()
+ const visit = (candidate: unknown, depth: number) => {
+ if (!candidate || typeof candidate !== 'object') return
+ for (const [key, child] of Object.entries(candidate)) {
+ if (
+ typeof child === 'string' &&
+ PATH_ARGUMENTS.includes(key) &&
+ (depth === 0 || key !== 'path')
+ ) {
+ paths.set(child, child)
+ } else if (typeof child === 'object') {
+ visit(child, depth + 1)
+ }
+ }
+ }
+ visit(value, 0)
+ return paths
+}
+
+function blocked(reason: string) {
+ return {
+ label: 'Blocked by context selection',
+ result: `${reason}. Ask the user to enable the relevant folder or scope in Context before retrying.`
+ }
+}
diff --git a/frontend/src/lib/components/copilot/chat/contextSummary/FolderAccessTree.svelte b/frontend/src/lib/components/copilot/chat/contextSummary/FolderAccessTree.svelte
index c0a4c36bef..cc771f5634 100644
--- a/frontend/src/lib/components/copilot/chat/contextSummary/FolderAccessTree.svelte
+++ b/frontend/src/lib/components/copilot/chat/contextSummary/FolderAccessTree.svelte
@@ -6,7 +6,11 @@
import { scopeRecap, type AccessScope } from './folderAccess'
import type { FolderAccessState } from './folderAccessState.svelte'
- let { state, title = 'Context' }: { state: FolderAccessState; title?: string } = $props()
+ let {
+ state,
+ title = 'Context',
+ showHistoryNote = false
+ }: { state: FolderAccessState; title?: string; showHistoryNote?: boolean } = $props()
function scopeIcon(scope: AccessScope) {
if (scope.kind === 'personal') return UserRound
@@ -90,4 +94,9 @@
{/each}
+ {#if showHistoryNote}
+
+ Changes apply to future turns. Earlier messages remain in this session.
+
+ {/if}
diff --git a/frontend/src/lib/components/copilot/chat/contextSummary/folderAccess.ts b/frontend/src/lib/components/copilot/chat/contextSummary/folderAccess.ts
index 133be0b481..2c7f296509 100644
--- a/frontend/src/lib/components/copilot/chat/contextSummary/folderAccess.ts
+++ b/frontend/src/lib/components/copilot/chat/contextSummary/folderAccess.ts
@@ -17,7 +17,7 @@ export type AccessEntry = {
}
export type AccessScope = {
- id: string
+ id: 'personal' | 'workspace' | `folder:${string}`
kind: 'personal' | 'workspace' | 'folder'
name: string
path?: string
@@ -47,257 +47,6 @@ export const ACCESS_ENTRY_LABELS: Record = {
variable: 'Variable'
}
-const folderSpecs = [
- {
- name: 'Finance',
- slug: 'finance',
- subject: 'financial records',
- scriptCount: 8,
- flowCount: 5,
- appCount: 2
- },
- {
- name: 'Customer support',
- slug: 'customer_support',
- subject: 'support tickets',
- scriptCount: 7,
- flowCount: 6,
- appCount: 2
- },
- {
- name: 'Data platform',
- slug: 'data_platform',
- subject: 'datasets',
- scriptCount: 9,
- flowCount: 5,
- appCount: 2
- },
- {
- name: 'Engineering',
- slug: 'engineering',
- subject: 'releases',
- scriptCount: 8,
- flowCount: 5,
- appCount: 2
- },
- {
- name: 'Growth',
- slug: 'growth',
- subject: 'campaigns',
- scriptCount: 6,
- flowCount: 4,
- appCount: 2
- },
- {
- name: 'Operations',
- slug: 'operations',
- subject: 'orders',
- scriptCount: 9,
- flowCount: 6,
- appCount: 3
- },
- {
- name: 'People',
- slug: 'people',
- subject: 'employee onboarding',
- scriptCount: 5,
- flowCount: 4,
- appCount: 1
- }
-] as const
-
-function entry(
- folder: string,
- kind: AccessEntryKind,
- name: string,
- path: string,
- description: string
-): AccessEntry {
- return { id: `${folder}:${kind}:${path}`, kind, name, path, description }
-}
-
-function folderScope(spec: (typeof folderSpecs)[number], index: number): AccessScope {
- const { name, slug, subject, scriptCount, flowCount, appCount } = spec
