From 772fafec8316a1e0c0e76b9a0737cc41d40a9a8c Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Wed, 2 Sep 2026 00:57:44 +0200
Subject: [PATCH 01/31] feat: make the home Build with AI composer dismissible,
 quiet the rest of the home page (#10930)

* feat: let the home Build with AI composer be dismissed, and hide it in locked workspaces

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QjJhxHHqRqyEX7HsbPjetn

* style: quiet the home tutorial banner down to an inline row

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QjJhxHHqRqyEX7HsbPjetn

* style: enlarge the empty home page state

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QjJhxHHqRqyEX7HsbPjetn

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .../lib/components/common/CloseButton.svelte  |   5 +-
 .../src/lib/components/home/HomeAIChat.svelte | 177 ++++++++++++------
 .../lib/components/home/NoItemFound.svelte    |   2 +-
 .../lib/components/home/TutorialBanner.svelte |  62 +++---
 .../src/routes/(root)/(logged)/+page.svelte   |  11 +-
 5 files changed, 150 insertions(+), 107 deletions(-)

diff --git a/frontend/src/lib/components/common/CloseButton.svelte b/frontend/src/lib/components/common/CloseButton.svelte
index d7d0a58a7b..264e478721 100644
--- a/frontend/src/lib/components/common/CloseButton.svelte
+++ b/frontend/src/lib/components/common/CloseButton.svelte
@@ -10,10 +10,12 @@
 		Icon?: any | undefined
 		class?: string
 		id?: string | undefined
+		/** Names the button: it has no text, so without this it reads as "button" to a screen reader. */
+		title?: string | undefined
 		onClick?: () => void | undefined | any
 	}
 
-	let { noBg = false, small = false, Icon, class: className, id, onClick }: Props = $props()
+	let { noBg = false, small = false, Icon, class: className, id, title, onClick }: Props = $props()
 
 	const dispatch = createEventDispatcher()
 </script>
@@ -22,6 +24,7 @@
 	on:click={() => (dispatch('close'), onClick?.())}
 	on:pointerdown={(e) => e.stopPropagation()}
 	{id}
+	{title}
 	startIcon={{ icon: Icon ?? X }}
 	iconOnly
 	unifiedSize="sm"
diff --git a/frontend/src/lib/components/home/HomeAIChat.svelte b/frontend/src/lib/components/home/HomeAIChat.svelte
index d0e75538ca..41c2930596 100644
--- a/frontend/src/lib/components/home/HomeAIChat.svelte
+++ b/frontend/src/lib/components/home/HomeAIChat.svelte
@@ -20,24 +20,46 @@
 
 <script lang="ts">
 	import TextInput from '$lib/components/text_input/TextInput.svelte'
-	import { ArrowUp, ExternalLink, Globe2, KeyRound, PlugZap, Settings } from 'lucide-svelte'
+	import {
+		ArrowUp,
+		ExternalLink,
+		Globe2,
+		KeyRound,
+		PlugZap,
+		Settings,
+		WandSparkles
+	} from 'lucide-svelte'
 	import Button from '../common/button/Button.svelte'
 	import { Badge } from '../common'
+	import CloseButton from '../common/CloseButton.svelte'
 	import { startSessionWithPrompt } from '../sessions/sessionSwitch.svelte'
 	import { copilotInfo, copilotWorkspace } from '$lib/aiStore'
 	import { loadCopilot } from '$lib/components/copilot/loadCopilot'
 	import { aiUserDisabled, hubBaseUrlStore, userStore, workspaceStore } from '$lib/stores'
 	import { HOME_SHOW_HUB } from '$lib/consts'
 	import { base } from '$lib/base'
+	import { getLocalSetting, storeLocalSetting } from '$lib/utils'
+	import { isRuleActive } from '$lib/workspaceProtectionRules.svelte'
+	import { BROWSER } from 'esm-env'
 	import AIChatModelSettings from '../copilot/chat/AIChatModelSettings.svelte'
 	import HomeConnectDrawer from './HomeConnectDrawer.svelte'
 	import { USER_SETTINGS_HASH } from '../sidebar/settings'
 	import { prefersSessionHandoff } from '../copilot/chat/global/gate'
 
+	const COLLAPSED_SETTING = 'home-ai-composer-collapsed'
+
 	let value = $state('')
 	let placeholder = $state('')
 	let homeConnectDrawer: HomeConnectDrawer | undefined = $state(undefined)
 
+	// How much of the home page this reader wants the composer to take, so it lives per browser
+	// rather than per workspace or account.
+	let collapsed = $state(BROWSER && getLocalSetting(COLLAPSED_SETTING) === 'true')
+	function setCollapsed(next: boolean) {
+		collapsed = next
+		storeLocalSetting(COLLAPSED_SETTING, next ? 'true' : undefined)
+	}
+
 	// In global-AI mode the layout's chat panel is disabled and never loads the copilot
 	// config, so the home chat loads it for the current workspace itself.
 	$effect(() => {
@@ -48,10 +70,9 @@
 
 	// Whether the copilot config has actually loaded for the current workspace.
 	let configLoaded = $derived($copilotWorkspace === $workspaceStore)
-	// No usable model (no provider configured, or AI disabled): the composer is blurred and an
-	// overlay explains why and links to the fix. Static, not hover-gated, so keyboard and touch
-	// users see it too. Gate on `configLoaded` so the initial (unloaded) state doesn't flash the
-	// overlay while a provider is in fact configured.
+	// No usable model (no provider configured, or AI disabled): the input is blurred and an overlay
+	// explains why and links to the fix. Gate on `configLoaded` so the initial (unloaded) state
+	// doesn't flash the overlay while a provider is in fact configured.
 	let disabled = $derived(configLoaded && !$copilotInfo.enabled)
 	// Submission is stricter than the overlay: block it until the config is loaded AND
 	// enabled. Submitting during the unknown-config window hands the prompt to a session
@@ -59,17 +80,27 @@
 	// workspace that never happens and the prompt is silently lost.
 	let canSend = $derived(configLoaded && $copilotInfo.enabled)
 
-	// Applied to the AI-specific parts only (title, input, example tags) when disabled. The
-	// CLI/MCP and Hub buttons are unrelated to AI and stay sharp and clickable.
+	// The input alone: what the overlay covers and the one part a missing provider makes unusable.
 	let blurClass = $derived(disabled ? 'blur-sm pointer-events-none select-none' : '')
 
 	// Disabled because the user spent their free Windmill AI grant, not because AI was never
 	// set up — the two look identical otherwise, and the "configure AI" copy would be a lie.
 	let freeTierExhausted = $derived($copilotInfo.freeTier?.exhausted === true)
 
