Merge remote-tracking branch 'origin/main' into sessions-chatbox-focus

# Conflicts: # frontend/src/lib/components/sessions/PreviewTabHost.svelte
2026-10-28 00:02:42 +00:00 · 2026-08-10 21:47:16 +02:00
parent 54759974be c09de594b6
commit 4965e9b9dd
1097 changed files with 72123 additions and 13456 deletions
@@ -9,11 +9,75 @@ Windmill uses `SQLX_OFFLINE=true` in CI, which requires all `sqlx::query!` / `sq

 ## When to Run

-Run after any change to SQL queries in Rust source files. Without it, CI will fail with:
+Run after **adding or editing** a SQL query in Rust source. Without it, CI fails with:
 ```
 error: `SQLX_OFFLINE=true` but there is no cached data for this query
 ```

+**Do NOT run it when a change only *removes* queries.** The cache is already complete for
+CI; all that is left are orphaned entries, which are cosmetic and never break a build.
+Running `prepare` to tidy them risks destroying the cache for no gain. Delete them
+offline instead: for each `.sqlx/query-*.json`, normalize its `query` field (strip `\`
+line-continuations, collapse whitespace) and check whether it still appears in any `.rs`
+file. That detector reports ~48 false positives in a CE checkout — EE queries live in
+`*_ee.rs` symlinks it cannot read — so **filter to the tables your change touched** and
+delete only those.
+
+## Before You Run Anything
+
+1. **Back the cache up.** `prepare` deletes `.sqlx/` *before* regenerating, so any compile
+   failure leaves it gutted (observed: 2350 → 142 entries).
+   ```bash
+   cp -r backend/.sqlx /tmp/sqlx_backup    # restore with: rm -rf backend/.sqlx && cp -r /tmp/sqlx_backup backend/.sqlx
+   ```
+2. **Point `DATABASE_URL` at THIS worktree's database.** `prepare` compiles every
+   `sqlx::query!` against the **live** database. Another worktree's DB lacks your
+   migrations, so every new-table query fails and takes the cache down with it. The
+   symptom is `relation "<your_new_table>" does not exist` — that is a wrong
+   `DATABASE_URL`, not a broken query. See AGENTS.md → "Per-worktree ports and database".
+
+## Queries Inside Tests Need `--all-targets`, Which Fails In A CE Checkout
+
+`prepare` only caches queries in code it compiles, and `--workspace` alone does **not**
+compile test targets. A `sqlx::query!` inside `tests/*.rs` therefore gets no entry, and CI
+fails on the test target with the usual "no cached data" error even though the lib built
+clean. `SQLX_OFFLINE=true cargo check --workspace --all-targets` is what reproduces it.
+
+Adding `--all-targets` caches them — and, in a CE checkout, **aborts partway through**:
+`backend/tests/otel.rs` imports `windmill_common::otel_ee`, which exists only behind the
+`private` feature, so the compile dies after `prepare` has already emptied `.sqlx/`.
+Observed: 2435 → 4 entries, `error: cargo check failed with status: exit status: 101`.
+
+Do not fight it — the abort is a pre-existing EE gap, not something your change caused.
+Take the entries you need and put the backup back:
+
+```bash
+cd backend
+cp -r .sqlx /tmp/sqlx_backup
+ls /tmp/sqlx_backup | sort > /tmp/before.txt
+
+DATABASE_URL=<this worktree's db> \
+  cargo sqlx prepare --workspace -- --workspace --features all_sqlx_features --all-targets
+# expected to fail; it still wrote the entries it got to before dying
+
+ls .sqlx | sort > /tmp/after.txt
+mkdir -p /tmp/newq
+comm -13 /tmp/before.txt /tmp/after.txt | while read f; do cp ".sqlx/$f" /tmp/newq/; done
+
+rm -rf .sqlx && cp -r /tmp/sqlx_backup .sqlx && cp /tmp/newq/*.json .sqlx/
+```
+
+**Read every file in `/tmp/newq` before copying it in** — print each one's `query` field and
+confirm it is one of yours. The set is small (one per new test query), and anything else in
+there means the run got further than you think.
+
+Then verify both targets, since the lib passing says nothing about the tests:
+
+```bash
+SQLX_OFFLINE=true cargo check --workspace --features all_sqlx_features   # lib
+SQLX_OFFLINE=true cargo check -p <your-crate> --all-targets              # tests
+```
+
 ## The Problem

 `cargo sqlx prepare --workspace` **deletes all existing cache files** and regenerates only the ones found in the current compilation. If you don't compile with every feature flag (especially `private` for EE files), you will **silently delete EE query caches**, breaking CI for enterprise tests.
@@ -68,7 +132,16 @@ But if it fails with EE compilation errors, use the safe procedure above.

 - **Never** run `cargo sqlx prepare --workspace` with only OSS features and commit the result — it will delete EE caches.
 - **Never** set `SQLX_OFFLINE=true` for local `cargo sqlx prepare` — use a live database per CLAUDE.md. (CI runs with `SQLX_OFFLINE=true`, which is why the cache must be complete.)
+- **Never** run `prepare` without a `.sqlx` backup, or against a `DATABASE_URL` you have not confirmed belongs to this worktree.
+- **Never** run `prepare` at all for a removal-only change.
 - **Never** skip the verification step (step 4 above).
+- **Never** leave a `--all-targets` run's output in place after it aborts — it is a
+  near-empty cache. Restore the backup and graft on only the entries you verified.
+
+Step 4 compares against `origin/main` because step 1 restored from it, so the two agree.
+If you did **not** run step 1 — auditing a branch's cache on its own, say — compare
+against `git merge-base HEAD origin/main` instead: `origin/main` advances, so its newer
+entries would read as losses on your branch.

 ## Verification

@@ -0,0 +1,179 @@
+#!/usr/bin/env bash
+# PreToolUse allowance for scratch file ops: auto-allow a single, plain, single-line
+# `mkdir` / `cp` / `mv` / `touch` / `chmod` / `tar` / `unzip` whose every path operand
+# resolves under /tmp. Anything else makes no decision (exit 0) and falls back to the normal
+# permission flow — where `Bash(mv:*)` and `Bash(chmod:*)` in the `ask` list prompt. A
+# PreToolUse `allow` overrides those ask rules, which is why this is a hook and not an allow
+# rule: permission rules match a command prefix, so they can only constrain the FIRST operand.
+# `cp /tmp/x ~/.zshrc` matches a `cp /tmp/` prefix, and requiring every operand is the point.
+#
+# Requiring the sources under /tmp too (not just the destination) keeps this from becoming a
+# read-exfiltration path around the `Read(**/.env)` / `Read(**/secrets/**)` deny rules: a copy
+# out of the project into /tmp would land the content somewhere `Read(/tmp/**)` allows.
+#
+# Deny-by-default tokenizing, in the same spirit as guard-rm-outside-tmp.sh: every path token
+# must consist only of alphanumerics and `. _ / -`. That set contains none of the characters
+# bash uses for quoting, expansion, or command separation ($ ` ~ { } ( ) ' " \ ; & | < >), nor
+# any glob character, so all of those forms fail by construction. `realpath -m` then resolves
+# `..` and existing symlinks, so `/tmp/link` pointing at /etc/passwd is caught.
+#
+# `tar` and `unzip` get their own parser: their write destination arrives as a flag VALUE
+# (`-C`, `-d`) rather than a positional, and a bundle like `-xzf` consumes the token after it.
+# Flags are an allowlist, not a denylist, so `-P` / `--absolute-names` — which turn off tar's
+# refusal to extract `..` and absolute member paths — defer rather than needing enumeration.
+# Extraction additionally requires an explicit destination under /tmp, or a cwd already under
+# /tmp, since otherwise members land in the project checkout.
+#
+# Residual risk accepted: an archive whose members include a symlink pointing out of /tmp
+# followed by a write through it can still escape, because tar applies member symlinks as it
+# extracts. The archive itself must be under /tmp to get here, so this is a hazard only for
+# archives fetched from an untrusted source into the scratch dir.
+#
+# Assumes GNU `realpath` (-m) and `jq`, both present in this repo's Linux dev env.
+set -uo pipefail
+
+input=$(cat)
+command -v jq >/dev/null 2>&1 || exit 0
+cmd=$(printf '%s' "$input" | jq -r '.tool_input.command // empty' 2>/dev/null)
+[ -z "$cmd" ] && exit 0
+cwd=$(printf '%s' "$input" | jq -r '.cwd // empty' 2>/dev/null)
+
+# A newline separates commands, and the tokenizer below only reads the first line — defer.
+case "$cmd" in *$'\n'*) exit 0 ;; esac
+
+read -r -a toks <<< "$cmd"
+
+# 0 iff the token is charset-safe and resolves to a path strictly inside /tmp.
+under_tmp() {
+  local t="$1" canon
+  # Globs never auto-allow. Bash expands them only after this hook has decided, so realpath
+  # sees the unexpanded pattern: `/tmp/link*` canonicalizes to itself and passes, then
+  # expands onto a symlink whose target is outside /tmp. chmod and cp follow command-line
+  # symlinks, so that is a write to the target. guard-rm-outside-tmp.sh can allow globs
+  # because `rm` unlinks the symlink itself rather than following it.
+  case "$t" in *[*?[]*) return 1 ;; esac
+  [ -n "$(printf '%s' "$t" | tr -d 'A-Za-z0-9._/-')" ] && return 1
+  # Absolute only. Resolving a relative operand against the cwd makes any bare word look like
+  # a safe path whenever the cwd is under /tmp, while the tool itself reads it as an option:
+  # `tar P -xf ...` is --absolute-names, not ./P, and `cp /tmp/t -RL /tmp/o` is a
+  # dereferencing recursive copy, not a file named -RL.
+  case "$t" in /*) ;; *) return 1 ;; esac
+  canon=$(realpath -m -- "$t" 2>/dev/null)
+  [ -n "$canon" ] || return 1
+  # /tmp itself is never a target — only paths strictly inside it.
+  case "$canon" in /tmp/?*) return 0 ;; esac
+  return 1
+}
+
+allow() {
+  jq -nc --arg r "$1" '{hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"allow",permissionDecisionReason:$r}}'
+  exit 0
+}
+
+# Bare command word only; wrappers (`timeout cp`), env prefixes, and `/bin/cp` defer.
+# Options are an allowlist per command, so anything that changes how symlinks are followed
+# defers instead of needing enumeration. `cp -L` / `-H` matter most: they dereference while
+# recursing, which copies the CONTENT of a symlink target from outside /tmp into a scratch
+# dir that `Read(/tmp/**)` then exposes. Plain `-r` and `-a` (which implies `-d`) recreate
+# such a symlink as a symlink instead, so no outside content is materialized.
+case "${toks[0]:-}" in
+  mkdir) takes_mode=0; ok_opts='pv' ;;
+  cp)    takes_mode=0; ok_opts='rRvfnpa' ;;
+  mv)    takes_mode=0; ok_opts='vfn' ;;
+  touch) takes_mode=0; ok_opts='acmv' ;;
+  chmod) takes_mode=1; ok_opts='Rvfc' ;;   # chmod's first operand is a mode, not a path
+  tar)   ok_flags='xctzjJavfC'; val_flags='fC' ;;
+  unzip) ok_flags='oqnljvd';    val_flags='d'  ;;
+  *) exit 0 ;;
+esac
+
+# ---------------------------------------------------------------- tar / unzip
+if [ -n "${ok_flags:-}" ]; then
+  saw_archive=0 saw_dest=0 extracting=0 listing=0 end_opts=0
+  i=1
+  while [ "$i" -lt "${#toks[@]}" ]; do
+    t="${toks[$i]}"
+    i=$((i + 1))
+    if [ "$end_opts" = 0 ]; then
+      [ "$t" = "--" ] && { end_opts=1; continue; }
+      case "$t" in
+        -?*)
+          flags="${t#-}"
+          # Allowlist: a long option, -P/--absolute-names, --transform, -I and friends all
+          # leave a residue here and defer rather than being enumerated as denials.
+          [ -n "$(printf '%s' "$flags" | tr -d "$ok_flags")" ] && exit 0
+          case "$flags" in *x*) extracting=1 ;; esac
+          case "${toks[0]}$flags" in unzip*[lv]*) listing=1 ;; esac
+          # A flag consuming the next token must be alone in its bundle's final position
+          # (`-xzf a.tar`), else the token it eats is ambiguous.
+          case "${flags%?}" in *[$val_flags]*) exit 0 ;; esac
+          case "${flags: -1}" in
+            [$val_flags])
+              val="${toks[$i]:-}"
+              i=$((i + 1))
+              [ -n "$val" ] || exit 0
+              under_tmp "$val" || exit 0
+              case "${flags: -1}" in
+                f) saw_archive=1 ;;
+                C | d) saw_dest=1 ;;
+              esac
+              ;;
+          esac
+          continue
+          ;;
+      esac
+    fi
+    # Positional. For tar these are sources (create) or member names (extract); for unzip the
+    # first is the archive. Requiring every one under /tmp is conservative for member names,
+    # which are not filesystem paths — those defer rather than being wrongly allowed.
+    under_tmp "$t" || exit 0
+    [ "${toks[0]}" = "unzip" ] && saw_archive=1
+  done
+
+  [ "$saw_archive" = 1 ] || exit 0   # tar without -f reads a tape/stdin; unzip needs an archive
+  # Writes land relative to the working directory unless a destination was given. `unzip -l`
+  # and `-v` only list, so they need no destination.
+  if [ "$extracting" = 1 ] || { [ "${toks[0]}" = "unzip" ] && [ "$listing" = 0 ]; }; then
+    [ "$saw_dest" = 1 ] || under_tmp "${cwd:-$PWD}" || exit 0
+  fi
+  allow "archive paths and extraction target are under /tmp"
+fi
+
+# ------------------------------------------- mkdir / cp / mv / touch / chmod
+path_operand=0
+seen_mode=0
+end_opts=0
+i=1
+while [ "$i" -lt "${#toks[@]}" ]; do
+  t="${toks[$i]}"
+  i=$((i + 1))
+
+  if [ "$end_opts" = 0 ]; then
+    [ "$t" = "--" ] && { end_opts=1; continue; }
+    # Checked at any position, not just before the first operand: GNU utils permute, so
+    # `cp /tmp/tree -RL /tmp/out` still enables dereferencing recursion.
+    case "$t" in
+      -?*)
+        # Allowlist: long options and the dereferencing flags leave a residue and defer.
+        [ -n "$(printf '%s' "${t#-}" | tr -d "$ok_opts")" ] && exit 0
+        continue
+        ;;
+    esac
+  fi
+
+  # chmod: consume the mode operand without a path check. Octal, or symbolic clauses.
+  if [ "$takes_mode" = 1 ] && [ "$seen_mode" = 0 ]; then
+    case "$t" in
+      [0-7] | [0-7][0-7] | [0-7][0-7][0-7] | [0-7][0-7][0-7][0-7]) ;;
+      *) printf '%s' "$t" | grep -Eq '^[ugoa]*[+=-][rwxXst]*(,[ugoa]*[+=-][rwxXst]*)*$' || exit 0 ;;
+    esac
+    seen_mode=1
+    continue
+  fi
+
+  under_tmp "$t" || exit 0
+  path_operand=1
+done
+
+[ "$path_operand" = 1 ] || exit 0
+allow "every path operand is under /tmp"
@@ -10,8 +10,12 @@ if [ -z "$FILE_PATH" ]; then
    exit 0
 fi

