde::Deserialize;
 use tokio_stream::StreamExt;
@@ -137,7 +138,9 @@ pub struct OpenAISSEParser {
     pub accumulated_content: String,
     /// The thinking streamed before the answer, kept so it can be stored with it.
     pub accumulated_reasoning: String,
-    pub accumulated_tool_calls: HashMap<i64, OpenAIToolCall>,
+    // Insertion-ordered in every parser: tool calls run and are persisted in the order the
+    // stream showed them, and a chat attaches a round's thinking to its first call.
+    pub accumulated_tool_calls: IndexMap<i64, OpenAIToolCall>,
     pub events_str: String,
     pub stream_event_processor: Box<dyn StreamEventSink>,
     /// Token usage from final chunk (when stream_options.include_usage is true)
@@ -149,7 +152,7 @@ impl OpenAISSEParser {
         Self {
             accumulated_content: String::new(),
             accumulated_reasoning: String::new(),
-            accumulated_tool_calls: HashMap::new(),
+            accumulated_tool_calls: IndexMap::new(),
             events_str: String::new(),
             stream_event_processor,
             usage: None,
@@ -359,7 +362,7 @@ pub struct AnthropicSSEParser {
     pub accumulated_content: String,
     /// The thinking streamed before the answer, kept so it can be stored with it.
     pub accumulated_reasoning: String,
-    pub accumulated_tool_calls: HashMap<i64, OpenAIToolCall>,
+    pub accumulated_tool_calls: IndexMap<i64, OpenAIToolCall>,
     pub events_str: String,
     pub stream_event_processor: Box<dyn StreamEventSink>,
     /// Track content block types by index
@@ -382,7 +385,7 @@ impl AnthropicSSEParser {
         Self {
             accumulated_content: String::new(),
             accumulated_reasoning: String::new(),
-            accumulated_tool_calls: HashMap::new(),
+            accumulated_tool_calls: IndexMap::new(),
             events_str: String::new(),
             stream_event_processor,
             content_blocks: HashMap::new(),
@@ -601,7 +604,7 @@ pub struct GeminiSSEParser {
     pub accumulated_content: String,
     /// The thinking streamed before the answer, kept so it can be stored with it.
     pub accumulated_reasoning: String,
-    pub accumulated_tool_calls: HashMap<i64, OpenAIToolCall>,
+    pub accumulated_tool_calls: IndexMap<i64, OpenAIToolCall>,
     pub events_str: String,
     pub stream_event_processor: Box<dyn StreamEventSink>,
     tool_call_index: i64,
@@ -615,7 +618,7 @@ impl GeminiSSEParser {
         Self {
             accumulated_content: String::new(),
             accumulated_reasoning: String::new(),
-            accumulated_tool_calls: HashMap::new(),
+            accumulated_tool_calls: IndexMap::new(),
             events_str: String::new(),
             stream_event_processor,
             tool_call_index: 0,
@@ -833,7 +836,7 @@ pub struct OpenAIResponsesSSEParser {
     pub accumulated_content: String,
     /// The reasoning summary streamed before the answer, kept so it can be stored with it.
     pub accumulated_reasoning: String,
-    pub accumulated_tool_calls: HashMap<String, OpenAIToolCall>,
+    pub accumulated_tool_calls: IndexMap<String, OpenAIToolCall>,
     /// Maps item_id -> (name, call_id) for function calls
     tool_call_metadata: HashMap<String, (String, String)>,
     /// Maps item_id -> accumulated arguments
@@ -855,7 +858,7 @@ impl OpenAIResponsesSSEParser {
         Self {
             accumulated_content: String::new(),
             accumulated_reasoning: String::new(),
-            accumulated_tool_calls: HashMap::new(),
+            accumulated_tool_calls: IndexMap::new(),
             tool_call_metadata: HashMap::new(),
             tool_call_arguments: HashMap::new(),
             events_str: String::new(),

backend/windmill-ai/src/types.rs

@@ -78,17 +78,50 @@ impl Default for OutputType {
 #[serde(tag = "kind", rename_all = "lowercase")]
 pub enum Memory {
     Off,
-    Auto {
-        #[serde(default)]
+    Window {
+        #[serde(default, deserialize_with = "deserialize_null_as_zero")]
         context_length: usize,
-        #[serde(default)]
+    },
+    /// Written before `window`. Its `memory_id` stays a fallback behind the run's memory id.
+    Auto {
+        #[serde(default, deserialize_with = "deserialize_null_as_zero")]
+        context_length: usize,
+        #[serde(default, deserialize_with = "deserialize_blank_as_none")]
         memory_id: Option<Uuid>,
     },
+    /// Written before a step had history inputs of its own, and read on its own where it remains.
     Manual {
         messages: Vec<OpenAIMessage>,
     },
 }
 
+// An editor form can leave `""` in a legacy baked id it never filled; it means no id rather than
+// failing every run of the step.
+fn deserialize_blank_as_none<'de, D: serde::Deserializer<'de>>(
+    deserializer: D,
+) -> Result<Option<Uuid>, D::Error> {
+    match <Option<String> as serde::Deserialize>::deserialize(deserializer)? {
+        Some(id) if !id.trim().is_empty() => Uuid::parse_str(id.trim())
+            .map(Some)
+            .map_err(serde::de::Error::custom),
+        _ => Ok(None),
+    }
+}
+
+// A count the editor's number field was cleared of is stored as `null`, which `default` does not
+// cover; it reads as 0, memory off, rather than failing every run of the step.
+fn deserialize_null_as_zero<'de, D: serde::Deserializer<'de>>(
+    deserializer: D,
+) -> Result<usize, D::Error> {
+    <Option<usize> as serde::Deserialize>::deserialize(deserializer).map(Option::unwrap_or_default)
+}
+
+fn deserialize_present<'de, D: serde::Deserializer<'de>>(
+    deserializer: D,
+) -> Result<Option<serde_json::Value>, D::Error> {
+    <serde_json::Value as serde::Deserialize>::deserialize(deserializer).map(Some)
+}
+
 #[derive(Deserialize)]
 struct AIAgentArgsRaw {
     provider: ProviderWithResource,
@@ -103,6 +136,12 @@ struct AIAgentArgsRaw {
     streaming: Option<bool>,
     max_iterations: Option<usize>,
     memory: Option<Memory>,
+    // A null must stay distinguishable from an absent key: a step whose own memory id evaluates to
+    // nothing runs stateless instead of falling back to the run's memory id.
+    #[serde(default, deserialize_with = "deserialize_present")]
+    memory_id: Option<serde_json::Value>,
+    #[serde(default)]
+    previous_messages: Option<Vec<OpenAIMessage>>,
     enabled_tools: Option<Vec<String>>,
     // Legacy field for backward compatibility
     messages_context_length: Option<usize>,
@@ -124,6 +163,10 @@ pub struct AIAgentArgs {
     pub streaming: Option<bool>,
     pub max_iterations: Option<usize>,
     pub memory: Option<Memory>,
+    /// Memory id set on the step, overriding the run's. Empty when its expression produced none.
+    pub memory_id: Option<String>,
+    /// History supplied by the flow, replayed without reading or writing memory.
+    pub previous_messages: Option<Vec<OpenAIMessage>>,
     /// Which of the agent's tools this run may call; `narrow_roster` holds what the names are and
     /// what `None` means.
     pub enabled_tools: Option<Vec<String>>,
@@ -139,12 +182,17 @@ impl From<AIAgentArgsRaw> for AIAgentArgs {
         });
 
         // Backward compatibility: if context_length is 0, use off mode
-        let memory = memory.map(|memory| {
-            if let Memory::Auto { context_length: 0, .. } = memory {
+        let memory = memory.map(|memory| match memory {
+            Memory::Auto { context_length: 0, .. } | Memory::Window { context_length: 0 } => {
                 Memory::Off
-            } else {
-                memory
             }
+            memory => memory,
+        });
+
+        let memory_id = raw.memory_id.map(|value| match value {
+            serde_json::Value::Null => String::new(),
+            serde_json::Value::String(s) => s.trim().to_string(),
+            value => value.to_string(),
         });
 
         AIAgentArgs {
@@ -159,6 +207,8 @@ impl From<AIAgentArgsRaw> for AIAgentArgs {
             streaming: raw.streaming,
             max_iterations: raw.max_iterations,
             memory,
+            memory_id,
+            previous_messages: raw.previous_messages,
             enabled_tools: raw.enabled_tools,
             credentials_check: raw.credentials_check.unwrap_or(false),
         }

backend/windmill-api-auth/src/lib.rs

@@ -1141,6 +1141,9 @@ impl NewToken {
 /// [`ensure_scopes_within_caller`] first (internal narrowing mints intentionally
 /// skip it, since their scopes derive from the action being authorized, not the
 /// caller's token).
+///
+/// A token the system mints for itself with an `expiration` needs a label reserved in
+/// `windmill_common::auth::is_user_token`, or its expiry alerts its owner (docs/auth-surface.md).
 pub async fn create_token_internal(
     tx: &mut sqlx::PgConnection,
     db: &DB,

backend/windmill-api-flow-conversations/src/lib.rs

@@ -1,6 +1,6 @@
 use axum::{
     extract::{Path, Query},
-    routing::{delete, get},
+    routing::{delete, get, post},
     Extension, Json, Router,
 };
 use chrono::{DateTime, Utc};
@@ -15,13 +15,14 @@ use windmill_common::{
     db::{UserDB, DB},
     error::{JsonResult, Result},
     flow_conversations::MessageType,
-    utils::{not_found_if_none, paginate, Pagination},
+    utils::{not_found_if_none, paginate, truncate_with_ellipsis, Pagination},
 };
 
 pub fn workspaced_service() -> Router {
     Router::new()
         .route("/list", get(list_conversations))
         .route("/delete/{conversation_id}", delete(delete_conversation))
+        .route("/update/{conversation_id}", post(update_conversation))
         .route("/{conversation_id}/messages", get(list_messages))
 }
 
@@ -36,11 +37,37 @@ pub struct FlowConversationMessage {
     pub created_seq: i64,
     pub step_name: Option<String>,
     pub success: bool,
+    /// On a tool row, the arguments the model wrote. For a Windmill tool these exclude the
+    /// inputs its step wires in. Null for a web search, whose query the provider does not
+    /// return.
+    pub tool_arguments: Option<String>,
+    /// On a tool row, the text the model got back, or what the call failed with; a web
+    /// search's citations.
+    pub tool_result: Option<String>,
+    /// On an answer, the thinking that produced it; on a tool row, the thinking that led to
+    /// the call. The agent job keeps the turn's thinking as one string.
+    pub reasoning: Option<String>,
+    /// The files a user message carried, as object-storage references
+    /// (`[{input, s3, storage?, filename?}]`).
+    pub attachments: Option<sqlx::types::JsonValue>,
+}
+
+/// Which conversations a listing holds. A test chat was started from the editor's test
+/// panel; a deployed one from the flow itself.
+#[derive(Deserialize, Default, Clone, Copy)]
+#[serde(rename_all = "lowercase")]
+pub enum ConversationKind {
+    Test,
+    /// The default: a deployed flow's chat should not surface someone's trial runs.
+    #[default]
+    Deployed,
+    All,
 }
 
 #[derive(Deserialize)]
 pub struct ListConversationsQuery {
     pub flow_path: Option<String>,
+    pub kind: Option<ConversationKind>,
 }
 
 #[derive(Deserialize)]
@@ -67,6 +94,7 @@ async fn list_conversations(
         "created_at",
         "updated_at",
         "created_by",
+        "is_test",
     ])
     .and_where_eq("workspace_id", "?".bind(&w_id));
 
@@ -74,6 +102,16 @@ async fn list_conversations(
         sqlb.and_where_eq("flow_path", "?".bind(flow_path));
     }
 
+    match query.kind.unwrap_or_default() {
+        ConversationKind::Test => {
+            sqlb.and_where_eq("is_test", "true");
+        }
+        ConversationKind::Deployed => {
+            sqlb.and_where_eq("is_test", "false");
+        }
+        ConversationKind::All => {}
+    }
+
     sqlb.order_by("updated_at", true)
         .limit(per_page as i64)
         .offset(offset as i64);
@@ -101,7 +139,7 @@ async fn delete_conversation(
     // Verify the conversation exists and belongs to the user
     let conversation = sqlx::query_as!(
         FlowConversation,
-        "SELECT id, workspace_id, flow_path, title, created_at, updated_at, created_by
+        "SELECT id, workspace_id, flow_path, title, created_at, updated_at, created_by, is_test
          FROM flow_conversation
          WHERE id = $1 AND workspace_id = $2",
         conversation_id,
@@ -148,6 +186,50 @@ async fn delete_conversation(
     Ok(format!("Conversation {} deleted", conversation_id))
 }
 
+#[derive(Deserialize)]
+pub struct UpdateConversation {
+    pub title: String,
+}
+
+async fn update_conversation(
+    authed: ApiAuthed,
+    Extension(user_db): Extension<UserDB>,
+    Path((w_id, conversation_id)): Path<(String, Uuid)>,
+    Json(update): Json<UpdateConversation>,
+) -> Result<String> {
+    // Postgres refuses a NUL in a text column, so it must not reach the query as a 500.
+    if update.title.contains('\0') {
+        return Err(windmill_common::error::Error::BadRequest(
+            "title cannot contain a NUL character".to_string(),
+        ));
+    }
+    // The column is VARCHAR(255) and the helper appends an ellipsis to what it cuts, so the
+    // bound it takes is three short of the column's. A longer title would otherwise reach
+    // Postgres as a 22001 and come back a 500.
+    let title = truncate_with_ellipsis(update.title.trim(), 252);
+
+    let mut tx = user_db.clone().begin(&authed).await?;
+
+    // `updated_at` is kept: the list is ordered by it, and a rename must not move the
+    // chat to the top the way a new turn does.
+    let updated = sqlx::query_scalar!(
+        "UPDATE flow_conversation SET title = $1, updated_at = updated_at
+         WHERE id = $2 AND workspace_id = $3
+         RETURNING id",
+        title,
+        conversation_id,
+        &w_id
+    )
+    .fetch_optional(&mut *tx)
+    .await?;
+
+    not_found_if_none(updated, "Conversation", conversation_id.to_string())?;
+
+    tx.commit().await?;
+
+    Ok(format!("Conversation {} updated", conversation_id))
+}
+
 async fn list_messages(
     authed: ApiAuthed,
     Extension(user_db): Extension<UserDB>,
@@ -178,7 +260,7 @@ async fn list_messages(
     let messages = if let Some(after_seq) = query.after_seq {
         sqlx::query_as!(
             FlowConversationMessage,
-            r#"SELECT id, conversation_id, message_type as "message_type: MessageType", content, job_id, created_at, created_seq, step_name, success
+            r#"SELECT id, conversation_id, message_type as "message_type: MessageType", content, job_id, created_at, created_seq, step_name, success, tool_arguments, tool_result, reasoning, attachments
              FROM flow_conversation_message
              WHERE conversation_id = $1
                AND created_seq > $2
@@ -195,9 +277,9 @@ async fn list_messages(
         // Fetch messages for this conversation, oldest first, but reverse the order of the messages for easy rendering on the frontend
         sqlx::query_as!(
             FlowConversationMessage,
-            r#"SELECT id, conversation_id, message_type as "message_type: MessageType", content, job_id, created_at, created_seq, step_name, success
+            r#"SELECT id, conversation_id, message_type as "message_type: MessageType", content, job_id, created_at, created_seq, step_name, success, tool_arguments, tool_result, reasoning, attachments
              FROM (
-                SELECT id, conversation_id, message_type, content, job_id, created_at, created_seq, step_name, success
+                SELECT id, conversation_id, message_type, content, job_id, created_at, created_seq, step_name, success, tool_arguments, tool_result, reasoning, attachments
                 FROM flow_conversation_message
                 WHERE conversation_id = $1
                 ORDER BY created_seq DESC

backend/windmill-api-flows/src/flows.rs

@@ -154,6 +154,7 @@ async fn list_flows(
             "favorite.path IS NOT NULL as starred",
             "ws_error_handler_muted",
             "o.labels",
+            "(o.value->>'chat_input_enabled')::bool as chat_input_enabled",
             "draft.email IS NOT NULL as is_draft",
             // Per-path draft owners as a JSON array; see scripts.rs for the rationale
             // (non-member superadmin identity fallback via `password`, legacy NULL-email row).
@@ -301,6 +302,10 @@ async fn list_flows(
                 ws_error_handler_muted: None,
                 deployment_msg: None,
                 labels: None,
+                chat_input_enabled: v
+                    .get("value")
+                    .and_then(|fv| fv.get("chat_input_enabled"))
+                    .and_then(|b| b.as_bool()),
                 // No deployed row to inherit folder labels from.
                 inherited_labels: None,
                 is_draft: true,

backend/windmill-api-integration-tests/tests/token_label_idor.rs

@@ -179,9 +179,11 @@ async fn test_trigger_token_labels_still_creatable(db: Pool<Postgres>) -> anyhow
         "http-test-user-2-cd34",
         "email-test-user-2-ef56",
         "my-ci-token",
-        // Minted client-side by the editor (every TypeScript editor load) and the debugger.
+        // Minted client-side by the editor (every TypeScript editor load), the debugger and
+        // the object-storage "Test from a worker" button.
         "Ephemeral lsp token",
         "debugger-token",
+        "ephemeral-test-connection: s3_bucket",
     ] {
         let resp = create_token_with_label(port, "SECRET_TOKEN_2", label).await;
         assert_eq!(

backend/windmill-api-jobs/src/execution.rs

@@ -26,7 +26,9 @@ use windmill_api_auth::{check_scopes, get_scope_tags, ApiAuthed};
 use windmill_common::{
     db::{UserDB, UserDbWithAuthed},
     error::{self, Error},
-    flow_conversations::{add_message_to_conversation_tx, MessageType},
+    flow_conversations::{
+        add_message_to_conversation_tx, message_attachments, MessageExtras, MessageType,
+    },
     get_latest_flow_version_info_for_path,
     jobs::{
         check_tag_available_for_workspace_internal, format_result, script_path_to_payload,
@@ -653,9 +655,11 @@ pub async fn set_flow_memory_id(
 pub async fn process_flow_run_query_params(
     tx: &mut sqlx::Transaction<'_, sqlx::Postgres>,
     job_id: Uuid,
+    w_id: &str,
+    flow_path: &str,
     run_query: &RunJobQuery,
 ) -> error::Result<()> {
-    if let Some(memory_id) = run_query.memory_id {
+    if let Some(memory_id) = run_query.memory_key(w_id, flow_path) {
         set_flow_memory_id(tx, job_id, memory_id).await?;
     }
     Ok(())
@@ -668,10 +672,19 @@ pub async fn handle_chat_conversation_messages(
     flow_path: &str,
     run_query: &RunJobQuery,
     user_message_raw: Option<&Box<serde_json::value::RawValue>>,
+    job_id: Uuid,
+    is_test: bool,
+    // The run's args, for the files the message carried.
+    args: &HashMap<String, Box<serde_json::value::RawValue>>,
 ) -> error::Result<()> {
-    let memory_id = run_query.memory_id.ok_or_else(|| {
+    // Names the query parameter rather than the field: it is not a flow argument, and
+    // supplying it as one is the first thing tried on reading `memory_id is required`.
+    let memory_id = run_query.memory_key(w_id, flow_path).ok_or_else(|| {
         windmill_common::error::Error::BadRequest(
-            "memory_id is required for chat-enabled flows".to_string(),
+            "memory_id is required for chat-enabled flows. Pass it as the `memory_id` query \
+             parameter, not as a flow argument: it names the conversation the turn belongs to, \
+             so a fresh UUID starts one and reusing a UUID continues it."
+                .to_string(),
         )
     })?;
 
@@ -695,17 +708,22 @@ pub async fn handle_chat_conversation_messages(
         &authed.username,
         &user_message,
         memory_id,
+        is_test,
     )
     .await?;
 
+    // The run this message started. The row keeps the files the message carried as
+    // references; its args are the only record of every other flow input, and nothing
+    // written later points at them: an assistant row holds the AI agent step's job.
     add_message_to_conversation_tx(
         tx,
         memory_id,
-        None,
+        Some(job_id),
         &user_message,
         MessageType::User,
         None,
         true,
+        Some(&MessageExtras { attachments: message_attachments(args), ..Default::default() }),
     )
     .await?;
 
@@ -813,7 +831,7 @@ pub async fn run_flow<'c>(
     .await?;
 
     // Set memory_id if provided (for agent memory)
-    if let Some(memory_id) = run_query.memory_id {
+    if let Some(memory_id) = run_query.memory_key(w_id, flow_path) {
         set_flow_memory_id(&mut tx, uuid, memory_id).await?;
     }
 
@@ -826,6 +844,9 @@ pub async fn run_flow<'c>(
             &flow_path.to_string(),
             &run_query,
             args.args.get("user_message"),
+            uuid,
+            false,
+            &args.args,
         )
         .await?;
     }

backend/windmill-api-jobs/src/jobs_export.rs

@@ -692,16 +692,64 @@ pub async fn delete_jobs(
     .await?
     .rows_affected();
 
-    let conversation_message_deleted = sqlx::query!(
+    // One row per message deleted, so the conversation of a chat losing several appears
+    // several times: the count is taken before the dedup below.
+    let mut conversation_ids: Vec<Uuid> = sqlx::query_scalar!(
         "DELETE FROM flow_conversation_message m
          USING flow_conversation c
-         WHERE m.conversation_id = c.id AND c.workspace_id = $1 AND m.job_id = ANY($2)",
+         WHERE m.conversation_id = c.id AND c.workspace_id = $1 AND m.job_id = ANY($2)
+         RETURNING m.conversation_id",
         &w_id,
         &job_ids
     )
-    .execute(&mut *tx)
-    .await?
-    .rows_affected();
+    .fetch_all(&mut *tx)
+    .await?;
+    let conversation_message_deleted = conversation_ids.len() as u64;
+
+    // Same rule, lock and statement order as retention (windmill_common::jobs::delete_jobs,
+    // which says why): a conversation with no messages left goes, and its memory with it.
+    conversation_ids.sort_unstable();
+    conversation_ids.dedup();
+    let mut memory_deleted = 0;
+    let mut conversation_deleted = 0;
+    if !conversation_ids.is_empty() {
+        sqlx::query_scalar!(
+            "SELECT id FROM flow_conversation WHERE id = ANY($1) AND workspace_id = $2 ORDER BY id FOR UPDATE",
+            &conversation_ids,
+            &w_id
+        )
+        .fetch_all(&mut *tx)
+        .await?;
+        memory_deleted = sqlx::query!(
+            "DELETE FROM ai_agent_memory a
+               USING flow_conversation c
+              WHERE c.id = ANY($1)
+                AND c.workspace_id = $2
+                AND a.conversation_id = c.id
+                AND a.workspace_id = c.workspace_id
+                AND NOT EXISTS (
+                    SELECT 1 FROM flow_conversation_message m WHERE m.conversation_id = c.id
+                )",
+            &conversation_ids,
+            &w_id
+        )
+        .execute(&mut *tx)
+        .await?
+        .rows_affected();
+        conversation_deleted = sqlx::query!(
+            "DELETE FROM flow_conversation c
+              WHERE c.id = ANY($1)
+                AND c.workspace_id = $2
+                AND NOT EXISTS (
+                    SELECT 1 FROM flow_conversation_message m WHERE m.conversation_id = c.id
+                )",
+            &conversation_ids,
+            &w_id
+        )
+        .execute(&mut *tx)
+        .await?
+        .rows_affected();
+    }
 
     // Resolutions are not exported, so a delete-then-reimport of the same UUID would
     // otherwise resurrect the old annotation on a job that never carried one.
@@ -737,6 +785,8 @@ pub async fn delete_jobs(
         + zombie_deleted
         + dispatch_event_deleted
         + conversation_message_deleted
+        + memory_deleted
+        + conversation_deleted
         + resolution_deleted
         + jobs_deleted;
 

backend/windmill-api-jobs/src/types.rs

@@ -47,13 +47,25 @@ pub struct RunJobQuery {
     pub cache_ignore_s3_path: Option<bool>,
     pub skip_preprocessor: Option<bool>,
     pub poll_delay_ms: Option<u64>,
-    pub memory_id: Option<Uuid>,
+    /// Any string; see [`RunJobQuery::memory_key`].
+    pub memory_id: Option<String>,
     pub trigger_external_id: Option<String>,
     pub service_name: Option<String>,
     pub suspended_mode: Option<bool>,
 }
 
 impl RunJobQuery {
+    /// The memory id as stored in `flow_status.memory_id`: a uuid is kept, any other string hashed
+    /// within the workspace and the flow being run.
+    pub fn memory_key(&self, workspace_id: &str, flow_path: &str) -> Option<Uuid> {
+        self.memory_id
+            .as_deref()
+            .filter(|memory_id| !memory_id.trim().is_empty())
+            .map(|memory_id| {
+                windmill_common::flow_conversations::memory_key(workspace_id, flow_path, memory_id)
+            })
+    }
+
     pub async fn get_scheduled_for(
         &self,
         db: &DB,

backend/windmill-api-users/src/users.rs

@@ -3882,8 +3882,8 @@ async fn update_token_label(
     Path(token_prefix): Path<String>,
     Json(req): Json<UpdateTokenLabelRequest>,
 ) -> Result<String> {
-    // The new label must not collide with a system-token namespace (`session`,
-    // `ephemeral*`, `debugger-token`, `mcp-oauth-*`): those labels are
+    // The new label must not collide with a system-token namespace (see
+    // `windmill_common::auth::is_user_token`): those labels are
     // load-bearing, and a user-set collision would orphan the token — hidden
     // from the UI (`isUserToken`) and rejected by the editability guard below —
     // while it still authenticates. (`is_user_token(None)` is true, so clearing
@@ -3922,6 +3922,9 @@ async fn update_token_label(
                  AND lower(label) NOT LIKE 'ephemeral%'
                  AND label <> 'debugger-token'
                  AND label NOT LIKE 'mcp-oauth-%'
+                 AND NOT starts_with(label, 'embed_app:')
+                 AND NOT starts_with(label, 'sdk_app:')
+                 AND NOT starts_with(label, 'impersonation:')
              ))
            RETURNING token_prefix",
         req.label.as_deref(),

backend/windmill-api-workspaces/src/workspaces.rs

@@ -1308,26 +1308,22 @@ async fn get_git_sync_deploy_mode(
 
     let configured = !settings.repositories.is_empty();
 