- const entries: AccessEntry[] = [
- entry(
- slug,
- 'instruction',
- `${name} working agreement`,
- `f/${slug}/instructions`,
- `How the agent should handle ${subject} work.`
- ),
- entry(
- slug,
- 'skill',
- `${name} specialist`,
- `f/${slug}/skills/specialist`,
- `Domain guidance and repeatable procedures for ${subject}.`
- )
- ]
-
- const scriptNames = [
- `Import ${subject}`,
- `Normalize ${subject}`,
- `Sync ${subject} to warehouse`,
- `Validate ${subject}`,
- `Export ${subject} report`,
- `Archive stale ${subject}`,
- `Backfill ${subject}`,
- `Notify ${subject} owners`,
- `Reconcile ${subject}`
- ]
- const flowNames = [
- `${name} intake`,
- `${name} approval`,
- `${name} daily sync`,
- `${name} escalation`,
- `${name} weekly review`,
- `${name} lifecycle`
- ]
- const appNames = [`${name} dashboard`, `${name} operations console`, `${name} admin`]
-
- entries.push(
- ...scriptNames
- .slice(0, scriptCount)
- .map((label, itemIndex) =>
- entry(
- slug,
- 'script',
- label,
- `f/${slug}/scripts/${itemIndex + 1}`,
- `Processes ${subject} for the ${name.toLowerCase()} team.`
- )
- ),
- ...flowNames
- .slice(0, flowCount)
- .map((label, itemIndex) =>
- entry(
- slug,
- 'flow',
- label,
- `f/${slug}/flows/${itemIndex + 1}`,
- `Coordinates ${subject} across the team.`
- )
- ),
- ...appNames
- .slice(0, appCount)
- .map((label, itemIndex) =>
- entry(
- slug,
- 'app',
- label,
- `f/${slug}/apps/${itemIndex + 1}`,
- `Operational view for ${subject}.`
- )
- )
- )
- if (index % 3 !== 1) {
- entries.push(
- entry(
- slug,
- 'resource',
- `${name} database`,
- `$res:f/${slug}/database`,
- `Connection configuration used by this folder.`
- )
- )
- }
- if (index % 3 === 0) {
- entries.push(
- entry(
- slug,
- 'mcp',
- `${name} gateway`,
- `$res:f/${slug}/mcp_gateway`,
- `External tools scoped to ${subject}.`
- )
- )
- }
- if (index % 4 !== 2) {
- entries.push(
- entry(
- slug,
- 'variable',
- `${slug.toUpperCase()}_REGION`,
- `$var:f/${slug}/region`,
- `Default region for ${subject} operations.`
- )
- )
- }
-
- return {
- id: `folder:${slug}`,
- kind: 'folder',
- name,
- path: `f/${slug}`,
- description: `Everything the agent can use for ${subject}.`,
- entries: entries.sort((a, b) => a.name.localeCompare(b.name))
- }
-}
-
-const virtualScopes: AccessScope[] = [
- {
- id: 'personal',
- kind: 'personal',
- name: 'Personal',
- description: 'Preferences and guidance that apply only to you.',
- entries: [
- entry(
- 'personal',
- 'instruction',
- 'My working preferences',
- 'personal/instructions',
- 'Favor concise explanations and show proposed changes before applying them.'
- ),
- entry(
- 'personal',
- 'skill',
- 'My review checklist',
- 'personal/skills/review_checklist',
- 'A personal checklist for reviewing generated work.'
- )
- ]
- },
- {
- id: 'workspace',
- kind: 'workspace',
- name: 'Workspace-wide',
- description: 'Shared context available across every workspace folder.',
- entries: [
- entry(
- 'workspace',
- 'instruction',
- 'Workspace conventions',
- 'workspace/instructions',
- 'Shared naming, testing, and deployment conventions.'
- ),
- entry(
- 'workspace',
- 'skill',
- 'Windmill conventions',
- 'workspace/skills/windmill',
- 'Standard patterns for scripts, flows, apps, and resources.'
- ),
- entry(
- 'workspace',
- 'mcp',
- 'Documentation',
- '$res:u/admin/documentation_mcp',
- 'Searches internal product and engineering documentation.'
- ),
- entry(
- 'workspace',
- 'resource',
- 'Shared object storage',
- '$res:u/admin/object_storage',
- 'Workspace-wide object storage configuration.'