-# Check if the file is in the frontend directory
-if [[ "$FILE_PATH" == *"/frontend/"* ]]; then
+# Only the frontend app itself, i.e. a "frontend" directory sitting at a repo root.
+# A bare */frontend/* substring also matches ai_evals/adapters/frontend and the
+# ai_evals app fixtures, which no prettier config governs — prettier then falls back
+# to its defaults and rewrites the whole file. Anchoring to $CLAUDE_PROJECT_DIR
+# instead would skip worktrees edited from a session rooted elsewhere.
+if [[ "$FILE_PATH" == *"/frontend/"* ]] && [[ -e "${FILE_PATH%%/frontend/*}/.git" ]]; then
    # Check if it's a formattable file type
    if [[ "$FILE_PATH" =~ \.(ts|js|svelte|json|css|html|md)$ ]]; then
        cd "$CLAUDE_PROJECT_DIR/frontend" || exit 0
@@ -48,18 +48,6 @@
      "Read(/tmp/**)",
      "Write(/tmp/**)",
      "Edit(/tmp/**)",
-      "Bash(mkdir:/tmp/*)",
-      "Bash(mkdir:/tmp/**)",
-      "Bash(cp:/tmp/*)",
-      "Bash(cp:/tmp/**)",
-      "Bash(mv:/tmp/*)",
-      "Bash(mv:/tmp/**)",
-      "Bash(touch:/tmp/*)",
-      "Bash(touch:/tmp/**)",
-      "Bash(chmod:/tmp/*)",
-      "Bash(chmod:/tmp/**)",
-      "Bash(tar * /tmp/*)",
-      "Bash(unzip * /tmp/*)",
      "mcp__claude_ai_Gmail__search_threads",
      "mcp__claude_ai_Gmail__get_thread",
      "mcp__claude_ai_Gmail__get_message",
@@ -124,6 +112,11 @@
            "type": "command",
            "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/guard-rm-outside-tmp.sh",
            "timeout": 5
+          },
+          {
+            "type": "command",
+            "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/allow-fileops-in-tmp.sh",
+            "timeout": 5
          }
        ]
      }
@@ -0,0 +1,3 @@
+# Files a generator owns. Collapsed in review diffs and left out of language
+# stats: reviewing them means reviewing the generator instead.
+*.gen.ts linguist-generated=true
@@ -15,6 +15,11 @@ const CONCURRENCY = 24
 const TIMEOUT_MS = 20000
 const RETRIES = 2

+// Links whose target page is written but not yet deployed on windmill.dev: the app
+// link is already the final slug, so a 404 is expected until the docs side ships.
+// The value is why the entry exists, for whoever has to judge whether it still should.
+const PENDING_DEPLOY = new Map()
+
 async function walk(dir) {
 	const out = []
 	for (const entry of await readdir(dir, { withFileTypes: true })) {
@@ -111,16 +116,45 @@ async function worker() {
 }
 await Promise.all(Array.from({ length: CONCURRENCY }, worker))

-const failures = results.filter((r) => !r.ok)
-if (failures.length === 0) {
-	console.log(`\n✅ All ${allUrls.length} docs links are reachable.`)
+// An entry claims one thing — the page is not published yet — and 404 is the only
+// answer that means it. A timeout, 403 or 5xx on the same URL is a real fault, and
+// suppressing it would also read as "still waiting" and defer the staleness check.
+const isPendingDeploy = (r) => PENDING_DEPLOY.has(r.url) && r.status === 404
+
+const pending = results.filter((r) => PENDING_DEPLOY.has(r.url))
+const waiting = results.filter(isPendingDeploy)
+if (waiting.length) {
+	console.log(`\n⏳ ${waiting.length} link(s) waiting on a docs deploy:`)
+	for (const p of waiting.sort((a, b) => a.url.localeCompare(b.url))) {
+		console.log(`   ${p.url}\n     ${PENDING_DEPLOY.get(p.url)} — not live yet (${p.status})`)
+	}
+}
+
+// An entry that outlived its reason exempts a URL from the check forever, so a stale
+// one has to fail the job: a line in a green log is not read at release time.
+const stale = [
+	...pending.filter((p) => p.ok).map((p) => [p.url, 'the page is live']),
+	...[...PENDING_DEPLOY.keys()].filter((u) => !urls.has(u)).map((u) => [u, 'nothing references it'])
+]
+
+const failures = results.filter((r) => !r.ok && !isPendingDeploy(r))
+if (failures.length === 0 && stale.length === 0) {
+	console.log(`\n✅ No broken docs links (${allUrls.length} checked).`)
 	process.exit(0)
 }

-console.log(`\n❌ ${failures.length} broken docs link(s):`)
-for (const f of failures.sort((a, b) => a.url.localeCompare(b.url))) {
-	console.log(`\n  ${f.url}`)
-	console.log(`    status: ${f.error ? `error (${f.error})` : f.status}`)
-	for (const file of urls.get(f.url)) console.log(`    ↳ ${file}`)
+if (failures.length) {
+	console.log(`\n❌ ${failures.length} broken docs link(s):`)
+	for (const f of failures.sort((a, b) => a.url.localeCompare(b.url))) {
+		console.log(`\n  ${f.url}`)
+		console.log(`    status: ${f.error ? `error (${f.error})` : f.status}`)
+		for (const file of urls.get(f.url)) console.log(`    ↳ ${file}`)
+	}
+}
+if (stale.length) {
+	console.log(`\n❌ ${stale.length} PENDING_DEPLOY entr(ies) to delete from this script:`)
+	for (const [url, why] of stale.sort((a, b) => a[0].localeCompare(b[0]))) {
+		console.log(`\n  ${url}\n    ${why}`)
+	}
 }
 process.exit(1)
@@ -77,9 +77,11 @@ jobs:

      - uses: actions/setup-node@v4
        with:
-          # Node 22.19+ is required by the frontend's undici 8.x, which the
+          # Node 24 ships npm 11, which frontend/package-lock.json is authored
+          # with; npm 10 rejects it ("Missing: picomatch@4.0.5 from lock file").
+          # Node must also stay >= 22.19 for the frontend's undici 8.x, which the
          # Vitest bridge loads; Node 20 fails with markAsUncloneable.
-          node-version: "22"
+          node-version: "24"

      # CE build used only as the AI proxy (login, workspace, provider resource,
      # /ai/proxy). No worker execution or MCP needed — global tools/drafts run
@@ -116,6 +118,12 @@ jobs:
          npm ci
          npm run generate-backend-client

+      - name: Run harness unit tests
+        working-directory: ./ai_evals
+        run: |
+          bun install
+          bun test adapters/
+
      - name: Run global AI evals
        timeout-minutes: 20
        working-directory: ./ai_evals
@@ -30,8 +30,14 @@ jobs:
    outputs:
      authorized: ${{ steps.check.outputs.authorized }}
    steps:
+      # This check is purely additive: callers OR it with author_association, so it must
+      # never fail the job. Failing here would block every dependent reviewer job through
+      # `needs`, turning an unconfigured or misconfigured app into a total review outage
+      # rather than a fallback to the author_association path.
      - name: Mint internal app token
        id: app
+        if: vars.INTERNAL_APP_ID != ''
+        continue-on-error: true
        uses: actions/create-github-app-token@v2
        with:
          app-id: ${{ vars.INTERNAL_APP_ID }}
@@ -41,7 +47,9 @@ jobs:
      - name: Resolve authorization
        id: check
        env:
-          GH_TOKEN: ${{ steps.app.outputs.token }}
+          # Without the app token, the default token still resolves public members and
+          # repo collaborators; private members simply fall through to author_association.
+          GH_TOKEN: ${{ steps.app.outputs.token || github.token }}
          USERNAME: ${{ inputs.username }}
          TRUSTED_BOT: ${{ inputs.trusted_bot }}
          REPO: ${{ github.repository }}
@@ -23,5 +23,8 @@ jobs:
          cache-dependency-path: "frontend/package-lock.json"
      - name: "npm check"
        timeout-minutes: 5
+        env:
+          # svelte-check peaks past node's ~4GB default ceiling on this runner and aborts.
+          NODE_OPTIONS: --max-old-space-size=8192
        run: cd frontend && npm ci && npm run generate-backend-client && npm run
          check
@@ -8,8 +8,10 @@ jobs:
    name: "Release please"
    runs-on: ubicloud
    steps:
-      - uses: GoogleCloudPlatform/release-please-action@v3
+      # Config lives in release-please-config.json / .release-please-manifest.json:
+      # a `release-type` input instead re-derives the last released version by
+      # paginating every GitHub release, which on a repo this size is slow enough
+      # to fail intermittently.
+      - uses: googleapis/release-please-action@v5
        with:
-          release-type: simple
-          package-name: windmill
          token: ${{ secrets.PAT_TOKEN }}
@@ -7,12 +7,12 @@
    "playwright": {
      "type": "stdio",
      "command": "npx",
-      "args": ["-y", "@playwright/mcp@latest", "--browser", "chromium", "--headless"]
+      "args": ["-y", "@playwright/mcp@latest", "--browser", "chromium", "--headless", "--output-dir", "/tmp/playwright-mcp-${USER:-shared}"]
    },
    "playwright-headed": {
      "type": "stdio",
      "command": "npx",
-      "args": ["-y", "@playwright/mcp@latest", "--browser", "chromium"]
+      "args": ["-y", "@playwright/mcp@latest", "--browser", "chromium", "--output-dir", "/tmp/playwright-mcp-${USER:-shared}"]
    }
  }
 }
@@ -0,0 +1,3 @@
+{
+  ".": "1.783.0"
+}
@@ -13,6 +13,9 @@ Open-source platform for internal tools, workflows, API integrations, background

 - **Validation**: `docs/validation.md` — what checks to run based on what you changed
 - **Unreleased SDK changes**: `docs/wac-sdk-e2e.md` — exercising a client change on a real worker
+- **Agent workers**: `docs/agent-worker-e2e.md` — building and running one locally. An agent
+  reaches the DB only through the API, so `Connection::Http` paths are never taken by a plain
+  `cargo run`; a normal build cannot start one at all.
 - **Enterprise**: `docs/enterprise.md` — EE file conventions and PR workflow
 - **Backend patterns**: use the `rust-backend` skill when writing Rust code
 - **Frontend patterns**: use the `svelte-frontend` skill when writing Svelte code. Do NOT edit svelte files unless you have read that skill.
@@ -20,10 +23,17 @@ Open-source platform for internal tools, workflows, API integrations, background
 - **Code review**: review the current PR or branch against the shared review policy in `REVIEW.md` (severity triage, public-surface checklist, AGENTS.md compliance, test-coverage assessment). The skill at `.agents/skills/local-review/SKILL.md` orchestrates it. All three CLIs auto-discover the same SKILL — Claude reads `.claude/skills/` (symlinked to the canonical `.agents/skills/` file), Codex and Pi read `.agents/skills/` directly. Invoke with `/local-review` in Claude Code, `$local-review` (or `/skills` selector) in Codex, or `pi --skill local-review` / `/skill:local-review` in Pi. For a Codex-driven pass that mirrors the `codex-pr-review` GitHub action against your unpushed work (committed + uncommitted) before you push, use `/local-review-codex` (`.agents/skills/local-review-codex/`) — same `REVIEW.md` policy, `gpt-5.6-sol`, `xhigh` reasoning; requires the `codex` CLI >= 0.144.1.
 - **Domain guides**: `.claude/skills/native-trigger/` and `frontend/tutorial-system-guide.mdc`
 - **Brand/UI guidelines**: `frontend/brand-guidelines.md`
+- **Domain vocabulary**: `CONTEXT.md` — the words this codebase uses for its own concepts (step, step setting, trigger step, …). Name things the way it does.
 - **CLI commands**: when adding/modifying/removing a command, subcommand, option, or description in `cli/src/commands/`, run `python system_prompts/generate.py` to refresh `system_prompts/auto-generated/` and `cli/src/guidance/skills.gen.ts`. The CLI docs the agents use to operate `wmill` are derived from the source — stale generated files give agents the wrong flags.
+- **Session recorder**: `frontend/src/lib/components/recording/` is also the recorder `wmill app dev --recording` serves, vendored into the CLI as `cli/src/commands/app/devRecorderBundle.gen.ts`. After changing `rawAppSnapshot.ts` or `rawAppRecording.svelte.ts`, run `bun run gen:dev-recorder` from `cli/` (`cli/test/dev_recorder_bundle_unit.test.ts` fails otherwise).

 ## Dev Environment

+> **In a git worktree, the ports and database below are NOT the ones to use.** Each
+> worktree gets its own backend port, frontend port and Postgres database, so the
+> defaults in this section apply only to a plain single checkout. **Discover the real
+> values before running anything** — see "Per-worktree ports and database" below.
+
 - **Backend**: `cargo run` from `backend/` (API at http://localhost:8000)
 - **DuckDB local jobs**: before running DuckDB scripts locally, build the FFI shared library with `cd backend/windmill-duckdb-ffi-internal && ./build_dev.sh`. Re-run it after clean builds or when `backend/target/debug/libwindmill_duckdb_ffi_internal.*` is missing. The bundled DuckDB compile (~2min) is cached in a per-user dir shared across worktrees, so a fresh worktree reuses it and the build is near-instant.
 - **Data pipelines (DuckLake) from source**: a plain `cargo run` (even `--features quickjs`) advertises a `duckdb` worker tag but **cannot** execute DuckDB scripts and has **no** working S3 proxy (DuckLake writes 404). Build CE DuckLake with `cargo run --features quickjs,duckdb,parquet,private` (add `,python` for Python scripts, `,enterprise,license` for EE) **and** build the FFI (bullet above). See `backend/CLAUDE.md` → "Running data pipelines (DuckLake) from source" for the exact feature sets and the two feature-gate gotchas.
@@ -33,6 +43,37 @@ Open-source platform for internal tools, workflows, API integrations, background
 - **Instance settings**: navigate to `/#superadmin-settings`
 - **Migrations**: use `cargo sqlx migrate add -r <name>` from `backend/` to create new migrations (never generate timestamps manually)

+### Per-worktree ports and database
+
+A worktree's `.env` / `.env.local` (repo root) and `backend/.env` hold its own
+`DATABASE_URL` and `PORT`; the database is typically `windmill_<branch_with_underscores>`
+(branch `dbt-runtime` → `windmill_dbt_runtime`). Read them, or discover from what is
+already running:
+
+```bash
+psql postgres://postgres:changeme@localhost:5432/postgres -tAc \
+  "select datname from pg_database where datname like 'windmill%'" | grep "$(git branch --show-current | tr - _)"
+# the port the frontend actually proxies to (REMOTE of this worktree's vite):
+for p in $(pgrep -f vite); do case "$(readlink /proc/$p/cwd)" in *"$(basename "$(git rev-parse --show-toplevel)")"*)
+  tr '\0' '\n' < /proc/$p/environ | grep -E '^REMOTE=|^PORT=';; esac; done
+```
+
+Getting these wrong is not a cheap mistake:
+
+- **`DATABASE_URL` pointed at another worktree's database silently destroys the sqlx
+  cache.** `cargo run` and `cargo sqlx prepare` both compile `sqlx::query!` against the
+  **live** database, so the wrong one fails with `relation "<your_new_table>" does not
+  exist` — and `prepare` deletes the whole `.sqlx/` directory *before* it fails, leaving
+  it gutted. Always `cp -r backend/.sqlx <tmp>/sqlx_backup` first (see the `update-sqlx`
+  skill).
+- **The frontend proxies to its own worktree's backend port, not 8000.** Starting a
+  backend on the wrong port leaves the UI up but every API call 502s, which reads like an
+  application bug rather than a misconfiguration.
+- **Kill backends by pid scoped to this worktree's cwd** (`readlink /proc/<pid>/cwd`),
+  never `pkill -f target/debug/windmill` — that kills every sibling worktree's backend.
+  Beware that a `pgrep -f "<pattern>"` in a shell whose own command line contains
+  `<pattern>` matches the shell itself.
+
 ## Verifying Frontend Changes

 After modifying frontend code, drive the running dev server with the **Playwright MCP** to verify the change in a real browser — don't claim a UI change works without exercising it.
@@ -51,10 +92,34 @@ Typical flow:
 5. `mcp__playwright__browser_take_screenshot` for visual confirmation
 6. `mcp__playwright__browser_console_messages` / `browser_network_requests` to surface errors

+Write screenshots to an absolute path under `/tmp` (the MCP servers already do; standalone
+Playwright scripts must be told): moving a PNG out of the checkout afterwards needs a `mv` the
+permission hooks always prompt on. Same reason to run `rm`/`mv`/`cp` as one plain command per Bash
+call: those hooks defer on `&&`, `;`, redirects, quotes and `$VAR`.
+
 **Attach the screenshots to the PR.** For any change under `frontend/`, embed screenshots of the affected UI in the PR body — the `pr` skill requires this and carries the upload recipe.

 If you cannot exercise a UI change (no dev server, etc.), say so explicitly rather than claiming success.