-    // Auto-pull runs only on Enterprise-licensed instances (see poll_git_auto_pull);
-    // without a caller branch there is nothing to match. Either way deploy_on_push
-    // stays false and the caller falls back (git push via CI, or wmill sync push).
+    // Auto-pull runs only in builds that compile the poller (`private`); without a
+    // caller branch there is nothing to match. Either way deploy_on_push stays
+    // false and the caller falls back (git push via CI, or wmill sync push).
     let Some(branch) = q.branch.as_deref() else {
         return Ok(Json(GitSyncDeployMode {
             configured,
             deploy_on_push: false,
         }));
     };
-    let licensed = matches!(
-        windmill_common::ee_oss::get_license_plan().await,
-        windmill_common::ee_oss::LicensePlan::Enterprise
-    );
 
     // Count the auto-pull repos that would deploy this branch. We deliberately do
     // not check the caller's remote URL: with exactly one such repo the local
     // checkout is unambiguously it, and with several we can't tell which is the
     // caller's, so we report false and let the CLI ask the user.
     let mut matches = 0u32;
-    if licensed && !root_deleted {
+    if cfg!(feature = "private") && !root_deleted {
         for repo in &settings.repositories {
             let Some(auto_pull) = repo.auto_pull.as_ref() else {
                 continue;
@@ -3762,54 +3758,6 @@ fn cleanup_legacy_git_sync_settings_in_memory(
 #[cfg(not(feature = "enterprise"))]
 const CE_GIT_SYNC_MAX_USERS: i64 = 2;
 
-/// Auto-pull is licensed per plan, not just per build: the poller only serves
-/// Enterprise plans at runtime, so the save path must reject the setting too —
-/// otherwise an EE binary without the plan could still register a webhook and
-/// receive webhook-driven pulls.
-#[cfg(feature = "enterprise")]
-async fn check_git_sync_ee_license(feature: &str) -> Result<()> {
-    if !matches!(
-        windmill_common::ee_oss::get_license_plan().await,
-        windmill_common::ee_oss::LicensePlan::Enterprise
-    ) {
-        return Err(Error::BadRequest(format!(
-            "{feature} requires an Enterprise license"
-        )));
-    }
-    Ok(())
-}
-
-#[cfg(feature = "enterprise")]
-async fn check_auto_pull_license() -> Result<()> {
-    check_git_sync_ee_license("Automatic pull from git").await
-}
-
-/// In-app PR creation (promotion/fork deploy branches) drives GitHub API calls
-/// from the deploy completion hook; runtime-gate it like auto-pull.
-#[cfg(feature = "enterprise")]
-async fn check_open_prs_license<'a>(
-    mut repos: impl Iterator<Item = &'a windmill_common::workspaces::GitRepositorySettings>,
-) -> Result<()> {
-    if repos.any(|r| r.promotion_open_prs || r.fork_open_prs) {
-        check_git_sync_ee_license("Opening pull requests from Windmill").await?;
-    }
-    Ok(())
-}
-
-/// Promotion mode (`use_individual_branch`: per-item `wm_deploy/**` deploy
-/// branches) is an EE feature; runtime-gate it like auto-pull and PR creation
-/// so an enterprise binary without an active plan can't enable it via either
-/// git-sync edit endpoint.
-#[cfg(feature = "enterprise")]
-async fn check_promotion_license<'a>(
-    mut repos: impl Iterator<Item = &'a windmill_common::workspaces::GitRepositorySettings>,
-) -> Result<()> {
-    if repos.any(|r| r.use_individual_branch.unwrap_or(false)) {
-        check_git_sync_ee_license("Promotion mode").await?;
-    }
-    Ok(())
-}
-
 /// Promotion on a dev workspace needs the dev-aware sync script (hub >= 28796):
 /// an older pinned script bundles a CLI that force-disables per-item branches
 /// on every fork, so enabling promotion would silently keep deploying to the
@@ -4061,18 +4009,6 @@ async fn edit_git_sync_config(
             ));
         }
         #[cfg(feature = "enterprise")]
-        if git_sync_settings
-            .repositories
-            .iter()
-            .any(|r| r.auto_pull.as_ref().is_some_and(|a| a.enabled))
-        {
-            check_auto_pull_license().await?;
-        }
-        #[cfg(feature = "enterprise")]
-        check_open_prs_license(git_sync_settings.repositories.iter()).await?;
-        #[cfg(feature = "enterprise")]
-        check_promotion_license(git_sync_settings.repositories.iter()).await?;
-        #[cfg(feature = "enterprise")]
         check_dev_promotion_script_version(&db, &w_id, git_sync_settings.repositories.iter())
             .await?;
         #[cfg(all(feature = "enterprise", feature = "private"))]
@@ -4310,19 +4246,6 @@ async fn edit_git_sync_repository(
         ));
     }
     #[cfg(feature = "enterprise")]
-    if new_config
-        .repository
-        .auto_pull
-        .as_ref()
-        .is_some_and(|a| a.enabled)
-    {
-        check_auto_pull_license().await?;
-    }
-    #[cfg(feature = "enterprise")]
-    check_open_prs_license(std::iter::once(&new_config.repository)).await?;
-    #[cfg(feature = "enterprise")]
-    check_promotion_license(std::iter::once(&new_config.repository)).await?;
-    #[cfg(feature = "enterprise")]
     check_dev_promotion_script_version(&db, &w_id, std::iter::once(&new_config.repository)).await?;
     #[cfg(all(feature = "enterprise", feature = "private"))]
     check_dev_promotion_targets_parent_repo(&db, &w_id, std::iter::once(&new_config.repository))
@@ -4428,13 +4351,6 @@ async fn edit_git_sync_repository(
             }
             _ => {}
         }
-        // The request-side license gate above only saw the submitted config; the
-        // preservation can resurrect an enabled auto_pull (None arm), so re-check
-        // the effective state before it gets written and reconciled.
-        #[cfg(feature = "enterprise")]
-        if updated.auto_pull.as_ref().is_some_and(|a| a.enabled) {
-            check_auto_pull_license().await?;
-        }
         *existing_repo = updated;
     } else {
         // Repository doesn't exist, add it as a new repository

backend/windmill-api/openapi.yaml

@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.812.0
+  version: 1.814.0
   title: Windmill API
 
   contact:
@@ -11267,11 +11267,10 @@ paths:
         - $ref: "#/components/parameters/NewJobId"
         - $ref: "#/components/parameters/SkipPreprocessor"
         - name: memory_id
-          description: memory ID for chat-enabled flows
+          description: Memory id for the flow's AI agent steps. A uuid is used as is; any other string is hashed within the workspace and flow, so the same string always names the same memory of that flow.
           in: query
           schema:
             type: string
-            format: uuid
 
       requestBody:
         description: script args
@@ -11308,11 +11307,10 @@ paths:
         - $ref: "#/components/parameters/NewJobId"
         - $ref: "#/components/parameters/SkipPreprocessor"
         - name: memory_id
-          description: memory ID for chat-enabled flows
+          description: Memory id for the flow's AI agent steps. A uuid is used as is; any other string is hashed within the workspace and flow, so the same string always names the same memory of that flow.
           in: query
           schema:
             type: string
-            format: uuid
 
       requestBody:
         description: script args
@@ -11349,11 +11347,10 @@ paths:
         - $ref: "#/components/parameters/NewJobId"
         - $ref: "#/components/parameters/SkipPreprocessor"
         - name: memory_id
-          description: memory ID for chat-enabled flows
+          description: Memory id for the flow's AI agent steps. A uuid is used as is; any other string is hashed within the workspace and flow, so the same string always names the same memory of that flow.
           in: query
           schema:
             type: string
-            format: uuid
 
       responses:
         "200":
@@ -11376,11 +11373,10 @@ paths:
         - $ref: "#/components/parameters/NewJobId"
         - $ref: "#/components/parameters/SkipPreprocessor"
         - name: memory_id
-          description: memory ID for chat-enabled flows
+          description: Memory id for the flow's AI agent steps. A uuid is used as is; any other string is hashed within the workspace and flow, so the same string always names the same memory of that flow.
           in: query
           schema:
             type: string
-            format: uuid
         - name: poll_delay_ms
           description: delay between polling for job updates in milliseconds
           in: query
@@ -11418,11 +11414,10 @@ paths:
         - $ref: "#/components/parameters/NewJobId"
         - $ref: "#/components/parameters/SkipPreprocessor"
         - name: memory_id
-          description: memory ID for chat-enabled flows
+          description: Memory id for the flow's AI agent steps. A uuid is used as is; any other string is hashed within the workspace and flow, so the same string always names the same memory of that flow.
           in: query
           schema:
             type: string
-            format: uuid
         - name: poll_delay_ms
           description: delay between polling for job updates in milliseconds
           in: query
@@ -11458,11 +11453,10 @@ paths:
         - $ref: "#/components/parameters/NewJobId"
         - $ref: "#/components/parameters/SkipPreprocessor"
         - name: memory_id
-          description: memory ID for chat-enabled flows
+          description: Memory id for the flow's AI agent steps. A uuid is used as is; any other string is hashed within the workspace and flow, so the same string always names the same memory of that flow.
           in: query
           schema:
             type: string
-            format: uuid
         - name: poll_delay_ms
           description: delay between polling for job updates in milliseconds
           in: query
@@ -11506,11 +11500,10 @@ paths:
         - $ref: "#/components/parameters/NewJobId"
         - $ref: "#/components/parameters/SkipPreprocessor"
         - name: memory_id
-          description: memory ID for chat-enabled flows
+          description: Memory id for the flow's AI agent steps. A uuid is used as is; any other string is hashed within the workspace and flow, so the same string always names the same memory of that flow.
           in: query
           schema:
             type: string
-            format: uuid
         - name: poll_delay_ms
           description: delay between polling for job updates in milliseconds
           in: query
@@ -12010,6 +12003,13 @@ paths:
                       properties:
                         draft_only:
                           type: boolean
+                        chat_input_enabled:
+                          type: boolean
+                          description: |
+                            `chat_input_enabled` of the flow's value,
+                            projected so the list can mark flows that open
+                            as a chat. Omitted when the value has no such
+                            field.
                         is_draft:
                           type: boolean
                           description: |
@@ -12457,6 +12457,15 @@ paths:
           in: query
           schema:
             type: string
+        - name: kind
+          description: which conversations to list - the flow editor's test chats, the deployed flow's own (the default), or both
+          in: query
+          schema:
+            type: string
+            enum:
+              - test
+              - deployed
+              - all
       responses:
         "200":
           description: flow conversations list
@@ -12467,6 +12476,40 @@ paths:
                 items:
                   $ref: "#/components/schemas/FlowConversation"
 
+  /w/{workspace}/flow_conversations/update/{conversation_id}:
+    post:
+      summary: rename flow conversation
+      operationId: updateFlowConversation
+      tags:
+        - flow_conversations
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - name: conversation_id
+          description: conversation id
+          in: path
+          required: true
+          schema:
+            type: string
+            format: uuid
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [title]
+              properties:
+                title:
+                  type: string
+                  description: the chat's name
+      responses:
+        "200":
+          description: flow conversation updated
+          content:
+            text/plain:
+              schema:
+                type: string
+
   /w/{workspace}/flow_conversations/delete/{conversation_id}:
     delete:
       summary: delete flow conversation
@@ -14861,11 +14904,10 @@ paths:
           schema:
             type: boolean
         - name: memory_id
-          description: memory ID for chat-enabled flows
+          description: Memory id for the flow's AI agent steps. A uuid is used as is; any other string is hashed within the workspace and flow, so the same string always names the same memory of that flow.
           in: query
           schema:
             type: string
-            format: uuid
       requestBody:
         description: flow args
         required: true
@@ -14919,11 +14961,10 @@ paths:
           schema:
             type: boolean
         - name: memory_id
-          description: memory ID for chat-enabled flows
+          description: Memory id for the flow's AI agent steps. A uuid is used as is; any other string is hashed within the workspace and flow, so the same string always names the same memory of that flow.
           in: query
           schema:
             type: string
-            format: uuid
       requestBody:
         description: flow args
         required: true
@@ -15411,11 +15452,10 @@ paths:
             type: boolean
         - $ref: "#/components/parameters/NewJobId"
         - name: memory_id
-          description: memory ID for chat-enabled flows
+          description: Memory id for the flow's AI agent steps. A uuid is used as is; any other string is hashed within the workspace and flow, so the same string always names the same memory of that flow.
           in: query
           schema:
             type: string
-            format: uuid
 
       requestBody:
         description: preview
@@ -15443,11 +15483,10 @@ paths:
       parameters:
         - $ref: "#/components/parameters/WorkspaceId"
         - name: memory_id
-          description: memory ID for chat-enabled flows
+          description: Memory id for the flow's AI agent steps. A uuid is used as is; any other string is hashed within the workspace and flow, so the same string always names the same memory of that flow.
           in: query
           schema:
             type: string
-            format: uuid
 
       requestBody:
         description: preview
@@ -28294,7 +28333,7 @@ components:
     FlowConversation:
       type: object
       required:
-        [id, workspace_id, flow_path, created_at, updated_at, created_by]
+        [id, workspace_id, flow_path, created_at, updated_at, created_by, is_test]
       properties:
         id:
           type: string
@@ -28321,6 +28360,9 @@ components:
         created_by:
           type: string
           description: Username who created the conversation
+        is_test:
+          type: boolean
+          description: Started from the flow editor's test panel rather than a deployed run
 
     FlowConversationMessage:
       type: object
@@ -28360,6 +28402,50 @@ components:
         success:
           type: boolean
           description: Whether the message is a success
+        tool_arguments:
+          type: string
+          nullable: true
+          description: >-
+            On a tool row, the arguments the model wrote for the call. For a script, flow or
+            AI agent tool these exclude the inputs its step wires in, which only the tool's
+            job holds. Null for a provider-native web search, whose query the provider does
+            not return.
+        tool_result:
+          type: string
+          nullable: true
+          description: >-
+            On a tool row, the text the model got back from the call, or what the call
+            failed with — the row's own text names the tool rather than the reason. For a
+            provider-native web search, its citations.
+        reasoning:
+          type: string
+          nullable: true
+          description: >-
+            On an answer, the thinking that produced it; on a tool row, the thinking that
+            led to the call. Each round's thinking is on one row. The agent job's result
+            keeps the turn's thinking as a single string.
+        attachments:
+          type: array
+          nullable: true
+          description: >-
+            The files a user message carried, as object-storage references: every flow
+            input other than user_message that held one or a list of them, at most 20. Never
+            file bytes or a presigned URL.
+          items:
+            type: object
+            required: [input, s3]
+            properties:
+              input:
+                type: string
+                description: The flow input that held the file
+              s3:
+                type: string
+                description: The file's key in object storage
+              storage:
+                type: string
+                description: The secondary storage holding the file, absent for the primary one
+              filename:
+                type: string
 
     EndpointTool:
       type: object
@@ -28951,6 +29037,12 @@ components:
           type: boolean
         has_deploy_errors:
           type: boolean
+        chat_input_enabled:
+          type: boolean
+          description: >-
+            flow-only. `chat_input_enabled` of the flow's value, projected so
+            the list can mark flows that open as a chat. Omitted when the
+            value has no such field.
         raw_app:
           type: boolean
         execution_mode:

backend/windmill-api/src/apps.rs

@@ -57,7 +57,7 @@ use windmill_audit::audit_oss::{audit_log, AuditAuthorable};
 use windmill_audit::ActionKind;
 use windmill_common::{
     apps::{AppScriptId, ListAppQuery, APP_WORKSPACED_ROUTE},
-    auth::TOKEN_PREFIX_LEN,
+    auth::{APP_EMBED_TOKEN_LABEL_PREFIX, RAW_APP_SDK_TOKEN_LABEL_PREFIX, TOKEN_PREFIX_LEN},
     cache::{self, future::FutureCachedExt},
     db::{DbWithOptAuthed, UserDB},
     error::{to_anyhow, Error, JsonResult, Result},
@@ -1522,7 +1522,10 @@ async fn mint_raw_app_sdk_token(
                 scopes.push(windmill_api_auth::scopes::GUEST_SENTINEL.to_string());
                 (label, exp)
             }
-            None => (format!("sdk_app:{app_path}"), requested_exp),
+            None => (
+                format!("{RAW_APP_SDK_TOKEN_LABEL_PREFIX}{app_path}"),
+                requested_exp,
+            ),
         };
     let token_config = NewToken::new(
         Some(label),
@@ -1804,7 +1807,10 @@ pub async fn mint_app_embed_token(
                     scopes.push(windmill_api_auth::scopes::GUEST_SENTINEL.to_string());
                     (label, exp)
                 }
-                None => (format!("embed_app:{app_path}"), requested_exp),
+                None => (
+                    format!("{APP_EMBED_TOKEN_LABEL_PREFIX}{app_path}"),
+                    requested_exp,
+                ),
             };
         let token_config = NewToken::new(
             Some(label),
@@ -4304,11 +4310,11 @@ async fn execute_component(
         }
     }
 
-    let is_flow = payload
+    let flow_path = payload
         .path
-        .as_ref()
-        .map(|p| p.starts_with("flow/"))
-        .unwrap_or(false);
+        .as_deref()
+        .and_then(|path| path.strip_prefix("flow/"))
+        .map(str::to_string);
 
     // Tag for inline-script jobs is read from the deployed policy in run mode;
     // only preview mode (editor) honors the client-supplied tag. This applies to
@@ -4438,8 +4444,9 @@ async fn execute_component(
 
     // Apply runnable query parameters if provided
     if let Some(ref run_query) = payload.run_query_params {
-        if is_flow {
-            crate::jobs::process_flow_run_query_params(&mut tx, uuid, run_query).await?;
+        if let Some(flow_path) = flow_path.as_deref() {
+            crate::jobs::process_flow_run_query_params(&mut tx, uuid, &w_id, flow_path, run_query)
+                .await?;
         }
     }
 

backend/windmill-api/src/jobs.rs

@@ -4369,12 +4369,12 @@ async fn count_completed_jobs_detail(
     Query(query): Query<CountCompletedJobsQuery>,
 ) -> error::JsonResult<i64> {
     let mut sqlb = SqlBuilder::select_from("v2_job_completed");
-    //FOR RLS
-    sqlb.join("v2_job USING (id)");
     sqlb.field("COUNT(*) as count");
 
+    // Filtering on v2_job.workspace_id instead would keep the planner off
+    // ix_job_workspace_id_completed_at_all and scan the whole retention window.
     if !(w_id == "admins" && query.all_workspaces.unwrap_or(false)) {
-        sqlb.and_where_eq("v2_job.workspace_id", "?".bind(&w_id));
+        sqlb.and_where_eq("v2_job_completed.workspace_id", "?".bind(&w_id));
     }
 
     if let Some(after_s_ago) = query.completed_after_s_ago {
@@ -4393,6 +4393,7 @@ async fn count_completed_jobs_detail(
     }
 
     if let Some(tags) = query.tags {
+        sqlb.join("v2_job USING (id)");
         sqlb.and_where_in(
             "v2_job.tag",
             &tags.split(",").map(|t| quote(t)).collect::<Vec<_>>(),
@@ -4400,7 +4401,19 @@ async fn count_completed_jobs_detail(
     }
 
     let sql = sqlb.sql()?;
-    let stats = sqlx::query_scalar::<_, i64>(&sql).fetch_one(&db).await?;
+    let mut tx = db.begin().await?;
+    set_list_jobs_statement_timeout(&mut tx).await?;
+    let stats = sqlx::query_scalar::<_, i64>(&sql)
+        .fetch_one(&mut *tx)
+        .await
+        .map_err(|e| {
+            list_jobs_timeout_error(
+                e,
+                "Counting completed jobs",
+                "Lower completed_after_s_ago or narrow the filters.",
+            )
+        })?;
+    tx.commit().await?;
 
     Ok(Json(stats))
 }
@@ -4429,6 +4442,33 @@ lazy_static::lazy_static! {
             .unwrap_or(30);
 }
 
+/// A client that gives up does not cancel its query, so without this bound every retry of a
+/// slow filter stacks another scan running until the connection-wide 5min timeout.
+async fn set_list_jobs_statement_timeout(tx: &mut Transaction<'_, Postgres>) -> error::Result<()> {
+    let timeout_secs = *LIST_JOBS_STATEMENT_TIMEOUT_SECS;
+    if timeout_secs > 0 {
+        sqlx::query(&format!("SET LOCAL statement_timeout = '{timeout_secs}s'"))
+            .execute(&mut **tx)
+            .await?;
+    }
+    Ok(())
+}
+
+fn list_jobs_timeout_error(e: sqlx::Error, action: &str, hint: &str) -> Error {
+    let timeout_secs = *LIST_JOBS_STATEMENT_TIMEOUT_SECS;
+    match e {
+        sqlx::Error::Database(ref db_err)
+            if timeout_secs > 0 && db_err.code().as_deref() == Some("57014") =>
+        {
+            Error::Generic(
+                StatusCode::BAD_REQUEST,
+                format!("{action} took more than {timeout_secs}s and was stopped. {hint}"),
+            )
+        }
+        e => e.into(),
+    }
+}
+
 async fn list_jobs(
     authed: ApiAuthed,
     Extension(user_db): Extension<UserDB>,
@@ -4545,32 +4585,14 @@ async fn list_jobs(
     };
     // tracing::info!("sql: {}", &sql);
     let mut tx: Transaction<'_, Postgres> = user_db.begin(&authed).await?;
-
-    // A client that gives up does not cancel its query, so without this bound every retry of a
-    // slow filter stacks another scan running until the connection-wide 5min timeout.
-    let timeout_secs = *LIST_JOBS_STATEMENT_TIMEOUT_SECS;
-    if timeout_secs > 0 {
-        sqlx::query(&format!("SET LOCAL statement_timeout = '{timeout_secs}s'"))
-            .execute(&mut *tx)
-            .await?;
-    }
+    set_list_jobs_statement_timeout(&mut tx).await?;
 
     let jobs: Vec<UnifiedJob> = sqlx::query_as(&sql)
         .fetch_all(&mut *tx)
         .warn_after_seconds_with_sql(5, format!("list_jobs: {}", sql))
         .await
-        .map_err(|e| match e {
-            sqlx::Error::Database(ref db_err)
-                if timeout_secs > 0 && db_err.code().as_deref() == Some("57014") =>
-            {
-                Error::Generic(
-                    StatusCode::BAD_REQUEST,
-                    format!(
-                        "Listing jobs took more than {timeout_secs}s and was stopped. Set a start date or narrow the filters."
-                    ),
-                )
-            }
-            e => e.into(),
+        .map_err(|e| {
+            list_jobs_timeout_error(e, "Listing jobs", "Set a start date or narrow the filters.")
         })?;
     tx.commit().await?;
 
@@ -9540,7 +9562,7 @@ async fn run_preview_flow_job(
     .await?;
 
     // Set memory_id if provided (for agent memory)
-    if let Some(memory_id) = run_query.memory_id {
+    if let Some(memory_id) = run_query.memory_key(&w_id, &flow_path) {
         set_flow_memory_id(&mut tx, uuid, memory_id).await?;
     }
 
@@ -9553,6 +9575,10 @@ async fn run_preview_flow_job(
             &flow_path,
             &run_query,
             user_message.as_ref(),
+            uuid,
+            // Run from the editor's test panel: a trial, not a real conversation.
+            true,
+            &flow_args,
         )
         .await?;
     }

backend/windmill-api/src/runnables.rs

@@ -116,6 +116,10 @@ struct RunnableItem {
     use_codebase: Option<bool>,
     #[serde(skip_serializing_if = "Option::is_none")]
     has_deploy_errors: Option<bool>,
+    // flow-only: projected from the value so the home list can badge flows that
+    // open as a chat without fetching every flow's value.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    chat_input_enabled: Option<bool>,
     // app-only
     #[serde(skip_serializing_if = "Option::is_none")]
     raw_app: Option<bool>,
@@ -274,7 +278,7 @@ fn branch_sqls() -> Branches {
                 o.ws_error_handler_muted, o.created_at as edited_at, \
                 o.hash, o.language::text as language, o.kind::text as script_kind, o.auto_kind, \
                 o.codebase IS NOT NULL as use_codebase, \
-                (o.lock_error_logs IS NOT NULL) as has_deploy_errors, \
+                (o.lock_error_logs IS NOT NULL) as has_deploy_errors, NULL::bool as chat_input_enabled, \
                 NULL::bool as raw_app, NULL::text as execution_mode, NULL::bigint as id, NULL::bigint as version, \
                 o.created_at as sort_time, lower(COALESCE(NULLIF(o.summary, ''), o.path)) as sort_name, o.hash as tiebreak \
          FROM script o \
@@ -291,6 +295,7 @@ fn branch_sqls() -> Branches {
                 o.ws_error_handler_muted, o.edited_at, \
                 NULL::bigint as hash, NULL::text as language, NULL::text as script_kind, NULL::text as auto_kind, \
                 NULL::bool as use_codebase, NULL::bool as has_deploy_errors, \
+                (o.value->>'chat_input_enabled')::bool as chat_input_enabled, \
                 NULL::bool as raw_app, NULL::text as execution_mode, NULL::bigint as id, NULL::bigint as version, \
                 o.edited_at as sort_time, lower(COALESCE(NULLIF(o.summary, ''), o.path)) as sort_name, 0::bigint as tiebreak \
          FROM flow o \
@@ -306,7 +311,7 @@ fn branch_sqls() -> Branches {
                 {draft_users}, o.labels, folder_labels(o.workspace_id, o.path) as inherited_labels, \
                 NULL::bool as ws_error_handler_muted, av.created_at as edited_at, \
                 NULL::bigint as hash, NULL::text as language, NULL::text as script_kind, NULL::text as auto_kind, \
-                NULL::bool as use_codebase, NULL::bool as has_deploy_errors, \
+                NULL::bool as use_codebase, NULL::bool as has_deploy_errors, NULL::bool as chat_input_enabled, \
                 av.raw_app, o.policy->>'execution_mode' as execution_mode, o.id, \
                 o.versions[array_upper(o.versions, 1)] as version, \
                 COALESCE(av.created_at, 'epoch'::timestamptz) as sort_time, lower(COALESCE(NULLIF(o.summary, ''), o.path)) as sort_name, 0::bigint as tiebreak \
@@ -344,11 +349,21 @@ fn draft_branch_sql(kind: &str) -> String {
     let kind_cols = match kind {
         "script" => {
             "d.value->>'language' as language, d.value->>'kind' as script_kind, \
-                     d.value->>'auto_kind' as auto_kind, false as raw_app"
+                     d.value->>'auto_kind' as auto_kind, false as raw_app, \
+                     NULL::bool as chat_input_enabled"
+        }
+        // Type-guarded rather than a bare `::bool` cast: draft JSON is stored
+        // unvalidated, so a malformed value must yield NULL, not abort the list,
+        // and the string "true" must not count as enabled.
+        "flow" => {
+            "NULL::text as language, NULL::text as script_kind, NULL::text as auto_kind, \
+              false as raw_app, \
+              CASE WHEN json_typeof(d.value->'value'->'chat_input_enabled') = 'boolean' \
+                   THEN (d.value->'value'->>'chat_input_enabled')::bool END as chat_input_enabled"
         }
         _ => {
             "NULL::text as language, NULL::text as script_kind, NULL::text as auto_kind, \
-              (d.typ = 'raw_app') as raw_app"
+              (d.typ = 'raw_app') as raw_app, NULL::bool as chat_input_enabled"
         }
     };
     format!(
@@ -359,7 +374,7 @@ fn draft_branch_sql(kind: &str) -> String {
                 NULL::text[] as labels, NULL::text[] as inherited_labels, \
                 NULL::bool as ws_error_handler_muted, o.created_at as edited_at, \
                 NULL::bigint as hash, o.language, o.script_kind, o.auto_kind, \
-                NULL::bool as use_codebase, NULL::bool as has_deploy_errors, \
+                NULL::bool as use_codebase, NULL::bool as has_deploy_errors, o.chat_input_enabled, \
                 o.raw_app, NULL::text as execution_mode, NULL::bigint as id, NULL::bigint as version, \
                 o.created_at as sort_time, lower(COALESCE(NULLIF(o.summary, ''), o.draft_path, o.path)) as sort_name, 0::bigint as tiebreak \
          FROM ( \

backend/windmill-common/Cargo.toml

@@ -33,6 +33,7 @@ path = "src/lib.rs"
 tar.workspace = true
 hmac.workspace = true
 sha2.workspace = true
+sha1.workspace = true
 thiserror.workspace = true
 anyhow.workspace = true
 serde.workspace = true

backend/windmill-common/src/auth.rs

@@ -19,10 +19,11 @@ use crate::{
 };
 