+	// A workspace locked against direct deployment is run, not authored in, so its home page drops
+	// the composer and the button to reopen it. This is about the workspace, not the caller:
+	// `createSession` would steer a prompt into the paired dev workspace and an admin bypasses the
+	// lock outright, yet neither makes prod the place to start one. Unresolved rules read as
+	// unlocked, so the far commoner unlocked workspace never pops the composer in mid-load.
+	let runOnlyWorkspace = $derived(isRuleActive('DisableDirectDeployment'))
+
 	// The composer hands off to /sessions, which refuses operators — so hide it from them (the
 	// prompt would be silently dropped) while the AI-independent CLI/MCP row below stays.
-	let showComposer = $derived(prefersSessionHandoff($userStore?.operator))
+	let showComposer = $derived(prefersSessionHandoff($userStore?.operator) && !runOnlyWorkspace)
+
+	// The hero's margins are for the full block; around the lone button row left by a collapsed,
+	// operator or run-only view they would just be empty page.
+	let outerSpacing = $derived(showComposer && !collapsed ? 'mt-20 mb-16' : 'mt-8 mb-2')
 
 	let starting = $state(false)
 	async function start() {
@@ -100,7 +131,7 @@
 	// Typewriter effect: type a prompt out, hold, delete, then advance to the next. Only while the
 	// composer is shown — otherwise (operators) it would loop forever driving an unrendered input.
 	$effect(() => {
-		if (!showComposer) return
+		if (!showComposer || collapsed) return
 		let promptIndex = 0
 		let charIndex = 0
 		let deleting = false
@@ -135,17 +166,26 @@
 	})
 </script>
 
-<div class="w-full flex justify-center">
+<div class="w-full flex justify-center {outerSpacing}">
 	<div class="max-w-[40rem] grow relative group">
-		{#if showComposer}
-			<div class={blurClass} inert={disabled}>
-				<div class="flex items-center justify-center gap-2 mb-4">
-					<p class="text-center font-regular text-3xl">Build with AI</p>
-					<Badge color="blue" small>Beta</Badge>
+		{#if showComposer && !collapsed}
+			{#if !disabled}
+				<!-- The one dismiss control while the composer is usable; the overlay below carries its
+				     own once it takes over, so the two never show at the same time. -->
+				<div class="absolute right-0 top-0 z-20">
+					<CloseButton small noBg title="Hide Build with AI" onClick={() => setCollapsed(true)} />
 				</div>
-				<!-- anchors the send button / model settings to the input, not to the whole
-				     block — the row below would otherwise push them down -->
-				<div class="relative">
+			{/if}
+			<div class="flex items-center justify-center gap-2 mb-4">
+				<p class="text-center font-regular text-3xl">Build with AI</p>
+				<Badge color="blue" small>Beta</Badge>
+			</div>
+			<!-- Anchors the send button / model settings to the input, not to the whole block — the row
+			     below would otherwise push them down. The inner wrapper stays `relative` in both
+			     states: `blur-sm` is a filter, which makes an element the containing block for its
+			     absolutely positioned children, so those two would shift when the blur turns on. -->
+			<div class="relative">
+				<div class="relative {blurClass}" inert={disabled}>
 					<TextInput
 						bind:value
 						class="resize-none px-4 py-3 pb-9 shadow-sm border-accent"
@@ -165,12 +205,56 @@
 						<AIChatModelSettings />
 					</div>
 				</div>
+				{#if disabled}
+					<!-- Covers the input alone: the title, the example prompts and the CLI/MCP row are all
+					     still legible and usable without a provider. Static, not hover-gated, so keyboard
+					     and touch users see it too. -->
+					<div
+						class="absolute inset-0 z-10 flex flex-col items-center justify-center gap-2 rounded-md bg-surface/70"
+					>
+						<p class="text-sm text-secondary">
+							{#if $aiUserDisabled}
+								Windmill AI is disabled in your account settings
+							{:else if freeTierExhausted}
+								You have used all of your free Windmill AI tokens
+							{:else}
+								No AI provider is configured
+							{/if}
+						</p>
+						<div class="flex items-center gap-2">
+							{#if $aiUserDisabled}
+								<!-- The fix lives in account settings (a hash-opened drawer, not a route), so link
+								     the hash the sidebar's Account menu uses rather than the workspace AI settings. -->
+								<Button
+									unifiedSize="sm"
+									variant="accent"
+									startIcon={{ icon: Settings }}
+									href={USER_SETTINGS_HASH}
+								>
+									Open account settings
+								</Button>
+							{:else}
+								<Button
+									unifiedSize="sm"
+									variant="accent"
+									startIcon={{ icon: freeTierExhausted ? KeyRound : Settings }}
+									href="{base}/workspace_settings?tab=ai"
+								>
+									{freeTierExhausted ? 'Add your own API key' : 'Configure AI'}
+								</Button>
+							{/if}
+							<Button unifiedSize="sm" variant="default" onClick={() => setCollapsed(true)}>
+								Hide
+							</Button>
+						</div>
+					</div>
+				{/if}
 			</div>
 		{/if}
 
 		<div class="flex items-center justify-between gap-2">
-			{#if showComposer}
-				<div class="flex flex-row flex-wrap items-center gap-1.5 {blurClass}" inert={disabled}>
+			{#if showComposer && !collapsed}
+				<div class="flex flex-row flex-wrap items-center gap-1.5">
 					{#each homeAIExamples as example (example.label)}
 						<Button
 							variant="default"
@@ -182,13 +266,24 @@
 						</Button>
 					{/each}
 				</div>
+			{:else if showComposer}
+				<!-- All that is left of the composer once dismissed: sits with the CLI/MCP row so the
+				     collapsed home page is one quiet line. -->
+				<Button
+					variant="subtle"
+					unifiedSize="xs"
+					btnClasses="!text-2xs !text-hint"
+					startIcon={{ icon: WandSparkles }}
+					onClick={() => setCollapsed(false)}
+				>
+					Build with AI
+				</Button>
 			{:else}
 				<div></div>
 			{/if}
 
