From fbf9f04e107c674474f61c1559a2f1e56dfeeaba Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Tue, 28 Jul 2026 14:29:06 +0200
Subject: [PATCH 01/24] fix: surface the real postgres error when data table
 migrations fail (#10371)

* fix: surface the real postgres error when data table migrations fail

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix: address review nits on the data table migration error fix

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix: name the exact grant a data table migration needs

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix: quote both identifiers in the data table grant hint

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* feat: add a data table connection and privilege check to workspace settings

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix: report data table privileges from the capability fields, not the grant list

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix: read grant targets from the server and drop the public schema guess

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix: render the search_path suggestion server-side and pin the granted database

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix: key the connection check on request identity, not the data table name

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix: declare the data table check schema field nullable and required

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 backend/tests/datatable_migrations_grants.rs  | 300 ++++++++++++++++++
 .../fixtures/datatable_migrations_grants.sql  |  35 ++
 backend/windmill-api-settings/src/lib.rs      |   4 +-
 .../src/datatable_migrations.rs               | 125 +++++++-
 .../windmill-api-workspaces/src/workspaces.rs | 156 ++++++++-
 backend/windmill-api/openapi.yaml             |  46 +++
 backend/windmill-common/src/error.rs          |  87 +++++
 backend/windmill-common/src/lib.rs            |   2 +-
 backend/windmill-common/src/query_builders.rs |   8 +-
 .../DataTableSettings.svelte                  | 116 ++++++-
 10 files changed, 849 insertions(+), 30 deletions(-)
 create mode 100644 backend/tests/datatable_migrations_grants.rs
 create mode 100644 backend/tests/fixtures/datatable_migrations_grants.sql

diff --git a/backend/tests/datatable_migrations_grants.rs b/backend/tests/datatable_migrations_grants.rs
new file mode 100644
index 0000000000..ebe9aeba4d
--- /dev/null
+++ b/backend/tests/datatable_migrations_grants.rs
@@ -0,0 +1,300 @@
+//! Regression test for running data table migrations against a database whose
+//! role only holds DML grants.
+//!
+//! Two failure modes are pinned here:
+//!  - the Postgres message must reach the caller. `tokio_postgres::Error`'s
+//!    `Display` renders only the error kind, so interpolating it with `{}`
+//!    produced a bare `Failed to ensure _wm_migrations table: db error`.
+//!  - `CREATE TABLE IF NOT EXISTS` checks CREATE on the schema *before* it
+//!    checks existence, so the run must probe for `_wm_migrations` first or an
+//!    unprivileged role can never migrate, even against a pre-created table.
+//!
+//! Plus the privilege report that surfaces the same state from workspace
+//! settings before anyone reaches a migration.
+
+use serde_json::{json, Value};
+use sqlx::{Pool, Postgres};
+
+use windmill_test_utils::*;
+
+const ROLE: &str = "wm_dtmig_test_role";
+const ROLE_PASSWORD: &str = "wm_dtmig_test_pwd";
+/// Deliberately hyphenated: it only parses inside double quotes, so it pins that
+/// the emitted recovery statement quotes the role rather than interpolating it.
+const NOSCHEMA_ROLE: &str = "wm-dtmig-noschema";
+
+fn authed(b: reqwest::RequestBuilder) -> reqwest::RequestBuilder {
+    b.header("Authorization", "Bearer DTMIG_ADMIN_TOKEN")
+}
+
+/// Point the fixture's data table at this test's own database, connecting as a
+/// role that may read and write but not create: `GRANT USAGE` without `CREATE`,
+/// and the schema's own CREATE revoked from PUBLIC so the outcome does not
+/// depend on the server's default `public` grants (relaxed before Postgres 15).
+async fn setup_unprivileged_datatable_role(db: &Pool<Postgres>) -> anyhow::Result<()> {
+    let opts = (*db.connect_options()).clone();
+    let dbname = opts.get_database().expect("test database name").to_string();
+
+    sqlx::query(&format!(
+        // Roles are cluster objects, not per-test-database ones. A previous run
+        // leaving the role behind raises duplicate_object; the tests in this
+        // binary run in parallel, so two sessions can also clear that check
+        // together and collide on pg_authid's unique index instead.
+        "DO $$ BEGIN \
+           CREATE ROLE {ROLE} LOGIN PASSWORD '{ROLE_PASSWORD}'; \
+         EXCEPTION WHEN duplicate_object OR unique_violation THEN NULL; \
+         END $$"
+    ))
+    .execute(db)
+    .await?;
+    sqlx::raw_sql(&format!(
+        "REVOKE CREATE ON SCHEMA public FROM PUBLIC; \
+         GRANT CONNECT ON DATABASE \"{dbname}\" TO {ROLE}; \
+         GRANT USAGE ON SCHEMA public TO {ROLE};"
+    ))
+    .execute(db)
+    .await?;
+
+    sqlx::query(
+        "INSERT INTO resource (workspace_id, path, value, resource_type, created_by) \
+         VALUES ('dtmig-ws', 'u/dtmig-admin/pg', $1, 'postgresql', 'dtmig-admin')",
+    )
+    .bind(json!({
+        "host": opts.get_host(),
+        "port": opts.get_port(),
+        "dbname": dbname,
+        "user": ROLE,
+        "password": ROLE_PASSWORD,
+        "sslmode": "disable",
+    }))
+    .execute(db)
+    .await?;
+
+    Ok(())
+}
+
+#[sqlx::test(fixtures("datatable_migrations_grants"))]
+async fn test_run_migrations_without_create_privilege(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    setup_unprivileged_datatable_role(&db).await?;
+
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let url =
+        format!("http://localhost:{port}/api/w/dtmig-ws/workspaces/run_datatable_migrations/main");
+
+    // No `_wm_migrations` yet and no way to create one: the caller must be told
+    // what Postgres actually refused, not "db error".
+    let resp = authed(reqwest::Client::new().post(&url)).send().await?;
+    assert_eq!(resp.status(), 500);
+    let body = resp.text().await?;
+    assert!(
+        body.contains("permission denied for schema"),
+        "the Postgres message should reach the caller, got: {body}"
+    );
+    // The suggested statement must be complete and quoted, not a placeholder.
+    assert!(
+        body.contains(&format!("GRANT CREATE ON SCHEMA \"public\" TO \"{ROLE}\"")),
+        "the hint should name the actual role and schema, got: {body}"
+    );
+
+    // Once an operator has created the bookkeeping table and granted DML on it,
+    // migrations run even though the role still cannot create tables.
+    sqlx::raw_sql(&format!(
+        "CREATE TABLE _wm_migrations ( \
+            datatable TEXT NOT NULL, \
+            version BIGINT NOT NULL, \
+            installed_at TIMESTAMPTZ NOT NULL DEFAULT now(), \
+            PRIMARY KEY (datatable, version)); \
+         GRANT SELECT, INSERT, UPDATE, DELETE ON _wm_migrations TO {ROLE};"
+    ))
+    .execute(&db)
+    .await?;
+
+    let resp = authed(reqwest::Client::new().post(&url)).send().await?;
+    let status = resp.status();
+    let body = resp.text().await?;
+    assert_eq!(
+        status, 200,
+        "run should succeed on a pre-created table: {body}"
+    );
+
+    Ok(())
+}
+
+#[sqlx::test(fixtures("datatable_migrations_grants"))]
+async fn test_datatable_connection_report(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    setup_unprivileged_datatable_role(&db).await?;
+
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let url =
+        format!("http://localhost:{port}/api/w/dtmig-ws/workspaces/test_datatable_connection/main");
+
+    // The report is a privilege disclosure about the data table's database, so
+    // it stays behind the same bar as editing the data table config.
+    let resp = reqwest::Client::new()
+        .get(&url)
+        .header("Authorization", "Bearer DTMIG_USER_TOKEN")
+        .send()
+        .await?;
+    assert_eq!(resp.status(), 403, "non-admins must not get the report");
+
+    let report: Value = authed(reqwest::Client::new().get(&url))
+        .send()
+        .await?
+        .json()
+        .await?;
+    assert_eq!(report["user"], ROLE);
+    assert_eq!(report["schema"], "public");
+    assert_eq!(report["can_create_table"], false);
+    assert_eq!(report["can_create_schema"], false);
+    let grants = report["suggested_grants"].as_array().unwrap();
+    assert!(
+        grants
+            .iter()
+            .any(|g| g.as_str().unwrap()
+                == format!("GRANT CREATE ON SCHEMA \"public\" TO \"{ROLE}\"")),
+        "missing schema grant: {report}"
+    );
+    // Pin the name, not just the shape: the endpoint reads it from
+    // `current_database()` rather than the resource, and a prefix assertion
+    // would pass either way.
+    let dbname = (*db.connect_options())
+        .clone()
+        .get_database()
+        .expect("test database name")
+        .to_string();
+    assert!(
+        grants.iter().any(|g| g.as_str().unwrap()
+            == format!("GRANT CREATE ON DATABASE \"{dbname}\" TO \"{ROLE}\"")),
+        "missing database grant for {dbname}: {report}"
+    );
+
+    // A pre-created bookkeeping table lets migration *tracking* work, but the
+    // role still cannot create anything: the report must keep saying so rather
+    // than falling silent because nothing needs creating right now.
+    sqlx::raw_sql(&format!(
+        "CREATE TABLE _wm_migrations ( \
+            datatable TEXT NOT NULL, \
+            version BIGINT NOT NULL, \
+            installed_at TIMESTAMPTZ NOT NULL DEFAULT now(), \
+            PRIMARY KEY (datatable, version)); \
+         GRANT SELECT, INSERT, UPDATE, DELETE ON _wm_migrations TO {ROLE};"
+    ))
+    .execute(&db)
+    .await?;
+
+    let report: Value = authed(reqwest::Client::new().get(&url))
+        .send()
+        .await?
+        .json()
+        .await?;
+    assert_eq!(report["migrations_table_exists"], true);
+    assert_eq!(report["can_create_table"], false);
+    assert!(
+        report["suggested_grants"]
+            .as_array()
+            .unwrap()
+            .iter()
+            .any(|g| g.as_str().unwrap().contains("ON SCHEMA")),
+        "an existing bookkeeping table must not suppress the schema grant: {report}"
+    );
+
+    // Granting the privileges clears the suggestions.
+    sqlx::raw_sql(&format!(
+        "GRANT CREATE ON SCHEMA public TO {ROLE}; \
+         GRANT CREATE ON DATABASE \"{dbname}\" TO {ROLE};"
+    ))
+    .execute(&db)
+    .await?;
+
+    let report: Value = authed(reqwest::Client::new().get(&url))
+        .send()
+        .await?
+        .json()
+        .await?;
+    assert_eq!(report["can_create_table"], true);
+    assert_eq!(report["can_create_schema"], true);
+    assert_eq!(report["suggested_grants"].as_array().unwrap().len(), 0);
+
+    Ok(())
+}
+
+/// Point the fixture's second data table at a role whose `search_path` resolves
+/// to nothing, the one state where no grant helps.
+async fn setup_schemaless_datatable_role(db: &Pool<Postgres>) -> anyhow::Result<()> {
+    let opts = (*db.connect_options()).clone();
+    let dbname = opts.get_database().expect("test database name").to_string();
+
+    sqlx::query(&format!(
+        "DO $$ BEGIN \
+           CREATE ROLE \"{NOSCHEMA_ROLE}\" LOGIN PASSWORD '{ROLE_PASSWORD}'; \
+         EXCEPTION WHEN duplicate_object OR unique_violation THEN NULL; \
+         END $$"
+    ))
+    .execute(db)
+    .await?;
+    // Cluster-wide for this role, which is why it gets one of its own rather
+    // than sharing the role the other assertions connect with.
+    sqlx::raw_sql(&format!(
+        "ALTER ROLE \"{NOSCHEMA_ROLE}\" SET search_path = wm_dtmig_absent_schema; \
+         GRANT CONNECT ON DATABASE \"{dbname}\" TO \"{NOSCHEMA_ROLE}\";"
+    ))
+    .execute(db)
+    .await?;
+
+    sqlx::query(
+        "INSERT INTO resource (workspace_id, path, value, resource_type, created_by) \
+         VALUES ('dtmig-ws', 'u/dtmig-admin/pg_noschema', $1, 'postgresql', 'dtmig-admin')",
+    )
+    .bind(json!({
+        "host": opts.get_host(),
+        "port": opts.get_port(),
+        "dbname": dbname,
+        "user": NOSCHEMA_ROLE,
+        "password": ROLE_PASSWORD,
+        "sslmode": "disable",
+    }))
+    .execute(db)
+    .await?;
+
+    Ok(())
+}
+
+#[sqlx::test(fixtures("datatable_migrations_grants"))]
+async fn test_datatable_connection_without_a_resolvable_schema(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    setup_schemaless_datatable_role(&db).await?;
+
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let report: Value = authed(reqwest::Client::new().get(format!(
+        "http://localhost:{port}/api/w/dtmig-ws/workspaces/test_datatable_connection/noschema"
+    )))
+    .send()
+    .await?
+    .json()
+    .await?;
+
+    assert!(report["schema"].is_null(), "expected no schema: {report}");
+    // No grant fixes an empty search_path, so suggesting one would send the
+    // reader after a statement that changes nothing.
+    assert!(
+        !report["suggested_grants"]
+            .as_array()
+            .unwrap()
+            .iter()
+            .any(|g| g.as_str().unwrap().contains("ON SCHEMA")),
+        "an empty search_path must not yield a schema grant: {report}"
+    );
+    assert_eq!(
+        report["suggested_search_path"],
+        format!("ALTER ROLE \"{NOSCHEMA_ROLE}\" SET search_path = public")
+    );
+
+    Ok(())
+}
diff --git a/backend/tests/fixtures/datatable_migrations_grants.sql b/backend/tests/fixtures/datatable_migrations_grants.sql
new file mode 100644
index 0000000000..81feb9ce91
--- /dev/null
+++ b/backend/tests/fixtures/datatable_migrations_grants.sql
@@ -0,0 +1,35 @@
+-- Fixture for the data table migration bookkeeping-grants regression test.
+-- Workspace + admin token + a data table pointing at a postgres resource; the
+-- test fills that resource in with credentials for a deliberately unprivileged
+-- role, since the database name is allocated per test run.
+
+INSERT INTO workspace (id, name, owner) VALUES
+    ('dtmig-ws', 'DTMIG WS', 'dtmig-admin');
+
+INSERT INTO workspace_key (workspace_id, kind, key) VALUES
+    ('dtmig-ws', 'cloud', 'dtmig-key');
+
+INSERT INTO workspace_settings (workspace_id, datatable) VALUES
+    ('dtmig-ws', '{"datatables": {"main": {"database": {"resource_type": "postgresql", "resource_path": "u/dtmig-admin/pg"}, "migrations_enabled": true}, "noschema": {"database": {"resource_type": "postgresql", "resource_path": "u/dtmig-admin/pg_noschema"}, "migrations_enabled": true}}}');
+
+INSERT INTO group_ (workspace_id, name, summary, extra_perms) VALUES
+    ('dtmig-ws', 'all', 'All users', '{}');
+
+INSERT INTO password(email, password_hash, login_type, super_admin, verified, name, username)
+    VALUES ('dtmig-admin@windmill.dev', 'x', 'password', true, true, 'DTMIG Admin', 'dtmig-admin');
+
+INSERT INTO usr(workspace_id, email, username, is_admin, role) VALUES
+    ('dtmig-ws', 'dtmig-admin@windmill.dev', 'dtmig-admin', true, 'Admin');
+
+INSERT INTO token(token_hash, token_prefix, token, email, label, super_admin)
+    VALUES (encode(sha256('DTMIG_ADMIN_TOKEN'::bytea), 'hex'), 'DTMIG_ADM', 'DTMIG_ADMIN_TOKEN', 'dtmig-admin@windmill.dev', 't', true);
+
+-- Non-admin member, to pin that the privilege report stays admin-only.
+INSERT INTO password(email, password_hash, login_type, super_admin, verified, name, username)
+    VALUES ('dtmig-user@windmill.dev', 'x', 'password', false, true, 'DTMIG User', 'dtmig-user');
+
+INSERT INTO usr(workspace_id, email, username, is_admin, role) VALUES
+    ('dtmig-ws', 'dtmig-user@windmill.dev', 'dtmig-user', false, 'User');
+
+INSERT INTO token(token_hash, token_prefix, token, email, label)
+    VALUES (encode(sha256('DTMIG_USER_TOKEN'::bytea), 'hex'), 'DTMIG_USR', 'DTMIG_USER_TOKEN', 'dtmig-user@windmill.dev', 't');
diff --git a/backend/windmill-api-settings/src/lib.rs b/backend/windmill-api-settings/src/lib.rs
index bd34ca35ef..eca0001eab 100644
--- a/backend/windmill-api-settings/src/lib.rs
+++ b/backend/windmill-api-settings/src/lib.rs
@@ -53,7 +53,7 @@ use windmill_common::{
     auth::is_super_admin_email,
     ee_oss::{get_license_plan, LicensePlan},
     email_oss::send_email_plain_text,
-    error::{self, JsonResult, Result},
+    error::{self, pg_error_message, JsonResult, Result},
     get_database_url,
     global_settings::{
         AI_CONFIG_SETTING, APP_WORKSPACED_ROUTE_SETTING, AUTOMATE_USERNAME_CREATION_SETTING,
@@ -1705,7 +1705,7 @@ async fn setup_custom_instance_pg_database_inner(
         .map_err(|e| {
             error::Error::ExecutionErr(format!(
                 "Failed to grant permissions to custom_instance_user: {}",
-                e.to_string(),
+                pg_error_message(&e),
             ))
         })?;
 
diff --git a/backend/windmill-api-workspaces/src/datatable_migrations.rs b/backend/windmill-api-workspaces/src/datatable_migrations.rs
index fef9963933..73e2fb85cc 100644
--- a/backend/windmill-api-workspaces/src/datatable_migrations.rs
+++ b/backend/windmill-api-workspaces/src/datatable_migrations.rs
@@ -21,14 +21,16 @@ use chrono::Utc;
 use serde::{Deserialize, Serialize};
 use sqlx::{Postgres, Transaction};
 use std::collections::{HashMap, HashSet};
+use tokio_postgres::error::SqlState;
 
 use windmill_api_auth::{require_super_admin, ApiAuthed};
 use windmill_api_jobs::run_wait_result_internal;
 use windmill_audit::audit_oss::audit_log;
 use windmill_audit::ActionKind;
 use windmill_common::db::UserDB;
-use windmill_common::error::{Error, JsonResult, Result};
+use windmill_common::error::{pg_error_message, Error, JsonResult, Result};
 use windmill_common::jobs::{JobPayload, RawCode};
+use windmill_common::query_builders::{render_db_quoted_identifier, DbType};
 use windmill_common::runnable_settings::{ConcurrencySettingsWithCustom, DebouncingSettings};
 use windmill_common::scripts::ScriptLang;
 use windmill_common::users::username_to_permissioned_as;
@@ -222,7 +224,31 @@ async fn run_datatable_migration_job(
 /// key would let one data table's migration mark another's same-version
 /// migration as already applied (and rollback could touch the wrong row).
 async fn ensure_wm_migrations_schema(client: &tokio_postgres::Client) -> Result<()> {
-    client
+    // `CREATE TABLE IF NOT EXISTS` checks CREATE on the schema before it checks
+    // existence, so probing first is what lets a data table whose role only holds
+    // DML grants keep migrating against an already-created bookkeeping table.
+    // `to_regclass` resolves through search_path, like the unqualified statements
+    // the rest of this module runs against it. Takes no parameters, so it goes
+    // through the simple protocol: a named prepared statement is what stalls
+    // behind a transaction-pooling proxy (see `pg_get_full_schema`).
+    let rows = client
+        .simple_query("SELECT to_regclass('_wm_migrations') IS NOT NULL AS present")
+        .await
+        .map_err(|e| {
+            Error::internal_err(format!(
+                "Failed to look up _wm_migrations table: {}",
+                pg_error_message(&e)
+            ))
+        })?;
+    let exists = rows.iter().any(|msg| match msg {
+        tokio_postgres::SimpleQueryMessage::Row(row) => row.get("present") == Some("t"),
+        _ => false,
+    });
+    if exists {
+        return Ok(());
+    }
+
+    let Err(e) = client
         .batch_execute(
             "CREATE TABLE IF NOT EXISTS _wm_migrations (\
                 datatable TEXT NOT NULL, \
@@ -231,10 +257,53 @@ async fn ensure_wm_migrations_schema(client: &tokio_postgres::Client) -> Result<
                 PRIMARY KEY (datatable, version))",
         )
         .await
-        .map_err(|e| {
-            Error::internal_err(format!("Failed to ensure _wm_migrations table: {}", e))
-        })?;
-    Ok(())
+    else {
+        return Ok(());
+    };
+
+    let mut msg = format!(
+        "Failed to ensure _wm_migrations table: {}",
+        pg_error_message(&e)
+    );
+    // A role with only table-level grants cannot create it: since Postgres 15 the
+    // `public` schema no longer grants CREATE to PUBLIC, so this is the usual
+    // failure on a bring-your-own database.
+    if e.code() == Some(&SqlState::INSUFFICIENT_PRIVILEGE) {
+        // Windmill connects as the role that lacks the privilege, so it cannot
+        // grant it: hand over the statement a schema owner has to run instead.
+        // Keep it ahead of the explanation below — the UI collapses everything
+        // past the first couple of lines behind a "Show more".
+        if let Some((user, schema)) = connection_identity(client).await {
+            // Both come back unquoted, so a mixed-case or hyphenated name would
+            // otherwise render a statement that targets a different schema.
+            msg.push_str(&format!(
+                ". Run: GRANT CREATE ON SCHEMA {} TO {}",
+                render_db_quoted_identifier(&schema, DbType::Postgresql),
+                render_db_quoted_identifier(&user, DbType::Postgresql),
+            ));
+        }
+        msg.push_str(
+            ". Applied migrations are recorded in a `_wm_migrations` table in the data \
+             table's own database, so its user needs to be able to create it",
+        );
+    }
+    Err(Error::internal_err(msg))
+}
+
+/// The role and default schema of a data table connection, for grant hints.
+/// Both come from the server so the statement we suggest names what the
+/// connection actually resolves to, not what the resource happens to say.
+async fn connection_identity(client: &tokio_postgres::Client) -> Option<(String, String)> {
+    let rows = client
+        .simple_query("SELECT current_user AS usr, current_schema() AS sch")
+        .await
+        .ok()?;
+    rows.iter().find_map(|msg| match msg {
+        tokio_postgres::SimpleQueryMessage::Row(row) => {
+            Some((row.get("usr")?.to_string(), row.get("sch")?.to_string()))
+        }
+        _ => None,
+    })
 }
 
 /// Open a connection to a data table's own database and hold the session-level
@@ -265,7 +334,12 @@ async fn lock_datatable_migration_runs(
     client
         .batch_execute("SELECT pg_advisory_lock(hashtext('windmill_datatable_migrations')::int8)")
         .await
-        .map_err(|e| Error::internal_err(format!("Failed to acquire migration lock: {}", e)))?;
+        .map_err(|e| {
+            Error::internal_err(format!(
+                "Failed to acquire migration lock: {}",
+                pg_error_message(&e)
+            ))
+        })?;
     Ok(client)
 }
 
@@ -287,7 +361,7 @@ async fn read_applied_versions_on_client(
         Err(e) if e.as_db_error().map(|d| d.code().code()) == Some("42P01") => Ok(HashSet::new()),
         Err(e) => Err(Error::internal_err(format!(
             "Failed to read _wm_migrations: {}",
-            e
+            pg_error_message(&e)
         ))),
     }
 }
@@ -366,7 +440,12 @@ async fn run_datatable_migrations(
                 &[&datatable_name, &m.timestamp],
             )
             .await
-            .map_err(|e| Error::internal_err(format!("Failed to record migration: {}", e)))?;
+            .map_err(|e| {
+                Error::internal_err(format!(
+                    "Failed to record migration: {}",
+                    pg_error_message(&e)
+                ))
+            })?;
         applied.push(AppliedMigration { version: m.timestamp, name: m.name });
     }
 
@@ -433,7 +512,12 @@ async fn rollback_datatable_migrations(
                 &[&datatable_name, &only],
             )
             .await
-            .map_err(|e| Error::internal_err(format!("Failed to read _wm_migrations: {}", e)))?,
+            .map_err(|e| {
+                Error::internal_err(format!(
+                    "Failed to read _wm_migrations: {}",
+                    pg_error_message(&e)
+                ))
+            })?,
         None => client
             .query_opt(
                 "SELECT version FROM _wm_migrations WHERE datatable = $1 \
@@ -441,7 +525,12 @@ async fn rollback_datatable_migrations(
                 &[&datatable_name],
             )
             .await
-            .map_err(|e| Error::internal_err(format!("Failed to read _wm_migrations: {}", e)))?,
+            .map_err(|e| {
+                Error::internal_err(format!(
+                    "Failed to read _wm_migrations: {}",
+                    pg_error_message(&e)
+                ))
+            })?,
     };
 
     let version: i64 = match target {
@@ -492,7 +581,12 @@ async fn rollback_datatable_migrations(
             &[&datatable_name, &version],
         )
         .await
-        .map_err(|e| Error::internal_err(format!("Failed to drop migration record: {}", e)))?;
+        .map_err(|e| {
+            Error::internal_err(format!(
+                "Failed to drop migration record: {}",
+                pg_error_message(&e)
+            ))
+        })?;
 
     Ok(Json(RollbackDatatableMigrationsResult {
         rolled_back: vec![RolledBackMigration { version, name: definition.name }],
@@ -940,7 +1034,10 @@ async fn mark_datatable_version_installed(
         )
         .await
         .map_err(|e| {
-            Error::internal_err(format!("Failed to mark initial migration installed: {}", e))
+            Error::internal_err(format!(
+                "Failed to mark initial migration installed: {}",
+                pg_error_message(&e)
+            ))
         })?;
     Ok(())
 }
@@ -1378,7 +1475,7 @@ fn ignore_missing_wm_migrations(e: tokio_postgres::Error) -> Result<()> {
         Some("42P01") => Ok(()),
         _ => Err(Error::internal_err(format!(
             "Failed to update _wm_migrations: {}",
-            e
+            pg_error_message(&e)
         ))),
     }
 }
diff --git a/backend/windmill-api-workspaces/src/workspaces.rs b/backend/windmill-api-workspaces/src/workspaces.rs
index c8f67c9d2e..b7e2ab72c1 100644
--- a/backend/windmill-api-workspaces/src/workspaces.rs
+++ b/backend/windmill-api-workspaces/src/workspaces.rs
@@ -34,6 +34,7 @@ use windmill_audit::audit_oss::{audit_log, AuditAuthorable};
 use windmill_audit::ActionKind;
 use windmill_common::db::UserDB;
 use windmill_common::global_settings::HTTP_ROUTE_WORKSPACED_ROUTE;
+use windmill_common::query_builders::{render_db_quoted_identifier, DbType};
 use windmill_common::users::username_to_permissioned_as;
 use windmill_common::variables::{
     build_crypt, decrypt, encrypt, SECRET_SALT, WORKSPACE_CRYPT_CACHE,
@@ -51,7 +52,7 @@ use windmill_common::workspaces::{
 use windmill_common::workspaces::{Ducklake, DucklakeCatalogResourceType};
 use windmill_common::PgDatabase;
 use windmill_common::{
-    error::{Error, JsonResult, Result},
+    error::{pg_error_message, Error, JsonResult, Result},
     global_settings::{
         AUTOMATE_USERNAME_CREATION_SETTING, DISABLE_WORKSPACE_INVITE_EMAILS_SETTING,
     },
@@ -133,6 +134,10 @@ pub fn workspaced_service() -> Router {
             get(get_datatable_table_schema),
         )
         .route("/edit_datatable_config", post(edit_datatable_config))
+        .route(
+            "/test_datatable_connection/{datatable_name}",
+            get(test_datatable_connection),
+        )
         .merge(crate::datatable_migrations::routes())
         .route("/git_sync_enabled", get(get_git_sync_enabled))
         .route("/git_sync_deploy_mode", get(get_git_sync_deploy_mode))
@@ -2023,6 +2028,127 @@ struct DataTableTableSchema {
     columns: ColumnMap,
 }
 
+#[derive(Serialize, Debug)]
+struct DataTableConnectionCheck {
+    /// The role the data table actually connects as, and the schema its
+    /// unqualified statements resolve to. Both are read from the server rather
+    /// than the resource, which need not spell either of them out.
+    user: String,
+    schema: Option<String>,
+    /// Whether that role can create tables in `schema` / schemas in the database.
+    can_create_table: bool,
+    can_create_schema: bool,
+    /// Whether the migration bookkeeping table is already present. Informative
+    /// only: it explains why migration *tracking* can work without CREATE, and
+    /// grants nothing beyond that.
+    migrations_table_exists: bool,
+    /// Statements to run for the privileges that are missing, empty when there
+    /// are none. Windmill connects as the role that lacks them, so it can only
+    /// name them for a schema owner to run.
+    suggested_grants: Vec<String>,
+    /// Statement that gives the session a schema to work in, when `search_path`
+    /// resolves to none. Rendered here rather than by the caller so identifier
+    /// quoting stays in one place.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    suggested_search_path: Option<String>,
+}
+
+/// Report what the data table's own database lets its role do. Surfacing this
+/// from the settings page is the difference between finding out here and finding
+/// out on a first schema change, when the failure reads as a Postgres refusal
+/// deep inside a migration.
+async fn test_datatable_connection(
+    authed: ApiAuthed,
+    Extension(db): Extension<DB>,
+    Path((w_id, datatable_name)): Path<(String, String)>,
+) -> JsonResult<DataTableConnectionCheck> {
+    require_admin(authed.is_admin, &authed.username)?;
+
+    let db_resource = get_datatable_resource_from_db_unchecked(&db, &w_id, &datatable_name).await?;
+    let pg_db: PgDatabase = serde_json::from_value(db_resource)
+        .map_err(|e| Error::internal_err(format!("Failed to parse database credentials: {}", e)))?;
+    let (client, connection) = pg_db.connect(Some(&db)).await?;
+    let join_handle = tokio::spawn(async move { connection.await });
+
+    // One round trip, no side effects: `has_*_privilege` answers for the
+    // connected role without attempting the operation.
+    let rows = client
+        .simple_query(
+            "SELECT current_user AS usr, \
+                    current_schema() AS sch, \
+                    current_database() AS db, \
+                    has_schema_privilege(current_schema(), 'CREATE') AS can_create_table, \
+                    has_database_privilege(current_database(), 'CREATE') AS can_create_schema, \
+                    to_regclass('_wm_migrations') IS NOT NULL AS has_migrations_table",
+        )
+        .await
+        .map_err(|e| {
+            Error::internal_err(format!(
+                "Failed to inspect data table privileges: {}",
+                pg_error_message(&e)
+            ))
+        });
+
+    drop(client);
+    let _ = windmill_common::shutdown_pg_connection(join_handle).await;
+
+    let row = rows?
+        .into_iter()
+        .find_map(|msg| match msg {
+            tokio_postgres::SimpleQueryMessage::Row(row) => Some(row),
+            _ => None,
+        })
+        .ok_or_else(|| Error::internal_err("Privilege query returned no row".to_string()))?;
+
+    let user = row.get("usr").unwrap_or_default().to_string();
+    let schema = row.get("sch").map(str::to_string);
+    let can_create_table = row.get("can_create_table") == Some("t");
+    let can_create_schema = row.get("can_create_schema") == Some("t");
+    let migrations_table_exists = row.get("has_migrations_table") == Some("t");
+
+    let quoted_user = render_db_quoted_identifier(&user, DbType::Postgresql);
+    let mut suggested_grants = Vec::new();
+    // Suggest on the capability alone: an existing `_wm_migrations` spares only
+    // that one table, and says nothing about the tables a migration will create.
+    // A NULL `current_schema()` means search_path resolves to nothing, and no
+    // grant fixes that — an unqualified CREATE fails with `no schema has been
+    // selected to create in` whoever holds the privilege — so suggest nothing
+    // and let `schema: null` carry the diagnosis.
+    if let (false, Some(target)) = (can_create_table, schema.as_deref()) {
+        suggested_grants.push(format!(
+            "GRANT CREATE ON SCHEMA {} TO {}",
+            render_db_quoted_identifier(target, DbType::Postgresql),
+            quoted_user
+        ));
+    }
+    if !can_create_schema {
+        // Named from the server like every other identifier here: behind a
+        // pooler the resource's dbname can be an alias for another database.
+        let dbname = row.get("db").unwrap_or(pg_db.dbname.as_str());
+        suggested_grants.push(format!(
+            "GRANT CREATE ON DATABASE {} TO {}",
+            render_db_quoted_identifier(dbname, DbType::Postgresql),
+            quoted_user
+        ));
+    }
+
+    // An empty search_path is not a privilege problem, so it gets a statement of
+    // its own rather than a grant.
+    let suggested_search_path = schema
+        .is_none()
+        .then(|| format!("ALTER ROLE {quoted_user} SET search_path = public"));
+
+    Ok(Json(DataTableConnectionCheck {
+        user,
+        schema,
+        can_create_table,
+        can_create_schema,
+        migrations_table_exists,
+        suggested_grants,
+        suggested_search_path,
+    }))
+}
+
 async fn list_datatable_schemas(
     _authed: ApiAuthed,
     Extension(db): Extension<DB>,
@@ -2139,7 +2265,9 @@ async fn get_datatable_schema(db: &DB, w_id: &str, datatable_name: &str) -> Resu
             &[],
         )
         .await
-        .map_err(|e| Error::internal_err(format!("Failed to query schemas: {}", e)))?;
+        .map_err(|e| {
+            Error::internal_err(format!("Failed to query schemas: {}", pg_error_message(&e)))
+        })?;
 
     // Build hierarchical structure: schema -> table -> column -> compact_type
     let mut schema_map: SchemaMap = HashMap::new();
@@ -2173,7 +2301,9 @@ async fn get_datatable_schema(db: &DB, w_id: &str, datatable_name: &str) -> Resu
             &[&schema_names],
         )
         .await
-        .map_err(|e| Error::internal_err(format!("Failed to query columns: {}", e)))?;
+        .map_err(|e| {
+            Error::internal_err(format!("Failed to query columns: {}", pg_error_message(&e)))
+        })?;
 
     for row in rows {
         let table_schema: String = row.get(0);
@@ -2221,7 +2351,9 @@ async fn get_datatable_tables(db: &DB, w_id: &str, datatable_name: &str) -> Resu
             &[],
         )
         .await
-        .map_err(|e| Error::internal_err(format!("Failed to query schemas: {}", e)))?;
+        .map_err(|e| {
+            Error::internal_err(format!("Failed to query schemas: {}", pg_error_message(&e)))
+        })?;
 
     let mut table_map: TableListMap = HashMap::new();
     let schema_names: Vec<String> = schema_rows
@@ -2247,7 +2379,9 @@ async fn get_datatable_tables(db: &DB, w_id: &str, datatable_name: &str) -> Resu
             &[&schema_names],
         )
         .await
-        .map_err(|e| Error::internal_err(format!("Failed to query tables: {}", e)))?;
+        .map_err(|e| {
+            Error::internal_err(format!("Failed to query tables: {}", pg_error_message(&e)))
+        })?;
 
     for row in rows {
         let table_schema: String = row.get(0);
@@ -2299,7 +2433,9 @@ async fn get_datatable_table_columns(
             &[&schema_name, &table_name],
         )
         .await
-        .map_err(|e| Error::internal_err(format!("Failed to query columns: {}", e)))?;
+        .map_err(|e| {
+            Error::internal_err(format!("Failed to query columns: {}", pg_error_message(&e)))
+        })?;
 
     if rows.is_empty() {
         return Err(Error::NotFound(format!(
@@ -2671,7 +2807,10 @@ async fn create_pg_database(
             )
             .await
             .map_err(|e| {
-                Error::internal_err(format!("Failed to check database existence: {}", e))
+                Error::internal_err(format!(
+                    "Failed to check database existence: {}",
+                    pg_error_message(&e)
+                ))
             })?;
         let db_exists: bool = row.get(0);
 
@@ -2690,7 +2829,8 @@ async fn create_pg_database(
             .map_err(|e| {
                 Error::internal_err(format!(
                     "Failed to create database '{}': {}",
-                    req.target_dbname, e
+                    req.target_dbname,
+                    pg_error_message(&e)
                 ))
             })?;
 
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 7927a7f00d..1dd692752f 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -4633,6 +4633,52 @@ paths:
                 items:
                   $ref: "#/components/schemas/DataTableSchema"
 
+  /w/{workspace}/workspaces/test_datatable_connection/{datatable_name}:
+    get:
+      summary: check what the data table's database lets its role do
+      operationId: testDataTableConnection
+      tags:
+        - workspace
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - name: datatable_name
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: connection and privilege report
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  user:
+                    type: string
+                  schema:
+                    type: string
+                    nullable: true
+                  can_create_table:
+                    type: boolean
+                  can_create_schema:
+                    type: boolean
+                  migrations_table_exists:
+                    type: boolean
+                  suggested_grants:
+                    type: array
+                    items:
+                      type: string
+                  suggested_search_path:
+                    type: string
+                required:
+                  - user
+                  - schema
+                  - can_create_table
+                  - can_create_schema
+                  - migrations_table_exists
+                  - suggested_grants
+
   /w/{workspace}/workspaces/list_datatable_tables:
     get:
       summary: list tables of all connected Datatables
diff --git a/backend/windmill-common/src/error.rs b/backend/windmill-common/src/error.rs
index f202bf27f9..0d5ebdc2c3 100644
--- a/backend/windmill-common/src/error.rs
+++ b/backend/windmill-common/src/error.rs
@@ -247,6 +247,41 @@ pub fn to_anyhow<T: 'static + std::error::Error + Send + Sync>(e: T) -> anyhow::
     From::from(e)
 }
 
+/// Render a `tokio_postgres` error for a user-facing message.
+///
+/// The pinned rust-postgres build prints only the error *kind* in its `Display`
+/// impl, so `format!("{e}")` on one of these yields the useless `db error` and
+/// drops the Postgres message. Interpolate errors from a `tokio_postgres::Client`
+/// through this instead.
+pub fn pg_error_message(e: &tokio_postgres::Error) -> String {
+    match e.as_db_error() {
+        Some(db_err) => format_db_error(db_err.message(), db_err.detail(), db_err.hint()),
+        // Non-database failures (io, tls, protocol) keep their message in the cause.
+        None => error_source_chain(e),
+    }
+}
+
+fn format_db_error(message: &str, detail: Option<&str>, hint: Option<&str>) -> String {
+    let mut msg = message.to_string();
+    if let Some(detail) = detail {
+        msg.push_str(&format!(" ({detail})"));
+    }
+    if let Some(hint) = hint {
+        msg.push_str(&format!(". Hint: {hint}"));
+    }
+    msg
+}
+
+fn error_source_chain(e: &dyn std::error::Error) -> String {
+    let mut msg = e.to_string();
+    let mut source = e.source();
+    while let Some(cause) = source {
+        msg.push_str(&format!(": {cause}"));
+        source = cause.source();
+    }
+    msg
+}
+
 impl IntoResponse for Error {
     fn into_response(self) -> axum::response::Response {
         let status = match self {
@@ -419,4 +454,56 @@ mod tests {
         let rendered = Error::JsonErr(v).to_string();
         assert_eq!(rendered, "[\n  1,\n  2,\n  3\n]");
     }
+
+    #[test]
+    fn db_error_renders_message_with_detail_and_hint() {
+        assert_eq!(
+            super::format_db_error("permission denied for schema public", None, None),
+            "permission denied for schema public"
+        );
+        assert_eq!(
+            super::format_db_error("insert violates foreign key", Some("Key (id)=(1)"), None),
+            "insert violates foreign key (Key (id)=(1))"
+        );
+        assert_eq!(
+            super::format_db_error(
+                "column does not exist",
+                None,
+                Some("Perhaps you meant \"b\"")
+            ),
+            "column does not exist. Hint: Perhaps you meant \"b\""
+        );
+    }
+
+    #[test]
+    fn non_db_error_walks_the_source_chain() {
+        #[derive(Debug)]
+        struct Layer(&'static str, Option<Box<Layer>>);
+        impl std::fmt::Display for Layer {
+            fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+                f.write_str(self.0)
+            }
+        }
+        impl std::error::Error for Layer {
+            fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
+                self.1
+                    .as_ref()
+                    .map(|c| c.as_ref() as &(dyn std::error::Error + 'static))
+            }
+        }
+
+        // The pinned rust-postgres build renders only the kind, so everything
+        // actionable is in the causes: they must all reach the message.
+        let err = Layer(
+            "error connecting to server",
+            Some(Box::new(Layer(
+                "tcp connect error",
+                Some(Box::new(Layer("timed out", None))),
+            ))),
+        );
+        assert_eq!(
+            super::error_source_chain(&err),
+            "error connecting to server: tcp connect error: timed out"
+        );
+    }
 }
diff --git a/backend/windmill-common/src/lib.rs b/backend/windmill-common/src/lib.rs
index 1eda7503af..30a5edad32 100644
--- a/backend/windmill-common/src/lib.rs
+++ b/backend/windmill-common/src/lib.rs
@@ -1257,7 +1257,7 @@ pub async fn create_custom_instance_database(
         tracing::warn!(
             "Failed to grant permissions on '{}': {}. Continuing.",
             dbname,
-            e
+            crate::error::pg_error_message(&e)
         );
     }
 
diff --git a/backend/windmill-common/src/query_builders.rs b/backend/windmill-common/src/query_builders.rs
index c0eedadbc4..c315a564af 100644
--- a/backend/windmill-common/src/query_builders.rs
+++ b/backend/windmill-common/src/query_builders.rs
@@ -1,6 +1,8 @@
 use serde::{Deserialize, Deserializer, Serialize};
 use windmill_types::scripts::ScriptLang;
 
+use crate::error::pg_error_message;
+
 fn deserialize_bool_from_null<'de, D>(deserializer: D) -> Result<bool, D::Error>
 where
     D: Deserializer<'de>,
@@ -4848,7 +4850,7 @@ fn required_str<'a>(
     column: &str,
 ) -> Result<&'a str, String> {
     row.try_get(column)
-        .map_err(|e| format!("Failed to read column {}: {}", column, e))?
+        .map_err(|e| format!("Failed to read column {}: {}", column, pg_error_message(&e)))?
         .ok_or_else(|| format!("Unexpected NULL in column {}", column))
 }
 
@@ -4894,7 +4896,7 @@ pub async fn pg_get_full_schema(
         )
         .await
         .map(simple_query_rows)
-        .map_err(|e| format!("Failed to query columns: {}", e))?;
+        .map_err(|e| format!("Failed to query columns: {}", pg_error_message(&e)))?;
 
     let fk_rows = client
         .simple_query(
@@ -4922,7 +4924,7 @@ pub async fn pg_get_full_schema(
         )
         .await
         .map(simple_query_rows)
-        .map_err(|e| format!("Failed to query foreign keys: {}", e))?;
+        .map_err(|e| format!("Failed to query foreign keys: {}", pg_error_message(&e)))?;
 
     let mut result: FullDatabaseSchema = std::collections::HashMap::new();
 
diff --git a/frontend/src/lib/components/workspaceSettings/DataTableSettings.svelte b/frontend/src/lib/components/workspaceSettings/DataTableSettings.svelte
index f652ed8704..069ef6093d 100644
--- a/frontend/src/lib/components/workspaceSettings/DataTableSettings.svelte
+++ b/frontend/src/lib/components/workspaceSettings/DataTableSettings.svelte
@@ -51,7 +51,7 @@
 </script>
 
 <script lang="ts">
-	import { Plus } from 'lucide-svelte'
+	import { Plus, PlugZap } from 'lucide-svelte'
 
 	import Button from '../common/button/Button.svelte'
 
@@ -69,7 +69,12 @@
 	import { isCustomInstanceDbEnabled, getUnusedInstanceDbName } from './utils.svelte'
 	import { random_adj } from '../random_positive_adjetive'
 	import { sendUserToast } from '$lib/toast'
-	import { SettingService, WorkspaceService, type GetSettingsResponse } from '$lib/gen'
+	import {
+		SettingService,
+		WorkspaceService,
+		type GetSettingsResponse,
+		type TestDataTableConnectionResponse
+	} from '$lib/gen'
 	import { workspaceStore } from '$lib/stores'
 	import { createAsyncConfirmationModal } from '../common/confirmationModal/asyncConfirmationModal.svelte'
 	import ConfirmationModal from '../common/confirmationModal/ConfirmationModal.svelte'
@@ -90,6 +95,39 @@
 
 	let { dataTableSettings = $bindable() }: Props = $props()
 
+	// Result of the last "Test connection", shown under the table: the grant
+	// statements have to stay selectable, which rules out a toast.
+	let connectionCheck = $state<
+		| {
+				name: string
+				loading: boolean
+				report?: TestDataTableConnectionResponse
+				error?: string
+		  }
+		| undefined
+	>(undefined)
+
+	// Identifies the request the single result slot is waiting on. The data table
+	// name is not enough: A -> B -> A leaves two A requests in flight, and the
+	// first to be issued can be the last to land.
+	let latestCheck = 0
+
+	async function testConnection(name: string) {
+		const check = ++latestCheck
+		connectionCheck = { name, loading: true }
+		try {
+			const report = await WorkspaceService.testDataTableConnection({
+				workspace: $workspaceStore ?? '',
+				datatableName: name
+			})
+			if (check !== latestCheck) return
+			connectionCheck = { name, loading: false, report }
+		} catch (err) {
+			if (check !== latestCheck) return
+			connectionCheck = { name, loading: false, error: err?.body ?? err?.message ?? String(err) }
+		}
+	}
+
 	let tableHeadNames = ['Name', 'Database', '', ''] as const
 	let tableHeadTooltips: Partial<Record<(typeof tableHeadNames)[number], string | undefined>> = {
 		Name: 'Data tables are referenced by their name. main is a special name that can be used as the default data table.',
@@ -305,6 +343,17 @@
 							datatable={dataTable.name}
 							disabled={!!dirtyMap[dataTable.name]}
 						/>
+						<Button
+							size="xs"
+							color="light"
+							variant="border"
+							startIcon={{ icon: PlugZap }}
+							iconOnly
+							disabled={!!dirtyMap[dataTable.name]}
+							loading={connectionCheck?.name === dataTable.name && connectionCheck.loading}
+							title="Test connection: check the database is reachable and its user can create tables"
+							on:click={() => testConnection(dataTable.name)}
+						/>
 						{#if dirtyMap[dataTable.name]}
 							<Popover
 								openOnHover
@@ -343,6 +392,69 @@
 	</tbody>
 </DataTable>
 
+{#if connectionCheck && !connectionCheck.loading}
+	{@const report = connectionCheck.report}
+	{#if connectionCheck.error}
+		<Alert type="error" title="Could not connect to {connectionCheck.name}" class="mt-4" size="xs">
+			{connectionCheck.error}
+		</Alert>
+	{:else if report}
+		{@const fullyPrivileged = report.can_create_table && report.can_create_schema}
+		<Alert
+			type={fullyPrivileged ? 'success' : 'warning'}
+			title={fullyPrivileged
+				? `${connectionCheck.name} is reachable and its user can create tables and schemas`
+				: `${connectionCheck.name} is reachable but its user is missing privileges`}
+			class="mt-4"
+			size="xs"
+		>
+			<div class="flex flex-col gap-2">
+				<div>
+					Connects as <span class="font-mono">{report.user}</span>{#if report.schema}, resolving
+						unqualified statements to schema <span class="font-mono">{report.schema}</span>{/if}.
+				</div>
+				{#if report.suggested_search_path}
+					<div>
+						Its search_path resolves to no schema, so unqualified statements fail with
+						<span class="font-mono">no schema has been selected to create in</span> whatever
+						privileges the role holds. Point it at one, e.g.
+						<span class="font-mono select-all">{report.suggested_search_path}</span>.
+					</div>
+				{/if}
+				<ul class="list-disc list-inside">
+					<li>
+						Create tables{report.schema ? ` in ${report.schema}` : ''}:
+						<span class="font-semibold">{report.can_create_table ? 'yes' : 'no'}</span>
+					</li>
+					<li>
+						Create schemas:
+						<span class="font-semibold">{report.can_create_schema ? 'yes' : 'no'}</span>
+					</li>
+					<li>
+						Migration bookkeeping table exists:
+						<span class="font-semibold">{report.migrations_table_exists ? 'yes' : 'no'}</span>
+					</li>
+				</ul>
+				{#if report.suggested_grants.length > 0}
+					<div>
+						Windmill connects as the role that lacks these privileges, so it cannot grant them
+						itself. Run as a schema owner or superuser on that database:
+					</div>
+					<pre class="whitespace-pre-wrap select-all text-xs"
+						>{report.suggested_grants.map((g) => `${g};`).join('\n')}</pre
+					>
+					{#if report.schema && !report.can_create_table && !report.migrations_table_exists}
+						<div>
+							Alternatively, create the <span class="font-mono">_wm_migrations</span> bookkeeping table
+							yourself and grant only SELECT, INSERT, UPDATE, DELETE on it.
+						</div>
+					{/if}
+				{/if}
+			</div>
+		</Alert>
+	{/if}
+{/if}
+
 <SettingsFooter
 	class="mt-8"
 	{hasUnsavedChanges}

From 2a2ef411525f032743af93f143c10ad373c20fc8 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Tue, 28 Jul 2026 14:32:44 +0200
Subject: [PATCH 02/24] fix: home kind filter no longer resets a fork or
 reloads the page (#10384)

* fix: source setQuery's query string from the address bar, not page.url

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix: stop treating site-wide cross-origin isolation as leaving the editor

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .../src/lib/components/home/ItemsList.svelte  |  2 +-
 frontend/src/lib/navigation.test.ts           | 33 +++++++++++++++++--
 frontend/src/lib/navigation.ts                | 18 +++++++---
 .../src/routes/(root)/(logged)/+layout.svelte | 11 +++++--
 .../src/routes/(root)/(logged)/+page.svelte   |  2 +-
 .../(logged)/amqp_triggers/+page.svelte       |  2 --
 .../(logged)/azure_triggers/+page.svelte      |  2 --
 .../(logged)/email_triggers/+page.svelte      |  2 --
 .../(root)/(logged)/gcp_triggers/+page.svelte |  2 --
 .../(logged)/kafka_triggers/+page.svelte      |  2 --
 .../(logged)/mqtt_triggers/+page.svelte       |  2 --
 .../(logged)/nats_triggers/+page.svelte       |  2 --
 .../(logged)/postgres_triggers/+page.svelte   |  2 --
 .../(root)/(logged)/routes/+page.svelte       |  2 --
 .../(root)/(logged)/sqs_triggers/+page.svelte |  2 --
 .../(logged)/websocket_triggers/+page.svelte  |  2 --
 16 files changed, 54 insertions(+), 34 deletions(-)

diff --git a/frontend/src/lib/components/home/ItemsList.svelte b/frontend/src/lib/components/home/ItemsList.svelte
index 8eafad1824..041d8fc58e 100644
--- a/frontend/src/lib/components/home/ItemsList.svelte
+++ b/frontend/src/lib/components/home/ItemsList.svelte
@@ -1361,7 +1361,7 @@
 					if (itemKind != 'all') {
 						subtab = v
 					}
-					setQuery(page.url, 'kind', v)
+					setQuery('kind', v)
 				}}
 			>
 				{#snippet children({ item })}
diff --git a/frontend/src/lib/navigation.test.ts b/frontend/src/lib/navigation.test.ts
index b6233d44f8..f499ddf1f7 100644
--- a/frontend/src/lib/navigation.test.ts
+++ b/frontend/src/lib/navigation.test.ts
@@ -1,5 +1,10 @@
-import { describe, it, expect } from 'vitest'
-import { buildFilterUrl } from './navigation'
+import { describe, it, expect, vi } from 'vitest'
+
+const goto = vi.hoisted(() => vi.fn(async (_path: string) => {}))
+vi.mock('$app/navigation', () => ({ goto: (path: string) => goto(path) }))
+vi.mock('$app/paths', () => ({ base: '' }))
+
+import { buildFilterUrl, setQuery } from './navigation'
 
 // Parse the (un-based) app path the builder returns against a dummy origin so we can
 // assert on pathname / searchParams / hash without caring about ordering.
@@ -50,3 +55,27 @@ describe('buildFilterUrl', () => {
 		expect(u.hash).toBe('#f/a/b')
 	})
 })
+
+describe('setQuery', () => {
+	// setQuery reads nothing but `window.location.search`; the node test env has no
+	// real `location`, so a stub carrying the query is the whole browser it needs.
+	function addressBar(search: string) {
+		Object.defineProperty(globalThis, 'location', {
+			value: { search },
+			writable: true,
+			configurable: true
+		})
+	}
+
+	it('preserves params that only the address bar knows about', async () => {
+		goto.mockClear()
+		addressBar('?workspace=wm-fork-x&search=foo')
+
+		await setQuery('kind', 'script')
+
+		const u = parse(goto.mock.calls[0][0])
+		expect(u.searchParams.get('workspace')).toBe('wm-fork-x')
+		expect(u.searchParams.get('search')).toBe('foo')
+		expect(u.searchParams.get('kind')).toBe('script')
+	})
+})
diff --git a/frontend/src/lib/navigation.ts b/frontend/src/lib/navigation.ts
index fd3a35800e..d0c2bae4e7 100644
--- a/frontend/src/lib/navigation.ts
+++ b/frontend/src/lib/navigation.ts
@@ -36,19 +36,27 @@ export function buildFilterUrl(
 	return qs ? `${pathname}?${qs}${hash}` : `${pathname}${hash}`
 }
 
+/**
+ * Set (or, with an undefined value, drop) one query param on the current page and
+ * navigate, leaving every other param untouched.
+ *
+ * The starting query must come from `window.location`, never from a URL held
+ * elsewhere — above all `page.url`, which SvelteKit refreshes only on router-driven
+ * navigations. Params written with shallow routing (a workspace switch's
+ * `?workspace=`, anything `useSearchParams` writes) never reach `page.url`, so
+ * rebuilding the query from it navigates back to their pre-write values.
+ */
 export async function setQuery(
-	url: URL,
 	key: string,
 	value: string | undefined,
 	currentHash: string | undefined = undefined
 ): Promise<void> {
+	const searchParams = new URLSearchParams(window.location.search)
 	if (value !== undefined) {
-		url.searchParams.set(key, value)
+		searchParams.set(key, value)
 	} else {
-		url.searchParams.delete(key)
+		searchParams.delete(key)
 	}
 