+## Verifying Backend Changes
+
+`cargo check` and the unit tests do not exercise a worker code path. **If you changed how
+a job runs — an executor, `handle_child`, anything spawning or reading from a
+subprocess — run an actual job of that kind** and confirm it completed, then say so.
+Whole classes of defect compile and unit-test clean:
+
+- **Stack overflow from a large buffer in an async block.** An array declared across an
+  `.await` is baked into the future's state; once that future is boxed a few layers deep
+  by the job poller, two 16 KB arrays abort the worker *process* (`thread
+  'tokio-runtime-worker' has overflowed its stack`). Heap-allocate read buffers
+  (`vec![0u8; N]`, not `[0u8; N]`).
+- Deadlocks from draining only one of a child's pipes, missed cancellation or timeout
+  propagation, and anything depending on the real engine's output format.
+
+A crash like this takes down every job on that worker, not just yours, so check the
+backend log after the run rather than only the job's own status. If you cannot run one,
+say which path went unexercised instead of implying it was verified.
+
 ## Banned Patterns

 ### `$bindable(default_value)` on optional props
@@ -1,5 +1,221 @@
 # Changelog

+## [1.783.0](https://github.com/windmill-labs/windmill/compare/v1.782.0...v1.783.0) (2026-08-07)
+
+
+### Features
+
+* add public sharing option for job pages ([#10573](https://github.com/windmill-labs/windmill/issues/10573)) ([5ce29b3](https://github.com/windmill-labs/windmill/commit/5ce29b34364d6429411621752c64e306426aa2dd))
+* offer more dev workspace environment labels ([#10570](https://github.com/windmill-labs/windmill/issues/10570)) ([8c6211c](https://github.com/windmill-labs/windmill/commit/8c6211c27718912ad1e1a29f770747ea07fdb161))
+* open a session edit in the preview panel from the edits list ([#10486](https://github.com/windmill-labs/windmill/issues/10486)) ([d008975](https://github.com/windmill-labs/windmill/commit/d0089758e6091b07009dee5b8387f3f4b6d97455))
+* preview merge result in git-sync PR diff check ([#10542](https://github.com/windmill-labs/windmill/issues/10542)) ([c61404a](https://github.com/windmill-labs/windmill/commit/c61404a0f4008cd1de3c977c653c712ef3d9e0a3))
+
+
+### Bug Fixes
+
+* **frontend:** collapse the dev-workspace edit notice into a badge ([#10576](https://github.com/windmill-labs/windmill/issues/10576)) ([fdd76a6](https://github.com/windmill-labs/windmill/commit/fdd76a6f1358404b13326c68eed1eac14097bd88))
+* **frontend:** hide the fork workspace banner from operators ([#10575](https://github.com/windmill-labs/windmill/issues/10575)) ([57ed0f7](https://github.com/windmill-labs/windmill/commit/57ed0f77e1f83751ea04820b365fb53f098d38bf))
+* scope a fork's cloned app policy and custom path to its creator ([#10589](https://github.com/windmill-labs/windmill/issues/10589)) ([8e95bfe](https://github.com/windmill-labs/windmill/commit/8e95bfe6157ebe4f8fc5f6e13c36a6f0bdb9969d))
+
+## [1.782.0](https://github.com/windmill-labs/windmill/compare/v1.781.3...v1.782.0) (2026-08-06)
+
+
+### Features
+
+* improve duckdb isolation ([#10565](https://github.com/windmill-labs/windmill/issues/10565)) ([956210e](https://github.com/windmill-labs/windmill/commit/956210ea06224f7c6cd3e5082a96d3f80039404b))
+
+
+### Bug Fixes
+
+* compact ai chat context for models with unknown context windows ([#10564](https://github.com/windmill-labs/windmill/issues/10564)) ([fc1e11c](https://github.com/windmill-labs/windmill/commit/fc1e11cb3d056af6a3779cf17b23f9bf7152d355))
+* keep the mermaid fullscreen dialog in its pane and its emoji vector ([#10541](https://github.com/windmill-labs/windmill/issues/10541)) ([c2a6936](https://github.com/windmill-labs/windmill/commit/c2a6936e7d3fe724f968b10dd689abb6ff8f75ad))
+
+## [1.781.3](https://github.com/windmill-labs/windmill/compare/v1.781.2...v1.781.3) (2026-08-06)
+
+
+### Bug Fixes
+
+* **frontend:** take the editor's post-edit content, not setCode's argument ([#10562](https://github.com/windmill-labs/windmill/issues/10562)) ([1846bd5](https://github.com/windmill-labs/windmill/commit/1846bd5ce59ee71a4262297513673d662f6a38b6))
+
+## [1.781.2](https://github.com/windmill-labs/windmill/compare/v1.781.1...v1.781.2) (2026-08-06)
+
+
+### Bug Fixes
+
+* **frontend:** reset the editor content when the script language changes ([#10560](https://github.com/windmill-labs/windmill/issues/10560)) ([56ea133](https://github.com/windmill-labs/windmill/commit/56ea133366875d8bd13347b5002f4ef351a8e4e6))
+
+## [1.781.1](https://github.com/windmill-labs/windmill/compare/v1.781.0...v1.781.1) (2026-08-06)
+
+
+### Bug Fixes
+
+* open the expression property column on demand, not from focus ([#10558](https://github.com/windmill-labs/windmill/issues/10558)) ([386c66b](https://github.com/windmill-labs/windmill/commit/386c66bef0534d4a63b3220050e98b9654ef8f34))
+* restore the flow expression editor's property side panel ([#10555](https://github.com/windmill-labs/windmill/issues/10555)) ([e4e7782](https://github.com/windmill-labs/windmill/commit/e4e7782517a9fd0fbbec020694b263a948ed1c0c))
+
+
+### Performance Improvements
+
+* keep run status out of flow graph node and edge data ([#10554](https://github.com/windmill-labs/windmill/issues/10554)) ([b2d38e0](https://github.com/windmill-labs/windmill/commit/b2d38e0391f26d92e8f9245a3db099129b6c3977))
+
+## [1.781.0](https://github.com/windmill-labs/windmill/compare/v1.780.0...v1.781.0) (2026-08-05)
+
+
+### Features
+
+* add a load all to the tree view's per-folder pager ([#10548](https://github.com/windmill-labs/windmill/issues/10548)) ([a3b79d7](https://github.com/windmill-labs/windmill/commit/a3b79d7732deba54fd6344229d5b91a80a3e0dd6))
+* allow a dev workspace to have its own dev workspace ([#10534](https://github.com/windmill-labs/windmill/issues/10534)) ([e203ab0](https://github.com/windmill-labs/windmill/commit/e203ab087a4ce885a1d424267f96db861207a0e6))
+* **debugger:** install debug session deps from the instance registry settings ([#10550](https://github.com/windmill-labs/windmill/issues/10550)) ([154f8f4](https://github.com/windmill-labs/windmill/commit/154f8f461ef01d60da73f9633d76bed45381a035))
+* **mcp:** serve the 2026-07-28 spec alongside the legacy protocol ([#10535](https://github.com/windmill-labs/windmill/issues/10535)) ([4fe4fac](https://github.com/windmill-labs/windmill/commit/4fe4fac358e67ee6e20dbff8bfa1de0e92e5f3c7))
+* redesign flow step, loop and branch settings panels ([#10026](https://github.com/windmill-labs/windmill/issues/10026)) ([09c8f3b](https://github.com/windmill-labs/windmill/commit/09c8f3b1f3eef2409e212cdb26c7bd2f830dae89))
+* register mounted CA certificates in windmill_extra at startup ([#10545](https://github.com/windmill-labs/windmill/issues/10545)) ([d9d6ec8](https://github.com/windmill-labs/windmill/commit/d9d6ec82ab7ad5279ba8ebc059f58bd663bad87f))
+
+
+### Bug Fixes
+
+* **ai:** collapse thinking to a status row with a thought-for duration ([#10515](https://github.com/windmill-labs/windmill/issues/10515)) ([d9b10e7](https://github.com/windmill-labs/windmill/commit/d9b10e7b0a1ba6702ecf05f64b80ac8bb7c79326))
+* **debugger:** confine prepare-deps under nsjail in both language paths ([#10546](https://github.com/windmill-labs/windmill/issues/10546)) ([a5423a8](https://github.com/windmill-labs/windmill/commit/a5423a81ca5d7c1e88ebed4573952e858ef1546c))
+* **debugger:** pass python index settings to prepare-deps and report failures ([#10533](https://github.com/windmill-labs/windmill/issues/10533)) ([7d153d5](https://github.com/windmill-labs/windmill/commit/7d153d5750db0ea17812d6b1f9a63ceaefddc2b9))
+* **debugger:** report python debugger dependency install failures instead of timing out ([#10531](https://github.com/windmill-labs/windmill/issues/10531)) ([29e179f](https://github.com/windmill-labs/windmill/commit/29e179f7879845f01c6813ad5dfbb19d08dc030e))
+* edit-in-dev-workspace dead-ends, wraps, and misses the tree view ([#10354](https://github.com/windmill-labs/windmill/issues/10354)) ([616d4fe](https://github.com/windmill-labs/windmill/commit/616d4fe167e1c99f8f5104c7b66dbc5fd502e0be))
+* flow step picker layout and single hover/keyboard highlight ([#10488](https://github.com/windmill-labs/windmill/issues/10488)) ([aa91619](https://github.com/windmill-labs/windmill/commit/aa91619bb67b7ae0cbd3a3848b6171d36967bd1f))
+* forward TLS trust roots to debug sessions and honor INIT_SCRIPT on windmill_extra ([#10532](https://github.com/windmill-labs/windmill/issues/10532)) ([74c4185](https://github.com/windmill-labs/windmill/commit/74c418570bb5bf1af54f367cfecae3e8b4ede764))
+* **frontend:** draw the tab strip's scroll bar instead of the native one ([#10547](https://github.com/windmill-labs/windmill/issues/10547)) ([2c189fe](https://github.com/windmill-labs/windmill/commit/2c189fea14749b8bb4604b1363eef907abc3b129))
+* **frontend:** filter the AI Sandbox entry by the flow insert search ([#10529](https://github.com/windmill-labs/windmill/issues/10529)) ([1dcb6bb](https://github.com/windmill-labs/windmill/commit/1dcb6bb9005c1e97f1fca6470eb2d2105a973918))
+* keep the same_worker pin across a flow module that spawns no job ([#10551](https://github.com/windmill-labs/windmill/issues/10551)) ([1aee222](https://github.com/windmill-labs/windmill/commit/1aee22296e228c54d4ca7251e9ae7e04229adb34))
+* keep the same_worker pin when a suspend ends without approval ([#10552](https://github.com/windmill-labs/windmill/issues/10552)) ([c59b60c](https://github.com/windmill-labs/windmill/commit/c59b60c729b03c5be66738b1f4cbf0d989a7b438))
+* point re-opened previews at the tab already showing them ([#10538](https://github.com/windmill-labs/windmill/issues/10538)) ([f11e883](https://github.com/windmill-labs/windmill/commit/f11e8835fdc762fccb521de48049ea43838d7f3c))
+* **triggers:** stop one failing trigger count from zeroing the rest ([#10549](https://github.com/windmill-labs/windmill/issues/10549)) ([0e42381](https://github.com/windmill-labs/windmill/commit/0e42381df086d4463e5914d8a194fe5141793bd1))
+
+## [1.780.0](https://github.com/windmill-labs/windmill/compare/v1.779.0...v1.780.0) (2026-08-04)
+
+
+### Features
+
+* **dbt:** reach any dbt adapter through a dbt_profile resource, and constrain the warehouse picker ([#10525](https://github.com/windmill-labs/windmill/issues/10525)) ([340d3cd](https://github.com/windmill-labs/windmill/commit/340d3cd5653fb7f23ba349517c1ab9a2a74bba58))
+
+
+### Bug Fixes
+
+* reflect custom tag add/remove in the manage-tags drawer immediately ([#10526](https://github.com/windmill-labs/windmill/issues/10526)) ([552ad9c](https://github.com/windmill-labs/windmill/commit/552ad9c859497d3b2d6d20ecf3103b06758cada7))
+
+## [1.779.0](https://github.com/windmill-labs/windmill/compare/v1.778.0...v1.779.0) (2026-08-04)
+
+
+### Features
+
+* add multi-select and bulk actions to the Home page ([#10499](https://github.com/windmill-labs/windmill/issues/10499)) ([c57045d](https://github.com/windmill-labs/windmill/commit/c57045dbb30aa40a212a9ee179f5da78c0f1a405))
+* deploy a raw app from its sources, bundling them on a worker ([#10500](https://github.com/windmill-labs/windmill/issues/10500)) ([81ba961](https://github.com/windmill-labs/windmill/commit/81ba9611eb7cdbb67a285337d2069c3909d10b69))
+* **frontend:** pick workspace members from a searchable instance user list ([#10474](https://github.com/windmill-labs/windmill/issues/10474)) ([d63315e](https://github.com/windmill-labs/windmill/commit/d63315ed356afaedc60e3fcf8427cd2c2e822ba0))
+* let the database manager run its jobs on a custom worker tag ([#10516](https://github.com/windmill-labs/windmill/issues/10516)) ([221566d](https://github.com/windmill-labs/windmill/commit/221566d2824efbb3f1ac6f3c543633a5783c085a))
+* make createApp and updateApp the full-code app tools over MCP ([#10510](https://github.com/windmill-labs/windmill/issues/10510)) ([f3e73fb](https://github.com/windmill-labs/windmill/commit/f3e73fb006ab316c422a6b318fe21946bff34d13))
+* preview and edit steps inside expanded subflows ([#10520](https://github.com/windmill-labs/windmill/issues/10520)) ([0d1cb81](https://github.com/windmill-labs/windmill/commit/0d1cb818eec35de9f1af8963b0f9138dc89b0192))
+* send prompt_cache_key on the openai responses api ([#10507](https://github.com/windmill-labs/windmill/issues/10507)) ([8364dd9](https://github.com/windmill-labs/windmill/commit/8364dd96ef355aa01516aa53aac1a9f01fadaa80))
+* show far more in the home tree view and say what is not loaded ([#10519](https://github.com/windmill-labs/windmill/issues/10519)) ([4254686](https://github.com/windmill-labs/windmill/commit/425468675808d12b71f5fefde3bccce38e74869d))
+
+
+### Bug Fixes
+
+* bound ScopeSelector badge heights and correct three scope-chip defects ([#10523](https://github.com/windmill-labs/windmill/issues/10523)) ([6d21d30](https://github.com/windmill-labs/windmill/commit/6d21d30242632549a1698b3e82ed4f55895ea51e))
+* bundle a vector emoji font so emoji scale with flow graph zoom ([#10498](https://github.com/windmill-labs/windmill/issues/10498)) ([62b2f4b](https://github.com/windmill-labs/windmill/commit/62b2f4b06768b5559b59761760899076476b1e47))
+* keep the token scope builder inside its panel when scopes get long ([#10517](https://github.com/windmill-labs/windmill/issues/10517)) ([ae2f584](https://github.com/windmill-labs/windmill/commit/ae2f584de88f0b0eb34ec270c9dfb109cab54938))
+* let admins edit the dev workspace lock ruleset ([#10512](https://github.com/windmill-labs/windmill/issues/10512)) ([ecae932](https://github.com/windmill-labs/windmill/commit/ecae9320d0f752d01af12da1834e15d741b443d0))
+* load the workspace AI config even when the docked chat is disabled ([#10493](https://github.com/windmill-labs/windmill/issues/10493)) ([99e7661](https://github.com/windmill-labs/windmill/commit/99e7661a1b1b24a148a07f7dd37d44e3ae963ba2))
+* locate coursier artifacts by coordinate so private maven registries work ([#10501](https://github.com/windmill-labs/windmill/issues/10501)) ([56d53d3](https://github.com/windmill-labs/windmill/commit/56d53d3f328cc5a7002dbc1d31e2a90821590663))
+* log the db auth mode used and hint at the ms_entraid sentinel ([#10508](https://github.com/windmill-labs/windmill/issues/10508)) ([9f3d155](https://github.com/windmill-labs/windmill/commit/9f3d15583a863c50d60925e97fe98f35f9e4c9e2))
+* match openrouter model ids by parsed vendor, not raw prefix ([#10497](https://github.com/windmill-labs/windmill/issues/10497)) ([546b8d0](https://github.com/windmill-labs/windmill/commit/546b8d076961398a40e7e53fb1e3e561a39a135b))
+* open an AI session from the editor bar's AI button, on the step ([#10504](https://github.com/windmill-labs/windmill/issues/10504)) ([ea4f3ec](https://github.com/windmill-labs/windmill/commit/ea4f3ecc6e54f24a0899470c2efb9850d3ed2d48))
+* show which MCP endpoint tools a token scope will actually expose ([#10514](https://github.com/windmill-labs/windmill/issues/10514)) ([71e68e8](https://github.com/windmill-labs/windmill/commit/71e68e87dcc34939f9262d3fdf2e0e5495332491))
+* stop app updates from silently converting an app between raw and low-code ([#10495](https://github.com/windmill-labs/windmill/issues/10495)) ([d9dd036](https://github.com/windmill-labs/windmill/commit/d9dd036edc88124f2424f13e0ed3697cf03bdf99))
+
+## [1.778.0](https://github.com/windmill-labs/windmill/compare/v1.777.1...v1.778.0) (2026-08-03)
+
+
+### Features
+
+* **apps:** use the windmill-client SDK from raw app frontend code ([#10377](https://github.com/windmill-labs/windmill/issues/10377)) ([7e1c1fa](https://github.com/windmill-labs/windmill/commit/7e1c1fa3a455b8187886692567e0045658ed7013))
+* azure workload identity auth for mssql and postgres resources ([#10470](https://github.com/windmill-labs/windmill/issues/10470)) ([beef6e2](https://github.com/windmill-labs/windmill/commit/beef6e295cb4e01af00c279f406012a82d91c8c4))
+* **fork:** merge a fork deletion on evidence, not on the counters ([#10484](https://github.com/windmill-labs/windmill/issues/10484)) ([f365929](https://github.com/windmill-labs/windmill/commit/f365929eaaebf546c58ee1641a010d5f1f8b555f))
+* label ai session preview tabs by item summary ([#10475](https://github.com/windmill-labs/windmill/issues/10475)) ([b93ee66](https://github.com/windmill-labs/windmill/commit/b93ee66bba72250c17d4c7f567436b348504c2b1))
+* lazily expand s3 explorer folders one level at a time ([#10420](https://github.com/windmill-labs/windmill/issues/10420)) ([386e115](https://github.com/windmill-labs/windmill/commit/386e115daaf850ac45d10f2240bacb5758d238e6))
+
+
+### Bug Fixes
+
+* anchor overlays to their preview tab instead of the viewport ([#10477](https://github.com/windmill-labs/windmill/issues/10477)) ([b718ea8](https://github.com/windmill-labs/windmill/commit/b718ea84956995d96f4056cdbd03bd8634883921))
+* base a new fork on the dev workspace when forking from one ([#10489](https://github.com/windmill-labs/windmill/issues/10489)) ([db46d34](https://github.com/windmill-labs/windmill/commit/db46d347272c940057dca1aa7fb4b4456eea8a9e))
+* **cli:** stop a deleted raw-app .lock from dropping the whole app push ([#10473](https://github.com/windmill-labs/windmill/issues/10473)) ([4254324](https://github.com/windmill-labs/windmill/commit/42543240e87ad232f6dffde61d47cfaced766b20))
+* confirm step delete consequences in a single dialog ([#10485](https://github.com/windmill-labs/windmill/issues/10485)) ([5aeee56](https://github.com/windmill-labs/windmill/commit/5aeee564beaab5b398b0eff1ae9db8e9ef1d9bfe))
+* normalize the pipeline folder so AI node paths aren't double-prefixed ([#10479](https://github.com/windmill-labs/windmill/issues/10479)) ([4db432f](https://github.com/windmill-labs/windmill/commit/4db432f0048c9295e93ff7da0753eef7145d3623))
+* refresh the dev-workspace pairing after attach and detach ([#10491](https://github.com/windmill-labs/windmill/issues/10491)) ([fadbe07](https://github.com/windmill-labs/windmill/commit/fadbe079e4e747147861c6df495270cf2f390700))
+* report why a native trigger service refused instead of a 500 ([#10463](https://github.com/windmill-labs/windmill/issues/10463)) ([4f03aa9](https://github.com/windmill-labs/windmill/commit/4f03aa91a714eb0132cf01a6cd4f37a1a11cfe02))
+* show the fork banner to a superadmin who is not a workspace member ([#10465](https://github.com/windmill-labs/windmill/issues/10465)) ([3cef678](https://github.com/windmill-labs/windmill/commit/3cef678b5f247ec431e89cfc2a6a97e79dce2b51))
+* stop reading a parent-only fork item as deleted in the fork ([#10467](https://github.com/windmill-labs/windmill/issues/10467)) ([689f5d7](https://github.com/windmill-labs/windmill/commit/689f5d7c751f5fd8d4ceb7a79004a22afb8263b8))
+* stop the chat deleting drafts as deployed workspace items ([#10476](https://github.com/windmill-labs/windmill/issues/10476)) ([ed9fb47](https://github.com/windmill-labs/windmill/commit/ed9fb47f5a9e05aa8380d288d892f8068eaf1d0c))
+
+
+### Performance Improvements
+
+* cut ai chat request size and cache the prefix on openrouter ([#10481](https://github.com/windmill-labs/windmill/issues/10481)) ([e15bea4](https://github.com/windmill-labs/windmill/commit/e15bea419a1a65f6d9b577e918d5e617e0345da2))
+* serve the rare schedule options on demand instead of inlining them ([#10487](https://github.com/windmill-labs/windmill/issues/10487)) ([a3c59c7](https://github.com/windmill-labs/windmill/commit/a3c59c7320be961a88b581ab06ded24b80e1d544))
+
+## [1.777.1](https://github.com/windmill-labs/windmill/compare/v1.777.0...v1.777.1) (2026-08-03)
+
+
+### Bug Fixes
+
+* return result.json and stdout results from sandboxed containers ([#10460](https://github.com/windmill-labs/windmill/issues/10460)) ([d509551](https://github.com/windmill-labs/windmill/commit/d5095515ed007d4e7fbfc1a15582c550d3293ece))
+
+## [1.777.0](https://github.com/windmill-labs/windmill/compare/v1.776.0...v1.777.0) (2026-08-03)
+
+
+### Features
+
+* add session recording to wmill app dev ([#10457](https://github.com/windmill-labs/windmill/issues/10457)) ([2105540](https://github.com/windmill-labs/windmill/commit/2105540cca7cc7bdced9e06ef3ad1ed54732feef))
+* give dbt its own editor with an explicitly refreshed model graph ([#10448](https://github.com/windmill-labs/windmill/issues/10448)) ([baefa13](https://github.com/windmill-labs/windmill/commit/baefa1345b7b7a4110257a53a417d4fc229d0149))
+* show an on-behalf-of badge on the script and flow detail pages ([#10452](https://github.com/windmill-labs/windmill/issues/10452)) ([9bafb7e](https://github.com/windmill-labs/windmill/commit/9bafb7ebd2b8571f1adf5a86b681af8d07660a50))
+
+
+### Bug Fixes
+
+* keep uri and method on request logs under RUST_LOG=error ([#10462](https://github.com/windmill-labs/windmill/issues/10462)) ([0466ea2](https://github.com/windmill-labs/windmill/commit/0466ea201952bd382d893bd973eedaa7183b597e))
+* report a missing worker tag instead of spinning in data table UIs ([#10456](https://github.com/windmill-labs/windmill/issues/10456)) ([eca24bd](https://github.com/windmill-labs/windmill/commit/eca24bdfb5c7a49c428d541ca06407d1635cc3b6))
+
+## [1.776.0](https://github.com/windmill-labs/windmill/compare/v1.775.2...v1.776.0) (2026-08-01)
+
+
+### Features
+
+* **frontend:** add missing resource type icons and show them in the resource picker ([#10407](https://github.com/windmill-labs/windmill/issues/10407)) ([705c90d](https://github.com/windmill-labs/windmill/commit/705c90debda87451fcdc32f15f086080ab7dc5f9))
+* **git-sync:** dedicated base url for GitHub webhook delivery ([#10411](https://github.com/windmill-labs/windmill/issues/10411)) ([318c9f0](https://github.com/windmill-labs/windmill/commit/318c9f00739bfd43bd5d6afed4ae12f3f1a565d1))
+* let the merge UI target an arbitrary workspace ([#10417](https://github.com/windmill-labs/windmill/issues/10417)) ([61f2d8d](https://github.com/windmill-labs/windmill/commit/61f2d8dc6ab980c1aba959b853d505f09299ed9c))
+* make job subprocess oom_score_adj configurable ([#10443](https://github.com/windmill-labs/windmill/issues/10443)) ([2508417](https://github.com/windmill-labs/windmill/commit/25084170d7449dfa06dd758bc3783580916cfa95))
+* make the fork lineage the only deploy relationship ([#10410](https://github.com/windmill-labs/windmill/issues/10410)) ([81b23a2](https://github.com/windmill-labs/windmill/commit/81b23a2ba0ee1001241e4fe6066c07526ab640f6))
+* run dbt projects as a first-class Windmill runtime ([#10326](https://github.com/windmill-labs/windmill/issues/10326)) ([032300e](https://github.com/windmill-labs/windmill/commit/032300e28eba9f8e790f16e894bb00fff22eb296))
+* stamp webhook trigger_kind on token-driven job runs ([#10431](https://github.com/windmill-labs/windmill/issues/10431)) ([dda5976](https://github.com/windmill-labs/windmill/commit/dda59767c2b997e675ffe799bc6b1dcc79c2a52d))
+* sync data table migrations to git, gated by a new object type ([#10436](https://github.com/windmill-labs/windmill/issues/10436)) ([bfc3f52](https://github.com/windmill-labs/windmill/commit/bfc3f5242a0d9a833d12859f96ea8f1aa67d362b))
+
+
+### Bug Fixes
+
+* add apps:run to the token scope picker and confine path-scoped app tokens ([#10428](https://github.com/windmill-labs/windmill/issues/10428)) ([c69f080](https://github.com/windmill-labs/windmill/commit/c69f08073a657ee6d91bfdbd19e8639a392fd77a))
+* **ai:** pass only the output of a nested agent tool to the parent ([#10416](https://github.com/windmill-labs/windmill/issues/10416)) ([7d097d2](https://github.com/windmill-labs/windmill/commit/7d097d25c3bba89d708c21a2fc3a1a8e0099a5c5))
+* **ai:** route Azure OpenAI agent steps through the Responses API ([#10404](https://github.com/windmill-labs/windmill/issues/10404)) ([94bcc00](https://github.com/windmill-labs/windmill/commit/94bcc00554423eb9e4056dd33ceff1b07263e9ec))
+* app progress bar stuck on running, and misreporting queued/canceled jobs as errors ([#10409](https://github.com/windmill-labs/windmill/issues/10409)) ([5579913](https://github.com/windmill-labs/windmill/commit/557991360a5c920909cac45e335c11b35bd2d880))
+* apply default workspace dependencies to raw app runnables ([#10427](https://github.com/windmill-labs/windmill/issues/10427)) ([38b6099](https://github.com/windmill-labs/windmill/commit/38b6099b4c5039232cf306a01ee814b3ec5dc04c))
+* carry the token label into job-run audit rows ([#10433](https://github.com/windmill-labs/windmill/issues/10433)) ([02c4a9e](https://github.com/windmill-labs/windmill/commit/02c4a9e515b3ef9c0e759211a6b7cbd874a778b0))
+* **cli:** lint against the checkout's schema, not the published validator ([#10418](https://github.com/windmill-labs/windmill/issues/10418)) ([a372ae0](https://github.com/windmill-labs/windmill/commit/a372ae0c04d0849932d83a76d38b5a9e507077af))
+* credit the token owner instead of the token label in the audit trail ([#10423](https://github.com/windmill-labs/windmill/issues/10423)) ([3716a71](https://github.com/windmill-labs/windmill/commit/3716a71fd76f66b58bc29977b4f6a10ed97cea16))
+* **flows:** mint fresh orchestration token so long steps don't expire the result-fetch JWT ([#10415](https://github.com/windmill-labs/windmill/issues/10415)) ([2e249ff](https://github.com/windmill-labs/windmill/commit/2e249ff8922c152f410cd40b88514f5dad875b85))
+* **forks:** record fork changes that never reached the diff tally ([#10403](https://github.com/windmill-labs/windmill/issues/10403)) ([f9a547b](https://github.com/windmill-labs/windmill/commit/f9a547b8b8e4982346607acae4e8e7646529c374))
+* harden flow-orchestration token refresh (mint from job_perms) ([#10419](https://github.com/windmill-labs/windmill/issues/10419)) ([e0d6dc1](https://github.com/windmill-labs/windmill/commit/e0d6dc1a1997514bfcaa8615de61daff4a2f81ca))
+* honor on-behalf-of when a workflow step dispatches a script or flow ([#10437](https://github.com/windmill-labs/windmill/issues/10437)) ([2b525d2](https://github.com/windmill-labs/windmill/commit/2b525d28dbcda4a4b0f626ad40b0c4d79cfbcd53))
+* keep native triggers attached when a runnable is renamed ([#10432](https://github.com/windmill-labs/windmill/issues/10432)) ([bd71566](https://github.com/windmill-labs/windmill/commit/bd7156682d4d4b78e01fa316580e632152cc5b62))
+* make /usr/bin/coursier self-contained so java jobs work air-gapped ([#10414](https://github.com/windmill-labs/windmill/issues/10414)) ([7e64960](https://github.com/windmill-labs/windmill/commit/7e649604db2047bf8587b46628aa74051e1b9409))
+* make on_behalf_of control permissions for scripts and flows ([#10438](https://github.com/windmill-labs/windmill/issues/10438)) ([fb82748](https://github.com/windmill-labs/windmill/commit/fb82748296cd0f81ad8d21c30c12e172a6477173))
+* pre-warm coursier bootstrap cache at the worker's cache path ([#10413](https://github.com/windmill-labs/windmill/issues/10413)) ([ed9dfc5](https://github.com/windmill-labs/windmill/commit/ed9dfc5de684197e14f3c4a3a6873c0e1a55229a))
+* run the init script before dedicated workers install dependencies ([#10412](https://github.com/windmill-labs/windmill/issues/10412)) ([43a684d](https://github.com/windmill-labs/windmill/commit/43a684d7432837fcf00a97712f28d7c474a58402))
+* sidebar workspace toggle navigates home when already in workspace mode ([#10405](https://github.com/windmill-labs/windmill/issues/10405)) ([9cd6a70](https://github.com/windmill-labs/windmill/commit/9cd6a70f6ace956f679c1ce1fb46543cda569183))
+
 ## [1.775.2](https://github.com/windmill-labs/windmill/compare/v1.775.1...v1.775.2) (2026-07-29)