-			<!-- Not AI-related, so shown even to operators / when the composer is hidden: kept out of
-			     the blurred subtree and above the disabled overlay so it stays sharp and clickable. -->
-			<div class="relative z-20 flex flex-row items-center gap-1">
+			<!-- Not AI-related, so shown even to operators / when the composer is hidden. -->
+			<div class="flex flex-row items-center gap-1">
 				<Button
 					variant="subtle"
 					unifiedSize="xs"
@@ -213,42 +308,6 @@
 				{/if}
 			</div>
 		</div>
-		{#if showComposer && disabled}
-			<div
-				class="absolute inset-0 z-10 flex flex-col items-center justify-center gap-2 rounded-md bg-surface/70"
-			>
-				<p class="text-sm text-secondary">
-					{#if $aiUserDisabled}
-						Windmill AI is disabled in your account settings
-					{:else if freeTierExhausted}
-						You have used all of your free Windmill AI tokens
-					{:else}
-						No AI provider is configured
-					{/if}
-				</p>
-				{#if $aiUserDisabled}
-					<!-- The fix lives in account settings (a hash-opened drawer, not a route), so link
-					     the hash the sidebar's Account menu uses rather than the workspace AI settings. -->
-					<Button
-						unifiedSize="sm"
-						variant="accent"
-						startIcon={{ icon: Settings }}
-						href={USER_SETTINGS_HASH}
-					>
-						Open account settings
-					</Button>
-				{:else}
-					<Button
-						unifiedSize="sm"
-						variant="accent"
-						startIcon={{ icon: freeTierExhausted ? KeyRound : Settings }}
-						href="{base}/workspace_settings?tab=ai"
-					>
-						{freeTierExhausted ? 'Add your own API key' : 'Configure AI'}
-					</Button>
-				{/if}
-			</div>
-		{/if}
 	</div>
 </div>
 
diff --git a/frontend/src/lib/components/home/NoItemFound.svelte b/frontend/src/lib/components/home/NoItemFound.svelte
index ea90c8dd0d..94d6dfa1b8 100644
--- a/frontend/src/lib/components/home/NoItemFound.svelte
+++ b/frontend/src/lib/components/home/NoItemFound.svelte
@@ -30,7 +30,7 @@
 {:else}
 	<div class="flex justify-center items-center h-48">
 		<div class="text-primary text-center">
-			<div class="text-xs font-normal text-hint">
+			<div class="text-lg font-normal text-hint">
 				Get started by creating your first script, flow, or app
 			</div>
 		</div>
diff --git a/frontend/src/lib/components/home/TutorialBanner.svelte b/frontend/src/lib/components/home/TutorialBanner.svelte
index 14d8b750c1..ef7b30c27e 100644
--- a/frontend/src/lib/components/home/TutorialBanner.svelte
+++ b/frontend/src/lib/components/home/TutorialBanner.svelte
@@ -1,6 +1,7 @@
 <script lang="ts">
 	import { Button } from '$lib/components/common'
-	import { GraduationCap, X } from 'lucide-svelte'
+	import CloseButton from '$lib/components/common/CloseButton.svelte'
+	import { GraduationCap } from 'lucide-svelte'
 	import { base } from '$lib/base'
 	import { goto } from '$app/navigation'
 	import { sendUserToast, type ToastAction } from '$lib/toast'
@@ -153,44 +154,25 @@
 </script>
 
 {#if !isDismissed}
-	<div
-		class="flex items-center justify-between gap-4 px-4 py-3 rounded-lg border border-light bg-surface-tertiary mb-4"
-	>
-		<div class="flex items-center gap-3 flex-1 min-w-0">
-			<GraduationCap size={20} class="text-accent-primary flex-shrink-0" />
-			<div class="flex-1 min-w-0">
-				<div class="text-emphasis flex-wrap text-left text-xs font-semibold">
-					{#if hasCompletedAny}
-						New tutorial available!
-					{:else}
-						Learn with interactive tutorials
-					{/if}
-				</div>
-				<div class="text-hint text-3xs truncate text-left font-normal">
-					{#if hasCompletedAny}
-						Continue your learning journey and master new Windmill skills.
-					{:else}
-						Get started quickly with step-by-step guides on building flows, scripts, and more.
-					{/if}
-				</div>
-			</div>
-		</div>
-		<div class="flex items-center gap-2 flex-shrink-0">
-			<Button
-				size="xs"
-				variant="accent"
-				onclick={goToTutorials}
-				startIcon={{ icon: GraduationCap }}
-			>
-				View tutorials
-			</Button>
-			<button
-				onclick={dismissBanner}
-				class="p-1.5 rounded hover:bg-surface-hover text-secondary hover:text-primary transition-colors"
-				aria-label="Dismiss tutorial banner"
-			>
-				<X size={16} />
-			</button>
-		</div>
+	<!-- A standing invitation, not an announcement: it sits inline at the start of the row rather
+	     than filling the page, so it reads as one more control and not as a card the user has to
+	     dispatch before getting to their work. -->
+	<div class="flex items-center gap-2 mt-4 mb-4">
+		<span class="text-hint text-xs truncate min-w-0">
+			{#if hasCompletedAny}
+				New tutorial available!
+			{:else}
+				First time?
+			{/if}
+		</span>
+		<Button
+			unifiedSize="sm"
+			variant="default"
+			onclick={goToTutorials}
+			startIcon={{ icon: GraduationCap }}
+		>
+			Tutorials
+		</Button>
+		<CloseButton small noBg title="Dismiss tutorial banner" onClick={dismissBanner} />
 	</div>
 {/if}
diff --git a/frontend/src/routes/(root)/(logged)/+page.svelte b/frontend/src/routes/(root)/(logged)/+page.svelte
index 38189c22ce..5e9bda4e2c 100644
--- a/frontend/src/routes/(root)/(logged)/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/+page.svelte
@@ -263,13 +263,14 @@
 	<ForkWorkspaceBanner />
 	<WorkspaceDraftsBanner />
 	<div class="max-w-7xl px-4 sm:px-8 md:px-8 h-fit w-full mb-6">
+		<TutorialBanner />
+
 		<!-- HomeAIChat carries both the AI composer and the AI-independent CLI/MCP connect row,
 		     so it shows whenever the sessions beta is on; the composer itself is gated on operator
-		     status inside the component (operators are refused by /sessions). -->
+		     status and on the workspace inside the component, which owns its own vertical spacing
+		     because the hero and the bare connect row want different amounts of it. -->
 		{#if isGlobalAiEnabled()}
-			<div class="w-full mb-16 mt-20">
-				<HomeAIChat />
-			</div>
+			<HomeAIChat />
 		{/if}
 
 		{#if $workspaceStore == 'admins'}
@@ -280,8 +281,6 @@
 			<div class="my-4"></div>
 		{/if}
 
-		<TutorialBanner />
-
 		<NoDirectDeployAlert onUpdateCanEditStatus={(v) => (showCreateButtons = v)} />
 
 		{#if tab == 'hub'}

From 74c1813f983f12d9cb4093b93685ee3a30163aaa Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Wed, 2 Sep 2026 01:01:01 +0200
Subject: [PATCH 02/31] chore(main): release 1.801.0 (#10921)