-	let searchParams = url.searchParams.toString()
-
 	await goto(currentHash ? `?${searchParams}${currentHash}` : `?${searchParams}`)
 }
diff --git a/frontend/src/routes/(root)/(logged)/+layout.svelte b/frontend/src/routes/(root)/(logged)/+layout.svelte
index c2092f5059..7dbe5ca376 100644
--- a/frontend/src/routes/(root)/(logged)/+layout.svelte
+++ b/frontend/src/routes/(root)/(logged)/+layout.svelte
@@ -426,13 +426,18 @@
 				navigation.cancel()
 				window.location.href = navigation.to!.url.href
 			}
-		} else if (toPath && (isEditorPath(currentPath) || window.crossOriginIsolated)) {
+		} else if (toPath && isEditorPath(currentPath)) {
 			// Reverse of the guard above: leaving the isolated editor document must
 			// also fully reload, or its COEP header sticks for the rest of the SPA
 			// session and blocks CORP-less cross-origin subresources (e.g. images in
 			// a viewed app — see needs_cross_origin_isolation in static_assets.rs).
-			// The path check covers plain-HTTP origins, where `crossOriginIsolated`
-			// stays false even with the headers applied.
+			// Key off the path, never `window.crossOriginIsolated`: a deployment may
+			// isolate the whole site (frontend/static/_headers does, for Cloudflare
+			// Pages), and there the flag is true on every page — turning every
+			// navigation into a full page load, while the reload it forces cannot
+			// clear an isolation the next document asserts too. Among the routes this
+			// layout governs, only the editor is served the headers, so entering it is
+			// the only way into an isolated document here.
 			navigation.cancel()
 			window.location.href = navigation.to!.url.href
 		}
diff --git a/frontend/src/routes/(root)/(logged)/+page.svelte b/frontend/src/routes/(root)/(logged)/+page.svelte
index e326bc87f7..c26dfdf2d0 100644
--- a/frontend/src/routes/(root)/(logged)/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/+page.svelte
@@ -327,7 +327,7 @@
 						<ToggleButtonGroup
 							bind:selected={subtab}
 							onSelected={(v) => {
-								setQuery(page.url, 'kind', v, window.location.hash)
+								setQuery('kind', v, window.location.hash)
 							}}
 							noWFull
 						>
diff --git a/frontend/src/routes/(root)/(logged)/amqp_triggers/+page.svelte b/frontend/src/routes/(root)/(logged)/amqp_triggers/+page.svelte
index ef1e549fb7..159d967627 100644
--- a/frontend/src/routes/(root)/(logged)/amqp_triggers/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/amqp_triggers/+page.svelte
@@ -238,13 +238,11 @@
 
 	function updateQueryFilters(selectedFilterKind, filterUserFolders) {
 		setQuery(
-			new URL(window.location.href),
 			TRIGGER_PATH_KIND_FILTER_SETTING,
 			selectedFilterKind,
 			window.location.hash || undefined
 		).then(() => {
 			setQuery(
-				new URL(window.location.href),
 				FILTER_USER_FOLDER_SETTING_NAME,
 				String(filterUserFolders),
 				window.location.hash || undefined
diff --git a/frontend/src/routes/(root)/(logged)/azure_triggers/+page.svelte b/frontend/src/routes/(root)/(logged)/azure_triggers/+page.svelte
index d86f2a8861..e6d25c1876 100644
--- a/frontend/src/routes/(root)/(logged)/azure_triggers/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/azure_triggers/+page.svelte
@@ -258,13 +258,11 @@
 
 	function updateQueryFilters(selectedFilterKind, filterUserFolders) {
 		setQuery(
-			new URL(window.location.href),
 			TRIGGER_PATH_KIND_FILTER_SETTING,
 			selectedFilterKind,
 			window.location.hash || undefined
 		).then(() => {
 			setQuery(
-				new URL(window.location.href),
 				FILTER_USER_FOLDER_SETTING_NAME,
 				String(filterUserFolders),
 				window.location.hash || undefined
diff --git a/frontend/src/routes/(root)/(logged)/email_triggers/+page.svelte b/frontend/src/routes/(root)/(logged)/email_triggers/+page.svelte
index b3ab65be7f..f98a1b867f 100644
--- a/frontend/src/routes/(root)/(logged)/email_triggers/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/email_triggers/+page.svelte
@@ -204,13 +204,11 @@
 
 	function updateQueryFilters(selectedFilterKind, filterUserFolders) {
 		setQuery(
-			new URL(window.location.href),
 			TRIGGER_PATH_KIND_FILTER_SETTING,
 			selectedFilterKind,
 			window.location.hash || undefined
 		).then(() => {
 			setQuery(
-				new URL(window.location.href),
 				FILTER_USER_FOLDER_SETTING_NAME,
 				String(filterUserFolders),
 				window.location.hash || undefined
diff --git a/frontend/src/routes/(root)/(logged)/gcp_triggers/+page.svelte b/frontend/src/routes/(root)/(logged)/gcp_triggers/+page.svelte
index 96652a26ff..21442cfdba 100644
--- a/frontend/src/routes/(root)/(logged)/gcp_triggers/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/gcp_triggers/+page.svelte
@@ -251,13 +251,11 @@
 
 	function updateQueryFilters(selectedFilterKind, filterUserFolders) {
 		setQuery(
-			new URL(window.location.href),
 			TRIGGER_PATH_KIND_FILTER_SETTING,
 			selectedFilterKind,
 			window.location.hash || undefined
 		).then(() => {
 			setQuery(
-				new URL(window.location.href),
 				FILTER_USER_FOLDER_SETTING_NAME,
 				String(filterUserFolders),
 				window.location.hash || undefined
diff --git a/frontend/src/routes/(root)/(logged)/kafka_triggers/+page.svelte b/frontend/src/routes/(root)/(logged)/kafka_triggers/+page.svelte
index 5734e592fc..44cea41b51 100644
--- a/frontend/src/routes/(root)/(logged)/kafka_triggers/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/kafka_triggers/+page.svelte
@@ -242,13 +242,11 @@
 
 	function updateQueryFilters(selectedFilterKind, filterUserFolders) {
 		setQuery(
-			new URL(window.location.href),
 			TRIGGER_PATH_KIND_FILTER_SETTING,
 			selectedFilterKind,
 			window.location.hash || undefined
 		).then(() => {
 			setQuery(
-				new URL(window.location.href),
 				FILTER_USER_FOLDER_SETTING_NAME,
 				String(filterUserFolders),
 				window.location.hash || undefined
diff --git a/frontend/src/routes/(root)/(logged)/mqtt_triggers/+page.svelte b/frontend/src/routes/(root)/(logged)/mqtt_triggers/+page.svelte
index bd2ecf2d79..905d5b914f 100644
--- a/frontend/src/routes/(root)/(logged)/mqtt_triggers/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/mqtt_triggers/+page.svelte
@@ -238,13 +238,11 @@
 
 	function updateQueryFilters(selectedFilterKind, filterUserFolders) {
 		setQuery(
-			new URL(window.location.href),
 			TRIGGER_PATH_KIND_FILTER_SETTING,
 			selectedFilterKind,
 			window.location.hash || undefined
 		).then(() => {
 			setQuery(
-				new URL(window.location.href),
 				FILTER_USER_FOLDER_SETTING_NAME,
 				String(filterUserFolders),
 				window.location.hash || undefined
diff --git a/frontend/src/routes/(root)/(logged)/nats_triggers/+page.svelte b/frontend/src/routes/(root)/(logged)/nats_triggers/+page.svelte
index 670f6fb041..23bdc86360 100644
--- a/frontend/src/routes/(root)/(logged)/nats_triggers/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/nats_triggers/+page.svelte
@@ -241,13 +241,11 @@
 
 	function updateQueryFilters(selectedFilterKind, filterUserFolders) {
 		setQuery(
-			new URL(window.location.href),
 			TRIGGER_PATH_KIND_FILTER_SETTING,
 			selectedFilterKind,
 			window.location.hash || undefined
 		).then(() => {
 			setQuery(
-				new URL(window.location.href),
 				FILTER_USER_FOLDER_SETTING_NAME,
 				String(filterUserFolders),
 				window.location.hash || undefined
diff --git a/frontend/src/routes/(root)/(logged)/postgres_triggers/+page.svelte b/frontend/src/routes/(root)/(logged)/postgres_triggers/+page.svelte
index 0d901ac4cc..193a3cb2ac 100644
--- a/frontend/src/routes/(root)/(logged)/postgres_triggers/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/postgres_triggers/+page.svelte
@@ -255,13 +255,11 @@
 
 	function updateQueryFilters(selectedFilterKind, filterUserFolders) {
 		setQuery(
-			new URL(window.location.href),
 			TRIGGER_PATH_KIND_FILTER_SETTING,
 			selectedFilterKind,
 			window.location.hash || undefined
 		).then(() => {
 			setQuery(
-				new URL(window.location.href),
 				FILTER_USER_FOLDER_SETTING_NAME,
 				String(filterUserFolders),
 				window.location.hash || undefined
diff --git a/frontend/src/routes/(root)/(logged)/routes/+page.svelte b/frontend/src/routes/(root)/(logged)/routes/+page.svelte
index 7ac46b7a61..5f2a657480 100644
--- a/frontend/src/routes/(root)/(logged)/routes/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/routes/+page.svelte
@@ -220,13 +220,11 @@
 
 	function updateQueryFilters(selectedFilterKind, filterUserFolders) {
 		setQuery(
-			new URL(window.location.href),
 			TRIGGER_PATH_KIND_FILTER_SETTING,
 			selectedFilterKind,
 			window.location.hash || undefined
 		).then(() => {
 			setQuery(
-				new URL(window.location.href),
 				FILTER_USER_FOLDER_SETTING_NAME,
 				String(filterUserFolders),
 				window.location.hash || undefined
diff --git a/frontend/src/routes/(root)/(logged)/sqs_triggers/+page.svelte b/frontend/src/routes/(root)/(logged)/sqs_triggers/+page.svelte
index 6106c2c775..41aa60d31b 100644
--- a/frontend/src/routes/(root)/(logged)/sqs_triggers/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/sqs_triggers/+page.svelte
@@ -235,13 +235,11 @@
 
 	function updateQueryFilters(selectedFilterKind, filterUserFolders) {
 		setQuery(
-			new URL(window.location.href),
 			TRIGGER_PATH_KIND_FILTER_SETTING,
 			selectedFilterKind,
 			window.location.hash || undefined
 		).then(() => {
 			setQuery(
-				new URL(window.location.href),
 				FILTER_USER_FOLDER_SETTING_NAME,
 				String(filterUserFolders),
 				window.location.hash || undefined
diff --git a/frontend/src/routes/(root)/(logged)/websocket_triggers/+page.svelte b/frontend/src/routes/(root)/(logged)/websocket_triggers/+page.svelte
index be0004be2a..73edd337c1 100644
--- a/frontend/src/routes/(root)/(logged)/websocket_triggers/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/websocket_triggers/+page.svelte
@@ -238,13 +238,11 @@
 
 	function updateQueryFilters(selectedFilterKind, filterUserFolders) {
 		setQuery(
-			new URL(window.location.href),
 			TRIGGER_PATH_KIND_FILTER_SETTING,
 			selectedFilterKind,
 			window.location.hash || undefined
 		).then(() => {
 			setQuery(
-				new URL(window.location.href),
 				FILTER_USER_FOLDER_SETTING_NAME,
 				String(filterUserFolders),
 				window.location.hash || undefined

From c4e75683a8a346f4cb39038f3045c94f3a9621b2 Mon Sep 17 00:00:00 2001
From: Alexander Petric <alpetric@users.noreply.github.com>
Date: Tue, 28 Jul 2026 14:34:29 +0200
Subject: [PATCH 03/24] fix: mark Setup URL as required in self-managed GitHub
 App instructions (#10380)

* fix: mark Setup URL as required in self-managed GitHub App instructions

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WTZ5UBBLNh2rkgfNzUmCWs

* fix: clarify workspace assignments table only renders once app is configured

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WTZ5UBBLNh2rkgfNzUmCWs

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
---
 .../components/instanceSettings/GhesAppSettings.svelte | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/frontend/src/lib/components/instanceSettings/GhesAppSettings.svelte b/frontend/src/lib/components/instanceSettings/GhesAppSettings.svelte
index 86e3038fdf..ae5347d278 100644
--- a/frontend/src/lib/components/instanceSettings/GhesAppSettings.svelte
+++ b/frontend/src/lib/components/instanceSettings/GhesAppSettings.svelte
@@ -184,11 +184,15 @@
 						<strong>Homepage URL</strong>: your Windmill instance URL
 					</li>
 					<li>
-						<strong>Callback URL</strong>: <code>&lt;your-windmill-url&gt;/gh_success</code>
+						<strong>Setup URL</strong> (under "Post installation"):
+						<code>&lt;your-windmill-url&gt;/gh_success</code> with "Redirect on update" checked.
+						Required for installing the app from workspace Git sync settings — GitHub redirects
+						here after installation to link it to the workspace. Without it, installations can
+						still be linked manually from the Workspace assignments table that appears below
+						once the app details are saved.
 					</li>
 					<li>
-						<strong>Setup URL</strong> (optional):
-						<code>&lt;your-windmill-url&gt;/gh_success</code> with "Redirect on update" checked
+						<strong>Callback URL</strong>: <code>&lt;your-windmill-url&gt;/gh_success</code>
 					</li>
 					<li>Uncheck <strong>Active</strong> under Webhook (not needed)</li>
 				</ul>

From 5feec9b4cd3cdd4eed3edf5be0fc42dabfeb13d2 Mon Sep 17 00:00:00 2001
From: Guilhem <guilhemlemouel@gmail.com>
Date: Tue, 28 Jul 2026 14:35:01 +0200
Subject: [PATCH 04/24] fix(ai-chat): make hub script paths readable from the
 global chat (#10381)

* fix(ai-chat): make hub script paths readable from the global chat

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix(ai-evals): match hub fixtures on whole words, not substrings

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 ai_evals/adapters/frontend/mockBackend.ts     | 162 +++++++++++++++++-
 ai_evals/cases/global.yaml                    |  46 +++++
 .../copilot/chat/global/core.test.ts          |  26 +++
 .../components/copilot/chat/global/core.ts    |  24 ++-
 .../components/copilot/chat/shared.test.ts    |  67 ++++++++
 .../src/lib/components/copilot/chat/shared.ts |  43 +++--
 6 files changed, 352 insertions(+), 16 deletions(-)

diff --git a/ai_evals/adapters/frontend/mockBackend.ts b/ai_evals/adapters/frontend/mockBackend.ts
index 64cacabd58..40a6dfa4ad 100644
--- a/ai_evals/adapters/frontend/mockBackend.ts
+++ b/ai_evals/adapters/frontend/mockBackend.ts
@@ -809,6 +809,142 @@ export function listBenchmarkMcpTools(): EndpointTool[] {
 	return BENCHMARK_MCP_TOOLS
 }
 
+/** A stand-in Windmill hub. `search_hub_scripts` and a `hub/` read go out over
+ * relative `/api/...` fetches, which have no origin here, so without these the
+ * hub tools throw and no case can exercise hub reuse. Serving fixtures rather
+ * than the live hub also keeps assertions on script content stable as the real
+ * hub republishes new versions. */
+const BENCHMARK_HUB_SCRIPTS = [
+	{
+		version_id: 22235,
+		app: 'holded',
+		summary: 'Send Document',
+		terms: 'holded invoice document send email mail',
+		language: 'bun',
+		content: `//native
+type Holded = {
+  apiKey: string;
+};
+/**
+ * Send Document
+ * Send a specific document by email.
+ */
+export async function main(
+  auth: Holded,
+  docType: string,
+  documentId: string,
+  body: {
+    mailTemplateId?: string;
+    emails: string;
+    subject?: string;
+    message?: string;
+    docIds?: string;
+  },
+) {
+  const url = new URL(
+    \`https://api.holded.com/api/invoicing/v1/documents/\${docType}/\${documentId}/send\`,
+  );
+
+  const response = await fetch(url, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      key: auth.apiKey,
+    },
+    body: JSON.stringify(body),
+  });
+  if (!response.ok) {
+    const text = await response.text();
+    throw new Error(\`\${response.status} \${text}\`);
+  }
+  return await response.json();
+}
+`,
+		schema: {
+			type: 'object',
+			required: ['auth', 'docType', 'documentId', 'body'],
+			properties: {
+				auth: { type: 'object', format: 'resource-holded' },
+				docType: { type: 'string' },
+				documentId: { type: 'string' },
+				body: { type: 'object' }
+			}
+		}
+	},
+	{
+		version_id: 28294,
+		app: 'discord',
+		summary: 'Send a message to Discord using Webhook',
+		terms: 'discord webhook message send chat channel',
+		language: 'bunnative',
+		content: `//native
+
+type DiscordWebhook = {
+  webhook_url: string;
+};
+export async function main(discord_webhook: DiscordWebhook, message: string) {
+  const response = await fetch(\`\${discord_webhook.webhook_url}?wait=true\`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ content: message }),
+  });
+  if (!response.ok) {
+    throw new Error(\`\${response.status} \${await response.text()}\`);
+  }
+  return await response.json();
+}
+`,
+		schema: {
+			type: 'object',
+			required: ['discord_webhook', 'message'],
+			properties: {
+				discord_webhook: { type: 'object', format: 'resource-discord_webhook' },
+				message: { type: 'string' }
+			}
+		}
+	}
+]
+
+/** Naive whole-word overlap — enough to rank a handful of fixtures for a natural
+ * query without pulling an embedding model into the benchmark. Every frontend eval
+ * shares this handler, so the bar to match is deliberately high: naming the
+ * integration, or overlapping on three meaningful words. A looser bar answers
+ * "send a Slack message" with the Discord fixture, handing an unrelated case a
+ * plausible-looking wrong integration. */
+function searchBenchmarkHubScripts(text: string) {
+	const tokens = new Set(
+		text
+			.toLowerCase()
+			.split(/[^a-z0-9]+/)
+			.filter((token) => token.length > 2)
+	)
+	return BENCHMARK_HUB_SCRIPTS.map((script) => {
+		const words = new Set(
+			`${script.app} ${script.summary} ${script.terms}`.toLowerCase().split(/[^a-z0-9]+/)
+		)
+		const score = [...tokens].filter((token) => words.has(token)).length
+		return { script, score, namesApp: tokens.has(script.app) }
+	})
+		.filter((entry) => entry.namesApp || entry.score >= 3)
+		.sort((a, b) => b.score - a.score)
+		.map(({ script }, index) => ({
+			ask_id: script.version_id,
+			id: script.version_id,
+			version_id: script.version_id,
+			summary: script.summary,
+			app: script.app,
+			kind: 'script',
+			score: 1 - index * 0.01
+		}))
+}
+
+/** The hub keys a script by its version id; the app and slug segments that
+ * follow are descriptive, so match on the id exactly as the real hub does. */
+function getBenchmarkHubScript(path: string) {
+	const versionId = Number(path.replace(/^\/api\/scripts\/hub\/get_full\/hub\//, '').split('/')[0])
+	return BENCHMARK_HUB_SCRIPTS.find((script) => script.version_id === versionId)
+}
+
 const BENCHMARK_WORKERS = [
 	{
 		worker: 'wk-benchmark-1',
@@ -837,10 +973,16 @@ const BENCHMARK_WORKERS = [
  * intercepting it with a synthetic 404 sends the model into retry loops. */
 export function hasBenchmarkApiHandler(url: string): boolean {
 	const path = url.split('?')[0]
-	return path === '/api/workers/list' || /^\/api\/w\/[^/]+\/jobs\/queue\/list$/.test(path)
+	return (
+		path === '/api/workers/list' ||
+		/^\/api\/w\/[^/]+\/jobs\/queue\/list$/.test(path) ||
+		path === '/api/embeddings/query_hub_scripts' ||
+		path.startsWith('/api/scripts/hub/get_full/')
+	)
 }
 
-/** Answer a relative `/api/...` fetch issued by the API catalog executor. */
+/** Answer a relative `/api/...` fetch — from the API catalog executor, or from the
+ * chat's hub tools. */
 export function handleBenchmarkApiFetch(url: string): Response {
 	const path = url.split('?')[0]
 	if (path === '/api/workers/list') {
@@ -849,5 +991,21 @@ export function handleBenchmarkApiFetch(url: string): Response {
 	if (/^\/api\/w\/[^/]+\/jobs\/queue\/list$/.test(path)) {
 		return Response.json([])
 	}
+	if (path === '/api/embeddings/query_hub_scripts') {
+		const text = new URLSearchParams(url.split('?')[1] ?? '').get('text') ?? ''
+		return Response.json(searchBenchmarkHubScripts(text))
+	}
+	if (path.startsWith('/api/scripts/hub/get_full/')) {
+		const script = getBenchmarkHubScript(path)
+		if (!script) {
+			return Response.json({ error: 'hub script not found' }, { status: 404 })
+		}
+		return Response.json({
+			content: script.content,
+			language: script.language,
+			schema: script.schema,
+			summary: script.summary
+		})
+	}
 	return Response.json({ error: `no benchmark handler for ${path}` }, { status: 404 })
 }
diff --git a/ai_evals/cases/global.yaml b/ai_evals/cases/global.yaml
index 72739d2778..005c677e79 100644
--- a/ai_evals/cases/global.yaml
+++ b/ai_evals/cases/global.yaml
@@ -1877,3 +1877,49 @@
         stringIncludesAnyOf:
           - email
   skipJudge: true
+
+# --- Windmill Hub reuse (search_hub_scripts + read_workspace_item on a hub/ path) ---
+# Holded's API is obscure enough that a model writing from memory cannot reproduce
+# its endpoint and `key` auth header — so the draft's fidelity to the published
+# script is what proves the hub content was actually fetched, not guessed.
+- id: global-hub1-reuse-hub-script
+  prompt: |-
+    I want to email one of my Holded invoices to a customer from Windmill.
+    There is already a script for that on the Windmill hub — reuse it instead of writing
+    your own, and save it as a draft script at `f/evals/global/holded_send_document`.
+    Leave it as an AI draft; do not deploy it.
+  initial: ai_evals/fixtures/frontend/global/initial/user_admin_evals_folder.json
+  runtime:
+    maxTurns: 12
+  validate:
+    draftCountExactly: 1
+    requiredDrafts:
+      - type: script
+        path: f/evals/global/holded_send_document
+        language: bun
+        valueIncludes:
+          - api.holded.com/api/invoicing/v1/documents
+          # `mailTemplateId` is an optional field of the published script's body
+          # that a model writing from memory does not invent, so it is what
+          # separates reusing the hub script from re-deriving one that merely
+          # hits the same endpoint.
+          - mailTemplateId
+  toolExpect:
+    requiredToolsUsed:
+      - search_hub_scripts
+      - read_workspace_item
+      - write_script
+    forbiddenToolsUsed:
+      - deploy_workspace_item
+      - delete_workspace_item
+    toolCallArgs:
+      - tool: read_workspace_item
+        field: path
+        stringIncludesAnyOf:
+          - hub/
+  judgeChecklist:
+    - the draft sends an existing Holded document by email rather than creating one
+    - the request targets Holded's document send endpoint, not an invented URL
+    - authentication uses Holded's own key header rather than a bearer token
+    - the document type, document id, and recipient emails are inputs to the script
+    - the result stays an AI draft and is not deployed
diff --git a/frontend/src/lib/components/copilot/chat/global/core.test.ts b/frontend/src/lib/components/copilot/chat/global/core.test.ts
index 2ce668d789..9e8cec8b1e 100644
--- a/frontend/src/lib/components/copilot/chat/global/core.test.ts
+++ b/frontend/src/lib/components/copilot/chat/global/core.test.ts
@@ -69,6 +69,9 @@ vi.mock('$lib/gen', async () => {
 			}),
 			queryHubScripts: vi.fn(async () => []),
 			getHubScriptContentByPath: vi.fn(async () => ''),
+			getHubScriptByPath: vi.fn(async () => {
+				throw new Error('getHubScriptByPath mock not configured')
+			}),
 			listScripts: vi.fn(async () => [])
 		}),
 		JobService: wrapService(actual.JobService, {
@@ -534,6 +537,29 @@ describe('global AI tools', () => {
 		])
 	})
 
+	it('reads a hub script path through the hub endpoint, not the workspace one', async () => {
+		vi.mocked(ScriptService.getHubScriptByPath).mockResolvedValueOnce({
+			content: 'export async function main() {}',
+			language: 'bunnative',
+			summary: 'Send a message to discord using webhook',
+			schema: { type: 'object', properties: {} }
+		})
+
+		const raw = await callGlobalTool('read_workspace_item', {
+			type: 'script',
+			path: 'hub/28294/discord/send_a_message_to_discord_using_webhook'
+		})
+
+		expect(ScriptService.getHubScriptByPath).toHaveBeenCalledWith({
+			path: 'hub/28294/discord/send_a_message_to_discord_using_webhook'
+		})
+		expect(ScriptService.getScriptByPath).not.toHaveBeenCalled()
+		expect(JSON.parse(raw)).toMatchObject({
+			language: 'bunnative',
+			value: 'export async function main() {}'
+		})
+	})
+
 	it('reads the deployed state, skipping chat and DB drafts, with version: deployed', async () => {
 		await callGlobalTool('write_script', {
 			path: 'f/scripts/greet',
diff --git a/frontend/src/lib/components/copilot/chat/global/core.ts b/frontend/src/lib/components/copilot/chat/global/core.ts
index 80204ba02b..cc91b9810b 100644
--- a/frontend/src/lib/components/copilot/chat/global/core.ts
+++ b/frontend/src/lib/components/copilot/chat/global/core.ts
@@ -90,6 +90,7 @@ import {
 	executeFlowStepTestRun,
 	executeTestRun,
 	findAndReplace,
+	isHubPath,
 	type CreatedResourceTriggerKind,
 	type PreviewCardKind,
 	type Tool,
@@ -362,7 +363,11 @@ const listWorkspaceItemsSchema = z.object({
 
 const readWorkspaceItemSchema = z.object({
 	type: itemTypeSchema,
-	path: z.string().describe('Workspace path of the item to read.'),
+	path: z
+		.string()
+		.describe(
+			'Workspace path of the item to read, or a hub/<version>/<app>/<name> path from search_hub_scripts to read a hub script.'
+		),
 	trigger_kind: triggerKindSchema
 		.optional()
 		.describe('Required when type is trigger. Identifies which trigger service to call.'),
@@ -1170,6 +1175,7 @@ Rules:
 - Variable values are never readable. For secrets, create a secret variable and reference it from resources as "$var:path/to/variable".
 - Use search_resource_types before write_resource.
 - When script or raw app code needs an external npm package you are not fully familiar with, use search_npm_packages to find it and get its documentation and type definitions. Link the package documentation in your answer when you rely on it.
+- Hub scripts are prebuilt integrations for third-party services, hosted outside the workspace under \`hub/<version>/<app>/<name>\` paths. Use search_hub_scripts to find one before hand-writing an integration, then read_workspace_item with type "script" and the returned hub path to get its code, language, and input schema.
 - Use get_db_schema with a database resource path to fetch its tables and columns before writing SQL (or a script querying that database).
 - Use get_instructions before writing scripts, flows, resources, or apps. For scripts, pass the target language.
 ${pipelineBullet}
@@ -1778,6 +1784,20 @@ async function readWorkspaceItem(
 ): Promise<WorkspaceItem> {
 	switch (type) {
 		case 'script': {
+			// Hub scripts are not workspace items: search_hub_scripts hands back
+			// `hub/<version>/<app>/<slug>` paths, which getScriptByPath cannot resolve.
+			if (isHubPath(path)) {
+				const hub = await ScriptService.getHubScriptByPath({ path })
+				return {
+					type: 'script',
+					path,
+					summary: hub.summary,
+					language: hub.language as ScriptLang,
+					value: hub.content,
+					schema: hub.schema,
+					isDraft: false
+				}
+			}
 			// Prefer the DB draft (newer than the deployed version) when one exists,
 			// unless the caller explicitly asked for the deployed state.
 			const script = await ScriptService.getScriptByPath({
@@ -2785,7 +2805,7 @@ export const globalTools: Tool<{}>[] = [
 				return JSON.stringify({ success: false, error: message })
 			}
 			const draft =
-				parsed.version === 'deployed'
+				parsed.version === 'deployed' || isHubPath(parsed.path)
 					? null
 					: await getGlobalDraft(workspace, parsed.type, parsed.path, parsed.trigger_kind)
 			if (draft) {
diff --git a/frontend/src/lib/components/copilot/chat/shared.test.ts b/frontend/src/lib/components/copilot/chat/shared.test.ts
index 473c3d3335..179742763f 100644
--- a/frontend/src/lib/components/copilot/chat/shared.test.ts
+++ b/frontend/src/lib/components/copilot/chat/shared.test.ts
@@ -1124,3 +1124,70 @@ describe('openItemPreviewAction', () => {
 		expect(openItemPreviewAction('raw_app', 'u/me/dash').label).toBe('Open app preview')
 	})
 })
+
+describe('createSearchHubScriptsTool', () => {
+	const hit = (version_id: number, app: string, summary: string) => ({
+		version_id,
+		app,
+		summary,
+		ask_id: version_id,
+		id: version_id,
+		kind: 'script' as const,
+		score: 1
+	})
+
+	async function runWithContent(getHubScriptByPath: ReturnType<typeof vi.fn>) {
+		const { ScriptService } = await import('$lib/gen')
+		Object.assign(ScriptService, {
+			queryHubScripts: vi.fn(async () => [
+				hit(1, 'discord', 'Send a message'),
+				hit(2, 'slack', 'Post a message')
+			]),
+			getHubScriptByPath
+		})
+		const { createSearchHubScriptsTool } = await import('./shared')
+		const raw = await createSearchHubScriptsTool(true).fn({
+			args: { query: 'send a message' },
+			toolId: 't1',
+			toolCallbacks: { setToolStatus: vi.fn() }
+		} as any)
+		return JSON.parse(raw)
+	}
+
+	it('reports each script language alongside its content', async () => {
+		const results = await runWithContent(
+			vi.fn(async ({ path }: { path: string }) => ({
+				content: `// ${path}`,
+				language: path.startsWith('hub/1/') ? 'bunnative' : 'python3'
+			}))
+		)
+
+		expect(results).toEqual([
+			{
+				path: 'hub/1/discord/send_a_message',
+				summary: 'Send a message',
+				language: 'bunnative',
+				content: '// hub/1/discord/send_a_message'
+			},
+			{
+				path: 'hub/2/slack/post_a_message',
+				summary: 'Post a message',
+				language: 'python3',
+				content: '// hub/2/slack/post_a_message'
+			}
+		])
+	})
+
+	it('keeps the other results when one content fetch fails', async () => {
+		const results = await runWithContent(
+			vi.fn(async ({ path }: { path: string }) => {
+				if (path.startsWith('hub/1/')) throw new Error('hub unreachable')
+				return { content: 'ok', language: 'python3' }
+			})
+		)
+
+		expect(results[0].error).toContain('hub unreachable')
+		expect(results[0].content).toBeUndefined()
+		expect(results[1].content).toBe('ok')
+	})
+})
diff --git a/frontend/src/lib/components/copilot/chat/shared.ts b/frontend/src/lib/components/copilot/chat/shared.ts
index dd602c640f..dcff212198 100644
--- a/frontend/src/lib/components/copilot/chat/shared.ts
+++ b/frontend/src/lib/components/copilot/chat/shared.ts
@@ -1130,6 +1130,18 @@ const searchHubScriptsToolDef = createToolDef(
 	'Search for scripts in the hub'
 )
 
+/** The hub resolves a script by its version id alone; the app and summary
+ * segments are descriptive only. Mirrors the paths the hub pickers build. */
+function hubScriptPath(s: { version_id: number; app: string; summary: string }): string {
+	return `hub/${s.version_id}/${s.app}/${s.summary.toLowerCase().replaceAll(/\s+/g, '_')}`
+}
+
+/** Hub scripts are hosted outside the workspace: their paths resolve through the
+ * hub endpoints only, never through workspace lookups or drafts. */
+export function isHubPath(path: string): boolean {
+	return path.startsWith('hub/')
+}
+
 export const createSearchHubScriptsTool = (withContent: boolean = false) => ({
 	def: searchHubScriptsToolDef,
 	fn: async ({ args, toolId, toolCallbacks }) => {
@@ -1141,22 +1153,29 @@ export const createSearchHubScriptsTool = (withContent: boolean = false) => ({
 			text: parsedArgs.query,
 			kind: 'script'
 		})
+		// Each result costs a content fetch, so cap the fan-out when content is wanted.
+		const matches = withContent ? scripts.slice(0, 3) : scripts
 		toolCallbacks.setToolStatus(toolId, {
-			content: 'Found ' + scripts.length + ' scripts in the hub related to "' + args.query + '"'
+			content: `Found ${matches.length} script${matches.length === 1 ? '' : 's'} in the hub related to "${parsedArgs.query}"`
 		})
-		// if withContent, fetch scripts with their content, limit to 3 results
 		const results = await Promise.all(
-			scripts.slice(0, withContent ? 3 : undefined).map(async (s) => {
-				let content = ''
-				if (withContent) {
-					content = await ScriptService.getHubScriptContentByPath({
-						path: `hub/${s.version_id}/${s.app}/${s.summary.toLowerCase().replaceAll(/\s+/g, '_')}`
-					})
+			matches.map(async (s) => {
+				const path = hubScriptPath(s)
+				if (!withContent) {
+					return { path, summary: s.summary }
 				}
-				return {
-					path: `hub/${s.version_id}/${s.app}/${s.summary.toLowerCase().replaceAll(/\s+/g, '_')}`,
-					summary: s.summary,
-					...(withContent ? { content } : {})
+				try {
+					// get_full, not the raw content endpoint: callers are told to match the
+					// script's language, which raw content does not carry.
+					const hub = await ScriptService.getHubScriptByPath({ path })
+					return { path, summary: s.summary, language: hub.language, content: hub.content }
+				} catch (err) {
+					// One unreachable script must not sink the whole search.
+					return {
+						path,
+						summary: s.summary,
+						error: `Could not fetch content: ${err instanceof Error ? err.message : String(err)}`
+					}
 				}
 			})
 		)

From c12e7c34310b417e89f94efc3c412b3c7278344b Mon Sep 17 00:00:00 2001
From: Guilhem <guilhemlemouel@gmail.com>
Date: Tue, 28 Jul 2026 14:35:24 +0200
Subject: [PATCH 05/24] feat(ai-chat): add get_flow_run_details tool for
 per-step flow run results (#10374)

* feat(ai-chat): add get_flow_run_details tool for per-step flow run results

* fix(ai-chat): report flow step retries as attempts, not loop iterations

* fix(ai-chat): scope-tag flow tree descendants, cap entries, fix labels

* fix(ai-chat): cap rows pre-join, signal tag scoping, code-point slicing

* fix(ai-chat): authoritative sibling order + pinned flow_version lookup

* fix(ai-chat): decorrelate drill ordinal join, cap step diagnostics
---
 ...e8e849e56f8db795df2ad4d907cdb3c9fce60.json |  24 +
 ...cc8b68627c8ed9a6da969674734854ef2742a.json |  37 +
 ...a00a6539788f9be647d6b52f01cbb2967473e.json |  83 --
 ...16ac71390028dfe8c54798b1701b01591fff7.json |  66 ++
 ...d7190324533119792b650c6db734a3b99575c.json |  84 ++
 ...53d23ec2af084b2f93da24c920532c1916384.json | 110 +++
 ...b58fbce8c09e6ec8172d9ed94716958a29b40.json |  30 +
 backend/windmill-api/openapi.yaml             | 110 +++
 backend/windmill-api/src/jobs.rs              | 883 ++++++++++++++++--
 .../components/copilot/chat/global/core.ts    |  38 +-
 .../copilot/chat/global/flowRunTree.test.ts   | 193 ++++
 .../copilot/chat/global/flowRunTree.ts        | 313 +++++++
 .../src/lib/components/copilot/chat/shared.ts |  17 +-
 13 files changed, 1822 insertions(+), 166 deletions(-)
 create mode 100644 backend/.sqlx/query-2ef832a6d8e9feb83de6706b0ffe8e849e56f8db795df2ad4d907cdb3c9fce60.json
 create mode 100644 backend/.sqlx/query-48c2eeca50aedc1895256f615aecc8b68627c8ed9a6da969674734854ef2742a.json
 delete mode 100644 backend/.sqlx/query-5b95f464d492227ffe8a449844da00a6539788f9be647d6b52f01cbb2967473e.json
 create mode 100644 backend/.sqlx/query-6981553b904f9ae38d6eaeae05716ac71390028dfe8c54798b1701b01591fff7.json
 create mode 100644 backend/.sqlx/query-94f0e271a67179c78de217ae1f4d7190324533119792b650c6db734a3b99575c.json
 create mode 100644 backend/.sqlx/query-b8e732a03969666444f73397ac153d23ec2af084b2f93da24c920532c1916384.json
 create mode 100644 backend/.sqlx/query-bd594f06413dd21d7e6923e6754b58fbce8c09e6ec8172d9ed94716958a29b40.json
 create mode 100644 frontend/src/lib/components/copilot/chat/global/flowRunTree.test.ts
 create mode 100644 frontend/src/lib/components/copilot/chat/global/flowRunTree.ts

diff --git a/backend/.sqlx/query-2ef832a6d8e9feb83de6706b0ffe8e849e56f8db795df2ad4d907cdb3c9fce60.json b/backend/.sqlx/query-2ef832a6d8e9feb83de6706b0ffe8e849e56f8db795df2ad4d907cdb3c9fce60.json
new file mode 100644
index 0000000000..183c620240
--- /dev/null
+++ b/backend/.sqlx/query-2ef832a6d8e9feb83de6706b0ffe8e849e56f8db795df2ad4d907cdb3c9fce60.json
@@ -0,0 +1,24 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT DISTINCT flow_step_id as \"flow_step_id!\" FROM v2_job\n                 WHERE parent_job = $1 AND workspace_id = $2 AND flow_step_id IS NOT NULL\n                   AND ($3::text[] IS NULL OR tag = ANY($3))\n                 ORDER BY flow_step_id",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "flow_step_id!",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Text",
+        "TextArray"
+      ]
+    },
+    "nullable": [
+      true
+    ]
+  },
+  "hash": "2ef832a6d8e9feb83de6706b0ffe8e849e56f8db795df2ad4d907cdb3c9fce60"
+}
diff --git a/backend/.sqlx/query-48c2eeca50aedc1895256f615aecc8b68627c8ed9a6da969674734854ef2742a.json b/backend/.sqlx/query-48c2eeca50aedc1895256f615aecc8b68627c8ed9a6da969674734854ef2742a.json
new file mode 100644
index 0000000000..93b908a567
--- /dev/null
+++ b/backend/.sqlx/query-48c2eeca50aedc1895256f615aecc8b68627c8ed9a6da969674734854ef2742a.json
@@ -0,0 +1,37 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT j.id,\n                    COALESCE(c.status::text,\n                             CASE WHEN q.running AND q.suspend > 0 THEN 'suspended'\n                                  WHEN q.running THEN 'running'\n                                  ELSE 'queued' END) as \"status!\",\n                    COALESCE((\n                        SELECT m->'value'->>'type'\n                        FROM v2_job parent_j\n                        LEFT JOIN flow_version fv ON fv.id = parent_j.runnable_id\n                            AND parent_j.kind::text = 'flow'\n                        LEFT JOIN flow f ON f.path = parent_j.runnable_path\n                            AND f.workspace_id = parent_j.workspace_id\n                        LEFT JOIN flow_node fn ON fn.id = parent_j.runnable_id\n                        CROSS JOIN LATERAL jsonb_array_elements(\n                            COALESCE(parent_j.raw_flow, fv.value, f.value, fn.flow)->'modules'\n                        ) m\n                        WHERE parent_j.id = $1\n                          AND m->>'id' = $3\n                        LIMIT 1\n                    ), '')::text as \"parent_module_type!\"\n             FROM v2_job j\n             LEFT JOIN v2_job_completed c ON c.id = j.id\n             LEFT JOIN v2_job_queue q ON q.id = j.id\n             LEFT JOIN (\n                 SELECT fj.jid, fj.ord\n                 FROM (SELECT COALESCE(\n                         (SELECT flow_status FROM v2_job_completed WHERE id = $1),\n                         (SELECT flow_status FROM v2_job_status WHERE id = $1)\n                     ) AS fs) pf\n                 CROSS JOIN LATERAL (\n                     SELECT m FROM jsonb_array_elements(pf.fs->'modules') m\n                     WHERE m->>'id' = $3\n                     LIMIT 1\n                 ) md\n                 CROSS JOIN LATERAL jsonb_array_elements_text(md.m->'flow_jobs')\n                     WITH ORDINALITY fj(jid, ord)\n             ) pos ON pos.jid = j.id::text\n             WHERE j.parent_job = $1 AND j.workspace_id = $2 AND j.flow_step_id = $3\n               AND ($4::text[] IS NULL OR j.tag = ANY($4))\n             ORDER BY pos.ord NULLS LAST, j.id",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Uuid"
+      },
+      {
+        "ordinal": 1,
+        "name": "status!",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 2,
+        "name": "parent_module_type!",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Text",
+        "Text",
+        "TextArray"
+      ]
+    },
+    "nullable": [
+      false,
+      null,
+      null
+    ]
+  },
+  "hash": "48c2eeca50aedc1895256f615aecc8b68627c8ed9a6da969674734854ef2742a"
+}
diff --git a/backend/.sqlx/query-5b95f464d492227ffe8a449844da00a6539788f9be647d6b52f01cbb2967473e.json b/backend/.sqlx/query-5b95f464d492227ffe8a449844da00a6539788f9be647d6b52f01cbb2967473e.json
deleted file mode 100644
index 3b1d7fae8c..0000000000
--- a/backend/.sqlx/query-5b95f464d492227ffe8a449844da00a6539788f9be647d6b52f01cbb2967473e.json
+++ /dev/null
@@ -1,83 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "WITH RECURSIVE job_tree AS (\n            SELECT j.id, j.kind::text, j.flow_step_id, j.parent_job,\n                   '' as path_label, 0 as depth,\n                   j.id::text as id_path,\n                   ''::text as parent_module_type\n            FROM v2_job j\n            WHERE j.id = $2 AND j.workspace_id = $1\n            UNION ALL\n            SELECT j.id, j.kind::text, j.flow_step_id, j.parent_job,\n                   CASE\n                       WHEN jt.path_label = '' THEN COALESCE(j.flow_step_id, '')\n                       ELSE jt.path_label || '/' || COALESCE(j.flow_step_id, '')\n                   END,\n                   jt.depth + 1,\n                   jt.id_path || '/' || j.id::text,\n                   COALESCE((\n                       SELECT m->'value'->>'type'\n                       FROM v2_job parent_j\n                       LEFT JOIN flow f ON f.path = parent_j.runnable_path\n                           AND f.workspace_id = parent_j.workspace_id\n                       LEFT JOIN flow_node fn ON fn.id = parent_j.runnable_id\n                       CROSS JOIN LATERAL jsonb_array_elements(\n                           COALESCE(parent_j.raw_flow, f.value, fn.flow)->'modules'\n                       ) m\n                       WHERE parent_j.id = jt.id\n                         AND m->>'id' = j.flow_step_id\n                       LIMIT 1\n                   ), '')::text\n            FROM v2_job j\n            JOIN job_tree jt ON j.parent_job = jt.id\n            WHERE j.workspace_id = $1\n        ),\n        with_sibling_index AS (\n            SELECT jt.*,\n                   ROW_NUMBER() OVER (\n                       PARTITION BY jt.parent_job, jt.flow_step_id\n                       ORDER BY jt.id\n                   ) as sibling_index,\n                   COUNT(*) OVER (\n                       PARTITION BY jt.parent_job, jt.flow_step_id\n                   ) as sibling_count\n            FROM job_tree jt\n        )\n        SELECT w.id, w.kind, w.flow_step_id, w.path_label,\n               w.sibling_index::int as sibling_index,\n               w.sibling_count::int as sibling_count,\n               w.depth::int as depth,\n               w.parent_module_type,\n               coalesce(job_logs.logs, '') as logs,\n               COALESCE(job_logs.log_offset, 0) as log_offset,\n               job_logs.log_file_index\n        FROM with_sibling_index w\n        LEFT JOIN job_logs ON job_logs.job_id = w.id\n        ORDER BY w.id_path ASC",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "id",
-        "type_info": "Uuid"
-      },
-      {
-        "ordinal": 1,
-        "name": "kind",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 2,
-        "name": "flow_step_id",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 3,
-        "name": "path_label",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 4,
-        "name": "sibling_index",
-        "type_info": "Int4"
-      },
-      {
-        "ordinal": 5,
-        "name": "sibling_count",
-        "type_info": "Int4"
-      },
-      {
-        "ordinal": 6,
-        "name": "depth",
-        "type_info": "Int4"
-      },
-      {
-        "ordinal": 7,
-        "name": "parent_module_type",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 8,
-        "name": "logs",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 9,
-        "name": "log_offset",
-        "type_info": "Int4"
-      },
-      {
-        "ordinal": 10,
-        "name": "log_file_index",
-        "type_info": "TextArray"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Uuid"
-      ]
-    },
-    "nullable": [
-      null,
-      null,
-      null,
-      null,
-      null,
-      null,
-      null,
-      null,
-      null,
-      null,
-      true
-    ]
-  },
-  "hash": "5b95f464d492227ffe8a449844da00a6539788f9be647d6b52f01cbb2967473e"
-}
diff --git a/backend/.sqlx/query-6981553b904f9ae38d6eaeae05716ac71390028dfe8c54798b1701b01591fff7.json b/backend/.sqlx/query-6981553b904f9ae38d6eaeae05716ac71390028dfe8c54798b1701b01591fff7.json
new file mode 100644
index 0000000000..1a965a6dc3
--- /dev/null
+++ b/backend/.sqlx/query-6981553b904f9ae38d6eaeae05716ac71390028dfe8c54798b1701b01591fff7.json
@@ -0,0 +1,66 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT j.kind::text as kind,\n                    c.status::text as completed_status,\n                    c.duration_ms as \"duration_ms?\",\n                    COALESCE(c.started_at, q.started_at) as started_at,\n                    LEFT(c.result::text, $3) as result_prefix,\n                    length(c.result::text) as result_length,\n                    q.running as \"q_running?\",\n                    q.suspend as \"q_suspend?\"\n             FROM v2_job j\n             LEFT JOIN v2_job_completed c ON c.id = j.id\n             LEFT JOIN v2_job_queue q ON q.id = j.id\n             WHERE j.id = $1 AND j.workspace_id = $2",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "kind",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 1,
+        "name": "completed_status",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 2,
+        "name": "duration_ms?",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 3,
+        "name": "started_at",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 4,
+        "name": "result_prefix",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 5,
+        "name": "result_length",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 6,
+        "name": "q_running?",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 7,
+        "name": "q_suspend?",
+        "type_info": "Int4"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Text",
+        "Int4"
+      ]
+    },
+    "nullable": [
+      null,
+      null,
+      false,
+      null,
+      null,
+      null,
+      false,
+      false
+    ]
+  },
+  "hash": "6981553b904f9ae38d6eaeae05716ac71390028dfe8c54798b1701b01591fff7"
+}
diff --git a/backend/.sqlx/query-94f0e271a67179c78de217ae1f4d7190324533119792b650c6db734a3b99575c.json b/backend/.sqlx/query-94f0e271a67179c78de217ae1f4d7190324533119792b650c6db734a3b99575c.json
new file mode 100644
index 0000000000..c284efca75
--- /dev/null
+++ b/backend/.sqlx/query-94f0e271a67179c78de217ae1f4d7190324533119792b650c6db734a3b99575c.json
@@ -0,0 +1,84 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "WITH RECURSIVE job_tree AS (\n            SELECT j.id, j.kind::text, j.flow_step_id, j.parent_job,\n                   '' as path_label, 0 as depth,\n                   j.id::text as id_path,\n                   ''::text as parent_module_type\n            FROM v2_job j\n            WHERE j.id = $2 AND j.workspace_id = $1\n            UNION ALL\n            SELECT j.id, j.kind::text, j.flow_step_id, j.parent_job,\n                   CASE\n                       WHEN jt.path_label = '' THEN COALESCE(j.flow_step_id, '')\n                       ELSE jt.path_label || '/' || COALESCE(j.flow_step_id, '')\n                   END,\n                   jt.depth + 1,\n                   jt.id_path || '/' || j.id::text,\n                   COALESCE((\n                       SELECT m->'value'->>'type'\n                       FROM v2_job parent_j\n                       LEFT JOIN flow_version fv ON fv.id = parent_j.runnable_id\n                           AND parent_j.kind::text = 'flow'\n                       LEFT JOIN flow f ON f.path = parent_j.runnable_path\n                           AND f.workspace_id = parent_j.workspace_id\n                       LEFT JOIN flow_node fn ON fn.id = parent_j.runnable_id\n                       CROSS JOIN LATERAL jsonb_array_elements(\n                           COALESCE(parent_j.raw_flow, fv.value, f.value, fn.flow)->'modules'\n                       ) m\n                       WHERE parent_j.id = jt.id\n                         AND m->>'id' = j.flow_step_id\n                       LIMIT 1\n                   ), '')::text\n            FROM v2_job j\n            JOIN job_tree jt ON j.parent_job = jt.id\n            WHERE j.workspace_id = $1\n              AND ($3::text[] IS NULL OR j.tag = ANY($3))\n        ),\n        positions AS (\n            SELECT g.parent_job, g.flow_step_id, fj.jid, fj.ord\n            FROM (SELECT DISTINCT parent_job, flow_step_id FROM job_tree\n                  WHERE parent_job IS NOT NULL AND flow_step_id IS NOT NULL) g\n            CROSS JOIN LATERAL (\n                SELECT COALESCE(\n                    (SELECT flow_status FROM v2_job_completed WHERE id = g.parent_job),\n                    (SELECT flow_status FROM v2_job_status WHERE id = g.parent_job)\n                ) AS fs\n            ) pf\n            CROSS JOIN LATERAL (\n                SELECT m FROM jsonb_array_elements(pf.fs->'modules') m\n                WHERE m->>'id' = g.flow_step_id\n                LIMIT 1\n            ) md\n            CROSS JOIN LATERAL jsonb_array_elements_text(md.m->'flow_jobs')\n                WITH ORDINALITY fj(jid, ord)\n        ),\n        with_sibling_index AS (\n            SELECT jt.*,\n                   ROW_NUMBER() OVER (\n                       PARTITION BY jt.parent_job, jt.flow_step_id\n                       ORDER BY pos.ord NULLS LAST, jt.id\n                   ) as sibling_index,\n                   COUNT(*) OVER (\n                       PARTITION BY jt.parent_job, jt.flow_step_id\n                   ) as sibling_count\n            FROM job_tree jt\n            LEFT JOIN positions pos ON pos.parent_job = jt.parent_job\n                AND pos.flow_step_id = jt.flow_step_id\n                AND pos.jid = jt.id::text\n        )\n        SELECT w.id, w.kind, w.flow_step_id, w.path_label,\n               w.sibling_index::int as sibling_index,\n               w.sibling_count::int as sibling_count,\n               w.depth::int as depth,\n               w.parent_module_type,\n               coalesce(job_logs.logs, '') as logs,\n               COALESCE(job_logs.log_offset, 0) as log_offset,\n               job_logs.log_file_index\n        FROM with_sibling_index w\n        LEFT JOIN job_logs ON job_logs.job_id = w.id\n        ORDER BY w.id_path ASC",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Uuid"
+      },
+      {
+        "ordinal": 1,
+        "name": "kind",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 2,
+        "name": "flow_step_id",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 3,
+        "name": "path_label",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 4,
+        "name": "sibling_index",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 5,
+        "name": "sibling_count",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 6,
+        "name": "depth",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 7,
+        "name": "parent_module_type",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 8,
+        "name": "logs",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 9,
+        "name": "log_offset",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 10,
+        "name": "log_file_index",
+        "type_info": "TextArray"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Uuid",
+        "TextArray"
+      ]
+    },
+    "nullable": [
+      null,
+      null,
+      null,
+      null,
+      null,
+      null,
+      null,
+      null,
+      null,
+      null,
+      true
+    ]
+  },
+  "hash": "94f0e271a67179c78de217ae1f4d7190324533119792b650c6db734a3b99575c"
+}
diff --git a/backend/.sqlx/query-b8e732a03969666444f73397ac153d23ec2af084b2f93da24c920532c1916384.json b/backend/.sqlx/query-b8e732a03969666444f73397ac153d23ec2af084b2f93da24c920532c1916384.json
new file mode 100644
index 0000000000..b892061f56
--- /dev/null
+++ b/backend/.sqlx/query-b8e732a03969666444f73397ac153d23ec2af084b2f93da24c920532c1916384.json
@@ -0,0 +1,110 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "WITH RECURSIVE job_tree AS (\n            SELECT j.id, j.kind::text, j.flow_step_id, j.parent_job,\n                   '' as path_label, 0 as depth,\n                   j.id::text as id_path,\n                   ''::text as parent_module_type\n            FROM v2_job j\n            WHERE j.id = $2 AND j.workspace_id = $1\n            UNION ALL\n            SELECT j.id, j.kind::text, j.flow_step_id, j.parent_job,\n                   CASE\n                       WHEN jt.path_label = '' THEN COALESCE(j.flow_step_id, '')\n                       ELSE jt.path_label || '/' || COALESCE(j.flow_step_id, '')\n                   END,\n                   jt.depth + 1,\n                   jt.id_path || '/' || j.id::text,\n                   COALESCE((\n                       SELECT m->'value'->>'type'\n                       FROM v2_job parent_j\n                       LEFT JOIN flow_version fv ON fv.id = parent_j.runnable_id\n                           AND parent_j.kind::text = 'flow'\n                       LEFT JOIN flow f ON f.path = parent_j.runnable_path\n                           AND f.workspace_id = parent_j.workspace_id\n                       LEFT JOIN flow_node fn ON fn.id = parent_j.runnable_id\n                       CROSS JOIN LATERAL jsonb_array_elements(\n                           COALESCE(parent_j.raw_flow, fv.value, f.value, fn.flow)->'modules'\n                       ) m\n                       WHERE parent_j.id = jt.id\n                         AND m->>'id' = j.flow_step_id\n                       LIMIT 1\n                   ), '')::text\n            FROM v2_job j\n            JOIN job_tree jt ON j.parent_job = jt.id\n            WHERE j.workspace_id = $1\n              AND ($4::text[] IS NULL OR j.tag = ANY($4))\n        ),\n        positions AS (\n            SELECT g.parent_job, g.flow_step_id, fj.jid, fj.ord\n            FROM (SELECT DISTINCT parent_job, flow_step_id FROM job_tree\n                  WHERE parent_job IS NOT NULL AND flow_step_id IS NOT NULL) g\n            CROSS JOIN LATERAL (\n                SELECT COALESCE(\n                    (SELECT flow_status FROM v2_job_completed WHERE id = g.parent_job),\n                    (SELECT flow_status FROM v2_job_status WHERE id = g.parent_job)\n                ) AS fs\n            ) pf\n            CROSS JOIN LATERAL (\n                SELECT m FROM jsonb_array_elements(pf.fs->'modules') m\n                WHERE m->>'id' = g.flow_step_id\n                LIMIT 1\n            ) md\n            CROSS JOIN LATERAL jsonb_array_elements_text(md.m->'flow_jobs')\n                WITH ORDINALITY fj(jid, ord)\n        ),\n        with_sibling_index AS (\n            SELECT jt.*,\n                   ROW_NUMBER() OVER (\n                       PARTITION BY jt.parent_job, jt.flow_step_id\n                       ORDER BY pos.ord NULLS LAST, jt.id\n                   ) as sibling_index,\n                   COUNT(*) OVER (\n                       PARTITION BY jt.parent_job, jt.flow_step_id\n                   ) as sibling_count\n            FROM job_tree jt\n            LEFT JOIN positions pos ON pos.parent_job = jt.parent_job\n                AND pos.flow_step_id = jt.flow_step_id\n                AND pos.jid = jt.id::text\n        ),\n        limited AS (\n            SELECT * FROM with_sibling_index ORDER BY id_path ASC LIMIT $5\n        )\n        SELECT w.id, w.kind, w.flow_step_id, w.path_label,\n               w.sibling_index::int as sibling_index,\n               w.sibling_count::int as sibling_count,\n               w.depth::int as depth,\n               w.parent_module_type,\n               c.status::text as completed_status,\n               c.duration_ms as \"duration_ms?\",\n               COALESCE(c.started_at, q.started_at) as started_at,\n               LEFT(c.result::text, $3) as result_prefix,\n               length(c.result::text) as result_length,\n               q.running as \"q_running?\",\n               q.suspend as \"q_suspend?\"\n        FROM limited w\n        LEFT JOIN v2_job_completed c ON c.id = w.id\n        LEFT JOIN v2_job_queue q ON q.id = w.id\n        ORDER BY w.id_path ASC",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Uuid"
+      },
+      {
+        "ordinal": 1,
+        "name": "kind",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 2,
+        "name": "flow_step_id",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 3,
+        "name": "path_label",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 4,
+        "name": "sibling_index",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 5,
+        "name": "sibling_count",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 6,
+        "name": "depth",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 7,
+        "name": "parent_module_type",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 8,
+        "name": "completed_status",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 9,
+        "name": "duration_ms?",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 10,
+        "name": "started_at",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 11,
+        "name": "result_prefix",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 12,
+        "name": "result_length",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 13,
+        "name": "q_running?",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 14,
+        "name": "q_suspend?",
+        "type_info": "Int4"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Uuid",
+        "Int4",
+        "TextArray",
+        "Int8"
+      ]
+    },
+    "nullable": [
+      null,
+      null,
+      null,
+      null,
+      null,
+      null,
+      null,
+      null,
+      null,
+      false,
+      null,
+      null,
+      null,
+      false,
+      false
+    ]
+  },
+  "hash": "b8e732a03969666444f73397ac153d23ec2af084b2f93da24c920532c1916384"
+}
diff --git a/backend/.sqlx/query-bd594f06413dd21d7e6923e6754b58fbce8c09e6ec8172d9ed94716958a29b40.json b/backend/.sqlx/query-bd594f06413dd21d7e6923e6754b58fbce8c09e6ec8172d9ed94716958a29b40.json
new file mode 100644
index 0000000000..5e9e4bfa6e
--- /dev/null
+++ b/backend/.sqlx/query-bd594f06413dd21d7e6923e6754b58fbce8c09e6ec8172d9ed94716958a29b40.json
@@ -0,0 +1,30 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT created_by, COALESCE(flow_innermost_root_job, parent_job) as enclosing_job FROM v2_job WHERE id = $1 AND workspace_id = $2 AND ($3::text[] IS NULL OR tag = ANY($3))",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "created_by",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "enclosing_job",
+        "type_info": "Uuid"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Text",
+        "TextArray"
+      ]
+    },
+    "nullable": [
+      false,
+      null
+    ]
+  },
+  "hash": "bd594f06413dd21d7e6923e6754b58fbce8c09e6ec8172d9ed94716958a29b40"
+}
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 1dd692752f..c60a3eb777 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -14258,6 +14258,116 @@ paths:
                     - sibling_count
                     - logs
 