 /// Whether `label` denotes a user-created token rather than a system token
-/// (`session`, `guest_session`, `ephemeral*`, `debugger-token`, `mcp-oauth-*`). System-token
-/// labels are load-bearing — session cleanup, super_admin propagation, expiry
-/// notifications and username overrides all key off them — so they must not be
-/// user-editable. `None` (no label) is treated as a user token.
+/// (`session`, `guest_session`, `ephemeral*`, `debugger-token`, `mcp-oauth-*`,
+/// `embed_app:*`, `sdk_app:*`, `impersonation:*`). System-token labels are load-bearing —
+/// session cleanup, super_admin propagation, expiry notifications and username overrides
+/// all key off them — so they must not be user-editable. `None` (no label) is treated as
+/// a user token.
 ///
 /// This is the canonical copy. When updating it, also update its mirrors:
 /// - the `update_token_label` editability guard (SQL `WHERE`) in
@@ -40,15 +41,30 @@ pub fn is_user_token(label: Option<&str>) -> bool {
                 && !l.to_lowercase().starts_with("ephemeral")
                 && l != "debugger-token"
                 && !l.starts_with("mcp-oauth-")
+                // Short-lived tokens the server mints per app open or per service-account
+                // impersonation (EE `users_ee.rs`) and nobody manages, so an expiry warning
+                // for one is noise.
+                && !l.starts_with(APP_EMBED_TOKEN_LABEL_PREFIX)
+                && !l.starts_with(RAW_APP_SDK_TOKEN_LABEL_PREFIX)
+                && !l.starts_with("impersonation:")
         }
     }
 }
 
+/// Label prefix, followed by the app path, of the token an app viewer's sandboxed iframe
+/// runs with. Reserved in [`is_user_token`], whose SQL and frontend mirrors spell it out.
+pub const APP_EMBED_TOKEN_LABEL_PREFIX: &str = "embed_app:";
+
+/// Label prefix, followed by the app path, of the token a raw app's bundle uses for the
+/// frontend SDK. Reserved in [`is_user_token`], whose SQL and frontend mirrors spell it out.
+pub const RAW_APP_SDK_TOKEN_LABEL_PREFIX: &str = "sdk_app:";
+
 /// Whether `label` belongs to a namespace only the server mints, and which therefore must be
 /// rejected by `create_token`. Narrower than [`is_user_token`], which also drives label
-/// editability and expiry notifications and can afford to reserve more: `Ephemeral lsp token`
-/// and `debugger-token` are minted by the editor and the debugger through that same handler,
-/// so reserving them would break those features.
+/// editability and expiry notifications and can afford to reserve more: `Ephemeral lsp token`,
+/// `debugger-token` and `ephemeral-test-connection: *` are minted by the editor, the debugger
+/// and object-storage connection tests through that same handler, so reserving them would
+/// break those features.
 ///
 /// `username_override_from_label` trusts a label to name the entity acting only if it is in
 /// here, so anything added must be unmintable by a member.
@@ -961,6 +977,9 @@ mod tests {
         assert!(!is_user_token(Some("Ephemeral lsp token")));
         assert!(!is_user_token(Some("debugger-token")));
         assert!(!is_user_token(Some("mcp-oauth-client")));
+        assert!(!is_user_token(Some("embed_app:f/team/dashboard")));
+        assert!(!is_user_token(Some("sdk_app:u/admin/raw app")));
+        assert!(!is_user_token(Some("impersonation:admin@windmill.dev")));
     }
 
     #[test]

backend/windmill-common/src/flow_conversations.rs

@@ -1,12 +1,39 @@
+use std::collections::HashMap;
+
 use chrono::{DateTime, Utc};
 use serde::{Deserialize, Serialize};
+use serde_json::value::RawValue;
 use sqlx::{self, FromRow};
 use uuid::Uuid;
+use windmill_types::s3::S3Object;
 
 use crate::db::DB;
 use crate::error::Result;
 use crate::utils::truncate_with_ellipsis;
 
+/// Changing it detaches every memory stored under a string memory id.
+const MEMORY_ID_NAMESPACE: Uuid = Uuid::from_u128(0x6f1c2d4e_8a3b_5c7d_9e0f_1a2b3c4d5e6f);
+
+/// Memory is stored and carried in `flow_status.memory_id` as a uuid, which names the same memory
+/// wherever it is passed, as a chat conversation id must. Any other string names a memory through a
+/// name-based (v5) uuid scoped to its workspace and flow, so the same key in two flows or two
+/// workspaces names two memories, and chat conversation ids stay unique across workspaces.
+pub fn memory_key(workspace_id: &str, flow_path: &str, memory_id: &str) -> Uuid {
+    let memory_id = memory_id.trim();
+    Uuid::parse_str(memory_id).unwrap_or_else(|_| {
+        use sha1::{Digest, Sha1};
+        let mut hasher = Sha1::new();
+        hasher.update(MEMORY_ID_NAMESPACE.as_bytes());
+        for part in [workspace_id, flow_path, memory_id] {
+            hasher.update(part.as_bytes());
+            hasher.update([0u8]);
+        }
+        let mut bytes = [0u8; 16];
+        bytes.copy_from_slice(&hasher.finalize()[..16]);
+        uuid::Builder::from_sha1_bytes(bytes).into_uuid()
+    })
+}
+
 #[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq, sqlx::Type)]
 #[sqlx(type_name = "MESSAGE_TYPE", rename_all = "lowercase")]
 #[serde(rename_all = "lowercase")]
@@ -26,8 +53,12 @@ pub struct FlowConversation {
     pub created_at: DateTime<Utc>,
     pub updated_at: DateTime<Utc>,
     pub created_by: String,
+    /// Started from the flow editor's test panel rather than a deployed run.
+    pub is_test: bool,
 }
 
+/// `is_test` is written on insert. An existing conversation of the other kind refuses the
+/// turn, so preview and deployed runs never share one.
 pub async fn get_or_create_conversation_with_id(
     tx: &mut sqlx::Transaction<'_, sqlx::Postgres>,
     w_id: &str,
@@ -35,42 +66,140 @@ pub async fn get_or_create_conversation_with_id(
     username: &str,
     title: &str,
     conversation_id: Uuid,
+    is_test: bool,
 ) -> Result<FlowConversation> {
-    // Check if conversation already exists
-    let existing_conversation = sqlx::query_as!(
-        FlowConversation,
-        "SELECT id, workspace_id, flow_path, title, created_at, updated_at, created_by
-         FROM flow_conversation
-         WHERE id = $1 AND workspace_id = $2",
-        conversation_id,
-        w_id
-    )
-    .fetch_optional(&mut **tx)
-    .await?;
-
-    if let Some(existing) = existing_conversation {
-        return Ok(existing);
+    if let Some(existing) = lock_conversation(tx, w_id, conversation_id).await? {
+        return same_kind(existing, is_test);
     }
 
     // Truncate title to 25 characters max
     let title = truncate_with_ellipsis(title, 25);
 
-    // Create new conversation with provided ID
-    let conversation = sqlx::query_as!(
+    // Every turn released by the same collector's commit finds no row: the first insert
+    // wins, the others wait on it, do nothing, and read the row it created.
+    let created = sqlx::query_as!(
         FlowConversation,
-        "INSERT INTO flow_conversation (id, workspace_id, flow_path, created_by, title)
-         VALUES ($1, $2, $3, $4, $5)
-         RETURNING id, workspace_id, flow_path, title, created_at, updated_at, created_by",
+        "INSERT INTO flow_conversation (id, workspace_id, flow_path, created_by, title, is_test)
+         VALUES ($1, $2, $3, $4, $5, $6)
+         ON CONFLICT (id) DO NOTHING
+         RETURNING id, workspace_id, flow_path, title, created_at, updated_at, created_by, is_test",
         conversation_id,
         w_id,
         flow_path,
         username,
-        title
+        title,
+        is_test
     )
-    .fetch_one(&mut **tx)
+    .fetch_optional(&mut **tx)
     .await?;
+    if let Some(conversation) = created {
+        return Ok(conversation);
+    }
 
-    Ok(conversation)
+    // The concurrent first turn that won the insert may have been of the other kind.
+    let existing = lock_conversation(tx, w_id, conversation_id)
+        .await?
+        .ok_or_else(|| {
+            crate::error::Error::BadRequest(format!(
+                "conversation {conversation_id} belongs to another workspace"
+            ))
+        })?;
+    same_kind(existing, is_test)
+}
+
+/// `memory_id` is the caller's to choose, so a preview run could name a deployed
+/// conversation and the reverse. A conversation's kind is fixed at creation and nothing
+/// would show the mixing afterwards, so the turn is refused before it starts.
+fn same_kind(existing: FlowConversation, is_test: bool) -> Result<FlowConversation> {
+    if existing.is_test == is_test {
+        return Ok(existing);
+    }
+    Err(crate::error::Error::BadRequest(if existing.is_test {
+        "this conversation was started from the flow editor's test panel; start a new conversation to run the deployed flow".to_string()
+    } else {
+        "this conversation belongs to the deployed flow; start a new conversation to test from the flow editor".to_string()
+    }))
+}
+
+/// Locked, so a turn orders against retention collecting the conversation
+/// (windmill_common::jobs::delete_jobs): either the turn goes first and the collector then
+/// sees its message, or it waits and finds the row gone and creates it again. Unlocked, the
+/// message insert would wait on the parent row's lock instead and then fail its FK check.
+async fn lock_conversation(
+    tx: &mut sqlx::Transaction<'_, sqlx::Postgres>,
+    w_id: &str,
+    conversation_id: Uuid,
+) -> Result<Option<FlowConversation>> {
+    Ok(sqlx::query_as!(
+        FlowConversation,
+        "SELECT id, workspace_id, flow_path, title, created_at, updated_at, created_by, is_test
+         FROM flow_conversation
+         WHERE id = $1 AND workspace_id = $2
+         FOR UPDATE",
+        conversation_id,
+        w_id
+    )
+    .fetch_optional(&mut **tx)
+    .await?)
+}
+
+/// What a row carries beyond its text. A chat is rebuilt from its rows alone, without
+/// reading jobs, so every tool row carries the model's call and what the model got back: a
+/// Windmill tool's job holds the args its input transforms produced rather than the model's,
+/// and an MCP tool's call sits among every call of the turn in the agent's job. That job's
+/// `reasoning` is one string for the whole turn, where the rows keep it per iteration.
+#[derive(Debug, Clone, Default)]
+pub struct MessageExtras {
+    pub tool_arguments: Option<String>,
+    pub tool_result: Option<String>,
+    pub reasoning: Option<String>,
+    /// The files a user message carried; see `message_attachments`.
+    pub attachments: Vec<MessageAttachment>,
+}
+
+/// The most files a user message keeps references to; the rest are dropped.
+pub const MAX_MESSAGE_ATTACHMENTS: usize = 20;
+
+/// A file a user message carried, as the object-storage reference its run received.
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+pub struct MessageAttachment {
+    /// The flow input that held it.
+    pub input: String,
+    pub s3: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub storage: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub filename: Option<String>,
+}
+
+/// The files a run's args carry for its user message: every top-level input other than
+/// `user_message` whose value is an object-storage reference or a list of them, in input
+/// name order, capped at `MAX_MESSAGE_ATTACHMENTS`. Only the reference is kept: `presigned`
+/// grants access to the file, and any other value may be the file's bytes.
+pub fn message_attachments(args: &HashMap<String, Box<RawValue>>) -> Vec<MessageAttachment> {
+    let mut inputs: Vec<_> = args
+        .iter()
+        .filter(|(name, _)| name.as_str() != "user_message")
+        .collect();
+    inputs.sort_by(|a, b| a.0.cmp(b.0));
+    inputs
+        .into_iter()
+        .flat_map(|(name, value)| {
+            serde_json::from_str::<S3Object>(value.get())
+                .map(|object| vec![object])
+                .or_else(|_| serde_json::from_str::<Vec<S3Object>>(value.get()))
+                .unwrap_or_default()
+                .into_iter()
+                .filter(|object| !object.s3.is_empty())
+                .map(move |object| MessageAttachment {
+                    input: name.clone(),
+                    s3: object.s3,
+                    storage: object.storage,
+                    filename: object.filename,
+                })
+        })
+        .take(MAX_MESSAGE_ATTACHMENTS)
+        .collect()
 }
 
 /// Add a message to a conversation using an existing transaction
@@ -84,6 +213,7 @@ pub async fn add_message_to_conversation_tx(
     message_type: MessageType,
     step_name: Option<&str>,
     success: bool,
+    extras: Option<&MessageExtras>,
 ) -> Result<()> {
     // Check if conversation exists first
     let conversation_exists = sqlx::query!(
@@ -104,14 +234,21 @@ pub async fn add_message_to_conversation_tx(
 
     // Insert the message
     sqlx::query!(
-        "INSERT INTO flow_conversation_message (conversation_id, message_type, content, job_id, step_name, success)
-         VALUES ($1, $2, $3, $4, $5, $6)",
+        "INSERT INTO flow_conversation_message (conversation_id, message_type, content, job_id, step_name, success, tool_arguments, tool_result, reasoning, attachments)
+         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)",
         conversation_id,
         message_type as MessageType,
         content,
         job_id,
         step_name,
-        success
+        success,
+        extras.and_then(|e| e.tool_arguments.as_deref()),
+        extras.and_then(|e| e.tool_result.as_deref()),
+        extras.and_then(|e| e.reasoning.as_deref()),
+        extras
+            .map(|e| &e.attachments)
+            .filter(|attachments| !attachments.is_empty())
+            .map(sqlx::types::Json) as Option<sqlx::types::Json<&Vec<MessageAttachment>>>
     )
     .execute(&mut **tx)
     .await?;
@@ -143,3 +280,67 @@ pub async fn delete_conversation_memory(
 
     Ok(())
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::{json, value::to_raw_value};
+
+    fn args(values: serde_json::Value) -> HashMap<String, Box<RawValue>> {
+        values
+            .as_object()
+            .unwrap()
+            .iter()
+            .map(|(name, value)| (name.clone(), to_raw_value(value).unwrap()))
+            .collect()
+    }
+
+    #[test]
+    fn keeps_only_object_storage_references() {
+        let attachments = message_attachments(&args(json!({
+            "user_message": { "s3": "not/an/attachment.png" },
+            "avatar": { "s3": "u/a.png", "storage": "secondary", "presigned": "https://signed" },
+            "files": [
+                { "s3": "u/b.pdf", "filename": "b.pdf" },
+                { "s3": "" }
+            ],
+            "photo": "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNkYPhfDwAChwGA60e6kgAAAABJRU5ErkJggg==",
+            "count": 3
+        })));
+        assert_eq!(
+            serde_json::to_value(&attachments).unwrap(),
+            json!([
+                { "input": "avatar", "s3": "u/a.png", "storage": "secondary" },
+                { "input": "files", "s3": "u/b.pdf", "filename": "b.pdf" }
+            ])
+        );
+    }
+
+    #[test]
+    fn caps_the_references_of_one_message() {
+        let files: Vec<_> = (0..25)
+            .map(|i| json!({ "s3": format!("u/{i}.png") }))
+            .collect();
+        let attachments = message_attachments(&args(json!({ "files": files })));
+        assert_eq!(attachments.len(), MAX_MESSAGE_ATTACHMENTS);
+        assert_eq!(attachments.last().unwrap().s3, "u/19.png");
+    }
+
+    /// A string names a memory only within its workspace and flow; a uuid is used as is.
+    #[test]
+    fn memory_key_scopes_strings_but_not_uuids() {
+        let key = memory_key("ws", "f/support/triage", " customer-1 ");
+        assert_eq!(key, memory_key("ws", "f/support/triage", "customer-1"));
+        assert_ne!(
+            key,
+            memory_key("other_ws", "f/support/triage", "customer-1")
+        );
+        assert_ne!(key, memory_key("ws", "f/sales/triage", "customer-1"));
+        let conversation = Uuid::from_u128(7).to_string();
+        assert_eq!(memory_key("ws", "f/a", &conversation), Uuid::from_u128(7));
+        assert_eq!(
+            memory_key("other_ws", "f/b", &conversation),
+            Uuid::from_u128(7)
+        );
+    }
+}

backend/windmill-common/src/jobs.rs

@@ -478,6 +478,12 @@ pub static WORKER_INTERNAL_SERVER_INLINE_UTILS: OnceCell<WorkerInternalServerInl
 /// set-based deletes below cost one scan per table per call instead. Because the cascade no
 /// longer fires, every code path that deletes from `v2_job` by id must go through this helper
 /// (or delete these tables itself) or it will leave orphan rows behind.
+/// **Transaction contract:** call this inside a transaction. The conversation cleanup below
+/// locks rows to serialise itself against a concurrent delete, and on an autocommit
+/// connection that lock is released at statement end, silently restoring the race.
+/// A conversation is collected only once every message row of it has gone with a job; a
+/// row written with no job id (an MCP tool call, persisted under no job of its own) keeps
+/// its conversation and the agent's memory for it alive for as long as it exists.
 pub async fn delete_jobs(conn: &mut sqlx::PgConnection, ids: &[uuid::Uuid]) -> error::Result<()> {
     sqlx::query!(
         "DELETE FROM dispatch_event WHERE producer_job_id = ANY($1)",
@@ -485,12 +491,55 @@ pub async fn delete_jobs(conn: &mut sqlx::PgConnection, ids: &[uuid::Uuid]) -> e
     )
     .execute(&mut *conn)
     .await?;
-    sqlx::query!(
-        "DELETE FROM flow_conversation_message WHERE job_id = ANY($1)",
+    let mut conversation_ids: Vec<uuid::Uuid> = sqlx::query_scalar!(
+        "DELETE FROM flow_conversation_message WHERE job_id = ANY($1) RETURNING conversation_id",
         ids
     )
-    .execute(&mut *conn)
+    .fetch_all(&mut *conn)
     .await?;
+    conversation_ids.sort_unstable();
+    conversation_ids.dedup();
+    if !conversation_ids.is_empty() {
+        // A conversation is a view over its messages: once the last one goes with its job,
+        // the row and the agent's memory for it are all that is left, and nothing else
+        // collects them — `ai_agent_memory` carries no job id for retention to match on.
+        // Two statements rather than one CTE: a data-modifying CTE reads the snapshot from
+        // before the delete above, so every conversation would still look non-empty.
+        // Two calls each deleting one of a conversation's last messages would each still see
+        // the other's row — uncommitted deletes are invisible across transactions — so
+        // neither would collect it and nothing would try again. Taking the conversation row
+        // first serialises them: the second reads the first's delete and finds it empty.
+        sqlx::query_scalar!(
+            "SELECT id FROM flow_conversation WHERE id = ANY($1) ORDER BY id FOR UPDATE",
+            &conversation_ids
+        )
+        .fetch_all(&mut *conn)
+        .await?;
+        // Memory first, since it reads the conversation row for its workspace.
+        sqlx::query!(
+            "DELETE FROM ai_agent_memory a
+               USING flow_conversation c
+              WHERE c.id = ANY($1)
+                AND a.conversation_id = c.id
+                AND a.workspace_id = c.workspace_id
+                AND NOT EXISTS (
+                    SELECT 1 FROM flow_conversation_message m WHERE m.conversation_id = c.id
+                )",
+            &conversation_ids
+        )
+        .execute(&mut *conn)
+        .await?;
+        sqlx::query!(
+            "DELETE FROM flow_conversation c
+              WHERE c.id = ANY($1)
+                AND NOT EXISTS (
+                    SELECT 1 FROM flow_conversation_message m WHERE m.conversation_id = c.id
+                )",
+            &conversation_ids
+        )
+        .execute(&mut *conn)
+        .await?;
+    }
     sqlx::query!("DELETE FROM zombie_job_counter WHERE job_id = ANY($1)", ids)
         .execute(&mut *conn)
         .await?;

backend/windmill-common/src/utils.rs

@@ -976,18 +976,33 @@ fn six_fields_hint(schedule_str: &str, version: Option<&str>, seconds_required:
 }
 
 impl ScheduleType {
+    /// `NotFound` means the expression has no run left (an expired year, an impossible
+    /// date), and schedule pushes disable the schedule on it. Every other error must stay
+    /// transient: croner fails across a DST jump longer than an hour (Antarctica/Troll)
+    /// and succeeds again once the jump has passed.
     pub fn find_next(
         &self,
         starting_from: &chrono::DateTime<chrono_tz::Tz>,
-    ) -> chrono::DateTime<chrono_tz::Tz> {
+    ) -> Result<chrono::DateTime<chrono_tz::Tz>> {
+        let no_run_left = || {
+            Error::NotFound(format!(
+                "cron: the schedule has no run left after {}",
+                starting_from.format("%Y-%m-%d %H:%M:%S %Z")
+            ))
+        };
         match self {
             ScheduleType::Croner(croner_schedule) => croner_schedule
                 .find_next_occurrence(starting_from, false)
-                .expect("cron: a schedule should have a next event"),
-            ScheduleType::Cron(schedule) => schedule
-                .after(starting_from)
-                .next()
-                .expect("cron: a schedule should have a next event"),
+                .map_err(|e| match e {
+                    croner::errors::CronError::TimeSearchLimitExceeded => no_run_left(),
+                    e => Error::internal_err(format!(
+                        "cron: could not compute the run after {}: {e}",
+                        starting_from.format("%Y-%m-%d %H:%M:%S %Z")
+                    )),
+                }),
+            ScheduleType::Cron(schedule) => {
+                schedule.after(starting_from).next().ok_or_else(no_run_left)
+            }
         }
     }
 
@@ -1709,6 +1724,22 @@ mod tests {
         assert!(!err.contains("6 fields"), "{err}");
     }
 
+    #[test]
+    fn find_next_reports_only_a_cron_with_no_run_left_as_not_found() {
+        use chrono::TimeZone;
+        let troll: chrono_tz::Tz = "Antarctica/Troll".parse().unwrap();
+        // Troll's clocks jump from 01:00 to 03:00 on the last Sunday of March.
+        let before_jump = troll.with_ymd_and_hms(2027, 3, 28, 0, 30, 0).unwrap();
+
+        let expired = ScheduleType::from_str("0 0 9 1 1 * 2026", Some("v1"), true).unwrap();
+        let err = expired.find_next(&before_jump).unwrap_err();
+        assert!(matches!(err, Error::NotFound(_)), "{err}");
+
+        let across_jump = ScheduleType::from_str("0 30 1 * * *", Some("v2"), true).unwrap();
+        let err = across_jump.find_next(&before_jump).unwrap_err();
+        assert!(!matches!(err, Error::NotFound(_)), "{err}");
+    }
+
     /// A worker that restarts must land on the exact same name to reclaim its `worker_ping`
     /// row, while still never colliding with the other workers of its own process. The
     /// suffix must also stay a single `-` segment, which is what the interactive shell tag

backend/windmill-queue/src/schedule.rs

@@ -166,13 +166,10 @@ pub async fn push_scheduled_job<'c>(
         }
     };
 
-    let next = sched.find_next(&starting_from);
-    // println!("next event ({:?}): {}", tz, next);
-    // println!("next event(UTC): {}", next.with_timezone(&chrono::Utc));
+    let next = sched.find_next(&starting_from)?;
 
     // Scheduled events must be stored in the database in UTC
     let next = next.with_timezone(&chrono::Utc);
-    // panic!("next: {}", next);
     let already_exists: bool = sqlx::query_scalar!(
         // Query plan:
         // - use of the `ix_v2_job_root_by_path` index; hence the `parent_job IS NULL` clause.