* chore(main): release 1.801.0

* Apply automatic changes

---------

Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com>
---
 .release-please-manifest.json                 |   2 +-
 CHANGELOG.md                                  |  17 ++
 backend/Cargo.lock                            | 179 +++++++++---------
 backend/Cargo.toml                            |   4 +-
 .../parsers/windmill-parser-wasm/Cargo.lock   |  48 ++---
 .../parsers/windmill-parser-wasm/Cargo.toml   |   2 +-
 backend/windmill-api/openapi.yaml             |   2 +-
 benchmarks/lib.ts                             |   2 +-
 cli/src/core/constants.ts                     |   2 +-
 frontend/package-lock.json                    |   4 +-
 frontend/package.json                         |   2 +-
 lsp/Pipfile                                   |   2 +-
 openflow.openapi.yaml                         |   2 +-
 .../WindmillClient/WindmillClient.psd1        |   2 +-
 python-client/wmill/pyproject.toml            |   2 +-
 typescript-client/jsr.json                    |   2 +-
 typescript-client/package.json                |   2 +-
 version.txt                                   |   2 +-
 windmill-yaml-validator/package-lock.json     |   4 +-
 windmill-yaml-validator/package.json          |   2 +-
 20 files changed, 151 insertions(+), 133 deletions(-)

diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index ab80d05f6b..238a566433 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "1.800.1"
+  ".": "1.801.0"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2cc8ecb481..2a7512989f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,22 @@
 # Changelog
 
+## [1.801.0](https://github.com/windmill-labs/windmill/compare/v1.800.1...v1.801.0) (2026-09-01)
+
+
+### Features
+
+* **ai-chat:** make reusable skills ai_skill resources you select per workspace ([#10914](https://github.com/windmill-labs/windmill/issues/10914)) ([cfcfe29](https://github.com/windmill-labs/windmill/commit/cfcfe298dd9ab50196bd64926ef78c4563f58c2c))
+* **ai-sessions:** show a running session across tabs and reload finished turns ([#10916](https://github.com/windmill-labs/windmill/issues/10916)) ([816dc9d](https://github.com/windmill-labs/windmill/commit/816dc9dcd2c310e499d2d210a0abcd403469f29c))
+* edit folders and groups in a drawer that saves once ([#10873](https://github.com/windmill-labs/windmill/issues/10873)) ([5d5ad4e](https://github.com/windmill-labs/windmill/commit/5d5ad4e8974e076ef53a26a5584e4209255a2248))
+* make the home Build with AI composer dismissible, quiet the rest of the home page ([#10930](https://github.com/windmill-labs/windmill/issues/10930)) ([772fafe](https://github.com/windmill-labs/windmill/commit/772fafec8316a1e0c0e76b9a0737cc41d40a9a8c))
+
+
+### Bug Fixes
+
+* let a principal without a login account own a draft ([#10925](https://github.com/windmill-labs/windmill/issues/10925)) ([94af8d0](https://github.com/windmill-labs/windmill/commit/94af8d0fb5aceebe83936fd6761c6c1c02c75323))
+* resolve chat path links against the session's operating workspace ([#10924](https://github.com/windmill-labs/windmill/issues/10924)) ([9074de2](https://github.com/windmill-labs/windmill/commit/9074de25ea730ca02653c9a2e2b8b99eda6f3137))
+* tolerate string app_id in GHES app config deserialization ([#10923](https://github.com/windmill-labs/windmill/issues/10923)) ([af8ff38](https://github.com/windmill-labs/windmill/commit/af8ff3868748412cb658c803ebc8a71edc3cd8fb))
+
 ## [1.800.1](https://github.com/windmill-labs/windmill/compare/v1.800.0...v1.800.1) (2026-09-01)
 
 
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index c79abcb78e..913e0eda75 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -970,9 +970,9 @@ dependencies = [
 
 [[package]]
 name = "aws-lc-rs"
-version = "1.18.0"
+version = "1.18.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce2b2dcc879c3bae0d371e77c99f2238400ef24ec001394befa67b6e543add9e"
+checksum = "b281d307588d634de920874890732659e2e7672f72b5e10e81badc1a8a83621e"
 dependencies = [
  "aws-lc-sys",
  "untrusted 0.7.1",
@@ -981,9 +981,9 @@ dependencies = [
 
 [[package]]
 name = "aws-lc-sys"
-version = "0.44.0"
+version = "0.45.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f09fae7be8bb3174e05c6afdb34199e6dc0c7c04ba9fa237b1967adfbde27483"
+checksum = "9bff6c3b54fad79a2e60b8102caf565819711497c1f5f092f49508e2f5c31b27"
 dependencies = [
  "cc",
  "cmake",
@@ -7262,9 +7262,9 @@ dependencies = [
 
 [[package]]
 name = "libredox"
-version = "0.1.21"
+version = "0.1.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7955dfc218a8afb29dfeffd540e3a6e96baeb94fe7138228dd7cc6937fbbf96"
+checksum = "8d8f1ea3f21fd3405dcaf6c9b5c1630af9afc422d9073ea39c5f6d6c772e08ed"
 dependencies = [
  "bitflags 2.13.1",
  "libc",
@@ -7870,10 +7870,11 @@ dependencies = [
 
 [[package]]
 name = "mysql_async"
-version = "0.37.0"
+version = "0.37.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3519e91b0d254ac1ffa495bc42053286cb2172ad7241d5b3b1b9f8a891f21ee2"
+checksum = "40d11da0e2d9fad4640c9f9198ee431c6d68444568f83ef1f10f3367270071e4"
 dependencies = [
+ "arc-swap",
  "bytes",
  "crossbeam-queue",
  "crossbeam-utils",
@@ -11753,9 +11754,9 @@ checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
 
 [[package]]
 name = "smallvec"
-version = "1.15.2"
+version = "1.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90"
+checksum = "b9be42f50aa861c555654aa3a37f52f4b1074bacf4e48fe0ef7fa584e80f1f0f"
 dependencies = [
  "serde",
 ]
@@ -14746,7 +14747,7 @@ dependencies = [
 