- )
- ].sort((a, b) => a.name.localeCompare(b.name))
- }
-]
-
-export const ACCESS_SCOPES: AccessScope[] = [...virtualScopes, ...folderSpecs.map(folderScope)]
-
export const WORKSPACE_ITEM_KINDS = new Set([
'script',
'flow',
@@ -320,7 +69,7 @@ export function scopeRecap(scope: AccessScope): string {
return `${count} ${label}${count === 1 ? '' : 's'}`
})
if (collapseItems) {
- parts.push(`${itemCounts.reduce((total, { count }) => total + count, 0)} items`)
+ parts.push(`${itemCounts.reduce((sum, { count }) => sum + count, 0)} items`)
}
return parts.join(' · ')
}
diff --git a/frontend/src/lib/components/copilot/chat/contextSummary/folderAccessState.svelte.ts b/frontend/src/lib/components/copilot/chat/contextSummary/folderAccessState.svelte.ts
index ec495c82ca..049fe327e6 100644
--- a/frontend/src/lib/components/copilot/chat/contextSummary/folderAccessState.svelte.ts
+++ b/frontend/src/lib/components/copilot/chat/contextSummary/folderAccessState.svelte.ts
@@ -1,14 +1,50 @@
-import { ACCESS_SCOPES, type AccessScope } from './folderAccess'
-import { isEditableFolderSelected, setEditableFolderSelected } from './selectedEditableFolders'
+import type { AccessScope } from './folderAccess'
+import type { AiSkillListItem } from '../global/core'
+import type { McpServer } from '../global/mcpTools'
+import { buildLiveAccessScopes, loadLiveAccessItems } from './liveFolderAccess'
+import { logFeatureUsage } from '$lib/utils/featureUsage'
+import {
+ isEditableFolderSelected,
+ setAllEditableFoldersSelected,
+ setEditableFolderSelected
+} from './selectedEditableFolders'
export class FolderAccessState {
private selectionVersion = $state(0)
+ private itemEntries = $state.raw([])
+ private itemRefreshId = 0
expanded = $state>({})
- constructor(private readonly workspace: () => string) {}
+ constructor(
+ private readonly workspace: () => string,
+ private readonly username: () => string,
+ private readonly folders: () => string[],
+ private readonly skills: () => AiSkillListItem[],
+ private readonly mcpServers: () => McpServer[],
+ private readonly onSelectionChange: () => void
+ ) {}
get scopes(): AccessScope[] {
- return ACCESS_SCOPES
+ return buildLiveAccessScopes(
+ this.username(),
+ this.folders(),
+ this.skills(),
+ this.mcpServers(),
+ this.itemEntries
+ )
+ }
+
+ async refreshItems(workspace = this.workspace()) {
+ const refreshId = ++this.itemRefreshId
+ try {
+ const entries = await loadLiveAccessItems(workspace)
+ if (refreshId === this.itemRefreshId && workspace === this.workspace()) {
+ this.itemEntries = entries
+ }
+ } catch (error) {
+ console.error('Failed to load AI context folder contents', error)
+ if (refreshId === this.itemRefreshId) this.itemEntries = []
+ }
}
isSelected(id: string): boolean {
@@ -25,15 +61,26 @@ export class FolderAccessState {
}
setSelected(id: string, value: boolean) {
- if (setEditableFolderSelected(this.workspace(), id, value)) this.selectionVersion++
+ if (setEditableFolderSelected(this.workspace(), id, value)) {
+ this.selectionVersion++
+ const selected = this.selectedScopes.length
+ logFeatureUsage('ai_session', 'context_scope_change', {
+ key: selected === 0 ? 'none' : selected === this.scopes.length ? 'all' : 'partial',
+ workspace: this.workspace()
+ })
+ this.onSelectionChange()
+ }
}
setAll(value: boolean) {
- let changed = false
- for (const scope of this.scopes) {
- changed = setEditableFolderSelected(this.workspace(), scope.id, value) || changed
+ if (setAllEditableFoldersSelected(this.workspace(), value)) {
+ this.selectionVersion++
+ logFeatureUsage('ai_session', 'context_scope_change', {
+ key: value ? 'all' : 'none',
+ workspace: this.workspace()
+ })
+ this.onSelectionChange()
}
- if (changed) this.selectionVersion++
}
toggleExpanded(id: string) {
diff --git a/frontend/src/lib/components/copilot/chat/contextSummary/liveFolderAccess.ts b/frontend/src/lib/components/copilot/chat/contextSummary/liveFolderAccess.ts
new file mode 100644
index 0000000000..c3e55f6f72
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/contextSummary/liveFolderAccess.ts
@@ -0,0 +1,89 @@
+import type { AiSkillListItem } from '../global/core'
+import type { McpServer } from '../global/mcpTools'
+import type { AccessEntry, AccessScope } from './folderAccess'
+import { scopeForWorkspacePath } from '../agentAccessPolicy'
+import { AppService, FlowService, ResourceService, ScriptService, VariableService } from '$lib/gen'
+
+function displayName(path: string): string {
+ return path.split('/').pop() ?? path
+}
+
+function entry(kind: AccessEntry['kind'], path: string): AccessEntry {
+ return {
+ id: `${kind}:${path}`,
+ kind,
+ name: displayName(path),
+ path,
+ description: ''
+ }
+}
+
+export function buildLiveAccessScopes(
+ username: string,
+ folders: string[],
+ skills: AiSkillListItem[],
+ mcpServers: McpServer[],
+ items: AccessEntry[] = []
+): AccessScope[] {