backend/windmill-queue/tests/schedule_push.rs

@@ -921,6 +921,47 @@ mod schedule_push {
         Ok(())
     }
 
+    // -----------------------------------------------------------------------
+    // try_schedule_next_job: a cron with no run left disables the schedule
+    // -----------------------------------------------------------------------
+
+    #[sqlx::test(migrations = "../migrations", fixtures("base", "schedule_push"))]
+    async fn test_cron_with_no_run_left_disables_schedule(
+        db: Pool<Postgres>,
+    ) -> anyhow::Result<()> {
+        sqlx::query(
+            "INSERT INTO schedule (workspace_id, path, edited_by, edited_at, schedule, timezone, enabled, script_path, is_flow, email, extra_perms, ws_error_handler_muted, no_flow_overlap, permissioned_as, cron_version)
+             VALUES ('test-workspace', 'f/system/test_schedule', 'test-user', now(), '0 0 9 1 1 * 2020', 'UTC', true, 'f/system/test_script', false, 'test@windmill.dev', '{}', false, false, 'u/test-user', 'v1')"
+        )
+        .execute(&db)
+        .await?;
+
+        let schedule = make_schedule(|s| {
+            s.schedule = "0 0 9 1 1 * 2020".to_string();
+            s.cron_version = Some("v1".to_string());
+        });
+        let job = make_completed_job(&schedule);
+
+        let tx = db.begin().await?;
+        let (tx, err) =
+            try_schedule_next_job(&db, tx, &job, &schedule, &schedule.script_path).await;
+        assert!(err.is_none(), "completion must go through, got: {err:?}");
+        tx.commit().await?;
+
+        assert_eq!(count_queued_jobs(&db).await, 0);
+        let (enabled, error): (bool, Option<String>) = sqlx::query_as(
+            "SELECT enabled, error FROM schedule WHERE workspace_id = 'test-workspace' AND path = 'f/system/test_schedule'",
+        )
+        .fetch_one(&db)
+        .await?;
+        assert!(!enabled, "schedule with no run left must be disabled");
+        assert!(
+            error.as_deref().is_some_and(|e| e.contains("no run left")),
+            "error should say why, got: {error:?}"
+        );
+        Ok(())
+    }
+
     // -----------------------------------------------------------------------
     // try_schedule_next_job: disabled schedule leaves no side effects
     // -----------------------------------------------------------------------

backend/windmill-types/src/flows.rs

@@ -98,6 +98,11 @@ pub struct ListableFlow {
     pub deployment_msg: Option<String>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub labels: Option<Vec<String>>,
+    /// Projected from the flow value so a list can mark a flow that opens as a
+    /// chat without fetching every flow's value.
+    #[sqlx(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub chat_input_enabled: Option<bool>,
     /// True when the authed user has a draft for this flow (draft-only or layered
     /// over the deployed row). See ListableScript in scripts.rs.
     #[serde(default)]
@@ -1095,7 +1100,8 @@ pub enum FlowModuleValue {
         omit_output_from_conversation: bool,
         /// When set, the agent brain config (provider/model/system prompt/etc.) and tools are
         /// resolved at runtime from this `ai_agent` resource path (hybrid linking). The module's
-        /// `input_transforms` then only carry the flow-local inputs (user_message/user_attachments).
+        /// `input_transforms` then only carry the flow-local inputs: user_message,
+        /// user_attachments, enabled_tools and the history inputs memory_id and previous_messages.
         #[serde(default, skip_serializing_if = "Option::is_none")]
         agent: Option<String>,
         /// Binds an agent's tools to *this* flow's context, keyed by tool id then input key, without

backend/windmill-worker/src/ai/tools.rs

@@ -33,7 +33,7 @@ use windmill_common::{
     client::AuthedClient,
     db::DB,
     error::Error,
-    flow_conversations::MessageType,
+    flow_conversations::{MessageExtras, MessageType},
     flow_status::AgentAction,
     flows::FlowModuleValue,
     worker::{to_raw_value, Connection},
@@ -74,6 +74,9 @@ pub struct ToolExecutionContext<'a> {
     pub stream_event_processor: Option<&'a StreamEventProcessor>,
     pub flow_context: &'a mut FlowContext,
     pub omit_output_from_conversation: bool,
+    /// The thinking that led to this round's calls, stored on the first tool row written.
+    /// None when the round wrote text, whose row carries it.
+    pub reasoning: Option<String>,
     pub previous_result: &'a Option<Box<RawValue>>,
     pub id_context: &'a Option<crate::js_eval::IdContext>,
 
@@ -235,9 +238,24 @@ async fn execute_mcp_tool_call(
                 update_flow_status_module_with_actions_success(ctx.db, parent_job, true).await?;
             }
 
-            // Add tool message to conversation if chat_input_enabled
+            // An MCP tool runs inside the agent's job, whose result holds every call of the
+            // turn and nothing tying one of them to this row: same job id for all of them,
+            // no call id on the row. Kept here so the card shows this call — and the row
+            // names that job, so retention sweeps it with every other row of the turn.
             let content = format!("Used {} tool", tool_call.function.name);
-            add_tool_message_to_chat(ctx, None, &content, true).await;
+            let agent_job_id = ctx.job.id;
+            add_tool_message_to_chat(
+                ctx,
+                Some(agent_job_id),
+                &content,
+                true,
+                Some(MessageExtras {
+                    tool_arguments: Some(tool_call.function.arguments.clone()),
+                    tool_result: Some(result_str),
+                    ..Default::default()
+                }),
+            )
+            .await;
         }
         Err(e) => {
             let error_msg = format!("MCP tool error: {}", e);
@@ -271,8 +289,23 @@ async fn execute_mcp_tool_call(
                 update_flow_status_module_with_actions_success(ctx.db, parent_job, false).await?;
             }
 
-            // Add tool message to conversation if chat_input_enabled
-            add_tool_message_to_chat(ctx, None, &error_msg, false).await;
+            // Add tool message to conversation if chat_input_enabled. The row is worded from
+            // the tool, like every other tool row, and the error it failed with is its result
+            // — the one field a call that produced nothing else still has something to put in.
+            let agent_job_id = ctx.job.id;
+            let content = format!("Error executing {}", tool_name);
+            add_tool_message_to_chat(
+                ctx,
+                Some(agent_job_id),
+                &content,
+                false,
+                Some(MessageExtras {
+                    tool_arguments: Some(tool_call.function.arguments.clone()),
+                    tool_result: Some(error_msg.clone()),
+                    ..Default::default()
+                }),
+            )
+            .await;
         }
     }
 
@@ -680,8 +713,8 @@ async fn handle_tool_execution_error(
         update_flow_status_module_with_actions_success(ctx.db, parent_job, false).await?;
     }
 
-    // Add tool message to conversation if chat_input_enabled (error case)
-    add_tool_message_to_chat(ctx, Some(job_id), &error_message, false).await;
+    let (content, extras) = windmill_tool_row(tool_call, false, &error_message);
+    add_tool_message_to_chat(ctx, Some(job_id), &content, false, Some(extras)).await;
 
     Ok(())
 }
@@ -782,13 +815,17 @@ async fn handle_tool_execution_success(
         ..Default::default()
     });
 
-    // Stream tool result (success case)
+    let (content, extras) = windmill_tool_row(tool_call, success, &tool_result);
+
+    // The job ran; whether it ran successfully is `success`, and the row stored below is
+    // worded from it. The stream has to carry the same value, or the card the reader watches
+    // and the row that replaces it describe the same call differently.
     if let Some(stream_event_processor) = ctx.stream_event_processor {
         let tool_result_event = StreamingEvent::ToolResult {
             call_id: tool_call.id.clone(),
             function_name: tool_call.function.name.clone(),
             result: tool_result,
-            success: true,
+            success,
         };
         stream_event_processor
             .send(tool_result_event, final_events_str)
@@ -799,28 +836,56 @@ async fn handle_tool_execution_success(
         update_flow_status_module_with_actions_success(ctx.db, parent_job, success).await?;
     }
 
-    // Add tool message to conversation if chat_input_enabled
+    add_tool_message_to_chat(ctx, Some(job_id), &content, success, Some(extras)).await;
+
+    Ok(())
+}
+
+/// A Windmill tool's conversation row: worded from the tool, carrying the model's call and
+/// the exact text the model got back, the same text agent memory keeps for that tool
+/// message, so a card needs no job fetch. The call is the model's arguments, not the job's
+/// args: the step's input transforms add inputs the model never wrote.
+fn windmill_tool_row(
+    tool_call: &OpenAIToolCall,
+    success: bool,
+    sent_to_model: &str,
+) -> (String, MessageExtras) {
     let content = if success {
         format!("Used {} tool", tool_call.function.name)
     } else {
         format!("Error executing {}", tool_call.function.name)
     };
-
-    add_tool_message_to_chat(ctx, Some(job_id), &content, success).await;
-
-    Ok(())
+    let extras = MessageExtras {
+        tool_arguments: Some(tool_call.function.arguments.clone()),
+        tool_result: Some(sent_to_model.to_string()),
+        ..Default::default()
+    };
+    (content, extras)
 }
 
 /// Add tool message to conversation if chat is enabled
 async fn add_tool_message_to_chat(
     ctx: &mut ToolExecutionContext<'_>,
+    // The job this row belongs to: the tool's own where it has one, else the agent's, which
+    // is the job it ran inside. Every row names one so that retention collects the whole
+    // turn — `delete_jobs` removes messages by `job_id = ANY(..)` (there is no FK on the
+    // column; `drop_v2_job_side_table_cascades` dropped it), and a row naming no job would
+    // survive every purge and leave a conversation that can never become empty.
     tool_job_id: Option<Uuid>,
     content: &str,
     success: bool,
+    // The model's call and what it got back; every tool row carries both.
+    extras: Option<MessageExtras>,
 ) {
     if ctx.omit_output_from_conversation {
         return;
     }
+    let extras = match ctx.reasoning.take() {
+        Some(reasoning) => {
+            Some(MessageExtras { reasoning: Some(reasoning), ..extras.unwrap_or_default() })
+        }
+        None => extras,
+    };
 
     let chat_enabled = ctx
         .flow_context
@@ -835,41 +900,74 @@ async fn add_tool_message_to_chat(
             .as_ref()
             .and_then(|fs| fs.memory_id)
         {
-            let db_clone = ctx.db.clone();
             let effective_step_id = ctx
                 .flow_step_id_override
                 .or(ctx.job.flow_step_id.as_deref());
             let step_name = get_step_name_from_flow(ctx.summary.as_deref(), effective_step_id);
-            let content = content.to_string();
 
-            // Spawn task because we do not need to wait for the result
-            tokio::spawn(async move {
-                if let Err(e) = add_message_to_conversation(
-                    &db_clone,
-                    &memory_id,
-                    tool_job_id,
-                    &content,
-                    MessageType::Tool,
-                    &step_name,
-                    success,
-                )
-                .await
-                {
-                    tracing::warn!(
-                        "Failed to add tool message to conversation {}: {}",
-                        memory_id,
-                        e
-                    );
-                }
-            });
+            // Awaited, not spawned: `created_seq` is the transcript's order, so a round's rows
+            // must commit in the order of its calls. Calls run one after another; running them
+            // in parallel would need their rows written in call order all the same.
+            if let Err(e) = add_message_to_conversation(
+                ctx.db,
+                &memory_id,
+                tool_job_id,
+                content,
+                MessageType::Tool,
+                &step_name,
+                success,
+                extras.as_ref(),
+            )
+            .await
+            {
+                tracing::warn!(
+                    "Failed to add tool message to conversation {}: {}",
+                    memory_id,
+                    e
+                );
+            }
         }
     }
 }
 
 #[cfg(test)]
 mod tests {
-    use super::extract_ai_agent_output;
+    use super::{extract_ai_agent_output, windmill_tool_row};
     use serde_json::value::RawValue;
+    use windmill_ai::ai_types::{OpenAIFunction, OpenAIToolCall};
+
+    #[test]
+    fn a_windmill_tool_row_carries_the_models_call_and_what_it_got_back() {
+        let tool_call = OpenAIToolCall {
+            id: "call_1".to_string(),
+            function: OpenAIFunction {
+                name: "get_price".to_string(),
+                arguments: r#"{"item":"widget"}"#.to_string(),
+            },
+            r#type: "function".to_string(),
+            extra_content: None,
+        };
+
+        let (content, extras) = windmill_tool_row(&tool_call, true, r#"{"price":42}"#);
+        assert_eq!(content, "Used get_price tool");
+        assert_eq!(
+            extras.tool_arguments.as_deref(),
+            Some(r#"{"item":"widget"}"#)
+        );
+        assert_eq!(extras.tool_result.as_deref(), Some(r#"{"price":42}"#));
+
+        let (content, extras) =
+            windmill_tool_row(&tool_call, false, "Error running tool: ExecutionErr: boom");
+        assert_eq!(content, "Error executing get_price");
+        assert_eq!(
+            extras.tool_arguments.as_deref(),
+            Some(r#"{"item":"widget"}"#)
+        );
+        assert_eq!(
+            extras.tool_result.as_deref(),
+            Some("Error running tool: ExecutionErr: boom")
+        );
+    }
 
     #[test]
     fn extracts_only_the_output_of_an_agent_result() {

backend/windmill-worker/src/ai/utils.rs

@@ -13,7 +13,7 @@ use windmill_common::flows::FlowModuleValue;
 use windmill_common::{
     db::DB,
     error::Error,
-    flow_conversations::{add_message_to_conversation_tx, MessageType},
+    flow_conversations::{add_message_to_conversation_tx, MessageExtras, MessageType},
     flow_status::AgentAction,
     flows::{InputTransform, Step},
     jobs::JobKind,
@@ -154,6 +154,8 @@ pub async fn get_flow_job_runnable_and_raw_flow(
 pub struct FlowContext {
     pub flow_inputs: Option<HashMap<String, Box<RawValue>>>,
     pub flow_status: Option<windmill_common::flow_status::FlowStatus>,
+    /// Path of the flow the run started from, which scopes a string memory id.
+    pub flow_path: Option<String>,
 }
 
 /// Get flow context (chat settings + args + flow_status) from root flow's job data
@@ -171,7 +173,8 @@ pub async fn get_flow_context(db: &DB, job: &MiniPulledJob) -> FlowContext {
         r#"
         SELECT
             j.args as "args: Json<HashMap<String, Box<RawValue>>>",
-            js.flow_status as "flow_status: Json<windmill_common::flow_status::FlowStatus>"
+            js.flow_status as "flow_status: Json<windmill_common::flow_status::FlowStatus>",
+            j.runnable_path
         FROM v2_job_status js
         INNER JOIN v2_job j ON j.id = js.id
         WHERE js.id = $1
@@ -184,6 +187,7 @@ pub async fn get_flow_context(db: &DB, job: &MiniPulledJob) -> FlowContext {
         Ok(Some(row)) => FlowContext {
             flow_inputs: row.args.map(|j| j.0),
             flow_status: row.flow_status.map(|j| j.0),
+            flow_path: row.runnable_path,
         },
         Ok(None) => {
             tracing::warn!(
@@ -209,6 +213,7 @@ pub async fn add_message_to_conversation(
     message_type: MessageType,
     step_name: &Option<String>,
     success: bool,
+    extras: Option<&MessageExtras>,
 ) -> Result<(), Error> {
     let mut tx = db.begin().await?;
     add_message_to_conversation_tx(
@@ -219,6 +224,7 @@ pub async fn add_message_to_conversation(
         message_type,
         step_name.as_deref(),
         success,
+        extras,
     )
     .await?;
     tx.commit().await?;

backend/windmill-worker/src/ai_executor.rs

@@ -44,7 +44,7 @@ use windmill_common::{
     client::AuthedClient,
     db::DB,
     error::{self, Error},
-    flow_conversations::MessageType,
+    flow_conversations::{memory_key, MessageExtras, MessageType},
     flow_status::AgentAction,
     flows::{AgentTool, FlowModule, FlowModuleValue, InputTransform, ToolValue},
     get_latest_hash_for_path,
@@ -111,6 +111,148 @@ fn prepare_auto_memory_messages_for_persistence(
     non_system_messages[start_idx..].to_vec()
 }
 
+/// The inputs a linked step supplies for itself; the resource holds the rest of the brain.
+const FLOW_LOCAL_AGENT_KEYS: [&str; 5] = [
+    "user_message",
+    "user_attachments",
+    "enabled_tools",
+    "memory_id",
+    "previous_messages",
+];
+
+/// The flow-local inputs that name a conversation, which a saved agent never carries.
+const STEP_HISTORY_KEYS: [&str; 2] = ["memory_id", "previous_messages"];
+
+/// Where one agent invocation's history comes from.
+#[derive(Debug)]
+enum HistorySource<'a> {
+    /// Supplied by the flow and replayed as is: memory is neither read nor written.
+    Messages(&'a [OpenAIMessage]),
+    Window {
+        memory_id: Uuid,
+        context_length: usize,
+    },
+    Stateless,
+}
+
+/// A step's memory id counts only as the step authored it. A static empty value is a form
+/// placeholder, so it reads as unset rather than as an expression that evaluated to nothing, which
+/// runs without memory; an AI-filled value would let the model choose which memory the agent reads.
+fn keep_authored_memory_id(
+    args: &mut AIAgentArgs,
+    step_input_transforms: &HashMap<String, InputTransform>,
+) {
+    match step_input_transforms.get("memory_id") {
+        Some(InputTransform::Javascript { .. }) => {}
+        Some(InputTransform::Static { .. }) if args.memory_id.as_deref() != Some("") => {}
+        _ => args.memory_id = None,
+    }
+}
+
+/// Reconciles the step's history inputs, the agent's memory policy and the run's memory id. A step
+/// holds one of two shapes: an older `auto` or `manual` memory, read as the editor that wrote it
+/// meant it, or the current setting plus the step's own history inputs. Also returns lines for the
+/// job log: an input that went unused, or a policy that remembers ending up stateless.
+fn resolve_history_source<'a>(
+    args: &'a AIAgentArgs,
+    run_memory_id: Option<Uuid>,
+    workspace_id: &str,
+    flow_path: &str,
+) -> (HistorySource<'a>, Vec<&'static str>) {
+    let mut notes = Vec::new();
+    let no_memory_id = "No memory id was passed to this run, so the agent runs without memory.";
+    match &args.memory {
+        // The step's own history inputs came after these, so a step that still holds one reads it
+        // alone: what it did before the editor offered them is what it keeps doing.
+        Some(Memory::Manual { messages }) => {
+            note_unread_step_inputs(&mut notes, args);
+            (HistorySource::Messages(messages), notes)
+        }
+        Some(Memory::Auto { context_length, memory_id }) => {
+            note_unread_step_inputs(&mut notes, args);
+            // An id baked in at save time only ever applied when the run carried none.
+            match run_memory_id.or(*memory_id) {
+                Some(memory_id) => (
+                    HistorySource::Window { memory_id, context_length: *context_length },
+                    notes,
+                ),
+                None => {
+                    notes.push(no_memory_id);
+                    (HistorySource::Stateless, notes)
+                }
+            }
+        }
+        Some(Memory::Window { context_length }) => {
+            if args
+                .previous_messages
+                .as_ref()
+                .is_some_and(|messages| !messages.is_empty())
+            {
+                notes.push("Managed memory is on, so this step's previous messages are ignored.");
+            }
+            let memory_id = match args.memory_id.as_deref() {
+                Some("") => {
+                    notes.push(
+                        "This step's memory id evaluated to an empty value, so the agent runs without memory.",
+                    );
+                    return (HistorySource::Stateless, notes);
+                }
+                Some(step_memory_id) => memory_key(workspace_id, flow_path, step_memory_id),
+                None => match run_memory_id {
+                    Some(memory_id) => memory_id,
+                    None => {
+                        notes.push(no_memory_id);
+                        return (HistorySource::Stateless, notes);
+                    }
+                },
+            };
+            (
+                HistorySource::Window { memory_id, context_length: *context_length },
+                notes,
+            )
+        }
+        Some(Memory::Off) | None => {
+            if args.memory_id.as_deref().is_some_and(|id| !id.is_empty()) {
+                notes.push("Managed memory is off, so this step's memory id is ignored.");
+            }
+            match &args.previous_messages {
+                Some(messages) => (HistorySource::Messages(messages), notes),
+                None => (HistorySource::Stateless, notes),
+            }
+        }
+    }
+}
+
+/// An older memory setting reads neither history input, which is only visible in the job log: the
+/// editor offers them on a step that has been moved to the current settings.
+fn note_unread_step_inputs(notes: &mut Vec<&'static str>, args: &AIAgentArgs) {
+    if args.memory_id.as_deref().is_some_and(|id| !id.is_empty()) {
+        notes.push("This step uses an older memory setting, so its memory id is not read.");
+    }
+    if args
+        .previous_messages
+        .as_ref()
+        .is_some_and(|messages| !messages.is_empty())
+    {
+        notes
+            .push("This step uses an older memory setting, so its previous messages are not read.");
+    }
+}
+
+/// Whether a request has something to ask the model. Only text output sends previous messages, so
+/// an image prompt comes from the user message alone. An empty list is no conversation, except
+/// under a legacy `manual` memory, which ran on whatever list it held.
+fn has_prompt(
+    history: &HistorySource,
+    has_user_message: bool,
+    is_text_output: bool,
+    legacy_list: bool,
+) -> bool {
+    has_user_message
+        || (is_text_output
+            && (legacy_list || matches!(history, HistorySource::Messages(m) if !m.is_empty())))
+}
+
 fn find_module_by_id(
     modules: &Vec<FlowModule>,
     target_id: &str,
@@ -136,14 +278,16 @@ async fn find_ai_agent_tool_module_in_parent_agent(
         return Ok(None);
     };
 
-    let FlowModuleValue::AIAgent { tools, agent, .. } = parent_agent_module.get_value()? else {
+    let FlowModuleValue::AIAgent { tools, agent, tool_inputs, .. } =
+        parent_agent_module.get_value()?
+    else {
         return Ok(None);
     };
 
     // A linked parent carries no tools on the module (they live in the resource, resolved only in
     // the main execution branch). Resolve them from the resource here too, so a nested agent tool
     // of a saved+linked agent can still be located when it runs as its own job.
-    let tools = if let Some(agent_ref) = agent.as_deref() {
+    let mut tools = if let Some(agent_ref) = agent.as_deref() {
         let agent_path = agent_ref
             .trim_start_matches("$res:")
             .trim_start_matches("res://");
@@ -170,6 +314,9 @@ async fn find_ai_agent_tool_module_in_parent_agent(
     } else {
         tools
     };
+    // The nested job reads its history inputs from the tool's transforms, which must carry the
+    // host flow's bindings as the parent evaluated them.
+    overlay_tool_inputs(&mut tools, &tool_inputs);
 
     for tool in tools {
         if tool.id == tool_module_id {
@@ -456,6 +603,7 @@ pub async fn handle_ai_agent_job(
         omit_output_from_conversation,
         agent,
         tool_inputs,
+        input_transforms: step_input_transforms,
         ..
     } = module.get_value()?
     else {
@@ -466,9 +614,11 @@ pub async fn handle_ai_agent_job(
 
     // A linked step takes its brain and tools from the resource and keeps only its own flow-local
     // inputs. The brain and the roster stay rigid; what the step binds to this flow is the message
-    // it asks, which of those tools this use may call, the conversation it is part of, and the
-    // tools' own inputs — the last overlaid from `tool_inputs` below.
-    let (args, tools): (AIAgentArgs, Vec<AgentTool>) = if let Some(agent_ref) = agent.as_deref() {
+    // it asks, which of those tools this use may call, the conversation it is part of (its memory
+    // id and previous messages), and the tools' own inputs — the last overlaid from `tool_inputs`
+    // below.
+    let (mut args, tools): (AIAgentArgs, Vec<AgentTool>) = if let Some(agent_ref) = agent.as_deref()
+    {
         let agent_path = agent_ref
             .trim_start_matches("$res:")
             .trim_start_matches("res://");
@@ -500,6 +650,12 @@ pub async fn handle_ai_agent_job(
             None => Vec::new(),
         };
         overlay_tool_inputs(&mut tools, &tool_inputs);
+        // The resource is not validated against a schema, so a history input it happens to carry
+        // is dropped before interpolation, where a bad `$res:` in it would fail the step. The
+        // other flow-local keys stay: a resource's own user message is the step's fallback.
+        for key in STEP_HISTORY_KEYS {
+            config.remove(key);
+        }
         let brain = transform_json_value(
             "ai_agent",
             client,
@@ -521,7 +677,7 @@ pub async fn handle_ai_agent_job(
         // Only after interpolating the resource: these are caller-controlled and already resolved by
         // build_args_map, so passing them through it again would expand contextual values —
         // `$WM_TOKEN` in a user message would reach the model provider.
-        for key in ["user_message", "user_attachments", "enabled_tools"] {
+        for key in FLOW_LOCAL_AGENT_KEYS {
             if let Some(v) = local_args.get(key) {
                 brain.insert(
                     key.to_string(),
@@ -546,6 +702,8 @@ pub async fn handle_ai_agent_job(
         (args, tools)
     };
 
+    keep_authored_memory_id(&mut args, &step_input_transforms);
+
     // Nesting is capped at flow → agent → nested agent. When this job is itself a nested tool,
     // a linked resource's tool set may still contain AIAgent tools (the editor can't constrain a
     // shared resource); don't advertise them — invoking one would only fail the depth check as a
@@ -1010,8 +1168,18 @@ pub async fn run_agent(
     // Fetch flow context for input transforms context, chat and memory
     let mut flow_context = get_flow_context(db, job).await;
 
-    // Determine if we're using manual messages (which bypasses memory)
-    let use_manual_messages = matches!(args.memory, Some(Memory::Manual { .. }));
+    // The run's memory id is also the chat conversation id, which a step's own memory id never
+    // replaces.
+    let conversation_id = flow_context
+        .flow_status
+        .as_ref()
+        .and_then(|fs| fs.memory_id);
+    let (history, history_notes) = resolve_history_source(
+        args,
+        conversation_id,
+        &job.workspace_id,
+        flow_context.flow_path.as_deref().unwrap_or_default(),
+    );
 
     // Check if user_message is provided and non-empty
     let has_user_message = args
@@ -1020,63 +1188,63 @@ pub async fn run_agent(
         .map(|m| !m.is_empty())
         .unwrap_or(false);
 
-    // Validate: at least one of memory with manual messages or user_message must be provided
-    if !use_manual_messages && !has_user_message {
-        return Err(Error::internal_err(
-            "Either 'memory' with manual messages or 'user_message' must be provided".to_string(),
-        ));
-    }
-
     let is_text_output = output_type == &OutputType::Text;
 
-    // Flow-level memory_id (from chat mode) takes precedence over step-level memory_id
-    let memory_id = flow_context
-        .flow_status
-        .as_ref()
-        .and_then(|fs| fs.memory_id)
-        .or_else(|| {
-            // Extract memory_id from Memory::Auto if present
-            match &args.memory {
-                Some(Memory::Auto { memory_id, .. }) => *memory_id,
-                _ => None,
-            }
-        });
+    if is_text_output {
+        for note in &history_notes {
+            append_logs(&job.id, &job.workspace_id, format!("{note}\n"), conn).await;
+        }
+    } else if !matches!(args.memory, None | Some(Memory::Off))
+        || args.memory_id.is_some()
+        || args.previous_messages.is_some()
+    {
+        append_logs(
+            &job.id,
+            &job.workspace_id,
+            "Image output sends no history, so memory and previous messages are not read.\n",
+            conn,
+        )
+        .await;
+    }
+
+    // A `manual` memory sent whatever list it held, an empty one included, so a step that still has
+    // one keeps running without a user message.
+    let legacy_list = matches!(args.memory, Some(Memory::Manual { .. }));
+    if !has_prompt(&history, has_user_message, is_text_output, legacy_list) {
+        let missing = if !is_text_output {
+            "'user_message' must be provided for image output"
+        } else if matches!(
+            args.memory,
+            Some(Memory::Window { .. } | Memory::Auto { .. })
+        ) {
+            "'user_message' must be provided while managed memory is on"
+        } else {
+            "Either 'previous_messages' or 'user_message' must be provided"
+        };
+        return Err(Error::internal_err(missing.to_string()));
+    }
 