 [[package]]
 name = "windmill"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -14831,7 +14832,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-ai"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "async-stream",
  "async-trait",
@@ -14864,7 +14865,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-alerting"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14877,7 +14878,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "argon2",
@@ -15017,7 +15018,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-agent-workers"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15040,7 +15041,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-assets"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15057,7 +15058,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-auth"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15083,7 +15084,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-client"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "reqwest 0.12.28",
  "serde",
@@ -15093,7 +15094,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-configs"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15110,7 +15111,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-debug"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "axum 0.8.9",
  "base64 0.22.1",
@@ -15132,7 +15133,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-embeddings"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15155,7 +15156,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flow-conversations"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15171,7 +15172,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flows"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15193,7 +15194,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-groups"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15214,7 +15215,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-inputs"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15228,7 +15229,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-integration-tests"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -15263,7 +15264,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-jobs"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15288,7 +15289,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-npm-proxy"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15316,7 +15317,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-openapi"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15338,7 +15339,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-schedule"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15358,7 +15359,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-scripts"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15396,7 +15397,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-settings"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15424,7 +15425,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-sse"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "lazy_static",
  "serde",
@@ -15436,7 +15437,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-users"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "argon2",
  "axum 0.8.9",
@@ -15460,7 +15461,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workers"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15474,7 +15475,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workspaces"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15509,7 +15510,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-audit"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "chrono",
  "lazy_static",
@@ -15523,7 +15524,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-autoscaling"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15542,7 +15543,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-common"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "aes-gcm",
  "aho-corasick",
@@ -15646,7 +15647,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-dep-map"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "chrono",
  "itertools 0.14.0",
@@ -15665,7 +15666,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-git-sync"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "regex",
  "serde",
@@ -15680,7 +15681,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-indexer"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "astral-tokio-tar",
@@ -15707,7 +15708,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-jseval"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "futures",
@@ -15724,7 +15725,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "itertools 0.14.0",
  "lazy_static",
@@ -15740,7 +15741,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-mcp"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15761,7 +15762,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-native-triggers"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15792,7 +15793,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-oauth"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "arc-swap",
@@ -15817,7 +15818,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-object-store"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "async-stream",
@@ -15851,7 +15852,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-operator"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "futures",
@@ -15869,7 +15870,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "convert_case 0.6.0",
  "serde",
@@ -15878,7 +15879,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15890,7 +15891,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15902,7 +15903,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -15914,7 +15915,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15926,7 +15927,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15938,7 +15939,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -15949,7 +15950,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15960,7 +15961,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15972,7 +15973,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -15983,7 +15984,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -16005,7 +16006,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -16017,7 +16018,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -16031,7 +16032,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "convert_case 0.6.0",
@@ -16048,7 +16049,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -16061,7 +16062,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -16073,7 +16074,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -16091,7 +16092,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -16107,7 +16108,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -16123,7 +16124,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -16137,7 +16138,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-queue"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -16176,7 +16177,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-runtime-nativets"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "const_format",
@@ -16216,7 +16217,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-sql-datatype-parser-wasm"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "getrandom 0.3.4",
  "wasm-bindgen",
@@ -16227,7 +16228,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-store"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -16262,7 +16263,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-test-utils"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16286,7 +16287,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16319,7 +16320,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-amqp"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16346,7 +16347,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-azure"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16379,7 +16380,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-email"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16399,7 +16400,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-gcp"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16433,7 +16434,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-http"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16469,7 +16470,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-kafka"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16492,7 +16493,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-mqtt"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16516,7 +16517,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-nats"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -16540,7 +16541,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-postgres"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16575,7 +16576,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-sqs"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16603,7 +16604,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-websocket"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16628,7 +16629,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "bitflags 2.13.1",
@@ -16647,7 +16648,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "async-once-cell",
@@ -16764,7 +16765,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker-volumes"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "bytes",
  "futures",
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index 491f3cb48a..ef62595562 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.800.1"
+version = "1.801.0"
 authors.workspace = true
 edition.workspace = true
 
@@ -88,7 +88,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal", "./parsers/windmill-parser-wasm"]
 
 [workspace.package]
-version = "1.800.1"
+version = "1.801.0"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.lock b/backend/parsers/windmill-parser-wasm/Cargo.lock
index 1b09928903..15a288cb24 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.lock
+++ b/backend/parsers/windmill-parser-wasm/Cargo.lock
@@ -6191,7 +6191,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windmill-common"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "aho-corasick",
  "anyhow",
@@ -6274,7 +6274,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -6286,7 +6286,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "convert_case",
  "serde",
@@ -6295,7 +6295,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6307,7 +6307,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6319,7 +6319,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -6331,7 +6331,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6343,7 +6343,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6355,7 +6355,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -6366,7 +6366,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6377,7 +6377,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6389,7 +6389,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6400,7 +6400,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -6422,7 +6422,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6434,7 +6434,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6448,7 +6448,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "convert_case",
@@ -6465,7 +6465,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6478,7 +6478,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -6490,7 +6490,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6508,7 +6508,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -6524,7 +6524,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6540,7 +6540,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wasm"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "getrandom 0.2.17",
@@ -6572,7 +6572,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6586,7 +6586,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.800.1"
+version = "1.801.0"
 dependencies = [
  "anyhow",
  "bitflags",
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.toml b/backend/parsers/windmill-parser-wasm/Cargo.toml
index 752d80a1e3..4aae8cad13 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.toml
+++ b/backend/parsers/windmill-parser-wasm/Cargo.toml
@@ -12,7 +12,7 @@ resolver = "2"
 members = ["."]
 
 [workspace.package]
-version = "1.800.1"
+version = "1.801.0"
 edition = "2021"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 3daa0b6133..29266603da 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.800.1
+  version: 1.801.0
   title: Windmill API
 
   contact:
diff --git a/benchmarks/lib.ts b/benchmarks/lib.ts
index 9085d6a365..db9077b9cc 100644
--- a/benchmarks/lib.ts
+++ b/benchmarks/lib.ts
@@ -2,7 +2,7 @@ import { sleep } from "https://deno.land/x/sleep@v1.2.1/mod.ts";
 import * as windmill from "https://deno.land/x/windmill@v1.174.0/mod.ts";
 import * as api from "https://deno.land/x/windmill@v1.174.0/windmill-api/index.ts";
 
-export const VERSION = "v1.800.1";
+export const VERSION = "v1.801.0";
 
 export async function login(email: string, password: string): Promise<string> {
   return await windmill.UserService.login({
diff --git a/cli/src/core/constants.ts b/cli/src/core/constants.ts
index 52b000d4c2..3d92b31a36 100644
--- a/cli/src/core/constants.ts
+++ b/cli/src/core/constants.ts
@@ -10,4 +10,4 @@ export const WM_FORK_PREFIX = "wm-fork";
 // (e.g. utils.ts) can read it without importing main.ts and creating a circular
 // dependency (main → workspace → utils → main) that triggers a TDZ.
 // Re-exported from main.ts for backwards compatibility.
-export const VERSION = "1.800.1";
+export const VERSION = "1.801.0";
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 536b178852..66bb47f9ab 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -1,12 +1,12 @@
 {
 	"name": "@windmill-labs/components",
-	"version": "1.800.1",
+	"version": "1.801.0",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "@windmill-labs/components",
-			"version": "1.800.1",
+			"version": "1.801.0",
 			"hasInstallScript": true,
 			"license": "AGPL-3.0",
 			"dependencies": {
diff --git a/frontend/package.json b/frontend/package.json
index ed8c18768f..ab3768066a 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@windmill-labs/components",
-	"version": "1.800.1",
+	"version": "1.801.0",
 	"scripts": {
 		"dev": "vite dev",
 		"dev:ui-builder": "mv static/ui_builder static/ui_builder.dev-disabled 2>/dev/null || true ; trap 'mv static/ui_builder.dev-disabled static/ui_builder 2>/dev/null || true' EXIT ; vite dev",
diff --git a/lsp/Pipfile b/lsp/Pipfile
index cf1bb1ec17..1fcca67d5f 100644
--- a/lsp/Pipfile
+++ b/lsp/Pipfile
@@ -4,7 +4,7 @@ verify_ssl = true
 name = "pypi"
 