+  /w/{workspace}/jobs_u/get_flow_all_results/{id}:
+    get:
+      summary: get statuses and truncated results for all jobs of a flow job's execution tree
+      operationId: getFlowAllResults
+      tags:
+        - job
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - $ref: "#/components/parameters/JobId"
+        - name: max_result_len
+          in: query
+          description: per-entry cap (in characters of JSON text) on result_prefix (default 2000, max 30000)
+          schema:
+            type: integer
+        - name: step
+          in: query
+          description: 'step address to resolve to a single job instead of enumerating the tree: "b", "b/c", "b[12]" (1-based iteration/branch), composable as "b[12]/c"'
+          schema:
+            type: string
+      responses:
+        "200":
+          description: per-job statuses and truncated results of the flow's execution tree, or the single resolved entry when step is provided
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  enclosing_job:
+                    type: string
+                    format: uuid
+                    description: set when the requested job is itself a step of a larger flow run; id of the flow run directly enclosing it
+                  entries:
+                    type: array
+                    items:
+                      type: object
+                      properties:
+                        job_id:
+                          type: string
+                        label:
+                          type: string
+                          description: human-readable label describing the job's position in the flow tree
+                        kind:
+                          type: string
+                          description: job kind (script, flow, forloopflow, ...)
+                        flow_step_id:
+                          type: string
+                          nullable: true
+                        step_path:
+                          type: string
+                          nullable: true
+                          description: materialized step path (e.g. "a/b")
+                        depth:
+                          type: integer
+                          description: depth in the flow tree (0 for the root flow job)
+                        parent_module_type:
+                          type: string
+                          nullable: true
+                          description: parent module type (forloopflow, branchall, ...)
+                        sibling_index:
+                          type: integer
+                          description: 1-based index of this job among siblings sharing the same step
+                        sibling_count:
+                          type: integer
+                          description: total number of siblings sharing the same step
+                        status:
+                          type: string
+                          enum:
+                            [
+                              success,
+                              failure,
+                              canceled,
+                              skipped,
+                              suspended,
+                              running,
+                              queued,
+                            ]
+                        success:
+                          type: boolean
+                        duration_ms:
+                          type: integer
+                          format: int64
+                        started_at:
+                          type: string
+                          format: date-time
+                        result_prefix:
+                          type: string
+                          description: result JSON text truncated to the per-entry budget; absent until the job has completed
+                        result_length:
+                          type: integer
+                          description: full length in characters of the result JSON text (greater than the prefix length when truncated)
+                      required:
+                        - job_id
+                        - label
+                        - kind
+                        - depth
+                        - sibling_index
+                        - sibling_count
+                        - status
+                  truncated:
+                    type: boolean
+                    description: true when the tree has more jobs than the entry cap; entries then hold the depth-first prefix
+                  scope_filtered:
+                    type: boolean
+                    description: true when the caller's token is tag-scoped; steps running on other tags are omitted
+                  step_error:
+                    type: string
+                    description: set when step was provided but could not be resolved; a diagnostic listing available step ids or iteration statuses
+                required:
+                  - entries
+
   /w/{workspace}/jobs_u/get_completed_logs_tail/{id}:
     get:
       summary: get completed job logs tail
diff --git a/backend/windmill-api/src/jobs.rs b/backend/windmill-api/src/jobs.rs
index 663f65ca6f..3621ea0564 100644
--- a/backend/windmill-api/src/jobs.rs
+++ b/backend/windmill-api/src/jobs.rs
@@ -406,6 +406,7 @@ pub fn workspace_unauthed_service() -> Router {
             "/get_flow_all_logs_structured/{id}",
             get(get_flow_all_logs_structured),
         )
+        .route("/get_flow_all_results/{id}", get(get_flow_all_results))
         .route(
             "/get_completed_logs_tail/{id}",
             get(get_completed_job_logs_tail),
@@ -2269,48 +2270,35 @@ async fn resolve_logs_to_string(
     logs.to_string()
 }
 
-/// A single job in a flow's execution tree, with its resolved logs and a
-/// human-readable label describing its position (iteration, branch, subflow…).
-#[derive(Serialize)]
-struct FlowLogEntry {
-    job_id: String,
-    /// Human-readable label, e.g. "Step a (iteration 2/3)" or "Flow".
-    label: String,
-    /// Job kind (script, flow, forloopflow, …).
-    kind: String,
-    /// The flow step id this job corresponds to, if any.
-    flow_step_id: Option<String>,
-    /// Materialized step path (e.g. "a/b") used to locate the step in the flow.
-    step_path: Option<String>,
-    /// Depth in the flow tree (0 for the root flow job).
-    depth: i32,
-    /// The parent module type (forloopflow, branchall, …), if any.
-    parent_module_type: Option<String>,
-    /// 1-based index of this job among its siblings sharing the same step.
-    sibling_index: i32,
-    /// Total number of siblings sharing the same step.
-    sibling_count: i32,
-    /// Resolved logs for this job (pulled from disk/object store as needed).
-    logs: String,
+struct FlowTreeReadAuth {
+    /// Enclosing flow job id when the requested job is itself a step of a
+    /// larger flow run (flow_innermost_root_job is NULL on subflow jobs —
+    /// parent_job covers them).
+    enclosing_job: Option<Uuid>,
+    /// Scope tags of the caller's token, to re-apply on every descendant query
+    /// (child jobs of a `preserve_step_tags` flow can run on other tags).
+    scope_tags: Option<Vec<String>>,
 }
 
-async fn collect_flow_log_entries(
+/// Shared preamble of the flow-tree endpoints (`get_flow_all_logs*`,
+/// `get_flow_all_results`): verifies the job exists (scope-tag filtered),
+/// checks read access, and records the view.
+async fn authorize_flow_tree_read(
     view_token: Option<String>,
-    opt_authed: Option<ApiAuthed>,
-    opt_tokened: OptTokened,
+    opt_authed: &Option<ApiAuthed>,
+    opt_tokened: &OptTokened,
     db: &DB,
     user_db: &UserDB,
     w_id: &str,
     id: Uuid,
-) -> error::Result<Vec<FlowLogEntry>> {
+) -> error::Result<FlowTreeReadAuth> {
     let tags = opt_authed
         .as_ref()
         .map(|authed| get_scope_tags(authed).map(|v| v.iter().map(|s| s.to_string()).collect_vec()))
         .flatten();
 
-    // Verify the root job exists and check auth
     let root_job = sqlx::query!(
-        "SELECT created_by FROM v2_job WHERE id = $1 AND workspace_id = $2 AND ($3::text[] IS NULL OR tag = ANY($3))",
+        "SELECT created_by, COALESCE(flow_innermost_root_job, parent_job) as enclosing_job FROM v2_job WHERE id = $1 AND workspace_id = $2 AND ($3::text[] IS NULL OR tag = ANY($3))",
         id,
         w_id,
         tags.as_ref().map(|v| v.as_slice())
@@ -2346,6 +2334,128 @@ async fn collect_flow_log_entries(
     )
     .await?;
 
+    Ok(FlowTreeReadAuth {
+        enclosing_job: root_job.enclosing_job.filter(|r| *r != id),
+        scope_tags: tags,
+    })
+}
+
+/// Human-readable label for a job's position in a flow's execution tree,
+/// e.g. "Flow", "Step a (iteration 2/3)", "Step b (subflow)".
+fn flow_tree_entry_label(
+    kind: &str,
+    path: &str,
+    parent_module_type: &str,
+    sibling_index: i32,
+    sibling_count: i32,
+    depth: i32,
+) -> String {
+    let kind_label = match parent_module_type {
+        "branchall" => " branchall",
+        "branchone" => " branchone",
+        "forloopflow" => " forloop",
+        "whileloopflow" => " whileloop",
+        "aiagent" => " ai-agent",
+        _ => "",
+    };
+
+    // Only a known non-fan-out parent module marks siblings as retry attempts;
+    // an unresolved type ("" — e.g. the flow was edited since the run) keeps
+    // the generic iteration wording, matching resolve_flow_step_job and the
+    // frontend's FAN_OUT_MODULE_TYPES check.
+    let attempt_like = !parent_module_type.is_empty() && !is_fan_out_module(parent_module_type);
+
+    if depth == 0 {
+        "Flow".to_string()
+    } else if matches!(
+        kind,
+        "flow" | "flowpreview" | "flownode" | "singlestepflow" | "aiagent"
+    ) {
+        // Intermediate flow job (loop iteration or branch)
+        if parent_module_type == "branchone" {
+            // sibling_index is a row number among sibling jobs, not the chosen
+            // branch (branchone only enqueues the branch it selected) — don't
+            // pretend to know which branch ran.
+            format!("Step {}{} (selected branch)", path, kind_label)
+        } else if parent_module_type == "branchall" {
+            format!("Step {}{} (branch {})", path, kind_label, sibling_index)
+        } else if parent_module_type == "forloopflow" || parent_module_type == "whileloopflow" {
+            format!(
+                "Step {}{} (iteration {}/{})",
+                path, kind_label, sibling_index, sibling_count
+            )
+        } else if sibling_count > 1 {
+            if attempt_like {
+                format!(
+                    "Step {} (attempt {}/{})",
+                    path, sibling_index, sibling_count
+                )
+            } else {
+                format!(
+                    "Step {}{} (iteration {}/{})",
+                    path, kind_label, sibling_index, sibling_count
+                )
+            }
+        } else {
+            format!("Step {} (subflow)", path)
+        }
+    } else if sibling_count > 1 {
+        if attempt_like {
+            format!(
+                "Step {} (attempt {}/{})",
+                path, sibling_index, sibling_count
+            )
+        } else {
+            // Simple module optimization: forloop/whileloop with single step
+            // runs iterations as direct script jobs instead of subflows
+            format!(
+                "Step {}{} (iteration {}/{})",
+                path, kind_label, sibling_index, sibling_count
+            )
+        }
+    } else {
+        format!("Step {}", path)
+    }
+}
+
+/// A single job in a flow's execution tree, with its resolved logs and a
+/// human-readable label describing its position (iteration, branch, subflow…).
+#[derive(Serialize)]
+struct FlowLogEntry {
+    job_id: String,
+    /// Human-readable label, e.g. "Step a (iteration 2/3)" or "Flow".
+    label: String,
+    /// Job kind (script, flow, forloopflow, …).
+    kind: String,
+    /// The flow step id this job corresponds to, if any.
+    flow_step_id: Option<String>,
+    /// Materialized step path (e.g. "a/b") used to locate the step in the flow.
+    step_path: Option<String>,
+    /// Depth in the flow tree (0 for the root flow job).
+    depth: i32,
+    /// The parent module type (forloopflow, branchall, …), if any.
+    parent_module_type: Option<String>,
+    /// 1-based index of this job among its siblings sharing the same step.
+    sibling_index: i32,
+    /// Total number of siblings sharing the same step.
+    sibling_count: i32,
+    /// Resolved logs for this job (pulled from disk/object store as needed).
+    logs: String,
+}
+
+async fn collect_flow_log_entries(
+    view_token: Option<String>,
+    opt_authed: Option<ApiAuthed>,
+    opt_tokened: OptTokened,
+    db: &DB,
+    user_db: &UserDB,
+    w_id: &str,
+    id: Uuid,
+) -> error::Result<Vec<FlowLogEntry>> {
+    let auth =
+        authorize_flow_tree_read(view_token, &opt_authed, &opt_tokened, db, user_db, w_id, id)
+            .await?;
+
     // Fetch all jobs in the flow tree using recursive CTE.
     // Uses a materialized id_path for depth-first ordering so children
     // appear right after their parent (e.g. iteration 1 → its steps → iteration 2 → ...).
@@ -2369,11 +2479,13 @@ async fn collect_flow_log_entries(
                    COALESCE((
                        SELECT m->'value'->>'type'
                        FROM v2_job parent_j
+                       LEFT JOIN flow_version fv ON fv.id = parent_j.runnable_id
+                           AND parent_j.kind::text = 'flow'
                        LEFT JOIN flow f ON f.path = parent_j.runnable_path
                            AND f.workspace_id = parent_j.workspace_id
                        LEFT JOIN flow_node fn ON fn.id = parent_j.runnable_id
                        CROSS JOIN LATERAL jsonb_array_elements(
-                           COALESCE(parent_j.raw_flow, f.value, fn.flow)->'modules'
+                           COALESCE(parent_j.raw_flow, fv.value, f.value, fn.flow)->'modules'
                        ) m
                        WHERE parent_j.id = jt.id
                          AND m->>'id' = j.flow_step_id
@@ -2382,17 +2494,39 @@ async fn collect_flow_log_entries(
             FROM v2_job j
             JOIN job_tree jt ON j.parent_job = jt.id
             WHERE j.workspace_id = $1
+              AND ($3::text[] IS NULL OR j.tag = ANY($3))
+        ),
+        positions AS (
+            SELECT g.parent_job, g.flow_step_id, fj.jid, fj.ord
+            FROM (SELECT DISTINCT parent_job, flow_step_id FROM job_tree
+                  WHERE parent_job IS NOT NULL AND flow_step_id IS NOT NULL) g
+            CROSS JOIN LATERAL (
+                SELECT COALESCE(
+                    (SELECT flow_status FROM v2_job_completed WHERE id = g.parent_job),
+                    (SELECT flow_status FROM v2_job_status WHERE id = g.parent_job)
+                ) AS fs
+            ) pf
+            CROSS JOIN LATERAL (
+                SELECT m FROM jsonb_array_elements(pf.fs->'modules') m
+                WHERE m->>'id' = g.flow_step_id
+                LIMIT 1
+            ) md
+            CROSS JOIN LATERAL jsonb_array_elements_text(md.m->'flow_jobs')
+                WITH ORDINALITY fj(jid, ord)
         ),
         with_sibling_index AS (
             SELECT jt.*,
                    ROW_NUMBER() OVER (
                        PARTITION BY jt.parent_job, jt.flow_step_id
-                       ORDER BY jt.id
+                       ORDER BY pos.ord NULLS LAST, jt.id
                    ) as sibling_index,
                    COUNT(*) OVER (
                        PARTITION BY jt.parent_job, jt.flow_step_id
                    ) as sibling_count
             FROM job_tree jt
+            LEFT JOIN positions pos ON pos.parent_job = jt.parent_job
+                AND pos.flow_step_id = jt.flow_step_id
+                AND pos.jid = jt.id::text
         )
         SELECT w.id, w.kind, w.flow_step_id, w.path_label,
                w.sibling_index::int as sibling_index,
@@ -2407,6 +2541,7 @@ async fn collect_flow_log_entries(
         ORDER BY w.id_path ASC",
         w_id,
         id,
+        auth.scope_tags.as_deref(),
     )
     .fetch_all(db)
     .await?;
@@ -2421,57 +2556,15 @@ async fn collect_flow_log_entries(
         let sibling_index = record.sibling_index.unwrap_or(0);
         let parent_module_type = record.parent_module_type.as_deref().unwrap_or("");
 
-        // Build a descriptive label
         let path = record.path_label.as_deref().unwrap_or(step_id);
-
-        let kind_label = match parent_module_type {
-            "branchall" => " branchall",
-            "branchone" => " branchone",
-            "forloopflow" => " forloop",
-            "whileloopflow" => " whileloop",
-            "aiagent" => " ai-agent",
-            _ => "",
-        };
-
-        let label = if depth == 0 {
-            "Flow".to_string()
-        } else if matches!(
+        let label = flow_tree_entry_label(
             kind,
-            "flow" | "flowpreview" | "flownode" | "singlestepflow" | "aiagent"
-        ) {
-            // Intermediate flow job (loop iteration or branch)
-            if parent_module_type == "branchone" {
-                let branch_label = if sibling_index == 1 {
-                    "default".to_string()
-                } else {
-                    format!("{}", sibling_index - 1)
-                };
-                format!("Step {}{} (branch {})", path, kind_label, branch_label)
-            } else if parent_module_type == "branchall" {
-                format!("Step {}{} (branch {})", path, kind_label, sibling_index)
-            } else if parent_module_type == "forloopflow" || parent_module_type == "whileloopflow" {
-                format!(
-                    "Step {}{} (iteration {}/{})",
-                    path, kind_label, sibling_index, sibling_count
-                )
-            } else if sibling_count > 1 {
-                format!(
-                    "Step {} (iteration {}/{})",
-                    path, sibling_index, sibling_count
-                )
-            } else {
-                format!("Step {} (subflow)", path)
-            }
-        } else if sibling_count > 1 {
-            // Simple module optimization: forloop/whileloop with single step
-            // runs iterations as direct script jobs instead of subflows
-            format!(
-                "Step {}{} (iteration {}/{})",
-                path, kind_label, sibling_index, sibling_count
-            )
-        } else {
-            format!("Step {}", path)
-        };
+            path,
+            parent_module_type,
+            sibling_index,
+            sibling_count,
+            depth,
+        );
 
         let job_id = record.id.map(|u| u.to_string()).unwrap_or_default();
         let logs = record.logs.as_deref().unwrap_or("");
@@ -2557,6 +2650,636 @@ async fn get_flow_all_logs_structured(
     Ok(Json(entries))
 }
 
+/// A single job in a flow's execution tree with its status and (truncated)
+/// result — the results twin of `FlowLogEntry`.
+#[derive(Serialize)]
+struct FlowResultEntry {
+    job_id: String,
+    /// Human-readable label, e.g. "Step a (iteration 2/3)" or "Flow".
+    label: String,
+    /// Job kind (script, flow, forloopflow, …).
+    kind: String,
+    /// The flow step id this job corresponds to, if any.
+    flow_step_id: Option<String>,
+    /// Materialized step path (e.g. "a/b") used to locate the step in the flow.
+    step_path: Option<String>,
+    /// Depth in the flow tree (0 for the root flow job).
+    depth: i32,
+    /// The parent module type (forloopflow, branchall, …), if any.
+    parent_module_type: Option<String>,
+    /// 1-based index of this job among its siblings sharing the same step.
+    sibling_index: i32,
+    /// Total number of siblings sharing the same step.
+    sibling_count: i32,
+    /// success | failure | canceled | skipped | suspended | running | queued
+    status: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    success: Option<bool>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    duration_ms: Option<i64>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    started_at: Option<chrono::DateTime<Utc>>,
+    /// Result JSON text truncated to the per-entry budget; absent until the job
+    /// has completed.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    result_prefix: Option<String>,
+    /// Full length in characters of the result JSON text (greater than the
+    /// prefix length when truncated).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    result_length: Option<i32>,
+}
+
+#[derive(Serialize)]
+struct FlowAllResultsResponse {
+    /// Set when the requested job is itself a step of a larger flow run: the id
+    /// of the flow run directly enclosing it.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    enclosing_job: Option<Uuid>,
+    entries: Vec<FlowResultEntry>,
+    /// True when the tree has more jobs than the entry cap; entries then hold
+    /// the depth-first prefix.
+    #[serde(skip_serializing_if = "std::ops::Not::not")]
+    truncated: bool,
+    /// True when the caller's token is tag-scoped: steps running on other tags
+    /// are omitted and indistinguishable from steps that never ran.
+    #[serde(skip_serializing_if = "std::ops::Not::not")]
+    scope_filtered: bool,
+    /// Set when `step` was provided but could not be resolved; a diagnostic the
+    /// caller can act on (available step ids, iteration statuses).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    step_error: Option<String>,
+}
+
+#[derive(Deserialize)]
+struct FlowAllResultsQuery {
+    /// Per-entry cap (in characters of JSON text) on `result_prefix`.
+    max_result_len: Option<i32>,
+    /// Step address to resolve instead of enumerating the tree: 'b', 'b/c',
+    /// 'b[12]' (1-based iteration/branch), composable as 'b[12]/c'.
+    step: Option<String>,
+}
+
+const FLOW_ALL_RESULTS_DEFAULT_MAX_LEN: i32 = 2000;
+const FLOW_ALL_RESULTS_MAX_MAX_LEN: i32 = 30_000;
+/// Hard cap on enumerated tree entries — bounds both the response size and the
+/// per-row result::text materialization the query performs.
+const FLOW_ALL_RESULTS_MAX_ENTRIES: i64 = 2000;
+
+struct ResolvedStepJob {
+    job_id: Uuid,
+    flow_step_id: String,
+    path: String,
+    sibling_index: i32,
+    sibling_count: i32,
+    depth: i32,
+    parent_module_type: String,
+}
+
+/// Fan-out module types whose sibling jobs are iterations/branches; sibling
+/// jobs of any other step are retry attempts.
+fn is_fan_out_module(parent_module_type: &str) -> bool {
+    matches!(
+        parent_module_type,
+        "forloopflow" | "whileloopflow" | "branchall" | "branchone" | "aiagent"
+    )
+}
+
+/// 'b[12]' -> ("b", Some(12)); 'b' -> ("b", None).
+fn parse_step_segment(segment: &str) -> (&str, Option<usize>) {
+    if let Some(rest) = segment.strip_suffix(']') {
+        if let Some((step_id, idx)) = rest.rsplit_once('[') {
+            if let Ok(idx) = idx.parse::<usize>() {
+                return (step_id, Some(idx));
+            }
+        }
+    }
+    (segment, None)
+}
+
+#[cfg(test)]
+mod flow_tree_tests {
+    use super::{flow_tree_entry_label, parse_step_segment};
+
+    #[test]
+    fn label_classifies_iterations_branches_and_retry_attempts() {
+        assert_eq!(flow_tree_entry_label("flow", "", "", 1, 1, 0), "Flow");
+        assert_eq!(
+            flow_tree_entry_label("script", "l", "forloopflow", 2, 3, 1),
+            "Step l forloop (iteration 2/3)"
+        );
+        assert_eq!(
+            flow_tree_entry_label("flow", "b", "branchall", 2, 2, 1),
+            "Step b branchall (branch 2)"
+        );
+        // branchone only enqueues its chosen branch — the label must not claim
+        // which branch that was
+        assert_eq!(
+            flow_tree_entry_label("flow", "b", "branchone", 1, 1, 1),
+            "Step b branchone (selected branch)"
+        );
+        // siblings of a non-fan-out step are retry attempts, for both direct
+        // and subflow steps
+        assert_eq!(
+            flow_tree_entry_label("script", "a", "rawscript", 2, 3, 1),
+            "Step a (attempt 2/3)"
+        );
+        assert_eq!(
+            flow_tree_entry_label("flow", "b", "flow", 2, 2, 1),
+            "Step b (attempt 2/2)"
+        );
+        // unresolved parent module type ("", e.g. the flow was edited since the
+        // run) must NOT claim retries — keep the generic iteration wording
+        assert_eq!(
+            flow_tree_entry_label("script", "a", "", 2, 3, 1),
+            "Step a (iteration 2/3)"
+        );
+        assert_eq!(
+            flow_tree_entry_label("flow", "b", "flow", 1, 1, 1),
+            "Step b (subflow)"
+        );
+        assert_eq!(
+            flow_tree_entry_label("script", "a", "rawscript", 1, 1, 1),
+            "Step a"
+        );
+    }
+
+    #[test]
+    fn parses_step_segments() {
+        assert_eq!(parse_step_segment("b"), ("b", None));
+        assert_eq!(parse_step_segment("b[12]"), ("b", Some(12)));
+        assert_eq!(parse_step_segment("b[0]"), ("b", Some(0)));
+        assert_eq!(parse_step_segment("b[x]"), ("b[x]", None));
+        assert_eq!(parse_step_segment("b]"), ("b]", None));
+    }
+}
+
+/// Resolve a step address ('b/c', 'b[12]/c', '.' separators accepted) to a
+/// single job of the flow tree rooted at `root`, walking one indexed
+/// parent_job + flow_step_id lookup per segment — no tree enumeration.
+/// Siblings are numbered by their position in the parent flow_status's
+/// flow_jobs array — the authoritative iteration order — matching the tree
+/// view's numbering; job-id order alone would shuffle parallel iterations
+/// created in the same millisecond (ULID randomness). Retries have no
+/// flow_jobs and fall back to id order. Err carries a diagnostic listing what
+/// exists instead.
+async fn resolve_flow_step_job(
+    db: &DB,
+    w_id: &str,
+    root: Uuid,
+    address: &str,
+    scope_tags: Option<&[String]>,
+) -> error::Result<Result<ResolvedStepJob, String>> {
+    let segments = address
+        .replace('.', "/")
+        .split('/')
+        .filter(|s| !s.is_empty())
+        .map(|s| s.to_string())
+        .collect_vec();
+    if segments.is_empty() {
+        return Ok(Err("Empty step address.".to_string()));
+    }
+
+    let mut current = root;
+    let mut resolved: Option<ResolvedStepJob> = None;
+    let mut path_segments: Vec<&str> = vec![];
+    for (depth, segment) in segments.iter().enumerate() {
+        let (step_id, index) = parse_step_segment(segment);
+        path_segments.push(step_id);
+
+        // parent_module_type is resolved the same way as in the tree CTE (the
+        // module named `step_id` in the parent's flow definition); it is
+        // constant across the sibling rows.
+        let siblings = sqlx::query!(
+            "SELECT j.id,
+                    COALESCE(c.status::text,
+                             CASE WHEN q.running AND q.suspend > 0 THEN 'suspended'
+                                  WHEN q.running THEN 'running'
+                                  ELSE 'queued' END) as \"status!\",
+                    COALESCE((
+                        SELECT m->'value'->>'type'
+                        FROM v2_job parent_j
+                        LEFT JOIN flow_version fv ON fv.id = parent_j.runnable_id
+                            AND parent_j.kind::text = 'flow'
+                        LEFT JOIN flow f ON f.path = parent_j.runnable_path
+                            AND f.workspace_id = parent_j.workspace_id
+                        LEFT JOIN flow_node fn ON fn.id = parent_j.runnable_id
+                        CROSS JOIN LATERAL jsonb_array_elements(
+                            COALESCE(parent_j.raw_flow, fv.value, f.value, fn.flow)->'modules'
+                        ) m
+                        WHERE parent_j.id = $1
+                          AND m->>'id' = $3
+                        LIMIT 1
+                    ), '')::text as \"parent_module_type!\"
+             FROM v2_job j
+             LEFT JOIN v2_job_completed c ON c.id = j.id
+             LEFT JOIN v2_job_queue q ON q.id = j.id
+             LEFT JOIN (
+                 SELECT fj.jid, fj.ord
+                 FROM (SELECT COALESCE(
+                         (SELECT flow_status FROM v2_job_completed WHERE id = $1),
+                         (SELECT flow_status FROM v2_job_status WHERE id = $1)
+                     ) AS fs) pf
+                 CROSS JOIN LATERAL (
+                     SELECT m FROM jsonb_array_elements(pf.fs->'modules') m
+                     WHERE m->>'id' = $3
+                     LIMIT 1
+                 ) md
+                 CROSS JOIN LATERAL jsonb_array_elements_text(md.m->'flow_jobs')
+                     WITH ORDINALITY fj(jid, ord)
+             ) pos ON pos.jid = j.id::text
+             WHERE j.parent_job = $1 AND j.workspace_id = $2 AND j.flow_step_id = $3
+               AND ($4::text[] IS NULL OR j.tag = ANY($4))
+             ORDER BY pos.ord NULLS LAST, j.id",
+            current,
+            w_id,
+            step_id,
+            scope_tags,
+        )
+        .fetch_all(db)
+        .await?;
+
+        if siblings.is_empty() {
+            let available = sqlx::query_scalar!(
+                "SELECT DISTINCT flow_step_id as \"flow_step_id!\" FROM v2_job
+                 WHERE parent_job = $1 AND workspace_id = $2 AND flow_step_id IS NOT NULL
+                   AND ($3::text[] IS NULL OR tag = ANY($3))
+                 ORDER BY flow_step_id",
+                current,
+                w_id,
+                scope_tags,
+            )
+            .fetch_all(db)
+            .await?;
+            return Ok(Err(format!(
+                "No step \"{}\" at this level. Available steps: {}.",
+                step_id,
+                if available.is_empty() {
+                    "(none)".to_string()
+                } else {
+                    available.join(", ")
+                }
+            )));
+        }
+
+        let parent_module_type = siblings[0].parent_module_type.clone();
+        let node = if let Some(index) = index {
+            match index.checked_sub(1).and_then(|i| siblings.get(i)) {
+                Some(node) => node,
+                None => {
+                    return Ok(Err(format!(
+                        "Step \"{}\" has no iteration [{}]. Existing: 1..{}.",
+                        step_id,
+                        index,
+                        siblings.len()
+                    )));
+                }
+            }
+        } else if siblings.len() > 1 {
+            // These diagnostics go verbatim into the model's context — cap the
+            // per-sibling listing so huge loops can't flood it.
+            const MAX_STATUSES_LISTED: usize = 20;
+            let mut statuses = siblings
+                .iter()
+                .take(MAX_STATUSES_LISTED)
+                .enumerate()
+                .map(|(i, s)| format!("[{}] {}", i + 1, s.status))
+                .join(", ");
+            if siblings.len() > MAX_STATUSES_LISTED {
+                statuses.push_str(&format!(
+                    ", … (+{} more)",
+                    siblings.len() - MAX_STATUSES_LISTED
+                ));
+            }
+            return Ok(Err(
+                if is_fan_out_module(&parent_module_type) || parent_module_type.is_empty() {
+                    format!(
+                        "Step \"{}\" ran {} times (loop/branches) — pick one with \"{}[i]\". Iterations: {}.",
+                        step_id,
+                        siblings.len(),
+                        step_id,
+                        statuses
+                    )
+                } else {
+                    format!(
+                        "Step \"{}\" was retried — {} attempts, the last one is the final outcome. Pick one with \"{}[i]\". Attempts: {}.",
+                        step_id,
+                        siblings.len(),
+                        step_id,
+                        statuses
+                    )
+                },
+            ));
+        } else {
+            &siblings[0]
+        };
+
+        let index_in_siblings = siblings.iter().position(|s| s.id == node.id).unwrap_or(0);
+        current = node.id;
+        resolved = Some(ResolvedStepJob {
+            job_id: node.id,
+            flow_step_id: step_id.to_string(),
+            path: path_segments.join("/"),
+            sibling_index: (index_in_siblings + 1) as i32,
+            sibling_count: siblings.len() as i32,
+            depth: (depth + 1) as i32,
+            parent_module_type,
+        });
+    }
+
+    Ok(Ok(resolved.expect("segments is non-empty")))
+}
+
+/// Results twin of `get_flow_all_logs_structured`: one entry per job of the
+/// flow's execution tree (same recursive enumeration), carrying per-job status
+/// and truncated result instead of logs.
+async fn get_flow_all_results(
+    OptViewToken(view_token): OptViewToken,
+    OptAuthed(opt_authed): OptAuthed,
+    opt_tokened: OptTokened,
+    Extension(db): Extension<DB>,
+    Extension(user_db): Extension<UserDB>,
+    Path((w_id, id)): Path<(String, Uuid)>,
+    Query(query): Query<FlowAllResultsQuery>,
+) -> JsonResult<FlowAllResultsResponse> {
+    let auth = authorize_flow_tree_read(
+        view_token,
+        &opt_authed,
+        &opt_tokened,
+        &db,
+        &user_db,
+        &w_id,
+        id,
+    )
+    .await?;
+    let enclosing_job = auth.enclosing_job;
+    let scope_tags = auth.scope_tags;
+
+    let max_result_len = query
+        .max_result_len
+        .unwrap_or(FLOW_ALL_RESULTS_DEFAULT_MAX_LEN)
+        .clamp(1, FLOW_ALL_RESULTS_MAX_MAX_LEN);
+
+    // Step mode: resolve the address to one job directly (a few indexed
+    // lookups) instead of enumerating the whole tree.
+    if let Some(step) = query.step.as_deref().filter(|s| !s.trim().is_empty()) {
+        let resolved =
+            match resolve_flow_step_job(&db, &w_id, id, step, scope_tags.as_deref()).await? {
+                Ok(resolved) => resolved,
+                Err(step_error) => {
+                    return Ok(Json(FlowAllResultsResponse {
+                        enclosing_job,
+                        entries: vec![],
+                        truncated: false,
+                        scope_filtered: scope_tags.is_some(),
+                        step_error: Some(step_error),
+                    }));
+                }
+            };
+
+        let record = sqlx::query!(
+            "SELECT j.kind::text as kind,
+                    c.status::text as completed_status,
+                    c.duration_ms as \"duration_ms?\",
+                    COALESCE(c.started_at, q.started_at) as started_at,
+                    LEFT(c.result::text, $3) as result_prefix,
+                    length(c.result::text) as result_length,
+                    q.running as \"q_running?\",
+                    q.suspend as \"q_suspend?\"
+             FROM v2_job j
+             LEFT JOIN v2_job_completed c ON c.id = j.id
+             LEFT JOIN v2_job_queue q ON q.id = j.id
+             WHERE j.id = $1 AND j.workspace_id = $2",
+            resolved.job_id,
+            w_id,
+            max_result_len,
+        )
+        .fetch_one(&db)
+        .await?;
+
+        let kind = record.kind.as_deref().unwrap_or("");
+        let status = match record.completed_status.as_deref() {
+            Some(s) => s.to_string(),
+            None => {
+                if record.q_running.unwrap_or(false) && record.q_suspend.unwrap_or(0) > 0 {
+                    "suspended".to_string()
+                } else if record.q_running.unwrap_or(false) {
+                    "running".to_string()
+                } else {
+                    "queued".to_string()
+                }
+            }
+        };
+        let success = record.completed_status.as_deref().map(|s| s == "success");
+        let label = flow_tree_entry_label(
+            kind,
+            &resolved.path,
+            &resolved.parent_module_type,
+            resolved.sibling_index,
+            resolved.sibling_count,
+            resolved.depth,
+        );
+
+        return Ok(Json(FlowAllResultsResponse {
+            enclosing_job,
+            entries: vec![FlowResultEntry {
+                job_id: resolved.job_id.to_string(),
+                label,
+                kind: kind.to_string(),
+                flow_step_id: Some(resolved.flow_step_id),
+                step_path: Some(resolved.path),
+                depth: resolved.depth,
+                parent_module_type: if resolved.parent_module_type.is_empty() {
+                    None
+                } else {
+                    Some(resolved.parent_module_type)
+                },
+                sibling_index: resolved.sibling_index,
+                sibling_count: resolved.sibling_count,
+                status,
+                success,
+                duration_ms: record.duration_ms,
+                started_at: record.started_at,
+                result_prefix: record.result_prefix,
+                result_length: record.result_length,
+            }],
+            truncated: false,
+            scope_filtered: scope_tags.is_some(),
+            step_error: None,
+        }));
+    }
+
+    // Same recursive CTE as `collect_flow_log_entries` (kept textually in sync —
+    // sqlx macros cannot share the SQL string), joined against the completed and
+    // queue tables instead of `job_logs`.
+    let records = sqlx::query!(
+        "WITH RECURSIVE job_tree AS (
+            SELECT j.id, j.kind::text, j.flow_step_id, j.parent_job,
+                   '' as path_label, 0 as depth,
+                   j.id::text as id_path,
+                   ''::text as parent_module_type
+            FROM v2_job j
+            WHERE j.id = $2 AND j.workspace_id = $1
+            UNION ALL
+            SELECT j.id, j.kind::text, j.flow_step_id, j.parent_job,
+                   CASE
+                       WHEN jt.path_label = '' THEN COALESCE(j.flow_step_id, '')
+                       ELSE jt.path_label || '/' || COALESCE(j.flow_step_id, '')
+                   END,
+                   jt.depth + 1,
+                   jt.id_path || '/' || j.id::text,
+                   COALESCE((
+                       SELECT m->'value'->>'type'
+                       FROM v2_job parent_j
+                       LEFT JOIN flow_version fv ON fv.id = parent_j.runnable_id
+                           AND parent_j.kind::text = 'flow'
+                       LEFT JOIN flow f ON f.path = parent_j.runnable_path
+                           AND f.workspace_id = parent_j.workspace_id
+                       LEFT JOIN flow_node fn ON fn.id = parent_j.runnable_id
+                       CROSS JOIN LATERAL jsonb_array_elements(
+                           COALESCE(parent_j.raw_flow, fv.value, f.value, fn.flow)->'modules'
+                       ) m
+                       WHERE parent_j.id = jt.id
+                         AND m->>'id' = j.flow_step_id
+                       LIMIT 1
+                   ), '')::text
+            FROM v2_job j
+            JOIN job_tree jt ON j.parent_job = jt.id
+            WHERE j.workspace_id = $1
+              AND ($4::text[] IS NULL OR j.tag = ANY($4))
+        ),
+        positions AS (
+            SELECT g.parent_job, g.flow_step_id, fj.jid, fj.ord
+            FROM (SELECT DISTINCT parent_job, flow_step_id FROM job_tree
+                  WHERE parent_job IS NOT NULL AND flow_step_id IS NOT NULL) g
+            CROSS JOIN LATERAL (
+                SELECT COALESCE(
+                    (SELECT flow_status FROM v2_job_completed WHERE id = g.parent_job),
+                    (SELECT flow_status FROM v2_job_status WHERE id = g.parent_job)
+                ) AS fs
+            ) pf
+            CROSS JOIN LATERAL (
+                SELECT m FROM jsonb_array_elements(pf.fs->'modules') m
+                WHERE m->>'id' = g.flow_step_id
+                LIMIT 1
+            ) md
+            CROSS JOIN LATERAL jsonb_array_elements_text(md.m->'flow_jobs')
+                WITH ORDINALITY fj(jid, ord)
+        ),
+        with_sibling_index AS (
+            SELECT jt.*,
+                   ROW_NUMBER() OVER (
+                       PARTITION BY jt.parent_job, jt.flow_step_id
+                       ORDER BY pos.ord NULLS LAST, jt.id
+                   ) as sibling_index,
+                   COUNT(*) OVER (
+                       PARTITION BY jt.parent_job, jt.flow_step_id
+                   ) as sibling_count
+            FROM job_tree jt
+            LEFT JOIN positions pos ON pos.parent_job = jt.parent_job
+                AND pos.flow_step_id = jt.flow_step_id
+                AND pos.jid = jt.id::text
+        ),
+        limited AS (
+            SELECT * FROM with_sibling_index ORDER BY id_path ASC LIMIT $5
+        )
+        SELECT w.id, w.kind, w.flow_step_id, w.path_label,
+               w.sibling_index::int as sibling_index,
+               w.sibling_count::int as sibling_count,
+               w.depth::int as depth,
+               w.parent_module_type,
+               c.status::text as completed_status,
+               c.duration_ms as \"duration_ms?\",
+               COALESCE(c.started_at, q.started_at) as started_at,
+               LEFT(c.result::text, $3) as result_prefix,
+               length(c.result::text) as result_length,
+               q.running as \"q_running?\",
+               q.suspend as \"q_suspend?\"
+        FROM limited w
+        LEFT JOIN v2_job_completed c ON c.id = w.id
+        LEFT JOIN v2_job_queue q ON q.id = w.id
+        ORDER BY w.id_path ASC",
+        w_id,
+        id,
+        max_result_len,
+        scope_tags.as_deref(),
+        FLOW_ALL_RESULTS_MAX_ENTRIES + 1,
+    )
+    .fetch_all(&db)
+    .await?;
+
+    // One row past the cap fetched only to detect truncation.
+    let mut records = records;
+    let truncated = records.len() as i64 > FLOW_ALL_RESULTS_MAX_ENTRIES;
+    if truncated {
+        records.truncate(FLOW_ALL_RESULTS_MAX_ENTRIES as usize);
+    }
+
+    let mut entries = Vec::with_capacity(records.len());
+
+    for record in records {
+        let kind = record.kind.as_deref().unwrap_or("");
+        let step_id = record.flow_step_id.as_deref().unwrap_or("");
+        let depth = record.depth.unwrap_or(0);
+        let sibling_count = record.sibling_count.unwrap_or(1) as i32;
+        let sibling_index = record.sibling_index.unwrap_or(0) as i32;
+        let parent_module_type = record.parent_module_type.as_deref().unwrap_or("");
+
+        let path = record.path_label.as_deref().unwrap_or(step_id);
+        let label = flow_tree_entry_label(
+            kind,
+            path,
+            parent_module_type,
+            sibling_index,
+            sibling_count,
+            depth,
+        );
+
+        let status = match record.completed_status.as_deref() {
+            Some(s) => s.to_string(),
+            None => {
+                if record.q_running.unwrap_or(false) && record.q_suspend.unwrap_or(0) > 0 {
+                    "suspended".to_string()
+                } else if record.q_running.unwrap_or(false) {
+                    "running".to_string()
+                } else {
+                    "queued".to_string()
+                }
+            }
+        };
+        let success = record.completed_status.as_deref().map(|s| s == "success");
+
+        entries.push(FlowResultEntry {
+            job_id: record.id.map(|u| u.to_string()).unwrap_or_default(),
+            label,
+            kind: kind.to_string(),
+            flow_step_id: record.flow_step_id.clone(),
+            step_path: record.path_label.clone(),
+            depth,
+            parent_module_type: if parent_module_type.is_empty() {
+                None
+            } else {
+                Some(parent_module_type.to_string())
+            },
+            sibling_index,
+            sibling_count,
+            status,
+            success,
+            duration_ms: record.duration_ms,
+            started_at: record.started_at,
+            result_prefix: record.result_prefix,
+            result_length: record.result_length,
+        });
+    }
+
+    Ok(Json(FlowAllResultsResponse {
+        enclosing_job,
+        entries,
+        truncated,
+        scope_filtered: scope_tags.is_some(),
+        step_error: None,
+    }))
+}
+
 async fn get_args(
     OptViewToken(view_token): OptViewToken,
     OptAuthed(opt_authed): OptAuthed,
diff --git a/frontend/src/lib/components/copilot/chat/global/core.ts b/frontend/src/lib/components/copilot/chat/global/core.ts
index cc91b9810b..39b483ddc7 100644
--- a/frontend/src/lib/components/copilot/chat/global/core.ts
+++ b/frontend/src/lib/components/copilot/chat/global/core.ts
@@ -141,6 +141,7 @@ import {
 	getDraftDiffValues
 } from '$lib/utils_draft_deploy'
 import { changedLineIndices, draftDeployedPatch, windowPatch } from './draftDiff'
+import { getFlowRunDetails } from './flowRunTree'
 import { UserDraftDbSyncer } from '$lib/userDraftDbSyncer.svelte'
 import { invalidateWorkspaceComparison } from '$lib/workspaceComparison'
 import type { UserDraftItemKind } from '$lib/gen'
@@ -603,6 +604,16 @@ const getJobLogsSchema = z.object({
 	id: z.string().describe('The UUID of the job to fetch logs for.')
 })
 
+const getFlowRunDetailsSchema = z.object({
+	id: z.string().describe('The UUID of the flow run to inspect.'),
+	step: z
+		.string()
+		.optional()
+		.describe(
+			'Step to drill into for its result (returned in full up to 12k chars), addressed by the step ids shown in the tree: "b" for a top-level step, "b/c" for a step inside a subflow, "b[12]" for iteration 12 of a loop or attempt 12 of a retried step (1-based), composable as "b[12]/c". Omit to get the whole per-step tree.'
+		)
+})
+
 const cancelJobSchema = z.object({
 	id: z.string().describe('The UUID of the job to cancel.')
 })
@@ -1181,6 +1192,7 @@ Rules:
 ${pipelineBullet}
 - After creating or editing a script or flow draft, run test_run_script, test_run_flow, or test_run_step with representative args before reporting that it works. These tools prefer drafts, so testing does not require deployment.
 - Use list_runs to find recent runs (optionally filtered by path, creator, label, or status), then get_job_logs with a returned id to inspect a specific run's logs — without starting a new test run.
+- To see what a flow run actually did per step — statuses and results across the whole execution tree, subflow steps and loop iterations included — use get_flow_run_details with the run id (it also works while the flow is still running). Pass step to read one step's result in full (capped at 12k chars). Prefer it over get_job_logs when you need step results rather than logs.
 - Use open_page to show a workspace page with filters applied — Runs, Schedules, Variables, Resources, Assets, Audit logs, or Workspace settings on a specific tab (e.g. "open the failed runs of f/foo/bar", "open the schedule for X", "open the git sync settings"). Only the pages listed for this user in the tool are available; don't offer pages that aren't listed. Don't use it as a substitute for list_runs when you just need the data yourself.
 - Whenever you ask the user to perform a manual step in the UI — fill in a resource's credentials, set a secret variable's value, adjust a schedule or setting — call open_page in the same message, targeted at that item (pass open with its path to land in its edit drawer, or the page's filters otherwise). Never just describe where to click.
 - When the user is happy with the changes and wants to review or deploy them, use open_page with page "compare" — it opens the Compare & Deploy review page.${
@@ -1188,7 +1200,7 @@ ${pipelineBullet}
 			? ' By default it preselects the items this chat modified; pass items ("<kind>:<path>" entries) to control the selection'
 			: ' Pass items ("<kind>:<path>" entries naming the items you changed) so the review is scoped to them — omitting items preselects every pending change in the workspace'
 	}, or mode ("draft" or "fork") to force which comparison is shown. Prefer offering this review page over calling deploy_workspace_item directly when several items changed.
-- For a Windmill operation no other tool covers (workers, queue state, a run's result or args, ...), use search_api_endpoints to find a REST endpoint, then call_api_get for reads or call_api_endpoint for mutations (the user is asked to confirm those). Always prefer a dedicated tool when one exists; endpoints for authoring or deleting scripts, flows, apps, schedules, resources, or variables are not available through the API catalog tools — use the draft tools and delete_workspace_item instead.
+- For a Windmill operation no other tool covers (workers, queue state, a run's args, ...), use search_api_endpoints to find a REST endpoint, then call_api_get for reads or call_api_endpoint for mutations (the user is asked to confirm those). Always prefer a dedicated tool when one exists; endpoints for authoring or deleting scripts, flows, apps, schedules, resources, or variables are not available through the API catalog tools — use the draft tools and delete_workspace_item instead.
 - runScriptByPath / runFlowByPath from the API catalog run the DEPLOYED version of an item. Use them only when the user explicitly asks to run the deployed version, and read the item with read_workspace_item version: "deployed" first so the arguments match the deployed input schema (a draft may have different inputs). To test something you are editing or just wrote, always use test_run_script, test_run_flow, or test_run_step — they run the draft.
 - When a required decision is ambiguous, use askUserQuestion with two to ten clear proposed answer strings instead of guessing. The user can also type a custom answer when none of the proposed answers fit. Set multiSelect: true only when the answers can genuinely co-apply and the user may pick several (not mutually exclusive).
 - When the user asks you to remember a lasting preference, always/never do something, or change/stop a behavior going forward, call update_user_instructions to persist it. It edits only the USER INSTRUCTIONS block (not WORKSPACE INSTRUCTIONS). Keep each instruction concise; do not use it for one-off requests scoped to the current task.
@@ -3031,6 +3043,30 @@ export const globalTools: Tool<{}>[] = [
 			return result
 		}
 	},
+	{
+		def: createToolDef(
+			getFlowRunDetailsSchema,
+			'get_flow_run_details',
+			"Inspect a flow run's execution tree: per-step statuses and truncated results, including subflow steps, loop iterations, branches, and retries. Works on running flows too. Pass step to fetch one step's result in full (up to 12k chars)."
+		),
+		showDetails: true,
+		fn: async ({ args, workspace, toolId, toolCallbacks }) => {
+			const parsed = getFlowRunDetailsSchema.parse(args)
+			toolCallbacks.setToolStatus(toolId, {
+				content: parsed.step
+					? `Fetching result of step ${parsed.step} in run ${parsed.id}...`
+					: `Inspecting flow run ${parsed.id}...`
+			})
+			const result = await getFlowRunDetails(workspace, parsed.id, parsed.step)
+			toolCallbacks.setToolStatus(toolId, {
+				content: parsed.step
+					? `Fetched result of step ${parsed.step} in run ${parsed.id}`
+					: `Inspected flow run ${parsed.id}`,
+				result
+			})
+			return result
+		}
+	},
 	{
 		def: createToolDef(
 			getJobLogsSchema,
diff --git a/frontend/src/lib/components/copilot/chat/global/flowRunTree.test.ts b/frontend/src/lib/components/copilot/chat/global/flowRunTree.test.ts
new file mode 100644
index 0000000000..4b0dee5de0
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/global/flowRunTree.test.ts
@@ -0,0 +1,193 @@
+import { describe, expect, it } from 'vitest'
+import { buildFlowTree, shapeFlowRunTree, type FlowResultEntry } from './flowRunTree'
+
+let uuidCounter = 0
+function entry(partial: Partial<FlowResultEntry>): FlowResultEntry {
+	uuidCounter++
+	return {
+		job_id: `00000000-0000-0000-0000-${String(uuidCounter).padStart(12, '0')}`,
+		label: partial.step_path ? `Step ${partial.step_path}` : 'Flow',
+		kind: 'script',
+		depth: 1,
+		sibling_index: 1,
+		sibling_count: 1,
+		status: 'success',
+		success: true,
+		result_prefix: '"ok"',
+		result_length: 4,
+		...partial
+	}
+}
+
+function root(partial: Partial<FlowResultEntry> = {}): FlowResultEntry {
+	return entry({ kind: 'flow', depth: 0, step_path: null, label: 'Flow', ...partial })
+}
+
+/** Root flow with steps a, b where b is a subflow containing c. */
+function nestedEntries(): FlowResultEntry[] {
+	return [
+		root(),
+		entry({ step_path: 'a', flow_step_id: 'a' }),
+		entry({ step_path: 'b', flow_step_id: 'b', kind: 'flow', label: 'Step b (subflow)' }),
+		entry({
+			step_path: 'b/c',
+			flow_step_id: 'c',
+			depth: 2,
+			status: 'failure',
+			success: false,
+			result_prefix: '{"error":"boom"}',
+			result_length: 16
+		})
+	]
+}
+
+/** Root flow with loop step l of `n` iterations; `failed` are 1-based indices. */
+function loopEntries(n: number, failed: number[]): FlowResultEntry[] {
+	const entries = [root()]
+	for (let i = 1; i <= n; i++) {
+		entries.push(
+			entry({
+				step_path: 'l',
+				flow_step_id: 'l',
+				kind: 'flow',
+				label: `Step l forloop (iteration ${i}/${n})`,
+				parent_module_type: 'forloopflow',
+				sibling_index: i,
+				sibling_count: n,
+				status: failed.includes(i) ? 'failure' : 'success',
+				success: !failed.includes(i)
+			})
+		)
+	}
+	return entries
+}
+
+describe('buildFlowTree', () => {
+	it('rebuilds nesting from the depth-first flat list', () => {
+		const tree = buildFlowTree(nestedEntries())!
+		expect(tree.children.map((c) => c.entry.flow_step_id)).toEqual(['a', 'b'])
+		expect(tree.children[1].children.map((c) => c.entry.flow_step_id)).toEqual(['c'])
+	})
+})
+
+describe('shapeFlowRunTree', () => {
+	it('renders subflow steps nested under their parent step', () => {
+		const rendered = JSON.parse(shapeFlowRunTree({ entries: nestedEntries() }))
+		expect(rendered.run.status).toBe('success')
+		const stepB = rendered.steps[1]
+		expect(stepB.step).toBe('b')
+		expect(stepB.steps[0].step).toBe('b/c')
+		expect(stepB.steps[0].status).toBe('failure')
+		expect(stepB.steps[0].result).toBe('{"error":"boom"}')
+	})
+
+	it('collapses loop iterations to a tally with capped failed iterations plus the last', () => {
+		const rendered = JSON.parse(shapeFlowRunTree({ entries: loopEntries(50, [3, 7, 21, 30]) }))
+		const loop = rendered.steps[0]
+		expect(loop.type).toBe('forloopflow')
+		expect(loop.iterations).toBe(50)
+		expect(loop.ok).toBe(46)
+		expect(loop.failed_iterations).toEqual([3, 7, 21, 30])
+		// 3 failed shown (cap) + the last iteration
+		expect(loop.iterations_shown.map((i: any) => i.iteration)).toEqual([3, 7, 21, 50])
+		expect(loop.iterations_elided).toBe(46)
+	})
+
+	it('renders retried steps as attempts of one step, not loop iterations', () => {
+		const entries = [root()]
+		for (let i = 1; i <= 3; i++) {
+			entries.push(
+				entry({
+					step_path: 'a',
+					flow_step_id: 'a',
+					label: `Step a (attempt ${i}/3)`,
+					parent_module_type: 'rawscript',
+					sibling_index: i,
+					sibling_count: 3,
+					status: i < 3 ? 'failure' : 'success',
+					success: i === 3
+				})
+			)
+		}
+		const step = JSON.parse(shapeFlowRunTree({ entries })).steps[0]
+		expect(step.iterations).toBeUndefined()
+		expect(step.attempts).toBe(3)
+		expect(step.status).toBe('success')
+		expect(step.label).toBe('Step a (attempt 3/3)')
+		expect(step.previous_attempts.map((a: any) => a.status)).toEqual(['failure', 'failure'])
+	})
+
+	it('counts running iterations as unfinished and skipped ones as skipped', () => {
+		const entries = loopEntries(4, [])
+		entries[2].status = 'running'
+		entries[2].success = undefined
+		entries[2].result_prefix = undefined
+		entries[2].result_length = undefined
+		entries[3].status = 'skipped'
+		const loop = JSON.parse(shapeFlowRunTree({ entries })).steps[0]
+		expect(loop.ok).toBe(2)
+		expect(loop.unfinished).toBe(1)
+		expect(loop.skipped).toBe(1)
+		expect(loop.failed_iterations).toBeUndefined()
+	})
+
+	it('reports the truncated total size and surfaces the enclosing flow of a step job', () => {
+		const entries = nestedEntries()
+		entries[1].result_prefix = 'x'.repeat(700)
+		entries[1].result_length = 5000
+		const rendered = JSON.parse(shapeFlowRunTree({ enclosing_job: 'enclosing-uuid', entries }))
+		expect(rendered.note).toContain('enclosing-uuid')
+		expect(rendered.steps[0].result_total_chars).toBe(5000)
+	})
+
+	it('notes when the server truncated the tree', () => {
+		const rendered = JSON.parse(shapeFlowRunTree({ entries: nestedEntries(), truncated: true }))
+		expect(rendered.note).toContain('more jobs')
+	})
+
+	it('compares result sizes in code points and never splits a surrogate pair', () => {
+		const entries = [root()]
+		// 400 astral chars: 800 UTF-16 units but 400 code points. The 700-unit
+		// head budget keeps only 350 of them — comparing in UTF-16 units
+		// (400 < 700) used to hide that truncation entirely.
+		entries.push(
+			entry({
+				step_path: 'a',
+				flow_step_id: 'a',
+				status: 'failure',
+				success: false,
+				result_prefix: '🦄'.repeat(400),
+				result_length: 400
+			})
+		)
+		const step = JSON.parse(shapeFlowRunTree({ entries })).steps[0]
+		expect(step.result_total_chars).toBe(400)
+		// the cut must never leave a lone high surrogate at the tail
+		expect(step.result.charCodeAt(step.result.length - 1)).toBeGreaterThan(0xdbff)
+	})
+
+	it('shrinks result heads to fit the total budget instead of overflowing', () => {
+		const entries = [root()]
+		for (let i = 1; i <= 60; i++) {
+			entries.push(
+				entry({
+					step_path: `s${i}`,
+					flow_step_id: `s${i}`,
+					status: i === 1 ? 'failure' : 'success',
+					success: i !== 1,
+					result_prefix: 'y'.repeat(700),
+					result_length: 700
+				})
+			)
+		}
+		const rendered = shapeFlowRunTree({ entries })
+		expect(rendered.length).toBeLessThanOrEqual(21000)
+		const parsed = JSON.parse(rendered)
+		// failure detail outlives success detail: the failed step keeps a result
+		// head while succeeded steps are reduced to their size
+		expect(parsed.steps[0].status).toBe('failure')
+		expect(parsed.steps[0].result.length).toBeGreaterThan(0)
+		expect(parsed.steps[1].result).toBeUndefined()
+		expect(parsed.steps[1].result_total_chars).toBe(700)
+	})
+})
diff --git a/frontend/src/lib/components/copilot/chat/global/flowRunTree.ts b/frontend/src/lib/components/copilot/chat/global/flowRunTree.ts
new file mode 100644
index 0000000000..207dca1789
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/global/flowRunTree.ts
@@ -0,0 +1,313 @@
+import { JobService, type GetFlowAllResultsResponse } from '$lib/gen'
+
+/**
+ * Model-facing view of a flow run's execution tree for the global chat's
+ * get_flow_run_details tool. The backend endpoint (get_flow_all_results)
+ * enumerates every job of the tree with per-entry truncated results; this
+ * module shapes that flat list into a compact per-step tree the model can
+ * read in one tool result. Step addresses ('b/c', 'b[12]/c') are resolved
+ * server-side by the same endpoint for full-result drill-down.
+ */
+
+export type FlowResultEntry = GetFlowAllResultsResponse['entries'][number]
+
+/** Per-entry result budget requested from the server for the tree view. */
+export const TREE_RESULT_HEAD_CHARS = 700
+/** Cap on a drilled single-step full result handed to the model. */
+export const STEP_RESULT_MAX_CHARS = 12000
+/** Cap on the whole rendered tree; heads shrink progressively to fit. */
+const TREE_TOTAL_BUDGET_CHARS = 20000
+/** Failed loop iterations shown with a result head (the rest are indices only). */
+const MAX_FAILED_ITERATIONS_SHOWN = 3
+/** Head-shrink ladder tried in order until the rendered tree fits the budget.
+ * `successHead` caps results of succeeded steps separately so failure detail
+ * survives longest. */
+const SHRINK_LADDER = [
+	{ head: TREE_RESULT_HEAD_CHARS, successHead: TREE_RESULT_HEAD_CHARS },
+	{ head: 250, successHead: 250 },
+	{ head: 250, successHead: 0 },
+	{ head: 100, successHead: 0 }
+]
+
+export interface FlowTreeNode {
+	entry: FlowResultEntry
+	children: FlowTreeNode[]
+}
+
+/** Rebuild the parent/child tree from the server's depth-first flat list. */
+export function buildFlowTree(entries: FlowResultEntry[]): FlowTreeNode | undefined {
+	let root: FlowTreeNode | undefined
+	const stack: FlowTreeNode[] = []
+	for (const entry of entries) {
+		const node: FlowTreeNode = { entry, children: [] }
+		while (stack.length && stack[stack.length - 1].entry.depth >= entry.depth) {
+			stack.pop()
+		}
+		const parent = stack[stack.length - 1]
+		if (parent) {
+			parent.children.push(node)
+		} else if (!root) {
+			root = node
+		}
+		stack.push(node)
+	}
+	return root
+}
+
+interface ChildGroup {
+	stepId: string
+	nodes: FlowTreeNode[]
+}
+
+/** Group sibling jobs by flow step id (loop iterations / branches of one step
+ * form one group). Keyed rather than run-length so ordering quirks between
+ * parallel iterations can't split a step into two groups. */
+function groupChildren(children: FlowTreeNode[]): ChildGroup[] {
+	const groups = new Map<string, ChildGroup>()
+	for (const child of children) {
+		const stepId = child.entry.flow_step_id ?? `job:${child.entry.job_id}`
+		let group = groups.get(stepId)
+		if (!group) {
+			group = { stepId, nodes: [] }
+			groups.set(stepId, group)
+		}
+		group.nodes.push(child)
+	}
+	return Array.from(groups.values())
+}
+
+interface ShapeOpts {
+	head: number
+	successHead: number
+}
+
+/** Postgres LEFT()/length() count code points while JS .length/.slice count
+ * UTF-16 units — compare and cut in code points so astral characters neither
+ * hide a truncation nor get split through a surrogate pair. */
+function countCodePoints(s: string): number {
+	let n = 0
+	for (const _ of s) n++
+	return n
+}
+
+function sliceCodePointSafe(s: string, maxUnits: number): string {
+	const cut = s.slice(0, maxUnits)
+	const last = cut.charCodeAt(cut.length - 1)
+	// drop a trailing lone high surrogate
+	return last >= 0xd800 && last <= 0xdbff ? cut.slice(0, -1) : cut
+}
+
+function shapeResult(
+	entry: FlowResultEntry,
+	opts: ShapeOpts
+): { result?: string; result_total_chars?: number } {
+	if (entry.result_prefix === undefined || entry.result_prefix === null) return {}
+	const budget = entry.success ? opts.successHead : opts.head
+	if (budget <= 0) return { result_total_chars: entry.result_length ?? undefined }
+	const head = sliceCodePointSafe(entry.result_prefix, budget)
+	const total = entry.result_length ?? countCodePoints(entry.result_prefix)
+	return {
+		result: head,
+		...(total > countCodePoints(head) ? { result_total_chars: total } : {})
+	}
+}
+
+function shapeStep(node: FlowTreeNode, opts: ShapeOpts, iteration?: number): Record<string, any> {
+	const entry = node.entry
+	const shaped: Record<string, any> = {
+		...(entry.step_path ? { step: entry.step_path } : {}),
+		...(iteration !== undefined ? { iteration } : {}),
+		label: entry.label,
+		job_id: entry.job_id,
+		status: entry.status,
+		...(entry.duration_ms !== undefined && entry.duration_ms !== null
+			? { duration_ms: entry.duration_ms }
+			: {}),
+		...shapeResult(entry, opts)
+	}
+	const childSteps = shapeChildren(node.children, opts)
+	if (childSteps.length > 0) {
+		shaped.steps = childSteps
+	}
+	return shaped
+}
+
+/** Module types whose sibling jobs are iterations/branches; sibling jobs of
+ * any other step are retry attempts of that step. */
+const FAN_OUT_MODULE_TYPES = new Set([
+	'forloopflow',
+	'whileloopflow',
+	'branchall',
+	'branchone',
+	'aiagent'
+])
+
+function shapeGroup(group: ChildGroup, opts: ShapeOpts): Record<string, any> {
+	if (group.nodes.length === 1 && group.nodes[0].entry.sibling_count <= 1) {
+		return shapeStep(group.nodes[0], opts)
+	}
+
+	const first = group.nodes[0].entry
+	if (first.parent_module_type === 'branchall') {
+		return {
+			step: first.step_path ?? group.stepId,
+			type: 'branchall',
+			branches: group.nodes.map((n) => shapeStep(n, opts))
+		}
+	}
+
+	const byIndex = [...group.nodes].sort((a, b) => a.entry.sibling_index - b.entry.sibling_index)
+
+	if (first.parent_module_type && !FAN_OUT_MODULE_TYPES.has(first.parent_module_type)) {
+		// Retried step: siblings are attempts of the same step, the last one is
+		// the final outcome — render it as the step, keeping earlier attempts as
+		// status-only references.
+		const shaped = shapeStep(byIndex[byIndex.length - 1], opts)
+		shaped.attempts = byIndex.length
+		shaped.previous_attempts = byIndex.slice(0, -1).map((n) => ({
+			attempt: n.entry.sibling_index,
+			status: n.entry.status,
+			job_id: n.entry.job_id
+		}))
+		return shaped
+	}
+
+	// Loop-like fan-out (forloopflow, whileloopflow, aiagent actions, or any
+	// other multi-job step): tally statuses, show failed iterations (capped) and
+	// the latest one, elide the rest.
+	const ok = byIndex.filter((n) => n.entry.status === 'success').length
+	const failedNodes = byIndex.filter(
+		(n) => n.entry.status === 'failure' || n.entry.status === 'canceled'
+	)
+	const skipped = byIndex.filter((n) => n.entry.status === 'skipped').length
+	// skipped is terminal — only running/queued/suspended count as unfinished
+	const unfinished = byIndex.length - ok - failedNodes.length - skipped
+
+	const shown = failedNodes.slice(0, MAX_FAILED_ITERATIONS_SHOWN)
+	const last = byIndex[byIndex.length - 1]
+	if (!shown.includes(last)) {
+		shown.push(last)
+	}
+
+	return {
+		step: first.step_path ?? group.stepId,
+		type: first.parent_module_type || 'loop',
+		iterations: byIndex.length,
+		ok,
+		...(failedNodes.length > 0
+			? { failed_iterations: failedNodes.map((n) => n.entry.sibling_index) }
+			: {}),
+		...(skipped > 0 ? { skipped } : {}),
+		...(unfinished > 0 ? { unfinished } : {}),
+		iterations_shown: shown.map((n) => shapeStep(n, opts, n.entry.sibling_index)),
+		...(byIndex.length > shown.length ? { iterations_elided: byIndex.length - shown.length } : {})
+	}
+}
+
+function shapeChildren(children: FlowTreeNode[], opts: ShapeOpts): Record<string, any>[] {
+	return groupChildren(children).map((g) => shapeGroup(g, opts))
+}
+
+function renderTree(
+	root: FlowTreeNode,
+	rootJobNote: string | undefined,
+	opts: ShapeOpts
+): Record<string, any> {
+	const run = shapeStep(root, opts)
+	const steps = run.steps
+	delete run.steps
+	// The backend labels every depth-0 job "Flow"; correct that for the graceful
+	// non-flow case so the model doesn't mistake a plain script run for a flow.
+	if (!steps && root.entry.kind !== 'flow' && root.entry.kind !== 'flowpreview') {
+		run.label = `Job (${root.entry.kind})`
+	}
+	return {
+		...(rootJobNote ? { note: rootJobNote } : {}),
+		run,
+		...(steps ? { steps } : {}),
+		hint: `Results are truncated. Call get_flow_run_details again with step="<step>" (e.g. "b/c", or "b[12]" for one loop iteration) for a step's result in full (up to ${STEP_RESULT_MAX_CHARS} chars).`
+	}
+}
+
+/** Render the whole tree, shrinking result heads until it fits the budget. */
+export function shapeFlowRunTree(response: GetFlowAllResultsResponse): string {
+	const root = buildFlowTree(response.entries)
+	if (!root) {
+		return 'No jobs found for this run.'
+	}
+	const notes = [
+		...(response.enclosing_job
+			? [
+					`This job is a step of a larger flow run — its enclosing run is ${response.enclosing_job}; pass that id to see more of the tree.`
+				]
+			: []),
+		...(response.truncated
+			? [
+					`The run has more jobs than the server returns — this tree only covers the first ${response.entries.length} (depth-first), so tallies may undercount.`
+				]
+			: []),
+		...(response.scope_filtered
+			? [`Your token is tag-scoped: steps running on other tags are omitted from this tree.`]
+			: [])
+	]
+	const rootJobNote = notes.length > 0 ? notes.join(' ') : undefined
+
+	let rendered = ''
+	for (const opts of SHRINK_LADDER) {
+		rendered = JSON.stringify(renderTree(root, rootJobNote, opts), null, 1)
+		if (rendered.length <= TREE_TOTAL_BUDGET_CHARS) {
+			return rendered
+		}
+	}
+	return (
+		rendered.slice(0, TREE_TOTAL_BUDGET_CHARS) +
+		`\n… (tree truncated at ${TREE_TOTAL_BUDGET_CHARS} chars — drill into specific steps with the step parameter)`
+	)
+}
+
+/** Entry point of the get_flow_run_details tool. Without `step`: the compact
+ * tree. With `step`: that job's full (capped) result, resolved server-side. */
+export async function getFlowRunDetails(
+	workspace: string,
+	id: string,
+	step?: string
+): Promise<string> {
+	if (!step) {
+		return shapeFlowRunTree(
+			await JobService.getFlowAllResults({ workspace, id, maxResultLen: TREE_RESULT_HEAD_CHARS })
+		)
+	}
+
+	// Drill-down: the server resolves the address directly (a few indexed
+	// lookups, no tree enumeration) and returns the single job as an entry.
+	const response = await JobService.getFlowAllResults({
+		workspace,
+		id,
+		maxResultLen: STEP_RESULT_MAX_CHARS,
+		step
+	})
+	if (response.step_error) {
+		return (
+			response.step_error +
+			(response.scope_filtered
+				? ' (Steps running on tags outside your token’s scope are hidden.)'
+				: '')
+		)
+	}
+	const entry = response.entries[0]
+	if (!entry) {
+		return 'No jobs found for this run.'
+	}
+	if (entry.status === 'running' || entry.status === 'queued' || entry.status === 'suspended') {
+		return `Step "${step}" (job ${entry.job_id}) has not completed yet — status: ${entry.status}.`
+	}
+	if (entry.result_prefix === undefined || entry.result_prefix === null) {
+		return `Step "${step}" (job ${entry.job_id}, ${entry.status}) has no recorded result.`
+	}
+	const total = entry.result_length ?? countCodePoints(entry.result_prefix)
+	const capped =
+		total > countCodePoints(entry.result_prefix)
+			? entry.result_prefix + `\n… (result truncated: ${total} chars total)`
+			: entry.result_prefix
+	return `Step "${step}" (job ${entry.job_id}, ${entry.status}) result:\n${capped}`
+}
diff --git a/frontend/src/lib/components/copilot/chat/shared.ts b/frontend/src/lib/components/copilot/chat/shared.ts
index dcff212198..40bdcd9540 100644
--- a/frontend/src/lib/components/copilot/chat/shared.ts
+++ b/frontend/src/lib/components/copilot/chat/shared.ts
@@ -1508,10 +1508,14 @@ export function backgroundJobCompletionNote(
 ): string {
 	const status = job.success ? 'succeeded' : 'FAILED'
 	const resultHead = formattedResult ?? formatResult(job.result).slice(0, 2000)
+	const flowHint =
+		!job.success && (job.job_kind === 'flow' || job.job_kind === 'flowpreview')
+			? ` For per-step statuses and results call get_flow_run_details with id="${jobId}".`
+			: ''
 	return (
 		`Background job ${jobId} for "${label}" ${status}.\n` +
 		`Result: ${resultHead}\n` +
-		`(For full logs call get_job_logs with id="${jobId}".)`
+		`(For full logs call get_job_logs with id="${jobId}".${flowHint})`
 	)
 }
 