@@ -0,0 +1,38 @@
+# Windmill
+
+Open-source platform for internal tools, workflows, API integrations, background jobs and UIs. This file pins the vocabulary that is specific to Windmill's domain, so that code, docs and reviews name the same thing the same way.
+
+## Language
+
+### Flows
+
+**Step**:
+One node of a flow — the unit a user selects in the graph and configures in the right-hand panel. Typed as `FlowModule` in code.
+_Avoid_: module (ambiguous with the architectural sense), node, action
+
+**Step setting**:
+A per-step runtime option stored on the step itself: retries, error handling, timeout, concurrency limit, priority, cache, debounce, early stop, skip, suspend, sleep, lifetime. Distinct from the step's inputs and its code. The panel that edits them is the **run settings** tab; a single setting is still a step setting.
+_Avoid_: advanced setting, step config, flow option
+
+**Configured**:
+Said of a step setting whose config object is present on the step. Deliberately not the same as "would change the runtime's behaviour" — a setting can be configured and still be a no-op (`sleep` of `0`). Every surface that answers "is this setting on?" answers it this way.
+_Avoid_: enabled, active, effective
+
+**Trigger step**:
+The first step of a polling flow. It runs on a schedule and returns the items found since its last run; an empty return means there is nothing to process and the flow stops early, marked skipped rather than failed.
+_Avoid_: poll script, trigger node, schedule step
+
+**Default predicate**:
+The `stop_after_if` expression seeded onto a trigger step at creation, encoding what "nothing new" looks like. One value, owned in one place, shared by every path that creates a trigger step.
+
+**Connect**:
+Arming an input so that the next property picked fills it. A property can be picked from the prop picker or, when the panel is docked beside the graph, by clicking a step node's output. At most one input is armed per panel, so a pick always has exactly one destination.
+_Avoid_: link, bind, plug (the icon is a plug; the action is connecting)
+
+**Step input**:
+One argument of a step, edited in the step's input form. Its prop picker is a pane beside the form, always visible, so previous results can be browsed without connecting.
+_Avoid_: argument field, param
+
+**Expression input**:
+Any other place a property can be picked into: the loop iterator, skip and early-stop predicates, the retry condition, a branch predicate, timeout. Its prop picker opens in a popover from the connect button rather than taking a pane.
+_Avoid_: JS field, code input
@@ -0,0 +1,22 @@
+import { describe, expect, it } from "bun:test";
+import { createEvalArtifactHelpers } from "./evalArtifactStore";
+
+// A hand-written stand-in for SessionArtifactsStore (bun has no IndexedDB), so nothing
+// makes it follow that class. A method missing from it surfaces as a tool throwing
+// part-way through an eval run, which reads as a model failure rather than a harness one.
+describe("eval artifact store", () => {
+  it("exposes every method the artifact tools call", () => {
+    const { helpers } = createEvalArtifactHelpers();
+    for (const method of [
+      "create",
+      "get",
+      "update",
+      "remove",
+      "listForSession",
+      "listVersions",
+      "getVersion",
+    ]) {
+      expect(typeof (helpers.artifacts as any)[method]).toBe("function");
+    }
+  });
+});
@@ -0,0 +1,93 @@
+// SessionArtifactsStore can't run here (bun has no IndexedDB, nor the compiled $state runes),
+// so mirror only the shape the artifact tools call, not its scoping or race handling.
+export const EVAL_SESSION_ID = "eval-session";
+export function createEvalArtifactHelpers() {
+  const items = new Map<string, Record<string, any>>();
+  // Snapshots per artifact id, oldest first — the version tools read history from here.
+  const history = new Map<string, Array<Record<string, any>>>();
+  let seq = 0;
+  const snapshotOf = (
+    artifact: Record<string, any>,
+    version: number,
+    note?: string,
+  ) => ({
+    key: `${artifact.id}:${version}`,
+    artifactId: artifact.id,
+    version,
+    name: artifact.name,
+    content: artifact.content,
+    savedAt: artifact.updatedAt,
+    note,
+  });
+  const store = {
+    create: async (sessionId: string, input: Record<string, any>) => {
+      const now = seq++;
+      const artifact = {
+        id: `eval-artifact-${now}`,
+        sessionId,
+        chatId: input.chatId,
+        kind: input.kind ?? "md",
+        name: input.name,
+        content: input.content,
+        createdAt: now,
+        updatedAt: now,
+        version: 1,
+      };
+      items.set(artifact.id, artifact);
+      history.set(artifact.id, [snapshotOf(artifact, 1)]);
+      return artifact;
+    },
+    get: async (id: string) => items.get(id),
+    update: async (
+      id: string,
+      input: Record<string, any>,
+      opts?: { sessionId?: string },
+    ) => {
+      const existing = items.get(id);
+      if (!existing) return undefined;
+      if (
+        opts?.sessionId !== undefined &&
+        existing.sessionId !== opts.sessionId
+      )
+        return undefined;
+      // Only a content change earns a version, as in SessionArtifactsStore.
+      const contentChanged =
+        input.content !== undefined && input.content !== existing.content;
+      const version = (existing.version ?? 1) + (contentChanged ? 1 : 0);
+      const updated = {
+        ...existing,
+        name: input.name ?? existing.name,
+        content: input.content ?? existing.content,
+        updatedAt: seq++,
+        version,
+      };
+      items.set(id, updated);
+      if (contentChanged) {
+        history.set(id, [
+          ...(history.get(id) ?? []),
+          snapshotOf(updated, version, input.note),
+        ]);
+      }
+      return updated;
+    },
+    remove: async (id: string) => {
+      items.delete(id);
+      history.delete(id);
+    },
+    listForSession: async (sessionId: string) =>
+      [...items.values()].filter((a) => a.sessionId === sessionId),
+    listVersions: async (id: string) =>
+      [...(history.get(id) ?? [])].sort((a, b) => b.version - a.version),
+    getVersion: async (id: string, version: number) =>
+      (history.get(id) ?? []).find((v) => v.version === version),
+  };
+  return {
+    helpers: {
+      artifacts: store,
+      sessionId: EVAL_SESSION_ID,
+      getChatId: () => "eval-chat",
+      openArtifact: () => {},
+    },
+    snapshot: () => [...items.values()],
+  };
+}
@@ -14,6 +14,7 @@ import {
 } from "../../../../../frontend/src/lib/components/copilot/chat/global/userDraftAdapter";
 import type { Tool as ProductionTool } from "../../../../../frontend/src/lib/components/copilot/chat/shared";
 import { UserDraft } from "../../../../../frontend/src/lib/userDraft.svelte";
+import { createEvalArtifactHelpers } from "./evalArtifactStore";
 import type { ModeRunContext } from "../../../../core/types";
 import type { GlobalDraftState } from "../../../../core/validators";
 import type { WindmillBackendSettings } from "../../../../core/windmillBackendSettings";
@@ -43,67 +44,6 @@ const LIVE_EDITOR_ITEM_KINDS = {
  app: "raw_app",
 } as const;