 [packages]
-wmill = ">=1.800.1"
+wmill = ">=1.801.0"
 sendgrid = "*"
 mysql-connector-python = "*"
 pymongo = "*"
diff --git a/openflow.openapi.yaml b/openflow.openapi.yaml
index 0350536df4..c69767b582 100644
--- a/openflow.openapi.yaml
+++ b/openflow.openapi.yaml
@@ -1,7 +1,7 @@
 openapi: '3.0.3'
 
 info:
-  version: 1.800.1
+  version: 1.801.0
   title: OpenFlow Spec
   contact:
     name: Ruben Fiszel
diff --git a/powershell-client/WindmillClient/WindmillClient.psd1 b/powershell-client/WindmillClient/WindmillClient.psd1
index df980c46a0..d656f7f8a1 100644
--- a/powershell-client/WindmillClient/WindmillClient.psd1
+++ b/powershell-client/WindmillClient/WindmillClient.psd1
@@ -12,7 +12,7 @@
     RootModule        = 'WindmillClient.psm1'
 
     # Version number of this module.
-    ModuleVersion     = '1.800.1'
+    ModuleVersion     = '1.801.0'
 
     # Supported PSEditions
     # CompatiblePSEditions = @()
diff --git a/python-client/wmill/pyproject.toml b/python-client/wmill/pyproject.toml
index 00582eecd2..ce2cf1b813 100644
--- a/python-client/wmill/pyproject.toml
+++ b/python-client/wmill/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill"
-version = "1.800.1"
+version = "1.801.0"
 description = "A client library for accessing Windmill server wrapping the Windmill client API"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/typescript-client/jsr.json b/typescript-client/jsr.json
index 122221df80..f660ecd864 100644
--- a/typescript-client/jsr.json
+++ b/typescript-client/jsr.json
@@ -1,6 +1,6 @@
 {
   "name": "@windmill/windmill",
-  "version": "1.800.1",
+  "version": "1.801.0",
   "exports": "./src/index.ts",
   "publish": {
     "exclude": ["!src", "./s3Types.ts", "./sqlUtils.ts", "./client.ts", "./wacError.ts"]
diff --git a/typescript-client/package.json b/typescript-client/package.json
index 802d99056a..5a14a8d431 100644
--- a/typescript-client/package.json
+++ b/typescript-client/package.json
@@ -1,7 +1,7 @@
 {
   "name": "windmill-client",
   "description": "Windmill SDK client for browsers and Node.js",
-  "version": "1.800.1",
+  "version": "1.801.0",
   "author": "Ruben Fiszel",
   "license": "Apache 2.0",
   "homepage": "https://github.com/windmill-labs/windmill/tree/main/typescript-client#readme",
diff --git a/version.txt b/version.txt
index 16cbd6c8ab..a0a936e59b 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-1.800.1
+1.801.0
diff --git a/windmill-yaml-validator/package-lock.json b/windmill-yaml-validator/package-lock.json
index 197da5a8a8..3005098884 100644
--- a/windmill-yaml-validator/package-lock.json
+++ b/windmill-yaml-validator/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "windmill-yaml-validator",
-  "version": "1.800.1",
+  "version": "1.801.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "windmill-yaml-validator",
-      "version": "1.800.1",
+      "version": "1.801.0",
       "license": "Apache 2.0",
       "dependencies": {
         "@stoplight/yaml": "^4.3.0",
diff --git a/windmill-yaml-validator/package.json b/windmill-yaml-validator/package.json
index eb1eded0cc..5b5d6d84c0 100644
--- a/windmill-yaml-validator/package.json
+++ b/windmill-yaml-validator/package.json
@@ -1,6 +1,6 @@
 {
   "name": "windmill-yaml-validator",
-  "version": "1.800.1",
+  "version": "1.801.0",
   "description": "YAML validator for Windmill flow, schedule, and trigger files",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

From 337154b8304a5969f35216add627b5c1153c0f6c Mon Sep 17 00:00:00 2001
From: "Nathan A. Ferch" <nf+github@marginal.net>
Date: Wed, 2 Sep 2026 02:51:38 -0400
Subject: [PATCH 03/31] fix: connect to dev server instead of localhost
 (#10912)

* fix: connect to dev server instead of localhost

* fix: derive WebSocket scheme from location.protocol

Mirror the protocol-aware pattern used by initSqlWebSocket in dev.ts
so the WebSocket connects over wss:// when the dev server is reached
through an HTTPS proxy/tunnel, avoiding mixed-content blocking.

* refactor: drop now-unused port parameter of wmillTsDev

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HsfdN82yP88qyQ3h8Lwv2v

---------

Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 cli/src/commands/app/dev.ts        | 2 +-
 cli/src/commands/app/wmillTsDev.ts | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/cli/src/commands/app/dev.ts b/cli/src/commands/app/dev.ts
index b45666a1e1..2dac8639e2 100644
--- a/cli/src/commands/app/dev.ts
+++ b/cli/src/commands/app/dev.ts
@@ -603,7 +603,7 @@ async function dev(opts: DevOptions, appFolder?: string) {
       build.onLoad(
         { filter: /.*/, namespace: "wmill-virtual" },
         (args: any) => {
-          const contents = wmillTs(port);
+          const contents = wmillTs();
           log.info(
             colors.yellow(
               `[wmill-virtual] Loading virtual module: ${args.path}`,
diff --git a/cli/src/commands/app/wmillTsDev.ts b/cli/src/commands/app/wmillTsDev.ts
index 7cb2ea328b..821060d8e4 100644
--- a/cli/src/commands/app/wmillTsDev.ts
+++ b/cli/src/commands/app/wmillTsDev.ts
@@ -1,5 +1,5 @@
 //comment this line and last to dev
-export function wmillTsDev(port: number) { return `
+export function wmillTsDev() { return `
 let reqs: Record<string, any> = {}
 let ws: WebSocket | null = null
 let wsReady: Promise<void>
@@ -10,7 +10,7 @@ function initWebSocket() {
         wsReadyResolve = resolve
     })
 
-    ws = new WebSocket('ws://localhost:${port}')
+    ws = new WebSocket((window.location.protocol === 'https:' ? 'wss:' : 'ws:') + '//' + window.location.host)
 
     ws.onopen = () => {
         console.log('[wmill] WebSocket connected')
@@ -157,4 +157,4 @@ export function streamJob(
         ws?.send(JSON.stringify({ jobId, type: 'streamJob', reqId }))
     })
 }
-`}
\ No newline at end of file
+`}