@@ -1589,7 +1593,16 @@ export async function executeTestRun(config: TestRunConfig): Promise<string> {
 			...(job.success ? {} : { error: getErrorMessage(job.result) })
 		})
 
-		return formatResultSummary(job.result, job.logs, job.success)
+		const summary = formatResultSummary(job.result, job.logs, job.success)
+		// get_flow_run_details only exists in the global/sessions chat (the same
+		// hosts that wire the job hooks) — don't advertise it to in-editor chats.
+		if (detachEnabled && config.contextName === 'flow' && !job.success) {
+			return (
+				summary +
+				`\n\nFor per-step statuses and results (subflow steps included), call get_flow_run_details with id="${jobId}".`
+			)
+		}
+		return summary
 	} catch (error) {
 		const errorMessage = error instanceof Error ? error.message : 'Unknown error occurred'
 		config.toolCallbacks.setToolStatus(config.toolId, {

From ac970efa1698e42ad1e7b3cea5f06f18a567269d Mon Sep 17 00:00:00 2001
From: Guilhem <guilhemlemouel@gmail.com>
Date: Tue, 28 Jul 2026 14:35:44 +0200
Subject: [PATCH 06/24] feat: bulk discard selected drafts on the compare &
 deploy page (#10372)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* feat(frontend): bulk discard selected drafts on the Compare & Deploy page

Add a destructive "Discard N drafts" button next to "Deploy N drafts" in
draft mode. A single confirmation modal lists draft-only items (permanent
deletions) by path before discarding sequentially with per-row status.

Split the selection gate into isDiscardable (own draft, not deployed this
session, not a data-pipeline bundle) and isDeployable (+ can_write): the
server lets you discard your own draft on a path you can no longer write
to, so each footer button counts its own eligible selection.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(frontend): address review findings on bulk draft discard

- invalidate the workspace-drafts resource once per batch instead of once
  per discarded row (discardDraft gains an invalidate opt-out)
- write-gate legacy (ownerless) drafts in isDiscardable + tooltips,
  mirroring the server's discard check
- explain diverging footer counts with a hint when selected drafts are
  discardable but not deployable
- update selection-contract comments left over from the deploy-only gate

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(frontend): cover shared-draft outcome in bulk discard modal + comment reflow

A draft-only item someone else also drafted is neither reverted nor
deleted — only the current user's draft is removed. Say so in the modal.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
---
 .../src/lib/components/CompareDrafts.svelte   | 216 ++++++++++++++----
 frontend/src/lib/utils_draft_deploy.ts        |  10 +-
 2 files changed, 180 insertions(+), 46 deletions(-)

diff --git a/frontend/src/lib/components/CompareDrafts.svelte b/frontend/src/lib/components/CompareDrafts.svelte
index 32be6caf35..65fe205046 100644
--- a/frontend/src/lib/components/CompareDrafts.svelte
+++ b/frontend/src/lib/components/CompareDrafts.svelte
@@ -22,7 +22,11 @@
 		draftBaseIsStale
 	} from '$lib/utils_draft_deploy'
 	import { checkDeployPermission, type DeployPermission } from '$lib/utils_workspace_deploy'
-	import { type DraftItem, useWorkspaceDrafts } from '$lib/workspaceDrafts.svelte'
+	import {
+		type DraftItem,
+		invalidateWorkspaceDrafts,
+		useWorkspaceDrafts
+	} from '$lib/workspaceDrafts.svelte'
 	import type { Kind as LayoutKind } from '$lib/utils_deployable'
 	import { userStore } from '$lib/stores'
 
@@ -44,8 +48,8 @@
 		draftCount?: number
 		/** When set (reached via a session's Review button), preselect only the
 		 * rows this chat modified — `${UserDraftItemKind}:${path}` keys, matching
-		 * Row.key. Undefined → preselect all deployable rows (the default). All rows
-		 * are still shown either way. */
+		 * Row.key. Undefined → preselect all actionable rows (the default). All
+		 * rows are still shown either way. */
 		chatMask?: Set<string>
 		/** False while the (async) chatMask is still loading. The select-all default
 		 * waits for this so it doesn't race the mask and select everything. Defaults
@@ -180,35 +184,45 @@
 		isFork && hideUnchanged ? items.filter((i) => i.unchanged_from_parent !== true) : items
 	)
 
-	// A row is actionable when it isn't already deployed this session, the user has
-	// write permission, AND it's their own draft (you can't deploy someone else's
-	// draft — those show view-only in the "all drafts" view). The server enforces
-	// the same; this keeps the UI honest. A data-pipeline bundle is never deployable
-	// from this page — its scripts deploy individually inside the pipeline view — so
-	// it's excluded from every selection path.
-	function isSelectable(item: Row): boolean {
+	// Selection gate: a row is actionable when it isn't already deployed this
+	// session AND it's the user's own draft (someone else's shows view-only in the
+	// "all drafts" view). A data-pipeline bundle is excluded — its scripts deploy
+	// individually inside the pipeline view. Every selectable row can at least be
+	// discarded: discarding your own email-scoped draft never needs write
+	// permission on the path — only legacy (ownerless) drafts stay write-gated,
+	// mirroring the server's discard check.
+	function isDiscardable(item: Row): boolean {
 		return (
 			deploymentStatus[item.key]?.status !== 'deployed' &&
-			item.can_write &&
 			item.mine &&
-			item.draftKind !== 'data_pipeline'
+			item.draftKind !== 'data_pipeline' &&
+			(!item.legacy_draft || item.can_write)
 		)
 	}
 
-	// Why a row can't be deployed (drives the disabled-checkbox tooltip).
-	// `undefined` ⇒ actionable.
+	// Deploying additionally requires write permission on the path, so the Deploy
+	// count can be lower than the selection when a drafted path lost writability.
+	function isDeployable(item: Row): boolean {
+		return isDiscardable(item) && item.can_write
+	}
+
+	// Why a row can't be selected (drives the disabled-checkbox tooltip).
+	// `undefined` ⇒ selectable.
 	function blockedReason(item: Row): string | undefined {
 		if (!item.mine) return 'This draft belongs to another user'
-		if (!item.can_write) return "You don't have write permission on this path"
+		if (item.legacy_draft && !item.can_write)
+			return 'Discarding a legacy draft requires write permission on the path'
 		return undefined
 	}
 
 	// Why a row can't be discarded (drives the Discard button's title).
-	// Discarding only removes the caller's own draft row, which they always own,
-	// so — unlike deploy — it never requires write permission on the path. The
-	// only block is someone else's draft (view-only in the "all drafts" view).
+	// Discarding only removes the caller's own draft row, so it doesn't require
+	// write permission on the path — except for legacy (ownerless) drafts, which
+	// the server write-gates like a deploy.
 	function discardBlockedReason(item: Row): string | undefined {
 		if (!item.mine) return 'This draft belongs to another user'
+		if (item.legacy_draft && !item.can_write)
+			return 'Discarding a legacy draft requires write permission on the path'
 		return undefined
 	}
 
@@ -290,8 +304,9 @@
 			if (ws === currentWorkspaceId) deployPerm = p
 		})
 	})
-	// Select all on the first non-empty load (deploy-all is the common intent);
-	// only once, so a refetch after a deploy doesn't re-select the leftovers.
+	// Select all on the first non-empty load (acting on everything is the common
+	// intent); only once, so a refetch after a deploy doesn't re-select the
+	// leftovers.
 	let hasAutoSelected = $state(false)
 
 	const deploymentStatus: Record<
@@ -314,9 +329,9 @@
 
 	$effect(() => {
 		if (!hasAutoSelected && chatMaskReady && visibleItems.length > 0) {
-			// Default intent is deploy-all; when reached from a session's Review
+			// Default intent is act-on-all; when reached from a session's Review
 			// (chatMask set), preselect only that chat's items instead.
-			const selectable = visibleItems.filter(isSelectable)
+			const selectable = visibleItems.filter(isDiscardable)
 			selectedItems = (
 				chatMask
 					? selectable.filter((i) =>
@@ -332,17 +347,24 @@
 		}
 	})
 
-	// Selected items still in the visible list and deployable. Derived (not a
-	// pruning effect) so the "Deploy N drafts" button stays reactive to the
-	// Workspace Drafts resource: deploy/discard drop items, and stale keys left in
-	// selectedItems are simply ignored here (and by deploySelected).
-	let selectedCount = $derived(
-		visibleItems.filter((i) => selectedItems.includes(i.key) && isSelectable(i)).length
+	// Selected items still in the visible list, per action. Derived (not a
+	// pruning effect) so the footer buttons stay reactive to the Workspace
+	// Drafts resource: deploy/discard drop items, and stale keys left in
+	// selectedItems are simply ignored here (and by the action handlers).
+	let deployableCount = $derived(
+		visibleItems.filter((i) => selectedItems.includes(i.key) && isDeployable(i)).length
 	)
+	let discardableCount = $derived(
+		visibleItems.filter((i) => selectedItems.includes(i.key) && isDiscardable(i)).length
+	)
+	// Selected rows the user can discard but not deploy (own draft on a path
+	// without write permission) — surfaced under the footer so the diverging
+	// button counts are explained.
+	let undeployableSelectedCount = $derived(discardableCount - deployableCount)
 
 	let allSelected = $derived(
-		visibleItems.filter(isSelectable).length > 0 &&
-			visibleItems.filter(isSelectable).every((i) => selectedItems.includes(i.key))
+		visibleItems.filter(isDiscardable).length > 0 &&
+			visibleItems.filter(isDiscardable).every((i) => selectedItems.includes(i.key))
 	)
 
 	function toggleItem(item: { key: string }) {
@@ -354,7 +376,7 @@
 	}
 
 	function selectAll() {
-		selectedItems = visibleItems.filter(isSelectable).map((i) => i.key)
+		selectedItems = visibleItems.filter(isDiscardable).map((i) => i.key)
 	}
 
 	function deselectAll() {
@@ -394,8 +416,8 @@
 		deploying = true
 		// Snapshot the items to deploy: deployDraft invalidates the Workspace Drafts
 		// resource, so `items` can change mid-loop — iterate a stable copy. Guard on
-		// isSelectable so a non-writable row can never be deployed via a stale key.
-		const toDeploy = visibleItems.filter((i) => selectedItems.includes(i.key) && isSelectable(i))
+		// isDeployable so a non-writable row can never be deployed via a stale key.
+		const toDeploy = visibleItems.filter((i) => selectedItems.includes(i.key) && isDeployable(i))
 		let deployedAny = false
 		for (const item of toDeploy) {
 			deploymentStatus[item.key] = { status: 'loading' }
@@ -470,6 +492,64 @@
 		if (item) void doDiscard(item)
 	}
 
+	// --- Bulk discard ---
+	// One click can drop many drafts at once, and some of them (draft_only with
+	// no other drafter) are permanent deletions — always confirm, listing the
+	// permanent ones explicitly.
+	let bulkDiscardItems = $state<Row[] | undefined>(undefined)
+	let discarding = $state(false)
+	const bulkPermanent = $derived((bulkDiscardItems ?? []).filter(isDestructiveDiscard))
+	// Third outcome the modal must cover: a draft-only item someone else also
+	// drafted isn't deleted — only this user's draft goes; the item survives via
+	// the other drafts.
+	const bulkSharedCount = $derived(
+		(bulkDiscardItems ?? []).filter((i) => i.draft_only && !isDestructiveDiscard(i)).length
+	)
+
+	function onDiscardSelectedClick() {
+		const toDiscard = visibleItems.filter((i) => selectedItems.includes(i.key) && isDiscardable(i))
+		if (toDiscard.length > 0) bulkDiscardItems = toDiscard
+	}
+
+	async function discardSelected(toDiscard: Row[]) {
+		discarding = true
+		let changed = false
+		for (const item of toDiscard) {
+			deploymentStatus[item.key] = { status: 'loading' }
+			// invalidate: false — one refetch after the whole batch (below), not
+			// one per row.
+			const res = await discardDraft(
+				item.draftKind,
+				item.path,
+				currentWorkspaceId,
+				item.draft_only,
+				item.legacy_draft,
+				false
+			)
+			if (res.success) {
+				changed = true
+				delete deploymentStatus[item.key]
+			} else {
+				deploymentStatus[item.key] = { status: 'failed', error: res.error }
+				sendUserToast(`Failed to discard ${item.path}: ${res.error}`, true)
+			}
+		}
+		discarding = false
+		selectedItems = []
+		if (changed) {
+			// Refetch the Draft list once for the batch, then refresh the fork
+			// comparison.
+			invalidateWorkspaceDrafts(currentWorkspaceId)
+			onChanged?.()
+		}
+	}
+
+	function confirmBulkDiscard() {
+		const toDiscard = bulkDiscardItems
+		bulkDiscardItems = undefined
+		if (toDiscard) void discardSelected(toDiscard)
+	}
+
 	// Editor URL for a draft item, scoped to the current workspace. Raw apps live
 	// under a different editor route, so map their kind accordingly. Kinds whose
 	// editor is a drawer on a list page (variables, resources, schedules,
@@ -559,7 +639,7 @@
 			{selectedItems}
 			{deploymentStatus}
 			{allSelected}
-			selectablePredicate={(item) => isSelectable(item as unknown as Row)}
+			selectablePredicate={(item) => isDiscardable(item as unknown as Row)}
 			selectBlockedReason={(item) => blockedReason(item as unknown as Row)}
 			onToggleItem={toggleItem}
 			onSelectAll={selectAll}
@@ -752,17 +832,34 @@
 
 			{#snippet footer()}
 				<div class="flex flex-col items-end gap-2">
-					<Button
-						variant="accent"
-						disabled={selectedCount === 0 || deploying || !deployPerm.ok}
-						title={!deployPerm.ok ? deployPerm.reason : undefined}
-						loading={deploying}
-						onClick={deploySelected}
-					>
-						Deploy {selectedCount} draft{selectedCount !== 1 ? 's' : ''}
-					</Button>
+					<div class="flex items-center gap-2">
+						<Button
+							variant="default"
+							destructive
+							disabled={discardableCount === 0 || deploying || discarding}
+							loading={discarding}
+							startIcon={{ icon: Undo2 }}
+							onClick={onDiscardSelectedClick}
+						>
+							Discard {discardableCount} draft{discardableCount !== 1 ? 's' : ''}
+						</Button>
+						<Button
+							variant="accent"
+							disabled={deployableCount === 0 || deploying || discarding || !deployPerm.ok}
+							title={!deployPerm.ok ? deployPerm.reason : undefined}
+							loading={deploying}
+							onClick={deploySelected}
+						>
+							Deploy {deployableCount} draft{deployableCount !== 1 ? 's' : ''}
+						</Button>
+					</div>
 					{#if !deployPerm.ok}
 						<span class="text-xs text-yellow-600">{deployPerm.reason}</span>
+					{:else if undeployableSelectedCount > 0}
+						<span class="text-xs text-secondary">
+							{undeployableSelectedCount} selected draft{undeployableSelectedCount !== 1 ? 's' : ''}
+							can't be deployed (no write permission on the path) but can still be discarded
+						</span>
 					{/if}
 				</div>
 			{/snippet}
@@ -772,6 +869,39 @@
 	<DiffDrawer bind:this={diffDrawer} {isFlow} />
 </div>
 
+<ConfirmationModal
+	open={bulkDiscardItems !== undefined}
+	title="Discard selected drafts"
+	confirmationText="Discard"
+	onConfirmed={confirmBulkDiscard}
+	onCanceled={() => (bulkDiscardItems = undefined)}
+>
+	<p>
+		This will discard {bulkDiscardItems?.length} draft{(bulkDiscardItems?.length ?? 0) !== 1
+			? 's'
+			: ''}. Items with a deployed version revert to it.
+	</p>
+	{#if bulkSharedCount > 0}
+		<p class="mt-2">
+			{bulkSharedCount} draft-only {bulkSharedCount === 1 ? 'item is' : 'items are'} also drafted by
+			other users: only your draft is removed and the {bulkSharedCount === 1 ? 'item' : 'items'} will
+			remain through theirs.
+		</p>
+	{/if}
+	{#if bulkPermanent.length > 0}
+		<p class="mt-2">
+			{bulkPermanent.length}
+			{bulkPermanent.length === 1 ? 'item exists' : 'items exist'} only as a draft and will be
+			<span class="font-semibold">permanently deleted</span>:
+		</p>
+		<ul class="list-disc list-inside font-mono text-xs mt-1">
+			{#each bulkPermanent as item (item.key)}
+				<li>{item.draft_path ?? item.path}</li>
+			{/each}
+		</ul>
+	{/if}
+</ConfirmationModal>
+
 <!-- Only the destructive discard (deleting the last draft of a never-deployed
      item) opens this modal; non-destructive discards run without confirmation. -->
 <ConfirmationModal
diff --git a/frontend/src/lib/utils_draft_deploy.ts b/frontend/src/lib/utils_draft_deploy.ts
index 514ce9cdb2..87baf2e5c7 100644
--- a/frontend/src/lib/utils_draft_deploy.ts
+++ b/frontend/src/lib/utils_draft_deploy.ts
@@ -712,7 +712,11 @@ export async function discardDraft(
 	path: string,
 	workspace: string,
 	_draftOnly = false,
-	legacy = false
+	legacy = false,
+	// Batch callers pass false and invalidate once after the last discard —
+	// per-item invalidation would refetch the whole draft list N times, with
+	// overlapping responses able to land out of order.
+	invalidate = true
 ): Promise<DeployResult> {
 	try {
 		if (legacy) {
@@ -723,7 +727,7 @@ export async function discardDraft(
 				requestBody: { value: null, legacy: true }
 			})
 			setLocalDraftHint(workspace, kind, path, false)
-			invalidateWorkspaceDrafts(workspace)
+			if (invalidate) invalidateWorkspaceDrafts(workspace)
 			return { success: true }
 		}
 		// postSave clears the syncer-owned `*` hint on the delete. `immediate`
@@ -731,7 +735,7 @@ export async function discardDraft(
 		// enqueue time and the invalidate below refetches before the delete,
 		// re-listing the just-discarded draft.
 		await UserDraftDbSyncer.save({ workspace, itemKind: kind, path, value: null, immediate: true })
-		invalidateWorkspaceDrafts(workspace)
+		if (invalidate) invalidateWorkspaceDrafts(workspace)
 		return { success: true }
 	} catch (e: any) {
 		return { success: false, error: e?.body ?? e?.message ?? String(e) }

From faf5aead6feb4cc2cddd48bae19d54b71999f730 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Tue, 28 Jul 2026 16:51:47 +0200
Subject: [PATCH 07/24] ci: run the SDK suites on release (#10386)

* ci: run the python and typescript SDK suites

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* ci: run the SDK suites on release tags only

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* chore(ci): state the constraint without the incident

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* docs(sdk): claim only what functools.wraps actually restores

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* docs(ci): note the interpreter the suite runs on is not the worker's

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .github/workflows/sdk-tests.yml     | 61 +++++++++++++++++++++++++++++
 python-client/wmill/wmill/client.py |  5 +++
 2 files changed, 66 insertions(+)
 create mode 100644 .github/workflows/sdk-tests.yml

diff --git a/.github/workflows/sdk-tests.yml b/.github/workflows/sdk-tests.yml
new file mode 100644
index 0000000000..efcbcd6ec1
--- /dev/null
+++ b/.github/workflows/sdk-tests.yml
@@ -0,0 +1,61 @@
+# The python and typescript SDK unit suites, on release tags only: they guard
+# what gets published to npm / PyPI / JSR, and a tag is the moment that decides
+# it.
+#
+# This runs alongside the publish workflows rather than ahead of them, so it
+# reports a broken SDK rather than holding one back. Gating would mean putting
+# the job inside each publish workflow, since Actions cannot express `needs`
+# across workflows.
+name: SDK Tests
+
+on:
+  workflow_dispatch:
+  push:
+    tags:
+      - "v*"
+
+jobs:
+  typescript-client:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+
+      # No build step: these suites are deliberately free of the generated API
+      # client, so they run against the sources as committed.
+      - name: Run tests
+        working-directory: ./typescript-client
+        run: bun test --timeout 120000 tests/
+
+  python-client:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup uv
+        uses: astral-sh/setup-uv@v5
+
+      # The interpreter is named explicitly: on a clean checkout uv picks the
+      # runner's system python and stops with "not compatible with the locked
+      # Python requirement" rather than fetching one. Keep in step with
+      # `requires-python` in uv.lock.
+      #
+      # Note this is not the version a worker runs the SDK on — those are 3.12.
+      # `uv.lock` asks for >=3.14, so pinning lower means regenerating it, which
+      # is worth doing separately.
+      - name: Install the interpreter the lockfile requires
+        run: uv python install 3.14
+
+      # `--frozen` so a drifted lockfile fails here rather than quietly
+      # resolving to something nobody has run.
+      - name: Run tests
+        working-directory: ./python-client/wmill
+        env:
+          PYTHONPATH: .
+        run: uv run --frozen --python 3.14 pytest tests/ -q
diff --git a/python-client/wmill/wmill/client.py b/python-client/wmill/wmill/client.py
index 05496f0724..230530fdab 100644
--- a/python-client/wmill/wmill/client.py
+++ b/python-client/wmill/wmill/client.py
@@ -3190,6 +3190,11 @@ def task(
                     merged[f"arg{i}"] = arg
             return merged
 
+        # Keeps the decorated function's identity: `@task` is applied to a
+        # top-level `async def`, and a caller introspecting it should see that
+        # function, not `wrapper`. The step key is computed from `func` above,
+        # so this does not affect dispatch.
+        @functools.wraps(func)
         def wrapper(*args, **kwargs):
             # WAC v2: inside a @workflow context
             ctx = _workflow_ctx.get(None)

From 3b95c947d4a82ea533f1966ddb559cae222f8181 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Tue, 28 Jul 2026 16:54:40 +0200
Subject: [PATCH 08/24] test(wac): pin the failure record with one corpus both
 SDKs read (#10385)

* test(wac): pin the failure record with one corpus both SDKs read

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* test(wac): add the behaviour matrix that verified the failure record

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* docs(wac): record how to exercise an unreleased SDK change

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix(wac): guard the whole extra pair, not just its value

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix(wac): never rehash an untrusted extra key

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix(wac): walk only a real __dict__ when collecting extra

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* docs(wac): name the divergence the corpus cannot pin

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* chore(wac): state the extra-encoding constraints in four lines

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 AGENTS.md                                     |   1 +
 .../src/wac_failure_corpus.json               | 108 +++++++++++++++++
 docs/wac-sdk-e2e.md                           |  68 +++++++++++
 python-client/wmill/tests/test_workflow.py    | 110 ++++++++++++++++++
 python-client/wmill/wmill/client.py           |  53 +++++----
 typescript-client/tests/workflow.test.ts      |  36 +++++-
 typescript-client/wacError.ts                 |   4 +-
 7 files changed, 350 insertions(+), 30 deletions(-)
 create mode 100644 backend/windmill-common/src/wac_failure_corpus.json
 create mode 100644 docs/wac-sdk-e2e.md

diff --git a/AGENTS.md b/AGENTS.md
index d7ebf2452d..90c0060ae2 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -12,6 +12,7 @@ Open-source platform for internal tools, workflows, API integrations, background
 ## Documentation
 
 - **Validation**: `docs/validation.md` — what checks to run based on what you changed
+- **Unreleased SDK changes**: `docs/wac-sdk-e2e.md` — exercising a client change on a real worker
 - **Enterprise**: `docs/enterprise.md` — EE file conventions and PR workflow
 - **Backend patterns**: use the `rust-backend` skill when writing Rust code
 - **Frontend patterns**: use the `svelte-frontend` skill when writing Svelte code. Do NOT edit svelte files unless you have read that skill.
diff --git a/backend/windmill-common/src/wac_failure_corpus.json b/backend/windmill-common/src/wac_failure_corpus.json
new file mode 100644
index 0000000000..e4498159cd
--- /dev/null
+++ b/backend/windmill-common/src/wac_failure_corpus.json
@@ -0,0 +1,108 @@
+{
+  "_readme": [
+    "Cases the python and the typescript SDK must both satisfy when they serialize",
+    "a failed step() body into a `__wmill_error` marker.",
+    "",
+    "The two drifted apart twice while #10368 was in review: `name` was taken from",
+    "the constructor in one client and from `e.name` in the other, and `stack` was",
+    "written in two different formats. Each was caught by a reviewer reading the",
+    "diff, not by a test, because each suite only ever checked its own language.",
+    "A shared corpus turns the next divergence into a failure in both suites.",
+    "",
+    "It sits next to `wac_failure_record`, the function that decides the record's",
+    "final shape, because that is the contract these markers are the raw material",
+    "for. The SDK test suites read it by relative path.",
+    "",
+    "`thrown` describes a value each language constructs natively:",
+    "  name           the name the record must report",
+    "  message        the message the record must report",
+    "  props          own properties/attributes that must reach `extra`",
+    "  circular_prop  an own property holding a cycle, which must be dropped",
+    "                 without taking the rest of `extra` with it",
+    "`expect.stack` is only \"present\" or \"absent\": its text is language-specific",
+    "(each client matches its own executor's format) and is asserted there.",
+    "",
+    "Known divergence, deliberately not covered here: a non-finite float reaches",
+    "`extra` as the string \"NaN\" in python and as null in typescript, because",
+    "JSON.stringify has no hook for it. The executors differ the same way.",
+    "",
+    "Second known divergence, also not covered: an attribute named like a field",
+    "the executors report separately \u2014 `name`, `message`, `stack` \u2014 reaches",
+    "`extra` in python and not in typescript. Each client mirrors its own",
+    "executor, which differ the same way: the python one copies `__dict__`",
+    "wholesale, the bun/deno one filters that skip-list out."
+  ],
+  "cases": [
+    {
+      "case": "a named error keeps its name and message",
+      "thrown": {
+        "name": "HttpError",
+        "message": "429 too many requests"
+      },
+      "expect": {
+        "name": "HttpError",
+        "message": "429 too many requests",
+        "stack": "present",
+        "absent": [
+          "extra"
+        ]
+      }
+    },
+    {
+      "case": "custom properties reach extra",
+      "thrown": {
+        "name": "HttpError",
+        "message": "429",
+        "props": {
+          "code": 429,
+          "retry_after": 5,
+          "endpoint": "/v1/jobs"
+        }
+      },
+      "expect": {
+        "name": "HttpError",
+        "message": "429",
+        "stack": "present",
+        "extra": {
+          "code": 429,
+          "retry_after": 5,
+          "endpoint": "/v1/jobs"
+        }
+      }
+    },
+    {
+      "case": "a property that cannot be serialized is dropped on its own",
+      "thrown": {
+        "name": "RequestError",
+        "message": "socket hang up",
+        "props": {
+          "code": "ECONNRESET"
+        },
+        "circular_prop": "request"
+      },
+      "expect": {
+        "name": "RequestError",
+        "message": "socket hang up",
+        "stack": "present",
+        "extra": {
+          "code": "ECONNRESET"
+        }
+      }
+    },
+    {
+      "case": "an error carrying nothing of its own has no extra",
+      "thrown": {
+        "name": "ValueError",
+        "message": "nope"
+      },
+      "expect": {
+        "name": "ValueError",
+        "message": "nope",
+        "stack": "present",
+        "absent": [
+          "extra"
+        ]
+      }
+    }
+  ]
+}
diff --git a/docs/wac-sdk-e2e.md b/docs/wac-sdk-e2e.md
new file mode 100644
index 0000000000..5c6682d93d
--- /dev/null
+++ b/docs/wac-sdk-e2e.md
@@ -0,0 +1,68 @@
+# Exercising an unreleased SDK change end to end
+
+A job installs the **published** `windmill-client` / `wmill`, so a change in this
+repo is invisible to a real job until it is injected into the worker's dependency
+cache. The SDK unit suites cover neither the worker nor the SDK the worker
+installs, and that gap is where the Workflow-as-Code failure contract kept coming
+apart: every finding behind #10366, #10367 and #10368 came from review or from a
+run like the one below, never from a green suite.
+
+## Recipe
+
+Use a private `WINDMILL_DIR`. `/tmp/windmill/` is shared by every worktree's
+backend, so patching it in place leaks a modified SDK into other people's jobs.
+
+```bash
+# Run from the repository root. The backend holds a terminal of its own; every
+# other command is a subshell, so nothing depends on where the last one left you.
+
+# 1. a backend of your own, with its own cache root — in its own terminal
+(cd backend && DATABASE_URL=... PORT=8062 WINDMILL_DIR=/tmp/windmill-mytest \
+   cargo run --features quickjs)          # add ,python to run python jobs
+
+# 2. one job to populate the cache with the published SDK
+#    (any preview job importing the client will do)
+
+# 3. build the client and overwrite what the cache holds
+C=$(echo /tmp/windmill-mytest/cache_nomount/bun/windmill-client@*@@@1)
+(cd typescript-client && ./build.sh && npx tsdown --format esm --no-dts \
+   && cp dist/index.mjs "$C/dist/index.mjs" \
+   && cp dist/index.mjs "$C/dist/client.mjs")   # code-split package: cover both
+
+# python instead: copy the source file straight over, then drop the bytecode
+cp python-client/wmill/wmill/client.py \
+   /tmp/windmill-mytest/cache/python_3_12/wmill==*/wmill/client.py
+find /tmp/windmill-mytest -name __pycache__ -type d -exec rm -rf {} +
+
+# 4. RESTART the backend — see below
+# 5. run your scenarios, and rm -rf /tmp/windmill-mytest when done
+```
+
+## Restart the workers after injecting
+
+A worker materializes the package once and keeps using its copy, so patching the
+cache under a running backend leaves some workers on the old code. With more than
+one worker the results then **alternate run to run** as jobs land on one worker or
+the other, which reads like flakiness in the product rather than in the harness.
+Restarting after the swap makes it deterministic.
+
+Symptom worth recognising: identical jobs returning two different answers in a
+stable pattern, with each run internally consistent.
+
+## Run your scenarios twice
+
+Once against the published SDK, once against the injected one. A scenario that
+behaves the same either way is not testing what you think it is, and it is easy
+to write several of those without noticing.
+
+As a calibration: a spread of WAC scenarios written this way scored 10/17 (bun)
+and 7/18 (python) against the published SDK and 17/17 and 18/18 against a client
+carrying #10366, #10367 and #10368. The ones that did not move were covering
+behaviour those PRs never touched — worth knowing before concluding that a green
+run means anything.
+
+## Worth covering, and easy to miss
+
+The deno path, `taskScript` / `taskFlow`, `waitForApproval`, and failures
+interleaved with parallelism. None of these were exercised while the failure
+record was being unified.
diff --git a/python-client/wmill/tests/test_workflow.py b/python-client/wmill/tests/test_workflow.py
index 3f80fb06b3..f0b9d4b801 100644
--- a/python-client/wmill/tests/test_workflow.py
+++ b/python-client/wmill/tests/test_workflow.py
@@ -2,6 +2,7 @@
 
 import asyncio
 import json
+import pathlib
 import pytest
 
 from datetime import datetime, timezone
@@ -9,6 +10,16 @@ from datetime import datetime, timezone
 from wmill.client import WorkflowCtx, _StepSuspend, TaskError, workflow, task, step, sleep, parallel, wait_for_approval, _run_workflow, _run_workflow_async
 
 
+class _FakeItems(dict):
+    """A mapping whose ``items()`` yields something that is not a key/value pair."""
+
+    def __bool__(self):
+        return True
+
+    def items(self):
+        return [None]
+
+
 class _StubInlineClient:
     """Stands in for the httpx client the inline fast path POSTs with.
 
@@ -968,6 +979,59 @@ class TestErrorPropagation:
         assert "step failed" in r["result"]["caught"]
 
 
+class TestFailureRecordCorpus:
+    """The cases both SDKs must agree on, from the corpus the typescript suite
+    also reads. Its `_readme` states the contract and why it is shared."""
+
+    CORPUS = json.loads(
+        (
+            pathlib.Path(__file__).resolve().parents[3]
+            / "backend/windmill-common/src/wac_failure_corpus.json"
+        ).read_text()
+    )
+
+    @staticmethod
+    def _construct(spec: dict) -> BaseException:
+        exc = type(spec["name"], (Exception,), {})(spec["message"])
+        for key, value in (spec.get("props") or {}).items():
+            setattr(exc, key, value)
+        if spec.get("circular_prop"):
+            cyclic: dict = {}
+            cyclic["self"] = cyclic
+            setattr(exc, spec["circular_prop"], cyclic)
+        return exc
+
+    @pytest.mark.parametrize("case", CORPUS["cases"], ids=lambda c: c["case"])
+    def test_marker_matches_the_shared_contract(self, case):
+        exc = self._construct(case["thrown"])
+
+        def raiser():
+            raise exc
+
+        # through the real step path, so the stack is the one a failure actually
+        # records rather than one this test happens to construct
+        async def run():
+            ctx = WorkflowCtx({})
+            try:
+                await ctx._run_inline_step("k", raiser)
+            except _StepSuspend as suspended:
+                return suspended.dispatch_info["result"]
+            raise AssertionError("a raising step did not suspend")
+
+        error = asyncio.run(run())["result"]["error"]
+
+        expect = case["expect"]
+        assert error["name"] == expect["name"]
+        assert error["message"] == expect["message"]
+        assert ("stack" in error) == (expect["stack"] == "present")
+        if "extra" in expect:
+            assert error["extra"] == expect["extra"]
+        for absent in expect.get("absent", []):
+            assert absent not in error
+        # whatever it kept has to survive the trip to the checkpoint
+        json.dumps(error, allow_nan=False)
+
+
 class TestRaisingInlineStepIsCheckpointed:
     """A ``step()`` whose body raises must still land in ``completed_steps``.
 
@@ -1092,6 +1156,52 @@ class TestRaisingInlineStepIsCheckpointed:
         _json.dumps(marker)
         assert marker["result"]["error"]["name"] == "HostileDict"
 
+        # ...or an overridden __dict__, whatever shape it takes
+        class NotAMapping(Exception):
+            @property
+            def __dict__(self):
+                return "definitely not a mapping"
+
+        marker = _step_error_marker("k", NotAMapping())
+        _json.dumps(marker)
+        assert marker["result"]["error"]["name"] == "NotAMapping"
+
+        class YieldsNonPairs(Exception):
+            @property
+            def __dict__(self):
+                return _FakeItems()
+
+        marker = _step_error_marker("k", YieldsNonPairs())
+        _json.dumps(marker)
+        assert marker["result"]["error"]["name"] == "YieldsNonPairs"
+
+        class OddKey(Exception):
+            def __init__(self):
+                super().__init__("boom")
+                self.code = 429
+
+        odd = OddKey()
+        odd.__dict__[(1, 2)] = "tuple key"
+        marker = _step_error_marker("k", odd)
+        _json.dumps(marker)  # a surviving tuple key would raise here
+        assert marker["result"]["error"]["extra"] == {"code": 429}
+
+        class ExplodingKey:
+            def __init__(self):
+                self.hashed = 0
+
+            def __hash__(self):
+                self.hashed += 1
+                if self.hashed > 1:
+                    raise RuntimeError("second hash")
+                return 1
+
+        exploding = OddKey()
+        exploding.__dict__[ExplodingKey()] = "x"
+        marker = _step_error_marker("k", exploding)
+        _json.dumps(marker)
+        assert marker["result"]["error"]["extra"] == {"code": 429}
+
         # A float is serializable, so `default=` never sees NaN — it would go out
         # as a bare `NaN` literal, which is not JSON and which the backend
         # rejects, so the step could not be checkpointed at all.
diff --git a/python-client/wmill/wmill/client.py b/python-client/wmill/wmill/client.py
index 230530fdab..01589d4ef7 100644
--- a/python-client/wmill/wmill/client.py
+++ b/python-client/wmill/wmill/client.py
@@ -2772,33 +2772,36 @@ def _step_error_marker(key: str, exc: BaseException) -> dict:
     # there is — ``resp.raise_for_status()``, whose ``__dict__`` holds a request
     # and a response object — would otherwise fail to serialize and silently
     # drop every such failure onto the slow suspend-and-replay path.
-    # ``getattr``'s default only swallows ``AttributeError``; an exception
-    # overriding ``__getattribute__`` raises whatever it likes from this read.
+    # Everything about the failing exception can fight back, and this runs inside
+    # the ``except`` reporting it, so an escape replaces the user's error and
+    # skips the checkpoint. Only a genuine ``dict`` is walked: an overridden
+    # ``__dict__`` can raise on access, on ``.items()``, or yield non-pairs.
     try:
-        extra = getattr(exc, "__dict__", None)
+        _raw_extra = getattr(exc, "__dict__", None)
     except Exception:
-        extra = None
-    if extra:
-        # ``default`` is where json hands back the objects it cannot represent,
-        # and ``str()`` on a detached ORM row or a proxy over a closed
-        # connection raises in turn. This runs inside the ``except`` that is
-        # reporting the user's failure, so an escape here would replace their
-        # error with an unrelated one and skip the checkpoint entirely.
-        # Narrow: what json raises for something it cannot represent. A broader
-        # catch would hide a mistake in this function as a silently missing
-        # field, which is how it read before.
-        try:
-            # ``parse_constant`` catches the one thing ``default`` cannot: a
-            # float is serializable, so ``NaN``/``Infinity`` pass through as
-            # bare literals that are not JSON and that the backend's extractor
-            # rejects — taking the whole checkpoint down with them. Kept as
-            # their text rather than dropped, so the attribute still says
-            # something.
-            error["extra"] = json.loads(
-                json.dumps(extra, default=_safe_str), parse_constant=lambda c: c
-            )
-        except (TypeError, ValueError, RecursionError):
-            pass
+        _raw_extra = None
+    if type(_raw_extra) is dict and _raw_extra:
+        safe_extra = {}
+        for _k, _v in _raw_extra.items():
+            # Rebuilding the pair hashes the key again, so only the types json
+            # can represent, and exactly those: a subclass may define __hash__.
+            if type(_k) not in (str, int, float, bool, type(None)):
+                continue
+            # Per attribute so one bad value cannot take the rest, and as a pair
+            # so an int/bool/None key arrives as the string a replay reads.
+            # ``parse_constant`` catches what ``default`` cannot: a float is
+            # serializable, so NaN/Infinity would go out as invalid JSON.
+            try:
+                safe_extra.update(
+                    json.loads(
+                        json.dumps({_k: _v}, default=_safe_str),
+                        parse_constant=lambda c: c,
+                    )
+                )
+            except (TypeError, ValueError, RecursionError):
+                pass
+        if safe_extra:
+            error["extra"] = safe_extra
     return {
         "__wmill_error": True,
         "message": _safe_str(exc),
diff --git a/typescript-client/tests/workflow.test.ts b/typescript-client/tests/workflow.test.ts
index 179244314b..08a817bc54 100644
--- a/typescript-client/tests/workflow.test.ts
+++ b/typescript-client/tests/workflow.test.ts
@@ -5,11 +5,41 @@
  */
 import { expect, test, describe } from "bun:test";
 
-// The two functions that decide what a caught failure looks like come from the
-// shipped module, not from the mirror below: they are what drifted from the
-// backend's shape before, so a copy of them here would guard nothing.
+// From the shipped module, not the mirror below: these decide what a caught
+// failure looks like and what is the SDK's own control flow, so a copy here
+// would guard nothing.
 import { isSuspendSignal, stepErrorMarker, taskErrorFromMarker } from "../wacError";
 
+// The cases both SDKs must agree on, from the corpus the python suite also
+// reads. Its `_readme` states the contract and why it is shared.
+import corpus from "../../backend/windmill-common/src/wac_failure_corpus.json";
+
+describe("shared failure-record corpus", () => {
+  const construct = (spec: any): any => {
+    const e: any = Object.assign(new Error(spec.message), { name: spec.name });
+    for (const [k, v] of Object.entries(spec.props ?? {})) e[k] = v;
+    if (spec.circular_prop) {
+      const cyclic: any = {};
+      cyclic.self = cyclic;
+      e[spec.circular_prop] = cyclic;
+    }
+    return e;
+  };
+
+  for (const c of (corpus as any).cases) {
+    test(c.case, () => {
+      const error = stepErrorMarker("k", construct(c.thrown)).result.error;
+      expect(error.name).toBe(c.expect.name);
+      expect(error.message).toBe(c.expect.message);
+      expect("stack" in error).toBe(c.expect.stack === "present");
+      if (c.expect.extra) expect(error.extra).toEqual(c.expect.extra);
+      for (const absent of c.expect.absent ?? []) expect(absent in error).toBe(false);
+      // whatever it kept has to survive the trip to the checkpoint
+      expect(() => JSON.stringify(error)).not.toThrow();
+    });
+  }
+});
+
 // --- Inline SDK (mirrors client.ts implementation) ---
 
 class StepSuspend extends Error {
diff --git a/typescript-client/wacError.ts b/typescript-client/wacError.ts
index 025de78a7b..4145630565 100644
--- a/typescript-client/wacError.ts
+++ b/typescript-client/wacError.ts
@@ -3,8 +3,8 @@
 // Deliberately dependency-free so the tests can import it directly: the rest of
 // client.ts pulls in the generated API modules, which is why the workflow test
 // suite re-implements WorkflowCtx inline. What a caught failure looks like, and
-// what is a failure at all rather than the SDK's own control flow, is decided
-// here — so it is decided against the shipped code rather than against a copy.
+// what counts as a failure rather than the SDK's own control flow, is decided
+// here, against the shipped code rather than a copy of it.
 