-// SessionArtifactsStore can't run here (bun has no IndexedDB, nor the compiled $state runes),
-// so mirror only its tool-facing shape; its own logic (scoping, race guard) is unit-tested.
-const EVAL_SESSION_ID = "eval-session";
-function createEvalArtifactHelpers() {
-  const items = new Map<string, Record<string, unknown>>();
-  let seq = 0;
-  const store = {
-    create: async (sessionId: string, input: Record<string, any>) => {
-      const now = seq++;
-      const artifact = {
-        id: `eval-artifact-${now}`,
-        sessionId,
-        chatId: input.chatId,
-        kind: input.kind ?? "md",
-        name: input.name,
-        content: input.content,
-        createdAt: now,
-        updatedAt: now,
-      };
-      items.set(artifact.id, artifact);
-      return artifact;
-    },
-    get: async (id: string) => items.get(id),
-    update: async (
-      id: string,
-      input: Record<string, any>,
-      opts?: { sessionId?: string },
-    ) => {
-      const existing = items.get(id);
-      if (!existing) return undefined;
-      if (
-        opts?.sessionId !== undefined &&
-        existing.sessionId !== opts.sessionId
-      )
-        return undefined;
-      const updated = {
-        ...existing,
-        name: input.name ?? existing.name,
-        content: input.content ?? existing.content,
-        updatedAt: seq++,
-      };
-      items.set(id, updated);
-      return updated;
-    },
-    remove: async (id: string) => {
-      items.delete(id);
-    },
-    listForSession: async (sessionId: string) =>
-      [...items.values()].filter((a) => a.sessionId === sessionId),
-  };
-  return {
-    helpers: {
-      artifacts: store,
-      sessionId: EVAL_SESSION_ID,
-      getChatId: () => "eval-chat",
-      openArtifact: () => {},
-    },
-    snapshot: () => [...items.values()],
-  };
-}
-
 export interface GlobalLiveEditorDraftFixture {
  type: keyof typeof LIVE_EDITOR_ITEM_KINDS;
  storagePath?: string;
@@ -561,6 +561,35 @@ export function runBenchmarkScriptPreview(input: {
 	})
 }

+export function runBenchmarkScriptByPath(input: {
+	workspace: string
+	path: string
+	args?: Record<string, unknown>
+}): string {
+	const script = getBenchmarkScriptByPath(input.workspace, input.path)
+	return createBenchmarkCompletedJob({
+		workspace: input.workspace,
+		jobKind: 'script',
+		success: script !== null,
+		scriptPath: input.path,
+		args: input.args,
+		result:
+			script !== null
+				? {
+						path: input.path,
+						args: input.args ?? {},
+						mocked: true
+					}
+				: {
+						error: `Script "${input.path}" not found in benchmark workspace`
+					},
+		logs:
+			script !== null
+				? 'Mock benchmark script run completed successfully.'
+				: `Script "${input.path}" not found in benchmark workspace.`
+	})
+}
+
 export function runBenchmarkFlowByPath(input: {
 	workspace: string
 	path: string
@@ -747,6 +776,27 @@ const BENCHMARK_MCP_TOOLS: EndpointTool[] = [
 			required: ['workspace']
 		}
 	},
+	{
+		name: 'getJob',
+		description: 'get job',
+		instructions: '',
+		path: '/w/{workspace}/jobs_u/get/{id}',
+		method: 'GET',
+		path_params_schema: {
+			type: 'object',
+			properties: { workspace: { type: 'string' }, id: { type: 'string', format: 'uuid' } },
+			required: ['workspace', 'id']
+		},
+		query_params_schema: {
+			type: 'object',
+			properties: {
+				no_logs: { type: 'boolean' },
+				no_code: { type: 'boolean' },
+				approval_token: { type: 'string' }
+			},
+			required: []
+		}
+	},
 	{
 		name: 'runScriptByPath',
 		description: 'Run the deployed version of a script by path',
@@ -968,6 +1018,26 @@ const BENCHMARK_WORKERS = [
 	}
 ]

+const BENCHMARK_JOB_GET_PATH = /^\/api\/w\/([^/]+)\/jobs_u\/get\/([^/]+)$/
+const BENCHMARK_RUN_BY_PATH = /^\/api\/w\/([^/]+)\/jobs\/run\/(p|f)\/([^/]+)$/
+
+/** `executeEndpoint` sends a JSON string; anything else means no args were supplied. */
+function parseBenchmarkRequestBody(
+	body: BodyInit | null | undefined
+): Record<string, unknown> | undefined {
+	if (typeof body !== 'string') {
+		return undefined
+	}
+	try {
+		const parsed = JSON.parse(body)
+		return typeof parsed === 'object' && parsed !== null
+			? (parsed as Record<string, unknown>)
+			: undefined
+	} catch {
+		return undefined
+	}
+}
+
 /** True when `handleBenchmarkApiFetch` has an answer for this `/api/...` url.
 * Any other relative fetch must keep its normal (non-benchmark) behavior —
 * intercepting it with a synthetic 404 sends the model into retry loops. */
@@ -975,6 +1045,8 @@ export function hasBenchmarkApiHandler(url: string): boolean {
 	const path = url.split('?')[0]
 	return (
 		path === '/api/workers/list' ||
+		BENCHMARK_JOB_GET_PATH.test(path) ||
+		BENCHMARK_RUN_BY_PATH.test(path) ||
 		/^\/api\/w\/[^/]+\/jobs\/queue\/list$/.test(path) ||
 		path === '/api/embeddings/query_hub_scripts' ||
 		path.startsWith('/api/scripts/hub/get_full/')
@@ -983,7 +1055,7 @@ export function hasBenchmarkApiHandler(url: string): boolean {

 /** Answer a relative `/api/...` fetch — from the API catalog executor, or from the
 * chat's hub tools. */
-export function handleBenchmarkApiFetch(url: string): Response {
+export function handleBenchmarkApiFetch(url: string, init?: RequestInit): Response {
 	const path = url.split('?')[0]
 	if (path === '/api/workers/list') {
 		return Response.json(BENCHMARK_WORKERS)
@@ -991,6 +1063,36 @@ export function handleBenchmarkApiFetch(url: string): Response {
 	if (/^\/api\/w\/[^/]+\/jobs\/queue\/list$/.test(path)) {
 		return Response.json([])
 	}
+	const jobGet = BENCHMARK_JOB_GET_PATH.exec(path)
+	if (jobGet) {
+		const id = decodeURIComponent(jobGet[2])
+		const job = getBenchmarkCompletedJob(decodeURIComponent(jobGet[1]), id)
+		if (!job) {
+			return Response.json({ error: `Job not found for "${id}"` }, { status: 404 })
+		}
+		// The real endpoint lets a caller drop the bulky fields. Ignoring that here would
+		// size the model's context off a payload it explicitly asked to shrink.
+		const query = new URLSearchParams(url.split('?')[1] ?? '')
+		if (query.get('no_logs') === 'true') {
+			delete job.logs
+		}
+		if (query.get('no_code') === 'true') {
+			delete job.raw_code
+		}
+		return Response.json(job)
+	}
+	const runByPath = BENCHMARK_RUN_BY_PATH.exec(path)
+	if (runByPath) {
+		const workspace = decodeURIComponent(runByPath[1])
+		const runnablePath = decodeURIComponent(runByPath[3])
+		const args = parseBenchmarkRequestBody(init?.body)
+		// The real endpoint answers with the bare job id as text, not JSON.
+		return new Response(
+			runByPath[2] === 'f'
+				? runBenchmarkFlowByPath({ workspace, path: runnablePath, args })
+				: runBenchmarkScriptByPath({ workspace, path: runnablePath, args })
+		)
+	}
 	if (path === '/api/embeddings/query_hub_scripts') {
 		const text = new URLSearchParams(url.split('?')[1] ?? '').get('text') ?? ''
 		return Response.json(searchBenchmarkHubScripts(text))
@@ -0,0 +1,83 @@
+import { afterEach, beforeEach, describe, expect, it } from 'bun:test'
+import {
+	createBenchmarkCompletedJob,
+	getBenchmarkCompletedJob,
+	handleBenchmarkApiFetch,
+	hasBenchmarkApiHandler,
+	listBenchmarkMcpTools,
+	resetBenchmarkMockBackend,
+	registerBenchmarkWorkspaceRunnables
+} from './mockBackend'
+
+const WORKSPACE = 'benchmark-api-ws'
+
+// A catalog entry with no fetch handler is a dead end: the catalog executor builds a
+// relative `/api/...` url, the stub declines it, and node's fetch throws on the relative
+// url instead of returning a result the model can act on. Mutating entries are reachable
+// too — the eval runners define no `requestConfirmation`, so `call_api_endpoint` executes
+// unconfirmed.
+describe('benchmark API catalog', () => {
+	beforeEach(() => resetBenchmarkMockBackend())
+	afterEach(() => resetBenchmarkMockBackend())
+
+	it('answers every endpoint it advertises', () => {
+		const unanswered = listBenchmarkMcpTools()
+			.map((tool) =>
+				`/api${tool.path.replace('{workspace}', WORKSPACE)}`.replace(/\{[^}]+\}/g, 'x')
+			)
+			.filter((url) => !hasBenchmarkApiHandler(url))
+
+		// The draft-covered entries are refused by name before any fetch, so they are
+		// advertised without a handler on purpose.
+		expect(unanswered).toEqual([
+			`/api/w/${WORKSPACE}/scripts/get/p/x`,
+			`/api/w/${WORKSPACE}/flows/create`,
+			`/api/w/${WORKSPACE}/schedules/delete/x`,
+			`/api/w/${WORKSPACE}/variables/get/x`
+		])
+	})
+
+	it('runs a deployed script by path, the way call_api_endpoint reaches it', async () => {
+		registerBenchmarkWorkspaceRunnables(WORKSPACE, {
+			scripts: [
+				{
+					path: 'f/evals/greet',
+					summary: 'Greet',
+					language: 'bun',
+					content: 'export async function main() {}'
+				}
+			]
+		})
+
+		const res = handleBenchmarkApiFetch(
+			`/api/w/${WORKSPACE}/jobs/run/p/${encodeURIComponent('f/evals/greet')}`,
+			{ method: 'POST', body: JSON.stringify({ name: 'ada' }) }
+		)
+
+		expect(res.status).toBe(200)
+		const job = getBenchmarkCompletedJob(WORKSPACE, (await res.text()).trim())
+		expect(job).toMatchObject({ success: true, args: { name: 'ada' } })
+	})
+
+	it('serves a recorded job so a model can check the run it just started', async () => {
+		const id = createBenchmarkCompletedJob({
+			workspace: WORKSPACE,
+			jobKind: 'preview',
+			result: 'Hello, World!'
+		})
+
+		const res = handleBenchmarkApiFetch(`/api/w/${WORKSPACE}/jobs_u/get/${id}`)
+
+		expect(res.status).toBe(200)
+		expect(await res.json()).toMatchObject({
+			id,
+			success: true,
+			result: 'Hello, World!'
+		})
+	})
+
+	it('404s an unknown job id instead of letting the fetch fall through', () => {
+		expect(hasBenchmarkApiHandler(`/api/w/${WORKSPACE}/jobs_u/get/missing`)).toBe(true)
+		expect(handleBenchmarkApiFetch(`/api/w/${WORKSPACE}/jobs_u/get/missing`).status).toBe(404)
+	})
+})
@@ -13,7 +13,7 @@ const ORIGINAL_FETCH = globalThis.fetch
 globalThis.fetch = (async (input: unknown, init?: RequestInit) => {
 	const url = typeof input === 'string' ? input : ((input as Request | URL | null)?.url ?? '')
 	if (typeof url === 'string' && hasBenchmarkApiHandler(url)) {
-		return handleBenchmarkApiFetch(url)
+		return handleBenchmarkApiFetch(url, init)
 	}
 	return ORIGINAL_FETCH(input as Parameters<typeof fetch>[0], init)
 }) as typeof fetch
@@ -567,6 +567,40 @@
    - passes dry_run as true
    - leaves only the schedule draft for review