-    // Load messages based on history mode
     if matches!(output_type, OutputType::Text) {
-        match &args.memory {
-            Some(Memory::Manual { messages: manual_messages }) => {
-                // Use explicitly provided messages (bypass memory)
-                if !manual_messages.is_empty() {
-                    messages.extend(manual_messages.clone());
-                }
-            }
-            Some(Memory::Auto { context_length, .. }) => {
-                // Auto mode: load from memory
+        match &history {
+            HistorySource::Messages(provided) => messages.extend(provided.iter().cloned()),
+            HistorySource::Window { memory_id, context_length } => {
                 if let Some(step_id) = effective_flow_step_id {
-                    if let Some(memory_id) = memory_id {
-                        // Read messages from memory
-                        match read_from_memory(db, &job.workspace_id, memory_id, step_id).await {
-                            Ok(Some(loaded_messages)) => {
-                                let messages_to_load = prepare_auto_memory_messages_for_request(
-                                    &loaded_messages,
-                                    *context_length,
-                                );
-                                messages.extend(messages_to_load);
-                            }
-                            Ok(None) => {}
-                            Err(e) => {
-                                tracing::error!(
-                                    "Failed to read memory for step {}: {}",
-                                    step_id,
-                                    e
-                                );
-                            }
+                    match read_from_memory(db, &job.workspace_id, *memory_id, step_id).await {
+                        Ok(Some(loaded_messages)) => {
+                            let messages_to_load = prepare_auto_memory_messages_for_request(
+                                &loaded_messages,
+                                *context_length,
+                            );
+                            messages.extend(messages_to_load);
+                        }
+                        Ok(None) => {}
+                        Err(e) => {
+                            tracing::error!("Failed to read memory for step {}: {}", step_id, e);
                         }
                     }
                 }
             }
-            _ => {}
+            HistorySource::Stateless => {}
         }
     }
 
@@ -1521,30 +1689,35 @@ pub async fn run_agent(
                         ..Default::default()
                     });
                     if persist_output_to_conversation {
-                        if let Some(memory_id) = memory_id {
-                            let agent_job_id = job.id;
-                            let db_clone = db.clone();
-                            let message_content = "Used websearch tool successfully".to_string();
-                            let step_name = step_name.clone();
-                            tokio::spawn(async move {
-                                if let Err(e) = add_message_to_conversation(
-                                    &db_clone,
-                                    &memory_id,
-                                    Some(agent_job_id),
-                                    &message_content,
-                                    MessageType::Tool,
-                                    &step_name,
-                                    true,
-                                )
-                                .await
-                                {
-                                    tracing::warn!(
-                                        "Failed to add websearch tool message to conversation {}: {}",
-                                        memory_id,
-                                        e
-                                    );
-                                }
+                        if let Some(conversation_id) = conversation_id {
+                            // The search ran inside the provider's call, so this job's args
+                            // describe the agent, not the search: its sources reach the row
+                            // only if they are written here.
+                            let extras = (!annotations.is_empty()).then(|| MessageExtras {
+                                tool_result: serde_json::to_string(&annotations).ok(),
+                                ..Default::default()
                             });
+                            // Awaited like every row of the loop, so rows commit in turn order.
+                            // Worded like every other tool row, so a reader recovers the tool
+                            // name from the sentence.
+                            if let Err(e) = add_message_to_conversation(
+                                db,
+                                &conversation_id,
+                                Some(job.id),
+                                "Used websearch tool",
+                                MessageType::Tool,
+                                &step_name,
+                                true,
+                                extras.as_ref(),
+                            )
+                            .await
+                            {
+                                tracing::warn!(
+                                    "Failed to add websearch tool message to conversation {}: {}",
+                                    conversation_id,
+                                    e
+                                );
+                            }
                         }
                     }
                 }
@@ -1573,32 +1746,30 @@ pub async fn run_agent(
 
                     // Add assistant message to conversation if chat_input_enabled
                     if persist_output_to_conversation && !response_content.is_empty() {
-                        if let Some(memory_id) = memory_id {
-                            let agent_job_id = job.id;
-                            let db_clone = db.clone();
-                            let message_content = response_content.clone();
-                            let step_name = step_name.clone();
-
-                            // Spawn task because we do not need to wait for the result
-                            tokio::spawn(async move {
-                                if let Err(e) = add_message_to_conversation(
-                                    &db_clone,
-                                    &memory_id,
-                                    Some(agent_job_id),
-                                    &message_content,
-                                    MessageType::Assistant,
-                                    &step_name,
-                                    true,
-                                )
-                                .await
-                                {
-                                    tracing::warn!(
-                                        "Failed to add assistant message to conversation {}: {}",
-                                        memory_id,
-                                        e
-                                    );
-                                }
+                        if let Some(conversation_id) = conversation_id {
+                            // This iteration's thinking goes on the answer's row; the job
+                            // result only keeps the turn's thinking as one string.
+                            let extras = response_reasoning.clone().map(|reasoning| {
+                                MessageExtras { reasoning: Some(reasoning), ..Default::default() }
                             });
+                            if let Err(e) = add_message_to_conversation(
+                                db,
+                                &conversation_id,
+                                Some(job.id),
+                                response_content,
+                                MessageType::Assistant,
+                                &step_name,
+                                true,
+                                extras.as_ref(),
+                            )
+                            .await
+                            {
+                                tracing::warn!(
+                                    "Failed to add assistant message to conversation {}: {}",
+                                    conversation_id,
+                                    e
+                                );
+                            }
                         }
                     }
                 }
@@ -1637,6 +1808,18 @@ pub async fn run_agent(
                     ..Default::default()
                 });
 
+                // A round's thinking is stored on one row, the first the round writes, which is
+                // where the stream shows it: its text row when it wrote text, else the row of
+                // its first call — the answer row below when that call is the structured-output
+                // tool. Two rows carrying it would show it twice after a reload.
+                let call_reasoning = response_reasoning
+                    .clone()
+                    .filter(|_| response_content.as_deref().unwrap_or("").is_empty());
+                let structured_output_first = structured_output_tool_name
+                    .as_ref()
+                    .zip(tool_calls.first())
+                    .map_or(false, |(name, tc)| tc.function.name == *name);
+
                 // Handle tool calls using extracted tools module
                 let tool_execution_ctx = ToolExecutionContext {
                     db,
@@ -1655,6 +1838,11 @@ pub async fn run_agent(
                     stream_event_processor: stream_event_processor.as_ref(),
                     flow_context: &mut flow_context,
                     omit_output_from_conversation,
+                    reasoning: if structured_output_first {
+                        None
+                    } else {
+                        call_reasoning.clone()
+                    },
                     previous_result: &previous_result,
                     id_context: &id_context,
                     tool_abort_handles: tool_abort_handles.clone(),
@@ -1673,6 +1861,41 @@ pub async fn run_agent(
                     .await?;
 
                 messages.extend(tool_messages);
+
+                // A structured answer is the arguments of the structured-output tool call,
+                // on which the loop ends without a text iteration, so its row is written here.
+                if tool_used_structured_output && persist_output_to_conversation {
+                    if let (Some(conversation_id), Some(OpenAIContent::Text(answer))) =
+                        (conversation_id, tool_content.as_ref())
+                    {
+                        let extras = call_reasoning
+                            .clone()
+                            .filter(|_| structured_output_first)
+                            .map(|reasoning| MessageExtras {
+                                reasoning: Some(reasoning),
+                                ..Default::default()
+                            });
+                        if let Err(e) = add_message_to_conversation(
+                            db,
+                            &conversation_id,
+                            Some(job.id),
+                            answer,
+                            MessageType::Assistant,
+                            &step_name,
+                            true,
+                            extras.as_ref(),
+                        )
+                        .await
+                        {
+                            tracing::warn!(
+                                "Failed to add structured answer to conversation {}: {}",
+                                conversation_id,
+                                e
+                            );
+                        }
+                    }
+                }
+
                 if let Some(tc) = tool_content {
                     content = Some(tc);
                 }
@@ -1692,10 +1915,7 @@ pub async fn run_agent(
 
                 // Add assistant message to conversation if chat_input_enabled
                 if persist_output_to_conversation {
-                    if let Some(memory_id) = memory_id {
-                        let agent_job_id = job.id;
-                        let db_clone = db.clone();
-
+                    if let Some(conversation_id) = conversation_id {
                         // Create extended version with type discriminator for conversation storage
                         // This avoids conflicts with outputs that are of the same format as S3 objects
                         let s3_with_type = S3ObjectWithType {
@@ -1706,26 +1926,24 @@ pub async fn run_agent(
                         let message_content = serde_json::to_string(&s3_with_type)
                             .unwrap_or_else(|_| content.get().to_string());
 
-                        // Spawn task because we do not need to wait for the result
-                        tokio::spawn(async move {
-                            if let Err(e) = add_message_to_conversation(
-                                &db_clone,
-                                &memory_id,
-                                Some(agent_job_id),
-                                &message_content,
-                                MessageType::Assistant,
-                                &step_name,
-                                true,
-                            )
-                            .await
-                            {
-                                tracing::warn!(
-                                    "Failed to add assistant message to conversation {}: {}",
-                                    memory_id,
-                                    e
-                                );
-                            }
-                        });
+                        if let Err(e) = add_message_to_conversation(
+                            db,
+                            &conversation_id,
+                            Some(job.id),
+                            &message_content,
+                            MessageType::Assistant,
+                            &step_name,
+                            true,
+                            None,
+                        )
+                        .await
+                        {
+                            tracing::warn!(
+                                "Failed to add assistant message to conversation {}: {}",
+                                conversation_id,
+                                e
+                            );
+                        }
                     }
                 }
 
@@ -1778,13 +1996,10 @@ pub async fn run_agent(
         }
     }
 
-    // Persist complete conversation to memory at the end (only if in auto mode with context length)
-    // Skip memory persistence if using manual messages (bypass memory entirely)
-    // final_messages contains the complete history (old messages + new ones)
-    if matches!(output_type, OutputType::Text) && !use_manual_messages {
-        if let Some(Memory::Auto { context_length, .. }) = &args.memory {
+    // final_messages holds the complete history: what was loaded plus this run's messages
+    if matches!(output_type, OutputType::Text) {
+        if let HistorySource::Window { memory_id, context_length } = &history {
             if let Some(step_id) = effective_flow_step_id {
-                // Extract OpenAIMessages from final_messages
                 let all_messages: Vec<OpenAIMessage> =
                     final_messages.iter().map(|m| m.message.clone()).collect();
 
@@ -1794,23 +2009,21 @@ pub async fn run_agent(
                         *context_length,
                     );
 
-                    if let Some(memory_id) = memory_id {
-                        if let Err(e) = write_to_memory(
-                            db,
-                            &job.workspace_id,
-                            memory_id,
+                    if let Err(e) = write_to_memory(
+                        db,
+                        &job.workspace_id,
+                        *memory_id,
+                        step_id,
+                        &messages_to_persist,
+                    )
+                    .await
+                    {
+                        tracing::error!(
+                            "Failed to persist {} messages to memory for step {}: {}",
+                            messages_to_persist.len(),
                             step_id,
-                            &messages_to_persist,
-                        )
-                        .await
-                        {
-                            tracing::error!(
-                                "Failed to persist {} messages to memory for step {}: {}",
-                                messages_to_persist.len(),
-                                step_id,
-                                e
-                            );
-                        }
+                            e
+                        );
                     }
                 }
             }
@@ -1870,6 +2083,228 @@ mod tests {
         }
     }
 
+    #[derive(Debug, PartialEq)]
+    enum Resolved {
+        Messages(usize),
+        Window(Uuid, usize),
+        Stateless { noted: bool },
+    }
+
+    /// Every memory shape a worker may still read, resolved against a run with or without a
+    /// memory id. The hashed id is pinned: changing it detaches memories stored under string ids.
+    #[test]
+    fn history_source_resolves_every_memory_shape() {
+        use serde_json::json;
+        let run = Uuid::from_u128(1);
+        let baked = Uuid::from_u128(2);
+        let cust_1 = Uuid::parse_str("0168fcea-ffa7-5c15-bdb0-7709bb5f540d").unwrap();
+        let window = json!({ "kind": "window", "context_length": 10 });
+        let message = json!([{ "role": "user", "content": "earlier" }]);
+        let two_messages = json!([
+            { "role": "user", "content": "earlier" },
+            { "role": "assistant", "content": "reply" }
+        ]);
+        let cases = [
+            (
+                "absent memory is off",
+                json!({}),
+                Some(run),
+                Resolved::Stateless { noted: false },
+            ),
+            (
+                "legacy off",
+                json!({ "memory": { "kind": "off" } }),
+                Some(run),
+                Resolved::Stateless { noted: false },
+            ),
+            (
+                "legacy auto prefers the run's id",
+                json!({ "memory": { "kind": "auto", "context_length": 4, "memory_id": baked } }),
+                Some(run),
+                Resolved::Window(run, 4),
+            ),
+            (
+                "legacy auto falls back to its baked id",
+                json!({ "memory": { "kind": "auto", "context_length": 4, "memory_id": baked } }),
+                None,
+                Resolved::Window(baked, 4),
+            ),
+            (
+                "legacy auto with an empty baked id uses the run's",
+                json!({ "memory": { "kind": "auto", "context_length": 4, "memory_id": "" } }),
+                Some(run),
+                Resolved::Window(run, 4),
+            ),
+            (
+                "legacy auto with an empty baked id and no run id is stateless",
+                json!({ "memory": { "kind": "auto", "context_length": 4, "memory_id": " " } }),
+                None,
+                Resolved::Stateless { noted: true },
+            ),
+            (
+                "legacy auto without a length is off",
+                json!({ "memory": { "kind": "auto", "memory_id": baked } }),
+                Some(run),
+                Resolved::Stateless { noted: false },
+            ),
+            (
+                "a cleared count is off",
+                json!({ "memory": { "kind": "window", "context_length": null } }),
+                Some(run),
+                Resolved::Stateless { noted: false },
+            ),
+            (
+                "legacy manual replays its messages",
+                json!({ "memory": { "kind": "manual", "messages": message } }),
+                Some(run),
+                Resolved::Messages(1),
+            ),
+            (
+                "window keeps the run's memory",
+                json!({ "memory": window }),
+                Some(run),
+                Resolved::Window(run, 10),
+            ),
+            (
+                "window without a memory id is stateless",
+                json!({ "memory": window }),
+                None,
+                Resolved::Stateless { noted: true },
+            ),
+            (
+                "a step memory id overrides the run's",
+                json!({ "memory": window, "memory_id": "cust_1" }),
+                Some(run),
+                Resolved::Window(cust_1, 10),
+            ),
+            (
+                "a uuid step memory id is used as is",
+                json!({ "memory": window, "memory_id": baked.to_string() }),
+                Some(run),
+                Resolved::Window(baked, 10),
+            ),
+            (
+                "a step memory id evaluating to null is stateless",
+                json!({ "memory": window, "memory_id": null }),
+                Some(run),
+                Resolved::Stateless { noted: true },
+            ),
+            (
+                "an off policy ignores the step memory id, and says so",
+                json!({ "memory": { "kind": "off" }, "memory_id": "cust_1" }),
+                Some(run),
+                Resolved::Stateless { noted: true },
+            ),
+            (
+                "managed memory ignores the step's previous messages",
+                json!({ "memory": window, "memory_id": "cust_1", "previous_messages": message }),
+                Some(run),
+                Resolved::Window(cust_1, 10),
+            ),
+            (
+                "memory that is off sends the step's previous messages",
+                json!({ "previous_messages": message }),
+                Some(run),
+                Resolved::Messages(1),
+            ),
+            (
+                "a previous messages expression that evaluated to null is no history",
+                json!({ "previous_messages": null }),
+                Some(run),
+                Resolved::Stateless { noted: false },
+            ),
+            (
+                "a legacy manual list ignores the step's previous messages",
+                json!({ "memory": { "kind": "manual", "messages": message }, "previous_messages": two_messages }),
+                Some(run),
+                Resolved::Messages(1),
+            ),
+            (
+                "legacy auto ignores a step memory id",
+                json!({ "memory": { "kind": "auto", "context_length": 4, "memory_id": baked }, "memory_id": "cust_1" }),
+                None,
+                Resolved::Window(baked, 4),
+            ),
+        ];
+        for (name, history, run_memory_id, expected) in cases {
+            let mut raw = json!({ "provider": { "kind": "openai", "resource": {}, "model": "m" } });
+            raw.as_object_mut()
+                .unwrap()
+                .extend(history.as_object().unwrap().clone());
+            let args: AIAgentArgs = serde_json::from_value(raw).unwrap();
+            let resolved = match resolve_history_source(&args, run_memory_id, "ws", "f/flow") {
+                (HistorySource::Messages(m), _) => Resolved::Messages(m.len()),
+                (HistorySource::Window { memory_id, context_length }, _) => {
+                    Resolved::Window(memory_id, context_length)
+                }
+                (HistorySource::Stateless, notes) => {
+                    Resolved::Stateless { noted: !notes.is_empty() }
+                }
+            };
+            assert_eq!(resolved, expected, "{name}");
+        }
+    }
+
+    /// A placeholder the form seeds must not read as a memory id that evaluated to nothing, which
+    /// would turn memory off for the step.
+    #[test]
+    fn only_an_expression_can_set_an_empty_step_memory_id() {
+        let transforms = |memory_id: &str| -> HashMap<String, InputTransform> {
+            HashMap::from([(
+                "memory_id".to_string(),
+                serde_json::from_str(memory_id).unwrap(),
+            )])
+        };
+        let args = || -> AIAgentArgs {
+            serde_json::from_value(serde_json::json!({
+                "provider": { "kind": "openai", "resource": {}, "model": "m" },
+                "memory_id": null,
+            }))
+            .unwrap()
+        };
+        for (transform, expected) in [
+            (r#"{ "type": "static" }"#, None),
+            (r#"{ "type": "static", "value": "" }"#, None),
+            (r#"{ "type": "ai" }"#, None),
+            (
+                r#"{ "type": "javascript", "expr": "flow_input.customer_id" }"#,
+                Some(""),
+            ),
+        ] {
+            let mut args = args();
+            keep_authored_memory_id(&mut args, &transforms(transform));
+            assert_eq!(args.memory_id.as_deref(), expected, "{transform}");
+        }
+    }
+
+    /// Only text output sends previous messages, so they never stand in for an image prompt.
+    #[test]
+    fn previous_messages_never_stand_in_for_an_image_prompt() {
+        let args: AIAgentArgs = serde_json::from_value(serde_json::json!({
+            "provider": { "kind": "openai", "resource": {}, "model": "m" },
+            "previous_messages": [{ "role": "user", "content": "earlier" }],
+        }))
+        .unwrap();
+        let (history, _) = resolve_history_source(&args, None, "ws", "f/flow");
+        assert!(has_prompt(&history, false, true, false));
+        assert!(!has_prompt(&history, false, false, false));
+        assert!(has_prompt(&history, true, false, false));
+        assert!(!has_prompt(
+            &HistorySource::Messages(&[]),
+            false,
+            true,
+            false
+        ));
+        // A legacy `manual` memory ran on an empty list alone, and still does for text output.
+        assert!(has_prompt(&HistorySource::Messages(&[]), false, true, true));
+        assert!(!has_prompt(
+            &HistorySource::Messages(&[]),
+            false,
+            false,
+            true
+        ));
+    }
+
     #[test]
     fn reasoning_keeps_every_iteration_in_order() {
         let mut acc = String::new();

backend/windmill-worker/src/result_processor.rs

@@ -1254,18 +1254,6 @@ async fn maybe_open_git_sync_deploy_pr(
     if row.marker.is_none() {
         return;
     }
-    // Runtime Enterprise gate, like the poller: the toggles may have been set
-    // while a license was active (or written directly), and this hook drives
-    // GitHub API calls with the installation token.
-    if !matches!(
-        windmill_common::ee_oss::get_license_plan().await,
-        windmill_common::ee_oss::LicensePlan::Enterprise
-    ) {
-        tracing::warn!(
-            "git sync PR: skipping PR creation for {workspace_id}: requires an Enterprise license"
-        );
-        return;
-    }
     let Some(repo_path) = row.repo_path else {
         return;
     };

backend/windmill-worker/src/worker_flow.rs

@@ -2236,6 +2236,7 @@ async fn add_tool_message_to_conversation(
                     MessageType::Assistant,
                     None,
                     success,
+                    None,
                 )
                 .await?;
                 tx.commit().await?;

benchmarks/lib.ts

@@ -2,7 +2,7 @@ import { sleep } from "https://deno.land/x/sleep@v1.2.1/mod.ts";
 import * as windmill from "https://deno.land/x/windmill@v1.174.0/mod.ts";
 import * as api from "https://deno.land/x/windmill@v1.174.0/windmill-api/index.ts";
 
-export const VERSION = "v1.812.0";
+export const VERSION = "v1.814.0";
 
 export async function login(email: string, password: string): Promise<string> {
   return await windmill.UserService.login({

chat-sdk/README.md

@@ -56,8 +56,10 @@ not a replacement of the previous answer.
 
 The transport also carries the history helpers: `transport.loadMessages(id)` returns
 `UIMessage`s for `useChat({ messages })` or `setMessages`, `transport.listConversations()`
-and `transport.deleteConversation(id)`. Attachments are not supported: `sendMessage` with
-`files` is refused with an explanatory error.
+and `transport.deleteConversation(id)`. A loaded user message lists the files it carried
+in `metadata.attachments`; `WindmillChatApi.attachmentUrl` gives each one's download URL.
+Sending attachments is not supported: `sendMessage` with `files` is refused with an
+explanatory error.
 
 ## assistant-ui
 
@@ -181,7 +183,7 @@ await chat.sendMessage('Hello')
 | `workspace` | Detected inside a raw app. |
 | `token` | A token, or a function returning one (called before every request, so it can fetch a short-lived token from your backend). Omit it inside a raw app. |
 | `history` | `'server'`, `'local'` or `'none'`, see [History](#history). Defaults to `'server'` with a viewer session and `'local'` with an explicit `token`. |
-| `inputs` | Extra flow inputs sent with every message. `sendMessage(text, { inputs })` adds per-message ones. |
+| `inputs` | Extra flow inputs sent with every message. `sendMessage(text, { inputs })` adds per-message ones, and `{ attachments, attachmentsInput }` files, see [Attachments](#attachments). |
 | `storageKey` | Namespace for `local` history, e.g. the signed-in user's id. Local history is per browser and per flow; without it, users sharing a browser share it. |
 | `fetch`, `storage` | Replacements for the globals, for tests and unusual runtimes. |
 | `pageSize` | Messages and conversations per page of server history. Default 50. |
@@ -224,12 +226,41 @@ A turn goes `submitted` (the flow is queued) → `streaming` (the answer is arri
 answer, an `assistant` message with `success: false`. `status: 'error'` (with `error`
 set) means the turn could not run or be followed at all, such as a refused request.
 
-Methods: `sendMessage(text, { inputs? })`, `stop()`, `newConversation()`,
-`selectConversation(id)`, `loadConversations({ page?, perPage? })`,
-`deleteConversation(id)`, `loadOlderMessages()`, `destroy()`. Switching conversations
+Methods: `sendMessage(text, { inputs?, attachments?, attachmentsInput? })`, `stop()`,
+`newConversation()`, `selectConversation(id)`, `loadConversations({ page?, perPage?, kind? })`,
+`deleteConversation(id)`, `renameConversation(id, title)`, `loadOlderMessages()`,
+`destroy()`. `kind` lists the flow editor's test chats (`'test'`), the deployed flow's
+own (`'deployed'`, the server's default) or both (`'all'`); each `Conversation` carries
+`isTest`. A rename keeps the conversation's place in the list. Switching conversations
 stops following the current answer; the flow keeps running and, with server history,
 its answer is there when you come back.
 