From 95b6bbd46ada11d96a914ae5b0e92aba4dd02530 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Wed, 2 Sep 2026 13:49:31 +0200
Subject: [PATCH 04/31] fix: preselect first row of AI agent and AI sandbox
 insert panes (#10937)

* fix: preselect first row of AI agent and AI sandbox insert panes

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Claude-Session: https://claude.ai/code/session_019vjSnhnewkUbx6mR9iCeK8

* fix: keep Enter for focused controls in the AI insert panes

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Claude-Session: https://claude.ai/code/session_019vjSnhnewkUbx6mR9iCeK8
---
 .../components/copilot/StepGenQuick.svelte    |   4 +
 .../flows/content/FlowInputsQuick.svelte      |  12 +-
 .../flows/map/InsertModuleInner.svelte        | 134 ++++++++++++++----
 3 files changed, 114 insertions(+), 36 deletions(-)

diff --git a/frontend/src/lib/components/copilot/StepGenQuick.svelte b/frontend/src/lib/components/copilot/StepGenQuick.svelte
index d09e554240..22858c98c9 100644
--- a/frontend/src/lib/components/copilot/StepGenQuick.svelte
+++ b/frontend/src/lib/components/copilot/StepGenQuick.svelte
@@ -46,6 +46,10 @@
 
 	let input: TextInput | undefined = $state()
 
+	export function focus() {
+		input?.focus()
+	}
+
 	$effect(() => {
 		preFilter &&
 			setTimeout(() => {
diff --git a/frontend/src/lib/components/flows/content/FlowInputsQuick.svelte b/frontend/src/lib/components/flows/content/FlowInputsQuick.svelte
index cf9d008a27..dd72dc95af 100644
--- a/frontend/src/lib/components/flows/content/FlowInputsQuick.svelte
+++ b/frontend/src/lib/components/flows/content/FlowInputsQuick.svelte
@@ -15,12 +15,11 @@
 		workspaceStore
 	} from '$lib/stores'
 	import type { SupportedLanguage } from '$lib/common'
-	import { createEventDispatcher, getContext, onDestroy, onMount, untrack } from 'svelte'
+	import { createEventDispatcher, getContext, untrack } from 'svelte'
 	import type { FlowBuilderWhitelabelCustomUi } from '$lib/components/custom_ui'
 	import { type Script, type ScriptLang, type HubScriptKind } from '$lib/gen'
 	import ListFiltersQuick from '$lib/components/home/ListFiltersQuick.svelte'
 	import { ExternalLink, Folder, User, X } from 'lucide-svelte'
-	import type { FlowEditorContext } from '../../flows/types'
 	import { fade } from 'svelte/transition'
 	import { flip } from 'svelte/animate'
 	import { Button } from '$lib/components/common'
@@ -87,8 +86,6 @@
 
 	let hubCompletions: HubCompletion[] = $state([])
 
-	const { insertButtonOpen } = getContext<FlowEditorContext>('FlowEditorContext')
-
 	let selected: { kind: 'owner' | 'integrations'; name: string | undefined } | undefined =
 		$state(undefined)
 
@@ -221,13 +218,6 @@
 		selectedByKeyboard = index
 	}
 
-	onMount(() => {
-		$insertButtonOpen = true
-	})
-
-	onDestroy(() => {
-		$insertButtonOpen = false
-	})
 	let langs = $derived(
 		processInlineLangs(undefined, $defaultScripts?.order ?? Object.keys(defaultScriptLanguages))
 			.map((l) => [defaultScriptLanguages[l], l])
diff --git a/frontend/src/lib/components/flows/map/InsertModuleInner.svelte b/frontend/src/lib/components/flows/map/InsertModuleInner.svelte
index d1e65de1ea..7c75d97fab 100644
--- a/frontend/src/lib/components/flows/map/InsertModuleInner.svelte
+++ b/frontend/src/lib/components/flows/map/InsertModuleInner.svelte
@@ -3,7 +3,7 @@
 </script>
 
 <script lang="ts">
-	import { createEventDispatcher, getContext, untrack } from 'svelte'
+	import { createEventDispatcher, getContext, onDestroy, onMount, untrack } from 'svelte'
 	import StepGenQuick from '$lib/components/copilot/StepGenQuick.svelte'
 	import FlowInputsQuick from '../content/FlowInputsQuick.svelte'
 	import type { FlowBuilderWhitelabelCustomUi } from '$lib/components/custom_ui'
@@ -58,6 +58,15 @@
 	const flowEditorContext = getContext<FlowEditorContext | undefined>('FlowEditorContext')
 	let ws = $derived(flowEditorContext?.opWorkspace?.() ?? $workspaceStore)
 
+	// Flagged for the whole menu, whichever pane is showing: the flow builder walks node
+	// selection on ArrowUp/ArrowDown while it is unset, which tears the popover down.
+	onMount(() => {
+		flowEditorContext?.insertButtonOpen.set(true)
+	})
+	onDestroy(() => {
+		flowEditorContext?.insertButtonOpen.set(false)
+	})
+
 	let savedAgents = $state<{ path: string; description?: string }[]>([])
 	let savedAgentsLoading = $state(false)
 	let savedAgentsWs: string | undefined = undefined
@@ -86,6 +95,72 @@
 			: savedAgents
 	)
 