+- id: global-test29-schedule-with-retry-and-error-handler
+  prompt: |-
+    The workspace already has a report digest helper.
+    Schedule it every morning at 6am UTC with `dry_run` on, and have it retry twice
+    if it fails. Run it on our `nightly` worker group.
+    Draft only, I'll review before deploying.
+  initial: ai_evals/fixtures/frontend/global/initial/report_digest_script.json
+  runtime:
+    maxTurns: 8
+  validate:
+    draftCountExactly: 1
+    requiredDrafts:
+      - type: schedule
+        pathIncludes:
+          - digest
+        valueIncludes:
+          - f/evals/global/send_report_digest
+          - attempts
+          - nightly
+  toolExpect:
+    requiredToolsUsed:
+      - write_schedule
+      - get_schedule_schema
+    forbiddenToolsUsed:
+      - write_script
+      - write_flow
+      - deploy_workspace_item
+  judgeChecklist:
+    - finds the existing report digest helper rather than creating a new script or flow
+    - creates one schedule draft for that helper running daily around 06:00 UTC
+    - configures a retry policy with two attempts
+    - routes the schedule to the nightly worker tag
+    - leaves the schedule as a draft without deploying
+
 - id: global-test18-human-slack-resource-with-secret
  prompt: |-
    I'm preparing Slack notifications for eval failures.
@@ -1106,6 +1140,38 @@
    - closes the runs preview tab in the side panel
    - does not write, deploy, or delete anything

+# --- Artifact version history ---
+# Every content change to an artifact is snapshotted, and update_artifact requires a
+# change_note that the user reads in the version picker. A blank note makes the history
+# unreadable, so pin that the model fills it on every edit.
+
+- id: global-artifact-note-on-each-edit
+  prompt: |-
+    Write up a short rollout plan for me as a doc I can come back to, covering a staged
+    rollout in three phases. Then add a rollback section to it, and after that tighten
+    the wording of phase 2.
+  runtime:
+    maxTurns: 12
+    sessionChat: true
+  validate:
+    draftCountExactly: 0
+  toolExpect:
+    requiredToolsUsed:
+      - create_artifact
+      - update_artifact
+    forbiddenToolsUsed:
+      - deploy_workspace_item
+      - delete_workspace_item
+    toolCallArgs:
+      # The note is what the version picker shows; a blank one makes history unreadable.
+      - tool: update_artifact
+        field: change_note
+        nonEmpty: true
+  skipJudge: true
+  judgeChecklist:
+    - creates one artifact and revises it rather than creating a second artifact
+    - each revision carries a short description of what changed
+
 # --- Documentation search (search_docs) ---
 # Pure product-knowledge questions: the assistant should consult the docs via
 # search_docs and answer conversationally, not draft or mutate anything. No
@@ -1773,6 +1839,27 @@
  judgeChecklist:
    - deletes the deployed script via delete_workspace_item rather than a raw API endpoint

+- id: global-undo-created-draft
+  prompt: |-
+    Create a draft Postgres resource at `u/admin/scratch_db` for host db.example.com port 5432, database `orders`, user `app`, and tell me what fields it ended up with.
+    Once you've shown me that, delete it from the workspace again — I only wanted to see the shape of it.
+  initial: ai_evals/fixtures/frontend/global/initial/user_admin_empty.json
+  runtime:
+    maxTurns: 10
+  validate:
+    draftCountExactly: 0
+  toolExpect:
+    requiredToolsUsed:
+      - write_resource
+      - discard_local_draft
+    forbiddenToolsUsed:
+      - delete_workspace_item
+      - deploy_workspace_item
+  # Undoing a draft leaves no draft behind; validate via tool use.
+  skipJudge: true
+  judgeChecklist:
+    - undoes its own never-deployed resource with discard_local_draft rather than delete_workspace_item
+
 - id: global-draft-diff-report
  prompt: |-
    Update the existing workspace script at `f/evals/global/format_greeting` so the returned message ends with an exclamation mark, keeping everything else the same.
@@ -166,6 +166,12 @@ export interface ToolCallArgumentRule {
   * tool — e.g. SQL where a mutation is mixed with verification SELECTs.
   */
  stringIncludesAnyOf?: string[];
+  /**
+   * Universal over calls: every recorded call to `tool` must carry `field` as a
+   * non-blank string. Use for a required argument whose value is free text, where
+   * the point is that the model filled it in at all rather than what it said.
+   */
+  nonEmpty?: boolean;
 }

 export interface ToolValidationSpec {
@@ -174,6 +174,52 @@ describe("validateToolExpectations", () => {
    expect(checks.every((check) => check.passed)).toBe(true);
  });

+  it("fails nonEmpty when any call left the field blank", () => {
+    const checks = validateToolExpectations({
+      run: {
+        success: true,
+        actual: {},
+        assistantMessageCount: 1,
+        toolCallCount: 2,
+        toolsUsed: ["update_artifact"],
+        toolCallDetails: [
+          { name: "update_artifact", arguments: { change_note: "Added a rollback section" } },
+          // A whitespace-only note is as unreadable in the picker as a missing one.
+          { name: "update_artifact", arguments: { change_note: "   " } },
+        ],
+        skillsInvoked: [],
+      },
+      toolExpect: {
+        toolCallArgs: [{ tool: "update_artifact", field: "change_note", nonEmpty: true }],
+      },
+    });
+
+    const nonEmptyCheck = checks.find((c) => c.name.includes("is filled in on every call"));
+    expect(nonEmptyCheck?.passed).toBe(false);
+    expect(nonEmptyCheck?.details).toContain("blank on 1 of 2");
+  });
+
+  it("passes nonEmpty when every call filled the field", () => {
+    const checks = validateToolExpectations({
+      run: {
+        success: true,
+        actual: {},
+        assistantMessageCount: 1,
+        toolCallCount: 1,
+        toolsUsed: ["update_artifact"],
+        toolCallDetails: [
+          { name: "update_artifact", arguments: { change_note: "Tightened phase 2" } },
+        ],
+        skillsInvoked: [],
+      },
+      toolExpect: {
+        toolCallArgs: [{ tool: "update_artifact", field: "change_note", nonEmpty: true }],
+      },
+    });
+
+    expect(checks.every((check) => check.passed)).toBe(true);
+  });
+
  it("accepts a stringIncludesAnyOf substring inside an array-valued field", () => {
    const checks = validateToolExpectations({
      run: {
@@ -233,6 +233,19 @@ export function validateToolExpectations(input: {
      );
    }