 /** Error properties the executors already report as named fields, so they must
  *  not be repeated inside `extra`. Kept identical to the skip-list in the

From 773a428ad0f91a4f608dffc00b3cb3ce786aaa00 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Tue, 28 Jul 2026 17:43:36 +0200
Subject: [PATCH 09/24] chore(main): release 1.774.0 (#10365)

* chore(main): release 1.774.0

* Apply automatic changes

---------

Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com>
---
 CHANGELOG.md                                  |  31 ++++
 backend/Cargo.lock                            | 158 +++++++++---------
 backend/Cargo.toml                            |   4 +-
 .../parsers/windmill-parser-wasm/Cargo.lock   |  48 +++---
 .../parsers/windmill-parser-wasm/Cargo.toml   |   2 +-
 backend/windmill-api/openapi.yaml             |   2 +-
 benchmarks/lib.ts                             |   2 +-
 cli/src/core/constants.ts                     |   2 +-
 frontend/package-lock.json                    |   4 +-
 frontend/package.json                         |   2 +-
 lsp/Pipfile                                   |   2 +-
 openflow.openapi.yaml                         |   2 +-
 .../WindmillClient/WindmillClient.psd1        |   2 +-
 python-client/wmill/pyproject.toml            |   2 +-
 typescript-client/jsr.json                    |   2 +-
 typescript-client/package.json                |   2 +-
 version.txt                                   |   2 +-
 17 files changed, 150 insertions(+), 119 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 24b4b0cc25..fdcf834d59 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,36 @@
 # Changelog
 
+## [1.774.0](https://github.com/windmill-labs/windmill/compare/v1.773.0...v1.774.0) (2026-07-28)
+
+
+### Features
+
+* **ai-chat:** add get_flow_run_details tool for per-step flow run results ([#10374](https://github.com/windmill-labs/windmill/issues/10374)) ([c12e7c3](https://github.com/windmill-labs/windmill/commit/c12e7c34310b417e89f94efc3c412b3c7278344b))
+* **ai-chat:** recall queued/last message into the composer ([#10191](https://github.com/windmill-labs/windmill/issues/10191)) ([ad0fef4](https://github.com/windmill-labs/windmill/commit/ad0fef4a2e0ea63ae00562ff10d9ebbae66c42d0))
+* bulk discard selected drafts on the compare & deploy page ([#10372](https://github.com/windmill-labs/windmill/issues/10372)) ([ac970ef](https://github.com/windmill-labs/windmill/commit/ac970efa1698e42ad1e7b3cea5f06f18a567269d))
+* reusable AI agent steps with rigid linking and edit/fork ([#9825](https://github.com/windmill-labs/windmill/issues/9825)) ([3b95a2d](https://github.com/windmill-labs/windmill/commit/3b95a2d0967544640feb53fe962a8215e049f4d2))
+
+
+### Bug Fixes
+
+* **ai-agent:** keep tool description through flow deployment ([#10373](https://github.com/windmill-labs/windmill/issues/10373)) ([8d684c0](https://github.com/windmill-labs/windmill/commit/8d684c0b2305798a781685ca022b1b9dc0731cf0))
+* **ai-chat:** make hub script paths readable from the global chat ([#10381](https://github.com/windmill-labs/windmill/issues/10381)) ([5feec9b](https://github.com/windmill-labs/windmill/commit/5feec9b4cd3cdd4eed3edf5be0fc42dabfeb13d2))
+* **ai:** resolve deployment-pinned Azure base URLs to the v1 surface ([#10362](https://github.com/windmill-labs/windmill/issues/10362)) ([621718b](https://github.com/windmill-labs/windmill/commit/621718b32fe5322638039d4a560b845e11b38008))
+* **apps:** stop cross-origin isolating the raw app viewer ([#10370](https://github.com/windmill-labs/windmill/issues/10370)) ([3c2dab9](https://github.com/windmill-labs/windmill/commit/3c2dab9f8f302e2f80ef800a4271bfe5aa152767))
+* **datatable:** provision the replication user on managed postgres ([#10375](https://github.com/windmill-labs/windmill/issues/10375)) ([1b6b2aa](https://github.com/windmill-labs/windmill/commit/1b6b2aa8598100b5327ecc3e16f1541db95f9e47))
+* **frontend:** preserve top-level flow settings in AI flow tools ([#10369](https://github.com/windmill-labs/windmill/issues/10369)) ([a544dfd](https://github.com/windmill-labs/windmill/commit/a544dfde9a5f409247e78ef1c1aac2b9699d9ac8))
+* home kind filter no longer resets a fork or reloads the page ([#10384](https://github.com/windmill-labs/windmill/issues/10384)) ([2a2ef41](https://github.com/windmill-labs/windmill/commit/2a2ef411525f032743af93f143c10ad373c20fc8))
+* loop "Test an iteration" progress bar, while-loop modules and schema ([#10357](https://github.com/windmill-labs/windmill/issues/10357)) ([350eb66](https://github.com/windmill-labs/windmill/commit/350eb66560d2626c4100a21edb2101cdfa4a0a72))
+* make same worker mutually exclusive with retries and sleeps in the flow editor ([#10379](https://github.com/windmill-labs/windmill/issues/10379)) ([ecde945](https://github.com/windmill-labs/windmill/commit/ecde94567c5ec43002a06d2d765927e0d89640a4))
+* mark Setup URL as required in self-managed GitHub App instructions ([#10380](https://github.com/windmill-labs/windmill/issues/10380)) ([c4e7568](https://github.com/windmill-labs/windmill/commit/c4e75683a8a346f4cb39038f3045c94f3a9621b2))
+* raw apps with no stylesheet were permanently un-deployable ([#10364](https://github.com/windmill-labs/windmill/issues/10364)) ([8a96e3a](https://github.com/windmill-labs/windmill/commit/8a96e3a4ec47c0a28dd422b31388f7f0cced8e67))
+* show draft badge and disable the toggle for draft-only triggers ([#10155](https://github.com/windmill-labs/windmill/issues/10155)) ([b0c7e09](https://github.com/windmill-labs/windmill/commit/b0c7e0917376248cda0f894b138075d82f19f620))
+* surface postgres publication errors as 400 instead of 500 ([#10376](https://github.com/windmill-labs/windmill/issues/10376)) ([5e52346](https://github.com/windmill-labs/windmill/commit/5e523462423f73419df25e4d7aa1cd2e77c0228a))
+* surface the real postgres error when data table migrations fail ([#10371](https://github.com/windmill-labs/windmill/issues/10371)) ([fbf9f04](https://github.com/windmill-labs/windmill/commit/fbf9f04e107c674474f61c1559a2f1e56dfeeaba))
+* **wac:** one failure record for tasks and steps, in every round ([#10368](https://github.com/windmill-labs/windmill/issues/10368)) ([aeaea57](https://github.com/windmill-labs/windmill/commit/aeaea57ca1a0fac02157035530e84c3588a7aec1))
+* **wac:** report a task failure the child round's body catches ([#10366](https://github.com/windmill-labs/windmill/issues/10366)) ([727d22b](https://github.com/windmill-labs/windmill/commit/727d22b9a1f9520788afb9b519be8fcd8fd64319))
+* **wac:** return the checkpointed value from step(), not the live object ([#10367](https://github.com/windmill-labs/windmill/issues/10367)) ([044ce39](https://github.com/windmill-labs/windmill/commit/044ce39e5f9c8207287e19a0d2eefa22b79188f2))
+
 ## [1.773.0](https://github.com/windmill-labs/windmill/compare/v1.772.0...v1.773.0) (2026-07-27)
 
 
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index d7f7f16891..51c2338ec8 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -14489,7 +14489,7 @@ dependencies = [
 
 [[package]]
 name = "windmill"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -14574,7 +14574,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-ai"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "async-stream",
  "async-trait",
@@ -14607,7 +14607,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-alerting"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14620,7 +14620,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "argon2",
@@ -14759,7 +14759,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-agent-workers"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14782,7 +14782,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-assets"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14797,7 +14797,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-auth"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14823,7 +14823,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-client"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "reqwest 0.12.28",
  "serde",
@@ -14833,7 +14833,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-configs"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14850,7 +14850,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-debug"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "axum 0.8.9",
  "base64 0.22.1",
@@ -14872,7 +14872,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-embeddings"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14895,7 +14895,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flow-conversations"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14911,7 +14911,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flows"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14932,7 +14932,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-groups"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14953,7 +14953,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-inputs"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14967,7 +14967,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-integration-tests"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -15002,7 +15002,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-jobs"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15027,7 +15027,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-npm-proxy"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "axum 0.8.9",
  "flate2",
@@ -15045,7 +15045,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-openapi"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15067,7 +15067,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-schedule"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15087,7 +15087,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-scripts"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15124,7 +15124,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-settings"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15152,7 +15152,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-sse"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "lazy_static",
  "serde",
@@ -15164,7 +15164,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-users"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "argon2",
  "axum 0.8.9",
@@ -15189,7 +15189,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workers"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15203,7 +15203,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workspaces"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15238,7 +15238,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-audit"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "chrono",
  "lazy_static",
@@ -15252,7 +15252,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-autoscaling"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15271,7 +15271,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-common"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "aes-gcm",
  "aho-corasick",
@@ -15375,7 +15375,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-dep-map"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "chrono",
  "itertools 0.14.0",
@@ -15394,7 +15394,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-git-sync"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "regex",
  "serde",
@@ -15409,7 +15409,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-indexer"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "astral-tokio-tar",
@@ -15433,7 +15433,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-jseval"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "futures",
@@ -15450,7 +15450,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "itertools 0.14.0",
  "lazy_static",
@@ -15466,7 +15466,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-mcp"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15487,7 +15487,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-native-triggers"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15518,7 +15518,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-oauth"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "arc-swap",
@@ -15543,7 +15543,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-object-store"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "async-stream",
@@ -15577,7 +15577,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-operator"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "futures",
@@ -15595,7 +15595,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "convert_case 0.6.0",
  "serde",
@@ -15604,7 +15604,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15616,7 +15616,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15628,7 +15628,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -15640,7 +15640,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15652,7 +15652,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15664,7 +15664,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -15675,7 +15675,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15686,7 +15686,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15698,7 +15698,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -15709,7 +15709,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15731,7 +15731,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15743,7 +15743,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15757,7 +15757,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "convert_case 0.6.0",
@@ -15774,7 +15774,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15787,7 +15787,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -15799,7 +15799,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15817,7 +15817,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -15833,7 +15833,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -15849,7 +15849,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -15860,7 +15860,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-queue"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15899,7 +15899,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-runtime-nativets"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "const_format",
@@ -15939,7 +15939,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-sql-datatype-parser-wasm"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "getrandom 0.3.4",
  "wasm-bindgen",
@@ -15950,7 +15950,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-store"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15984,7 +15984,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-test-utils"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16008,7 +16008,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16041,7 +16041,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-amqp"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16068,7 +16068,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-azure"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16101,7 +16101,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-email"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16121,7 +16121,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-gcp"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16155,7 +16155,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-http"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16191,7 +16191,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-kafka"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16214,7 +16214,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-mqtt"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16238,7 +16238,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-nats"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -16262,7 +16262,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-postgres"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16297,7 +16297,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-sqs"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16325,7 +16325,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-websocket"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16350,7 +16350,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "bitflags 2.13.1",
@@ -16369,7 +16369,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "async-once-cell",
@@ -16484,7 +16484,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker-volumes"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "bytes",
  "futures",
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index 6ab31d6809..27421f1052 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.773.0"
+version = "1.774.0"
 authors.workspace = true
 edition.workspace = true
 
@@ -88,7 +88,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal", "./parsers/windmill-parser-wasm"]
 
 [workspace.package]
-version = "1.773.0"
+version = "1.774.0"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.lock b/backend/parsers/windmill-parser-wasm/Cargo.lock
index 193a97ed0e..1c110c1a3a 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.lock
+++ b/backend/parsers/windmill-parser-wasm/Cargo.lock
@@ -6191,7 +6191,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windmill-common"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "aho-corasick",
  "anyhow",
@@ -6272,7 +6272,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -6284,7 +6284,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "convert_case",
  "serde",
@@ -6293,7 +6293,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6305,7 +6305,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6317,7 +6317,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -6329,7 +6329,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6341,7 +6341,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6353,7 +6353,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -6364,7 +6364,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6375,7 +6375,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6387,7 +6387,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6398,7 +6398,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -6420,7 +6420,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6432,7 +6432,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6446,7 +6446,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "convert_case",
@@ -6463,7 +6463,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6476,7 +6476,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -6488,7 +6488,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6506,7 +6506,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -6522,7 +6522,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6538,7 +6538,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wasm"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "getrandom 0.2.17",
@@ -6570,7 +6570,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -6581,7 +6581,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.773.0"
+version = "1.774.0"
 dependencies = [
  "anyhow",
  "bitflags",
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.toml b/backend/parsers/windmill-parser-wasm/Cargo.toml
index 1866ea19d5..4f372a5a5f 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.toml
+++ b/backend/parsers/windmill-parser-wasm/Cargo.toml
@@ -12,7 +12,7 @@ resolver = "2"
 members = ["."]
 
 [workspace.package]
-version = "1.773.0"
+version = "1.774.0"
 edition = "2021"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index c60a3eb777..aaec1d2fb3 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.773.0
+  version: 1.774.0
   title: Windmill API
 
   contact:
diff --git a/benchmarks/lib.ts b/benchmarks/lib.ts
index be6fe5b529..2a211772a9 100644
--- a/benchmarks/lib.ts
+++ b/benchmarks/lib.ts
@@ -2,7 +2,7 @@ import { sleep } from "https://deno.land/x/sleep@v1.2.1/mod.ts";
 import * as windmill from "https://deno.land/x/windmill@v1.174.0/mod.ts";
 import * as api from "https://deno.land/x/windmill@v1.174.0/windmill-api/index.ts";
 
-export const VERSION = "v1.773.0";
+export const VERSION = "v1.774.0";
 
 export async function login(email: string, password: string): Promise<string> {
   return await windmill.UserService.login({
diff --git a/cli/src/core/constants.ts b/cli/src/core/constants.ts
index 40aee3823e..2039ac17b6 100644
--- a/cli/src/core/constants.ts
+++ b/cli/src/core/constants.ts
@@ -10,4 +10,4 @@ export const WM_FORK_PREFIX = "wm-fork";
 // (e.g. utils.ts) can read it without importing main.ts and creating a circular
 // dependency (main → workspace → utils → main) that triggers a TDZ.
 // Re-exported from main.ts for backwards compatibility.
-export const VERSION = "1.773.0";
+export const VERSION = "1.774.0";
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 1cbd409013..928a866e7d 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -1,12 +1,12 @@
 {
 	"name": "@windmill-labs/components",
-	"version": "1.773.0",
+	"version": "1.774.0",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "@windmill-labs/components",
-			"version": "1.773.0",
+			"version": "1.774.0",
 			"hasInstallScript": true,
 			"license": "AGPL-3.0",
 			"dependencies": {
diff --git a/frontend/package.json b/frontend/package.json
index 9c300c94d1..15b367e6d5 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@windmill-labs/components",
-	"version": "1.773.0",
+	"version": "1.774.0",
 	"scripts": {
 		"dev": "vite dev",
 		"dev:ui-builder": "mv static/ui_builder static/ui_builder.dev-disabled 2>/dev/null || true ; trap 'mv static/ui_builder.dev-disabled static/ui_builder 2>/dev/null || true' EXIT ; vite dev",
diff --git a/lsp/Pipfile b/lsp/Pipfile
index 0176fd31e1..b5410d4f7b 100644
--- a/lsp/Pipfile
+++ b/lsp/Pipfile
@@ -4,7 +4,7 @@ verify_ssl = true
 name = "pypi"
 
 [packages]
-wmill = ">=1.773.0"
+wmill = ">=1.774.0"
 sendgrid = "*"
 mysql-connector-python = "*"
 pymongo = "*"
diff --git a/openflow.openapi.yaml b/openflow.openapi.yaml
index 2b5054aa51..32f6991584 100644
--- a/openflow.openapi.yaml
+++ b/openflow.openapi.yaml
@@ -1,7 +1,7 @@
 openapi: '3.0.3'
 
 info:
-  version: 1.773.0
+  version: 1.774.0
   title: OpenFlow Spec
   contact:
     name: Ruben Fiszel
diff --git a/powershell-client/WindmillClient/WindmillClient.psd1 b/powershell-client/WindmillClient/WindmillClient.psd1
index 05f7159bfe..c1071fae9f 100644
--- a/powershell-client/WindmillClient/WindmillClient.psd1
+++ b/powershell-client/WindmillClient/WindmillClient.psd1
@@ -12,7 +12,7 @@
     RootModule        = 'WindmillClient.psm1'
 
     # Version number of this module.
-    ModuleVersion     = '1.773.0'
+    ModuleVersion     = '1.774.0'
 
     # Supported PSEditions
     # CompatiblePSEditions = @()
diff --git a/python-client/wmill/pyproject.toml b/python-client/wmill/pyproject.toml
index 6376c89660..f3296b4149 100644
--- a/python-client/wmill/pyproject.toml
+++ b/python-client/wmill/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill"
-version = "1.773.0"
+version = "1.774.0"
 description = "A client library for accessing Windmill server wrapping the Windmill client API"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/typescript-client/jsr.json b/typescript-client/jsr.json
index 2b0d66fa25..f5dce5c510 100644
--- a/typescript-client/jsr.json
+++ b/typescript-client/jsr.json
@@ -1,6 +1,6 @@
 {
   "name": "@windmill/windmill",
-  "version": "1.773.0",
+  "version": "1.774.0",
   "exports": "./src/index.ts",
   "publish": {
     "exclude": ["!src", "./s3Types.ts", "./sqlUtils.ts", "./client.ts", "./wacError.ts"]
diff --git a/typescript-client/package.json b/typescript-client/package.json
index 7c5cfbb5a1..55f118db9e 100644
--- a/typescript-client/package.json
+++ b/typescript-client/package.json
@@ -1,7 +1,7 @@
 {
   "name": "windmill-client",
   "description": "Windmill SDK client for browsers and Node.js",
-  "version": "1.773.0",
+  "version": "1.774.0",
   "author": "Ruben Fiszel",
   "license": "Apache 2.0",
   "homepage": "https://github.com/windmill-labs/windmill/tree/main/typescript-client#readme",
diff --git a/version.txt b/version.txt
index 5ea068c96f..9ec4850224 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-1.773.0
+1.774.0

From faa2aaf214444f4fbb129f10a46060d4a8ab3ae8 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Tue, 28 Jul 2026 18:29:45 +0200
Subject: [PATCH 10/24] fix: truncate strings on char boundaries to avoid
 panics on multibyte input (#10390)

* fix: truncate strings on char boundaries to avoid panics on multibyte input

* fix: add borrowed truncate_chars helper and pin ee ref for audit fix

* docs: clarify truncate_with_ellipsis length contract

* chore: update ee-repo-ref to bbfb0de0dc9fa06130a231eb10c64f60238d1bbd

This commit updates the EE repository reference after PR #690 was merged in windmill-ee-private.

Previous ee-repo-ref: de15aeff12daf457711f5b981de691418484535c

New ee-repo-ref: bbfb0de0dc9fa06130a231eb10c64f60238d1bbd

Automated by sync-ee-ref workflow.

---------

Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
---
 backend/ee-repo-ref.txt                       |  2 +-
 backend/windmill-api-debug/src/lib.rs         |  6 +---
 .../windmill-common/src/flow_conversations.rs |  9 ++---
 .../windmill-common/src/instance_config.rs    |  7 +---
 backend/windmill-common/src/utils.rs          | 35 +++++++++++++++++++
 5 files changed, 41 insertions(+), 18 deletions(-)

diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index b9f57e8175..9a99949d04 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-f78df23339e3136e8b6e9148a509508633448dd2
+bbfb0de0dc9fa06130a231eb10c64f60238d1bbd
diff --git a/backend/windmill-api-debug/src/lib.rs b/backend/windmill-api-debug/src/lib.rs
index 61ec59be75..3b43a04ad1 100644
--- a/backend/windmill-api-debug/src/lib.rs
+++ b/backend/windmill-api-debug/src/lib.rs
@@ -422,11 +422,7 @@ async fn sign_expression(
     let mut tx = user_db.begin(&authed).await?;
 
     // Truncate expression for resource field if too long (max 255 chars)
-    let resource = if request.expression.len() > 200 {
-        format!("{}...", &request.expression[..200])
-    } else {
-        request.expression.clone()
-    };
+    let resource = windmill_common::utils::truncate_with_ellipsis(&request.expression, 200);
 
     audit_log(
         &mut *tx,
diff --git a/backend/windmill-common/src/flow_conversations.rs b/backend/windmill-common/src/flow_conversations.rs
index 33056f59fa..21b1f56389 100644
--- a/backend/windmill-common/src/flow_conversations.rs
+++ b/backend/windmill-common/src/flow_conversations.rs
@@ -5,6 +5,7 @@ use uuid::Uuid;
 
 use crate::db::DB;
 use crate::error::Result;
+use crate::utils::truncate_with_ellipsis;
 
 #[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq, sqlx::Type)]
 #[sqlx(type_name = "MESSAGE_TYPE", rename_all = "lowercase")]
@@ -51,12 +52,8 @@ pub async fn get_or_create_conversation_with_id(
         return Ok(existing);
     }
 
-    // Truncate title to 25 char characters max
-    let title = if title.len() > 25 {
-        format!("{}...", &title[..25])
-    } else {
-        title.to_string()
-    };
+    // Truncate title to 25 characters max
+    let title = truncate_with_ellipsis(title, 25);
 
     // Create new conversation with provided ID
     let conversation = sqlx::query_as!(
diff --git a/backend/windmill-common/src/instance_config.rs b/backend/windmill-common/src/instance_config.rs
index abf1c1b662..0c8f8e4f4a 100644
--- a/backend/windmill-common/src/instance_config.rs
+++ b/backend/windmill-common/src/instance_config.rs
@@ -1077,12 +1077,7 @@ pub fn format_setting_value(key: &str, value: &serde_json::Value) -> String {
         };
     }
     let value = mask_nested_sensitive(key, value);
-    let s = value.to_string();
-    if s.len() > 200 {
-        format!("{}...", &s[..197])
-    } else {
-        s
-    }
+    crate::utils::truncate_with_ellipsis(&value.to_string(), 197)
 }
 
 /// Extract the expiry timestamp from a license key JSON value.
diff --git a/backend/windmill-common/src/utils.rs b/backend/windmill-common/src/utils.rs
index 7b1f2a13f9..2bd6f1b204 100644
--- a/backend/windmill-common/src/utils.rs
+++ b/backend/windmill-common/src/utils.rs
@@ -1364,10 +1364,45 @@ pub fn strip_json_nul(serialized: &str) -> Cow<'_, str> {
     Cow::Owned(String::from_utf8(out).expect("removing a NUL escape preserves valid UTF-8"))
 }
 
+/// Prefix of `s` holding at most `max_chars` characters.
+/// Slicing by byte index (`&s[..n]`) panics when `n` lands inside a multibyte character.
+pub fn truncate_chars(s: &str, max_chars: usize) -> &str {
+    match s.char_indices().nth(max_chars) {
+        Some((byte_idx, _)) => &s[..byte_idx],
+        None => s,
+    }
+}
+
+/// Keep at most `max_chars` characters of `s`, appending `...` when anything was dropped —
+/// so a truncated result is `max_chars + 3` characters long, not `max_chars`.
+pub fn truncate_with_ellipsis(s: &str, max_chars: usize) -> String {
+    let truncated = truncate_chars(s, max_chars);
+    if truncated.len() < s.len() {
+        format!("{}...", truncated)
+    } else {
+        s.to_string()
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
 
+    #[test]
+    fn truncate_handles_multibyte_at_boundary() {
+        // Byte 25 of this string falls inside a 2-byte 'а'; naive `&s[..25]` would panic.
+        let cyrillic = "а".repeat(30);
+        assert_eq!(truncate_chars(&cyrillic, 25), "а".repeat(25));
+        assert_eq!(
+            truncate_with_ellipsis(&cyrillic, 25),
+            format!("{}...", "а".repeat(25))
+        );
+        assert_eq!(truncate_with_ellipsis("ааааааааааааа", 25), "ааааааааааааа");
+        assert_eq!(truncate_chars("abcd", 3), "abc");
+        assert_eq!(truncate_with_ellipsis("abc", 3), "abc");
+        assert_eq!(truncate_with_ellipsis("abcd", 3), "abc...");
+    }
+
     // The 6-char JSON escape for U+0000: backslash + "u0000". Written via an
     // escaped backslash so no literal NUL byte ever appears in this source.
     const NUL_ESC: &str = "\\u0000";

From 91b8ce581a15baf7fc9ea4e983b50f233cf5e023 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Tue, 28 Jul 2026 18:30:55 +0200
Subject: [PATCH 11/24] feat: validate and make explicit the hub project's
 resource type export (#10388)

* feat: make hub resource type export explicit and validated

* fix: skip resource type validation when the workspace has no type catalog

* fix: snapshot the export opt-in and exclude s3_object unconditionally

* fix: capture the export opt-in at publish click, not after the draft request

* docs: correct the publish-snapshot rationale
---
 .../workspaceSettings/DeployToHub.svelte      | 38 ++++++--
 .../deployToHubItems.test.ts                  | 30 +++++-
 .../workspaceSettings/deployToHubItems.ts     | 37 ++++++++
 .../deployToHubSession.svelte.ts              | 91 +++++++++++++------
 4 files changed, 163 insertions(+), 33 deletions(-)

diff --git a/frontend/src/lib/components/workspaceSettings/DeployToHub.svelte b/frontend/src/lib/components/workspaceSettings/DeployToHub.svelte
index 12cfb8cd08..cbe0554be8 100644
--- a/frontend/src/lib/components/workspaceSettings/DeployToHub.svelte
+++ b/frontend/src/lib/components/workspaceSettings/DeployToHub.svelte
@@ -287,8 +287,9 @@
 									{/if}
 									<Tooltip>
 										Resource types the selected items depend on (whether passed as inputs or
-										referenced by a hardcoded path). Synced to the Hub so a fork knows what
-										credentials it needs to fill.
+										referenced by a hardcoded path). A stub resource of each type is synced to the
+										Hub so a fork knows what credentials it needs to fill. Publishing a type's own
+										definition is opt-in — tick it in the details drawer.
 									</Tooltip>
 								</span>
 								{#if s.dependencyTypes.length === 0}
@@ -303,6 +304,9 @@
 												: 'bg-surface'}"
 										>
 											{r.resource_type}
+											{#if s.exportedResourceTypes.has(r.resource_type)}
+												<Badge color="blue" size="xs">exported</Badge>
+											{/if}
 										</span>
 									{/each}
 									<Button
@@ -311,7 +315,9 @@
 										wrapperClasses="ml-auto"
 										onclick={() => resourceDrawer?.openDrawer()}
 									>
-										View details
+										{s.exportedDependencyTypes.length > 0
+											? `View details (${s.exportedDependencyTypes.length} type definition${s.exportedDependencyTypes.length > 1 ? 's' : ''} exported)`
+											: 'View details'}
 									</Button>
 								{/if}
 							</div>
@@ -830,12 +836,19 @@
 			<DrawerContent title="Resource dependencies" on:close={() => resourceDrawer?.closeDrawer()}>
 				<div class="flex flex-col gap-4">
 					<p class="text-xs text-secondary">
-						Resource types the selected items depend on. Each is synced to the Hub so a fork knows
-						what credentials it needs to fill. <span class="font-semibold">Input</span> means the
-						item takes the resource as a parameter;
+						Resource types the selected items depend on. A stub resource of each type is synced to
+						the Hub so a fork knows what credentials it needs to fill.
+						<span class="font-semibold">Input</span> means the item takes the resource as a
+						parameter;
 						<span class="font-semibold">hardcoded path</span> means the item pins a specific resource
 						path in its code.
 					</p>
+					<p class="text-xs text-secondary">
+						Publishing a type's own <span class="font-semibold">definition</span> (its schema and
+						description) is a separate, explicit choice: tick
+						<span class="font-semibold">Export type definition</span> only for custom types the Hub doesn't
+						already know. Standard types are already defined on the Hub and need no export.
+					</p>
 					{#if s.dependencyTypes.length === 0}
 						<span class="text-xs text-hint">No resource references in the current selection.</span>
 					{:else}
@@ -852,6 +865,19 @@
 									<span class="text-[11px] text-hint">
 										{r.usages.length} usage{r.usages.length > 1 ? 's' : ''}
 									</span>
+									<div class="ml-auto shrink-0">
+										<Toggle
+											size="xs"
+											checked={s.exportedResourceTypes.has(r.resource_type)}
+											disabled={s.deploying}
+											on:change={() => s.toggleResourceTypeExport(r.resource_type)}
+											options={{
+												right: 'Export type definition',
+												rightTooltip:
+													'Publishes this resource type (name, schema, description) to the Hub project. Leave off if the Hub already defines it.'
+											}}
+										/>
+									</div>
 								</div>
 								<div class="flex flex-col gap-3">
 									{#each r.usages as u, ui (ui)}
diff --git a/frontend/src/lib/components/workspaceSettings/deployToHubItems.test.ts b/frontend/src/lib/components/workspaceSettings/deployToHubItems.test.ts
index 07aa21abc3..5ec8eed841 100644
--- a/frontend/src/lib/components/workspaceSettings/deployToHubItems.test.ts
+++ b/frontend/src/lib/components/workspaceSettings/deployToHubItems.test.ts
@@ -1,5 +1,10 @@
 import { describe, it, expect } from 'vitest'
-import { canRecordSession, mergeAppTableOrigin, type DeployItem } from './deployToHubItems'
+import {
+	canRecordSession,
+	inputResourceTypes,
+	mergeAppTableOrigin,
+	type DeployItem
+} from './deployToHubItems'
 
 function item(over: Partial<DeployItem> & Pick<DeployItem, 'key' | 'path' | 'kind'>): DeployItem {
 	return { rec: 'none', ...over }
@@ -34,3 +39,26 @@ describe('mergeAppTableOrigin', () => {
 		).toBe(orphan)
 	})
 })
+
+describe('inputResourceTypes', () => {
+	const schema = {
+		properties: {
+			db: { format: 'resource-postgresql' },
+			file: { format: 'resource-s3_object' },
+			typo: { format: 'resource-postgres' },
+			theme: { format: 'resource-app_theme' },
+			name: { format: 'email' }
+		}
+	}
+	it('keeps only formats the workspace declares as a resource type', () => {
+		expect(inputResourceTypes(schema, new Set(['postgresql', 'stripe']))).toEqual(['postgresql'])
+	})
+	// Undefined (still loading) and empty (a workspace that never synced the Hub's
+	// types) are both "no catalog" — validating would drop every legitimate type.
+	// `s3_object` is never a resource type, so it stays out even here.
+	it('falls back to every non-hidden format without a type catalog', () => {
+		const all = ['postgresql', 'postgres']
+		expect(inputResourceTypes(schema, undefined)).toEqual(all)
+		expect(inputResourceTypes(schema, new Set())).toEqual(all)
+	})
+})
diff --git a/frontend/src/lib/components/workspaceSettings/deployToHubItems.ts b/frontend/src/lib/components/workspaceSettings/deployToHubItems.ts
index e4e85da5a1..5c018bcc96 100644
--- a/frontend/src/lib/components/workspaceSettings/deployToHubItems.ts
+++ b/frontend/src/lib/components/workspaceSettings/deployToHubItems.ts
@@ -18,6 +18,43 @@ export interface DeployItem {
 
 export const canRecord = (k: Kind) => k === 'script' || k === 'flow'
 
+// `s3_object` is a built-in file-picker format, never a resource type (it is not
+// on the Hub's type list), so it is excluded even when there is no catalog to
+// validate against.
+export const HIDDEN_RESOURCE_TYPES = new Set(['app_theme', 'state', 'cache', 's3_object'])
+
+/**
+ * Resource types an item takes as an input, read off its schema's
+ * `resource-<type>` arg formats.
+ *
+ * A `resource-<x>` format is not a type declaration: stale and misspelled ones
+ * pass through unchanged. Publishing those to the Hub would push an empty-schema
+ * type and a stub resource nothing can ever fill, so an input-derived type only
+ * counts once the workspace declares it — the same bar `ArgInput` applies before
+ * rendering an arg as a resource picker.
+ *
+ * `known` is only authoritative once it holds something: undefined (still
+ * loading, or the call failed) and empty (a workspace whose type catalog was
+ * never synced from the Hub) both mean "no catalog to validate against", and
+ * filtering on one would drop every legitimate type instead.
+ */
+export function inputResourceTypes(schema: unknown, known: Set<string> | undefined): string[] {
+	const validate = known !== undefined && known.size > 0
+	const out = new Set<string>()
+	const props = (schema as any)?.properties
+	if (props && typeof props === 'object') {
+		for (const key of Object.keys(props)) {
+			const fmt = props[key]?.format
+			if (typeof fmt !== 'string' || !fmt.startsWith('resource-')) continue
+			const type = fmt.slice('resource-'.length)
+			if (HIDDEN_RESOURCE_TYPES.has(type)) continue
+			if (validate && !known.has(type)) continue
+			out.add(type)
+		}
+	}
+	return [...out]
+}
+
 // A raw app has no run to capture: its demo is a recorded session of someone
 // using it, driven in the record drawer and replayed on the Hub page. Legacy raw
 // apps live only in the `raw_app` table, and the record surface loads the app
diff --git a/frontend/src/lib/components/workspaceSettings/deployToHubSession.svelte.ts b/frontend/src/lib/components/workspaceSettings/deployToHubSession.svelte.ts
index ab1adbfdea..521989262a 100644
--- a/frontend/src/lib/components/workspaceSettings/deployToHubSession.svelte.ts
+++ b/frontend/src/lib/components/workspaceSettings/deployToHubSession.svelte.ts
@@ -38,7 +38,9 @@ import type { Kind } from '$lib/utils_deployable'
 import {
 	canRecord,
 	canRecordSession,
+	inputResourceTypes,
 	mergeAppTableOrigin,
+	HIDDEN_RESOURCE_TYPES,
 	type DeployItem
 } from './deployToHubItems'
 import type { AssetGraphResponse } from '$lib/components/assets/AssetGraph/types'
@@ -92,8 +94,6 @@ const ITEM_KIND_ROUTE: Record<ItemKind, string> = {
 	raw_app: 'apps_raw/get'
 }
 
-const HIDDEN_RESOURCE_TYPES = new Set(['app_theme', 'state', 'cache'])
-
 // Prune a folder's asset graph to a set of scripts so a pipeline recording only
 // runs, renders and samples the project's included members — a deselected branch
 // (its nodes, code, logs/results and table samples) never enters the recording.
@@ -114,20 +114,6 @@ function pruneGraphToScripts(graph: AssetGraphResponse, scripts: Set<string>): A
 	return { assets, runnables, edges, triggers, macro_edges, test_edges }
 }
 
-function typesFromSchema(schema: any): string[] {
-	const out = new Set<string>()
-	const props = schema?.properties
-	if (props && typeof props === 'object') {
-		for (const key of Object.keys(props)) {
-			const fmt = props[key]?.format
-			if (typeof fmt === 'string' && fmt.startsWith('resource-')) {
-				out.add(fmt.slice('resource-'.length))
-			}
-		}
-	}
-	return [...out]
-}
-
 type DependencyUsage =
 	| { role: 'input'; label: string; kind: ItemKind; itemPath: string }
 	| { role: 'hardcoded'; label: string; kind: ItemKind; path: string; itemPath: string }
@@ -219,6 +205,14 @@ export class DeployToHubSession {
 	// they pick up the fresh SQL (Monaco doesn't sync external `code` changes).
 	migrationsGeneration = $state(0)
 
+	// Resource type names declared by the workspace, used to tell a real type from
+	// an arbitrary `resource-<x>` arg format. Stays undefined until the list loads.
+	resourceTypeNames = $state<Set<string> | undefined>(undefined)
+	// Resource types the user explicitly opted into publishing. Opt-in, never
+	// derived from the selection: exporting a type definition to the Hub is a
+	// deliberate act, so the default is to export none.
+	exportedResourceTypes = $state<Set<string>>(new Set())
+
 	bundlePreview = $state<ProjectBundle | undefined>(undefined)
 	detectingResources = $state(false)
 	// Data tables (→ tables) the current selection reads/writes, detected off the
@@ -257,11 +251,26 @@ export class DeployToHubSession {
 
 	load() {
 		void this.#loadWorkspace()
+		void this.#loadResourceTypeNames()
 		void this.#loadTriggers()
 		void this.rehydrateFromHub()
 		void this.#loadPipelineGraph()
 	}
 
+	// Deliberately not `resourceTypesStore.getResourceTypes()`: its error path
+	// resolves to a non-empty `['error_fetching_names']`, which here would read as
+	// a real catalog and filter out every legitimate type. A failure must leave the
+	// catalog unset so validation stays off.
+	async #loadResourceTypeNames() {
+		try {
+			const names = await ResourceService.listResourceTypeNames({ workspace: this.workspace })
+			if (this.#disposed) return
+			this.resourceTypeNames = new Set(names)
+		} catch (e: any) {
+			console.error('failed to load resource type names, resource type validation is off', e)
+		}
+	}
+
 	filteredWorkspaceItems = $derived(
 		this.workspaceItems.filter((i) => i.path.startsWith(this.selectedFolder + '/'))
 	)
@@ -372,8 +381,7 @@ export class DeployToHubSession {
 					itemPath: it.path
 				})
 			}
-			for (const t of typesFromSchema(it.schema)) {
-				if (HIDDEN_RESOURCE_TYPES.has(t)) continue
+			for (const t of inputResourceTypes(it.schema, this.resourceTypeNames)) {
 				ensure(t).usages.push({ role: 'input', label, kind: it.kind, itemPath: it.path })
 			}
 		}
@@ -400,6 +408,22 @@ export class DeployToHubSession {
 		return [...byType.values()].sort((a, b) => a.resource_type.localeCompare(b.resource_type))
 	})
 
+	// Only the types the user ticked, restricted to what the current selection
+	// actually depends on — deselecting the last item that used a type drops it
+	// from the export without the user having to untick it.
+	exportedDependencyTypes = $derived(
+		this.dependencyTypes
+			.map((d) => d.resource_type)
+			.filter((rt) => this.exportedResourceTypes.has(rt))
+	)
+
+	toggleResourceTypeExport = (resource_type: string) => {
+		const next = new Set(this.exportedResourceTypes)
+		if (next.has(resource_type)) next.delete(resource_type)
+		else next.add(resource_type)
+		this.exportedResourceTypes = next
+	}
+
 	toggleItem = (item: { key: string }) => {
 		const next = new Set(this.manualDeselected)
 		if (next.has(item.key)) next.delete(item.key)
@@ -827,9 +851,13 @@ export class DeployToHubSession {
 		if (this.deploying || this.triggersLoading || this.triggerDiscoveryFailed) return
 		this.deploying = true
 		try {
+			// Captured at click time rather than read in #deployAll, which only runs
+			// after the draft request resolves: what gets published must be what was
+			// ticked on confirmation, whatever mutates `exportedResourceTypes` after.
+			const exportedTypes = new Set(this.exportedResourceTypes)
 			if (!(await this.#createDraft())) return
 			onDraftCreated?.()
-			await this.#deployAll()
+			await this.#deployAll(exportedTypes)
 		} finally {
 			this.deploying = false
 		}
@@ -1048,7 +1076,7 @@ export class DeployToHubSession {
 		return results.reduce((a: number, b) => a + b, 0)
 	}
 
-	async #deployAll() {
+	async #deployAll(exportedTypes: Set<string>) {
 		const slug = this.hubSlug
 		// Snapshot the selection up-front: `selectedItems`/`relevantTriggers` are
 		// derived from live workspace data and `migrationDrafts` is edited in the
@@ -1096,14 +1124,22 @@ export class DeployToHubSession {
 			// was replaced (workspace/folder switch) in the meantime.
 			if (this.#disposed) return
 
-			// Types come from $res: stubs AND schema inputs (resource-<type>).
-			const inputTypes = bundle.items
-				.flatMap((i) => typesFromSchema(i.schema))
-				.filter((t) => !HIDDEN_RESOURCE_TYPES.has(t))
+			// Types come from $res: stubs AND schema inputs (resource-<type>). A stub's
+			// type is declared by an existing resource, so it needs no validation; an
+			// input's is a free-form format string, so it does.
+			const inputTypes = bundle.items.flatMap((i) =>
+				inputResourceTypes(i.schema, this.resourceTypeNames)
+			)
 			const types = [
 				...new Set([...bundle.resourceStubs.map((s) => s.resource_type), ...inputTypes])
 			]
-			const depFailures = await this.#pushResourceTypes(slug, types)
+			// Only the types the user ticked are published. The others still get their
+			// stub below, so a fork knows which credential to fill; only the type
+			// definition itself stays out of the Hub.
+			const depFailures = await this.#pushResourceTypes(
+				slug,
+				types.filter((t) => exportedTypes.has(t))
+			)
 
 			// Input-type deps with no path get a conventional f/<slug>/<type> stub.
 			const stubsByPath = new Map<string, { path: string; resource_type: string }>()
@@ -1185,7 +1221,10 @@ export class DeployToHubSession {
 					this.hubHasRemoteLogo = this.hubLogo !== null
 					this.hubLogo = undefined
 				} catch (e: any) {
-					sendUserToast(`Logo ${this.hubLogo ? 'upload' : 'removal'} failed: ${e?.message ?? e}`, true)
+					sendUserToast(
+						`Logo ${this.hubLogo ? 'upload' : 'removal'} failed: ${e?.message ?? e}`,
+						true
+					)
 					failures++
 				}
 			}

From bd246644c962f754a8477353d49ed39ba9b87ffd Mon Sep 17 00:00:00 2001
From: Guilhem <guilhemlemouel@gmail.com>
Date: Tue, 28 Jul 2026 18:34:41 +0200
Subject: [PATCH 12/24] feat: add github dark mode variant switchable in user
 settings (#10002)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* feat: add github dark mode variant switchable in user settings

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat: boot the UI Builder iframe into the current theme

Seed the UI Builder iframe URL with the live dark/variant state
(`?dark=&variant=`) so the VS Code workbench boots straight into GitHub
Dark / Nord / Light instead of flashing the dark default until the host's
`setDarkMode` message lands. Read from the <html> classes rather than the
reactive state so the src is computed once at mount — a later theme toggle
still updates the workbench via postMessage and does not reload the iframe.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* feat: align github-dark surfaces to GitHub Primer's elevation scale

Snap the invented mid-greys to Primer's real dark canvas scale
(inset=neutral.0, default=neutral.1, muted=neutral.2). Recessed surfaces
now use true inset (#010409) instead of washed-out half-steps that sat in
no-man's-land between inset and the page; raised surfaces align to muted.

- surface-secondary  #0b0e13 → #010409  (true inset)
- surface-input      #0c0f14 → #010409  (true inset)
- surface-disabled   #0b0e13 → #151b23  (muted)
- surface-tertiary   #161b22 → #151b23  (Primer neutral.2)
- component-virtual-node #161b22 → #151b23
- surface-selected   #21262d → #212830  (Primer neutral.3)

surface-sunken (#010409) and surface-primary (#0d1117) already matched
Primer inset/default exactly.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix: keep github-dark inputs subtle instead of full inset

surface-input at true inset (#010409) made form fields read as recessed as
the sidebar rail — too much contrast against the canvas. Inputs aren't
sunken, so keep the subtle #0c0f14 (a hair below the page) while the
recessed panel surfaces stay at inset.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* chore: bump UI Builder pin to the github-dark build (76ee616)

windmill-code-ui-builder PR #16 is merged and published to R2, so pin the
artifact to that build. The embedded raw-app editor now renders GitHub Dark
(and honors the `variant` message) natively from the pinned build — no local
swap needed. Reword the variant comment now that the dependency is resolved.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix: address codex review nits on the github-dark theme

- UserSettings: re-read the dark variant when the settings drawer opens, so a
  change made through one mounted instance (page-local drawer) isn't shown
  stale by another (the always-mounted layout instance).
- PublicApp / OAuth login callback: restore the `github-dark` variant class,
  not just the base `dark` class. These routes bypass the (root) layout, so
  they previously fell back to the default dark palette despite the saved
  preference.
- RawAppEditor: condense the two new theme comments to the durable constraints
  per AGENTS.md (drop narration and the ephemeral artifact-pin history).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix: address CI review findings on the github-dark theme

- Move the hand-authored `github-dark` token set out of the Figma-generated
  tokens.json into githubDark.json, merged back in at the two consumers
  (tailwind.config.cjs before the rgb pass, utils.ts) so a Figma re-export of
  tokens.json can no longer drop the set and crash the build.
- Restore the default-dark sidebar divider to #374151 — the PR must leave the
  Default variant unchanged; only the github variant adapts it to border-light.
- Extract the `github-dark` DOM-class read into getAppliedDarkModeVariant() and
  reuse it across RawAppEditor and vscode.ts; drop the redundant `void darkVariant`.
- Override the Monaco popup vars (suggest/hover widgets) in the github variant so
  they match the GitHub palette instead of VS Code's greys.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
---
 frontend/scripts/ui_builder_artifact.json     |  4 +-
 .../src/lib/assets/tokens/githubDark.json     | 35 +++++++++++
 frontend/src/lib/assets/tokens/tokens.json    |  7 ++-
 .../src/lib/components/EditorTheme.svelte     |  8 +--
 .../src/lib/components/ScriptEditor.svelte    |  2 +-
 .../src/lib/components/UserSettings.svelte    | 38 +++++++++++-
 .../components/apps/editor/PublicApp.svelte   |  3 +
 .../components/raw_apps/RawAppEditor.svelte   | 35 +++++++++--
 .../lib/components/sidebar/sidebarChrome.ts   |  9 +--
 frontend/src/lib/components/vscode.ts         | 57 ++++++++++++++++--
 frontend/src/lib/darkModeVariant.ts           | 27 +++++++++
 frontend/src/lib/utils.ts                     |  7 ++-
 .../src/routes/(root)/(logged)/+layout.svelte |  2 +-
 frontend/src/routes/(root)/+layout.svelte     |  3 +
 .../login_callback/[client_name]/+page.svelte |  3 +
 frontend/tailwind.config.cjs                  | 59 ++++++++++++++-----
 16 files changed, 254 insertions(+), 45 deletions(-)
 create mode 100644 frontend/src/lib/assets/tokens/githubDark.json
 create mode 100644 frontend/src/lib/darkModeVariant.ts

diff --git a/frontend/scripts/ui_builder_artifact.json b/frontend/scripts/ui_builder_artifact.json
index 4360794dbe..01cfbb2888 100644
--- a/frontend/scripts/ui_builder_artifact.json
+++ b/frontend/scripts/ui_builder_artifact.json
@@ -1,5 +1,5 @@
 {
 	"baseUrl": "https://pub-06154ed168a24e73a86ab84db6bf15d8.r2.dev",
-	"version": "1f1fe4f",
-	"sha256": "4c20b2b51f324e93dda3b46d914ebf7bc7d0cb4dc7eb2d37068408191220d206"
+	"version": "76ee616",
+	"sha256": "1d696d38a152179ef6e1cada5df302d078cc677b6dbc244b5c42335e11feabac"
 }
diff --git a/frontend/src/lib/assets/tokens/githubDark.json b/frontend/src/lib/assets/tokens/githubDark.json
new file mode 100644
index 0000000000..ea5b36145e
--- /dev/null
+++ b/frontend/src/lib/assets/tokens/githubDark.json
@@ -0,0 +1,35 @@
+{
+	"surface-accent-primary": "#506ab8",
+	"surface-accent-hover": "#5873c8",
+	"surface-accent-clicked": "#425797",
+	"text-primary": "#d5dbe2",
+	"text-secondary": "#8b949e",
+	"text-primary-inverse": "#24292f",
+	"text-secondary-inverse": "#57606a",
+	"text-tertiary-inverse": "#6e7781",
+	"surface-selected": "#212830",
+	"surface-disabled": "#151b23",
+	"surface-secondary": "#010409",
+	"surface-hover": "#6e768119",
+	"surface-primary": "#0d1117",
+	"border-light": "#242a32",
+	"border-normal": "#6e7681",
+	"border-accent": "#4a6ed6",
+	"surface-accent-selected": "#141a2e",
+	"surface-accent-secondary": "#e3e8ee",
+	"surface-tertiary": "#151b23",
+	"text-emphasis": "#dfe5eb",
+	"text-hint": "#6e7681",
+	"text-disabled": "#484f58",
+	"surface-accent-secondary-hover": "#d0d7de",
+	"surface-accent-secondary-clicked": "#afb8c1",
+	"component-button-accent-secondary": "#f0f6fc",
+	"text-emphasis-inverse": "#1f2328",
+	"reserved-ai": "#d2a8ff",
+	"component-virtual-node": "#151b23",
+	"text-accent": "#bdc8ee",
+	"border-selected": "#5a72c4",
+	"surface-sunken": "#010409",
+	"text-tertiary": "#6e7681",
+	"surface-input": "#0c0f14"
+}
diff --git a/frontend/src/lib/assets/tokens/tokens.json b/frontend/src/lib/assets/tokens/tokens.json
index f4f35c81d9..349b4376b8 100644
--- a/frontend/src/lib/assets/tokens/tokens.json
+++ b/frontend/src/lib/assets/tokens/tokens.json
@@ -239,7 +239,12 @@
 			"magenta-950": "#6e2ba1"
 		}
 	},
-	"guidelines": { "mode-1": { "blue": "#5e81ac", "demo-background": "#ffffff00" } },
+	"guidelines": {
+		"mode-1": {
+			"blue": "#5e81ac",
+			"demo-background": "#ffffff00"
+		}
+	},
 	"tailwind-c-s-s-v-3-3-2": {
 		"mode-1": {
 			"black": "#000000",
diff --git a/frontend/src/lib/components/EditorTheme.svelte b/frontend/src/lib/components/EditorTheme.svelte
index 9b24acab45..ba123e3dd5 100644
--- a/frontend/src/lib/components/EditorTheme.svelte
+++ b/frontend/src/lib/components/EditorTheme.svelte
@@ -1,5 +1,5 @@
 <script lang="ts">
-	import { isInitialized } from './vscode'
+	import { getEditorTheme, isInitialized } from './vscode'
 
 	import { editor as meditor } from 'monaco-editor'
 
@@ -8,11 +8,7 @@
 
 	function onThemeChange() {
 		if (isInitialized) {
-			if (document.documentElement.classList.contains('dark')) {
-				meditor.setTheme('nord')
-			} else {
-				meditor.setTheme('myTheme')
-			}
+			meditor.setTheme(getEditorTheme())
 		}
 	}
 
diff --git a/frontend/src/lib/components/ScriptEditor.svelte b/frontend/src/lib/components/ScriptEditor.svelte
index aaca5752c1..9a65fc9d2b 100644
--- a/frontend/src/lib/components/ScriptEditor.svelte
+++ b/frontend/src/lib/components/ScriptEditor.svelte
@@ -2505,7 +2505,7 @@
 {/snippet}
 
 {#snippet editorContent()}
-	<div class="h-full !overflow-visible bg-surface dark:bg-[#272D38] relative flex flex-col">
+	<div class="h-full !overflow-visible bg-surface dark:bg-surface-secondary relative flex flex-col">
 		{#if supportsModules}
 			<div
 				class="flex items-center border-b border-tertiary/30 bg-surface-secondary px-1 gap-0.5 text-xs overflow-x-auto shrink-0"
diff --git a/frontend/src/lib/components/UserSettings.svelte b/frontend/src/lib/components/UserSettings.svelte
index 327414cf9b..d3956f7f12 100644
--- a/frontend/src/lib/components/UserSettings.svelte
+++ b/frontend/src/lib/components/UserSettings.svelte
@@ -3,10 +3,17 @@
 	import DrawerContent from '$lib/components/common/drawer/DrawerContent.svelte'
 	import Version from './Version.svelte'
 	import DarkModeToggle from './sidebar/DarkModeToggle.svelte'
+	import ToggleButton from './common/toggleButton-v2/ToggleButton.svelte'
+	import ToggleButtonGroup from './common/toggleButton-v2/ToggleButtonGroup.svelte'
 	import TokensTable from './settings/TokensTable.svelte'
 	import { createEventDispatcher } from 'svelte'
 	import UserInfoSettings from './settings/UserInfoSettings.svelte'
 	import AIUserSettings from './settings/AIUserSettings.svelte'
+	import {
+		getDarkModeVariant,
+		setDarkModeVariant,
+		type DarkModeVariant
+	} from '$lib/darkModeVariant'
 
 	interface Props {
 		scopes?: string[] | undefined
@@ -28,6 +35,7 @@
 
 	let drawer: Drawer | undefined = $state()
 	let openWithMcpMode = $state(false)
+	let darkVariant = $state<DarkModeVariant>(getDarkModeVariant())
 
 	const dispatch = createEventDispatcher()
 
@@ -51,15 +59,39 @@
 	}
 </script>
 
-<Drawer bind:this={drawer} size="900px" on:close={removeHash} {disableChatOffset}>
+<Drawer
+	bind:this={drawer}
+	size="900px"
+	on:open={() => (darkVariant = getDarkModeVariant())}
+	on:close={removeHash}
+	{disableChatOffset}
+>
 	<DrawerContent title="User settings" on:close={closeDrawer}>
 		<div class="flex flex-col gap-6 pb-8">
 			{#if scopes == undefined}
 				<div
 					class="flex flex-row justify-between items-start gap-2 border border-border-light p-4 rounded-md"
 				>
-					<div class="font-semibold text-emphasis text-xs flex items-center">
-						Theme <DarkModeToggle forcedDarkMode={false} />
+					<div class="flex flex-col gap-2">
+						<div class="font-semibold text-emphasis text-xs flex items-center">
+							Theme <DarkModeToggle forcedDarkMode={false} />
+						</div>
+						<div class="flex items-center gap-2">
+							<span class="text-xs text-secondary">Dark variant</span>
+							<ToggleButtonGroup
+								selected={darkVariant}
+								class="w-fit"
+								onSelected={(v) => {
+									darkVariant = v
+									setDarkModeVariant(v)
+								}}
+							>
+								{#snippet children({ item })}
+									<ToggleButton value="default" label="Default" size="sm" {item} />
+									<ToggleButton value="github" label="GitHub" size="sm" {item} />
+								{/snippet}
+							</ToggleButtonGroup>
+						</div>
 					</div>
 					<div class="text-xs text-emphasis flex-col flex">
 						Windmill <Version />
diff --git a/frontend/src/lib/components/apps/editor/PublicApp.svelte b/frontend/src/lib/components/apps/editor/PublicApp.svelte
index 8995684e28..c0cf693e0f 100644
--- a/frontend/src/lib/components/apps/editor/PublicApp.svelte
+++ b/frontend/src/lib/components/apps/editor/PublicApp.svelte
@@ -1,5 +1,6 @@
 <script lang="ts">
 	import { User, UserRoundX } from 'lucide-svelte'
+	import { applyDarkModeVariant } from '$lib/darkModeVariant'
 	import { enterpriseLicense, userStore } from '$lib/stores'
 	import { base } from '$app/paths'
 	import { page } from '$app/state'
@@ -73,6 +74,8 @@
 	} else {
 		document.documentElement.classList.remove('dark')
 	}
+	// This route bypasses the (root) layout, so restore the variant class too.
+	applyDarkModeVariant()
 
 	let globalUser = $state<GlobalWhoamiResponse | undefined>(undefined)
 	async function loadGlobalUser() {
diff --git a/frontend/src/lib/components/raw_apps/RawAppEditor.svelte b/frontend/src/lib/components/raw_apps/RawAppEditor.svelte
index 75f703aa17..31e99dbe89 100644
--- a/frontend/src/lib/components/raw_apps/RawAppEditor.svelte
+++ b/frontend/src/lib/components/raw_apps/RawAppEditor.svelte
@@ -29,6 +29,7 @@
 	import { runDomQueryOnHtml, type RawAppDomQuery, type RawAppDomRequester } from './rawAppDom'
 	import InlineElementPrompt from './InlineElementPrompt.svelte'
 	import DarkModeObserver from '../DarkModeObserver.svelte'
+	import { getAppliedDarkModeVariant, type DarkModeVariant } from '$lib/darkModeVariant'
 	import RawAppSidebar from './RawAppSidebar.svelte'
 	import type { Modules } from './RawAppModules.svelte'
 	import { isRunnableByName, isRunnableByPath } from '../apps/inputType'
@@ -1304,7 +1305,7 @@
 	// it always matches the editor's current state. Plain rebuilds use
 	// `syncExternalPreview` alone (the theme hasn't changed).
 	function feedExternalPreview() {
-		postToExternalPreview({ type: 'setDarkMode', dark: darkMode })
+		postToExternalPreview({ type: 'setDarkMode', dark: darkMode, variant: darkVariant })
 		syncExternalPreview()
 	}
 
@@ -1697,6 +1698,17 @@
 	})
 
 	let darkMode: boolean = $state(false)
+	// Mirrors the `github-dark` class (the runtime source of truth); the
+	// DarkModeObserver below must keep it in sync or it goes stale.
+	let darkVariant: DarkModeVariant = $state(getAppliedDarkModeVariant())
+	// Read the DOM classes, not reactive state, so the src stays constant after
+	// mount: a reactive src would reload the iframe on every theme toggle. Live
+	// theme changes travel through postMessage instead (see the $effect below).
+	function uiBuilderIframeSrc(): string {
+		const dark = document.documentElement.classList.contains('dark')
+		const variant = getAppliedDarkModeVariant()
+		return `/ui_builder/index.html?dark=${dark}&variant=${variant}`
+	}
 	// Host's computed `text-xs` size in px. Windmill bumps :root to 18px at
 	// ≥1760px viewports, so this re-evaluates on resize via the listener below.
 	let editorFontSize = $state(12)
@@ -1746,12 +1758,18 @@
 		// Push dark mode to both children. The UI Builder iframe and the
 		// preview iframe each listen for `setDarkMode` separately.
 		if (iframe && iframeLoaded) {
-			iframe.contentWindow?.postMessage({ type: 'setDarkMode', dark: darkMode }, '*')
+			iframe.contentWindow?.postMessage(
+				{ type: 'setDarkMode', dark: darkMode, variant: darkVariant },
+				'*'
+			)
 		}
 		if (previewIframe && previewIframeLoaded) {
-			previewIframe.contentWindow?.postMessage({ type: 'setDarkMode', dark: darkMode }, '*')
+			previewIframe.contentWindow?.postMessage(
+				{ type: 'setDarkMode', dark: darkMode, variant: darkVariant },
+				'*'
+			)
 		}
-		postToExternalPreview({ type: 'setDarkMode', dark: darkMode })
+		postToExternalPreview({ type: 'setDarkMode', dark: darkMode, variant: darkVariant })
 	})
 	$effect(() => {
 		// Match VS Code's editor font size to Windmill's text-xs.
@@ -2036,7 +2054,12 @@
 </script>
 
 <svelte:window onmessage={listener} onkeydown={handleKeydown} />
-<DarkModeObserver bind:darkMode />
+<DarkModeObserver
+	bind:darkMode
+	on:change={() => {
+		darkVariant = getAppliedDarkModeVariant()
+	}}
+/>
 
 <RawAppBackgroundRunner
 	workspace={opWorkspace ?? ''}
@@ -2214,7 +2237,7 @@
 											<iframe
 												bind:this={iframe}
 												title="UI builder"
-												src="/ui_builder/index.html"
+												src={uiBuilderIframeSrc()}
 												class="w-full h-full block"
 												onload={attachIframeSaveShortcut}
 											></iframe>
diff --git a/frontend/src/lib/components/sidebar/sidebarChrome.ts b/frontend/src/lib/components/sidebar/sidebarChrome.ts
index 110435c058..71ff703d27 100644
--- a/frontend/src/lib/components/sidebar/sidebarChrome.ts
+++ b/frontend/src/lib/components/sidebar/sidebarChrome.ts
@@ -1,5 +1,6 @@
-// Sidebar rail background. Deliberately raw hex — no theme token exists for
-// the rail chrome — kept here as the single source for every host that renders
-// or mimics the sidebar (app layout, kitchen-sink harness).
+// Sidebar rail background. Kept here as the single source for every host that
+// renders or mimics the sidebar (app layout, kitchen-sink harness).
+// The dark value is a theme-driven CSS variable so it adapts across dark
+// variants (default vs GitHub dark) — see tailwind.config.cjs `--sidebar-bg-dark`.
 export const SIDEBAR_BG = '#F3F3F7'
-export const SIDEBAR_BG_DARK = '#1e232e'
+export const SIDEBAR_BG_DARK = 'var(--sidebar-bg-dark)'
diff --git a/frontend/src/lib/components/vscode.ts b/frontend/src/lib/components/vscode.ts
index 1277ac1b4a..f30ffcd780 100644
--- a/frontend/src/lib/components/vscode.ts
+++ b/frontend/src/lib/components/vscode.ts
@@ -1,6 +1,7 @@
 import '@codingame/monaco-vscode-standalone-typescript-language-features'
 
 import { editor as meditor, Uri as mUri } from 'monaco-editor'
+import { getAppliedDarkModeVariant } from '$lib/darkModeVariant'
 
 export let isInitialized = false
 export let isInitializing = false
@@ -12,6 +13,15 @@ import {
 import getLanguagesServiceOverride from '@codingame/monaco-vscode-languages-service-override'
 import { getCssColor } from '$lib/utils'
 