+ const scopes: AccessScope[] = [
+ {
+ id: 'personal',
+ kind: 'personal',
+ name: 'Personal',
+ description: 'Your items, skills, and personal instructions.',
+ entries: []
+ },
+ {
+ id: 'workspace',
+ kind: 'workspace',
+ name: 'Workspace-wide',
+ description: 'Shared context and workspace-level capabilities.',
+ entries: []
+ },
+ ...[...new Set(folders)].sort().map(
+ (name): AccessScope => ({
+ id: `folder:${name}`,
+ kind: 'folder',
+ name,
+ path: `f/${name}`,
+ description: `Items and AI context in f/${name}.`,
+ entries: []
+ })
+ )
+ ]
+ const byId = new Map(scopes.map((scope) => [scope.id, scope]))
+ for (const item of items) {
+ const scope = scopeForWorkspacePath(item.path, username)
+ if (scope) byId.get(scope)?.entries.push(item)
+ }
+ for (const skill of skills) {
+ const scope = scopeForWorkspacePath(skill.path, username)
+ if (scope) byId.get(scope)?.entries.push(entry('skill', skill.path))
+ }
+ for (const server of mcpServers) {
+ const scope = scopeForWorkspacePath(server.path, username)
+ if (scope) byId.get(scope)?.entries.push(entry('mcp', server.path))
+ }
+ for (const scope of scopes) scope.entries.sort((a, b) => a.name.localeCompare(b.name))
+ return scopes
+}
+
+export async function loadLiveAccessItems(workspace: string): Promise {
+ if (!workspace) return []
+ const [scripts, flows, apps, resources, variables] = await Promise.all([
+ ScriptService.listScripts({ workspace, perPage: 1000, withoutDescription: true }),
+ FlowService.listFlows({ workspace, perPage: 1000, withoutDescription: true }),
+ AppService.listApps({ workspace, perPage: 1000 }),
+ ResourceService.listResource({ workspace, perPage: 1000 }),
+ VariableService.listVariable({ workspace, perPage: 1000 })
+ ])
+ return [
+ ...scripts.map((item) => entry('script', item.path)),
+ ...flows.map((item) => entry('flow', item.path)),
+ ...apps.map((item) => entry('app', item.path)),
+ ...resources
+ .filter((item) => item.resource_type !== 'ai_skill' && item.resource_type !== 'mcp')
+ .map((item) => entry('resource', item.path)),
+ ...variables.map((item) => entry('variable', item.path))
+ ]
+}
diff --git a/frontend/src/lib/components/copilot/chat/contextSummary/selectedEditableFolders.test.ts b/frontend/src/lib/components/copilot/chat/contextSummary/selectedEditableFolders.test.ts
new file mode 100644
index 0000000000..9f849cc49e
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/contextSummary/selectedEditableFolders.test.ts
@@ -0,0 +1,51 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { session } = vi.hoisted(() => ({
+ session: { email: 'alice@windmill.dev' } as { email?: string }
+}))
+
+vi.mock('$lib/stores', () => ({
+ userStore: { subscribe: (run: (value: unknown) => void) => (run({ ...session }), () => {}) }
+}))
+
+import {
+ getAgentContextSelection,
+ isEditableFolderSelected,
+ setAllEditableFoldersSelected,
+ setEditableFolderSelected
+} from './selectedEditableFolders'
+
+describe('selected editable folders', () => {
+ beforeEach(() => {
+ localStorage.clear()
+ session.email = 'alice@windmill.dev'
+ })
+
+ it('selects new scopes by default in all mode', () => {
+ expect(isEditableFolderSelected('ws', 'folder:finance')).toBe(true)
+ setEditableFolderSelected('ws', 'folder:finance', false)
+ expect(isEditableFolderSelected('ws', 'folder:finance')).toBe(false)
+ expect(isEditableFolderSelected('ws', 'folder:new_team')).toBe(true)
+ })
+
+ it('keeps future scopes deselected after selecting none', () => {
+ setAllEditableFoldersSelected('ws', false)
+ setEditableFolderSelected('ws', 'folder:finance', true)
+ expect(isEditableFolderSelected('ws', 'folder:finance')).toBe(true)
+ expect(isEditableFolderSelected('ws', 'folder:new_team')).toBe(false)
+ })
+
+ it('migrates the prototype boolean map and remains scoped by account', () => {
+ localStorage.setItem(
+ 'wm_ai_editable_folders',
+ JSON.stringify({ 'ws:alice@windmill.dev': { personal: false, 'folder:finance': true } })
+ )
+ expect(getAgentContextSelection('ws')).toEqual({
+ version: 2,
+ baseline: 'selected',
+ overrides: ['personal']
+ })
+ session.email = 'bob@windmill.dev'
+ expect(isEditableFolderSelected('ws', 'personal')).toBe(true)
+ })
+})
diff --git a/frontend/src/lib/components/copilot/chat/contextSummary/selectedEditableFolders.ts b/frontend/src/lib/components/copilot/chat/contextSummary/selectedEditableFolders.ts
index d327e4a7d2..c3b64f2cb9 100644
--- a/frontend/src/lib/components/copilot/chat/contextSummary/selectedEditableFolders.ts
+++ b/frontend/src/lib/components/copilot/chat/contextSummary/selectedEditableFolders.ts
@@ -1,8 +1,116 @@
-import { createPathsPreference } from '../enabledPathsPreference'
+import { get } from 'svelte/store'
+import { userStore } from '$lib/stores'
-// No agent tool or prompt builder reads this preference: it only controls the
-// context-summary presentation and must not be interpreted as an access boundary.