+## Attachments
+
+A flow whose AI agent step reads `user_attachments` from an `s3object[]` (or a single
+`s3object`) flow input takes files with a message:
+
+```ts
+await chat.sendMessage('What does this contract say?', {
+  attachments: [{ name: file.name, data: file }], // a Blob/File, or a `data:` URL
+  attachmentsInput: { name: 'files', multiple: true }
+})
+```
+
+Each file is uploaded to the workspace's object storage under
+`windmill_uploads/chat/<turn>/<index>/<name>` and handed to the input as `{ s3, filename }`
+objects (the object for a single-file input). Once the uploads return, the pending user
+message lists them in `attachments`, as `{ input, s3, filename }` references. The name's
+extension is corrected to the file's media type for PNG, JPEG and PDF, because the worker
+reads the type off the key.
+Files need message text to go with them. A failed upload rejects `sendMessage` before any
+run starts, and `stop()` during the upload aborts it; both leave the transcript as it was.
+The chat never deletes uploads, so files of a send that did not run stay in storage. The
+workspace needs object storage set up. With Enterprise advanced storage permissions, the
+user needs read and write on `windmill_uploads/*`, which the default rules grant. The upload goes through
+`job_helpers`, so a restricted token needs `job_helpers:write`; a sandboxed raw app cannot
+request that scope today, so attachments are not available there yet.
+
 ## History
 
 Windmill stores every conversation of a chat-mode flow, and each Windmill user sees

chat-sdk/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "windmill-chat",
-  "version": "1.812.0",
+  "version": "1.814.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "windmill-chat",
-      "version": "1.812.0",
+      "version": "1.814.0",
       "license": "Apache-2.0",
       "devDependencies": {
         "@ai-sdk/react": "^4.0.102",

chat-sdk/package.json

@@ -1,7 +1,7 @@
 {
   "name": "windmill-chat",
   "description": "Build chat interfaces on Windmill flows deployed in chat mode, from any frontend or raw app",
-  "version": "1.812.0",
+  "version": "1.814.0",
   "author": "Ruben Fiszel",
   "license": "Apache-2.0",
   "homepage": "https://github.com/windmill-labs/windmill/tree/main/chat-sdk#readme",

chat-sdk/src/ai-sdk.ts

@@ -1,5 +1,10 @@
 import type { ChatTransport, UIMessage, UIMessageChunk, UIMessagePart } from 'ai'
-import { WindmillApiError, WindmillChatApi, type WindmillChatApiOptions } from './api'
+import {
+  WindmillApiError,
+  WindmillChatApi,
+  type FlowConversationMessage,
+  type WindmillChatApiOptions
+} from './api'
 import { followJob } from './follow'
 import type { AgentStreamEvent } from './stream'
 import type { ChatMessage, Conversation } from './types'
@@ -101,7 +106,9 @@ export function createWindmillChatTransport<UI_MESSAGE extends UIMessage = UIMes
           stepName: row.step_name ?? undefined,
           pending: false,
           seq: row.created_seq,
-          tool: toolFromRowContent(row.message_type, row.content, row.success ?? true)
+          reasoning: row.reasoning ?? undefined,
+          attachments: row.attachments ?? undefined,
+          tool: toolFromRow(row)
         }))
       ) as UI_MESSAGE[]
     },
@@ -123,10 +130,20 @@ export function createWindmillChatTransport<UI_MESSAGE extends UIMessage = UIMes
   }
 }
 
-function toolFromRowContent(role: string, content: string, success: boolean): ChatMessage['tool'] {
-  if (role !== 'tool') return undefined
-  const name = /^Used (.+) tool$/.exec(content)?.[1] ?? /^Error executing (.+)$/.exec(content)?.[1]
-  return name ? { name, status: success ? 'success' : 'error' } : undefined
+/** The call a stored tool row carries: its tool, named by the sentence the worker words
+ *  every tool row from, and the model's arguments and what it got back — for a failed
+ *  tool, the result is what it failed with. */
+function toolFromRow(row: FlowConversationMessage): ChatMessage['tool'] {
+  if (row.message_type !== 'tool') return undefined
+  const name =
+    /^Used (.+) tool$/.exec(row.content)?.[1] ?? /^Error executing (.+)$/.exec(row.content)?.[1]
+  if (!name) return undefined
+  return {
+    name,
+    status: (row.success ?? true) ? 'success' : 'error',
+    arguments: row.tool_arguments ?? undefined,
+    result: row.tool_result ?? undefined
+  }
 }
 
 /** Streams a job's answer as AI SDK chunks; resumes from `entry.offset` when the job is already running. */
@@ -292,13 +309,21 @@ class PartWriter {
 
 /**
  * `ChatMessage`s (Windmill's role-per-row model) as `UIMessage`s: an assistant
- * turn becomes one message whose parts carry its text, reasoning and tool calls.
+ * turn becomes one message whose parts carry its text, reasoning and tool calls. A
+ * user message's attachments ride in `metadata.attachments`, as references for
+ * `WindmillChatApi.attachmentUrl`: a `file` part would need a URL the browser can
+ * load unauthenticated.
  */
 export function toUIMessages(messages: ChatMessage[]): UIMessage[] {
   const out: UIMessage[] = []
   for (const m of messages) {
     if (m.role === 'user' || m.role === 'system') {
-      out.push({ id: m.id, role: m.role, parts: [{ type: 'text', text: m.content }] })
+      out.push({
+        id: m.id,
+        role: m.role,
+        ...(m.attachments?.length ? { metadata: { attachments: m.attachments } } : {}),
+        parts: [{ type: 'text', text: m.content }]
+      })
       continue
     }
     let target = out[out.length - 1]
@@ -306,18 +331,18 @@ export function toUIMessages(messages: ChatMessage[]): UIMessage[] {
       target = { id: m.id, role: 'assistant', parts: [] }
       out.push(target)
     }
+    if (m.reasoning) target.parts.push({ type: 'reasoning', text: m.reasoning, state: 'done' })
     if (m.role === 'tool') {
       const toolCallId = m.tool?.callId ?? m.id
       const toolName = m.tool?.name ?? 'tool'
       const input = parseJsonOr(m.tool?.arguments)
       target.parts.push(
         m.success
-          ? { type: 'dynamic-tool', toolName, toolCallId, state: 'output-available', input, output: parseJsonOr(m.tool?.result) ?? m.content }
+          ? { type: 'dynamic-tool', toolName, toolCallId, state: 'output-available', input, output: m.tool?.result !== undefined ? parseJsonOr(m.tool.result) : m.content }
           : { type: 'dynamic-tool', toolName, toolCallId, state: 'output-error', input, errorText: m.tool?.result ?? m.content }
       )
       continue
     }
-    if (m.reasoning) target.parts.push({ type: 'reasoning', text: m.reasoning, state: 'done' })
     if (m.content) target.parts.push({ type: 'text', text: m.content, state: 'done' })
   }
   return out

chat-sdk/src/api.ts

@@ -1,4 +1,4 @@
-import type { FetchLike, TokenSource } from './types'
+import type { ChatAttachment, FetchLike, TokenSource } from './types'
 
 export interface WindmillChatApiOptions {
   baseUrl: string
@@ -28,8 +28,16 @@ export interface FlowConversation {
   created_at: string
   updated_at: string
   created_by: string
+  /** Started from the flow editor's test panel rather than a deployed run. */
+  is_test: boolean
 }
 
+/**
+ * Which conversations a listing holds: the flow editor's test chats, the deployed flow's
+ * own (the server's default), or both.
+ */
+export type ConversationKind = 'test' | 'deployed' | 'all'
+
 export interface FlowConversationMessage {
   id: string
   conversation_id: string
@@ -40,6 +48,14 @@ export interface FlowConversationMessage {
   created_seq: number
   step_name?: string | null
   success?: boolean
+  /** On a tool row, the arguments the model wrote, without the inputs a step wires in; null for a web search. */
+  tool_arguments?: string | null
+  /** On a tool row, the text the model got back or what the call failed with; a web search's citations. */
+  tool_result?: string | null
+  /** On an answer, the thinking that produced it; on a tool row, the thinking that led to the call. */
+  reasoning?: string | null
+  /** The files a user message carried, as object-storage references. */
+  attachments?: ChatAttachment[] | null
 }
 
 export type JobUpdateEvent =
@@ -158,6 +174,17 @@ export class WindmillChatApi {
     return (await res.json()) as FlowJobStatus
   }
 
+  /**
+   * Where a message's attachment downloads from. The endpoint authenticates like every other
+   * request: a consumer holding a token must fetch it with that token, not put the URL in an
+   * `img src`, which would send only the Windmill session cookie.
+   */
+  attachmentUrl(attachment: ChatAttachment): string {
+    const query = new URLSearchParams({ file_key: attachment.s3 })
+    if (attachment.storage) query.set('storage', attachment.storage)
+    return `${this.#baseUrl}/api/w/${encodeURIComponent(this.#workspace)}/job_helpers/download_s3_file?${query}`
+  }
+
   async cancelJob(jobId: string, reason = 'Stopped from the chat'): Promise<void> {
     await this.#request(`jobs_u/queue/cancel/${encodeURIComponent(jobId)}`, {
       method: 'POST',
@@ -167,15 +194,25 @@ export class WindmillChatApi {
 
   async listConversations(
     flowPath: string,
-    options: { page?: number; perPage?: number; signal?: AbortSignal } = {}
+    options: { page?: number; perPage?: number; kind?: ConversationKind; signal?: AbortSignal } = {}
   ): Promise<FlowConversation[]> {
+    const extra: Record<string, string> = { flow_path: flowPath }
+    if (options.kind !== undefined) extra.kind = options.kind
     const res = await this.#request('flow_conversations/list', {
-      query: pagination(options, { flow_path: flowPath }),
+      query: pagination(options, extra),
       signal: options.signal
     })
     return (await res.json()) as FlowConversation[]
   }
 
+  /** Sets a conversation's title. Its place in the list is kept: only a turn moves one. */
+  async renameConversation(conversationId: string, title: string): Promise<void> {
+    await this.#request(`flow_conversations/update/${encodeURIComponent(conversationId)}`, {
+      method: 'POST',
+      body: { title }
+    })
+  }
+
   /**
    * Without `afterSeq`: one page counted from the newest message, returned oldest first.
    * With `afterSeq`: the messages created after that cursor, oldest first.
@@ -193,6 +230,27 @@ export class WindmillChatApi {
     return (await res.json()) as FlowConversationMessage[]
   }
 
+  /**
+   * Puts bytes in the workspace's object storage under `fileKey` and returns the key they were
+   * stored under (the server may rewrite it). Needs the workspace to have object storage set.
+   */
+  async uploadFile(
+    fileKey: string,
+    body: Blob,
+    options: { contentType?: string; signal?: AbortSignal } = {}
+  ): Promise<{ file_key: string }> {
+    const query: Record<string, string> = { file_key: fileKey }
+    if (options.contentType) query.content_type = options.contentType
+    const res = await this.#request('job_helpers/upload_s3_file', {
+      method: 'POST',
+      query,
+      raw: body,
+      contentType: options.contentType || 'application/octet-stream',
+      signal: options.signal
+    })
+    return (await res.json()) as { file_key: string }
+  }
+
   async deleteConversation(conversationId: string): Promise<void> {
     await this.#request(`flow_conversations/delete/${encodeURIComponent(conversationId)}`, {
       method: 'DELETE'
@@ -204,7 +262,11 @@ export class WindmillChatApi {
     init: {
       method?: string
       query?: Record<string, string>
+      /** JSON-encoded. */
       body?: unknown
+      /** Sent as is, under `contentType`. */
+      raw?: Blob
+      contentType?: string
       accept?: string
       signal?: AbortSignal
     } = {}
@@ -215,13 +277,14 @@ export class WindmillChatApi {
     const headers: Record<string, string> = {}
     if (init.accept) headers['Accept'] = init.accept
     if (init.body !== undefined) headers['Content-Type'] = 'application/json'
+    else if (init.raw !== undefined) headers['Content-Type'] = init.contentType ?? 'application/octet-stream'
     const token = typeof this.#token === 'function' ? await this.#token() : this.#token
     if (token) headers['Authorization'] = `Bearer ${token}`
 
     const res = await this.#fetch(url.toString(), {
       method: init.method ?? 'GET',
       headers,
-      body: init.body === undefined ? undefined : JSON.stringify(init.body),
+      body: init.body === undefined ? init.raw : JSON.stringify(init.body),
       // A token must not be paired with ambient cookies; without one, the cookie is
       // the credential and only rides same-origin requests.
       credentials: token ? 'omit' : 'same-origin',

chat-sdk/src/assistant-ui.ts

@@ -53,7 +53,8 @@ export function useWindmillRuntime(options: WindmillRuntimeOptions): AssistantRu
             threads: chat.conversations.map((c) => ({ status: 'regular' as const, id: c.id, title: c.title })),
             onSwitchToNewThread: () => chat.newConversation(),
             onSwitchToThread: (id) => chat.selectConversation(id),
-            onDelete: (id) => chat.deleteConversation(id)
+            onDelete: (id) => chat.deleteConversation(id),
+            onRename: (id, title) => chat.renameConversation(id, title)
           }
         }
       : undefined
@@ -91,6 +92,7 @@ export function toThreadMessage(turn: WindmillTurn): ThreadMessageLike {
   }
   const content: ThreadContentPart[] = []
   for (const m of turn.messages) {
+    if (m.reasoning) content.push({ type: 'reasoning', text: m.reasoning })
     if (m.role === 'tool') {
       const args = parseJsonOr(m.tool?.arguments)
       content.push({
@@ -99,12 +101,12 @@ export function toThreadMessage(turn: WindmillTurn): ThreadMessageLike {
         toolName: m.tool?.name ?? 'tool',
         args: (isJsonObject(args) ? args : args === undefined ? {} : { input: args }) as ToolCallArgs,
         argsText: m.tool?.arguments ?? '',
-        result: m.tool?.status === 'running' ? undefined : (parseJsonOr(m.tool?.result) ?? m.content),
+        result:
+          m.tool?.status === 'running' ? undefined : m.tool?.result !== undefined ? parseJsonOr(m.tool.result) : m.content,
         isError: m.tool?.status === 'error'
       })
       continue
     }
-    if (m.reasoning) content.push({ type: 'reasoning', text: m.reasoning })
     if (m.content) content.push({ type: 'text', text: m.content })
   }
   const last = turn.messages[turn.messages.length - 1]

chat-sdk/src/attachments.ts

@@ -0,0 +1,116 @@
+import type { WindmillChatApi } from './api'
+import type { AttachmentUpload } from './types'
+import { abortError, isAbortError } from './utils'
+
+/**
+ * Where a chat's uploads live in the workspace's object storage. Under `windmill_uploads/`
+ * because the default Enterprise storage permissions grant every user write and read there
+ * and deny any other top-level prefix: a key outside it is refused for non-admins, both on
+ * upload and when the agent's job reads the file back.
+ */
+export const CHAT_UPLOADS_PREFIX = 'windmill_uploads/chat'
+
+/** What an AI agent step reads out of `user_attachments`. */
+export interface UploadedAttachment {
+  s3: string
+  filename: string
+}
+
+/**
+ * The extension each type must be stored under. The worker reads an attachment's media type
+ * from the key's extension only (`mime_guess` in `windmill-ai/src/image_handler.rs`, falling
+ * back to `image/png`), never from the stored content type, so the extension must be true.
+ */
+const EXTENSION_BY_MEDIA_TYPE: Record<string, string> = {
+  'image/png': 'png',
+  'image/jpeg': 'jpg',
+  'application/pdf': 'pdf'
+}
+
+/**
+ * The name an attachment is stored under: the picked name with the extension its media type
+ * needs, e.g. a `photo.webp` re-encoded to PNG becomes `photo.png`. Other types keep their name.
+ */
+export function storedAttachmentName(filename: string, mediaType: string): string {
+  const extension = EXTENSION_BY_MEDIA_TYPE[mediaType]
+  if (!extension) return filename
+  const stem = filename.replace(/\.[^./]+$/, '')
+  return `${stem || filename}.${extension}`
+}
+
+/** The bytes of an attachment as a Blob carrying its media type. */
+export function attachmentBlob(attachment: AttachmentUpload): Blob {
+  const data =
+    typeof attachment.data === 'string'
+      ? dataUrlToBlob(attachment.data, 'application/octet-stream')
+      : attachment.data
+  return attachment.mediaType && attachment.mediaType !== data.type
+    ? new Blob([data], { type: attachment.mediaType })
+    : data
+}
+
+function dataUrlToBlob(dataUrl: string, fallbackType: string): Blob {
+  const comma = dataUrl.indexOf(',')
+  if (!dataUrl.startsWith('data:') || comma === -1) {
+    throw new Error('windmill-chat: an attachment given as a string must be a data: URL')
+  }
+  const header = dataUrl.slice(5, comma)
+  const isBase64 = header.endsWith(';base64')
+  const mediaType = (isBase64 ? header.slice(0, -';base64'.length) : header) || fallbackType
+  const payload = dataUrl.slice(comma + 1)
+  if (!isBase64) return new Blob([decodeURIComponent(payload)], { type: mediaType })
+  const binary = atob(payload)
+  const bytes = new Uint8Array(binary.length)
+  for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i)
+  return new Blob([bytes], { type: mediaType })
+}
+
+/**
+ * Put each attachment in the workspace's object storage and hand back what the agent reads.
+ * The key's turn prefix and per-file index keep two files with the same name, in this turn or
+ * an earlier one, from overwriting each other; the name stays the last segment.
+ */
+export async function uploadAttachments(
+  api: WindmillChatApi,
+  attachments: AttachmentUpload[],
+  turnId: string,
+  signal?: AbortSignal
+): Promise<UploadedAttachment[]> {
+  const prefix = `${CHAT_UPLOADS_PREFIX}/${turnId}`
+  // One failed upload aborts the rest. Nothing already stored is deleted: the chat never
+  // removes objects from the workspace's storage, so a send that does not run leaves them.
+  if (signal?.aborted) throw abortError()
+  const batch = new AbortController()
+  const abortBatch = () => batch.abort()
+  signal?.addEventListener('abort', abortBatch, { once: true })
+  try {
+    const results = await Promise.allSettled(
+      attachments.map(async (attachment, index) => {
+        try {
+          const blob = attachmentBlob(attachment)
+          const filename = storedAttachmentName(
+            attachment.name || `attachment-${index + 1}`,
+            blob.type
+          )
+          const { file_key } = await api.uploadFile(`${prefix}/${index}/${filename}`, blob, {
+            contentType: blob.type,
+            signal: batch.signal
+          })
+          return { s3: file_key, filename }
+        } catch (e) {
+          batch.abort()
+          throw e
+        }
+      })
+    )
+    const reasons = results.flatMap((r) => (r.status === 'rejected' ? [r.reason] : []))
+    // A stop that lands once every upload has answered still withdraws the batch.
+    if (reasons.length === 0 && !signal?.aborted) {
+      return results.flatMap((r) => (r.status === 'fulfilled' ? [r.value] : []))
+    }
+    // The failure that started it, not the aborts it caused in the other uploads.
+    throw reasons.find((reason) => !isAbortError(reason)) ?? reasons[0] ?? abortError()
+  } finally {
+    signal?.removeEventListener('abort', abortBatch)
+  }
+}

chat-sdk/src/chat.ts

@@ -1,12 +1,14 @@
 import {
   WindmillApiError,
   WindmillChatApi,
+  type ConversationKind,
   type FlowConversation,
   type FlowConversationMessage
 } from './api'
 import { resolveConfig, type ResolvedConfig } from './config'
 import { followJob } from './follow'
 import { createLocalHistory, type LocalHistory } from './history'
+import { uploadAttachments } from './attachments'
 import type { AgentStreamEvent } from './stream'
 import type {
   Chat,
@@ -14,12 +16,15 @@ import type {
   ChatOptions,
   ChatState,
   Conversation,
+  SendMessageOptions,
   ToolInvocation
 } from './types'
 import {
   conversationTitle,
+  truncateTitle,
   errorResultMessage,
   extractChatAnswer,
+  abortError,
   isAbortError,
   isErrorResult,
   now,
@@ -39,6 +44,12 @@ interface Turn {
   conversationId: string
   /** Id of the turn's user message; the answer is whatever follows it. */
   userMessageId: string
+  /** The turn opened the conversation; withdrawing it closes the conversation again. */
+  isNew: boolean
+  /** The run was asked for. Before that, a failure or a stop withdraws the turn instead of failing it. */
+  started: boolean
+  /** Both `stop()` and the send's own rejection withdraw; only the first may. */
+  withdrawn: boolean
   jobId?: string
   /** The flow job and its step jobs; a persisted answer carries one of them as `job_id`. */
   jobIds?: Set<string>
@@ -59,6 +70,8 @@ class ChatImpl implements Chat {
   #state: ChatState
   #turn: Turn | undefined
   #page = 1
+  /** The kind the caller last listed, so the refresh after a new turn lists the same rows. */
+  #conversationKind: ConversationKind | undefined
   #persistTimer: ReturnType<typeof setTimeout> | undefined
 
   constructor(options: ChatOptions) {
@@ -97,21 +110,34 @@ class ChatImpl implements Chat {
     }
   }
 
-  sendMessage = async (
-    text: string,
-    options: { inputs?: Record<string, unknown> } = {}
-  ): Promise<void> => {
+  sendMessage = async (text: string, options: SendMessageOptions = {}): Promise<void> => {
     const content = text.trim()
-    if (!content) return
+    if (!content) {
+      // A run needs a message; files alone would otherwise be dropped without a word.
+      if (options.attachments?.length) throw new Error('windmill-chat: attachments need a message to go with them')
+      return
+    }
     if (this.#turn) {
       throw new Error('windmill-chat: a message is already being answered; call stop() first')
     }
+    const attachments = options.attachments ?? []
+    const attachmentsInput = options.attachmentsInput
+    if (attachments.length > 0 && !attachmentsInput) {
+      throw new Error('windmill-chat: attachments need `attachmentsInput`, the flow input that takes them')
+    }
+    if (attachmentsInput && !attachmentsInput.multiple && attachments.length > 1) {
+      // Uploading all of them would run with the first and leave the rest stranded in storage.
+      throw new Error(`windmill-chat: \`${attachmentsInput.name}\` holds one file; got ${attachments.length}`)
+    }
     const isNew = this.#state.conversationId === undefined
     const conversationId = this.#state.conversationId ?? randomId()
     const turn: Turn = {
       controller: new AbortController(),
       conversationId,
       userMessageId: `pending-${randomId()}`,
+      isNew,
+      started: false,
+      withdrawn: false,
       streamedText: false
     }
     this.#turn = turn
@@ -123,7 +149,6 @@ class ChatImpl implements Chat {
     const touched = { ...conversation, updatedAt: timestamp }
     this.#set({
       conversationId,
-      conversations: [touched, ...this.#state.conversations.filter((c) => c.id !== conversationId)],
       messages: [
         ...this.#state.messages,
         { id: turn.userMessageId, role: 'user', content, success: true, createdAt: timestamp, pending: true }
@@ -131,10 +156,32 @@ class ChatImpl implements Chat {
       status: 'submitted',
       error: undefined
     })
-    this.#rememberConversation()
 
     try {
-      const args = { ...this.#config.inputs, ...options.inputs, user_message: content }
+      const args: Record<string, unknown> = { ...this.#config.inputs, ...options.inputs, user_message: content }
+      if (attachmentsInput && attachments.length > 0) {
+        // Uploaded with the turn already shown as submitted: the message is in the transcript
+        // and `stop()` can abort the upload, while a second send is refused as usual.
+        const uploaded = await uploadAttachments(this.#api, attachments, randomId(), turn.controller.signal)
+        args[attachmentsInput.name] = attachmentsInput.multiple ? uploaded : uploaded[0]
+        // Shown on the pending message until its server row replaces it, carrying its own.
+        const carried = uploaded.map((u) => ({ input: attachmentsInput.name, s3: u.s3, filename: u.filename }))
+        if (this.#turnActive(turn)) {
+          this.#set({
+            messages: this.#state.messages.map((m) => (m.id === turn.userMessageId ? { ...m, attachments: carried } : m))
+          })
+        }
+      }
+      // Nothing may start once stop() or a conversation switch has withdrawn the turn, including
+      // a stop from a subscriber told of the attachments just above.
+      if (turn.controller.signal.aborted) throw abortError()
+      turn.started = true
+      // Listed only once the run is asked for: a send that never runs (an upload that failed
+      // or was stopped) then has no conversation entry to take back.
+      this.#set({
+        conversations: [touched, ...this.#state.conversations.filter((c) => c.id !== conversationId)]
+      })
+      this.#rememberConversation()
       const context = { memoryId: conversationId, conversationId, signal: turn.controller.signal }
       turn.jobId = this.#config.run
         ? await this.#config.run(args, context)
@@ -148,6 +195,13 @@ class ChatImpl implements Chat {
       }
       await this.#finishTurn(turn, result, isNew)
     } catch (e) {
+      if (!turn.started) {
+        // Nothing ran: the message is withdrawn rather than shown as a failed turn, and the
+        // caller gets the reason (an upload that failed, or the AbortError of a stop()).
+        if (this.#turn === turn) this.#turn = undefined
+        this.#withdrawTurn(turn)
+        throw e
+      }
       // stop() and a conversation switch abort the turn and settle the state themselves.
       if (turn.controller.signal.aborted || isAbortError(e)) return
       this.#failTurn(turn, e)
@@ -160,6 +214,12 @@ class ChatImpl implements Chat {
     const turn = this.#turn
     if (!turn) return
     this.#detachTurn()
+    if (!turn.started) {
+      // Still uploading its attachments: there is no run to cancel, and the message the
+      // reader took back must not stay in the transcript as sent.
+      this.#withdrawTurn(turn)
+      return
+    }
     if (this.#state.conversationId === turn.conversationId) {
       this.#set({ messages: finalized(this.#state.messages), status: 'idle' })
       this.#persistLocal()
@@ -229,15 +289,21 @@ class ChatImpl implements Chat {
   }
 
   loadConversations = async (
-    options: { page?: number; perPage?: number } = {}
+    options: { page?: number; perPage?: number; kind?: ConversationKind } = {}
   ): Promise<Conversation[]> => {
     const page = options.page ?? 1
+    // A different kind is a different listing: its first rows replace the held ones, on
+    // whichever page they were asked for.
+    const kindChanged = 'kind' in options && options.kind !== this.#conversationKind
+    if ('kind' in options) this.#conversationKind = options.kind
+    const kind = this.#conversationKind
     let conversations: Conversation[]
     if (this.#state.history === 'server') {
       try {
         const rows = await this.#api.listConversations(this.#config.flowPath, {
           page,
-          perPage: options.perPage ?? this.#config.pageSize
+          perPage: options.perPage ?? this.#config.pageSize,
+          kind
         })
         conversations = rows.map(fromConversation)
       } catch (e) {
@@ -247,10 +313,13 @@ class ChatImpl implements Chat {
     } else {
       conversations = this.#state.history === 'local' ? this.#local.listConversations() : []
     }
+    // Another kind was asked for while this list was on its way: its rows are not the
+    // listing any more, whichever response lands last.
+    if (kind !== this.#conversationKind) return conversations
     const known = new Set(this.#state.conversations.map((c) => c.id))
     this.#set({
       conversations:
-        page === 1
+        page === 1 || kindChanged
           ? conversations
           : [...this.#state.conversations, ...conversations.filter((c) => !known.has(c.id))]
     })
@@ -273,6 +342,24 @@ class ChatImpl implements Chat {
     this.#set({ conversations: this.#state.conversations.filter((c) => c.id !== conversationId) })
   }
 
+  renameConversation = async (conversationId: string, title: string): Promise<void> => {
+    // Cut here as the server cuts, so the title shown is the one stored.
+    const trimmed = truncateTitle(title.trim())
+    if (!trimmed) return
+    if (this.#state.history === 'server') {
+      await this.#api.renameConversation(conversationId, trimmed)
+    } else if (this.#state.history === 'local') {
+      this.#local.renameConversation(conversationId, trimmed)
+    }
+    // Patched in place: the server keeps `updated_at` on a rename, so the list order the
+    // next load returns is the one shown now.
+    this.#set({
+      conversations: this.#state.conversations.map((c) =>
+        c.id === conversationId ? { ...c, title: trimmed } : c
+      )
+    })
+  }
+
   loadOlderMessages = async (): Promise<void> => {
     const conversationId = this.#state.conversationId
     if (
@@ -344,16 +431,21 @@ class ChatImpl implements Chat {
           tool: { ...existing.tool!, ...toolPatch }
         }
       } else {
+        // Thinking that produced no text led to this call, and is stored on its row.
+        const a = turn.assistantId ? messages.findIndex((m) => m.id === turn.assistantId) : -1
+        const reasoning = a >= 0 && messages[a].content === '' ? messages.splice(a, 1)[0].reasoning : undefined
         messages.push({
           id: `pending-${randomId()}`,
           role: 'tool',
           content: content ?? '',
+          reasoning,
           success: success ?? true,
           createdAt: now(),
           pending: true,
           tool: { callId, name, status: 'running', ...toolPatch }
         })
       }
+      turn.assistantId = undefined
     }
     const appendAssistant = (text: string, reasoning: string) => {
       const i = turn.assistantId
@@ -388,17 +480,14 @@ class ChatImpl implements Chat {
         case 'reasoning_token_delta':
           appendAssistant('', event.content)
           break
+        // A call completes the round's text: text after it is a new message.
         case 'tool_call':
-          // The round's text is complete; text after the tool result is a new message.
-          turn.assistantId = undefined
           upsertTool(event.call_id, event.function_name, { status: 'running' })
           break
         case 'tool_call_arguments':
-          turn.assistantId = undefined
           upsertTool(event.call_id, event.function_name, { arguments: event.arguments })
           break
         case 'tool_execution':
-          turn.assistantId = undefined
           upsertTool(event.call_id, event.function_name, { status: 'running' })
           break
         case 'tool_result':
@@ -545,6 +634,36 @@ class ChatImpl implements Chat {
     }
   }
 