+// Monaco theme name matching the current document theme (light / dark / GitHub dark variant).
+export function getEditorTheme(): string {
+	const classes = document.documentElement.classList
+	if (!classes.contains('dark')) {
+		return 'myTheme'
+	}
+	return getAppliedDarkModeVariant() === 'github' ? 'github-dark' : 'nord'
+}
+
 export function buildWorkerDefinition() {
 	const envEnhanced = getEnhancedMonacoEnvironment()
 	const getWorker = (moduleId: string, label: string) => {
@@ -248,6 +258,47 @@ export async function initializeVscode(caller?: string, htmlContainer?: HTMLElem
 				}
 			})
 
+			meditor.defineTheme('github-dark', {
+				base: 'vs-dark',
+				inherit: true,
+				rules: [
+					{ background: '0D1117', token: '' },
+					{ foreground: '8b949e', token: 'comment' },
+					{ foreground: 'a5d6ff', token: 'string' },
+					{ foreground: '79c0ff', token: 'constant.numeric' },
+					{ foreground: '79c0ff', token: 'constant.language' },
+					{ foreground: 'ff7b72', token: 'keyword' },
+					{ foreground: 'ff7b72', token: 'storage' },
+					{ foreground: 'ff7b72', token: 'storage.type' },
+					{ foreground: 'ffa657', token: 'entity.name.class' },
+					{ foreground: 'ffa657', fontStyle: 'bold', token: 'entity.other.inherited-class' },
+					{ foreground: 'd2a8ff', token: 'entity.name.function' },
+					{ foreground: '7ee787', token: 'entity.name.tag' },
+					{ foreground: '79c0ff', token: 'entity.other.attribute-name' },
+					{ foreground: 'd2a8ff', token: 'support.function' },
+					{ foreground: 'f0f6fc', background: 'f85149', token: 'invalid' },
+					{ foreground: 'f0f6fc', background: 'bd561d', token: 'invalid.deprecated' },
+					{ foreground: '79c0ff', token: 'constant.color.other.rgb-value' },
+					{ foreground: '79c0ff', token: 'constant.character.escape' },
+					{ foreground: 'ffa657', token: 'variable.other.constant' },
+					{ token: 'string.value.json', foreground: 'a5d6ff' }, // string values in JSON
+					{ token: 'keyword.json', foreground: '79c0ff' } // true, false, null in JSON
+				],
+				colors: {
+					'editor.foreground': '#e6edf3',
+					'editor.background': getCssColor('surface-input', { format: 'hex-github-dark' }),
+					'editor.selectionBackground': '#3392FF44',
+					'editor.inactiveSelectionBackground': '#3392FF22',
+					'editor.lineHighlightBackground': '#161b22',
+					'editorCursor.foreground': '#e6edf3',
+					'editorWhitespace.foreground': '#484f58',
+					'editorIndentGuide.background1': '#21262d',
+					'editorIndentGuide.activeBackground1': '#30363d',
+					'editorLineNumber.foreground': '#6e7681',
+					'editorLineNumber.activeForeground': '#e6edf3'
+				}
+			})
+
 			meditor.defineTheme('myTheme', {
 				base: 'vs',
 				inherit: true,
@@ -262,11 +313,7 @@ export async function initializeVscode(caller?: string, htmlContainer?: HTMLElem
 				}
 			})
 
-			if (document.documentElement.classList.contains('dark')) {
-				meditor.setTheme('nord')
-			} else {
-				meditor.setTheme('myTheme')
-			}
+			meditor.setTheme(getEditorTheme())
 		} catch (e) {
 			console.error('Failed to initialize monaco services', e)
 		} finally {
diff --git a/frontend/src/lib/darkModeVariant.ts b/frontend/src/lib/darkModeVariant.ts
new file mode 100644
index 0000000000..1e1bbff28b
--- /dev/null
+++ b/frontend/src/lib/darkModeVariant.ts
@@ -0,0 +1,27 @@
+export type DarkModeVariant = 'default' | 'github'
+
+const DARK_MODE_VARIANT_KEY = 'dark-mode-variant'
+
+export function getDarkModeVariant(): DarkModeVariant {
+	return window.localStorage.getItem(DARK_MODE_VARIANT_KEY) === 'github' ? 'github' : 'default'
+}
+
+// The variant currently applied to the DOM (the `github-dark` class) — the
+// runtime source of truth, as opposed to the persisted preference above.
+export function getAppliedDarkModeVariant(): DarkModeVariant {
+	return typeof document !== 'undefined' &&
+		document.documentElement.classList.contains('github-dark')
+		? 'github'
+		: 'default'
+}
+
+// The `github-dark` class only takes effect when `dark` is also present (see tailwind.config.cjs).
+// It lives on <html> permanently so it survives the many independent `dark` toggle sites.
+export function applyDarkModeVariant(variant: DarkModeVariant = getDarkModeVariant()): void {
+	document.documentElement.classList.toggle('github-dark', variant === 'github')
+}
+
+export function setDarkModeVariant(variant: DarkModeVariant): void {
+	window.localStorage.setItem(DARK_MODE_VARIANT_KEY, variant)
+	applyDarkModeVariant(variant)
+}
diff --git a/frontend/src/lib/utils.ts b/frontend/src/lib/utils.ts
index 28d33335ae..e9acfdacab 100644
--- a/frontend/src/lib/utils.ts
+++ b/frontend/src/lib/utils.ts
@@ -2029,6 +2029,8 @@ export function validateRetryConfig(retry: Retry | undefined): string | null {
 }
 export type CssColor = keyof (typeof tokensFile)['tokens']['light']
 import tokensFile from './assets/tokens/tokens.json'
+// Hand-authored variant kept out of the Figma-generated tokens.json.
+import githubDarkTokens from './assets/tokens/githubDark.json'
 import { darkModeName, lightModeName } from './assets/tokens/colorTokensConfig'
 import BarsStaggered from './components/icons/BarsStaggered.svelte'
 import { GitIcon } from './components/icons'
@@ -2041,7 +2043,7 @@ export function getCssColor(
 		format = 'css-var'
 	}: {
 		alpha?: number
-		format?: 'css-var' | 'hex-dark' | 'hex-light'
+		format?: 'css-var' | 'hex-dark' | 'hex-light' | 'hex-github-dark'
 	}
 ): string {
 	if (format === 'hex-light') {
@@ -2050,6 +2052,9 @@ export function getCssColor(
 	if (format === 'hex-dark') {
 		return tokensFile.tokens[darkModeName][color]
 	}
+	if (format === 'hex-github-dark') {
+		return githubDarkTokens[color]
+	}
 	return `rgb(var(--color-${color}) / ${alpha})`
 }
 
diff --git a/frontend/src/routes/(root)/(logged)/+layout.svelte b/frontend/src/routes/(root)/(logged)/+layout.svelte
index 7dbe5ca376..9de1123ff9 100644
--- a/frontend/src/routes/(root)/(logged)/+layout.svelte
+++ b/frontend/src/routes/(root)/(logged)/+layout.svelte
@@ -1052,7 +1052,7 @@
 						style:width="{railWidth}rem"
 					>
 						<div
-							class="flex-1 flex flex-col min-h-0 h-screen shadow-[inset_-1px_0_0_0_rgb(var(--color-border-light))] dark:shadow-[inset_-1px_0_0_0_#374151]"
+							class="flex-1 flex flex-col min-h-0 h-screen shadow-[inset_-1px_0_0_0_rgb(var(--color-border-light))] dark:shadow-[inset_-1px_0_0_0_#374151] [html.github-dark_&]:shadow-[inset_-1px_0_0_0_rgb(var(--color-border-light))]"
 							style:background-color={darkMode ? SIDEBAR_BG_DARK : SIDEBAR_BG}
 						>
 							{#if !isCollapsed}
diff --git a/frontend/src/routes/(root)/+layout.svelte b/frontend/src/routes/(root)/+layout.svelte
index 8b7736965d..3db5efcf60 100644
--- a/frontend/src/routes/(root)/+layout.svelte
+++ b/frontend/src/routes/(root)/+layout.svelte
@@ -19,6 +19,7 @@
 	// import EditorTheme from '$lib/components/EditorTheme.svelte'
 	import { computeDrift } from '$lib/forLater'
 	import { setLicense } from '$lib/enterpriseUtils'
+	import { applyDarkModeVariant } from '$lib/darkModeVariant'
 	import { deepEqual } from 'fast-equals'
 	interface Props {
 		children?: import('svelte').Snippet
@@ -255,6 +256,8 @@
 	} else {
 		document.documentElement.classList.remove('dark')
 	}
+
+	applyDarkModeVariant()
 </script>
 
 {@render children?.()}
diff --git a/frontend/src/routes/user/login_callback/[client_name]/+page.svelte b/frontend/src/routes/user/login_callback/[client_name]/+page.svelte
index 737da14321..1aeb57f223 100644
--- a/frontend/src/routes/user/login_callback/[client_name]/+page.svelte
+++ b/frontend/src/routes/user/login_callback/[client_name]/+page.svelte
@@ -1,5 +1,6 @@
 <script lang="ts">
 	import { goto } from '$lib/navigation'
+	import { applyDarkModeVariant } from '$lib/darkModeVariant'
 	import { sendUserToast } from '$lib/toast'
 	import { onMount } from 'svelte'
 	import { UserService, WorkspaceService } from '$lib/gen'
@@ -132,6 +133,8 @@
 	} else {
 		document.documentElement.classList.remove('dark')
 	}
+	// This route bypasses the (root) layout, so restore the variant class too.
+	applyDarkModeVariant()
 
 	function closeUponLoginSuccess() {
 		const message = { type: 'success' }
diff --git a/frontend/tailwind.config.cjs b/frontend/tailwind.config.cjs
index 9bed325d03..6650c44544 100644
--- a/frontend/tailwind.config.cjs
+++ b/frontend/tailwind.config.cjs
@@ -4,10 +4,18 @@ const {
 } = require('./src/lib/components/apps/editor/componentsPanel/tailwindUtils')
 const { zIndexes } = require('./src/lib/zIndexes')
 
-const figmaTokens = makeRgb(require('./src/lib/assets/tokens/tokens.json'))
+const rawTokens = require('./src/lib/assets/tokens/tokens.json')
+// `github-dark` is a hand-authored variant kept out of the Figma-generated
+// tokens.json (a re-export would drop it); merge it in before the rgb pass.
+rawTokens.tokens['github-dark'] = require('./src/lib/assets/tokens/githubDark.json')
+const figmaTokens = makeRgb(rawTokens)
 const { darkModeName, lightModeName } = require('./src/lib/assets/tokens/colorTokensConfig')
 
-const tokens = { dark: figmaTokens.tokens[darkModeName], light: figmaTokens.tokens[lightModeName] }
+const tokens = {
+	dark: figmaTokens.tokens[darkModeName],
+	light: figmaTokens.tokens[lightModeName],
+	githubDark: figmaTokens.tokens['github-dark']
+}
 const primitives = figmaTokens.primitives.light
 
 // Helper function to create color definition based on whether the value contains alpha
@@ -571,6 +579,12 @@ const config = {
 				...Object.entries(tokens.dark).map(([key, value]) => [`--color-${key}`, value]),
 				...Object.entries(tokens.light).map(([key, value]) => [`--color-${key}-inverse`, value])
 			])
+			// GitHub dark variant: overrides the default dark variables when the
+			// `github-dark` class is present alongside `dark` (see html.&.dark.github-dark below).
+			let githubDarkColorVariables = Object.fromEntries([
+				...Object.entries(tokens.githubDark).map(([key, value]) => [`--color-${key}`, value]),
+				...Object.entries(tokens.light).map(([key, value]) => [`--color-${key}-inverse`, value])
+			])
 
 			addBase({
 				html: {
@@ -600,10 +614,31 @@ const config = {
 
 						...darkColorVariables,
 
+						// Sidebar rail chrome — consumed via var(--sidebar-bg-dark) (see sidebarChrome.ts).
+						'--sidebar-bg-dark': '#1e232e',
+
 						'--vscode-editorSuggestWidget-background': '#252526',
 						'--vscode-editorHoverWidget-foreground': '#cccccc',
 						'--vscode-editorHoverWidget-border': '#454545',
 						'--vscode-editorHoverWidget-statusBarBackground': '#2c2c2d'
+					},
+					'&.dark.github-dark': {
+						backgroundColor: `rgb(${tokens.githubDark['surface-primary']})`,
+						color: `rgb(${tokens.githubDark['text-primary']})`,
+
+						...githubDarkColorVariables,
+
+						// GitHub's canvas.inset — the authentic recessed surface, sitting below
+						// the canvas (#0d1117) like the sidebar-vs-primary relationship in the
+						// default dark theme.
+						'--sidebar-bg-dark': '#010409',
+
+						// Monaco popup chrome — the &.dark defaults above are VS Code's greys;
+						// override so the widgets match the GitHub Dark palette in this variant.
+						'--vscode-editorSuggestWidget-background': '#1c2128',
+						'--vscode-editorHoverWidget-foreground': '#c9d1d9',
+						'--vscode-editorHoverWidget-border': '#30363d',
+						'--vscode-editorHoverWidget-statusBarBackground': '#1c2128'
 					}
 				},
 				h1: {
@@ -842,20 +877,20 @@ const config = {
 						'colors.gray.600'
 					)})`
 				},
+				// Drive pane/splitter chrome off the theme CSS variables (not literal token
+				// values) so every theme — light, dark, and the GitHub dark variant — is
+				// covered by a single rule. A `.dark`-specific literal here would freeze the
+				// default dark color and ignore the variant.
 				'.splitpanes__pane': {
-					backgroundColor: `rgb(${tokens.light['surface-primary']})` + ' !important',
-					overflow: 'auto !important'
-				},
-				'.dark .splitpanes__pane': {
-					backgroundColor: `rgb(${tokens.dark['surface-primary']})` + ' !important',
+					backgroundColor: 'rgb(var(--color-surface-primary)) !important',
 					overflow: 'auto !important'
 				},
 				'.splitpanes__splitter': {
-					backgroundColor: `rgb(${tokens.light['border-light']})` + ' !important',
+					backgroundColor: 'rgb(var(--color-border-light)) !important',
 					margin: '0 !important',
 					border: 'none !important',
 					'&::after': {
-						backgroundColor: `rgb(${tokens.light['border-light']})` + ' !important',
+						backgroundColor: 'rgb(var(--color-border-light)) !important',
 						margin: '0 !important',
 						transform: 'none !important',
 						transition: 'opacity 200ms !important',
@@ -868,12 +903,6 @@ const config = {
 						zIndex: '1001 !important'
 					}
 				},
-				'.dark .splitpanes__splitter': {
-					backgroundColor: `rgb(${tokens.dark['border-light']})` + ' !important',
-					'&::after': {
-						backgroundColor: `rgb(${tokens.dark['border-light']})` + ' !important'
-					}
-				},
 				'.splitpanes--vertical>.splitpanes__splitter': {
 					width: '1px !important',
 					'&::before': {

From bff654596fb9cf8b086919367614ba0915cd7b87 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Tue, 28 Jul 2026 18:41:52 +0200
Subject: [PATCH 13/24] fix: render the flow editor's error handler node as an
 inert run marker (#10391)

* fix(frontend): render the error handler as an inert run marker in the flow editor graph

* fix(frontend): dismiss nested error handler markers via a dedicated handler

* docs(frontend): note that error handler markers are keyed by failing step
---
 .../flows/map/FlowModuleSchemaMap.svelte      |  1 +
 .../lib/components/graph/FlowGraphV2.svelte   |  9 +++
 .../components/graph/graphBuilder.svelte.ts   | 44 +++++++++++-
 .../renderers/nodes/FailureModuleNode.svelte  | 70 +++++++++++++++++++
 4 files changed, 122 insertions(+), 2 deletions(-)
 create mode 100644 frontend/src/lib/components/graph/renderers/nodes/FailureModuleNode.svelte

diff --git a/frontend/src/lib/components/flows/map/FlowModuleSchemaMap.svelte b/frontend/src/lib/components/flows/map/FlowModuleSchemaMap.svelte
index 43f57485d9..82f91306c0 100644
--- a/frontend/src/lib/components/flows/map/FlowModuleSchemaMap.svelte
+++ b/frontend/src/lib/components/flows/map/FlowModuleSchemaMap.svelte
@@ -610,6 +610,7 @@
 			{flowHasChanged}
 			chatInputEnabled={Boolean(flowStore.val.value?.chat_input_enabled)}
 			onDelete={(id) => requestDelete([id])}
+			onDismissRunNode={(id) => onDelete?.(id)}
 			onInsert={async (detail) => {
 				if (!flowStore.val.value.modules || !Array.isArray(flowStore.val.value.modules)) return
 				await tick()
diff --git a/frontend/src/lib/components/graph/FlowGraphV2.svelte b/frontend/src/lib/components/graph/FlowGraphV2.svelte
index 7547dbcadb..bb43e1dc22 100644
--- a/frontend/src/lib/components/graph/FlowGraphV2.svelte
+++ b/frontend/src/lib/components/graph/FlowGraphV2.svelte
@@ -27,6 +27,7 @@
 		type SimplifiableFlow
 	} from './graphBuilder.svelte'
 	import ModuleNode from './renderers/nodes/ModuleNode.svelte'
+	import FailureModuleNode from './renderers/nodes/FailureModuleNode.svelte'
 	import InputNode from './renderers/nodes/InputNode.svelte'
 	import BranchAllStart from './renderers/nodes/BranchAllStart.svelte'
 	import BranchAllEndNode from './renderers/nodes/BranchAllEndNode.svelte'
@@ -169,6 +170,9 @@
 		onMoveMultiple?: (ids: string[]) => void
 		movingIds?: string[]
 		onDelete?: (id: string) => void
+		/** Forget the run state of a node that only mirrors a run (the error handler marker), so it
+		 * stops being rendered. Must not touch the flow itself. */
+		onDismissRunNode?: (id: string) => void
 		onInsert?: (detail: {
 			sourceId?: string
 			targetId?: string
@@ -218,6 +222,7 @@
 	let {
 		onInsert = undefined,
 		onDelete = undefined,
+		onDismissRunNode = undefined,
 		onMove = undefined,
 		onDuplicate = undefined,
 		onDeleteBranch = undefined,
@@ -531,6 +536,9 @@
 		},
 		hideJobStatus: () => {
 			onHideJobStatus?.()
+		},
+		dismissRunNode: (id: string) => {
+			onDismissRunNode?.(id)
 		}
 	}
 
@@ -806,6 +814,7 @@
 	const nodeTypes = {
 		input2: InputNode,
 		module: ModuleNode,
+		failureModule: FailureModuleNode,
 		branchAllStart: BranchAllStart,
 		branchAllEnd: BranchAllEndNode,
 		forLoopEnd: ForLoopEndNode,
diff --git a/frontend/src/lib/components/graph/graphBuilder.svelte.ts b/frontend/src/lib/components/graph/graphBuilder.svelte.ts
index 41223a7a96..7a568bdbe4 100644
--- a/frontend/src/lib/components/graph/graphBuilder.svelte.ts
+++ b/frontend/src/lib/components/graph/graphBuilder.svelte.ts
@@ -62,6 +62,8 @@ export type GraphEventHandlers = {
 	deleteBranch: (detail: { id: string; index: number }, label: string) => void
 	select: (mod: string | FlowModule) => void
 	delete: (detail: { id: string }, label: string) => void
+	/** Drop a node that only mirrors run state (the error handler marker). Never edits the flow. */
+	dismissRunNode: (id: string) => void
 	newBranch: (id: string) => void
 	move: (detail: { id: string }) => void
 	duplicate: (detail: { id: string }) => void
@@ -123,6 +125,7 @@ export type FlowNode =
 	| CollapsedGroupN
 	| GroupHeadN
 	| GroupEndN
+	| FailureModuleN
 
 export type InputN = {
 	type: 'input2'
@@ -163,6 +166,18 @@ export type ModuleN = {
 	}
 }
 
+/** The error handler as it appears in the editor graph once a run triggered it: an inert
+ * marker of where the handler fired, not an editable step of the flow structure. */
+export type FailureModuleN = {
+	type: 'failureModule'
+	data: {
+		id: string
+		module: FlowModule
+		eventHandlers: GraphEventHandlers
+		flowModuleState: GraphModuleState | undefined
+	}
+}
+
 export type BranchAllStartN = {
 	type: 'branchAllStart'
 	data: {
@@ -484,6 +499,29 @@ export function graphBuilder(
 			return module.id
 		}
 
+		// In the editor the error handler is configured from its own header button, so its graph node
+		// is only a marker of the last run: inert, dismissable, and never selectable. Everywhere else
+		// (run view, viewers) it stays a regular step card.
+		function addFailureNode(module: FlowModule) {
+			if (!extra.editMode) {
+				return addNode(module)
+			}
+
+			nodes.push({
+				id: module.id,
+				data: {
+					id: module.id,
+					module,
+					eventHandlers: eventHandlers,
+					flowModuleState: extra.flowModuleStates?.[module.id]
+				},
+				type: 'failureModule',
+				selectable: false
+			})
+
+			return module.id
+		}
+
 		// TODO : Do better than this
 		const nodeIdsWithOutputAssets = new Set(
 			getAllModules(modules)
@@ -1194,6 +1232,8 @@ export function graphBuilder(
 		}
 
 		if (failureModule) {
+			// Keyed by failing step, so a step that failed several times (loop iterations each run
+			// their own handler, with ids like `failure-0-1`) gets one marker, not a stack of them.
 			let toAdd: Record<string, string> = {}
 			Object.keys(extra.flowModuleStates ?? {}).forEach((id) => {
 				if (id.startsWith('failure')) {
@@ -1205,7 +1245,7 @@ export function graphBuilder(
 			})
 
 			Object.entries(toAdd).forEach((x) => {
-				addNode({ ...failureModule, id: x[1] })
+				addFailureNode({ ...failureModule, id: x[1] })
 				addEdge(x[0], x[1], undefined, undefined, { type: 'empty' })
 			})
 		}
@@ -1217,7 +1257,7 @@ export function graphBuilder(
 		}
 
 		if (failureModule && !extra.flowModuleStates) {
-			addNode(failureModule)
+			addFailureNode(failureModule)
 		}
 
 		Object.keys(parents).forEach((key) => {
diff --git a/frontend/src/lib/components/graph/renderers/nodes/FailureModuleNode.svelte b/frontend/src/lib/components/graph/renderers/nodes/FailureModuleNode.svelte
new file mode 100644
index 0000000000..49ccbe46d6
--- /dev/null
+++ b/frontend/src/lib/components/graph/renderers/nodes/FailureModuleNode.svelte
@@ -0,0 +1,70 @@
+<script lang="ts">
+	import { Bug, EyeOff } from 'lucide-svelte'
+	import { twMerge } from 'tailwind-merge'
+	import NodeWrapper from './NodeWrapper.svelte'
+	import Tooltip from '$lib/components/meltComponents/Tooltip.svelte'
+	import type { FailureModuleN } from '../../graphBuilder.svelte'
+	import { getNodeColorClasses, NODE } from '$lib/components/graph'
+	import { msToSec } from '$lib/utils'
+
+	interface Props {
+		data: FailureModuleN['data']
+	}
+
+	let { data }: Props = $props()
+
+	let state = $derived(data.flowModuleState)
+	let colorClasses = $derived(getNodeColorClasses(state?.skipped ? '_Skipped' : state?.type, false))
+</script>
+
+<NodeWrapper>
+	{#if state?.duration_ms}
+		<div
+			class="absolute z-5 right-0 -top-4 mr-2 center-center text-2xs font-normal text-gray-400 dark:text-gray-500"
+		>
+			{msToSec(state.duration_ms)}s
+		</div>
+	{/if}
+	<div
+		class="flex flex-row justify-center items-center"
+		style="width: {NODE.width}px; height: {NODE.height}px;"
+	>
+		<div class="group relative">
+			<Tooltip placement="bottom">
+				<div
+					class={twMerge(
+						'flex flex-row items-center gap-2 rounded-md border border-dashed border-border-normal px-3 py-1.5 max-w-full cursor-default',
+						colorClasses.bg
+					)}
+				>
+					<Bug size={14} class={twMerge('shrink-0', colorClasses.text)} />
+					<div class={twMerge('truncate text-2xs', colorClasses.text)}>
+						{data.module.summary || 'Error handler'}
+					</div>
+				</div>
+				{#snippet text()}
+					Marks where the error handler ran during the last run. It is not a step of the flow: edit
+					it from the error handler button above the graph.
+				{/snippet}
+			</Tooltip>
+			<!-- Deliberately not an `X` on a bug badge: that is the header control which deletes
+			`failure_module` for good. This one only hides a run marker. -->
+			<Tooltip
+				placement="top"
+				class="absolute -top-1.5 -right-1.5 opacity-0 transition-opacity group-hover:opacity-100 group-focus-within:opacity-100"
+			>
+				<button
+					type="button"
+					aria-label="Hide error handler run marker"
+					class="rounded-full border border-border bg-surface p-0.5 text-secondary hover:bg-surface-hover"
+					onclick={() => data.eventHandlers.dismissRunNode(data.id)}
+				>
+					<EyeOff size={11} />
+				</button>
+				{#snippet text()}
+					Hide this marker until the next run. The error handler itself is kept.
+				{/snippet}
+			</Tooltip>
+		</div>
+	</div>
+</NodeWrapper>

From 7ac2909b302c7ffa8589e9676c5cc006b8f5708f Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Tue, 28 Jul 2026 18:59:01 +0200
Subject: [PATCH 14/24] fix: don't crash the flow editor when a step with an
 error handler marker is deleted (#10393)

* fix(frontend): don't anchor an error handler marker to a deleted step

* test(frontend): pin that topologicalSort tolerates a missing parent node
---
 .../components/graph/graphBuilder.svelte.ts   | 11 ++++++++-
 .../lib/components/graph/graphBuilder.test.ts | 23 +++++++++++++++++++
 2 files changed, 33 insertions(+), 1 deletion(-)
 create mode 100644 frontend/src/lib/components/graph/graphBuilder.test.ts

diff --git a/frontend/src/lib/components/graph/graphBuilder.svelte.ts b/frontend/src/lib/components/graph/graphBuilder.svelte.ts
index 7a568bdbe4..aefe57da68 100644
--- a/frontend/src/lib/components/graph/graphBuilder.svelte.ts
+++ b/frontend/src/lib/components/graph/graphBuilder.svelte.ts
@@ -402,7 +402,10 @@ export function topologicalSort(
 		if (visited.has(id)) return
 		visited.add(id)
 
-		const node = nodeMap.get(id)!
+		// A parent id with no node is a bug in whoever built the graph, but the whole editor
+		// unmounts if this throws, so skip it and let the rest of the graph render.
+		const node = nodeMap.get(id)
+		if (!node) return
 		node.parentIds?.forEach(visit)
 		result.push(node)
 	}
@@ -1245,6 +1248,12 @@ export function graphBuilder(
 			})
 
 			Object.entries(toAdd).forEach((x) => {
+				// Run state outlives the flow it ran on: a step deleted since the run keeps its marker
+				// in `flowModuleStates`. Anchoring the marker to a step that is no longer in the graph
+				// leaves a parent id no node answers to, which the layout cannot sort.
+				if (!nodes.some((n) => n.id === x[0])) {
+					return
+				}
 				addFailureNode({ ...failureModule, id: x[1] })
 				addEdge(x[0], x[1], undefined, undefined, { type: 'empty' })
 			})
diff --git a/frontend/src/lib/components/graph/graphBuilder.test.ts b/frontend/src/lib/components/graph/graphBuilder.test.ts
new file mode 100644
index 0000000000..1203ab57cd
--- /dev/null
+++ b/frontend/src/lib/components/graph/graphBuilder.test.ts
@@ -0,0 +1,23 @@
+import { describe, it, expect, vi } from 'vitest'
+
+// Mock modules that transitively import CSS/Monaco
+vi.mock('monaco-editor', () => ({}))
+vi.mock('@xyflow/svelte', () => ({}))
+vi.mock('./renderers/nodes/AssetNode.svelte', () => ({
+	assetDisplaysAsOutputInFlowGraph: () => false
+}))
+vi.mock('../modulesTest.svelte', () => ({}))
+
+import { topologicalSort } from './graphBuilder.svelte'
+
+describe('topologicalSort', () => {
+	it('skips parent ids with no node instead of throwing', () => {
+		const sorted = topologicalSort([
+			{ id: 'a' },
+			{ id: 'b', parentIds: ['a'] },
+			{ id: 'orphan', parentIds: ['deleted'] }
+		])
+
+		expect(sorted.map((n) => n.id)).toEqual(['orphan', 'b', 'a'])
+	})
+})

From 0de18dc017fbe2169f9ccf8dcf903c7684df2dae Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Tue, 28 Jul 2026 18:59:14 +0200
Subject: [PATCH 15/24] chore(main): release 1.775.0 (#10392)

* chore(main): release 1.775.0

* Apply automatic changes

---------

Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com>
---
 CHANGELOG.md                                  |  14 ++
 backend/Cargo.lock                            | 170 +++++++++---------
 backend/Cargo.toml                            |   4 +-
 .../parsers/windmill-parser-wasm/Cargo.lock   |  48 ++---
 .../parsers/windmill-parser-wasm/Cargo.toml   |   2 +-
 backend/windmill-api/openapi.yaml             |   2 +-
 benchmarks/lib.ts                             |   2 +-
 cli/src/core/constants.ts                     |   2 +-
 frontend/package-lock.json                    |   4 +-
 frontend/package.json                         |   2 +-
 lsp/Pipfile                                   |   2 +-
 openflow.openapi.yaml                         |   2 +-
 .../WindmillClient/WindmillClient.psd1        |   2 +-
 python-client/wmill/pyproject.toml            |   2 +-
 typescript-client/jsr.json                    |   2 +-
 typescript-client/package.json                |   2 +-
 version.txt                                   |   2 +-
 17 files changed, 139 insertions(+), 125 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index fdcf834d59..3eb210ce41 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,19 @@
 # Changelog
 
+## [1.775.0](https://github.com/windmill-labs/windmill/compare/v1.774.0...v1.775.0) (2026-07-28)
+
+
+### Features
+
+* add github dark mode variant switchable in user settings ([#10002](https://github.com/windmill-labs/windmill/issues/10002)) ([bd24664](https://github.com/windmill-labs/windmill/commit/bd246644c962f754a8477353d49ed39ba9b87ffd))
+* validate and make explicit the hub project's resource type export ([#10388](https://github.com/windmill-labs/windmill/issues/10388)) ([91b8ce5](https://github.com/windmill-labs/windmill/commit/91b8ce581a15baf7fc9ea4e983b50f233cf5e023))
+
+
+### Bug Fixes
+
+* render the flow editor's error handler node as an inert run marker ([#10391](https://github.com/windmill-labs/windmill/issues/10391)) ([bff6545](https://github.com/windmill-labs/windmill/commit/bff654596fb9cf8b086919367614ba0915cd7b87))
+* truncate strings on char boundaries to avoid panics on multibyte input ([#10390](https://github.com/windmill-labs/windmill/issues/10390)) ([faa2aaf](https://github.com/windmill-labs/windmill/commit/faa2aaf214444f4fbb129f10a46060d4a8ab3ae8))
+
 ## [1.774.0](https://github.com/windmill-labs/windmill/compare/v1.773.0...v1.774.0) (2026-07-28)
 
 
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index 51c2338ec8..8a96ea40aa 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -4482,13 +4482,13 @@ dependencies = [
 
 [[package]]
 name = "displaydoc"
-version = "0.2.6"
+version = "0.2.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ac70aa55017e108007fbaf5aa0f54b021c98f92ff8af59d42eda9da96e3dd4f"
+checksum = "c6232dd377dcc64799954cbd3a9bb882e9cdc1308ccd87b1c098f1fb2eaf82a8"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.119",
+ "syn 3.0.3",
 ]
 
 [[package]]
@@ -7073,7 +7073,7 @@ dependencies = [
  "bitflags 2.13.1",
  "libc",
  "plain",
- "redox_syscall 0.9.0",
+ "redox_syscall 0.9.1",
 ]
 
 [[package]]
@@ -9920,9 +9920,9 @@ dependencies = [
 
 [[package]]
 name = "redox_syscall"
-version = "0.9.0"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c5102a6aaa05aa011a238e178e6bca86d2cb56fc9f586d37cb80f5bca6e07759"
+checksum = "07507be7b4a5f9f26eeb41eeaebb1f5a7ff29dfb29739facc21d35bf8b11c21e"
 dependencies = [
  "bitflags 2.13.1",
 ]
@@ -14489,7 +14489,7 @@ dependencies = [
 
 [[package]]
 name = "windmill"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -14574,7 +14574,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-ai"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "async-stream",
  "async-trait",
@@ -14607,7 +14607,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-alerting"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14620,7 +14620,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "argon2",
@@ -14759,7 +14759,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-agent-workers"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14782,7 +14782,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-assets"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14797,7 +14797,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-auth"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14823,7 +14823,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-client"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "reqwest 0.12.28",
  "serde",
@@ -14833,7 +14833,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-configs"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14850,7 +14850,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-debug"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "axum 0.8.9",
  "base64 0.22.1",
@@ -14872,7 +14872,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-embeddings"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14895,7 +14895,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flow-conversations"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14911,7 +14911,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flows"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14932,7 +14932,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-groups"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14953,7 +14953,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-inputs"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14967,7 +14967,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-integration-tests"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -15002,7 +15002,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-jobs"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15027,7 +15027,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-npm-proxy"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "axum 0.8.9",
  "flate2",
@@ -15045,7 +15045,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-openapi"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15067,7 +15067,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-schedule"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15087,7 +15087,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-scripts"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15124,7 +15124,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-settings"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15152,7 +15152,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-sse"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "lazy_static",
  "serde",
@@ -15164,7 +15164,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-users"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "argon2",
  "axum 0.8.9",
@@ -15189,7 +15189,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workers"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15203,7 +15203,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workspaces"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15238,7 +15238,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-audit"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "chrono",
  "lazy_static",
@@ -15252,7 +15252,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-autoscaling"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15271,7 +15271,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-common"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "aes-gcm",
  "aho-corasick",
@@ -15375,7 +15375,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-dep-map"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "chrono",
  "itertools 0.14.0",
@@ -15394,7 +15394,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-git-sync"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "regex",
  "serde",
@@ -15409,7 +15409,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-indexer"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "astral-tokio-tar",
@@ -15433,7 +15433,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-jseval"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "futures",
@@ -15450,7 +15450,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "itertools 0.14.0",
  "lazy_static",
@@ -15466,7 +15466,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-mcp"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15487,7 +15487,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-native-triggers"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15518,7 +15518,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-oauth"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "arc-swap",
@@ -15543,7 +15543,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-object-store"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "async-stream",
@@ -15577,7 +15577,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-operator"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "futures",
@@ -15595,7 +15595,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "convert_case 0.6.0",
  "serde",
@@ -15604,7 +15604,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15616,7 +15616,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15628,7 +15628,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -15640,7 +15640,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15652,7 +15652,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15664,7 +15664,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -15675,7 +15675,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15686,7 +15686,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15698,7 +15698,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -15709,7 +15709,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15731,7 +15731,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15743,7 +15743,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15757,7 +15757,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "convert_case 0.6.0",
@@ -15774,7 +15774,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15787,7 +15787,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -15799,7 +15799,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15817,7 +15817,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -15833,7 +15833,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -15849,7 +15849,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -15860,7 +15860,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-queue"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15899,7 +15899,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-runtime-nativets"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "const_format",
@@ -15939,7 +15939,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-sql-datatype-parser-wasm"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "getrandom 0.3.4",
  "wasm-bindgen",
@@ -15950,7 +15950,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-store"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15984,7 +15984,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-test-utils"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16008,7 +16008,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16041,7 +16041,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-amqp"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16068,7 +16068,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-azure"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16101,7 +16101,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-email"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16121,7 +16121,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-gcp"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16155,7 +16155,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-http"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16191,7 +16191,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-kafka"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16214,7 +16214,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-mqtt"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16238,7 +16238,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-nats"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -16262,7 +16262,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-postgres"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16297,7 +16297,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-sqs"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16325,7 +16325,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-websocket"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16350,7 +16350,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "bitflags 2.13.1",
@@ -16369,7 +16369,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "async-once-cell",
@@ -16484,7 +16484,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker-volumes"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "bytes",
  "futures",
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index 27421f1052..41b511effd 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.774.0"
+version = "1.775.0"
 authors.workspace = true
 edition.workspace = true
 
@@ -88,7 +88,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal", "./parsers/windmill-parser-wasm"]
 
 [workspace.package]
-version = "1.774.0"
+version = "1.775.0"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.lock b/backend/parsers/windmill-parser-wasm/Cargo.lock
index 1c110c1a3a..ae0e40d701 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.lock
+++ b/backend/parsers/windmill-parser-wasm/Cargo.lock
@@ -6191,7 +6191,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windmill-common"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "aho-corasick",
  "anyhow",
@@ -6272,7 +6272,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -6284,7 +6284,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "convert_case",
  "serde",
@@ -6293,7 +6293,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6305,7 +6305,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6317,7 +6317,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -6329,7 +6329,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6341,7 +6341,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6353,7 +6353,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -6364,7 +6364,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6375,7 +6375,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6387,7 +6387,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6398,7 +6398,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -6420,7 +6420,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6432,7 +6432,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6446,7 +6446,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "convert_case",
@@ -6463,7 +6463,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6476,7 +6476,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -6488,7 +6488,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6506,7 +6506,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -6522,7 +6522,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6538,7 +6538,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wasm"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "getrandom 0.2.17",
@@ -6570,7 +6570,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -6581,7 +6581,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.774.0"
+version = "1.775.0"
 dependencies = [
  "anyhow",
  "bitflags",
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.toml b/backend/parsers/windmill-parser-wasm/Cargo.toml
index 4f372a5a5f..1fc6a3bddb 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.toml
+++ b/backend/parsers/windmill-parser-wasm/Cargo.toml
@@ -12,7 +12,7 @@ resolver = "2"
 members = ["."]
 
 [workspace.package]
-version = "1.774.0"
+version = "1.775.0"
 edition = "2021"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index aaec1d2fb3..b695cfa6bd 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.774.0
+  version: 1.775.0
   title: Windmill API
 
   contact:
diff --git a/benchmarks/lib.ts b/benchmarks/lib.ts
index 2a211772a9..392090630e 100644
--- a/benchmarks/lib.ts
+++ b/benchmarks/lib.ts
@@ -2,7 +2,7 @@ import { sleep } from "https://deno.land/x/sleep@v1.2.1/mod.ts";
 import * as windmill from "https://deno.land/x/windmill@v1.174.0/mod.ts";
 import * as api from "https://deno.land/x/windmill@v1.174.0/windmill-api/index.ts";
 
-export const VERSION = "v1.774.0";
+export const VERSION = "v1.775.0";
 
 export async function login(email: string, password: string): Promise<string> {
   return await windmill.UserService.login({
diff --git a/cli/src/core/constants.ts b/cli/src/core/constants.ts
index 2039ac17b6..1228b95cf1 100644
--- a/cli/src/core/constants.ts
+++ b/cli/src/core/constants.ts
@@ -10,4 +10,4 @@ export const WM_FORK_PREFIX = "wm-fork";
 // (e.g. utils.ts) can read it without importing main.ts and creating a circular
 // dependency (main → workspace → utils → main) that triggers a TDZ.
 // Re-exported from main.ts for backwards compatibility.
-export const VERSION = "1.774.0";
+export const VERSION = "1.775.0";
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 928a866e7d..4382a820d9 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -1,12 +1,12 @@
 {
 	"name": "@windmill-labs/components",
-	"version": "1.774.0",
+	"version": "1.775.0",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "@windmill-labs/components",
-			"version": "1.774.0",
+			"version": "1.775.0",
 			"hasInstallScript": true,
 			"license": "AGPL-3.0",
 			"dependencies": {
diff --git a/frontend/package.json b/frontend/package.json
index 15b367e6d5..5179a62a52 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@windmill-labs/components",
-	"version": "1.774.0",
+	"version": "1.775.0",
 	"scripts": {
 		"dev": "vite dev",
 		"dev:ui-builder": "mv static/ui_builder static/ui_builder.dev-disabled 2>/dev/null || true ; trap 'mv static/ui_builder.dev-disabled static/ui_builder 2>/dev/null || true' EXIT ; vite dev",
diff --git a/lsp/Pipfile b/lsp/Pipfile
index b5410d4f7b..4a26d80da0 100644
--- a/lsp/Pipfile
+++ b/lsp/Pipfile
@@ -4,7 +4,7 @@ verify_ssl = true
 name = "pypi"
 
 [packages]
-wmill = ">=1.774.0"
+wmill = ">=1.775.0"
 sendgrid = "*"
 mysql-connector-python = "*"
 pymongo = "*"
diff --git a/openflow.openapi.yaml b/openflow.openapi.yaml
index 32f6991584..65b50c6475 100644
--- a/openflow.openapi.yaml
+++ b/openflow.openapi.yaml
@@ -1,7 +1,7 @@
 openapi: '3.0.3'
 
 info:
-  version: 1.774.0
+  version: 1.775.0
   title: OpenFlow Spec
   contact:
     name: Ruben Fiszel
diff --git a/powershell-client/WindmillClient/WindmillClient.psd1 b/powershell-client/WindmillClient/WindmillClient.psd1
index c1071fae9f..395c56e99a 100644
--- a/powershell-client/WindmillClient/WindmillClient.psd1
+++ b/powershell-client/WindmillClient/WindmillClient.psd1
@@ -12,7 +12,7 @@
     RootModule        = 'WindmillClient.psm1'
 
     # Version number of this module.
-    ModuleVersion     = '1.774.0'
+    ModuleVersion     = '1.775.0'
 
     # Supported PSEditions
     # CompatiblePSEditions = @()
diff --git a/python-client/wmill/pyproject.toml b/python-client/wmill/pyproject.toml
index f3296b4149..cb3ff3a9eb 100644
--- a/python-client/wmill/pyproject.toml
+++ b/python-client/wmill/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill"
-version = "1.774.0"
+version = "1.775.0"
 description = "A client library for accessing Windmill server wrapping the Windmill client API"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/typescript-client/jsr.json b/typescript-client/jsr.json
index f5dce5c510..8555ae900b 100644
--- a/typescript-client/jsr.json
+++ b/typescript-client/jsr.json
@@ -1,6 +1,6 @@
 {
   "name": "@windmill/windmill",
-  "version": "1.774.0",
+  "version": "1.775.0",
   "exports": "./src/index.ts",
   "publish": {
     "exclude": ["!src", "./s3Types.ts", "./sqlUtils.ts", "./client.ts", "./wacError.ts"]
diff --git a/typescript-client/package.json b/typescript-client/package.json
index 55f118db9e..6a5df397a8 100644
--- a/typescript-client/package.json
+++ b/typescript-client/package.json
@@ -1,7 +1,7 @@
 {
   "name": "windmill-client",
   "description": "Windmill SDK client for browsers and Node.js",
-  "version": "1.774.0",
+  "version": "1.775.0",
   "author": "Ruben Fiszel",
   "license": "Apache 2.0",
   "homepage": "https://github.com/windmill-labs/windmill/tree/main/typescript-client#readme",
diff --git a/version.txt b/version.txt
index 9ec4850224..cce24028ca 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-1.774.0
+1.775.0

From d842f765a457f0c80a2cd1eb06bc703167512160 Mon Sep 17 00:00:00 2001
From: Guilhem <guilhemlemouel@gmail.com>
Date: Tue, 28 Jul 2026 19:34:17 +0200
Subject: [PATCH 16/24] fix(ai): render pending parallel tool calls as faded
 queued cards (#10208)

* fix(ai): show queued state instead of spinner for pending parallel tool calls

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ai): clear queued tool cards on chat cancel or stream error

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ai): render queued tool calls faded with imperative labels

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ai): keep queued labels past preAction, humanize camelCase names

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* style: drop narrating comment in queuedToolStatus

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ai): run preAction at tool promotion, dedupe queued-state comments

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
---
 .../copilot/chat/AIChatManager.svelte.ts      |  3 +-
 .../copilot/chat/ToolExecutionDisplay.svelte  | 10 ++-
 .../lib/components/copilot/chat/anthropic.ts  | 32 ++++---
 .../components/copilot/chat/global/core.ts    |  3 +
 .../copilot/chat/openai-responses.ts          | 12 +--
 .../components/copilot/chat/shared.test.ts    | 62 +++++++++++++
 .../src/lib/components/copilot/chat/shared.ts | 44 ++++++++-
 .../components/copilot/lib.toolCalls.test.ts  | 89 +++++++++++++++++++
 frontend/src/lib/components/copilot/lib.ts    | 32 +++++--
 9 files changed, 261 insertions(+), 26 deletions(-)

diff --git a/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts b/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
index a1f90c546d..4bfb6f90df 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
+++ b/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
@@ -3828,10 +3828,11 @@ export class AIChatManager {
 
 	cancelLoadingTools = (messageText: 'Canceled' | 'Error' = 'Canceled') => {
 		this.displayMessages = this.displayMessages.map((message) => {
-			if (message.role === 'tool' && message.isLoading) {
+			if (message.role === 'tool' && (message.isLoading || message.isQueued)) {
 				return {
 					...message,
 					isLoading: false,
+					isQueued: false,
 					// A question's card disappears once canceled, so keep the question
 					// itself readable in the collapsed header.
 					content: message.userQuestion
diff --git a/frontend/src/lib/components/copilot/chat/ToolExecutionDisplay.svelte b/frontend/src/lib/components/copilot/chat/ToolExecutionDisplay.svelte
index 8360ed962f..a1ee9984e5 100644
--- a/frontend/src/lib/components/copilot/chat/ToolExecutionDisplay.svelte
+++ b/frontend/src/lib/components/copilot/chat/ToolExecutionDisplay.svelte
@@ -26,6 +26,7 @@
 
 	const isSuccessful = $derived(
 		!message.isLoading &&
+			!message.isQueued &&
 			!message.error &&
 			!message.needsConfirmation &&
 			!message.isStreamingArguments
@@ -64,7 +65,14 @@
 {#if activeUserQuestion}
 	<AskUserQuestionDisplay toolCallId={message.tool_call_id} userQuestion={activeUserQuestion} />
 {:else}
-	<div class="font-mono text-xs">
+	<!-- Queued calls (waiting their turn behind the executing tool) are faded: the
+	     reduced weight is what says "not started" — no icon, no spinner. -->
+	<div
+		class={twMerge(
+			'font-mono text-xs',
+			message.isQueued && !message.error ? 'opacity-60 hover:opacity-100 transition-opacity' : ''
+		)}
+	>
 		<!-- Collapsible Header -->
 		{#snippet headerButton()}
 			<button
diff --git a/frontend/src/lib/components/copilot/chat/anthropic.ts b/frontend/src/lib/components/copilot/chat/anthropic.ts
index e9707e05ab..7273dc8cd5 100644
--- a/frontend/src/lib/components/copilot/chat/anthropic.ts
+++ b/frontend/src/lib/components/copilot/chat/anthropic.ts
@@ -19,6 +19,7 @@ import { applyReasoningToConfig } from '../reasoningRegistry'
 import {
 	appendPendingToolImages,
 	processToolCall,
+	queuedToolStatus,
 	type Tool,
 	type ToolCallbacks,
 	type WebSearchSource
@@ -227,7 +228,7 @@ export async function parseAnthropicCompletion(
 
 				callbacks.setToolStatus(toolId, {
 					isLoading: true,
-					content: tool?.streamingLabel ?? `Calling ${toolName}...`,
+					content: tool?.streamingLabel ?? `Preparing ${toolName}...`,
 					toolName,
 					isStreamingArguments: shouldStream,
 					showFade: tool?.showFade,
@@ -256,6 +257,17 @@ export async function parseAnthropicCompletion(
 					{ errorCode, query: webSearchQueries.get(block.tool_use_id), sources }
 				)
 			}
+		} else if (event.type === 'content_block_stop' && currentStreamingTool) {
+			// Args fully streamed: demote to queued (see queuedToolStatus). Server-side
+			// web search is exempt — it executes remotely and never goes through
+			// processToolCall, so demoting it would strand the card as queued.
+			if (!currentStreamingTool.isWebSearch) {
+				callbacks.setToolStatus(
+					currentStreamingTool.tempId,
+					queuedToolStatus(tools, currentStreamingTool.toolName, accumulatedJson)
+				)
+			}
+			currentStreamingTool = undefined
 		}
 	})
 
@@ -275,7 +287,10 @@ export async function parseAnthropicCompletion(
 	})
 
 	completion.on('inputJson', (partialJson: string) => {
-		if (currentStreamingTool?.isWebSearch) {
+		if (!currentStreamingTool) {
+			return
+		}
+		if (currentStreamingTool.isWebSearch) {
 			accumulatedJson += partialJson
 			const query = partialWebSearchQuery(accumulatedJson)
 			if (query) {
@@ -284,10 +299,10 @@ export async function parseAnthropicCompletion(
 			}
 			return
 		}
-		if (currentStreamingTool?.shouldStream && currentStreamingTool.tempId) {
-			// Accumulate the partial JSON
-			accumulatedJson += partialJson
-
+		// Accumulated even for non-streamArguments tools: queuedToolStatus derives
+		// the queued header from the completed args at content_block_stop.
+		accumulatedJson += partialJson
+		if (currentStreamingTool.shouldStream && currentStreamingTool.tempId) {
 			// Try to parse and display
 			try {
 				const parsed = JSON.parse(accumulatedJson)
@@ -352,11 +367,6 @@ export async function parseAnthropicCompletion(
 						arguments: JSON.stringify(block.input)
 					}
 				})
-				// Preprocess tool if it has a preAction
-				const tool = tools.find((t) => t.def.function.name === block.name)
-				if (tool && tool.preAction) {
-					tool.preAction({ toolCallbacks: callbacks, toolId: block.id })
-				}
 			}
 		}
 
diff --git a/frontend/src/lib/components/copilot/chat/global/core.ts b/frontend/src/lib/components/copilot/chat/global/core.ts
index 39b483ddc7..1034dcb62a 100644
--- a/frontend/src/lib/components/copilot/chat/global/core.ts
+++ b/frontend/src/lib/components/copilot/chat/global/core.ts
@@ -2989,6 +2989,7 @@ export const globalTools: Tool<{}>[] = [
 		},
 		requiresConfirmation: true,
 		confirmationMessage: (args) => `Run a test of ${pathLeaf(args?.path, 'the script')}`,
+		queuedLabel: (args) => `Test ${args?.path ?? 'the script'}`,
 		showDetails: true,
 		autoCollapseDetails: false
 	},
@@ -3000,6 +3001,7 @@ export const globalTools: Tool<{}>[] = [
 		},
 		requiresConfirmation: true,
 		confirmationMessage: (args) => `Run a test of ${pathLeaf(args?.path, 'the flow')}`,
+		queuedLabel: (args) => `Test ${args?.path ?? 'the flow'}`,
 		showDetails: true,
 		autoCollapseDetails: false
 	},
@@ -3012,6 +3014,7 @@ export const globalTools: Tool<{}>[] = [
 		requiresConfirmation: true,
 		confirmationMessage: (args) =>
 			`Run a test of step "${args?.stepId ?? ''}" in ${pathLeaf(args?.path, 'the flow')}`,
+		queuedLabel: (args) => `Test step "${args?.stepId ?? ''}" of ${args?.path ?? 'the flow'}`,
 		showDetails: true,
 		autoCollapseDetails: false
 	},
diff --git a/frontend/src/lib/components/copilot/chat/openai-responses.ts b/frontend/src/lib/components/copilot/chat/openai-responses.ts
index 9db5baf42f..cf7bcd3b4a 100644
--- a/frontend/src/lib/components/copilot/chat/openai-responses.ts
+++ b/frontend/src/lib/components/copilot/chat/openai-responses.ts
@@ -16,6 +16,7 @@ import { applyReasoningToConfig } from '../reasoningRegistry'
 import {
 	appendPendingToolImages,
 	processToolCall,
+	queuedToolStatus,
 	type Tool,
 	type ToolCallbacks,
 	type WebSearchSource
@@ -402,7 +403,7 @@ export async function parseOpenAIResponsesCompletion(
 			callbacks.onMessageEnd()
 			callbacks.setToolStatus(`${item.id}`, {
 				isLoading: true,
-				content: tool?.streamingLabel ?? `Calling ${item.name}...`,
+				content: tool?.streamingLabel ?? `Preparing ${item.name}...`,
 				toolName: item.name,
 				isStreamingArguments: shouldStream,
 				showFade: tool?.showFade,
@@ -470,11 +471,12 @@ export async function parseOpenAIResponsesCompletion(
 
 	// Handle function call arguments done
 	runner.on('response.function_call_arguments.done', (event) => {
-		// Clear streaming state
+		// Args fully streamed: demote to queued (see queuedToolStatus).
 		currentStreamingTool = undefined
-		callbacks.setToolStatus(`${event.item_id}`, {
-			isStreamingArguments: false
-		})
+		callbacks.setToolStatus(
+			`${event.item_id}`,
+			queuedToolStatus(tools, toolCallsMap[event.item_id]?.name ?? '', event.arguments)
+		)
 
 		// Retrieve tool call metadata from map
 		const metadata = toolCallsMap[event.item_id]
diff --git a/frontend/src/lib/components/copilot/chat/shared.test.ts b/frontend/src/lib/components/copilot/chat/shared.test.ts
index 179742763f..0588d2a171 100644
--- a/frontend/src/lib/components/copilot/chat/shared.test.ts
+++ b/frontend/src/lib/components/copilot/chat/shared.test.ts
@@ -1069,6 +1069,68 @@ describe('trimJob', () => {
 	})
 })
 
+describe('processToolCall preAction', () => {
+	// preAction's "-ing" label must land at execution start, not stream time —
+	// firing it earlier would relabel a still-queued card as active.
+	it('invokes preAction at promotion, before the tool fn runs', async () => {
+		const { processToolCall } = await import('./shared')
+		const calls: string[] = []
+		const tool = {
+			def: { type: 'function' as const, function: { name: 'patch_app_file', parameters: {} } },
+			preAction: () => calls.push('preAction'),
+			fn: vi.fn().mockImplementation(async () => {
+				calls.push('fn')
+				return 'ok'
+			})
+		}
+		await processToolCall({
+			tools: [tool] as any,
+			toolCall: {
+				id: 'call_1',
+				type: 'function',
+				function: { name: 'patch_app_file', arguments: '{}' }
+			},
+			helpers: {},
+			toolCallbacks: { setToolStatus: vi.fn() } as any,
+			workspace: 'test'
+		})
+		expect(calls).toEqual(['preAction', 'fn'])
+	})
+})
+
+describe('queuedToolStatus', () => {
+	const tool = (extra: Record<string, unknown> = {}) => ({
+		def: { type: 'function' as const, function: { name: 'run_script', parameters: {} } },
+		fn: vi.fn(),
+		...extra
+	})
+
+	it('humanizes snake_case and camelCase tool names by default', async () => {
+		const { queuedToolStatus } = await import('./shared')
+		expect(queuedToolStatus([], 'run_script', '{}')).toMatchObject({
+			isLoading: false,
+			isQueued: true,
+			isStreamingArguments: false,
+			content: 'Run script'
+		})
+		expect(queuedToolStatus([], 'askUserQuestion', '{}').content).toBe('Ask user question')
+	})
+
+	it('derives the label from parsed args via queuedLabel', async () => {
+		const { queuedToolStatus } = await import('./shared')
+		const t = tool({ queuedLabel: (args: any) => `Test ${args.path}` })
+		expect(queuedToolStatus([t] as any, 'run_script', '{"path": "u/admin/x"}').content).toBe(
+			'Test u/admin/x'
+		)
+	})
+
+	it('falls back to the humanized name when args are truncated', async () => {
+		const { queuedToolStatus } = await import('./shared')
+		const t = tool({ queuedLabel: (args: any) => `Test ${args.path}` })
+		expect(queuedToolStatus([t] as any, 'run_script', '{"path": "u/adm').content).toBe('Run script')
+	})
+})
+
 describe('appendPendingToolImages', () => {
 	// Tool results are string-only, so tool-produced images ride a follow-up
 	// user message appended after the whole tool batch. It must land in BOTH
diff --git a/frontend/src/lib/components/copilot/chat/shared.ts b/frontend/src/lib/components/copilot/chat/shared.ts
index 40bdcd9540..76a1595c7b 100644
--- a/frontend/src/lib/components/copilot/chat/shared.ts
+++ b/frontend/src/lib/components/copilot/chat/shared.ts
@@ -577,6 +577,8 @@ export type ToolDisplayMessage = {
 	result?: any
 	logs?: string
 	isLoading?: boolean
+	/** Arguments fully streamed but execution not started (see queuedToolStatus). */
+	isQueued?: boolean
 	error?: string
 	needsConfirmation?: boolean
 	showDetails?: boolean
@@ -749,6 +751,7 @@ export async function processToolCall<T>({
 				content: validationError,
 				parameters: args,
 				isLoading: false,
+				isQueued: false,
 				isStreamingArguments: false,
 				error: validationError,
 				needsConfirmation: false,
@@ -773,12 +776,18 @@ export async function processToolCall<T>({
 				? tool.confirmationMessage(args)
 				: tool?.confirmationMessage
 