-const preference = createPathsPreference('wm_ai_editable_folders', true)
+export type AgentScopeId = 'personal' | 'workspace' | `folder:${string}`
-export const isEditableFolderSelected = preference.isEnabled
-export const setEditableFolderSelected = preference.setEnabled
+export type AgentContextSelection = {
+ version: 2
+ baseline: 'selected' | 'deselected'
+ overrides: AgentScopeId[]
+}
+
+const STORAGE_KEY = 'wm_ai_editable_folders'
+const DEFAULT_SELECTION: AgentContextSelection = {
+ version: 2,
+ baseline: 'selected',
+ overrides: []
+}
+
+function storageScope(workspace: string): string | undefined {
+ const email = get(userStore)?.email
+ return email ? `${workspace}:${email}` : undefined
+}
+
+function readStorage(): Record {
+ if (typeof localStorage === 'undefined') return {}
+ try {
+ return JSON.parse(localStorage.getItem(STORAGE_KEY) ?? '{}')
+ } catch {
+ return {}
+ }
+}
+
+function isScopeId(value: string): value is AgentScopeId {
+ return value === 'personal' || value === 'workspace' || value.startsWith('folder:')
+}
+
+function normalizeSelection(raw: unknown): AgentContextSelection {
+ if (raw && typeof raw === 'object' && (raw as any).version === 2) {
+ const selection = raw as Partial
+ return {
+ version: 2,
+ baseline: selection.baseline === 'deselected' ? 'deselected' : 'selected',
+ overrides: Array.isArray(selection.overrides)
+ ? [
+ ...new Set(
+ selection.overrides.filter(
+ (value): value is AgentScopeId => typeof value === 'string' && isScopeId(value)
+ )
+ )
+ ]
+ : []
+ }
+ }
+
+ // The presentation prototype stored a boolean decision per scope. Preserve those
+ // decisions under the original selected-by-default semantics.
+ if (raw && typeof raw === 'object' && !Array.isArray(raw)) {
+ return {
+ version: 2,
+ baseline: 'selected',
+ overrides: Object.entries(raw)
+ .filter(([id, enabled]) => isScopeId(id) && enabled === false)
+ .map(([id]) => id as AgentScopeId)
+ }
+ }
+
+ return { ...DEFAULT_SELECTION }
+}
+
+export function getAgentContextSelection(workspace: string): AgentContextSelection {
+ const scope = storageScope(workspace)
+ return scope ? normalizeSelection(readStorage()[scope]) : { ...DEFAULT_SELECTION }
+}
+
+function writeSelection(workspace: string, selection: AgentContextSelection): boolean {
+ const scope = storageScope(workspace)
+ if (!scope) return false
+ const all = readStorage()
+ all[scope] = selection
+ try {
+ localStorage.setItem(STORAGE_KEY, JSON.stringify(all))
+ return true
+ } catch (error) {
+ console.error(`Failed to persist ${STORAGE_KEY}`, error)
+ return false
+ }
+}
+
+export function isEditableFolderSelected(workspace: string, id: string): boolean {
+ if (!isScopeId(id)) return false
+ const selection = getAgentContextSelection(workspace)
+ const baseline = selection.baseline === 'selected'
+ return selection.overrides.includes(id) ? !baseline : baseline
+}
+
+export function setEditableFolderSelected(
+ workspace: string,
+ id: string,
+ enabled: boolean
+): boolean {
+ if (!isScopeId(id)) return false
+ const selection = getAgentContextSelection(workspace)
+ const baseline = selection.baseline === 'selected'
+ const overrides = new Set(selection.overrides)
+ if (enabled === baseline) overrides.delete(id)
+ else overrides.add(id)
+ return writeSelection(workspace, { ...selection, overrides: [...overrides] })
+}
+
+export function setAllEditableFoldersSelected(workspace: string, enabled: boolean): boolean {
+ return writeSelection(workspace, {
+ version: 2,
+ baseline: enabled ? 'selected' : 'deselected',
+ overrides: []
+ })
+}
diff --git a/frontend/src/lib/components/copilot/chat/global/core.test.ts b/frontend/src/lib/components/copilot/chat/global/core.test.ts
index 876e178e31..c35c5518dd 100644
--- a/frontend/src/lib/components/copilot/chat/global/core.test.ts
+++ b/frontend/src/lib/components/copilot/chat/global/core.test.ts
@@ -1,4 +1,5 @@
import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { AgentAccessPolicy } from '../agentAccessPolicy'
vi.mock('monaco-editor', () => ({
editor: {},
@@ -7070,6 +7071,31 @@ describe('session-only preview tools gating', () => {
expect(content).not.toContain(WS_HEADER)
expect(content).not.toContain(USER_HEADER)
})
+
+ it('omits instructions and advertises only the selected session scopes', () => {
+ const accessPolicy = new AgentAccessPolicy('alice', {
+ version: 2,
+ baseline: 'deselected',
+ overrides: ['folder:finance']
+ })
+ const content = prepareGlobalSystemMessage(
+ { workspace: 'Workspace secret.', user: 'Personal preference.' },
+ {
+ user: {
+ username: 'alice',
+ folders: ['finance', 'people'],
+ folders_read: ['finance', 'people']
+ },
+ accessPolicy
+ }
+ ).content as string
+
+ expect(content).toContain('Only these scopes are selected: f/finance')
+ expect(content).not.toContain('Workspace secret.')