+  /**
+   * Take back the user message of a turn that never ran. A conversation it would have opened
+   * was never listed (see `sendMessage`), so only the message goes, and, while it is the turn
+   * on screen, the busy status. A switch away mid-upload has already written the message to
+   * local history, so it is removed there too.
+   */
+  #withdrawTurn(turn: Turn): void {
+    if (turn.withdrawn) return
+    turn.withdrawn = true
+    const id = turn.conversationId
+    const withoutTurn = (messages: ChatMessage[]) => messages.filter((m) => m.id !== turn.userMessageId)
+    if (this.#state.conversationId === id) {
+      const messages = withoutTurn(this.#state.messages)
+      // A turn started since, such as a resend right after Stop, owns the status.
+      const newerTurn = this.#turn !== undefined && this.#turn !== turn
+      if (newerTurn) {
+        this.#set({ messages })
+      } else {
+        const unopened = turn.isNew && messages.length === 0
+        this.#set({ messages, status: 'idle', error: undefined, ...(unopened ? { conversationId: undefined } : {}) })
+      }
+      this.#persistLocal()
+    }
+    if (this.#state.history === 'local' && this.#state.conversationId !== id) {
+      const stored = withoutTurn(this.#local.getMessages(id))
+      if (stored.length > 0) this.#local.saveMessages(id, stored)
+      else if (!this.#state.conversations.some((c) => c.id === id)) this.#local.deleteConversation(id)
+    }
+  }
+
   #failTurn(turn: Turn, e: unknown): void {
     if (!this.#turnActive(turn)) return
     const error = toError(e)
@@ -612,22 +731,54 @@ class ChatImpl implements Chat {
     for (const row of rows.map(fromRow)) {
       if (known.has(row.id)) continue
       known.add(row.id)
-      const i = messages.findIndex(
+      let i = messages.findIndex(
         (m) =>
           m.seq === undefined &&
           m.role === row.role &&
           (m.content === row.content || (row.tool !== undefined && m.tool?.name === row.tool.name))
       )
+      // A structured answer streams as the call of the structured-output tool, whose
+      // arguments are the answer's text: its row replaces that call. Only past the newest
+      // user message, where a stopped turn's identical call cannot be.
+      if (i < 0 && row.role === 'assistant') {
+        let j = messages.length - 1
+        while (j >= 0 && messages[j].role !== 'user') {
+          const m = messages[j]
+          if (m.seq === undefined && m.role === 'tool' && m.tool?.arguments === row.content) i = j
+          j--
+        }
+      }
       if (i >= 0) {
         const m = messages[i]
         messages[i] = {
           ...row,
           id: m.id,
           reasoning: m.reasoning ?? row.reasoning,
-          tool: m.tool ? { ...m.tool, status: row.tool?.status ?? m.tool.status } : row.tool
+          // The stream's call wins where it has a value; a stream cut short leaves gaps the row fills.
+          tool:
+            row.role === 'tool' && m.tool
+              ? {
+                  ...m.tool,
+                  arguments: m.tool.arguments ?? row.tool?.arguments,
+                  result: m.tool.result ?? row.tool?.result,
+                  status: row.tool?.status ?? m.tool.status
+                }
+              : row.tool
         }
       } else {
-        messages.push(row)
+        // A tool row nothing streamed, such as a provider-native web search, goes where a
+        // reload puts it: after the last message of a lower `seq`, before the streamed answer.
+        // Any other row closes the turn, a failure included, and stays last: above a streamed
+        // message that never got a row, it would hide the turn's failure.
+        let at = messages.length
+        for (let j = messages.length - 1; row.role === 'tool' && j >= 0; j--) {
+          const seq = messages[j].seq
+          if (seq !== undefined && seq < row.seq!) {
+            at = j + 1
+            break
+          }
+        }
+        messages.splice(at, 0, row)
       }
     }
     this.#set({ messages })
@@ -725,7 +876,19 @@ function fromRow(row: FlowConversationMessage): ChatMessage {
     stepName: row.step_name ?? undefined,
     pending: false,
     seq: row.created_seq,
-    tool: toolName ? { name: toolName, status: success ? 'success' : 'error' } : undefined
+    reasoning: row.reasoning ?? undefined,
+    attachments: row.attachments ?? undefined,
+    // The call the row carries: the model's arguments and what the model got back. For a
+    // failed tool the result is what it failed with, and the row's text names the tool
+    // rather than the reason.
+    tool: toolName
+      ? {
+          name: toolName,
+          status: success ? 'success' : 'error',
+          arguments: row.tool_arguments ?? undefined,
+          result: row.tool_result ?? undefined
+        }
+      : undefined
   }
 }
 
@@ -734,7 +897,8 @@ function fromConversation(row: FlowConversation): Conversation {
     id: row.id,
     title: row.title ?? undefined,
     createdAt: row.created_at,
-    updatedAt: row.updated_at
+    updatedAt: row.updated_at,
+    isTest: row.is_test
   }
 }
 

chat-sdk/src/history.ts

@@ -4,6 +4,8 @@ export interface LocalHistory {
   listConversations(): Conversation[]
   getMessages(conversationId: string): ChatMessage[]
   upsertConversation(conversation: Conversation): void
+  /** Changes a stored conversation's title in place; unlike `upsertConversation`, its position is kept. */
+  renameConversation(conversationId: string, title: string): void
   saveMessages(conversationId: string, messages: ChatMessage[]): void
   deleteConversation(conversationId: string): void
 }
@@ -55,6 +57,11 @@ export function createLocalHistory(storage: StorageLike | undefined, key: string
       }
       write(s)
     },
+    renameConversation(id, title) {
+      const s = read()
+      s.conversations = s.conversations.map((c) => (c.id === id ? { ...c, title } : c))
+      write(s)
+    },
     saveMessages(id, messages) {
       const s = read()
       s.messages[id] = messages.map((m) => ({ ...m, pending: false }))

chat-sdk/src/index.ts

@@ -5,6 +5,7 @@ export {
   WindmillApiError,
   readServerSentEvents,
   type WindmillChatApiOptions,
+  type ConversationKind,
   type FlowConversation,
   type FlowConversationMessage,
   type JobUpdateEvent,
@@ -13,8 +14,12 @@ export {
 export { parseStreamEvents, createStreamEventParser, type AgentStreamEvent } from './stream'
 export { followJob, type FollowEvent } from './follow'
 export { extractChatAnswer, conversationIdFor } from './utils'
+export { storedAttachmentName, uploadAttachments, CHAT_UPLOADS_PREFIX, type UploadedAttachment } from './attachments'
 export type {
+  AttachmentsInput,
+  AttachmentUpload,
   Chat,
+  ChatAttachment,
   ChatMessage,
   ChatOptions,
   ChatRole,
@@ -23,6 +28,7 @@ export type {
   Conversation,
   FetchLike,
   HistoryMode,
+  SendMessageOptions,
   StorageLike,
   TokenSource,
   ToolInvocation

chat-sdk/src/react.ts

@@ -11,6 +11,7 @@ export type UseWindmillChat = ChatState &
     | 'selectConversation'
     | 'loadConversations'
     | 'deleteConversation'
+    | 'renameConversation'
     | 'loadOlderMessages'
   > & { chat: Chat }
 
@@ -65,6 +66,7 @@ export function useWindmillChat(options: ChatOptions): UseWindmillChat {
       selectConversation: chat.selectConversation,
       loadConversations: chat.loadConversations,
       deleteConversation: chat.deleteConversation,
+      renameConversation: chat.renameConversation,
       loadOlderMessages: chat.loadOlderMessages
     }),
     [state, chat]

chat-sdk/src/types.ts

@@ -26,19 +26,23 @@ export interface ToolInvocation {
   status: 'running' | 'success' | 'error'
 }
 
+export interface ChatAttachment { input: string; s3: string; storage?: string; filename?: string }
+
 export interface ChatMessage {
   id: string
   role: ChatRole
   content: string
   /** The model's reasoning summary, when the provider streams one. */
   reasoning?: string
-  /** Set on `tool` messages that came from the live stream. */
+  /** The call on a `tool` message, from the live stream or its stored row; `callId` is only known from the stream. */
   tool?: ToolInvocation
   success: boolean
   createdAt: string
   jobId?: string
   /** The flow step that produced the message. */
   stepName?: string
+  /** The files a user message carried, as object-storage references. */
+  attachments?: ChatAttachment[]
   /** True while the message is optimistic or still streaming. */
   pending: boolean
   /** Id of the persisted row once the server has it; `id` itself never changes, so list keys stay stable. */
@@ -52,6 +56,11 @@ export interface Conversation {
   title: string | undefined
   createdAt: string
   updatedAt: string
+  /**
+   * Started from the flow editor's test panel rather than a deployed run. Known once the
+   * server has listed the conversation; unset for one only this client has seen.
+   */
+  isTest?: boolean
 }
 
 export interface ChatState {
@@ -118,18 +127,61 @@ export interface ChatOptions {
   onError?: (error: Error, turn: { conversationId: string; jobId?: string }) => void
 }
 
+/** A file sent with a message. It is uploaded to the workspace's object storage before the run starts. */
+export interface AttachmentUpload {
+  /** Kept as the last segment of the stored key, its extension corrected to the media type for PNG, JPEG and PDF. */
+  name: string
+  /** The bytes: a Blob, or a `data:` URL of them. */
+  data: Blob | string
+  /** The file's media type. Defaults to the Blob's own type, or the data URL's. */
+  mediaType?: string
+}
+
+/** The flow input the uploaded attachments are handed to: an `s3object` (`multiple: false`) or an `s3object[]`. */
+export interface AttachmentsInput {
+  name: string
+  multiple: boolean
+}
+
+export interface SendMessageOptions {
+  /** Extra flow inputs for this message, on top of `ChatOptions.inputs`. */
+  inputs?: Record<string, unknown>
+  /**
+   * Files to upload and hand to the flow as `{ s3, filename }` objects in `attachmentsInput`,
+   * the way an AI agent step reads `user_attachments`. A failed upload rejects `sendMessage`
+   * and the run never starts; `stop()` during the upload does the same with an `AbortError`.
+   */
+  attachments?: AttachmentUpload[]
+  /** Required with `attachments`, which also need message text. With `multiple: false`, more than one attachment is refused before anything uploads. */
+  attachmentsInput?: AttachmentsInput
+}
+
 export interface Chat {
   getState(): ChatState
   /** Calls `listener` now and on every change; returns the unsubscribe function (Svelte store contract). */
   subscribe(listener: (state: ChatState) => void): () => void
-  /** Sends a message in the current conversation, starting one when there is none. Resolves when the answer is complete. */
-  sendMessage(text: string, options?: { inputs?: Record<string, unknown> }): Promise<void>
+  /**
+   * Sends a message in the current conversation, starting one when there is none. Resolves
+   * when the answer is complete. Rejects when the message could not be sent at all — a turn
+   * already running, an attachment that failed to upload — without touching the transcript.
+   */
+  sendMessage(text: string, options?: SendMessageOptions): Promise<void>
   /** Stops following the answer and asks Windmill to cancel the run. */
   stop(): Promise<void>
   newConversation(): void
   selectConversation(conversationId: string): Promise<void>
-  loadConversations(options?: { page?: number; perPage?: number }): Promise<Conversation[]>
+  /**
+   * `kind` narrows server history to the flow editor's test chats, the deployed flow's
+   * own (the server's default), or both. Local history has no test chats and ignores it.
+   */
+  loadConversations(options?: {
+    page?: number
+    perPage?: number
+    kind?: 'test' | 'deployed' | 'all'
+  }): Promise<Conversation[]>
   deleteConversation(conversationId: string): Promise<void>
+  /** Sets a conversation's title. The list keeps its order: only a turn moves a conversation. */
+  renameConversation(conversationId: string, title: string): Promise<void>
   loadOlderMessages(): Promise<void>
   /** Stops background work (stream, polling) and writes local history out. The chat stays usable. */
   destroy(): void

chat-sdk/src/utils.ts

@@ -69,6 +69,12 @@ export function conversationTitle(firstMessage: string): string {
   return chars.length > 25 ? `${chars.slice(0, 25).join('')}...` : firstMessage
 }
 
+/** The server's bound on a typed title: 252 characters plus an ellipsis fits its 255-char column. */
+export function truncateTitle(title: string): string {
+  const chars = Array.from(title)
+  return chars.length > 252 ? `${chars.slice(0, 252).join('')}...` : title
+}
+
 export function sleep(ms: number, signal?: AbortSignal): Promise<void> {
   return new Promise((resolve, reject) => {
     if (signal?.aborted) return reject(abortError())

chat-sdk/test/ai-sdk.test.ts

@@ -2,7 +2,7 @@ import { describe, expect, test } from 'bun:test'
 import type { UIMessage, UIMessageChunk } from 'ai'
 import { createWindmillChatTransport, toUIMessages } from '../src/ai-sdk'
 import type { ChatMessage } from '../src/types'
-import { fetchMock, json, ndjson, sse, text, type Route } from './support'
+import { fetchMock, json, messageRow, ndjson, sse, text, type Route } from './support'
 
 const FLOW = 'f/chat/agent'
 const run: Route = (c) =>
@@ -141,6 +141,26 @@ describe('createWindmillChatTransport', () => {
     expect(second[1]).toMatchObject({ errorText: 'ExecutionErr: boom' })
   })
 
+  test('loads the attachments of a user row, the call an MCP tool row carries and the reasoning behind an answer', async () => {
+    const { fetch } = fetchMock((c) =>
+      c.method === 'GET' && c.url.pathname.endsWith('/messages')
+        ? json([
+            messageRow(1, 'user', 'hi', { attachments: [{ input: 'files', s3: 'chat/a.png', filename: 'a.png' }] }),
+            messageRow(2, 'tool', 'Used lookup tool', { job_id: 'agent-job', reasoning: 'why', tool_arguments: '{"q":1}', tool_result: '42' }),
+            messageRow(3, 'assistant', 'The answer is 42', { reasoning: 'hmm' })
+          ])
+        : undefined
+    )
+    const transport = createWindmillChatTransport({ baseUrl: 'http://wm.test', workspace: 'ws', flowPath: FLOW, fetch })
+    const ui = await transport.loadMessages('c')
+    expect(ui.map((m) => m.parts.map((p) => p.type))).toEqual([['text'], ['reasoning', 'dynamic-tool', 'reasoning', 'text']])
+    expect(ui[0].metadata).toEqual({ attachments: [{ input: 'files', s3: 'chat/a.png', filename: 'a.png' }] })
+    expect(ui[1].metadata).toBeUndefined()
+    expect(ui[1].parts[0]).toMatchObject({ type: 'reasoning', text: 'why' })
+    expect(ui[1].parts[1]).toMatchObject({ toolName: 'lookup', state: 'output-available', input: { q: 1 }, output: 42 })
+    expect(ui[1].parts[2]).toMatchObject({ type: 'reasoning', text: 'hmm' })
+  })
+
   test('refuses attachments with a clear error', async () => {
     const transport = createWindmillChatTransport({ baseUrl: 'http://wm.test', workspace: 'ws', flowPath: FLOW, fetch: fetchMock().fetch })
     await expect(
@@ -175,4 +195,11 @@ describe('toUIMessages', () => {
     expect(ui[1].parts[0]).toMatchObject({ toolCallId: 'c1', toolName: 'lookup', state: 'output-available', input: { q: 1 }, output: 42 })
     expect(ui[3].parts[0]).toMatchObject({ state: 'output-error', errorText: 'Error executing lookup' })
   })
+
+  test('keeps a stored JSON null result rather than the row text', () => {
+    const ui = toUIMessages([
+      { success: true, createdAt: '2026-01-01T00:00:00Z', pending: false, id: 't1', role: 'tool', content: 'Used notify tool', tool: { callId: 'c1', name: 'notify', status: 'success', arguments: '{}', result: 'null' } }
+    ])
+    expect(ui[0].parts[0]).toMatchObject({ type: 'dynamic-tool', state: 'output-available', output: null })
+  })
 })

chat-sdk/test/api.test.ts

@@ -0,0 +1,14 @@
+import { describe, expect, test } from 'bun:test'
+import { WindmillChatApi } from '../src/api'
+
+describe('WindmillChatApi.attachmentUrl', () => {
+  test('points at the workspace download endpoint, with the storage only when there is one', () => {
+    const api = new WindmillChatApi({ baseUrl: 'https://wm.test/api/', workspace: 'my ws' })
+    expect(api.attachmentUrl({ input: 'files', s3: 'chat/a b&c.png', storage: 'secondary' })).toBe(
+      'https://wm.test/api/w/my%20ws/job_helpers/download_s3_file?file_key=chat%2Fa+b%26c.png&storage=secondary'
+    )
+    expect(api.attachmentUrl({ input: 'files', s3: 'chat/a.png' })).toBe(
+      'https://wm.test/api/w/my%20ws/job_helpers/download_s3_file?file_key=chat%2Fa.png'
+    )
+  })
+})

chat-sdk/test/assistant-ui.test.ts

@@ -31,6 +31,13 @@ describe('assistant-ui conversion', () => {
     expect(toThreadMessage(turns[0])).toMatchObject({ role: 'user', content: [{ type: 'text', text: 'hi' }] })
   })
 
+  test('keeps a stored JSON null result rather than the row text', () => {
+    const turn = groupTurns([
+      { ...base, id: 't1', role: 'tool', content: 'Used notify tool', tool: { callId: 'c1', name: 'notify', status: 'success', arguments: '{}', result: 'null' } }
+    ])[0]
+    expect(toThreadMessage(turn).content).toMatchObject([{ type: 'tool-call', toolName: 'notify', result: null }])
+  })
+
   test('marks a failed answer as incomplete', () => {
     const [turn] = groupTurns([{ ...base, id: 'a', role: 'assistant', content: 'boom', success: false }])
     expect(toThreadMessage(turn).status).toEqual({ type: 'incomplete', reason: 'error', error: 'boom' })