+    if (rule.nonEmpty) {
+      const blankValues = values.filter(
+        (value) => typeof value !== "string" || value.trim().length === 0
+      );
+      checks.push(
+        check(
+          `${rule.tool}.${rule.field} is filled in on every call`,
+          blankValues.length === 0,
+          `blank on ${blankValues.length} of ${values.length} call(s); values: ${summarizeToolValues(values)}`
+        )
+      );
+    }
+
    if (rule.stringIncludesAnyOf && rule.stringIncludesAnyOf.length > 0) {
      // Existential: at least one call must contain one of the substrings.
      // Other calls to the same tool may do anything — this suits SQL, where a
@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO flow (workspace_id, path, summary, description, value, edited_by, edited_at, on_behalf_of, on_behalf_of_email)\n         VALUES ('test-workspace', 'u/test-user/obo_flow', '', '', $1, 'test-user', NOW(), 'u/test-user-2', 'test2@windmill.dev')",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Jsonb"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "00a7fccde8bc2075642ba02f4015d752ba7d67966ed03c0bf3414c842c049b3a"
+}
@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "DELETE FROM datatable_migrations WHERE workspace_id = $1 AND datatable = ANY($2::text[])",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        "TextArray"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "00e9fc3fed9379264881c58df9404ab3569a0611b33c261602d62e9c847c583e"
-}
@@ -0,0 +1,24 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT path FROM flow WHERE on_behalf_of = $1 AND NOT path LIKE $2 AND workspace_id = $3 AND NOT archived",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "path",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "015b63b1fbdf95fc76138fcf0aed03ac8948cfcf071c7f5df574c5f7003545cd"
+}
@@ -16,7 +16,8 @@
                "variable",
                "ducklake",
                "datatable",
-                "volume"
+                "volume",
+                "dbt"
              ]
            }
          }
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "UPDATE azure_trigger SET email = $1 WHERE email = $2",
+  "query": "UPDATE flow SET on_behalf_of = $1 WHERE on_behalf_of = $2",
  "describe": {
    "columns": [],
    "parameters": {
@@ -11,5 +11,5 @@
    },
    "nullable": []
  },
-  "hash": "0da2425ff8ee737104cd9f2650f1ffba1511715ac1f9270939d79fb82f8e88d0"
+  "hash": "024fa8a99a7967a56cd5ac9486ef728f2de0800eeb877fd29aca2fba3029aa55"
 }
@@ -0,0 +1,17 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO dbt_graph_snapshot (workspace_id, script_path, script_hash, job_id, digest)\n         VALUES ($1, $2, $3, $4, 'd2')",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Varchar",
+        "Int8",
+        "Uuid"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "03238f44f8d4db3ed406f853b5afd945796a2657e58cf1c5086d971e652803d5"
+}
@@ -0,0 +1,29 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT created_by, runnable_path FROM v2_job\n          WHERE id = $1 AND workspace_id = $2",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "created_by",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "runnable_path",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      true
+    ]
+  },
+  "hash": "04896f435eee78f5ac604f5a57c8d35a313fc321df788e1c701e11f60da46480"
+}
@@ -0,0 +1,28 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "WITH RECURSIVE tree AS (\n                       SELECT id, is_dev_workspace, dev_workspace_label, deleted, 0 AS depth\n                       FROM workspace WHERE id = $1\n                       UNION ALL\n                       SELECT w.id, w.is_dev_workspace, w.dev_workspace_label, w.deleted,\n                              tree.depth + 1\n                       FROM workspace w JOIN tree ON w.parent_workspace_id = tree.id\n                       WHERE tree.depth < 20\n                   )\n                   SELECT id AS \"id!\", dev_workspace_label FROM tree\n                   WHERE depth > 0 AND is_dev_workspace AND NOT deleted",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id!",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "dev_workspace_label",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      null,
+      null
+    ]
+  },
+  "hash": "051a18ab1720ffff792a843be93e8c01515be10b2e40292d904d20e7d53bf289"
+}
@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE usr SET email = 'group-ops@windmill.dev' WHERE email = 'test2@windmill.dev'",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "058df18b148867dbb8bcf9e10c485d276b5af4b2b972fb335e41077a029c3196"
+}
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "SELECT\n            j.id, j.workspace_id, j.runnable_id AS \"runnable_id: ScriptHash\", q.scheduled_for, q.started_at, j.parent_job, j.flow_innermost_root_job, j.runnable_path, j.kind as \"kind!: JobKind\", j.permissioned_as,\n            j.created_by, j.script_lang AS \"script_lang: ScriptLang\", j.permissioned_as_email, j.flow_step_id, j.trigger_kind AS \"trigger_kind: JobTriggerKind\", j.trigger, j.priority, j.concurrent_limit, j.tag, j.cache_ttl, q.cache_ignore_s3_path, q.runnable_settings_handle\n            FROM v2_job j LEFT JOIN v2_job_queue q ON j.id = q.id\n            WHERE j.id = $1 AND j.workspace_id = $2",
+  "query": "SELECT\n            j.id, j.workspace_id, j.runnable_id AS \"runnable_id: ScriptHash\", q.scheduled_for, q.started_at, j.parent_job, j.flow_innermost_root_job, j.runnable_path, j.kind as \"kind!: JobKind\", j.permissioned_as,\n            j.created_by, j.script_lang AS \"script_lang: ScriptLang\", j.permissioned_as_email, j.flow_step_id, j.trigger_kind AS \"trigger_kind: TriggerKindLabel\", j.trigger, j.priority, j.concurrent_limit, j.tag, j.cache_ttl, q.cache_ignore_s3_path, q.runnable_settings_handle\n            FROM v2_job j LEFT JOIN v2_job_queue q ON j.id = q.id\n            WHERE j.id = $1 AND j.workspace_id = $2",
  "describe": {
    "columns": [
      {
@@ -119,7 +119,8 @@
                "java",
                "duckdb",
                "ruby",
-                "rlang"
+                "rlang",
+                "dbt"
              ]
            }
          }
@@ -137,7 +138,7 @@
      },
      {
        "ordinal": 14,
-        "name": "trigger_kind: JobTriggerKind",
+        "name": "trigger_kind: TriggerKindLabel",
        "type_info": {
          "Custom": {
            "name": "job_trigger_kind",
@@ -236,5 +237,5 @@
      true
    ]
  },
-  "hash": "67e25a7c19ea0ffaf7ea5303fcd04af5a7eb488c76f783e690af0c2153b1d6a8"
+  "hash": "09ae123099f05fe3db8bd67ca2c0d778a27619dd7fad71ba656f6b54c4915d1e"
 }
@@ -0,0 +1,17 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM dbt_edge WHERE workspace_id = $1 AND script_path = $2\n           AND script_hash = $3 AND job_id = $4",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Int8",
+        "Uuid"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "0b3754e11677390837ec7ab00ba5443dc634b8628e90cce879952c8c4319a6a6"
+}
@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT pg_advisory_xact_lock(hashtext('dev_workspace_pairing:' || $1))",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "pg_advisory_xact_lock",
+        "type_info": "Void"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "0b9088064d2a61fd9df91269ec95cab2539a701109727f997a3e5a0f4b0f1f22"
+}
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE draft SET value = to_json(jsonb_set(to_jsonb(value), ARRAY['on_behalf_of'], to_jsonb('u/' || $1))) WHERE value->>'on_behalf_of' = ('u/' || $2) AND workspace_id = $3",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "0c416eee574142b7a709a6e3e9a47d436f407781ff2bee820d3234317f46f2a6"
+}
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO workspace_settings (workspace_id, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, ducklake, dbt_warehouses, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts) SELECT $1, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, ducklake, dbt_warehouses, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts FROM workspace_settings WHERE workspace_id = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "0c5b02b6b70fb8fd2ab3e6c57897038750a44a67360d342b6ef705ef2e4d3007"
+}
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT EXISTS(SELECT 1 FROM app WHERE workspace_id = $1 AND path = $2)",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "exists",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "0d9c4c350db3ef8f47c0951d901e9b87a9e3ee8c157b3e9a33053d2f0eeb8069"
+}
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT EXISTS(SELECT 1 FROM resource_type WHERE workspace_id = $1 AND name = $2)",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "exists",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "0dbac8411e9fdaacd11980ac548c8cb957ff989aa70dae1223630f48d9949b44"
+}
@@ -16,7 +16,8 @@
                "variable",
                "ducklake",
                "datatable",
-                "volume"
+                "volume",
+                "dbt"
              ]
            }
          }
@@ -55,7 +56,8 @@
                      "variable",
                      "ducklake",
                      "datatable",
-                      "volume"
+                      "volume",
+                      "dbt"
                    ]
                  }
                }
@@ -35,7 +35,8 @@
                "java",
                "duckdb",
                "ruby",
-                "rlang"
+                "rlang",
+                "dbt"
              ]
            }
          }
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT path FROM resource WHERE workspace_id = $1 AND path = ANY($2)",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "path",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "TextArray"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "10eba371c513030f165a6c8d3a32f7e33828247ab8108ffe304d7548aab5a42d"
+}
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE draft SET value = to_json(jsonb_set(to_jsonb(value), ARRAY['on_behalf_of_email'], to_jsonb($1::text))) WHERE typ IN ('script', 'flow') AND value->>'on_behalf_of_email' = $2 AND (value->>'on_behalf_of' IS NULL OR value->>'on_behalf_of' NOT LIKE 'g/%')",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "117b6de99cd75e279f738226d9455c506ac1d40163b4f3c50279a93e4cded5fa"
+}
@@ -34,7 +34,8 @@
                "java",
                "duckdb",
                "ruby",
-                "rlang"
+                "rlang",
+                "dbt"
              ]
            }
          }
@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO script (workspace_id, path, hash, content, summary, description, language, created_by, created_at, on_behalf_of, on_behalf_of_email)\n         VALUES ('test-workspace', 'f/shared/obo', 1099, 'def main(): pass', '', '', 'python3', 'test-user', NOW(), 'u/test-user-2', 'test2@windmill.dev')",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "1253d0f62254b30979a1c8b41d5dc1a57a0253f9a76721e7b8965905613f2ace"
+}
@@ -0,0 +1,17 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO dbt_graph_snapshot (workspace_id, script_path, script_hash, job_id, digest)\n         VALUES ($1, $2, $3, $4, 'd')",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Varchar",
+        "Int8",
+        "Uuid"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "12912ebe5df4eda15976e7c3a2f0501ed3098f33a234f283def6932ce491eb66"
+}
@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO token(token_hash, token_prefix, token, email, label, super_admin)\n         VALUES (encode(sha256('LONG_TOKEN'::bytea), 'hex'), 'LONG_TOKEN', 'LONG_TOKEN', $1, 'long', true)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "13ab0cda87d04b9c1fb52b46e0211d02b24375643a030efdbfab331cdc248349"
+}
@@ -0,0 +1,38 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        UPDATE native_trigger\n        SET webhook_token_hash = $1, service_config = $2, error = NULL, updated_at = NOW()\n        WHERE\n            workspace_id = $3\n            AND service_name = $4\n            AND external_id = $5\n            AND updated_at = $6\n        RETURNING 1 AS \"applied!\"\n        ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "applied!",
+        "type_info": "Int4"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Jsonb",
+        "Text",
+        {
+          "Custom": {
+            "name": "native_trigger_service",
+            "kind": {
+              "Enum": [
+                "nextcloud",
+                "google",
+                "github"
+              ]
+            }
+          }
+        },
+        "Text",
+        "Timestamptz"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "14a826d794da720981368c77a4f9dac27307833fafaa0ea232819aecd4d62773"
+}
@@ -0,0 +1,20 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO workspace_diff (source_workspace_id, fork_workspace_id, path, kind, ahead, behind, has_changes, source_last_event_kind, source_last_event_origin)\n                SELECT $1, unnest($2::varchar[]), $3, $4, 0, 1, NULL, $5, $6\n                ON CONFLICT (source_workspace_id, fork_workspace_id, path, kind)\n                DO UPDATE SET\n                    behind = workspace_diff.behind + 1,\n                    has_changes = NULL,\n                    source_last_event_kind = CASE WHEN $6::varchar IS NULL OR (NOT $7 AND workspace_diff.source_last_event_origin IS NOT NULL) THEN workspace_diff.source_last_event_kind ELSE $5 END,\n                    source_last_event_origin = CASE WHEN $6::varchar IS NULL OR (NOT $7 AND workspace_diff.source_last_event_origin IS NOT NULL) THEN workspace_diff.source_last_event_origin ELSE $6 END",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "VarcharArray",
+        "Varchar",
+        "Varchar",
+        "Varchar",
+        "Varchar",
+        "Bool"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "14f024e99b3f7129294435671eba84c3d8cd9e36ff773c0cf2843509cce4fdf9"
+}
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE app SET policy = jsonb_set(policy, ARRAY['on_behalf_of_email'], to_jsonb($1::text)) WHERE policy->>'on_behalf_of_email' = $2 AND (policy->>'on_behalf_of' IS NULL OR policy->>'on_behalf_of' NOT LIKE 'g/%')",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "164d94369014ce77642984818a0e436a87a1bd1c56fcaafbfae2ee45f62fe4e1"
+}
@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO azure_trigger (\n            azure_resource_path, azure_mode, scope_resource_id, topic_name,\n            subscription_name, event_type_filters, push_auth_config, path, script_path,\n            is_flow, workspace_id, edited_by, email, edited_at, extra_perms, server_id,\n            last_server_ping, error, mode, permissioned_as, error_handler_path,\n            error_handler_args, retry, labels\n        )\n        SELECT\n            azure_resource_path, azure_mode, scope_resource_id, topic_name,\n            subscription_name, event_type_filters, push_auth_config, path, script_path,\n            is_flow, $1, edited_by, email, edited_at, extra_perms, NULL,\n            NULL, NULL, 'disabled'::TRIGGER_MODE, permissioned_as, error_handler_path,\n            error_handler_args, retry, labels\n        FROM azure_trigger WHERE workspace_id = $2",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "16e8d3f75ce4b5b18cefc25ebb670b506677681394606426964491488d64c62c"
-}
@@ -0,0 +1,17 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE script SET on_behalf_of = $1, on_behalf_of_email = $4 WHERE on_behalf_of = $2 AND workspace_id = $3",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "175a732180336a801d1c2f41854269a2ce2160349f163b714cee77b5ed4b92f5"
+}
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM dbt_run_state WHERE workspace_id = $1 AND script_path = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "19d19f3ed995ac68d9692c8fdf96836099dd325fa25d3660eb766a895b07c1da"
+}
@@ -0,0 +1,25 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM dbt_graph_snapshot g\n          WHERE g.workspace_id = $1 AND g.script_path = $2 AND g.script_hash IS NULL\n            AND g.permissioned_as IS NOT DISTINCT FROM $4\n            AND g.job_id NOT IN (\n              SELECT job_id FROM dbt_graph_snapshot\n               WHERE workspace_id = $1 AND script_path = $2 AND script_hash IS NULL\n                 AND permissioned_as IS NOT DISTINCT FROM $4\n               ORDER BY ingested_at DESC LIMIT $3)\n        RETURNING g.job_id",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "job_id",
+        "type_info": "Uuid"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Int8",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "1a3fb9f51abd42f1ac4c7597f985a687bed32d2905a446c4e4b33f0b853e8e54"
+}
@@ -0,0 +1,26 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT path, on_behalf_of_email AS email FROM script WHERE workspace_id = 'test-workspace' AND path LIKE 'u/test-user/s%' ORDER BY path",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "path",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "email",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      false,
+      true
+    ]
+  },
+  "hash": "1b18f9fdcc0fbc3d5a1328776a804e2943193ad7d28b67df4e80baf38fc19271"
+}
@@ -0,0 +1,70 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT\n            workspace.id AS \"id!\",\n            workspace.name AS \"name!\",\n            workspace.owner AS \"owner!\",\n            workspace.deleted AS \"deleted!\",\n            workspace.premium AS \"premium!\",\n            workspace_settings.color AS \"color\",\n            workspace.parent_workspace_id AS \"parent_workspace_id\",\n            workspace.is_dev_workspace AS \"is_dev_workspace!\",\n            workspace.dev_workspace_label AS \"dev_workspace_label\"\n        FROM workspace\n        LEFT JOIN workspace_settings ON workspace.id = workspace_settings.workspace_id\n        WHERE workspace.id = $1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id!",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "name!",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "owner!",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 3,
+        "name": "deleted!",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 4,
+        "name": "premium!",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 5,
+        "name": "color",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 6,
+        "name": "parent_workspace_id",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 7,
+        "name": "is_dev_workspace!",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 8,
+        "name": "dev_workspace_label",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      false,
+      false,
+      false,
+      true,
+      true,
+      false,
+      true
+    ]
+  },
+  "hash": "1c472a4740a41ae8985f865e15b0c4edb4d5af2281c22955121cb794428c3cde"
+}
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM dbt_run_progress\n          WHERE workspace_id = $1 AND job_id = $2 AND status = 'running'\n            AND asset_path = ANY($3)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Uuid",
+        "TextArray"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "1d4fb43c4856679371abfa5eeea8b92697ae3640a2e680395c2958c5d8664e27"
+}
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT resource_type FROM resource WHERE workspace_id = $1 AND path = $2",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "resource_type",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "1ddb83c0941de9ca80f867b57ad20c3ee0952d118d339f94d16102d9edb23ec0"
+}
@@ -0,0 +1,20 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT on_behalf_of FROM flow WHERE workspace_id = 'wm-fork-obo'",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "on_behalf_of",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      true
+    ]
+  },
+  "hash": "1e044b8f64184393953dfeadbeda8af703060a604e68f32e714610513aa284eb"
+}
@@ -44,7 +44,8 @@
                "java",
                "duckdb",
                "ruby",
-                "rlang"
+                "rlang",
+                "dbt"
              ]
            }
          }
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE script SET archived = true WHERE workspace_id = $1 AND hash = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Int8"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "1f39f7ca0c04e825d3648906eed0c98c1dc8c913dc95b691cc6f92ffcd57989e"
+}
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO dbt_node (workspace_id, script_path, script_hash, job_id, unique_id,\n                                 resource_type, name, asset_path, raw_code, tags)\n           VALUES ($1, $2, NULL, $3, 'model.p.draft', 'model', 'draft',\n                   'u/a/wh/analytics/draft', 'select 3', '{}')",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Varchar",
+        "Uuid"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "1fb5590cb1fe706b0d2dffcd04a41bb2fce6012b812d16d37c895b2eb9aeca4c"
+}
@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        UPDATE workspace_settings\n        SET\n            ai_config = source_ws.ai_config,\n            large_file_storage = source_ws.large_file_storage,\n            ducklake = source_ws.ducklake,\n            datatable = source_ws.datatable,\n            git_app_installations = source_ws.git_app_installations\n        FROM workspace_settings source_ws\n        WHERE source_ws.workspace_id = $1\n        AND workspace_settings.workspace_id = $2\n        ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "2213dc4b594d27b3788c48b19e13c600224681e11c016eea5cee3086a7bea8d0"
-}
@@ -0,0 +1,17 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO dbt_node (workspace_id, script_path, script_hash, job_id, unique_id,\n                                 resource_type, name, asset_path, raw_code, tags, description,\n                                 columns, freshness)\n           VALUES ($1, $2, $3, $4, 'model.p.orders', 'model', 'orders',\n                   'u/a/wh/analytics/orders', 'select 1', '{finance}', 'daily order facts',\n                   '{\"order_id\": {\"description\": \"natural key\"}}'::jsonb,\n                   '{\"warn_after\": {\"count\": 12, \"period\": \"hour\"}}'::jsonb)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Varchar",
+        "Int8",
+        "Uuid"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "229cc3975b7f579c35ac0daa9204ff3ff25fb57954dd1ba2d552c7b263696c07"
+}
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "WITH keep AS (\n           SELECT hash FROM script\n            WHERE workspace_id = $2 AND path = $3 AND language = 'dbt'\n            ORDER BY created_at DESC LIMIT $1\n         )\n         DELETE FROM dbt_graph_snapshot g\n          WHERE g.workspace_id = $2 AND g.script_path = $3\n            AND g.job_id = '00000000-0000-0000-0000-000000000000'\n            AND NOT EXISTS (SELECT 1 FROM keep k WHERE k.hash = g.script_hash)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Int8",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "22be2359b966bd92d8327f142281ec620fc98c5fb77061ed192a6f75bea2b049"
+}
@@ -27,7 +27,8 @@
                "variable",
                "ducklake",
                "datatable",
-                "volume"
+                "volume",
+                "dbt"
              ]
            }
          }
@@ -0,0 +1,19 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO workspace_diff (source_workspace_id, fork_workspace_id, path, kind, ahead, behind, has_changes, fork_last_event_kind, fork_last_event_origin)\n                VALUES ($1, $2, $3, $4, 1, 0, NULL, $5, $6)\n                ON CONFLICT (source_workspace_id, fork_workspace_id, path, kind)\n                DO UPDATE SET\n                    ahead = workspace_diff.ahead + 1,\n                    has_changes = NULL,\n                    fork_last_event_kind = EXCLUDED.fork_last_event_kind,\n                    fork_last_event_origin = EXCLUDED.fork_last_event_origin",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Varchar",