+ expect(content).not.toContain('Personal preference.')
+ expect(content).toContain('f/finance')
+ expect(content).not.toContain('f/people')
+ })
})
describe('read_skill', () => {
diff --git a/frontend/src/lib/components/copilot/chat/global/core.ts b/frontend/src/lib/components/copilot/chat/global/core.ts
index 6efcb58f98..9ead934dff 100644
--- a/frontend/src/lib/components/copilot/chat/global/core.ts
+++ b/frontend/src/lib/components/copilot/chat/global/core.ts
@@ -94,6 +94,8 @@ import {
} from '../flow/inlineScriptsUtils'
import { searchNpmPackagesTool } from '../script/core'
import type { McpServer } from './mcpTools'
+import type { AgentAccessPolicy } from '../agentAccessPolicy'
+import { setEditableFolderSelected } from '../contextSummary/selectedEditableFolders'
import { logFeatureUsage } from '$lib/utils/featureUsage'
import { isSkillEnabled } from '../skills/enabledSkills'
import {
@@ -315,6 +317,7 @@ export type GlobalActivePreviewContext = {
export type GlobalUserMessageOptions = {
workspace?: string
+ accessPolicy?: AgentAccessPolicy
activeEditor?: GlobalActiveEditorContext
activePreview?: GlobalActivePreviewContext
/** Images attached to this message; delivered as image_url content parts. */
@@ -1317,7 +1320,8 @@ const buildGlobalSystemPrompt = (
previewTools: boolean,
folderCtx?: FolderPromptContext,
skills: AiSkillListItem[] = [],
- mcpServers: McpServer[] = []
+ mcpServers: McpServer[] = [],
+ accessPolicy?: AgentAccessPolicy
) => {
const folderGuidance = buildFolderGuidance(username, folderCtx)
const folderGuidanceBlock = folderGuidance ? `\n${folderGuidance}` : ''
@@ -1347,7 +1351,11 @@ const buildGlobalSystemPrompt = (
}. Use that to judge whether a feature is available before promising it.`
: ''
- return `You are Windmill's global workspace assistant.
+ const accessPolicyBlock = accessPolicy
+ ? `\n\nSession context selection:\n- ${accessPolicy.promptSummary()}\n- Treat this selection as authoritative. Never ask a tool to read, modify, run, or preview an item outside it. When listing workspace items under a restricted selection, pass a selected path_prefix. If access is blocked, ask the user to enable that scope in Context.`
+ : ''
+
+ return `You are Windmill's global workspace assistant.${accessPolicyBlock}
The current user's workspace username is "${username}".${instanceLine}
@@ -3389,7 +3397,7 @@ export const globalTools: Tool<{}>[] = [
'List workspace items and drafts. Returns metadata only, up to limit items per item type per page (default 50); pass page to continue past a full page.'
),
planModeSafe: true,
- fn: async ({ args, workspace, toolId, toolCallbacks }) => {
+ fn: async ({ args, workspace, helpers, toolId, toolCallbacks }) => {
const parsed = listWorkspaceItemsSchema.parse(args)
const types = getRequestedTypes(parsed.types)
const limit = parsed.limit ?? 50
@@ -3438,7 +3446,9 @@ export const globalTools: Tool<{}>[] = [
// No cross-type truncation: each type is already capped at `limit` rows by
// its own list call, and slicing the concatenation would silently drop the
// later types' rows while their next page skips past them.