+		// preAction fires at promotion, not stream time, so its "-ing" label covers
+		// only the execution window — queued cards keep their imperative header.
+		// Before the promotion patch, so a confirmation label still wins the header.
+		tool?.preAction?.({ toolCallbacks, toolId: toolCall.id })
+
 		toolCallbacks.setToolStatus(toolCall.id, {
 			...(requiresConfirmation
 				? { content: confirmationContent ?? 'Waiting for confirmation...' }
 				: {}),
 			parameters: args,
 			isLoading: true,
+			isQueued: false,
 			needsConfirmation: needsConfirmation,
 			showDetails: tool?.showDetails,
 			autoCollapseDetails: tool?.autoCollapseDetails
@@ -851,6 +860,7 @@ export async function processToolCall<T>({
 		const errorMessage = formatToolError(err)
 		toolCallbacks.setToolStatus(toolCall.id, {
 			isLoading: false,
+			isQueued: false,
 			isStreamingArguments: false,
 			error: errorMessage
 		})
@@ -913,8 +923,40 @@ export interface Tool<T> {
 	streamArguments?: boolean
 	showFade?: boolean
 	/** Header shown while the model is still streaming this call's arguments,
-	 * before `fn` runs and sets a real status. Defaults to "Calling <name>...". */
+	 * before `fn` runs and sets a real status. Defaults to "Preparing <name>...". */
 	streamingLabel?: string
+	/** Header shown while the call waits its turn to execute (args fully streamed).
+	 * Pass a function to derive it from the parsed arguments (e.g. name the script
+	 * about to run). Defaults to the humanized tool name ("run_script" → "Run script"). */
+	queuedLabel?: string | ((args: any) => string)
+}
+
+/** Status patch demoting a tool call to the queued state once its arguments have
+ * fully streamed: it waits its turn (tool calls in one message run sequentially)
+ * and processToolCall flips it back to loading when execution starts. The header
+ * switches from the "-ing" streaming label to an imperative one so a waiting call
+ * doesn't read as active. */
+export function queuedToolStatus(
+	tools: Tool<any>[],
+	toolName: string,
+	argsString: string | undefined
+): Partial<ToolDisplayMessage> {
+	const tool = tools.find((t) => t.def.function.name === toolName)
+	const words = toolName
+		.replaceAll('_', ' ')
+		.replace(/([a-z0-9])([A-Z])/g, '$1 $2')
+		.toLowerCase()
+	let content = words.charAt(0).toUpperCase() + words.slice(1)
+	if (typeof tool?.queuedLabel === 'string') {
+		content = tool.queuedLabel
+	} else if (typeof tool?.queuedLabel === 'function') {
+		try {
+			content = tool.queuedLabel(JSON.parse(argsString || '{}'))
+		} catch {
+			// Truncated/invalid args: keep the humanized name; the error path handles the rest.
+		}
+	}
+	return { isLoading: false, isQueued: true, isStreamingArguments: false, content }
 }
 
 /** Status of a job the chat started and tracks in the jobs tray. Mirrors the
diff --git a/frontend/src/lib/components/copilot/lib.toolCalls.test.ts b/frontend/src/lib/components/copilot/lib.toolCalls.test.ts
index 36e667f57d..ef2708e570 100644
--- a/frontend/src/lib/components/copilot/lib.toolCalls.test.ts
+++ b/frontend/src/lib/components/copilot/lib.toolCalls.test.ts
@@ -134,6 +134,95 @@ describe('parseOpenAICompletion tool call arguments', () => {
 		expect(addedMessages).toEqual(messages)
 	})
 
+	it('marks only the executing tool call as loading when one message has several', async () => {
+		const { parseOpenAICompletion } = await import('./lib')
+		const statuses: Record<string, any> = {}
+		const callbacks = createCallbacks()
+		callbacks.setToolStatus.mockImplementation((id: string, patch: any) => {
+			statuses[id] = { ...statuses[id], ...patch }
+		})
+		// Snapshot both cards' statuses at each execution start: tools run
+		// sequentially, so the not-yet-started call must read as queued, not loading.
+		const seen: any[] = []
+		const fn = vi.fn().mockImplementation(async () => {
+			seen.push({ call_1: { ...statuses['call_1'] }, call_2: { ...statuses['call_2'] } })
+			return 'tool ok'
+		})
+
+		await parseOpenAICompletion(
+			streamOf([
+				toolCallChunk({
+					index: 0,
+					id: 'call_1',
+					function: { name: 'patch_app_file', arguments: '{}' }
+				}),
+				toolCallChunk({
+					index: 1,
+					id: 'call_2',
+					function: { name: 'patch_app_file', arguments: '{}' }
+				})
+			]),
+			callbacks,
+			[],
+			[],
+			[createTool(fn)] as any,
+			{},
+			undefined,
+			{ workspace: 'test' }
+		)
+
+		expect(seen).toHaveLength(2)
+		expect(seen[0].call_1).toMatchObject({ isLoading: true, isQueued: false })
+		// Queued header is the humanized tool name, not the "-ing" streaming label.
+		expect(seen[0].call_2).toMatchObject({
+			isLoading: false,
+			isQueued: true,
+			content: 'Patch app file'
+		})
+		expect(seen[1].call_1).toMatchObject({ isLoading: false })
+		expect(seen[1].call_2).toMatchObject({ isLoading: true, isQueued: false })
+	})
+
+	it('never leaves a call both queued and loading when deltas interleave', async () => {
+		const { parseOpenAICompletion } = await import('./lib')
+		const statuses: Record<string, any> = {}
+		// Merged state after every patch: a call demoted to queued then re-promoted
+		// by an interleaved delta must never keep both flags set at once.
+		const timeline: Array<{ id: string; isLoading: any; isQueued: any }> = []
+		const callbacks = createCallbacks()
+		callbacks.setToolStatus.mockImplementation((id: string, patch: any) => {
+			statuses[id] = { ...statuses[id], ...patch }
+			timeline.push({ id, isLoading: statuses[id].isLoading, isQueued: statuses[id].isQueued })
+		})
+
+		await parseOpenAICompletion(
+			streamOf([
+				toolCallChunk({
+					index: 0,
+					id: 'call_1',
+					function: { name: 'patch_app_file', arguments: '{"path": ' }
+				}),
+				toolCallChunk({
+					index: 1,
+					id: 'call_2',
+					function: { name: 'patch_app_file', arguments: '{}' }
+				}),
+				// call_1 resumes streaming after call_2 started: re-promotion must clear isQueued
+				toolCallChunk({ index: 0, function: { arguments: '"u/admin/app"}' } })
+			]),
+			callbacks,
+			[],
+			[],
+			[createTool()] as any,
+			{},
+			undefined,
+			{ workspace: 'test' }
+		)
+
+		const bothFlags = timeline.filter((s) => s.isLoading === true && s.isQueued === true)
+		expect(bothFlags).toEqual([])
+	})
+
 	it('executes a tool call with valid streamed arguments and keeps them verbatim', async () => {
 		const { parseOpenAICompletion } = await import('./lib')
 		const fn = vi.fn().mockResolvedValue('tool ok')
diff --git a/frontend/src/lib/components/copilot/lib.ts b/frontend/src/lib/components/copilot/lib.ts
index af6513a29e..89154880c0 100644
--- a/frontend/src/lib/components/copilot/lib.ts
+++ b/frontend/src/lib/components/copilot/lib.ts
@@ -20,6 +20,7 @@ import { formatResourceTypes } from './utils'
 import {
 	appendPendingToolImages,
 	processToolCall,
+	queuedToolStatus,
 	type Tool,
 	type ToolCallbacks
 } from './chat/shared'
@@ -1073,6 +1074,9 @@ export async function parseOpenAICompletion(
 	options?: { workspace?: string; provider?: string }
 ): Promise<{ shouldContinue: boolean; tokenUsage: ChatTokenUsage }> {
 	const finalToolCalls: Record<number, ChatCompletionChunk.Choice.Delta.ToolCall> = {}
+	// The tool call currently receiving argument deltas; when the stream moves on
+	// to the next call, the previous one is demoted to queued.
+	let streamingToolCallId: string | undefined = undefined
 	let malformedFunctionCallError = false
 	let tokenUsage = emptyChatTokenUsage()
 
@@ -1163,10 +1167,17 @@ export async function parseOpenAICompletion(
 					id: toolCallId
 				} = finalToolCall
 				if (funcName && toolCallId) {
-					const tool = tools.find((t) => t.def.function.name === funcName)
-					if (tool && tool.preAction) {
-						tool.preAction({ toolCallbacks: callbacks, toolId: toolCallId })
+					if (streamingToolCallId !== undefined && streamingToolCallId !== toolCallId) {
+						const previous = Object.values(finalToolCalls).find(
+							(tc) => tc.id === streamingToolCallId
+						)
+						callbacks.setToolStatus(
+							streamingToolCallId,
+							queuedToolStatus(tools, previous?.function?.name ?? '', previous?.function?.arguments)
+						)
 					}
+					streamingToolCallId = toolCallId
+					const tool = tools.find((t) => t.def.function.name === funcName)
 
 					const shouldStream = tool?.streamArguments ?? false
 					const accumulatedArgs = finalToolCall.function.arguments
@@ -1179,10 +1190,13 @@ export async function parseOpenAICompletion(
 						}
 					}
 
-					// Display tool call with streaming parameters if enabled
+					// Display tool call with streaming parameters if enabled. isQueued is
+					// cleared explicitly: a provider may interleave deltas of parallel
+					// calls, re-promoting a call that was already demoted to queued.
 					callbacks.setToolStatus(toolCallId, {
 						isLoading: true,
-						content: tool?.streamingLabel ?? `Calling ${funcName}...`,
+						isQueued: false,
+						content: tool?.streamingLabel ?? `Preparing ${funcName}...`,
 						toolName: funcName,
 						isStreamingArguments: shouldStream,
 						showFade: tool?.showFade,
@@ -1207,10 +1221,13 @@ export async function parseOpenAICompletion(
 
 	callbacks.onMessageEnd()
 
-	// Clear streaming state for all tool calls
+	// Stream over: every parsed call is queued until its turn in processToolCall.
 	for (const toolCall of Object.values(finalToolCalls)) {
 		if (toolCall.id) {
-			callbacks.setToolStatus(toolCall.id, { isStreamingArguments: false })
+			callbacks.setToolStatus(
+				toolCall.id,
+				queuedToolStatus(tools, toolCall.function?.name ?? '', toolCall.function?.arguments)
+			)
 		}
 	}
 
@@ -1240,6 +1257,7 @@ export async function parseOpenAICompletion(
 			if (invalidToolCallIds.has(toolCall.id)) {
 				callbacks.setToolStatus(toolCall.id, {
 					isLoading: false,
+					isQueued: false,
 					isStreamingArguments: false,
 					error: 'Tool call arguments were invalid or truncated'
 				})

From 39dd411481d450b1cdb92ddba3a8b613ddd2218a Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Tue, 28 Jul 2026 20:37:22 +0200
Subject: [PATCH 17/24] fix(frontend): add the preprocessor node before the
 error handler markers (#10395)

---
 .../components/graph/graphBuilder.svelte.ts   | 21 ++++++++++++-------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/frontend/src/lib/components/graph/graphBuilder.svelte.ts b/frontend/src/lib/components/graph/graphBuilder.svelte.ts
index aefe57da68..3e56a5cd5b 100644
--- a/frontend/src/lib/components/graph/graphBuilder.svelte.ts
+++ b/frontend/src/lib/components/graph/graphBuilder.svelte.ts
@@ -403,9 +403,12 @@ export function topologicalSort(
 		visited.add(id)
 
 		// A parent id with no node is a bug in whoever built the graph, but the whole editor
-		// unmounts if this throws, so skip it and let the rest of the graph render.
+		// unmounts if this throws, so warn and let the rest of the graph render.
 		const node = nodeMap.get(id)
-		if (!node) return
+		if (!node) {
+			console.warn('Edge to a node that does not exist: ', id)
+			return
+		}
 		node.parentIds?.forEach(visit)
 		result.push(node)
 	}
@@ -1234,6 +1237,14 @@ export function graphBuilder(
 			processModules(topLevelItems, undefined, inputNode, resultNode, false, undefined)
 		}
 
+		// Before the failure markers: the preprocessor can be the step that failed, and a marker is
+		// only anchored to a step already present in `nodes`.
+		if (preprocessorModule) {
+			addNode(preprocessorModule)
+			const id = JSON.parse(JSON.stringify(preprocessorModule.id))
+			addEdge(id, 'Input', undefined, undefined, { type: 'empty' })
+		}
+
 		if (failureModule) {
 			// Keyed by failing step, so a step that failed several times (loop iterations each run
 			// their own handler, with ids like `failure-0-1`) gets one marker, not a stack of them.
@@ -1259,12 +1270,6 @@ export function graphBuilder(
 			})
 		}
 
-		if (preprocessorModule) {
-			addNode(preprocessorModule)
-			const id = JSON.parse(JSON.stringify(preprocessorModule.id))
-			addEdge(id, 'Input', undefined, undefined, { type: 'empty' })
-		}
-
 		if (failureModule && !extra.flowModuleStates) {
 			addFailureNode(failureModule)
 		}

From cfb8ca4391c848b9f841fab1fb844c9d00cd4ad6 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Tue, 28 Jul 2026 20:43:07 +0200
Subject: [PATCH 18/24] chore(main): release 1.775.1 (#10394)

* chore(main): release 1.775.1

* Apply automatic changes

---------

Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com>
---
 CHANGELOG.md                                  |   8 +
 backend/Cargo.lock                            | 158 +++++++++---------
 backend/Cargo.toml                            |   4 +-
 .../parsers/windmill-parser-wasm/Cargo.lock   |  48 +++---
 .../parsers/windmill-parser-wasm/Cargo.toml   |   2 +-
 backend/windmill-api/openapi.yaml             |   2 +-
 benchmarks/lib.ts                             |   2 +-
 cli/src/core/constants.ts                     |   2 +-
 frontend/package-lock.json                    |   4 +-
 frontend/package.json                         |   2 +-
 lsp/Pipfile                                   |   2 +-
 openflow.openapi.yaml                         |   2 +-
 .../WindmillClient/WindmillClient.psd1        |   2 +-
 python-client/wmill/pyproject.toml            |   2 +-
 typescript-client/jsr.json                    |   2 +-
 typescript-client/package.json                |   2 +-
 version.txt                                   |   2 +-
 17 files changed, 127 insertions(+), 119 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3eb210ce41..ac51063de9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,13 @@
 # Changelog
 
+## [1.775.1](https://github.com/windmill-labs/windmill/compare/v1.775.0...v1.775.1) (2026-07-28)
+
+
+### Bug Fixes
+
+* **ai:** render pending parallel tool calls as faded queued cards ([#10208](https://github.com/windmill-labs/windmill/issues/10208)) ([d842f76](https://github.com/windmill-labs/windmill/commit/d842f765a457f0c80a2cd1eb06bc703167512160))
+* **frontend:** add the preprocessor node before the error handler markers ([#10395](https://github.com/windmill-labs/windmill/issues/10395)) ([39dd411](https://github.com/windmill-labs/windmill/commit/39dd411481d450b1cdb92ddba3a8b613ddd2218a))
+
 ## [1.775.0](https://github.com/windmill-labs/windmill/compare/v1.774.0...v1.775.0) (2026-07-28)
 
 
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index 8a96ea40aa..11167f13cf 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -14489,7 +14489,7 @@ dependencies = [
 
 [[package]]
 name = "windmill"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -14574,7 +14574,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-ai"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "async-stream",
  "async-trait",
@@ -14607,7 +14607,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-alerting"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14620,7 +14620,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "argon2",
@@ -14759,7 +14759,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-agent-workers"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14782,7 +14782,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-assets"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14797,7 +14797,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-auth"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14823,7 +14823,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-client"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "reqwest 0.12.28",
  "serde",
@@ -14833,7 +14833,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-configs"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14850,7 +14850,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-debug"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "axum 0.8.9",
  "base64 0.22.1",
@@ -14872,7 +14872,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-embeddings"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14895,7 +14895,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flow-conversations"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14911,7 +14911,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flows"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14932,7 +14932,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-groups"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14953,7 +14953,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-inputs"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14967,7 +14967,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-integration-tests"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -15002,7 +15002,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-jobs"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15027,7 +15027,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-npm-proxy"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "axum 0.8.9",
  "flate2",
@@ -15045,7 +15045,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-openapi"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15067,7 +15067,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-schedule"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15087,7 +15087,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-scripts"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15124,7 +15124,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-settings"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15152,7 +15152,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-sse"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "lazy_static",
  "serde",
@@ -15164,7 +15164,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-users"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "argon2",
  "axum 0.8.9",
@@ -15189,7 +15189,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workers"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15203,7 +15203,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workspaces"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15238,7 +15238,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-audit"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "chrono",
  "lazy_static",
@@ -15252,7 +15252,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-autoscaling"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15271,7 +15271,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-common"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "aes-gcm",
  "aho-corasick",
@@ -15375,7 +15375,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-dep-map"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "chrono",
  "itertools 0.14.0",
@@ -15394,7 +15394,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-git-sync"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "regex",
  "serde",
@@ -15409,7 +15409,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-indexer"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "astral-tokio-tar",
@@ -15433,7 +15433,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-jseval"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "futures",
@@ -15450,7 +15450,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "itertools 0.14.0",
  "lazy_static",
@@ -15466,7 +15466,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-mcp"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15487,7 +15487,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-native-triggers"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15518,7 +15518,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-oauth"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "arc-swap",
@@ -15543,7 +15543,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-object-store"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "async-stream",
@@ -15577,7 +15577,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-operator"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "futures",
@@ -15595,7 +15595,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "convert_case 0.6.0",
  "serde",
@@ -15604,7 +15604,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15616,7 +15616,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15628,7 +15628,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -15640,7 +15640,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15652,7 +15652,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15664,7 +15664,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -15675,7 +15675,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15686,7 +15686,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15698,7 +15698,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -15709,7 +15709,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15731,7 +15731,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15743,7 +15743,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15757,7 +15757,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "convert_case 0.6.0",
@@ -15774,7 +15774,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15787,7 +15787,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "serde",
@@ -15799,7 +15799,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15817,7 +15817,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -15833,7 +15833,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -15849,7 +15849,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "serde",
@@ -15860,7 +15860,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-queue"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15899,7 +15899,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-runtime-nativets"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "const_format",
@@ -15939,7 +15939,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-sql-datatype-parser-wasm"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "getrandom 0.3.4",
  "wasm-bindgen",
@@ -15950,7 +15950,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-store"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15984,7 +15984,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-test-utils"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16008,7 +16008,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16041,7 +16041,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-amqp"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16068,7 +16068,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-azure"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16101,7 +16101,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-email"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16121,7 +16121,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-gcp"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16155,7 +16155,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-http"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16191,7 +16191,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-kafka"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16214,7 +16214,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-mqtt"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16238,7 +16238,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-nats"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -16262,7 +16262,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-postgres"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16297,7 +16297,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-sqs"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16325,7 +16325,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-websocket"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16350,7 +16350,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "bitflags 2.13.1",
@@ -16369,7 +16369,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "async-once-cell",
@@ -16484,7 +16484,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker-volumes"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "bytes",
  "futures",
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index 41b511effd..49beac0b8a 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.775.0"
+version = "1.775.1"
 authors.workspace = true
 edition.workspace = true
 
@@ -88,7 +88,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal", "./parsers/windmill-parser-wasm"]
 
 [workspace.package]
-version = "1.775.0"
+version = "1.775.1"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.lock b/backend/parsers/windmill-parser-wasm/Cargo.lock
index ae0e40d701..e3639e30c2 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.lock
+++ b/backend/parsers/windmill-parser-wasm/Cargo.lock
@@ -6191,7 +6191,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windmill-common"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "aho-corasick",
  "anyhow",
@@ -6272,7 +6272,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -6284,7 +6284,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "convert_case",
  "serde",
@@ -6293,7 +6293,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6305,7 +6305,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6317,7 +6317,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -6329,7 +6329,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6341,7 +6341,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6353,7 +6353,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -6364,7 +6364,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6375,7 +6375,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6387,7 +6387,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6398,7 +6398,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -6420,7 +6420,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6432,7 +6432,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6446,7 +6446,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "convert_case",
@@ -6463,7 +6463,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6476,7 +6476,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "serde",
@@ -6488,7 +6488,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6506,7 +6506,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -6522,7 +6522,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6538,7 +6538,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wasm"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "getrandom 0.2.17",
@@ -6570,7 +6570,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "serde",
@@ -6581,7 +6581,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.775.0"
+version = "1.775.1"
 dependencies = [
  "anyhow",
  "bitflags",
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.toml b/backend/parsers/windmill-parser-wasm/Cargo.toml
index 1fc6a3bddb..9ee10c7fbb 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.toml
+++ b/backend/parsers/windmill-parser-wasm/Cargo.toml
@@ -12,7 +12,7 @@ resolver = "2"
 members = ["."]
 
 [workspace.package]
-version = "1.775.0"
+version = "1.775.1"
 edition = "2021"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index b695cfa6bd..381cf1b999 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.775.0
+  version: 1.775.1
   title: Windmill API
 
   contact:
diff --git a/benchmarks/lib.ts b/benchmarks/lib.ts
index 392090630e..e77bfb67ba 100644
--- a/benchmarks/lib.ts
+++ b/benchmarks/lib.ts
@@ -2,7 +2,7 @@ import { sleep } from "https://deno.land/x/sleep@v1.2.1/mod.ts";
 import * as windmill from "https://deno.land/x/windmill@v1.174.0/mod.ts";
 import * as api from "https://deno.land/x/windmill@v1.174.0/windmill-api/index.ts";
 
-export const VERSION = "v1.775.0";
+export const VERSION = "v1.775.1";
 
 export async function login(email: string, password: string): Promise<string> {
   return await windmill.UserService.login({
diff --git a/cli/src/core/constants.ts b/cli/src/core/constants.ts
index 1228b95cf1..bd5add7ecd 100644
--- a/cli/src/core/constants.ts
+++ b/cli/src/core/constants.ts
@@ -10,4 +10,4 @@ export const WM_FORK_PREFIX = "wm-fork";
 // (e.g. utils.ts) can read it without importing main.ts and creating a circular
 // dependency (main → workspace → utils → main) that triggers a TDZ.
 // Re-exported from main.ts for backwards compatibility.
-export const VERSION = "1.775.0";
+export const VERSION = "1.775.1";
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 4382a820d9..ad6838fa37 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -1,12 +1,12 @@
 {
 	"name": "@windmill-labs/components",
-	"version": "1.775.0",
+	"version": "1.775.1",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "@windmill-labs/components",
-			"version": "1.775.0",
+			"version": "1.775.1",
 			"hasInstallScript": true,
 			"license": "AGPL-3.0",
 			"dependencies": {
diff --git a/frontend/package.json b/frontend/package.json
index 5179a62a52..4bf61cee55 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@windmill-labs/components",
-	"version": "1.775.0",
+	"version": "1.775.1",
 	"scripts": {
 		"dev": "vite dev",
 		"dev:ui-builder": "mv static/ui_builder static/ui_builder.dev-disabled 2>/dev/null || true ; trap 'mv static/ui_builder.dev-disabled static/ui_builder 2>/dev/null || true' EXIT ; vite dev",
diff --git a/lsp/Pipfile b/lsp/Pipfile
index 4a26d80da0..a69114c915 100644
--- a/lsp/Pipfile
+++ b/lsp/Pipfile
@@ -4,7 +4,7 @@ verify_ssl = true
 name = "pypi"
 
 [packages]
-wmill = ">=1.775.0"
+wmill = ">=1.775.1"
 sendgrid = "*"
 mysql-connector-python = "*"
 pymongo = "*"
diff --git a/openflow.openapi.yaml b/openflow.openapi.yaml
index 65b50c6475..8ee13fa39f 100644
--- a/openflow.openapi.yaml
+++ b/openflow.openapi.yaml
@@ -1,7 +1,7 @@
 openapi: '3.0.3'
 
 info:
-  version: 1.775.0
+  version: 1.775.1
   title: OpenFlow Spec
   contact:
     name: Ruben Fiszel
diff --git a/powershell-client/WindmillClient/WindmillClient.psd1 b/powershell-client/WindmillClient/WindmillClient.psd1
index 395c56e99a..7bdcf6a788 100644
--- a/powershell-client/WindmillClient/WindmillClient.psd1
+++ b/powershell-client/WindmillClient/WindmillClient.psd1
@@ -12,7 +12,7 @@
     RootModule        = 'WindmillClient.psm1'
 
     # Version number of this module.
-    ModuleVersion     = '1.775.0'
+    ModuleVersion     = '1.775.1'
 
     # Supported PSEditions
     # CompatiblePSEditions = @()
diff --git a/python-client/wmill/pyproject.toml b/python-client/wmill/pyproject.toml
index cb3ff3a9eb..55b38a4e1d 100644
--- a/python-client/wmill/pyproject.toml
+++ b/python-client/wmill/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill"
-version = "1.775.0"
+version = "1.775.1"
 description = "A client library for accessing Windmill server wrapping the Windmill client API"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/typescript-client/jsr.json b/typescript-client/jsr.json
index 8555ae900b..abde746fc4 100644
--- a/typescript-client/jsr.json
+++ b/typescript-client/jsr.json
@@ -1,6 +1,6 @@
 {
   "name": "@windmill/windmill",
-  "version": "1.775.0",
+  "version": "1.775.1",
   "exports": "./src/index.ts",
   "publish": {
     "exclude": ["!src", "./s3Types.ts", "./sqlUtils.ts", "./client.ts", "./wacError.ts"]
diff --git a/typescript-client/package.json b/typescript-client/package.json
index 6a5df397a8..0d9ac57f69 100644
--- a/typescript-client/package.json
+++ b/typescript-client/package.json
@@ -1,7 +1,7 @@
 {
   "name": "windmill-client",
   "description": "Windmill SDK client for browsers and Node.js",
-  "version": "1.775.0",
+  "version": "1.775.1",
   "author": "Ruben Fiszel",
   "license": "Apache 2.0",
   "homepage": "https://github.com/windmill-labs/windmill/tree/main/typescript-client#readme",
diff --git a/version.txt b/version.txt
index cce24028ca..393fbf5b71 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-1.775.0
+1.775.1

From a17ccbdd0d3c9f2f6234c4cc70d0917e83eeaceb Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Tue, 28 Jul 2026 22:30:13 +0200
Subject: [PATCH 19/24] fix: distinguish waiting-on-user from streaming in ai
 sessions (#10396)

* feat: expand the active fork's family in the workspace menu

* fix: distinguish waiting-on-user from streaming in ai sessions

* fix: honor compact sizing in the waiting-for-input pill

* docs: condense waiting-state comments to the 4-line limit

* fix: detect a blocked tool card sitting behind queued ones

* fix: scan to the turn boundary for a blocked tool card
---
 .../copilot/chat/AIChatDisplay.svelte         |  80 +++---------
 .../copilot/chat/ChatTypingIndicator.svelte   | 115 ++++++++++++------
 .../components/copilot/chat/shared.test.ts    |  49 ++++++++
 .../src/lib/components/copilot/chat/shared.ts |  20 +++
 .../sessions/SessionStatusDot.svelte          |  24 ++--
 .../sessions/sessionRuntime.svelte.ts         |  14 ++-
 .../components/sidebar/WorkspaceMenu.svelte   |  14 ++-
 7 files changed, 202 insertions(+), 114 deletions(-)

diff --git a/frontend/src/lib/components/copilot/chat/AIChatDisplay.svelte b/frontend/src/lib/components/copilot/chat/AIChatDisplay.svelte
index a267e71e8c..c3875f702f 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatDisplay.svelte
+++ b/frontend/src/lib/components/copilot/chat/AIChatDisplay.svelte
@@ -14,7 +14,6 @@
 		Folder,
 		Hand,
 		HistoryIcon,
-		Hourglass,
 		MousePointer2,
 		Plus,
 		TextSelect,
@@ -25,7 +24,7 @@
 	import { fade } from 'svelte/transition'
 	import Popover from '$lib/components/meltComponents/Popover.svelte'
 	import DropdownV2 from '$lib/components/DropdownV2.svelte'
-	import { isActiveUserQuestion, type DisplayMessage } from './shared'
+	import { pendingUserAction, type DisplayMessage } from './shared'
 	import type { ContextElement } from './context'
 	import ChatQuickActions from './ChatQuickActions.svelte'
 	import ContextUsageIndicator from './ContextUsageIndicator.svelte'
@@ -486,24 +485,15 @@
 		}
 	})
 
-	// "Waiting for user" detection — when the latest tool message is staged
-	// for confirmation or has an unanswered askUserQuestion, the AI loop is
-	// paused on the user, not on its own work. The typing-dots indicator
-	// implies the AI is busy, which is misleading; surface a text pill
-	// instead so users know to act on the tool above.
-	const waitingForUserAction = $derived.by(() => {
-		if (!aiChatManager.loading) return false
-		const last = messages[messages.length - 1]
-		if (!last || last.role !== 'tool') return false
-		if (last.needsConfirmation && last.isLoading) return true
-		if (isActiveUserQuestion(last)) return true
-		return false
-	})
+	// The typing-dots indicator implies the AI is busy, which is misleading while
+	// the loop is parked on the user; surface a text pill instead so users know to
+	// act on the tool above.
+	const waitingForUserAction = $derived(aiChatManager.loading && !!pendingUserAction(messages))
 
 	// While the AI is waiting on an answer to an askUserQuestion, the only valid
 	// input is one of the choices (or the custom answer) in the question card —
 	// so disable the main chat input until the question is answered or canceled.
-	const hasActiveUserQuestion = $derived(isActiveUserQuestion(messages[messages.length - 1]))
+	const hasActiveUserQuestion = $derived(pendingUserAction(messages) === 'question')
 
 	// Get app context for display when in APP mode
 	const appContext = $derived.by((): SelectedContext | undefined => {
@@ -682,28 +672,19 @@ the panel, or the Escape-to-stop focus check would wrongly reject them. -->
 								showFlowPendingActionControls ? 'bottom-14' : 'bottom-2'
 							)}
 						>
-							{#if waitingForUserAction}
-								<span
-									class="inline-flex items-center gap-1.5 px-2 py-1 rounded-md bg-surface/80 backdrop-blur text-2xs text-accent"
-									aria-label="Waiting for your input"
-								>
-									<Hourglass class="w-3 h-3 hourglass-flip" />
-									Waiting for your input
-								</span>
-							{:else}
-								<ChatTypingIndicator
-									loading={aiChatManager.loading}
-									label={aiChatManager.loadingLabel
-										? aiChatManager.loadingLabel
-										: aiChatManager.compacting
-											? 'Compacting conversation'
-											: aiChatManager.currentReasoningActive &&
-												  !aiChatManager.currentReply &&
-												  !aiChatManager.currentReasoning
-												? (aiChatManager.reasoningHiddenIndicatorLabel ?? 'Thinking')
-												: undefined}
-								/>
-							{/if}
+							<ChatTypingIndicator
+								loading={aiChatManager.loading}
+								paused={waitingForUserAction}
+								label={aiChatManager.loadingLabel
+									? aiChatManager.loadingLabel
+									: aiChatManager.compacting
+										? 'Compacting conversation'
+										: aiChatManager.currentReasoningActive &&
+											  !aiChatManager.currentReply &&
+											  !aiChatManager.currentReasoning
+											? (aiChatManager.reasoningHiddenIndicatorLabel ?? 'Thinking')
+											: undefined}
+							/>
 						</div>
 					{/if}
 				</div>
@@ -1067,26 +1048,3 @@ the panel, or the Escape-to-stop focus check would wrongly reject them. -->
 		{/if}
 	</div>
 </div>
-
-<style>
-	/* Hourglass flips every 4s with long rests at each upright position.
-	   `:global` because the class is applied to a child component's root
-	   (Lucide SVG) and Svelte scoped CSS otherwise wouldn't match it. */
-	:global(.hourglass-flip) {
-		animation: hourglass-flip 4s cubic-bezier(0.65, 0, 0.35, 1) infinite;
-		transform-origin: center;
-	}
-	@keyframes hourglass-flip {
-		0%,
-		35% {
-			transform: rotate(0deg);
-		}
-		50%,
-		85% {
-			transform: rotate(180deg);
-		}
-		100% {
-			transform: rotate(360deg);
-		}
-	}
-</style>
diff --git a/frontend/src/lib/components/copilot/chat/ChatTypingIndicator.svelte b/frontend/src/lib/components/copilot/chat/ChatTypingIndicator.svelte
index 7c52de5cdf..1afe8aff4a 100644
--- a/frontend/src/lib/components/copilot/chat/ChatTypingIndicator.svelte
+++ b/frontend/src/lib/components/copilot/chat/ChatTypingIndicator.svelte
@@ -1,26 +1,37 @@
 <script lang="ts">
+	import { Hourglass } from 'lucide-svelte'
+
 	let {
 		loading,
 		compact = false,
+		paused = false,
 		label
-	}: { loading: boolean; compact?: boolean; label?: string } = $props()
+	}: { loading: boolean; compact?: boolean; paused?: boolean; label?: string } = $props()
 
-	// Wall-clock for the typing-dots indicator. Starts on the rising edge of
-	// `loading`, ticks once a second, frozen on the last value when loading
-	// ends so callers reading the dots briefly after still see a coherent number.
-	let loadingStartedAt = $state<number | undefined>(undefined)
-	let loadingElapsedMs = $state(0)
+	// Starts on the rising edge of `loading`, frozen on its last value once loading
+	// ends so a caller reading it just after still sees a coherent number. `paused`
+	// suspends it and resumes where it stopped: time the user spends answering is
+	// theirs, and counting it makes a fast turn read as a slow one.
+	let elapsedMs = $state(0)
+	let accumulatedMs = 0
+	let wasLoading = false
 	$effect(() => {
 		if (!loading) {
-			loadingStartedAt = undefined
+			wasLoading = false
 			return
 		}
-		loadingStartedAt = Date.now()
-		loadingElapsedMs = 0
-		const interval = setInterval(() => {
-			if (loadingStartedAt) loadingElapsedMs = Date.now() - loadingStartedAt
-		}, 1000)
-		return () => clearInterval(interval)
+		if (!wasLoading) {
+			wasLoading = true
+			accumulatedMs = 0
+			elapsedMs = 0
+		}
+		if (paused) return
+		const startedAt = Date.now() - accumulatedMs
+		const interval = setInterval(() => (elapsedMs = Date.now() - startedAt), 1000)
+		return () => {
+			accumulatedMs = Date.now() - startedAt
+			clearInterval(interval)
+		}
 	})
 
 	function formatElapsed(ms: number): string {
@@ -35,30 +46,42 @@
 	}
 </script>
 
-<span
-	class={compact
-		? 'inline-flex items-center gap-1 px-1.5 py-0.5 rounded-md bg-surface/80 backdrop-blur'
-		: 'inline-flex items-center gap-2 px-2 py-1 rounded-md bg-surface/80 backdrop-blur'}
-	aria-label="AI is generating a response"
->
-	<span class={compact ? 'inline-flex items-end gap-0.5' : 'inline-flex items-end gap-1'}>
-		<span
-			class={(compact ? 'w-[3px] h-[3px]' : 'w-[5px] h-[5px]') +
-				' rounded-full bg-accent chat-typing-dot'}
-		></span>
-		<span
-			class={(compact ? 'w-[3px] h-[3px]' : 'w-[5px] h-[5px]') +
-				' rounded-full bg-accent chat-typing-dot chat-typing-dot-2'}
-		></span>
-		<span
-			class={(compact ? 'w-[3px] h-[3px]' : 'w-[5px] h-[5px]') +
-				' rounded-full bg-accent chat-typing-dot chat-typing-dot-3'}
-		></span>
-	</span>
-	<span class={(compact ? 'text-[10px]' : 'text-2xs') + ' text-tertiary tabular-nums leading-none'}
-		>{label ? label + ' · ' : ''}{formatElapsed(loadingElapsedMs)}</span
+{#if paused}
+	<span
+		class={(compact ? 'gap-1 px-1.5 py-0.5 text-[10px]' : 'gap-1.5 px-2 py-1 text-2xs') +
+			' inline-flex items-center rounded-md bg-surface/80 backdrop-blur text-accent'}
+		aria-label="Waiting for your input"
 	>
-</span>
+		<Hourglass class={(compact ? 'w-2.5 h-2.5' : 'w-3 h-3') + ' hourglass-flip'} />
+		Waiting for your input
+	</span>
+{:else}
+	<span
+		class={compact
+			? 'inline-flex items-center gap-1 px-1.5 py-0.5 rounded-md bg-surface/80 backdrop-blur'
+			: 'inline-flex items-center gap-2 px-2 py-1 rounded-md bg-surface/80 backdrop-blur'}
+		aria-label="AI is generating a response"
+	>
+		<span class={compact ? 'inline-flex items-end gap-0.5' : 'inline-flex items-end gap-1'}>
+			<span
+				class={(compact ? 'w-[3px] h-[3px]' : 'w-[5px] h-[5px]') +
+					' rounded-full bg-accent chat-typing-dot'}
+			></span>
+			<span
+				class={(compact ? 'w-[3px] h-[3px]' : 'w-[5px] h-[5px]') +
+					' rounded-full bg-accent chat-typing-dot chat-typing-dot-2'}
+			></span>
+			<span
+				class={(compact ? 'w-[3px] h-[3px]' : 'w-[5px] h-[5px]') +
+					' rounded-full bg-accent chat-typing-dot chat-typing-dot-3'}
+			></span>
+		</span>
+		<span
+			class={(compact ? 'text-[10px]' : 'text-2xs') + ' text-tertiary tabular-nums leading-none'}
+			>{label ? label + ' · ' : ''}{formatElapsed(elapsedMs)}</span
+		>
+	</span>
+{/if}
 
 <style>
 	.chat-typing-dot {
@@ -80,4 +103,24 @@
 			opacity: 1;
 		}
 	}
+
+	/* Hourglass flips every 4s with long rests at each upright position. Global:
+	   the class lands on a lucide component's own element. */
+	:global(.hourglass-flip) {
+		animation: hourglass-flip 4s cubic-bezier(0.65, 0, 0.35, 1) infinite;
+		transform-origin: center;
+	}
+	@keyframes hourglass-flip {
+		0%,
+		35% {
+			transform: rotate(0deg);
+		}
+		50%,
+		85% {
+			transform: rotate(180deg);
+		}
+		100% {
+			transform: rotate(360deg);
+		}
+	}
 </style>
diff --git a/frontend/src/lib/components/copilot/chat/shared.test.ts b/frontend/src/lib/components/copilot/chat/shared.test.ts
index 0588d2a171..719638d700 100644
--- a/frontend/src/lib/components/copilot/chat/shared.test.ts
+++ b/frontend/src/lib/components/copilot/chat/shared.test.ts
@@ -888,6 +888,55 @@ describe('isActiveUserQuestion', () => {
 	})
 })
 
+describe('pendingUserAction', () => {
+	const toolMessage = (overrides: Partial<ToolDisplayMessage> = {}): ToolDisplayMessage => ({
+		role: 'tool',
+		tool_call_id: 'call_p',
+		content: 'running',
+		isLoading: true,
+		...overrides
+	})
+
+	const question = toolMessage({ userQuestion: { question: 'Pick one', choices: ['a'] } })
+
+	it('distinguishes an unanswered question from a staged confirmation', async () => {
+		const { pendingUserAction } = await import('./shared')
+		expect(pendingUserAction([question])).toBe('question')
+		expect(pendingUserAction([toolMessage({ needsConfirmation: true })])).toBe('confirmation')
+	})
+
+	it('is undefined for a tool the AI is running on its own', async () => {
+		const { pendingUserAction } = await import('./shared')
+		expect(pendingUserAction([toolMessage()])).toBe(undefined)
+		expect(pendingUserAction([toolMessage({ needsConfirmation: true, isLoading: false })])).toBe(
+			undefined
+		)
+	})
+
+	// A multi-tool turn creates every card before running the calls one at a time,
+	// so the blocked card is not the last message.
+	it('finds a blocked card sitting behind queued ones', async () => {
+		const { pendingUserAction } = await import('./shared')
+		expect(pendingUserAction([question, toolMessage(), toolMessage()])).toBe('question')
+		expect(pendingUserAction([toolMessage({ needsConfirmation: true }), toolMessage()])).toBe(
+			'confirmation'
+		)
+	})
+
+	// Text emitted between two tool calls lands as an assistant card between them.
+	it('finds a blocked card behind an interleaved assistant card', async () => {
+		const { pendingUserAction } = await import('./shared')
+		const assistant: DisplayMessage = { role: 'assistant', content: 'and also…' }
+		expect(pendingUserAction([question, assistant, toolMessage()])).toBe('question')
+	})
+
+	it('stops at the previous turn rather than reviving its resolved cards', async () => {
+		const { pendingUserAction } = await import('./shared')
+		const userMessage: DisplayMessage = { role: 'user', index: 0, content: 'go on' }
+		expect(pendingUserAction([question, userMessage, toolMessage()])).toBe(undefined)
+	})
+})
+
 describe('pollJobCompletion detach', () => {
 	function makeCallbacks() {
 		return {
diff --git a/frontend/src/lib/components/copilot/chat/shared.ts b/frontend/src/lib/components/copilot/chat/shared.ts
index 76a1595c7b..131392a665 100644
--- a/frontend/src/lib/components/copilot/chat/shared.ts
+++ b/frontend/src/lib/components/copilot/chat/shared.ts
@@ -650,6 +650,26 @@ export function isActiveUserQuestion(message: DisplayMessage | undefined): boole
 	)
 }
 
+// The loop is parked on the user: an unanswered askUserQuestion, or a tool call
+// staged for confirmation. The manager stays `loading` through both, so anything
+// rendering progress must ask here first or it reports "the AI is working".
+export type PendingUserAction = 'question' | 'confirmation'
+
+// Scans back to the turn boundary, not just the last message: a turn's cards are
+// created up front and run one at a time, and text between two tool calls pushes
+// an assistant card between them, so the blocked card is rarely last. Only cards
+// of a live turn can match — every resolution path clears `isLoading`.
+export function pendingUserAction(messages: DisplayMessage[]): PendingUserAction | undefined {
+	for (let i = messages.length - 1; i >= 0; i--) {
+		const message = messages[i]
+		if (message.role === 'user') break
+		if (message.role !== 'tool') continue
+		if (isActiveUserQuestion(message)) return 'question'
+		if (message.needsConfirmation && message.isLoading) return 'confirmation'
+	}
+	return undefined
+}
+
 // Fires after every tool call resolves, with the tool name. Lets a host (e.g.
 // the sessions page) react to mutating tools — refreshing previews — without
 // the tool layer knowing about the UI. Single slot; the consumer filters by name
diff --git a/frontend/src/lib/components/sessions/SessionStatusDot.svelte b/frontend/src/lib/components/sessions/SessionStatusDot.svelte
index 4c0ef4c408..646163bcaf 100644
--- a/frontend/src/lib/components/sessions/SessionStatusDot.svelte
+++ b/frontend/src/lib/components/sessions/SessionStatusDot.svelte
@@ -1,11 +1,5 @@
 <script lang="ts">
-	import {
-		AlertCircle,
-		AlertTriangle,
-		Building,
-		GitFork,
-		GitPullRequestClosed
-	} from 'lucide-svelte'
+	import { AlertTriangle, Building, CircleHelp, GitFork, GitPullRequestClosed } from 'lucide-svelte'
 	import type { SessionChatStatus } from './sessionRuntime.svelte'
 
 	// The fork icon is deliberately sync-state-agnostic (no ahead/behind/
@@ -21,16 +15,20 @@
 		idle: 'No chat activity',
 		streaming: 'Generating response…',
 		'awaiting-user': 'Waiting for your reply',
+		'awaiting-answer': 'Waiting for your answer',
 		'needs-confirmation': 'Needs your confirmation',
 		draft: 'Unsent draft',
 		error: 'Last message had an error'
 	}
 
 	// Live chat signals take precedence over the persistent kind/fork
-	// indicator: streaming, needs-confirmation, and error are time-critical
-	// and warrant briefly hijacking the icon slot.
+	// indicator: they are time-critical and warrant briefly hijacking the icon
+	// slot.
 	const liveOverride = $derived(
-		status === 'streaming' || status === 'needs-confirmation' || status === 'error'
+		status === 'streaming' ||
+			status === 'awaiting-answer' ||
+			status === 'needs-confirmation' ||
+			status === 'error'
 	)
 
 	const persistentTitle = $derived(
@@ -51,8 +49,10 @@
 			<span class="w-[3px] h-[3px] rounded-full bg-blue-500 typing-dot dot-2"></span>
 			<span class="w-[3px] h-[3px] rounded-full bg-blue-500 typing-dot dot-3"></span>
 		</span>
-	{:else if status === 'needs-confirmation'}
-		<AlertCircle class="w-3 h-3 text-amber-500" />
+	{:else if status === 'awaiting-answer' || status === 'needs-confirmation'}
+		<!-- Both mean "the run is blocked on you"; at 12px a second amber circle
+		     glyph would be indistinguishable, so the tooltip carries which one. -->
+		<CircleHelp class="w-3 h-3 text-amber-500" />
 	{:else if status === 'error'}
 		<AlertTriangle class="w-3 h-3 text-red-500" />
 	{:else if isFork}
diff --git a/frontend/src/lib/components/sessions/sessionRuntime.svelte.ts b/frontend/src/lib/components/sessions/sessionRuntime.svelte.ts
index f95e4afa9b..83e6aae8dd 100644
--- a/frontend/src/lib/components/sessions/sessionRuntime.svelte.ts
+++ b/frontend/src/lib/components/sessions/sessionRuntime.svelte.ts
@@ -86,7 +86,7 @@ import type {
 	RawAppDomResult
 } from '$lib/components/raw_apps/rawAppDom'
 import { getNonStreamingMetadataCompletion } from '$lib/components/copilot/lib'
-import type { DisplayMessage } from '$lib/components/copilot/chat/shared'
+import { pendingUserAction, type DisplayMessage } from '$lib/components/copilot/chat/shared'
 import type { ChatCompletionMessageParam } from 'openai/resources/index.mjs'
 
 // Per-kind load state for a session's editor target. Pure state container the
@@ -967,7 +967,10 @@ export function resetSessionPreviewTabs(sessionId: string, url: string): void {
 export type SessionChatStatus =
 	| 'idle'
 	| 'streaming'
+	// The assistant's turn ended and the user has yet to reply — passive, unlike
+	// 'awaiting-answer'/'needs-confirmation', where a running loop is blocked.
 	| 'awaiting-user'
+	| 'awaiting-answer'
 	| 'needs-confirmation'
 	| 'draft'
 	| 'error'
@@ -1243,10 +1246,15 @@ setScreenshotHandler(async ({ sessionId: callerSessionId }) => {
 
 export function getSessionChatStatus(runtime: SessionRuntime): SessionChatStatus {
 	const m = runtime.manager
+	const last = m.displayMessages[m.displayMessages.length - 1]
+	// A loop parked on the user still reports `loading`, so these must be tested
+	// before `streaming` — otherwise "answer me" renders as "the AI is typing"
+	// and a session that needs the user looks like one that doesn't.
+	const pending = pendingUserAction(m.displayMessages)
+	if (pending === 'question') return 'awaiting-answer'
+	if (pending === 'confirmation') return 'needs-confirmation'
 	if (m.loading) return 'streaming'
 	if (m.instructions.trim().length > 0) return 'draft'
-	const last = m.displayMessages[m.displayMessages.length - 1]
-	if (last?.role === 'tool' && last.needsConfirmation) return 'needs-confirmation'
 	if (last?.role === 'user' && last.error) return 'error'
 	if (last && (last.role === 'assistant' || last.role === 'tool')) return 'awaiting-user'
 	return 'idle'
diff --git a/frontend/src/lib/components/sidebar/WorkspaceMenu.svelte b/frontend/src/lib/components/sidebar/WorkspaceMenu.svelte
index 2631af792f..2e57cf88fa 100644
--- a/frontend/src/lib/components/sidebar/WorkspaceMenu.svelte
+++ b/frontend/src/lib/components/sidebar/WorkspaceMenu.svelte
@@ -179,6 +179,15 @@
 		return ambiguous
 	})
 
+	// Opening while a fork is active expands that fork's family, so the tick sits
+	// on the active fork's own row instead of on its collapsed root.
+	function seedExpandedFamilies() {
+		expandedFamilies.clear()
+		if (currentFamily && currentFamily.id !== $workspaceStore) {
+			expandedFamilies.add(currentFamily.id)
+		}
+	}
+
 	// The active workspace itself (fork included) — names the settings entry.
 	const activeWorkspace = $derived($userWorkspaces?.find((w) => w.id === $workspaceStore))
 	const canManageWorkspace = $derived(
@@ -193,13 +202,14 @@
 
 <svelte:window onkeydowncapture={onExpandKeydown} />
 
-<!-- Expansion is per-open: every open starts with all families collapsed,
-     including the active fork's. -->
+<!-- Expansion is per-open: every open starts from the active workspace's family
+     alone, discarding whatever the previous open expanded. -->
 <Menu
 	{createMenu}
 	usePointerDownOutside
 	placement="bottom-start"
 	bind:open={menuOpen}
+	on:open={seedExpandedFamilies}
 	on:close={() => expandedFamilies.clear()}
 >
 	{#snippet triggr({ trigger })}

From 33d28456cc8ef9f64301eb3dd6dad6d7325018e3 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Tue, 28 Jul 2026 23:12:28 +0200
Subject: [PATCH 20/24] fix: surface the real reason git sync settings saves
 are rejected (#10398)

* fix: surface the real reason git sync settings saves are rejected

* fix: redact credentials and cover the remaining api error sites

* chore: update ee-repo-ref to 85209cfccb07538ae4748d85b56e61c0bef4f606

This commit updates the EE repository reference after PR #691 was merged in windmill-ee-private.

Previous ee-repo-ref: 01ca990c6a02a745e16f13da972497add0ad7a6c

New ee-repo-ref: 85209cfccb07538ae4748d85b56e61c0bef4f606

Automated by sync-ee-ref workflow.