+        "Varchar",
+        "Varchar",
+        "Varchar",
+        "Varchar"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "2458d56c20942e9d13578dbf0e898cda51a2fc652fb008f4e57f07f0922fdcdd"
+}
@@ -0,0 +1,20 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT COUNT(*) AS \"count!\" FROM workspace_diff\n             WHERE source_workspace_id = 'test-workspace'\n               AND fork_workspace_id = 'wm-fork-removal'\n               AND kind = 'script'\n               AND fork_last_event_origin IS NOT NULL",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "count!",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "24a8eba06c31e09a49ee2ced0748c6ced8664fc7f5278d0673d6134b1ab54bad"
+}
@@ -0,0 +1,32 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT ahead, fork_last_event_kind, fork_last_event_origin FROM workspace_diff\n         WHERE source_workspace_id = 'test-workspace' AND fork_workspace_id = 'wm-fork-removal'\n           AND kind = 'script' AND path = 'u/admin/dropped_by_sync'",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "ahead",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 1,
+        "name": "fork_last_event_kind",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "fork_last_event_origin",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      false,
+      true,
+      true
+    ]
+  },
+  "hash": "25763b3f6f9ef04f879a49407b65d4fa95129bd95418cf908088d9744fc22d4b"
+}
@@ -21,7 +21,8 @@
                "variable",
                "ducklake",
                "datatable",
-                "volume"
+                "volume",
+                "dbt"
              ]
            }
          }
@@ -0,0 +1,101 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO script (workspace_id, hash, path, parent_hashes, summary, description, content, created_by, schema, is_template, extra_perms, lock, language, kind, tag, envs, concurrent_limit, concurrency_time_window_s, cache_ttl, dedicated_worker, ws_error_handler_muted, priority, restart_unless_cancelled, delete_after_use, delete_after_secs, timeout, concurrency_key, visible_to_runner_only, auto_kind, codebase, has_preprocessor, schema_validation, assets, debounce_key, debounce_delay_s, cache_ignore_s3_path, runnable_settings_handle, modules, labels, on_behalf_of, on_behalf_of_email) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9::text::json, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20, $21, $22, $23, $24, $25, $26, $27, $28, $29, $30, $31, $32, $33, $34, $35, $36, $37, $38, $39, $40, $41)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Int8",
+        "Varchar",
+        "Int8Array",
+        "Text",
+        "Text",
+        "Text",
+        "Varchar",
+        "Text",
+        "Bool",
+        "Jsonb",
+        "Text",
+        {
+          "Custom": {
+            "name": "script_lang",
+            "kind": {
+              "Enum": [
+                "python3",
+                "deno",
+                "go",
+                "bash",
+                "postgresql",
+                "nativets",
+                "bun",
+                "mysql",
+                "bigquery",
+                "snowflake",
+                "graphql",
+                "powershell",
+                "mssql",
+                "php",
+                "bunnative",
+                "rust",
+                "ansible",
+                "csharp",
+                "oracledb",
+                "nu",
+                "java",
+                "duckdb",
+                "ruby",
+                "rlang",
+                "dbt"
+              ]
+            }
+          }
+        },
+        {
+          "Custom": {
+            "name": "script_kind",
+            "kind": {
+              "Enum": [
+                "script",
+                "trigger",
+                "failure",
+                "command",
+                "approval",
+                "preprocessor"
+              ]
+            }
+          }
+        },
+        "Varchar",
+        "VarcharArray",
+        "Int4",
+        "Int4",
+        "Int4",
+        "Bool",
+        "Bool",
+        "Int2",
+        "Bool",
+        "Bool",
+        "Int4",
+        "Int4",
+        "Varchar",
+        "Bool",
+        "Varchar",
+        "Varchar",
+        "Bool",
+        "Bool",
+        "Jsonb",
+        "Varchar",
+        "Int4",
+        "Bool",
+        "Int8",
+        "Jsonb",
+        "TextArray",
+        "Varchar",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "295325886239353a27bfb8807a59952b81141a2544fc5340e6526b8fa0fb06c5"
+}
@@ -42,7 +42,8 @@
                "variable",
                "ducklake",
                "datatable",
-                "volume"
+                "volume",
+                "dbt"
              ]
            }
          }
@@ -0,0 +1,17 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE flow SET on_behalf_of = $1, on_behalf_of_email = $4 WHERE on_behalf_of = $2 AND workspace_id = $3",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "2a89648b28c40dfb9ebd4aa0b5ffa772d88c5cf97de840b5147deaeb95c98209"
+}
@@ -0,0 +1,24 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT relation_root_at_last_ingest FROM dbt_graph_snapshot\n                  WHERE workspace_id = $1 AND script_path = $2 AND script_hash = $3\n                    AND job_id = '00000000-0000-0000-0000-000000000000'",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "relation_root_at_last_ingest",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Int8"
+      ]
+    },
+    "nullable": [
+      true
+    ]
+  },
+  "hash": "2a8b9b199a6d383ed39a64dad54014f869ade4a139956dcb082f0524779f7680"
+}
@@ -0,0 +1,20 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE workspace_diff SET fork_last_event_kind = 'delete', fork_last_event_origin = 'sync'\n         WHERE fork_workspace_id = 'wm-fork-deferred' AND kind = 'flow'\n           AND path = 'u/admin/moved_by_user' RETURNING 1 AS \"one!\"",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "one!",
+        "type_info": "Int4"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "2c125b9655cf3d61bee135b8efbfad1d2a395d15f34cfaa4e1438b36afdd4043"
+}
@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT pg_try_advisory_lock(hashtextextended($1, 0)) AS \"acquired!\"",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "acquired!",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "2c56da59ac2d7b410235a3181cf2db835776ff3928236dc26033a9f577ddad61"
+}
@@ -0,0 +1,24 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT job_id FROM dbt_run_state\n          WHERE workspace_id = $1 AND script_path = $2 AND permissioned_as = $3 AND retryable",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "job_id",
+        "type_info": "Uuid"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      true
+    ]
+  },
+  "hash": "2d943b22eb69010f3c2388b9443dc8c5729cb2b828cae94c047b896ebff37fd3"
+}
@@ -0,0 +1,19 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO workspace_diff (source_workspace_id, fork_workspace_id, path, kind, ahead, behind, has_changes, fork_last_event_kind, fork_last_event_origin)\n                VALUES ($1, $2, $3, $4, 1, 0, NULL, $5, $6)\n                ON CONFLICT (source_workspace_id, fork_workspace_id, path, kind)\n                DO UPDATE SET\n                    ahead = workspace_diff.ahead + 1,\n                    has_changes = NULL,\n                    fork_last_event_kind = CASE WHEN $6::varchar IS NULL THEN workspace_diff.fork_last_event_kind ELSE $5 END,\n                    fork_last_event_origin = COALESCE($6, workspace_diff.fork_last_event_origin)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Varchar",
+        "Varchar",
+        "Varchar",
+        "Varchar",
+        "Varchar"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "2db7e748ce92c8f300c1d7519900dbfa39304167e58c096186c7f9ee47207a05"
+}
@@ -21,7 +21,8 @@
                      "variable",
                      "ducklake",
                      "datatable",
-                      "volume"
+                      "volume",
+                      "dbt"
                    ]
                  }
                }
@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO script (workspace_id, path, hash, content, summary, description, language, created_by, created_at, on_behalf_of)\n         VALUES ('test-workspace', 'u/test-user/s', 93001, 'def main(): pass', '', '', 'python3', 'test-user', NOW(), 'ext@windmill.dev')",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "31f38820514b1d51459ad93dd0e59d96d4e8cc79c8f3d3c4228f3bc7585c1839"
+}
@@ -0,0 +1,30 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT req.id AS \"id!\",\n                (CASE\n                    WHEN workspace.id IS NULL THEN 'deleted'\n                    WHEN usr.email IS NULL AND NOT $3 THEN 'deleted'\n                    WHEN workspace.deleted THEN 'archived'\n                    ELSE 'active'\n                END) AS \"status!\"\n         FROM unnest($1::text[]) AS req(id)\n         LEFT JOIN workspace ON workspace.id = req.id\n         LEFT JOIN usr ON usr.workspace_id = workspace.id AND usr.email = $2",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id!",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 1,
+        "name": "status!",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "TextArray",
+        "Text",
+        "Bool"
+      ]
+    },
+    "nullable": [
+      null,
+      null
+    ]
+  },
+  "hash": "3200de51b6fedd925ab3e9e471a6719b7b6de68976e9f90d18c5b74f43763ece"
+}
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM resource_version rv\n         WHERE rv.workspace_id = $1 AND rv.path = $2\n           AND rv.id != (\n               SELECT max(id) FROM resource_version l\n               WHERE l.workspace_id = rv.workspace_id AND l.path = rv.path\n           )",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "33740249a429a5dcbb399459e6b92e865838992c21da78264b8f5d1fe71bc2bf"
+}
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM dbt_node WHERE workspace_id = $1 AND script_path = $2 AND script_hash = $3",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Int8"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "33b9ef6fabbb5f0de64246b51f0ce702603b7ae170054cda7ed5f6f0a9f44a28"
+}
@@ -0,0 +1,36 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT j.runnable_path, j.runnable_id, j.permissioned_as\n           FROM v2_job_queue q JOIN v2_job j ON j.id = q.id\n          WHERE q.id = $1 AND j.workspace_id = $2 AND q.tag = ANY($3)",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "runnable_path",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "runnable_id",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 2,
+        "name": "permissioned_as",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Text",
+        "TextArray"
+      ]
+    },
+    "nullable": [
+      true,
+      true,
+      false
+    ]
+  },
+  "hash": "34a0dd9de9495f80a07e568323c5b94e33dfcacba9466bd870152b130d400794"
+}
@@ -0,0 +1,28 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "WITH RECURSIVE ancestors AS (\n               SELECT id, parent_workspace_id, is_dev_workspace, dev_workspace_label, deleted,\n                      0 AS depth\n               FROM workspace WHERE id = $1\n               UNION ALL\n               SELECT w.id, w.parent_workspace_id, w.is_dev_workspace, w.dev_workspace_label,\n                      w.deleted, ancestors.depth + 1\n               FROM workspace w JOIN ancestors ON w.id = ancestors.parent_workspace_id\n               WHERE ancestors.depth < 20\n           )\n           SELECT id AS \"id!\", dev_workspace_label FROM ancestors\n           WHERE is_dev_workspace AND NOT deleted",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id!",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "dev_workspace_label",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      null,
+      null
+    ]
+  },
+  "hash": "34fbd17a412a11779fe54505a8c933a2884dbb4ab59161881fdf121ab48f1b35"
+}
@@ -0,0 +1,32 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT path, on_behalf_of, on_behalf_of_email FROM script WHERE workspace_id = 'wm-fork-obo' ORDER BY path",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "path",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "on_behalf_of",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "on_behalf_of_email",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      false,
+      true,
+      true
+    ]
+  },
+  "hash": "359b85d7940b82bb0e40ebf09e054f9191672e92fff6b22c2130bb04c7009665"
+}
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE script SET on_behalf_of = $1 WHERE on_behalf_of = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "36d0ace456b6022e5311491e0ef457b33679b6ffe75d068349638f9345693348"
+}
@@ -0,0 +1,17 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM dbt_node WHERE workspace_id = $1 AND script_path = $2\n           AND script_hash = $3 AND job_id = $4",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Int8",
+        "Uuid"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "38125105da39bfedbdc1396fe37a8835f2630389dc339be0fda614ddb4d773df"
+}
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE script SET archived = true, extra_perms = '{\"u/outsider\": true}'::jsonb\n            WHERE workspace_id = $1 AND hash = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Int8"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "381d59e7ab08e2ae7147e4c277a2d96f22375fa2b1eccafb7f09928a8b0cb549"
+}
@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT workspace_id FROM usr WHERE email = $1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "workspace_id",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "38c20dba51b1e2b4b28e5eed51f9071e1d3cf78e89ec467927823177c5a439cc"
+}
@@ -0,0 +1,153 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "select hash, tag, concurrency_key, concurrent_limit, concurrency_time_window_s, debounce_key, debounce_delay_s, cache_ttl, cache_ignore_s3_path, runnable_settings_handle, language as \"language: ScriptLang\", dedicated_worker, priority, timeout, on_behalf_of, created_by, labels FROM script\n             WHERE path = $1 AND workspace_id = $2 AND archived = false AND (lock IS NOT NULL OR $3 = false)\n             ORDER BY created_at DESC LIMIT 1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "hash",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 1,
+        "name": "tag",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "concurrency_key",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 3,
+        "name": "concurrent_limit",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 4,
+        "name": "concurrency_time_window_s",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 5,
+        "name": "debounce_key",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 6,
+        "name": "debounce_delay_s",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 7,
+        "name": "cache_ttl",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 8,
+        "name": "cache_ignore_s3_path",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 9,
+        "name": "runnable_settings_handle",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 10,
+        "name": "language: ScriptLang",
+        "type_info": {
+          "Custom": {
+            "name": "script_lang",
+            "kind": {
+              "Enum": [
+                "python3",
+                "deno",
+                "go",
+                "bash",
+                "postgresql",
+                "nativets",
+                "bun",
+                "mysql",
+                "bigquery",
+                "snowflake",
+                "graphql",
+                "powershell",
+                "mssql",
+                "php",
+                "bunnative",
+                "rust",
+                "ansible",
+                "csharp",
+                "oracledb",
+                "nu",
+                "java",
+                "duckdb",
+                "ruby",
+                "rlang",
+                "dbt"
+              ]
+            }
+          }
+        }
+      },
+      {
+        "ordinal": 11,
+        "name": "dedicated_worker",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 12,
+        "name": "priority",
+        "type_info": "Int2"
+      },
+      {
+        "ordinal": 13,
+        "name": "timeout",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 14,
+        "name": "on_behalf_of",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 15,
+        "name": "created_by",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 16,
+        "name": "labels",
+        "type_info": "TextArray"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Bool"
+      ]
+    },
+    "nullable": [
+      false,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      false,
+      true,
+      true,
+      true,
+      true,
+      false,
+      true
+    ]
+  },
+  "hash": "3b20f17e0fadb619de37cda93b361f73d964ae4562e0cb862c7402ae779ed13a"
+}
@@ -0,0 +1,17 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO dbt_node (workspace_id, script_path, script_hash, job_id, unique_id,\n                               resource_type, name, asset_path, raw_code, tags)\n         VALUES ($1, $2, $3, $4, 'model.p.orders', 'model', 'orders',\n                 'u/a/wh/analytics/orders', 'select 2', '{}')",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Varchar",
+        "Int8",
+        "Uuid"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "3b40cccf059fbd28ff9c8d0004daee26c81a8fe909e12ae997eaaba83ade634d"
+}
@@ -0,0 +1,27 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO flow (\n        workspace_id, path, summary, description,\n        dependency_job, lock_error_logs, tag,\n        dedicated_worker, visible_to_runner_only,\n        ws_error_handler_muted,\n        value, schema, edited_by, edited_at, labels,\n        on_behalf_of, on_behalf_of_email\n    ) VALUES (\n        $1, $2, $3, $4,\n        NULL, '', $5,\n        $6, $7,\n        $8,\n        $9, $10::text::json, $11, now(), $12,\n        $13, $14\n    )",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Varchar",
+        "Text",
+        "Text",
+        "Varchar",
+        "Bool",
+        "Bool",
+        "Bool",
+        "Jsonb",
+        "Text",
+        "Varchar",
+        "TextArray",
+        "Varchar",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "3c44de953b08ecfd8a962490d21b2dd0bfb66b7631acc958742523cce63793a0"
+}
@@ -77,7 +77,8 @@
                "java",
                "duckdb",
                "ruby",
-                "rlang"
+                "rlang",
+                "dbt"
              ]
            }
          }
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO flow (\n            workspace_id, path, summary, description, value, edited_by, edited_at,\n            archived, schema, extra_perms, dependency_job, tag,\n            ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only,\n            concurrency_key, versions, on_behalf_of, on_behalf_of_email, lock_error_logs\n        )\n        SELECT $2, path, summary, description, value, edited_by, edited_at,\n               archived, schema, extra_perms, NULL, tag,\n               ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only,\n               concurrency_key, ARRAY[]::bigint[],\n               -- Same predicate as clone_scripts.\n               CASE WHEN on_behalf_of LIKE 'u/%' THEN\n                       (SELECT on_behalf_of WHERE EXISTS (\n                           SELECT 1 FROM usr u WHERE u.workspace_id = $2::varchar\n                             AND u.username = substring(on_behalf_of from 3)\n                           UNION ALL\n                           SELECT 1 FROM password p WHERE p.super_admin\n                             AND (p.username = substring(on_behalf_of from 3)\n                                  OR p.email = substring(on_behalf_of from 3))))\n                    WHEN on_behalf_of LIKE 'g/%' THEN\n                       (SELECT on_behalf_of WHERE EXISTS (\n                           SELECT 1 FROM group_ g WHERE g.workspace_id = $2::varchar\n                             AND g.name = substring(on_behalf_of from 3)))\n                    ELSE\n                       (SELECT on_behalf_of WHERE EXISTS (\n                           SELECT 1 FROM usr u WHERE u.workspace_id = $2::varchar\n                             AND u.username = on_behalf_of\n                           UNION ALL\n                           SELECT 1 FROM password p WHERE p.email = on_behalf_of\n                             AND p.super_admin))\n               END, on_behalf_of_email, lock_error_logs\n        FROM flow\n        WHERE workspace_id = $1",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Varchar"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "3cc398db9c2f8f698a45cb763036c554a9d7525ad34f9ec1bd4ac3dc7afaee38"
+}
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "SELECT\n            workspace_invite.workspace_id,\n            workspace_invite.email,\n            workspace_invite.is_admin,\n            workspace_invite.operator,\n            workspace.parent_workspace_id\n        FROM workspace_invite JOIN workspace ON workspace_invite.workspace_id = workspace.id\n        WHERE workspace_id = $1",
+  "query": "SELECT\n            workspace_invite.workspace_id,\n            workspace_invite.email,\n            workspace_invite.is_admin,\n            workspace_invite.operator,\n            workspace.parent_workspace_id\n        FROM workspace_invite JOIN workspace ON workspace_invite.workspace_id = workspace.id\n        WHERE workspace_id = $1\n        ORDER BY workspace_invite.email",
  "describe": {
    "columns": [
      {
@@ -42,5 +42,5 @@
      true
    ]
  },
-  "hash": "ce5c081bbf8322371a6ec95b6a0b033837d574a1ec72dfe42b666172daf10880"
+  "hash": "3ce57583042b1daa2bd9d88502f6f4ab76c509dafee7371ac620c85e1b5d2498"
 }
@@ -0,0 +1,35 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM datatable_migrations WHERE workspace_id = $1 AND datatable = ANY($2::text[]) RETURNING datatable, timestamp, name",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "datatable",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "timestamp",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 2,
+        "name": "name",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "TextArray"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      false
+    ]
+  },
+  "hash": "3e474475c05ff5fc137a070b149dd3a5a77e1640e03f2964d5143c1063fd3d83"
+}
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "SELECT email, username, is_admin, is_operator, groups, folders FROM job_perms WHERE job_id = $1 AND workspace_id = $2",
+  "query": "SELECT email, username, is_admin, is_operator, groups, folders, end_user_email FROM job_perms WHERE job_id = $1 AND workspace_id = $2",
  "describe": {
    "columns": [
      {
@@ -32,6 +32,11 @@
        "ordinal": 5,
        "name": "folders",
        "type_info": "JsonbArray"
+      },
+      {
+        "ordinal": 6,
+        "name": "end_user_email",
+        "type_info": "Varchar"
      }
    ],
    "parameters": {
@@ -46,8 +51,9 @@
      false,
      false,
      false,
-      false
+      false,
+      true
    ]
  },
-  "hash": "2a510a8bec98055796f987d86c344ca116895d71de09db338ec09e425dcebe5e"
+  "hash": "3e869b95799300dff973a3c858f823a2872e33a360ff5a02169e4e80ce3d3b7b"
 }
--- a/Show More
+++ b/Show More