- const results = Array.from(byKey.values()).filter((item) => itemMatches(item, parsed.query))
+ let results = Array.from(byKey.values()).filter((item) => itemMatches(item, parsed.query))
+ const accessPolicy = (helpers as GlobalToolHelpers).agentAccessPolicy
+ if (accessPolicy) results = accessPolicy.filterPaths(results, (item) => item.path)
toolCallbacks.setToolStatus(toolId, {
content: `Listed ${results.length} workspace item(s)`
@@ -3494,7 +3504,7 @@ export const globalTools: Tool<{}>[] = [
requiresConfirmation: true,
confirmationMessage: 'Create folder',
showDetails: true,
- fn: async ({ args, workspace, toolId, toolCallbacks }) => {
+ fn: async ({ args, workspace, helpers, toolId, toolCallbacks }) => {
const parsed = createFolderSchema.parse(args)
if (!VALID_FOLDER_NAME.test(parsed.name)) {
const error =
@@ -3517,6 +3527,9 @@ export const globalTools: Tool<{}>[] = [
if (!user.folders) user.folders = []
if (!user.folders.includes(parsed.name)) user.folders.push(parsed.name)
}
+ const accessPolicy = (helpers as GlobalToolHelpers).agentAccessPolicy
+ accessPolicy?.grantCreatedFolder(parsed.name)
+ setEditableFolderSelected(workspace, `folder:${parsed.name}`, true)
const message = `Created folder \`f/${parsed.name}\`. You can now write items to \`f/${parsed.name}/\`.`
toolCallbacks.setToolStatus(toolId, { content: message })
return JSON.stringify({ success: true, message })
@@ -4420,6 +4433,7 @@ type WriteDraftCtx = {
export type SessionToolHelpers = { sessionId?: string }
export type GlobalToolHelpers = SessionToolHelpers & {
+ agentAccessPolicy?: AgentAccessPolicy
/** Runs the flow editor mounted on `storagePath`, if one is. `memoryId` names the
* chat-mode conversation the turn belongs to. */
testActiveFlow?: (
@@ -7695,9 +7709,13 @@ async function diffSearch(
if (failedPaths.length > 0) {
unflushedNote += `\nWarning: ${failedPaths.length === 1 ? 'this diff' : 'these diffs'} could not be computed and ${failedPaths.length === 1 ? 'was' : 'were'} NOT searched (matches may be missing): ${failedPaths.join(', ')}. Retry, or read the item${failedPaths.length === 1 ? '' : 's'} directly for the error.`
}
- const filtered = args.file_glob
- ? units.filter((u) => appFileMatchesGlob(u.subject, args.file_glob as string))
+ const accessPolicy = (ctx.helpers as GlobalToolHelpers).agentAccessPolicy
+ const accessibleUnits = accessPolicy
+ ? units.filter((unit) => accessPolicy.allows({ kind: 'workspace_path', path: unit.subject }))
: units
+ const filtered = args.file_glob
+ ? accessibleUnits.filter((u) => appFileMatchesGlob(u.subject, args.file_glob as string))
+ : accessibleUnits
const needle = query.toLowerCase()
const maxMatches = Math.min(
@@ -8327,28 +8345,44 @@ export function prepareGlobalSystemMessage(
user?: GlobalPromptIdentity
skills?: AiSkillListItem[]
mcpServers?: McpServer[]
+ accessPolicy?: AgentAccessPolicy
}
): ChatCompletionSystemMessageParam {
const user = opts?.user ?? get(userStore)
const username = user?.username ?? ''
- const folderCtx: FolderPromptContext | undefined = user
+ let folderCtx: FolderPromptContext | undefined = user
? {
folders: user.folders,
foldersRead: user.folders_read ?? user.folders,
isAdmin: user.is_admin ?? false
}
: undefined
+ if (folderCtx && opts?.accessPolicy) {
+ folderCtx = {
+ ...folderCtx,
+ folders: folderCtx.folders?.filter((folder) =>
+ opts.accessPolicy!.allows({ kind: 'workspace_path', path: `f/${folder}/item` })
+ ),
+ foldersRead: folderCtx.foldersRead?.filter((folder) =>
+ opts.accessPolicy!.allows({ kind: 'workspace_path', path: `f/${folder}/item` })
+ )
+ }
+ }
let content = buildGlobalSystemPrompt(
username,
opts?.previewTools ?? false,
folderCtx,
opts?.skills ?? [],
- opts?.mcpServers ?? []
+ opts?.mcpServers ?? [],
+ opts?.accessPolicy
)
- if (instructions?.workspace?.trim()) {
+ if (
+ instructions?.workspace?.trim() &&
+ opts?.accessPolicy?.isScopeSelected('workspace') !== false
+ ) {
content = `${content}\n\nWORKSPACE INSTRUCTIONS (configured by a workspace admin, shared by everyone in this workspace — you cannot modify these):\n${instructions.workspace.trim()}`
}
- if (instructions?.user?.trim()) {
+ if (instructions?.user?.trim() && opts?.accessPolicy?.isScopeSelected('personal') !== false) {
content = `${content}\n\nUSER INSTRUCTIONS (this user's personal instructions — update them with the update_user_instructions tool when the user asks you to remember, change, or stop something):\n${instructions.user.trim()}`
}
@@ -8375,15 +8409,27 @@ export function prepareGlobalUserMessage(
selectedContext: ContextElement[] = [],
options: GlobalUserMessageOptions = {}
): ChatCompletionUserMessageParam {
- const selectedWorkspaceItems = selectedContext.filter(
- (context) =>
- context.type === 'workspace_script' ||
- context.type === 'workspace_flow' ||
- context.type === 'workspace_app'
- )
- const activeEditor =
+ const selectedWorkspaceItems = selectedContext
+ .filter(
+ (context) =>
+ context.type === 'workspace_script' ||
+ context.type === 'workspace_flow' ||
+ context.type === 'workspace_app'
+ )
+ .filter(
+ (context) =>
+ !options.accessPolicy ||
+ options.accessPolicy.allows({ kind: 'workspace_path', path: context.path })
+ )
+ const resolvedActiveEditor =
options.activeEditor ??