chat-sdk/test/attachments.test.ts

@@ -0,0 +1,444 @@
+import { describe, expect, test } from 'bun:test'
+import { WindmillChatApi } from '../src/api'
+import { storedAttachmentName, uploadAttachments } from '../src/attachments'
+import { createChat } from '../src/chat'
+import type { ChatOptions } from '../src/types'
+import { abortError } from '../src/utils'
+import { fetchMock, json, memoryStorage, sse, text, type RecordedCall, type Route } from './support'
+
+const BASE = 'http://wm.test'
+const FLOW = 'f/chat/agent'
+const UPLOAD_PATH = '/api/w/ws/job_helpers/upload_s3_file'
+
+const run: Route = (c) =>
+  c.method === 'POST' && c.url.pathname === `/api/w/ws/jobs/run/f/${FLOW}`
+    ? text('job-1')
+    : undefined
+
+/** Stores under the key it was asked to, like the server with a `file_key`. */
+const upload: Route = (c) =>
+  c.url.pathname === UPLOAD_PATH
+    ? json({ file_key: c.url.searchParams.get('file_key') })
+    : undefined
+
+const answer: Route = (c) =>
+  c.url.pathname === '/api/w/ws/jobs_u/getupdate_sse/job-1'
+    ? sse([
+        {
+          type: 'update',
+          completed: true,
+          only_result: { output: 'ok', messages: [] }
+        }
+      ])
+    : undefined
+
+function options(fetch: ChatOptions['fetch']): ChatOptions {
+  return {
+    flowPath: FLOW,
+    baseUrl: BASE,
+    workspace: 'ws',
+    token: 'tok',
+    fetch,
+    storage: memoryStorage()
+  }
+}
+
+const uploads = (calls: RecordedCall[]) => calls.filter((c) => c.url.pathname === UPLOAD_PATH)
+const runs = (calls: RecordedCall[]) =>
+  calls.filter((c) => c.url.pathname.startsWith('/api/w/ws/jobs/run/'))
+
+const png = new Blob([new Uint8Array([0x89, 0x50, 0x4e, 0x47])], {
+  type: 'image/png'
+})
+const pdf = new Blob(['%PDF-1.7'], { type: 'application/pdf' })
+
+describe('storedAttachmentName', () => {
+  // The worker reads the media type from the key's extension, so it has to match the bytes.
+  test('renames a re-encoded image and gives a bare name its extension', () => {
+    expect(storedAttachmentName('photo.webp', 'image/png')).toBe('photo.png')
+    expect(storedAttachmentName('holiday.png', 'image/jpeg')).toBe('holiday.jpg')
+    expect(storedAttachmentName('contract', 'application/pdf')).toBe('contract.pdf')
+    expect(storedAttachmentName('report.2026.final.webp', 'image/png')).toBe(
+      'report.2026.final.png'
+    )
+  })
+
+  test('leaves a type it does not know alone', () => {
+    expect(storedAttachmentName('notes.csv', 'text/csv')).toBe('notes.csv')
+  })
+})
+
+describe('sendMessage with attachments', () => {
+  test('uploads each file under the turn prefix and hands the list to the input', async () => {
+    const { fetch, calls } = fetchMock(upload, run, answer)
+    const chat = createChat(options(fetch))
+
+    await chat.sendMessage('read these', {
+      inputs: { locale: 'fr' },
+      attachments: [
+        { name: 'photo.webp', data: png },
+        { name: 'contract', data: pdf },
+        // A data URL is decoded to its bytes; the mediaType names what they are.
+        {
+          name: 'photo.webp',
+          data: `data:image/png;base64,${btoa('\x89PNG')}`
+        }
+      ],
+      attachmentsInput: { name: 'files', multiple: true }
+    })
+
+    const keys = uploads(calls).map((c) => c.url.searchParams.get('file_key')!)
+    expect(keys).toHaveLength(3)
+    const prefix = keys[0].split('/').slice(0, 3).join('/')
+    expect(prefix).toMatch(/^windmill_uploads\/chat\/[0-9a-f-]{36}$/)
+    expect(keys).toEqual([
+      `${prefix}/0/photo.png`,
+      `${prefix}/1/contract.pdf`,
+      `${prefix}/2/photo.png`
+    ])
+    expect(uploads(calls).map((c) => c.url.searchParams.get('content_type'))).toEqual([
+      'image/png',
+      'application/pdf',
+      'image/png'
+    ])
+    expect(uploads(calls).map((c) => c.headers['content-type'])).toEqual([
+      'image/png',
+      'application/pdf',
+      'image/png'
+    ])
+    expect(new Uint8Array(await uploads(calls)[2].raw!.arrayBuffer())).toEqual(
+      new Uint8Array([0x89, 0x50, 0x4e, 0x47])
+    )
+
+    expect(runs(calls)[0].body).toEqual({
+      locale: 'fr',
+      user_message: 'read these',
+      files: [
+        { s3: `${prefix}/0/photo.png`, filename: 'photo.png' },
+        { s3: `${prefix}/1/contract.pdf`, filename: 'contract.pdf' },
+        { s3: `${prefix}/2/photo.png`, filename: 'photo.png' }
+      ]
+    })
+    expect(chat.getState().status).toBe('idle')
+  })
+
+  test('hands a single object to an input that holds one file', async () => {
+    const { fetch, calls } = fetchMock(upload, run, answer)
+    const chat = createChat(options(fetch))
+    await chat.sendMessage('read this', {
+      attachments: [{ name: 'contract.pdf', data: pdf }],
+      attachmentsInput: { name: 'file', multiple: false }
+    })
+    const body = runs(calls)[0].body as Record<string, unknown>
+    expect(body.file).toEqual({
+      s3: expect.stringMatching(/\/0\/contract\.pdf$/),
+      filename: 'contract.pdf'
+    })
+  })
+
+  test('refuses several files for an input that holds one, before uploading any', async () => {
+    const { fetch, calls } = fetchMock(upload, run, answer)
+    const chat = createChat(options(fetch))
+    await expect(
+      chat.sendMessage('read these', {
+        attachments: [
+          { name: 'a.pdf', data: pdf },
+          { name: 'b.png', data: png }
+        ],
+        attachmentsInput: { name: 'file', multiple: false }
+      })
+    ).rejects.toThrow('holds one file')
+    expect(calls).toHaveLength(0)
+    expect(chat.getState().messages).toEqual([])
+  })
+
+  test('refuses attachments without message text, before uploading', async () => {
+    const { fetch, calls } = fetchMock(upload, run, answer)
+    const chat = createChat(options(fetch))
+    await expect(
+      chat.sendMessage('  ', {
+        attachments: [{ name: 'a.pdf', data: pdf }],
+        attachmentsInput: { name: 'files', multiple: true }
+      })
+    ).rejects.toThrow('need a message')
+    expect(calls).toHaveLength(0)
+  })
+
+  test('refuses attachments without an input to put them in', async () => {
+    const { fetch, calls } = fetchMock(upload, run, answer)
+    const chat = createChat(options(fetch))
+    await expect(
+      chat.sendMessage('hi', { attachments: [{ name: 'a.pdf', data: pdf }] })
+    ).rejects.toThrow('attachmentsInput')
+    expect(calls).toHaveLength(0)
+  })
+
+  test('a failed upload rejects without a run, and withdraws the message', async () => {
+    const { fetch, calls } = fetchMock(
+      (c) => (c.url.pathname === UPLOAD_PATH ? text('no object storage', 500) : undefined),
+      run,
+      answer
+    )
+    const chat = createChat(options(fetch))
+    const statuses: string[] = []
+    chat.subscribe((s) => statuses.push(s.status))
+
+    await expect(
+      chat.sendMessage('read this', {
+        attachments: [{ name: 'contract.pdf', data: pdf }],
+        attachmentsInput: { name: 'files', multiple: true }
+      })
+    ).rejects.toThrow('no object storage')
+
+    expect(runs(calls)).toHaveLength(0)
+    // Shown as submitted while uploading, then withdrawn whole: no message, no conversation.
+    expect(statuses).toContain('submitted')
+    const state = chat.getState()
+    expect(state.status).toBe('idle')
+    expect(state.messages).toEqual([])
+    expect(state.conversationId).toBeUndefined()
+    expect(state.conversations).toEqual([])
+    // The chat is free for the next message.
+    await chat.sendMessage('plain')
+    expect(runs(calls)).toHaveLength(1)
+  })
+
+  test('stop() during the upload aborts it and withdraws the message', async () => {
+    const { fetch, calls } = fetchMock(
+      (c) =>
+        c.url.pathname === UPLOAD_PATH
+          ? new Promise((_, reject) =>
+              c.signal!.addEventListener('abort', () => reject(abortError()))
+            )
+          : undefined,
+      run,
+      answer
+    )
+    const chat = createChat(options(fetch))
+    const sending = chat.sendMessage('read this', {
+      attachments: [{ name: 'contract.pdf', data: pdf }],
+      attachmentsInput: { name: 'files', multiple: true }
+    })
+    await new Promise((r) => setTimeout(r, 0))
+    expect(chat.getState().status).toBe('submitted')
+    await chat.stop()
+    await expect(sending).rejects.toMatchObject({ name: 'AbortError' })
+    expect(runs(calls)).toHaveLength(0)
+    expect(chat.getState()).toMatchObject({
+      status: 'idle',
+      messages: [],
+      conversationId: undefined
+    })
+  })
+
+  test('a switch away mid-upload leaves no conversation behind', async () => {
+    const storage = memoryStorage()
+    const { fetch, calls } = fetchMock(
+      (c) =>
+        c.url.pathname === UPLOAD_PATH
+          ? new Promise((_, reject) =>
+              c.signal!.addEventListener('abort', () => reject(abortError()))
+            )
+          : undefined,
+      run,
+      answer
+    )
+    const chat = createChat({ ...options(fetch), storage })
+    const sending = chat.sendMessage('never runs', {
+      attachments: [{ name: 'contract.pdf', data: pdf }],
+      attachmentsInput: { name: 'files', multiple: true }
+    })
+    await new Promise((r) => setTimeout(r, 0))
+    const opened = chat.getState().conversationId!
+    chat.newConversation()
+    await expect(sending).rejects.toMatchObject({ name: 'AbortError' })
+
+    expect(runs(calls)).toHaveLength(0)
+    expect(chat.getState().conversations.map((c) => c.id)).not.toContain(opened)
+    const reloaded = createChat({ ...options(fetch), storage })
+    expect((await reloaded.loadConversations()).map((c) => c.id)).not.toContain(opened)
+  })
+
+  test('a failed upload aborts the rest of its batch and deletes nothing', async () => {
+    let first: (r: Response) => void = () => {}
+    const { fetch, calls } = fetchMock(
+      (c) => {
+        if (c.url.pathname !== UPLOAD_PATH) return undefined
+        const key = c.url.searchParams.get('file_key')!
+        // The first file lands after the second has already failed.
+        if (key.includes('/0/')) return new Promise<Response>((resolve) => (first = resolve))
+        setTimeout(() => first(json({ file_key: keys()[0] })), 5)
+        return text('quota exceeded', 507)
+      },
+      run,
+      answer
+    )
+    const keys = () => uploads(calls).map((c) => c.url.searchParams.get('file_key')!)
+    const chat = createChat(options(fetch))
+    await expect(
+      chat.sendMessage('read these', {
+        attachments: [
+          { name: 'a.pdf', data: pdf },
+          { name: 'b.png', data: png }
+        ],
+        attachmentsInput: { name: 'files', multiple: true }
+      })
+    ).rejects.toThrow('quota exceeded')
+    // The upload still in flight when the other failed was told to stop.
+    expect(uploads(calls)[0].signal?.aborted).toBe(true)
+    expect(calls.filter((c) => c.method === 'DELETE')).toEqual([])
+    expect(runs(calls)).toHaveLength(0)
+  })
+
+  test('a send made right after stop() is not reset by the stopped upload', async () => {
+    let releaseRun: (r: Response) => void = () => {}
+    const { fetch, calls } = fetchMock(
+      (c) =>
+        c.url.pathname === UPLOAD_PATH
+          ? new Promise((_, reject) =>
+              c.signal!.addEventListener('abort', () => reject(abortError()))
+            )
+          : undefined,
+      (c) =>
+        c.method === 'POST' && c.url.pathname === `/api/w/ws/jobs/run/f/${FLOW}`
+          ? new Promise<Response>((resolve) => (releaseRun = resolve))
+          : undefined,
+      answer
+    )
+    const chat = createChat(options(fetch))
+    // An existing conversation, so the stopped turn and the next one share it.
+    const first = chat.sendMessage('first')
+    await new Promise((r) => setTimeout(r, 0))
+    releaseRun(text('job-1'))
+    await first
+    const stopped = chat.sendMessage('with a file', {
+      attachments: [{ name: 'a.pdf', data: pdf }],
+      attachmentsInput: { name: 'files', multiple: true }
+    })
+    await new Promise((r) => setTimeout(r, 0))
+    void chat.stop()
+    const next = chat.sendMessage('right after')
+    await expect(stopped).rejects.toMatchObject({ name: 'AbortError' })
+    await new Promise((r) => setTimeout(r, 0))
+    expect(chat.getState().status).toBe('submitted')
+    expect(chat.getState().messages.map((m) => m.content)).toContain('right after')
+    expect(chat.getState().messages.map((m) => m.content)).not.toContain('with a file')
+    releaseRun(text('job-1'))
+    await next
+    expect(runs(calls)).toHaveLength(2)
+  })
+
+  test('a conversation is listed only once its run starts', async () => {
+    let failUpload: (r: Response) => void = () => {}
+    const { fetch } = fetchMock(
+      (c) =>
+        c.url.pathname === UPLOAD_PATH
+          ? new Promise<Response>((resolve) => (failUpload = resolve))
+          : undefined,
+      run,
+      answer
+    )
+    const chat = createChat(options(fetch))
+    const sending = chat.sendMessage('read this', {
+      attachments: [{ name: 'a.pdf', data: pdf }],
+      attachmentsInput: { name: 'files', multiple: true }
+    })
+    await new Promise((r) => setTimeout(r, 0))
+    expect(chat.getState()).toMatchObject({ status: 'submitted', conversations: [] })
+    failUpload(text('boom', 500))
+    await expect(sending).rejects.toThrow('boom')
+    expect(chat.getState().conversations).toEqual([])
+  })
+
+  test('an already aborted signal uploads nothing', async () => {
+    const { fetch, calls } = fetchMock(upload)
+    const api = new WindmillChatApi({ baseUrl: BASE, workspace: 'ws', token: 'tok', fetch })
+    const controller = new AbortController()
+    controller.abort()
+    await expect(
+      uploadAttachments(api, [{ name: 'a.pdf', data: pdf }], 'turn', controller.signal)
+    ).rejects.toMatchObject({ name: 'AbortError' })
+    expect(calls).toHaveLength(0)
+  })
+
+  test('the pending user message carries its uploaded files before the run returns', async () => {
+    let releaseRun: (r: Response) => void = () => {}
+    const { fetch, calls } = fetchMock(
+      upload,
+      (c) =>
+        c.method === 'POST' && c.url.pathname === `/api/w/ws/jobs/run/f/${FLOW}`
+          ? new Promise<Response>((resolve) => (releaseRun = resolve))
+          : undefined,
+      answer
+    )
+    const chat = createChat(options(fetch))
+    const sending = chat.sendMessage('read these', {
+      attachments: [
+        { name: 'photo.webp', data: png },
+        { name: 'contract', data: pdf }
+      ],
+      attachmentsInput: { name: 'files', multiple: true }
+    })
+    while (runs(calls).length === 0) await new Promise((r) => setTimeout(r, 1))
+    const keys = uploads(calls).map((c) => c.url.searchParams.get('file_key')!)
+    const pending = chat.getState().messages.find((m) => m.role === 'user')!
+    expect(pending.pending).toBe(true)
+    expect(pending.attachments).toEqual([
+      { input: 'files', s3: keys[0], filename: 'photo.png' },
+      { input: 'files', s3: keys[1], filename: 'contract.pdf' }
+    ])
+    releaseRun(text('job-1'))
+    await sending
+  })
+
+  test('an explicit mediaType wins over the type a data URL declares', async () => {
+    const { fetch, calls } = fetchMock(upload, run, answer)
+    const chat = createChat(options(fetch))
+    await chat.sendMessage('read this', {
+      attachments: [
+        {
+          name: 'contract',
+          data: `data:application/octet-stream;base64,${btoa('%PDF')}`,
+          mediaType: 'application/pdf'
+        }
+      ],
+      attachmentsInput: { name: 'files', multiple: true }
+    })
+    const call = uploads(calls)[0]
+    expect(call.url.searchParams.get('file_key')).toMatch(/\/0\/contract\.pdf$/)
+    expect(call.url.searchParams.get('content_type')).toBe('application/pdf')
+  })
+
+  test('stop() after the uploads land but before the run starts runs nothing', async () => {
+    const { fetch, calls } = fetchMock(upload, run, answer)
+    const chat = createChat(options(fetch))
+    const sending = chat.sendMessage('read this', {
+      attachments: [{ name: 'contract.pdf', data: pdf }],
+      attachmentsInput: { name: 'files', multiple: true }
+    })
+    // The upload responds at once; Stop lands before the send resumes after it.
+    while (uploads(calls).length === 0) await Promise.resolve()
+    await chat.stop()
+    await expect(sending).rejects.toMatchObject({ name: 'AbortError' })
+    expect(runs(calls)).toHaveLength(0)
+    expect(calls.filter((c) => c.method === 'DELETE')).toEqual([])
+    expect(chat.getState()).toMatchObject({ status: 'idle', messages: [], conversations: [] })
+  })
+
+  test('a subscriber stopping when the attachments appear runs nothing', async () => {
+    const { fetch, calls } = fetchMock(upload, run, answer)
+    const chat = createChat(options(fetch))
+    chat.subscribe((s) => {
+      if (s.messages.some((m) => m.attachments)) void chat.stop()
+    })
+    await expect(
+      chat.sendMessage('read this', {
+        attachments: [{ name: 'contract.pdf', data: pdf }],
+        attachmentsInput: { name: 'files', multiple: true }
+      })
+    ).rejects.toMatchObject({ name: 'AbortError' })
+    expect(runs(calls)).toHaveLength(0)
+    expect(calls.filter((c) => c.method === 'DELETE')).toEqual([])
+    expect(chat.getState()).toMatchObject({ status: 'idle', messages: [], conversations: [] })
+  })
+})

chat-sdk/test/chat.test.ts

@@ -327,6 +327,113 @@ describe('createChat with server history', () => {
     expect(messagesCall.headers.authorization).toBeUndefined()
   })
 
+  test('a persisted row brings back its attachments, reasoning and the call an MCP tool row carries', async () => {
+    const { fetch } = fetchMock(
+      (c) =>
+        c.method === 'GET' && c.url.pathname === '/api/w/ws/flow_conversations/conv-1/messages'
+          ? json([
+              messageRow(1, 'user', 'hi', {
+                attachments: [{ input: 'files', s3: 'chat/a.png', storage: 'secondary', filename: 'a.png' }]
+              }),
+              messageRow(2, 'tool', 'Used lookup tool', {
+                job_id: 'agent-job',
+                tool_arguments: '{"q":1}',
+                tool_result: '42'
+              }),
+              messageRow(3, 'tool', 'Error executing lookup', {
+                job_id: 'agent-job',
+                success: false,
+                tool_arguments: '{"q":2}',
+                tool_result: 'MCP tool error: boom'
+              }),
+              messageRow(4, 'assistant', 'The answer is 42', { reasoning: 'hmm' }),
+              messageRow(5, 'assistant', 'Hello'),
+              messageRow(6, 'tool', 'Used get_price tool', {
+                job_id: 'script-tool-job',
+                tool_arguments: '{"item":"widget"}',
+                tool_result: '{"price":42}'
+              })
+            ])
+          : undefined
+    )
+    const chat = createChat(options({ history: 'server' }, fetch))
+    await chat.selectConversation('conv-1')
+
+    const [user, used, failed, answer, plain, scriptTool] = chat.getState().messages
+    expect(scriptTool).toMatchObject({ jobId: 'script-tool-job', tool: { name: 'get_price', status: 'success', arguments: '{"item":"widget"}', result: '{"price":42}' } })
+    expect(user.attachments).toEqual([{ input: 'files', s3: 'chat/a.png', storage: 'secondary', filename: 'a.png' }])
+    expect(answer.attachments).toBeUndefined()
+    expect(used.tool).toEqual({ name: 'lookup', status: 'success', arguments: '{"q":1}', result: '42' })
+    expect(failed.tool).toEqual({ name: 'lookup', status: 'error', arguments: '{"q":2}', result: 'MCP tool error: boom' })
+    expect(answer.reasoning).toBe('hmm')
+    expect(plain.reasoning).toBeUndefined()
+  })
+
+  test('a row nothing streamed, like a web search, lands before the answer as on reload', async () => {
+    const { fetch } = fetchMock(
+      run,
+      (c) =>
+        c.url.pathname === streamPath
+          ? sse([
+              {
+                type: 'update',
+                new_result_stream: ndjson({ type: 'token_delta', content: 'Rust.' }),
+                stream_offset: 1,
+                completed: true,
+                only_result: { output: 'Rust.', messages: [] }
+              }
+            ])
+          : undefined,
+      (c) =>
+        c.url.pathname.endsWith('/messages')
+          ? json([
+              messageRow(91, 'user', 'hi'),
+              messageRow(92, 'tool', 'Used websearch tool', { job_id: 'step-1', tool_result: '[{"url":"https://example.com"}]' }),
+              messageRow(93, 'assistant', 'Rust.', { job_id: 'step-1' })
+            ])
+          : undefined,
+      (c) => (c.url.pathname === '/api/w/ws/flow_conversations/list' ? json([]) : undefined)
+    )
+    const chat = createChat(options({}, fetch))
+    await chat.sendMessage('hi')
+    expect(chat.getState().messages.map((m) => [m.role, m.content, m.seq])).toEqual([
+      ['user', 'hi', 91],
+      ['tool', 'Used websearch tool', 92],
+      ['assistant', 'Rust.', 93]
+    ])
+  })
+
+  test('a failure row stays after streamed text that never got a row', async () => {
+    const { fetch } = fetchMock(
+      run,
+      (c) =>
+        c.url.pathname === streamPath
+          ? sse([
+              {
+                type: 'update',
+                new_result_stream: ndjson({ type: 'token_delta', content: 'Let me look' }),
+                stream_offset: 1,
+                completed: true,
+                only_result: { error: { name: 'ExecutionErr', message: 'boom' } }
+              }
+            ])
+          : undefined,
+      (c) =>
+        c.url.pathname.endsWith('/messages')
+          ? json([messageRow(91, 'user', 'hi'), messageRow(92, 'assistant', 'boom', { job_id: 'step-1', success: false })])
+          : undefined,
+      (c) => (c.url.pathname === '/api/w/ws/flow_conversations/list' ? json([]) : undefined)
+    )
+    const chat = createChat(options({}, fetch))
+    await chat.sendMessage('hi')
+    const messages = chat.getState().messages
+    expect(messages.map((m) => [m.content, m.success])).toEqual([
+      ['hi', true],
+      ['Let me look', true],
+      ['boom', false]
+    ])
+  })
+
   test('keeps the streamed answer until its row lands, even when a tool row lands first', async () => {
     let messageFetches = 0
     const { fetch } = fetchMock(
@@ -414,6 +521,112 @@ describe('createChat with server history', () => {
     expect(chat.getState().conversations.map((c) => c.id)).toEqual(['c1', 'c2'])
   })
 
+  test('lists one kind of conversation and carries which kind each one is', async () => {
+    const row = (id: string, is_test: boolean) => ({
+      id,
+      workspace_id: 'ws',
+      flow_path: FLOW,
+      title: id,
+      created_at: '2026-01-01T00:00:00Z',
+      updated_at: '2026-01-01T00:00:00Z',
+      created_by: 'admin',
+      is_test
+    })
+    const { fetch, calls } = fetchMock((c) =>
+      c.url.pathname === '/api/w/ws/flow_conversations/list'
+        ? json(c.url.searchParams.get('kind') === 'test' ? [row('t1', true)] : [row('d1', false)])
+        : undefined
+    )
+    const chat = createChat(options({}, fetch))
+    await chat.loadConversations()
+    expect(calls[0].url.searchParams.has('kind')).toBe(false)
+    expect(chat.getState().conversations.map((c) => [c.id, c.isTest])).toEqual([['d1', false]])
+    await chat.loadConversations({ kind: 'test' })
+    expect(calls[1].url.searchParams.get('kind')).toBe('test')
+    expect(chat.getState().conversations.map((c) => [c.id, c.isTest])).toEqual([['t1', true]])
+  })
+
+  test('a list for a kind no longer asked for does not replace the newer one', async () => {
+    const row = (id: string, is_test: boolean) => ({
+      id,
+      workspace_id: 'ws',
+      flow_path: FLOW,
+      title: id,
+      created_at: '2026-01-01T00:00:00Z',
+      updated_at: '2026-01-01T00:00:00Z',
+      created_by: 'admin',
+      is_test
+    })
+    const { fetch } = fetchMock((c) => {
+      if (c.url.pathname !== '/api/w/ws/flow_conversations/list') return undefined
+      if (c.url.searchParams.get('kind') === 'test') {
+        return new Promise<Response>((r) => setTimeout(() => r(json([row('t1', true)])), 50))
+      }
+      return json([row('d1', false)])
+    })
+    const chat = createChat(options({}, fetch))
+    const slow = chat.loadConversations({ kind: 'test' })
+    await chat.loadConversations({ kind: 'deployed' })
+    await slow
+    expect(chat.getState().conversations.map((c) => c.id)).toEqual(['d1'])
+    // Another kind asked for on a later page starts its own listing rather than appending.
+    await chat.loadConversations({ page: 2, kind: 'test' })
+    expect(chat.getState().conversations.map((c) => c.id)).toEqual(['t1'])
+  })
+
+  test('the refresh after a new turn lists the kind last asked for', async () => {
+    const { fetch, calls } = fetchMock(
+      run,
+      (c) =>
+        c.url.pathname === streamPath
+          ? sse([{ type: 'update', completed: true, only_result: { output: 'Hello', messages: [] } }])
+          : undefined,
+      (c) =>
+        c.method === 'GET' && c.url.pathname.endsWith('/messages')
+          ? json([messageRow(11, 'user', 'hi'), messageRow(12, 'assistant', 'Hello', { job_id: 'agent-job' })])
+          : undefined,
+      (c) => (c.url.pathname === '/api/w/ws/flow_conversations/list' ? json([]) : undefined)
+    )
+    const chat = createChat(options({}, fetch))
+    await chat.loadConversations({ kind: 'test' })
+    await chat.sendMessage('hi')
+    const lists = calls.filter((c) => c.url.pathname === '/api/w/ws/flow_conversations/list')
+    expect(lists.length).toBeGreaterThan(1)
+    expect(lists.every((c) => c.url.searchParams.get('kind') === 'test')).toBe(true)
+  })
+
+  test('renaming a conversation keeps its place in the list', async () => {
+    const row = (id: string) => ({
+      id,
+      workspace_id: 'ws',
+      flow_path: FLOW,
+      title: id,
+      created_at: '2026-01-01T00:00:00Z',
+      updated_at: '2026-01-01T00:00:00Z',
+      created_by: 'admin',
+      is_test: false
+    })
+    const { fetch, calls } = fetchMock(
+      (c) => (c.url.pathname === '/api/w/ws/flow_conversations/list' ? json([row('c1'), row('c2')]) : undefined),
+      (c) =>
+        c.method === 'POST' && c.url.pathname === '/api/w/ws/flow_conversations/update/c2'
+          ? text('Conversation c2 updated')
+          : undefined
+    )
+    const chat = createChat(options({}, fetch))
+    await chat.loadConversations()
+    await chat.renameConversation('c2', '  Budget review  ')
+    expect(calls[1].body).toEqual({ title: 'Budget review' })
+    expect(chat.getState().conversations.map((c) => [c.id, c.title])).toEqual([
+      ['c1', 'c1'],
+      ['c2', 'Budget review']
+    ])
+    // Cut as the server cuts, so what is shown is what is stored.
+    await chat.renameConversation('c2', 'x'.repeat(300))
+    expect(chat.getState().conversations[1].title).toBe('x'.repeat(252) + '...')
+    expect(calls[2].body).toEqual({ title: 'x'.repeat(252) + '...' })
+  })
+
   test('a turn started right after stop() is not touched by the stop sync', async () => {
     let jobs = 0
     const { fetch } = fetchMock(
@@ -583,6 +796,120 @@ describe('createChat with server history', () => {
     expect(chat.getState().messages.map((m) => m.content)).toEqual(['hi', 'Let me check', 'Used search tool', 'Final answer'])
   })
 
+  test('thinking that led to a tool call rides on the call, live and once its row lands', async () => {
+    const { fetch } = fetchMock(
+      run,
+      (c) =>
+        c.url.pathname === streamPath
+          ? sse([
+              {
+                type: 'update',
+                // No `tool_call_arguments`: a stream cut short leaves the call without them.
+                new_result_stream: ndjson(
+                  { type: 'reasoning_token_delta', content: 'r1' },
+                  { type: 'tool_call', call_id: 'c1', function_name: 'lookup' },
+                  { type: 'tool_result', call_id: 'c1', function_name: 'lookup', result: '1', success: true },
+                  { type: 'token_delta', content: 'Final' }
+                ),
+                stream_offset: 4,
+                completed: true,
+                only_result: { output: 'Final', messages: [] }
+              }
+            ])
+          : undefined,
+      (c) =>
+        c.url.pathname.endsWith('/messages')
+          ? json([
+              messageRow(71, 'user', 'hi'),
+              messageRow(72, 'tool', 'Used lookup tool', { job_id: 'step-1', reasoning: 'r1', tool_arguments: '{"q":1}', tool_result: '1' }),
+              messageRow(73, 'assistant', 'Final', { job_id: 'step-1' })
+            ])
+          : undefined,
+      (c) => (c.url.pathname === '/api/w/ws/flow_conversations/list' ? json([]) : undefined)
+    )
+    const chat = createChat(options({}, fetch))
+    await chat.sendMessage('hi')
+    const messages = chat.getState().messages
+    expect(messages.map((m) => [m.role, m.content, m.reasoning, m.seq])).toEqual([
+      ['user', 'hi', undefined, 71],
+      ['tool', 'Used lookup tool', 'r1', 72],
+      ['assistant', 'Final', undefined, 73]
+    ])
+    expect(messages[1].tool).toMatchObject({ callId: 'c1', arguments: '{"q":1}', result: '1', status: 'success' })
+  })
+
+  test('a structured answer row replaces the call it streamed as', async () => {
+    const { fetch } = fetchMock(
+      run,
+      (c) =>
+        c.url.pathname === streamPath
+          ? sse([
+              {
+                type: 'update',
+                new_result_stream: ndjson(
+                  { type: 'reasoning_token_delta', content: 'hmm' },
+                  { type: 'tool_call', call_id: 'c9', function_name: 'structured_output' },
+                  { type: 'tool_call_arguments', call_id: 'c9', function_name: 'structured_output', arguments: '{"n": 1}' },
+                  { type: 'tool_execution', call_id: 'c9', function_name: 'structured_output' }
+                ),
+                stream_offset: 4,
+                completed: true,
+                only_result: { output: { n: 1 }, messages: [] }
+              }
+            ])
+          : undefined,
+      (c) =>
+        c.url.pathname.endsWith('/messages')
+          ? json([messageRow(75, 'user', 'hi'), messageRow(76, 'assistant', '{"n": 1}', { job_id: 'step-1', reasoning: 'hmm' })])
+          : undefined,
+      (c) => (c.url.pathname === '/api/w/ws/flow_conversations/list' ? json([]) : undefined)
+    )
+    const chat = createChat(options({}, fetch))
+    await chat.sendMessage('hi')
+    expect(chat.getState().messages.map((m) => [m.role, m.content, m.reasoning, m.tool])).toEqual([
+      ['user', 'hi', undefined, undefined],
+      ['assistant', '{"n": 1}', 'hmm', undefined]
+    ])
+  })
+
+  test('a structured answer row leaves a stopped turn its identical call', async () => {
+    const call = (id: string) =>
+      ndjson(
+        { type: 'tool_call', call_id: id, function_name: 'structured_output' },
+        { type: 'tool_call_arguments', call_id: id, function_name: 'structured_output', arguments: '{"ok": true}' }
+      )
+    let jobs = 0
+    const { fetch } = fetchMock(
+      (c) => (c.method === 'POST' && c.url.pathname.includes('/jobs/run/f/') ? text(`job-${++jobs}`) : undefined),
+      (c) =>
+        c.url.pathname.endsWith('/getupdate_sse/job-1') ? sse([{ type: 'update', new_result_stream: call('c1'), stream_offset: 2 }]) : undefined,
+      (c) =>
+        c.url.pathname.endsWith('/getupdate_sse/job-2')
+          ? sse([{ type: 'update', new_result_stream: call('c2'), stream_offset: 2, completed: true, only_result: { output: { ok: true }, messages: [] } }])
+          : undefined,
+      (c) => (c.url.pathname.includes('/queue/cancel/') ? text('ok') : undefined),
+      (c) =>
+        c.url.pathname.endsWith('/messages')
+          ? json([messageRow(41, 'user', 'first'), messageRow(42, 'user', 'again'), messageRow(43, 'assistant', '{"ok": true}', { job_id: 'step-2' })])
+          : undefined,
+      (c) => (c.url.pathname === '/api/w/ws/flow_conversations/list' ? json([]) : undefined)
+    )
+    const chat = createChat(options({}, fetch))
+    const first = chat.sendMessage('first')
+    await new Promise((r) => setTimeout(r, 50))
+    const stopped = chat.stop()
+    await first
+    const second = chat.sendMessage('again')
+    await stopped
+    await second
+    expect(chat.getState().messages.map((m) => [m.role, m.content, m.tool?.callId])).toEqual([
+      ['user', 'first', undefined],
+      ['tool', '', 'c1'],
+      ['user', 'again', undefined],
+      ['assistant', '{"ok": true}', undefined]
+    ])
+  })
+
   test('the stream asks for a server poll interval only when one is set', async () => {
     const answer: Route = (c) =>
       c.url.pathname === streamPath ? sse([{ type: 'update', completed: true, only_result: 'ok' }]) : undefined
@@ -726,6 +1053,27 @@ describe('createChat with server history', () => {
     expect((await again.loadConversations()).map((c) => c.id)).toEqual([newer, older])
   })
 
+  test('renaming a local conversation persists the title without reordering history', async () => {
+    const storage = memoryStorage()
+    const { fetch, calls } = fetchMock(run, (c) =>
+      c.url.pathname === streamPath ? sse([{ type: 'update', completed: true, only_result: 'ok' }]) : undefined
+    )
+    const chat = createChat(options({ token: 'tok', storage }, fetch))
+    await chat.sendMessage('older')
+    const older = chat.getState().conversationId!
+    chat.newConversation()
+    await chat.sendMessage('newer')
+    const newer = chat.getState().conversationId!
+    const before = calls.length
+    await chat.renameConversation(older, 'Renamed')
+    expect(calls.length).toBe(before)
+    const again = createChat(options({ token: 'tok', storage }, fetch))
+    expect((await again.loadConversations()).map((c) => [c.id, c.title])).toEqual([
+      [newer, 'newer'],
+      [older, 'Renamed']
+    ])
+  })
+
   test('destroying the chat mid-turn leaves it idle', async () => {
     const { fetch } = fetchMock(run, (c) =>
       c.url.pathname === streamPath