* fix: drop the unactionable branch advice and the last inline error copy

---------

Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
---
 backend/ee-repo-ref.txt                       |  2 +-
 .../windmill-api-workspaces/src/workspaces.rs | 58 ++++++++++++++++---
 .../components/git_sync/DetectionFlow.svelte  |  5 +-
 .../git_sync/GitSyncContext.svelte.ts         |  9 +--
 .../git_sync/GitSyncModalManager.svelte       | 20 ++++---
 .../git_sync/GitSyncRepositoryCard.svelte     | 12 ++--
 .../git_sync/PullWorkspaceModal.svelte        |  5 +-
 .../workspaceSettings/projectInstall.ts       | 13 +----
 .../workspaceSettings/projectMigrations.ts    | 10 +---
 frontend/src/lib/utils.test.ts                | 28 ++++++++-
 frontend/src/lib/utils.ts                     | 11 ++++
 11 files changed, 121 insertions(+), 52 deletions(-)

diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index 9a99949d04..da5859347f 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-bbfb0de0dc9fa06130a231eb10c64f60238d1bbd
+85209cfccb07538ae4748d85b56e61c0bef4f606
diff --git a/backend/windmill-api-workspaces/src/workspaces.rs b/backend/windmill-api-workspaces/src/workspaces.rs
index b7e2ab72c1..9501ed96f9 100644
--- a/backend/windmill-api-workspaces/src/workspaces.rs
+++ b/backend/windmill-api-workspaces/src/workspaces.rs
@@ -3349,20 +3349,60 @@ async fn check_dev_promotion_targets_parent_repo<'a>(
     repos: impl Iterator<Item = &'a windmill_common::workspaces::GitRepositorySettings>,
 ) -> Result<()> {
     for r in repos.filter(|r| r.use_individual_branch.unwrap_or(false)) {
-        if !windmill_common::git_sync_ee::dev_promotion_target_matches_parent(
+        let Some(m) = windmill_common::git_sync_ee::dev_promotion_target_mismatch(
             db,
             w_id,
             &r.git_repo_resource_path,
         )
         .await?
-        {
-            return Err(Error::BadRequest(
-                "Promotion mode on a dev workspace must reuse the parent workspace's git repository \
-                 (same URL and branch), but this repository is not one the parent tracks — promotion \
-                 would target a repository the parent does not sync with."
-                    .to_string(),
-            ));
-        }
+        else {
+            continue;
+        };
+        // A resource with no `branch` field normalizes to an empty string.
+        let named = |b: &str| {
+            if b.is_empty() {
+                "<none>".to_string()
+            } else {
+                b.to_string()
+            }
+        };
+        let branch = named(&m.branch);
+        let hint = if m.parent_branches.is_empty() {
+            format!(
+                "the parent workspace '{}' does not track that repository. Point this repository at \
+                 the one the parent syncs with, or add it to the parent's git sync settings.",
+                m.parent_workspace
+            )
+        } else {
+            // With no branch of its own there is nothing for the parent to add,
+            // so only offer the side of the advice that can be acted on.
+            let other_way = if m.branch.is_empty() {
+                String::new()
+            } else {
+                format!(", or add branch '{branch}' to the parent's git sync settings")
+            };
+            format!(
+                "the parent workspace '{}' tracks it on {} '{}'. Set this repository's branch to \
+                 match{other_way}.",
+                m.parent_workspace,
+                if m.parent_branches.len() > 1 {
+                    "branches"
+                } else {
+                    "branch"
+                },
+                m.parent_branches
+                    .iter()
+                    .map(|b| named(b))
+                    .collect::<Vec<_>>()
+                    .join("', '")
+            )
+        };
+        return Err(Error::BadRequest(format!(
+            "Promotion mode on a dev workspace must reuse the parent workspace's git repository \
+             (same URL and branch). Repository '{}' targets '{}' on branch '{branch}', but {hint}",
+            r.git_repo_resource_path.trim_start_matches("$res:"),
+            m.repo,
+        )));
     }
     Ok(())
 }
diff --git a/frontend/src/lib/components/git_sync/DetectionFlow.svelte b/frontend/src/lib/components/git_sync/DetectionFlow.svelte
index c4b25c8401..3250b3afb5 100644
--- a/frontend/src/lib/components/git_sync/DetectionFlow.svelte
+++ b/frontend/src/lib/components/git_sync/DetectionFlow.svelte
@@ -5,6 +5,7 @@
 	import GitSyncFilterSettings from '$lib/components/workspaceSettings/GitSyncFilterSettings.svelte'
 	import Toggle from '$lib/components/Toggle.svelte'
 	import { sendUserToast } from '$lib/toast'
+	import { apiErrorMessage } from '$lib/utils'
 	import { workspaceStore } from '$lib/stores'
 	import GitSyncModeDisplay from './GitSyncModeDisplay.svelte'
 
@@ -48,7 +49,7 @@
 			await gitSyncContext.detectRepository(idx)
 		} catch (error: any) {
 			console.error('Detection failed:', error)
-			sendUserToast('Detection failed: ' + error.message, true)
+			sendUserToast('Detection failed: ' + apiErrorMessage(error), true)
 		}
 	}
 
@@ -72,7 +73,7 @@
 			sendUserToast('Git sync connection saved successfully')
 		} catch (error: any) {
 			console.error('Failed to save connection:', error)
-			sendUserToast('Failed to save connection: ' + error.message, true)
+			sendUserToast('Failed to save connection: ' + apiErrorMessage(error), true)
 		}
 	}
 </script>
diff --git a/frontend/src/lib/components/git_sync/GitSyncContext.svelte.ts b/frontend/src/lib/components/git_sync/GitSyncContext.svelte.ts
index c69245b0e5..5856c3bfee 100644
--- a/frontend/src/lib/components/git_sync/GitSyncContext.svelte.ts
+++ b/frontend/src/lib/components/git_sync/GitSyncContext.svelte.ts
@@ -2,6 +2,7 @@ import { getContext, setContext } from 'svelte'
 import { enterpriseLicense } from '$lib/stores'
 import { get } from 'svelte/store'
 import { sendUserToast } from '$lib/toast'
+import { apiErrorMessage } from '$lib/utils'
 import { JobService, WorkspaceService, ResourceService } from '$lib/gen'
 import type {
 	GitRepositorySettings as BackendGitRepositorySettings,
@@ -373,7 +374,7 @@ export function createGitSyncContext(workspace: string) {
 			}
 
 			repo.detectionState = 'error'
-			repo.detectionError = error?.message || error?.toString() || 'Failed to detect repository'
+			repo.detectionError = apiErrorMessage(error) || 'Failed to detect repository'
 			repo.detectionJobStatus = 'failure'
 		}
 	}
@@ -599,11 +600,7 @@ export function createGitSyncContext(workspace: string) {
 			})
 		} catch (error: any) {
 			// Initialize the job entry if it doesn't exist (e.g., job creation failed)
-			const errorMessage =
-				(typeof error?.body === 'string' ? error.body : error?.body?.message) ||
-				error?.message ||
-				error?.toString() ||
-				'Failed to run test job'
+			const errorMessage = apiErrorMessage(error) || 'Failed to run test job'
 			if (!gitSyncTestJobs[idx]) {
 				gitSyncTestJobs[idx] = {
 					jobId: '',
diff --git a/frontend/src/lib/components/git_sync/GitSyncModalManager.svelte b/frontend/src/lib/components/git_sync/GitSyncModalManager.svelte
index 05925d6e26..610dafb562 100644
--- a/frontend/src/lib/components/git_sync/GitSyncModalManager.svelte
+++ b/frontend/src/lib/components/git_sync/GitSyncModalManager.svelte
@@ -4,6 +4,7 @@
 	import PullWorkspaceModal from '$lib/components/git_sync/PullWorkspaceModal.svelte'
 	import GitSyncSuccessModal from '$lib/components/git_sync/GitSyncSuccessModal.svelte'
 	import { sendUserToast } from '$lib/toast'
+	import { apiErrorMessage } from '$lib/utils'
 
 	const gitSyncContext = $state(getGitSyncContext())
 
@@ -15,11 +16,17 @@
 
 		// If this was a repository initialization, auto-save the connection
 		if (repo.isUnsavedConnection && repo.detectionState === 'no-wmill') {
-			gitSyncContext.saveRepository(idx).then(() => {
-				sendUserToast('Repository initialized and connection saved successfully')
-			}).catch((error) => {
-				sendUserToast('Repository initialized but failed to save connection: ' + error.message, true)
-			})
+			gitSyncContext
+				.saveRepository(idx)
+				.then(() => {
+					sendUserToast('Repository initialized and connection saved successfully')
+				})
+				.catch((error) => {
+					sendUserToast(
+						'Repository initialized but failed to save connection: ' + apiErrorMessage(error),
+						true
+					)
+				})
 		} else {
 			sendUserToast('Successfully pushed to git repository')
 		}
@@ -27,7 +34,6 @@
 		gitSyncContext.closePushModal()
 	}
 
-
 	function handlePullSuccess() {
 		sendUserToast('Successfully pulled from git repository')
 		gitSyncContext.closePullModal()
@@ -54,7 +60,7 @@
 			sendUserToast('Connection saved successfully without initializing repository')
 			gitSyncContext.closePushModal()
 		} catch (error: any) {
-			sendUserToast('Failed to save connection: ' + error.message, true)
+			sendUserToast('Failed to save connection: ' + apiErrorMessage(error), true)
 		}
 	}
 </script>
diff --git a/frontend/src/lib/components/git_sync/GitSyncRepositoryCard.svelte b/frontend/src/lib/components/git_sync/GitSyncRepositoryCard.svelte
index 30a8c3ef47..18a8adddfc 100644
--- a/frontend/src/lib/components/git_sync/GitSyncRepositoryCard.svelte
+++ b/frontend/src/lib/components/git_sync/GitSyncRepositoryCard.svelte
@@ -16,6 +16,7 @@
 	import GitSyncFilterSettings from '$lib/components/workspaceSettings/GitSyncFilterSettings.svelte'
 	import DetectionFlow from './DetectionFlow.svelte'
 	import { sendUserToast } from '$lib/toast'
+	import { apiErrorMessage } from '$lib/utils'
 	import { fade } from 'svelte/transition'
 	import { workspaceStore, userWorkspaces, enterpriseLicense } from '$lib/stores'
 	import type { GitSyncRepository } from './GitSyncContext.svelte'
@@ -114,7 +115,10 @@
 				repo.use_individual_branch = prevIndiv
 				repo.group_by_folder = prevGbf
 			}
-			sendUserToast(`Could not ${v ? 'enable' : 'disable'} Git promotion: ${e}`, true)
+			sendUserToast(
+				`Could not ${v ? 'enable' : 'disable'} Git promotion: ${apiErrorMessage(e)}`,
+				true
+			)
 		} finally {
 			savingDevPromotion = false
 		}
@@ -128,7 +132,7 @@
 			await gitSyncContext.saveRepository(idx)
 		} catch (e) {
 			if (repo) repo.group_by_folder = prev
-			sendUserToast(`Could not change promotion granularity: ${e}`, true)
+			sendUserToast(`Could not change promotion granularity: ${apiErrorMessage(e)}`, true)
 		} finally {
 			savingDevPromotion = false
 		}
@@ -353,7 +357,7 @@
 			sendUserToast('Repository settings updated')
 		} catch (error: any) {
 			console.error('Failed to save repository:', error)
-			sendUserToast('Failed to save repository: ' + error.message, true)
+			sendUserToast('Failed to save repository: ' + apiErrorMessage(error), true)
 		}
 	}
 
@@ -379,7 +383,7 @@
 			sendUserToast('Repository connection removed successfully')
 		} catch (error: any) {
 			console.error('Failed to remove repository:', error)
-			sendUserToast('Failed to remove repository: ' + error.message, true)
+			sendUserToast('Failed to remove repository: ' + apiErrorMessage(error), true)
 		} finally {
 			confirmingDelete = false
 		}
diff --git a/frontend/src/lib/components/git_sync/PullWorkspaceModal.svelte b/frontend/src/lib/components/git_sync/PullWorkspaceModal.svelte
index 94845aa646..b42e290215 100644
--- a/frontend/src/lib/components/git_sync/PullWorkspaceModal.svelte
+++ b/frontend/src/lib/components/git_sync/PullWorkspaceModal.svelte
@@ -15,6 +15,7 @@
 	import { JobService, ResourceService } from '$lib/gen'
 	import { workspaceStore, userWorkspaces } from '$lib/stores'
 	import { sendUserToast } from '$lib/toast'
+	import { apiErrorMessage } from '$lib/utils'
 	import hubPaths from '$lib/hubPaths.json'
 	import { jobManager } from '$lib/services/JobManager'
 	import type { SyncResponse, SettingsResponse, SettingsObject } from '$lib/git-sync'
@@ -100,7 +101,7 @@
 			onSettingsSaved?.()
 		} catch (error) {
 			console.error('Failed to save settings:', error)
-			sendUserToast('Failed to save updated settings', true)
+			sendUserToast('Failed to save updated settings: ' + apiErrorMessage(error), true)
 		}
 	}
 
@@ -289,7 +290,7 @@
 			}
 		} catch (error: any) {
 			console.error('Failed to apply settings:', error)
-			sendUserToast('Failed to apply settings: ' + error.message, true)
+			sendUserToast('Failed to apply settings: ' + apiErrorMessage(error), true)
 		} finally {
 			isApplying = false
 		}
diff --git a/frontend/src/lib/components/workspaceSettings/projectInstall.ts b/frontend/src/lib/components/workspaceSettings/projectInstall.ts
index 1827e00283..387dc82ade 100644
--- a/frontend/src/lib/components/workspaceSettings/projectInstall.ts
+++ b/frontend/src/lib/components/workspaceSettings/projectInstall.ts
@@ -20,6 +20,7 @@ import {
 } from '../triggers/workspaceTriggersList'
 import { updatePolicy } from '$lib/components/apps/editor/appPolicy'
 import { updateRawAppPolicy } from '$lib/sharedUtils'
+import { apiErrorMessage as errorMessage } from '$lib/utils'
 import type { App } from '$lib/components/apps/types'
 import { runScriptAndPollResult } from '$lib/components/jobs/utils'
 import {
@@ -74,18 +75,6 @@ export function varContainmentViolation(value: any, folder: string): string | un
 	return undefined
 }
 
-// Surface the backend's explanation: API errors carry the real message in
-// `.body` (plain text for Windmill 4xx), while `.message` is the generic
-// status text ("Bad Request"). Prefer the body so e.g. a path/route_path
-// collision reads as the actual reason, not just "Bad Request".
-function errorMessage(e: any): string {
-	const body = e?.body
-	if (typeof body === 'string' && body.trim() !== '') return body
-	if (body && typeof body === 'object')
-		return body.error?.message ?? body.message ?? JSON.stringify(body)
-	return e?.message ?? String(e)
-}
-
 // Recompute an app's execution policy from its (retargeted) value, mirroring
 // what the editor does on deploy. `triggerables_v2` is keyed by
 // `<component>:rawscript/<sha256(inline content)>`; retargeting rewrites that
diff --git a/frontend/src/lib/components/workspaceSettings/projectMigrations.ts b/frontend/src/lib/components/workspaceSettings/projectMigrations.ts
index b4e72389c0..8ff4da597d 100644
--- a/frontend/src/lib/components/workspaceSettings/projectMigrations.ts
+++ b/frontend/src/lib/components/workspaceSettings/projectMigrations.ts
@@ -19,6 +19,7 @@ import {
 	type DatabaseSchema
 } from '$lib/components/datatableSchemaSql'
 import { WorkspaceService } from '$lib/gen'
+import { apiErrorMessage } from '$lib/utils'
 import type { FetchedItem } from './projectBundle'
 
 export interface GeneratedMigration {
@@ -229,14 +230,7 @@ function orderByFkDependency(schema: DatabaseSchema, tables: ResolvedTable[]): R
 // Pull a readable one-line message out of an API error for embedding in a SQL
 // comment (collapse whitespace so it can't break out of the `--` line).
 function errorText(e: any): string {
-	const body = e?.body
-	const raw =
-		typeof body === 'string' && body.trim()
-			? body
-			: body && typeof body === 'object'
-				? (body.error?.message ?? body.message ?? JSON.stringify(body))
-				: (e?.message ?? String(e))
-	return String(raw).replace(/\s+/g, ' ').trim()
+	return apiErrorMessage(e).replace(/\s+/g, ' ').trim()
 }
 
 /**
diff --git a/frontend/src/lib/utils.test.ts b/frontend/src/lib/utils.test.ts
index 38abc13d04..b0d18473f1 100644
--- a/frontend/src/lib/utils.test.ts
+++ b/frontend/src/lib/utils.test.ts
@@ -9,7 +9,8 @@ import {
 	isTagTemplate,
 	getQueryStmtCountHeuristic,
 	isJobResolvable,
-	parseDbInputFromAssetSyntax
+	parseDbInputFromAssetSyntax,
+	apiErrorMessage
 } from './utils'
 
 // Mirrors the backend invariant that only `status = 'failure'` rows can carry a
@@ -572,3 +573,28 @@ describe('findMatchingCustomTag', () => {
 		).toBeUndefined()
 	})
 })
+
+// The generated client fills `message` with a canned per-status string ("Bad
+// Request") and keeps the server's explanation in `body`, so preferring `body`
+// is what makes a 4xx readable at all.
+describe('apiErrorMessage', () => {
+	it('prefers a plain-text body over the canned status message', () => {
+		expect(apiErrorMessage({ message: 'Bad Request', body: 'Promotion mode is EE only' })).toBe(
+			'Promotion mode is EE only'
+		)
+	})
+
+	it('digs the message out of a JSON body', () => {
+		expect(apiErrorMessage({ message: 'Bad Request', body: { error: { message: 'nope' } } })).toBe(
+			'nope'
+		)
+	})
+
+	it('falls back to message when the body is blank', () => {
+		expect(apiErrorMessage({ message: 'Bad Request', body: '   ' })).toBe('Bad Request')
+	})
+
+	it('handles a plain Error', () => {
+		expect(apiErrorMessage(new Error('boom'))).toBe('boom')
+	})
+})
diff --git a/frontend/src/lib/utils.ts b/frontend/src/lib/utils.ts
index e9acfdacab..2e538a635f 100644
--- a/frontend/src/lib/utils.ts
+++ b/frontend/src/lib/utils.ts
@@ -2464,3 +2464,14 @@ export function parsePrettyDate(text: string): Date | null {
 	const date = new Date(text)
 	return isNaN(date.getTime()) ? null : date
 }
+
+// Surface the backend's explanation: API errors carry the real message in
+// `.body` (plain text for Windmill 4xx), while `.message` is only the generic
+// status text ("Bad Request") the generated client fills in per status code.
+export function apiErrorMessage(e: any): string {
+	const body = e?.body
+	if (typeof body === 'string' && body.trim() !== '') return body
+	if (body && typeof body === 'object')
+		return body.error?.message ?? body.message ?? JSON.stringify(body)
+	return e?.message ?? String(e)
+}

From 9c37b0217c79390271d9855abe135df02f35c41f Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Wed, 29 Jul 2026 11:13:16 +0200
Subject: [PATCH 21/24] fix(cli): compile runes in .svelte.ts / .svelte.js
 modules (#10400)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix(cli): compile runes in .svelte.ts / .svelte.js modules

The svelte plugin only ran on `/\.svelte$/`, so a rune module like
`lib.svelte.ts` was bundled as plain TypeScript: the types were stripped
and `$state(0)` survived as a call to an undefined global, blowing up at
runtime with "ReferenceError: $state is not defined".

Route those files through `compileModule`. It parses with plain acorn and
chokes on TypeScript, so types come off first via esbuild's transform —
which is what vite-plugin-svelte gets for free by running after Vite's own
esbuild transform.

`wmill app dev` picks this up too; watch mode builds its plugin list with
the same `createFrameworkPlugins`.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* chore: pin ui_builder to 1ffb28e

Picks up the matching rune-module fix in the in-editor builder
(windmill-labs/windmill-code-ui-builder#24), so `.svelte.ts` modules
compile in the editor as well as through the CLI.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix(cli): compile raw apps with the app's own svelte compiler

Svelte 5.52.0 moved delegated event handlers off `element.__click` onto a
Symbol-keyed map. A raw app supplies its own Svelte *runtime* via
package.json, but `import("svelte/compiler")` resolves against the CLI,
whose own svelte floats independently — so the two can land on opposite
sides of that change and the app builds, renders, and has every
onclick/oninput silently dead.

Resolve the compiler from the app's node_modules instead, so compiler and
runtime are the same install by construction, and raise the CLI's own
floor past the break for the fallback path.

Also pin ui_builder to 013bf67, which carries the matching fix for the
in-editor builder (windmill-labs/windmill-code-ui-builder#25), and move
the Svelte raw-app template onto the same range. Those two go together:
the new builder rejects a runtime that sits on the far side of the ABI
break from its compiler.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 cli/bun.lock                                  |  12 +-
 cli/package.json                              |   2 +-
 cli/src/commands/app/bundle.ts                | 107 +++++++++++++---
 ...pp_svelte_compiler_resolution_unit.test.ts |  89 +++++++++++++
 cli/test/raw_app_svelte_module_unit.test.ts   | 118 ++++++++++++++++++
 frontend/scripts/ui_builder_artifact.json     |   4 +-
 .../src/lib/components/raw_apps/templates.ts  |   2 +-
 7 files changed, 305 insertions(+), 29 deletions(-)
 create mode 100644 cli/test/raw_app_svelte_compiler_resolution_unit.test.ts
 create mode 100644 cli/test/raw_app_svelte_module_unit.test.ts

diff --git a/cli/bun.lock b/cli/bun.lock
index c783e411c7..c48e0f3f22 100644
--- a/cli/bun.lock
+++ b/cli/bun.lock
@@ -17,7 +17,7 @@
         "minimatch": "^10.0.0",
         "open": "^10.0.0",
         "pg-gateway": "0.3.0-beta.4",
-        "svelte": "^5.45.2",
+        "svelte": "^5.56.8",
         "tar-stream": "^3.1.7",
         "windmill-parser-wasm-asset": "1.753.0",
         "windmill-parser-wasm-csharp": "1.510.1",
@@ -156,7 +156,7 @@
 
     "@stoplight/yaml-ast-parser": ["@stoplight/yaml-ast-parser@0.0.50", "", {}, "sha512-Pb6M8TDO9DtSVla9yXSTAxmo9GVEouq5P40DWXdOie69bXogZTkgvopCq+yEvTMA0F6PEvdJmbtTV3ccIp11VQ=="],
 
-    "@sveltejs/acorn-typescript": ["@sveltejs/acorn-typescript@1.0.9", "", { "peerDependencies": { "acorn": "^8.9.0" } }, "sha512-lVJX6qEgs/4DOcRTpo56tmKzVPtoWAaVbL4hfO7t7NVwl9AAXzQR6cihesW1BmNMPl+bK6dreu2sOKBP2Q9CIA=="],
+    "@sveltejs/acorn-typescript": ["@sveltejs/acorn-typescript@1.0.11", "", { "peerDependencies": { "acorn": "^8.9.0" } }, "sha512-LFuZUkjJ9iF7JZye/aG5XM0SFcQ5VyL0oVX4WJ9dc0Va3R3s0OauX1BESVCb+YN/ol8TAfqGDDAQsTG627Y5kw=="],
 
     "@types/bun": ["@types/bun@1.3.9", "", { "dependencies": { "bun-types": "1.3.9" } }, "sha512-KQ571yULOdWJiMH+RIWIOZ7B2RXQGpL1YQrBtLIV3FqDcCu6FsbFUBwhdKUlCKUpS3PJDsHlJ1QKlpxoVR+xtw=="],
 
@@ -180,7 +180,7 @@
 
     "ajv": ["ajv@8.18.0", "", { "dependencies": { "fast-deep-equal": "^3.1.3", "fast-uri": "^3.0.1", "json-schema-traverse": "^1.0.0", "require-from-string": "^2.0.2" } }, "sha512-PlXPeEWMXMZ7sPYOHqmDyCJzcfNrUr3fGNKtezX14ykXOEIvyK81d+qydx89KY5O71FKMPaQ2vBfBFI5NHR63A=="],
 
-    "aria-query": ["aria-query@5.3.2", "", {}, "sha512-COROpnaoap1E2F000S62r6A60uHZnmlvomhfyT2DlTcrY1OrBKn2UhH7qn5wTC9zMvD0AY7csdPSNwKP+7WiQw=="],
+    "aria-query": ["aria-query@5.3.1", "", {}, "sha512-Z/ZeOgVl7bcSYZ/u/rh0fOpvEpq//LZmdbkXyc7syVzjPAhfOa9ebsdTSjEBDU4vs5nC98Kfduj1uFo0qyET3g=="],
 
     "axobject-query": ["axobject-query@4.1.0", "", {}, "sha512-qIj0G9wZbMGNLjLmg1PT6v2mE9AH2zlnADJD/2tC6E00hgmhUOfEB6greHPAfLRSufHqROIUTkw6E+M3lH0PTQ=="],
 
@@ -206,7 +206,7 @@
 
     "define-lazy-prop": ["define-lazy-prop@3.0.0", "", {}, "sha512-N+MeXYoqr3pOgn8xfyRPREN7gHakLYjhsHhWGT3fWAiL4IkAt0iDw14QiiEm2bE30c5XX5q0FtAA3CK5f9/BUg=="],
 
-    "devalue": ["devalue@5.6.3", "", {}, "sha512-nc7XjUU/2Lb+SvEFVGcWLiKkzfw8+qHI7zn8WYXKkLMgfGSHbgCEaR6bJpev8Cm6Rmrb19Gfd/tZvGqx9is3wg=="],
+    "devalue": ["devalue@5.8.2", "", {}, "sha512-DObPPAfdtFbXjxLqK8s2Xk9ZuWz5+ZoFEhC7J76es4GU/rEiXwHTmbImoCdyoCOcBH1UF3+Cz6Z2sYD4hyl5TA=="],
 
     "diff": ["diff@5.2.2", "", {}, "sha512-vtcDfH3TOjP8UekytvnHH1o1P4FcUdt4eQ1Y+Abap1tk/OB2MWQvcwS2ClCd1zuIhc3JKOx6p3kod8Vfys3E+A=="],
 
@@ -214,7 +214,7 @@
 
     "esm-env": ["esm-env@1.2.2", "", {}, "sha512-Epxrv+Nr/CaL4ZcFGPJIYLWFom+YeV1DqMLHJoEd9SYRxNbaFruBwfEX/kkHUJf55j2+TUbmDcmuilbP1TmXHA=="],
 
-    "esrap": ["esrap@2.2.3", "", { "dependencies": { "@jridgewell/sourcemap-codec": "^1.4.15" } }, "sha512-8fOS+GIGCQZl/ZIlhl59htOlms6U8NvX6ZYgYHpRU/b6tVSh3uHkOHZikl3D4cMbYM0JlpBe+p/BkZEi8J9XIQ=="],
+    "esrap": ["esrap@2.3.0", "", { "dependencies": { "@jridgewell/sourcemap-codec": "^1.4.15" }, "peerDependencies": { "@typescript-eslint/types": "^8.2.0" }, "optionalPeers": ["@typescript-eslint/types"] }, "sha512-GQ/7RN8uOtEfNpzZzBMTzW9JBcX42oaSVtPzdF+6cEL8pqIL094iUpr9jzYGn4O4P/1S60dJ6izyT8F4LYARng=="],
 
     "events-universal": ["events-universal@1.0.1", "", { "dependencies": { "bare-events": "^2.7.0" } }, "sha512-LUd5euvbMLpwOF8m6ivPCbhQeSiYVNb8Vs0fQ8QjXo0JTkEHpz8pxdQf0gStltaPpw0Cca8b39KxvK9cfKRiAw=="],
 
@@ -274,7 +274,7 @@
 
     "string_decoder": ["string_decoder@1.1.1", "", { "dependencies": { "safe-buffer": "~5.1.0" } }, "sha512-n/ShnvDi6FHbbVfviro+WojiFzv+s8MPMHBczVePfUpDJLwoLT0ht1l4YwBCbi8pJAveEEdnkHyPyTP/mzRfwg=="],
 
-    "svelte": ["svelte@5.53.2", "", { "dependencies": { "@jridgewell/remapping": "^2.3.4", "@jridgewell/sourcemap-codec": "^1.5.0", "@sveltejs/acorn-typescript": "^1.0.5", "@types/estree": "^1.0.5", "@types/trusted-types": "^2.0.7", "acorn": "^8.12.1", "aria-query": "^5.3.1", "axobject-query": "^4.1.0", "clsx": "^2.1.1", "devalue": "^5.6.3", "esm-env": "^1.2.1", "esrap": "^2.2.2", "is-reference": "^3.0.3", "locate-character": "^3.0.0", "magic-string": "^0.30.11", "zimmerframe": "^1.1.2" } }, "sha512-yGONuIrcl/BMmqbm6/52Q/NYzfkta7uVlos5NSzGTfNJTTFtPPzra6rAQoQIwAqupeM3s9uuTf5PvioeiCdg9g=="],
+    "svelte": ["svelte@5.56.8", "", { "dependencies": { "@jridgewell/remapping": "^2.3.4", "@jridgewell/sourcemap-codec": "^1.5.0", "@sveltejs/acorn-typescript": "^1.0.10", "@types/estree": "^1.0.5", "@types/trusted-types": "^2.0.7", "acorn": "^8.12.1", "aria-query": "5.3.1", "axobject-query": "^4.1.0", "clsx": "^2.1.1", "devalue": "^5.8.1", "esm-env": "^1.2.1", "esrap": "^2.2.12", "is-reference": "^3.0.3", "locate-character": "^3.0.0", "magic-string": "^0.30.11", "zimmerframe": "^1.1.2" } }, "sha512-PY8LOw7xP6c8IOiVqdo0sbbZVYhXRSfklOQLAUyGBKqjTX0wx/z4l/9J+PmBpmlLnxzEb1NqltxQ5/wZme/Cmg=="],
 
     "tar-stream": ["tar-stream@3.1.7", "", { "dependencies": { "b4a": "^1.6.4", "fast-fifo": "^1.2.0", "streamx": "^2.15.0" } }, "sha512-qJj60CXt7IU1Ffyc3NJMjh6EkuCFej46zUqJ4J7pqYlThyd9bO0XBTmcOIhSzZJVWfsLks0+nle/j538YAW9RQ=="],
 
diff --git a/cli/package.json b/cli/package.json
index 548588a402..12f8e6158f 100644
--- a/cli/package.json
+++ b/cli/package.json
@@ -26,7 +26,7 @@
     "minimatch": "^10.0.0",
     "open": "^10.0.0",
     "pg-gateway": "0.3.0-beta.4",
-    "svelte": "^5.45.2",
+    "svelte": "^5.56.8",
     "tar-stream": "^3.1.7",
     "windmill-parser-wasm-asset": "1.753.0",
     "windmill-parser-wasm-csharp": "1.510.1",
diff --git a/cli/src/commands/app/bundle.ts b/cli/src/commands/app/bundle.ts
index c515e1e86e..9987713e4f 100644
--- a/cli/src/commands/app/bundle.ts
+++ b/cli/src/commands/app/bundle.ts
@@ -2,6 +2,8 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import process from "node:process";
 import { spawn } from "node:child_process";
+import { createRequire } from "node:module";
+import { pathToFileURL } from "node:url";
 import * as log from "../../core/log.ts";
 import { colors } from "@cliffy/ansi/colors";
 import * as windmillUtils from "@windmill-labs/shared-utils";
@@ -78,38 +80,70 @@ export function detectFrameworks(appDir: string): { svelte: boolean; vue: boolea
   }
 }
 
+/**
+ * Loads the Svelte compiler out of the *app's* node_modules.
+ *
+ * The app brings its own Svelte runtime via package.json, and compiler and
+ * runtime have to agree on internals: Svelte 5.52.0 moved delegated event
+ * handlers off `element.__click` onto a Symbol-keyed map, so an older
+ * compiler's `onclick` output is silently ignored by a newer runtime — the app
+ * builds and renders with every handler dead. A bare `import("svelte/compiler")`
+ * resolves against this CLI instead, whose own svelte floats independently of
+ * the app's, which is exactly how the two drift apart.
+ *
+ * Falls back to the CLI's own compiler when the app has none resolvable.
+ */
+export async function loadSvelteCompiler(appDir: string): Promise<any> {
+  try {
+    const requireFromApp = createRequire(
+      path.join(path.resolve(appDir), "package.json")
+    );
+    const entry = requireFromApp.resolve("svelte/compiler");
+    return await import(pathToFileURL(entry).href);
+  } catch {
+    return await import("svelte/compiler");
+  }
+}
+
 /**
  * Creates a Svelte esbuild plugin
  * Uses the svelte compiler from the project's node_modules
  */
 function createSveltePlugin(appDir: string): any {
+  // Resolved once per build, not per file.
+  let compilerPromise: Promise<any> | undefined;
+  const svelteCompiler = () =>
+    (compilerPromise ??= loadSvelteCompiler(appDir));
+
+  // This converts a message in Svelte's format to esbuild's format
+  const messageConverter =
+    (source: string, filename: string) =>
+    ({ message, start, end }: any) => {
+      let location;
+      if (start && end) {
+        const lineText = source.split(/\r\n|\r|\n/g)[start.line - 1];
+        const lineEnd = start.line === end.line ? end.column : lineText.length;
+        location = {
+          file: filename,
+          line: start.line,
+          column: start.column,
+          length: lineEnd - start.column,
+          lineText,
+        };
+      }
+      return { text: message, location };
+    };
+
   return {
     name: "svelte",
     setup(build: any) {
       build.onLoad({ filter: /\.svelte$/ }, async (args: any) => {
-        // Import svelte compiler from the project's node_modules
-        const svelte = await import("svelte/compiler");
+        const svelte = await svelteCompiler();
 
         // Load the file from the file system
         const source = await readTextFile(args.path);
         const filename = path.relative(process.cwd(), args.path);
-
-        // This converts a message in Svelte's format to esbuild's format
-        const convertMessage = ({ message, start, end }: any) => {
-          let location;
-          if (start && end) {
-            const lineText = source.split(/\r\n|\r|\n/g)[start.line - 1];
-            const lineEnd = start.line === end.line ? end.column : lineText.length;
-            location = {
-              file: filename,
-              line: start.line,
-              column: start.column,
-              length: lineEnd - start.column,
-              lineText,
-            };
-          }
-          return { text: message, location };
-        };
+        const convertMessage = messageConverter(source, filename);
 
         // Convert Svelte syntax to JavaScript
         try {
@@ -120,6 +154,41 @@ function createSveltePlugin(appDir: string): any {
           return { errors: [convertMessage(e)] };
         }
       });
+
+      // `lib.svelte.ts` / `lib.svelte.js` are plain modules that may use runes.
+      // They need `compileModule`, otherwise `$state`/`$derived` sail through
+      // esbuild untouched and the bundle throws "$state is not defined".
+      build.onLoad({ filter: /\.svelte\.[jt]s$/ }, async (args: any) => {
+        const svelte = await svelteCompiler();
+
+        const source = await readTextFile(args.path);
+        const filename = path.relative(process.cwd(), args.path);
+        const convertMessage = messageConverter(source, filename);
+
+        try {
+          // `compileModule` parses with plain acorn and chokes on TypeScript, so
+          // types have to come off first (vite-plugin-svelte gets this for free
+          // by running after Vite's esbuild transform).
+          const code = filename.endsWith(".ts")
+            ? (
+                await build.esbuild.transform(source, {
+                  loader: "ts",
+                  sourcefile: filename,
+                })
+              ).code
+            : source;
+
+          const { js, warnings } = svelte.compileModule(code, { filename });
+          const contents = js.code + `//# sourceMappingURL=` + js.map.toUrl();
+          return {
+            contents,
+            loader: "js",
+            warnings: warnings.map(convertMessage),
+          };
+        } catch (e: any) {
+          return { errors: [convertMessage(e)] };
+        }
+      });
     },
   };
 }
diff --git a/cli/test/raw_app_svelte_compiler_resolution_unit.test.ts b/cli/test/raw_app_svelte_compiler_resolution_unit.test.ts
new file mode 100644
index 0000000000..5fbf05384e
--- /dev/null
+++ b/cli/test/raw_app_svelte_compiler_resolution_unit.test.ts
@@ -0,0 +1,89 @@
+/**
+ * A raw app brings its own Svelte *runtime* via package.json, so it has to be
+ * compiled with its own *compiler* too — the two share internals that change
+ * between versions. Svelte 5.52.0 moved delegated event handlers off
+ * `element.__click` onto a Symbol-keyed map, so compiling with a version on the
+ * other side of that line produces an app that builds, renders, and has every
+ * `onclick` silently dead.
+ *
+ * `import("svelte/compiler")` resolves against the CLI, whose svelte floats
+ * independently of the app's. These cover the app-local resolution that avoids
+ * that drift.
+ */
+
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import * as os from "node:os";
+import { loadSvelteCompiler } from "../src/commands/app/bundle.ts";
+
+let tempDir: string;
+
+/** A stand-in svelte install, identifiable by a version the real one never has. */
+function installStubSvelte(dir: string, version: string) {
+  const pkgDir = path.join(dir, "node_modules", "svelte");
+  fs.mkdirSync(pkgDir, { recursive: true });
+  fs.writeFileSync(
+    path.join(pkgDir, "package.json"),
+    JSON.stringify({
+      name: "svelte",
+      version,
+      type: "module",
+      exports: { "./compiler": "./compiler.js" },
+    }),
+    "utf-8",
+  );
+  fs.writeFileSync(
+    path.join(pkgDir, "compiler.js"),
+    `export const VERSION = ${JSON.stringify(version)};\n` +
+      `export function compile() { return { js: { code: "", map: null }, warnings: [] }; }\n` +
+      `export function compileModule() { return { js: { code: "", map: null }, warnings: [] }; }\n`,
+    "utf-8",
+  );
+}
+
+beforeEach(() => {
+  tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "raw-app-svelte-compiler-"));
+  fs.writeFileSync(
+    path.join(tempDir, "package.json"),
+    JSON.stringify({ name: "app", private: true, dependencies: { svelte: "*" } }),
+    "utf-8",
+  );
+});
+
+afterEach(() => {
+  fs.rmSync(tempDir, { recursive: true, force: true });
+});
+
+describe("loadSvelteCompiler", () => {
+  test("uses the app's own compiler rather than the CLI's", async () => {
+    installStubSvelte(tempDir, "0.0.0-app-local");
+
+    const compiler = await loadSvelteCompiler(tempDir);
+
+    expect(compiler.VERSION).toBe("0.0.0-app-local");
+  });
+
+  test("resolves against the app even when given a relative dir", async () => {
+    installStubSvelte(tempDir, "0.0.0-relative");
+    const cwd = process.cwd();
+    try {
+      process.chdir(path.dirname(tempDir));
+      const compiler = await loadSvelteCompiler(path.basename(tempDir));
+      expect(compiler.VERSION).toBe("0.0.0-relative");
+    } finally {
+      process.chdir(cwd);
+    }
+  });
+
+  test("falls back to the CLI's compiler when the app has none", async () => {
+    const compiler = await loadSvelteCompiler(tempDir);
+
+    // The real thing, not a stub — and new enough to emit the Symbol-map form
+    // of delegated handlers that a modern runtime reads.
+    expect(typeof compiler.compile).toBe("function");
+    expect(compiler.VERSION).not.toContain("app-local");
+    const [major, minor] = compiler.VERSION.split(".").map(Number);
+    expect(major > 5 || (major === 5 && minor >= 52)).toBe(true);
+  });
+});
diff --git a/cli/test/raw_app_svelte_module_unit.test.ts b/cli/test/raw_app_svelte_module_unit.test.ts
new file mode 100644
index 0000000000..736e048100
--- /dev/null
+++ b/cli/test/raw_app_svelte_module_unit.test.ts
@@ -0,0 +1,118 @@
+/**
+ * `lib.svelte.ts` / `lib.svelte.js` modules are plain modules that may use
+ * runes. They need `svelte.compileModule`; without it esbuild happily bundles
+ * `$state(...)` as an ordinary call and the app dies at runtime with
+ * "ReferenceError: $state is not defined".
+ */
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import * as os from "node:os";
+import { createBundle } from "../src/commands/app/bundle.ts";
+
+let tempDir: string;
+let originalCwd: string;
+
+// Runes used as bare calls, ignoring the `$state(...)` mentions inside Svelte's
+// own warning message template literals.
+function bareRuneCalls(js: string): string[] {
+  return [...js.matchAll(/(^|[^.\w$`])\$(state|derived|effect|props)\s*\(/g)].map(
+    (m) => m[0]
+  );
+}
+
+function writeApp(files: Record<string, string>) {
+  for (const [name, content] of Object.entries(files)) {
+    fs.writeFileSync(path.join(tempDir, name), content, "utf-8");
+  }
+}
+
+async function bundle(entry: string): Promise<string> {
+  const { js } = await createBundle({
+    entryPoint: path.join(tempDir, entry),
+    minify: false,
+    sourcemap: false,
+  });
+  return js;
+}
+
+beforeAll(() => {
+  originalCwd = process.cwd();
+  tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "raw-app-svelte-module-"));
+  fs.writeFileSync(
+    path.join(tempDir, "package.json"),
+    JSON.stringify({ name: "app", private: true, dependencies: { svelte: "*" } }),
+    "utf-8"
+  );
+  // Reuse the CLI's own svelte install instead of paying for an npm install;
+  // `ensureNodeModules` only checks that the directory is there.
+  fs.symlinkSync(
+    path.join(originalCwd, "node_modules"),
+    path.join(tempDir, "node_modules")
+  );
+  process.chdir(tempDir);
+});
+
+afterAll(() => {
+  process.chdir(originalCwd);
+  fs.rmSync(tempDir, { recursive: true, force: true });
+});
+
+describe("svelte plugin: .svelte.ts modules", () => {
+  test("compiles runes in a TypeScript rune module and the bundle runs", async () => {
+    writeApp({
+      "lib.svelte.ts": `export class Cycle<T> {
+  #options: T[] = [];
+  #index = $state(0);
+  current = $derived(this.#options[this.#index]);
+
+  constructor(options: T[]) {
+    this.#options = options;
+  }
+
+  next() {
+    this.#index = (this.#index + 1) % this.#options.length;
+  }
+}
+`,
+      "ts_entry.ts": `import { Cycle } from './lib.svelte';
+
+const cycle = new Cycle(['a', 'b', 'c']);
+cycle.next();
+(globalThis as any).__cycleResult = cycle.current;
+`,
+    });
+
+    const js = await bundle("ts_entry.ts");
+
+    expect(bareRuneCalls(js)).toEqual([]);
+    // Runtime is the real check: unfixed, this throws
+    // "ReferenceError: $state is not defined".
+    new Function(js)();
+    expect((globalThis as any).__cycleResult).toBe("b");
+  });
+
+  test("compiles runes in a JavaScript rune module", async () => {
+    writeApp({
+      "counter.svelte.js": `export const counter = $state({ n: 0 });
+
+export function bump() {
+  counter.n += 1;
+}
+`,
+      "js_entry.ts": `import { counter, bump } from './counter.svelte.js';
+
+bump();
+bump();
+(globalThis as any).__counterResult = counter.n;
+`,
+    });
+
+    const js = await bundle("js_entry.ts");
+
+    expect(bareRuneCalls(js)).toEqual([]);
+    new Function(js)();
+    expect((globalThis as any).__counterResult).toBe(2);
+  });
+});
diff --git a/frontend/scripts/ui_builder_artifact.json b/frontend/scripts/ui_builder_artifact.json
index 01cfbb2888..544f788f83 100644
--- a/frontend/scripts/ui_builder_artifact.json
+++ b/frontend/scripts/ui_builder_artifact.json
@@ -1,5 +1,5 @@
 {
 	"baseUrl": "https://pub-06154ed168a24e73a86ab84db6bf15d8.r2.dev",
-	"version": "76ee616",
-	"sha256": "1d696d38a152179ef6e1cada5df302d078cc677b6dbc244b5c42335e11feabac"
+	"version": "013bf67",
+	"sha256": "4ad957f62a1cf2fe592144f7da702a899294a330acae40ef2d85ffd726326c91"
 }
diff --git a/frontend/src/lib/components/raw_apps/templates.ts b/frontend/src/lib/components/raw_apps/templates.ts
index 335ae4d8e8..22fa773f85 100644
--- a/frontend/src/lib/components/raw_apps/templates.ts
+++ b/frontend/src/lib/components/raw_apps/templates.ts
@@ -136,7 +136,7 @@ export const svelte5Template = {
 	'/index.css': indexCss,
 	'/package.json': `{
     "dependencies": {
-        "svelte": "^5.55.5",
+        "svelte": "^5.56.8",
         "windmill-client": "^1"
     }
 }`

From b1d26bd26814adb846175ae4a958746cc61b7d6f Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Wed, 29 Jul 2026 12:11:41 +0200
Subject: [PATCH 22/24] chore: pin ui_builder to 2471791 (#10402)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Picks up the language-server fix in the in-editor builder
(windmill-labs/windmill-code-ui-builder#26), so .svelte files get
IntelliSense, diagnostics and go-to-definition again. The bundled
extension's language server was dying on startup with

  Cannot read properties of undefined (reading 'useCaseSensitiveFileNames')

Builds and runtime were unaffected — this is editor language support
only, and it predates the rune-module and delegated-event fixes already
pinned here.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 frontend/scripts/ui_builder_artifact.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/frontend/scripts/ui_builder_artifact.json b/frontend/scripts/ui_builder_artifact.json
index 544f788f83..dcba3214de 100644
--- a/frontend/scripts/ui_builder_artifact.json
+++ b/frontend/scripts/ui_builder_artifact.json
@@ -1,5 +1,5 @@
 {
 	"baseUrl": "https://pub-06154ed168a24e73a86ab84db6bf15d8.r2.dev",
-	"version": "013bf67",
-	"sha256": "4ad957f62a1cf2fe592144f7da702a899294a330acae40ef2d85ffd726326c91"
+	"version": "2471791",
+	"sha256": "04048791fb6b2ebca5cc30447e163826cdb143d65cce07a629252e131ac83618"
 }

From 64ec1aa490ab5537a73bcb6f6b7e926c6339af39 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Wed, 29 Jul 2026 12:12:07 +0200
Subject: [PATCH 23/24] chore(main): release 1.775.2 (#10397)

* chore(main): release 1.775.2

* Apply automatic changes

---------

Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com>
---
 CHANGELOG.md                                  |   9 +
 backend/Cargo.lock                            | 158 +++++++++---------
 backend/Cargo.toml                            |   4 +-
 .../parsers/windmill-parser-wasm/Cargo.lock   |  48 +++---
 .../parsers/windmill-parser-wasm/Cargo.toml   |   2 +-
 backend/windmill-api/openapi.yaml             |   2 +-
 benchmarks/lib.ts                             |   2 +-
 cli/src/core/constants.ts                     |   2 +-
 frontend/package-lock.json                    |   4 +-
 frontend/package.json                         |   2 +-
 lsp/Pipfile                                   |   2 +-
 openflow.openapi.yaml                         |   2 +-
 .../WindmillClient/WindmillClient.psd1        |   2 +-
 python-client/wmill/pyproject.toml            |   2 +-
 typescript-client/jsr.json                    |   2 +-
 typescript-client/package.json                |   2 +-
 version.txt                                   |   2 +-
 17 files changed, 128 insertions(+), 119 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index ac51063de9..a69d7b0389 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,14 @@
 # Changelog
 
+## [1.775.2](https://github.com/windmill-labs/windmill/compare/v1.775.1...v1.775.2) (2026-07-29)
+
+
+### Bug Fixes
+
+* **cli:** compile runes in .svelte.ts / .svelte.js modules ([#10400](https://github.com/windmill-labs/windmill/issues/10400)) ([9c37b02](https://github.com/windmill-labs/windmill/commit/9c37b0217c79390271d9855abe135df02f35c41f))
+* distinguish waiting-on-user from streaming in ai sessions ([#10396](https://github.com/windmill-labs/windmill/issues/10396)) ([a17ccbd](https://github.com/windmill-labs/windmill/commit/a17ccbdd0d3c9f2f6234c4cc70d0917e83eeaceb))
+* surface the real reason git sync settings saves are rejected ([#10398](https://github.com/windmill-labs/windmill/issues/10398)) ([33d2845](https://github.com/windmill-labs/windmill/commit/33d28456cc8ef9f64301eb3dd6dad6d7325018e3))
+
 ## [1.775.1](https://github.com/windmill-labs/windmill/compare/v1.775.0...v1.775.1) (2026-07-28)
 
 
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index 11167f13cf..7dd3c795aa 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -14489,7 +14489,7 @@ dependencies = [
 
 [[package]]
 name = "windmill"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -14574,7 +14574,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-ai"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "async-stream",
  "async-trait",
@@ -14607,7 +14607,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-alerting"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14620,7 +14620,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "argon2",
@@ -14759,7 +14759,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-agent-workers"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14782,7 +14782,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-assets"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14797,7 +14797,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-auth"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14823,7 +14823,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-client"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "reqwest 0.12.28",
  "serde",
@@ -14833,7 +14833,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-configs"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14850,7 +14850,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-debug"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "axum 0.8.9",
  "base64 0.22.1",
@@ -14872,7 +14872,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-embeddings"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14895,7 +14895,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flow-conversations"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14911,7 +14911,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flows"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14932,7 +14932,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-groups"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14953,7 +14953,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-inputs"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14967,7 +14967,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-integration-tests"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -15002,7 +15002,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-jobs"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15027,7 +15027,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-npm-proxy"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "axum 0.8.9",
  "flate2",
@@ -15045,7 +15045,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-openapi"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15067,7 +15067,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-schedule"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15087,7 +15087,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-scripts"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15124,7 +15124,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-settings"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15152,7 +15152,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-sse"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "lazy_static",
  "serde",
@@ -15164,7 +15164,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-users"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "argon2",
  "axum 0.8.9",
@@ -15189,7 +15189,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workers"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15203,7 +15203,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workspaces"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15238,7 +15238,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-audit"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "chrono",
  "lazy_static",
@@ -15252,7 +15252,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-autoscaling"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15271,7 +15271,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-common"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "aes-gcm",
  "aho-corasick",
@@ -15375,7 +15375,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-dep-map"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "chrono",
  "itertools 0.14.0",
@@ -15394,7 +15394,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-git-sync"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "regex",
  "serde",
@@ -15409,7 +15409,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-indexer"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "astral-tokio-tar",
@@ -15433,7 +15433,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-jseval"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "futures",
@@ -15450,7 +15450,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "itertools 0.14.0",
  "lazy_static",
@@ -15466,7 +15466,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-mcp"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15487,7 +15487,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-native-triggers"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15518,7 +15518,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-oauth"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "arc-swap",
@@ -15543,7 +15543,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-object-store"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "async-stream",
@@ -15577,7 +15577,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-operator"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "futures",
@@ -15595,7 +15595,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "convert_case 0.6.0",
  "serde",
@@ -15604,7 +15604,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15616,7 +15616,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15628,7 +15628,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -15640,7 +15640,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15652,7 +15652,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15664,7 +15664,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -15675,7 +15675,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15686,7 +15686,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15698,7 +15698,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -15709,7 +15709,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15731,7 +15731,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15743,7 +15743,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15757,7 +15757,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "convert_case 0.6.0",
@@ -15774,7 +15774,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15787,7 +15787,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "serde",
@@ -15799,7 +15799,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15817,7 +15817,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -15833,7 +15833,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -15849,7 +15849,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "serde",
@@ -15860,7 +15860,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-queue"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15899,7 +15899,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-runtime-nativets"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "const_format",
@@ -15939,7 +15939,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-sql-datatype-parser-wasm"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "getrandom 0.3.4",
  "wasm-bindgen",
@@ -15950,7 +15950,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-store"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15984,7 +15984,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-test-utils"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16008,7 +16008,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16041,7 +16041,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-amqp"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16068,7 +16068,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-azure"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16101,7 +16101,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-email"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16121,7 +16121,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-gcp"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16155,7 +16155,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-http"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16191,7 +16191,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-kafka"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16214,7 +16214,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-mqtt"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16238,7 +16238,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-nats"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -16262,7 +16262,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-postgres"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16297,7 +16297,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-sqs"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16325,7 +16325,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-websocket"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16350,7 +16350,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "bitflags 2.13.1",
@@ -16369,7 +16369,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "async-once-cell",
@@ -16484,7 +16484,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker-volumes"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "bytes",
  "futures",
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index 49beac0b8a..a6fffe33f4 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.775.1"
+version = "1.775.2"
 authors.workspace = true
 edition.workspace = true
 
@@ -88,7 +88,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal", "./parsers/windmill-parser-wasm"]
 
 [workspace.package]
-version = "1.775.1"
+version = "1.775.2"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.lock b/backend/parsers/windmill-parser-wasm/Cargo.lock
index e3639e30c2..0e4e12eb89 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.lock
+++ b/backend/parsers/windmill-parser-wasm/Cargo.lock
@@ -6191,7 +6191,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windmill-common"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "aho-corasick",
  "anyhow",
@@ -6272,7 +6272,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -6284,7 +6284,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "convert_case",
  "serde",
@@ -6293,7 +6293,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6305,7 +6305,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6317,7 +6317,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -6329,7 +6329,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6341,7 +6341,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6353,7 +6353,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -6364,7 +6364,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6375,7 +6375,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6387,7 +6387,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6398,7 +6398,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -6420,7 +6420,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6432,7 +6432,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6446,7 +6446,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "convert_case",
@@ -6463,7 +6463,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6476,7 +6476,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "serde",
@@ -6488,7 +6488,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6506,7 +6506,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -6522,7 +6522,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6538,7 +6538,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wasm"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "getrandom 0.2.17",
@@ -6570,7 +6570,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "serde",
@@ -6581,7 +6581,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.775.1"
+version = "1.775.2"
 dependencies = [
  "anyhow",
  "bitflags",
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.toml b/backend/parsers/windmill-parser-wasm/Cargo.toml
index 9ee10c7fbb..1cb5004022 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.toml
+++ b/backend/parsers/windmill-parser-wasm/Cargo.toml
@@ -12,7 +12,7 @@ resolver = "2"
 members = ["."]
 
 [workspace.package]
-version = "1.775.1"
+version = "1.775.2"
 edition = "2021"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 381cf1b999..21eca505fd 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.775.1
+  version: 1.775.2
   title: Windmill API
 
   contact:
diff --git a/benchmarks/lib.ts b/benchmarks/lib.ts
index e77bfb67ba..57c877b441 100644
--- a/benchmarks/lib.ts
+++ b/benchmarks/lib.ts
@@ -2,7 +2,7 @@ import { sleep } from "https://deno.land/x/sleep@v1.2.1/mod.ts";
 import * as windmill from "https://deno.land/x/windmill@v1.174.0/mod.ts";
 import * as api from "https://deno.land/x/windmill@v1.174.0/windmill-api/index.ts";
 
-export const VERSION = "v1.775.1";
+export const VERSION = "v1.775.2";
 
 export async function login(email: string, password: string): Promise<string> {
   return await windmill.UserService.login({
diff --git a/cli/src/core/constants.ts b/cli/src/core/constants.ts
index bd5add7ecd..59de21e2bf 100644
--- a/cli/src/core/constants.ts
+++ b/cli/src/core/constants.ts
@@ -10,4 +10,4 @@ export const WM_FORK_PREFIX = "wm-fork";
 // (e.g. utils.ts) can read it without importing main.ts and creating a circular
 // dependency (main → workspace → utils → main) that triggers a TDZ.
 // Re-exported from main.ts for backwards compatibility.
-export const VERSION = "1.775.1";
+export const VERSION = "1.775.2";
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index ad6838fa37..4ab6621c30 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -1,12 +1,12 @@
 {
 	"name": "@windmill-labs/components",
-	"version": "1.775.1",
+	"version": "1.775.2",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "@windmill-labs/components",
-			"version": "1.775.1",
+			"version": "1.775.2",
 			"hasInstallScript": true,
 			"license": "AGPL-3.0",
 			"dependencies": {
diff --git a/frontend/package.json b/frontend/package.json
index 4bf61cee55..01e68d2acf 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@windmill-labs/components",
-	"version": "1.775.1",
+	"version": "1.775.2",
 	"scripts": {
 		"dev": "vite dev",
 		"dev:ui-builder": "mv static/ui_builder static/ui_builder.dev-disabled 2>/dev/null || true ; trap 'mv static/ui_builder.dev-disabled static/ui_builder 2>/dev/null || true' EXIT ; vite dev",
diff --git a/lsp/Pipfile b/lsp/Pipfile
index a69114c915..24c5b9197c 100644
--- a/lsp/Pipfile
+++ b/lsp/Pipfile
@@ -4,7 +4,7 @@ verify_ssl = true
 name = "pypi"
 
 [packages]
-wmill = ">=1.775.1"
+wmill = ">=1.775.2"
 sendgrid = "*"
 mysql-connector-python = "*"
 pymongo = "*"
diff --git a/openflow.openapi.yaml b/openflow.openapi.yaml
index 8ee13fa39f..833d43cb91 100644
--- a/openflow.openapi.yaml
+++ b/openflow.openapi.yaml
@@ -1,7 +1,7 @@
 openapi: '3.0.3'
 
 info:
-  version: 1.775.1
+  version: 1.775.2
   title: OpenFlow Spec
   contact:
     name: Ruben Fiszel
diff --git a/powershell-client/WindmillClient/WindmillClient.psd1 b/powershell-client/WindmillClient/WindmillClient.psd1
index 7bdcf6a788..d54c4c5a88 100644
--- a/powershell-client/WindmillClient/WindmillClient.psd1
+++ b/powershell-client/WindmillClient/WindmillClient.psd1
@@ -12,7 +12,7 @@
     RootModule        = 'WindmillClient.psm1'
 
     # Version number of this module.
-    ModuleVersion     = '1.775.1'
+    ModuleVersion     = '1.775.2'
 
     # Supported PSEditions
     # CompatiblePSEditions = @()
diff --git a/python-client/wmill/pyproject.toml b/python-client/wmill/pyproject.toml
index 55b38a4e1d..90b6989676 100644
--- a/python-client/wmill/pyproject.toml
+++ b/python-client/wmill/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill"
-version = "1.775.1"
+version = "1.775.2"
 description = "A client library for accessing Windmill server wrapping the Windmill client API"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/typescript-client/jsr.json b/typescript-client/jsr.json
index abde746fc4..7721bf829b 100644
--- a/typescript-client/jsr.json
+++ b/typescript-client/jsr.json
@@ -1,6 +1,6 @@
 {
   "name": "@windmill/windmill",
-  "version": "1.775.1",
+  "version": "1.775.2",
   "exports": "./src/index.ts",
   "publish": {
     "exclude": ["!src", "./s3Types.ts", "./sqlUtils.ts", "./client.ts", "./wacError.ts"]
diff --git a/typescript-client/package.json b/typescript-client/package.json
index 0d9ac57f69..b0ac36d410 100644
--- a/typescript-client/package.json
+++ b/typescript-client/package.json
@@ -1,7 +1,7 @@
 {
   "name": "windmill-client",
   "description": "Windmill SDK client for browsers and Node.js",
-  "version": "1.775.1",
+  "version": "1.775.2",
   "author": "Ruben Fiszel",
   "license": "Apache 2.0",
   "homepage": "https://github.com/windmill-labs/windmill/tree/main/typescript-client#readme",
diff --git a/version.txt b/version.txt
index 393fbf5b71..765699e2a4 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-1.775.1
+1.775.2

From 9cd6a70f6ace956f679c1ce1fb46543cda569183 Mon Sep 17 00:00:00 2001
From: Guilhem <guilhemlemouel@gmail.com>
Date: Wed, 29 Jul 2026 17:46:26 +0200
Subject: [PATCH 24/24] fix: sidebar workspace toggle navigates home when
 already in workspace mode (#10405)

* feat: sidebar workspace toggle navigates home when already in workspace mode

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix: fire the toggle home navigation on keyboard activation too

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix: one activation per key press and no duplicate history entry from home

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .../toggleButton-v2/ToggleButton.svelte       | 14 ++++++++++++-
 .../sessions/SessionModeSwitch.svelte         | 20 +++++++++++++++++--
 2 files changed, 31 insertions(+), 3 deletions(-)

diff --git a/frontend/src/lib/components/common/toggleButton-v2/ToggleButton.svelte b/frontend/src/lib/components/common/toggleButton-v2/ToggleButton.svelte
index 042bb09865..621e8383d0 100644
--- a/frontend/src/lib/components/common/toggleButton-v2/ToggleButton.svelte
+++ b/frontend/src/lib/components/common/toggleButton-v2/ToggleButton.svelte
@@ -21,6 +21,11 @@
 		item: ToggleGroupElements['item']
 		value: ToggleGroupItemProps
 		class?: string
+		// Fires on activation, including on the already-selected button — which the
+		// group's onSelected never reports (melt treats it as a deselection and the
+		// group keeps the current value). Keyboard activation needs its own keydown
+		// branch below: melt preventDefaults Enter/Space, so no click is synthesized.
+		onActivate?: (e: Event) => void
 	}
 
 	let {
@@ -38,7 +43,8 @@
 		id = undefined,
 		item,
 		value,
-		class: className = ''
+		class: className = '',
+		onActivate
 	}: Props = $props()
 
 	// Handle backward compatibility: small prop maps to size="sm"
@@ -74,6 +80,12 @@
 		)}
 		use:melt={$item(value)}
 		style={selectedColor ? `--selected-color: ${selectedColor}` : ''}
+		onclick={onActivate}
+		onkeydown={(e) => {
+			// `repeat` filtered out: a held key keeps firing keydown, and one activation
+			// must mean one call however the consumer's side effect behaves.
+			if (!e.repeat && (e.key === 'Enter' || e.key === ' ')) onActivate?.(e)
+		}}
 	>
 		{#if icon}
 			{@const SvelteComponent = icon}
diff --git a/frontend/src/lib/components/sessions/SessionModeSwitch.svelte b/frontend/src/lib/components/sessions/SessionModeSwitch.svelte
index c4d29c9791..d721b6f16f 100644
--- a/frontend/src/lib/components/sessions/SessionModeSwitch.svelte
+++ b/frontend/src/lib/components/sessions/SessionModeSwitch.svelte
@@ -1,8 +1,11 @@
 <script lang="ts">
-	import { House, MessagesSquare } from 'lucide-svelte'
+	import { Building, MessagesSquare } from 'lucide-svelte'
 	import ToggleButtonGroup from '$lib/components/common/toggleButton-v2/ToggleButtonGroup.svelte'
 	import ToggleButton from '$lib/components/common/toggleButton-v2/ToggleButton.svelte'
 	import { enterSessionMode, exitSessionMode } from './sessionSwitch.svelte'
+	import { goto } from '$lib/navigation'
+	import { page } from '$app/state'
+	import { base } from '$lib/base'
 
 	// Which side of the switch is active. `nav` = workspace navigation (the classic
 	// app), `session` = the sessions sidebar + chat + preview.
@@ -20,6 +23,18 @@
 		if (next === 'session') void enterSessionMode()
 		else void exitSessionMode()
 	}
+
+	// Pressing the already-active "Workspace" side goes home, so the toggle doubles
+	// as the home button when there is no mode to switch to. `onToggle` is
+	// deliberately not fired: this is a plain in-mode navigation, so the mobile menu
+	// drawer should dismiss like it does for any other nav link.
+	function onNavActivate() {
+		if (mode !== 'nav') return
+		// `goto` has no same-URL short-circuit, so navigating from home would push a
+		// duplicate history entry and make the next Back press look broken.
+		if (page.url.pathname === `${base}/`) return
+		void goto('/')
+	}
 </script>
 
 <!-- Each ToggleButton renders inside a Tooltip wrapper, which is the actual flex
@@ -34,12 +49,13 @@
 		<ToggleButton
 			{item}
 			value="nav"
-			icon={isCollapsed ? House : undefined}
+			icon={isCollapsed ? Building : undefined}
 			label="Workspace"
 			iconOnly={isCollapsed}
 			tooltip={isCollapsed ? 'Workspace' : undefined}
 			size="sm"
 			class="w-full justify-center"
+			onActivate={onNavActivate}
 		/>
 		<ToggleButton
 			{item}