(options.workspace ? getActiveGlobalEditorContext(options.workspace) : undefined)
+ const activeEditor =
+ resolvedActiveEditor &&
+ (!options.accessPolicy ||
+ options.accessPolicy.allows({ kind: 'workspace_path', path: resolvedActiveEditor.path }))
+ ? resolvedActiveEditor
+ : undefined
let content = ''
if (activeEditor) {
@@ -8393,7 +8439,12 @@ export function prepareGlobalUserMessage(
content += `isLiveDraft: true\n\n`
}
- if (options.activePreview) {
+ if (
+ options.activePreview &&
+ (!options.activePreview.open ||
+ !options.accessPolicy ||
+ options.accessPolicy.allows({ kind: 'workspace_path', path: options.activePreview.open }))
+ ) {
content += '## ACTIVE PREVIEW\n'
content += `page: ${options.activePreview.label}\n`
content += `location: ${options.activePreview.location}\n`
diff --git a/frontend/src/lib/components/copilot/chat/shared.test.ts b/frontend/src/lib/components/copilot/chat/shared.test.ts
index 768b6d1b65..d1f8706089 100644
--- a/frontend/src/lib/components/copilot/chat/shared.test.ts
+++ b/frontend/src/lib/components/copilot/chat/shared.test.ts
@@ -205,6 +205,47 @@ describe('buildContextString', () => {
})
describe('processToolCall', () => {
+ it('blocks a deselected folder before confirmation or execution', async () => {
+ const { AgentAccessPolicy } = await import('./agentAccessPolicy')
+ const { createToolDef, processToolCall } = await import('./shared')
+ const fn = vi.fn()
+ const requestConfirmation = vi.fn()
+ const result = await processToolCall({
+ tools: [
+ {
+ def: createToolDef(z.object({ path: z.string() }), 'delete_workspace_item', 'Delete'),
+ requiresConfirmation: true,
+ fn
+ }
+ ],
+ toolCall: {
+ id: 'blocked_call',
+ type: 'function',
+ function: {
+ name: 'delete_workspace_item',
+ arguments: JSON.stringify({ path: 'f/people/payroll' })
+ }
+ },
+ helpers: {
+ agentAccessPolicy: new AgentAccessPolicy('alice', {
+ version: 2,
+ baseline: 'deselected',
+ overrides: ['folder:finance']
+ })
+ },
+ workspace: 'test-workspace',
+ toolCallbacks: {
+ setToolStatus: vi.fn(),
+ removeToolStatus: vi.fn(),
+ requestConfirmation
+ }
+ })
+
+ expect(requestConfirmation).not.toHaveBeenCalled()
+ expect(fn).not.toHaveBeenCalled()
+ expect(result.content).toContain('does not include f/people/payroll')
+ })
+
it('returns pre-confirmation validation errors without asking for confirmation', async () => {
const { createToolDef, processToolCall } = await import('./shared')
const error = 'the script needs to be deployed before doing this action'
diff --git a/frontend/src/lib/components/copilot/chat/shared.ts b/frontend/src/lib/components/copilot/chat/shared.ts
index dd84e479de..1d1fda292f 100644
--- a/frontend/src/lib/components/copilot/chat/shared.ts
+++ b/frontend/src/lib/components/copilot/chat/shared.ts
@@ -59,6 +59,7 @@ import { forLater } from '$lib/forLater'
import { scriptLangToEditorLang } from '$lib/scripts'
import { getCurrentModel } from '$lib/aiStore'
import { type editor as meditor } from 'monaco-editor'
+import { toolAccessRejection } from './agentAccessPolicy'
// Prettify function for code arguments - extracts and formats code from JSON
function prettifyCodeArguments(content: string): string {
@@ -968,7 +969,10 @@ export async function processToolCall({
}
const rejection = normalizeToolRejection(
- await tool?.validateBeforeConfirmation?.({ args, workspace: workspaceId, helpers })
+ tool
+ ? (toolAccessRejection(tool.def.function.name, args, helpers) ??
+ (await tool.validateBeforeConfirmation?.({ args, workspace: workspaceId, helpers })))
+ : undefined
)
if (rejection) {
logToolOutcome('rejected')