+	function newBlankAgent() {
+		dispatch('close')
+		dispatch('new', { kind: 'aiagent' })
+	}
+	function newLinkedAgent(agentPath: string) {
+		dispatch('close')
+		logReusableAgentUsage('linked')
+		dispatch('new', { kind: 'aiagent', agentPath })
+	}
+	function newClaudeSandbox() {
+		dispatch('close')
+		dispatch('new', {
+			kind: 'script',
+			inlineScript: {
+				language: 'bun',
+				kind: 'script',
+				subkind: 'claudesandbox'
+			}
+		})
+	}
+
+	// Rows of the AI panes in render order. FlowInputsQuick owns the keyboard index for the other
+	// panes and is unmounted while these render, so the two never fight over Enter or the arrows.
+	let aiRows = $derived.by((): (() => void)[] => {
+		if (selectedKind === 'aiagent') {
+			const saved = savedAgentsLoading ? [] : filteredAgents
+			return [newBlankAgent, ...saved.map((a) => () => newLinkedAgent(a.path))]
+		}
+		if (selectedKind === 'aisandbox') {
+			return [newClaudeSandbox]
+		}
+		return []
+	})
+	let selectedByKeyboard = $state(0)
+	// Clamped rather than reset when the search filter shrinks the list, so the index never
+	// points past the last rendered row.
+	let aiSelected = $derived(Math.min(selectedByKeyboard, Math.max(aiRows.length - 1, 0)))
+	let aiScrollable: HTMLElement | undefined = $state()
+	let stepGen: StepGenQuick | undefined = $state()
+	function onAiKeyDown(e: KeyboardEvent) {
+		if (aiRows.length === 0) {
+			return
+		}
+		// Enter activates the highlighted row only from the search box (or nothing focused); a
+		// focused button, link or field keeps its own native activation.
+		if (
+			e.key === 'Enter' &&
+			e.target instanceof HTMLElement &&
+			e.target.closest('button, a, select, textarea')
+		) {
+			return
+		}
+		if (e.key === 'ArrowDown') {
+			selectedByKeyboard = (aiSelected + 1) % aiRows.length
+			aiScrollable?.scrollTo({ top: selectedByKeyboard * 32, behavior: 'smooth' })
+			e.preventDefault()
+		} else if (e.key === 'ArrowUp') {
+			selectedByKeyboard = (aiSelected - 1 + aiRows.length) % aiRows.length
+			aiScrollable?.scrollTo({ top: selectedByKeyboard * 32, behavior: 'smooth' })
+			e.preventDefault()
+		} else if (e.key === 'Enter') {
+			e.preventDefault()
+			aiRows[aiSelected]()
+		}
+	}
+
 	let height = $state(0)
 	let owners = $state([])
 	// Only the content-sized host (TriggersWrapper) grows past this. The fixed-height hosts top out
@@ -94,6 +169,7 @@
 	let displayPath = $derived(height > 480)
 </script>
 
+<svelte:window onkeydown={onAiKeyDown} />
 <div
 	id="flow-editor-insert-module"
 	class="flex flex-col h-full gap-2 max-w-full {small ? 'w-[450px]' : 'w-[650px]'}"
@@ -105,6 +181,7 @@
 >
 	<div class="flex flex-row items-center gap-2">
 		<StepGenQuick
+			bind:this={stepGen}
 			on:escape={() => dispatch('close')}
 			{disableAi}
 			on:insert
@@ -230,7 +307,10 @@
 							selected={selectedKind === 'aiagent'}
 							onSelect={() => {
 								selectedKind = 'aiagent'
+								selectedByKeyboard = 0
 								loadSavedAgents()
+								// Clicking leaves focus on this button, where Enter would only re-select it.
+								stepGen?.focus()
 							}}
 						/>
 					{/if}
@@ -240,6 +320,8 @@
 							selected={selectedKind === 'aisandbox'}
 							onSelect={() => {
 								selectedKind = 'aisandbox'
+								selectedByKeyboard = 0
+								stepGen?.focus()
 							}}
 						/>
 					{/if}
@@ -248,19 +330,25 @@
 		{/if}
 
 		{#if selectedKind === 'aiagent'}
-			<div class="h-full overflow-auto grow min-w-0 p-2 gap-1 flex flex-col">
+			<div
+				bind:this={aiScrollable}
+				class="h-full overflow-auto grow min-w-0 p-2 gap-1 flex flex-col"
+			>
 				<Button
-					onClick={() => {
-						dispatch('close')
-						dispatch('new', { kind: 'aiagent' })
-					}}
+					onClick={newBlankAgent}
+					onmousemove={() => (selectedByKeyboard = 0)}
 					role="menuitem"
 					variant="subtle"
 					unifiedSize="sm"
-					btnClasses="justify-start"
+					btnClasses="justify-start {aiSelected === 0
+						? 'bg-surface-hover'
+						: 'hover:bg-transparent'}"
 				>
 					<Plus size={13} class="shrink-0" />
 					<span class="grow truncate text-left">Blank AI agent</span>
+					{#if aiSelected === 0}
+						<kbd class="!text-xs">&crarr;</kbd>
+					{/if}
 				</Button>
 				{#if savedAgentsLoading}
 					<div class="flex items-center gap-2 p-2 text-xs text-tertiary">
@@ -268,21 +356,23 @@
 					</div>
 				{:else if filteredAgents.length > 0}
 					<div class="pt-2 pb-0 text-2xs font-normal text-secondary ml-2">Saved agents</div>
-					{#each filteredAgents as agent (agent.path)}
+					{#each filteredAgents as agent, i (agent.path)}
 						<Button
-							onClick={() => {
-								dispatch('close')
-								logReusableAgentUsage('linked')
-								dispatch('new', { kind: 'aiagent', agentPath: agent.path })
-							}}
+							onClick={() => newLinkedAgent(agent.path)}
+							onmousemove={() => (selectedByKeyboard = i + 1)}
 							role="menuitem"
 							variant="subtle"
 							unifiedSize="sm"
-							btnClasses="justify-start"
+							btnClasses="justify-start {aiSelected === i + 1
+								? 'bg-surface-hover'
+								: 'hover:bg-transparent'}"
 							title={agent.description || agent.path}
 						>
 							<BotIcon size={13} class="shrink-0 text-ai" />
 							<span class="grow truncate text-left">{agent.path}</span>
+							{#if aiSelected === i + 1}
+								<kbd class="!text-xs">&crarr;</kbd>
+							{/if}
 						</Button>
 					{/each}
 				{:else}
@@ -297,17 +387,11 @@
 			<div class="h-full overflow-auto grow min-w-0 p-2 gap-1 flex flex-col">
 				<TopLevelNode
 					label="Claude Code"
-					onSelect={() => {
-						dispatch('close')
-						dispatch('new', {
-							kind: 'script',
-							inlineScript: {
-								language: 'bun',
-								kind: 'script',
-								subkind: 'claudesandbox'
-							}
-						})
-					}}
+					neutral
+					returnIcon
+					selected={aiSelected === 0}
+					onSelect={newClaudeSandbox}
+					onHover={() => (selectedByKeyboard = 0)}
 				/>
 			</div>
 		{:else}

From d3747d62555ebcb09c78cfabcaa3b6177758d6ea Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Wed, 2 Sep 2026 17:17:58 +0200
Subject: [PATCH 05/31] feat(sessions): offer the item you came from when
 starting a new session (#10940)

* fix: connect to dev server instead of localhost

* fix: derive WebSocket scheme from location.protocol

Mirror the protocol-aware pattern used by initSqlWebSocket in dev.ts
so the WebSocket connects over wss:// when the dev server is reached
through an HTTPS proxy/tunnel, avoiding mixed-content blocking.

* refactor: drop now-unused port parameter of wmillTsDev

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HsfdN82yP88qyQ3h8Lwv2v

* feat(sessions): offer the item you came from when starting a new session

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VkrstcgtV4AC4jZRHVzFdm

* docs(sessions): state the new-session seed latch's real lifetime

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VkrstcgtV4AC4jZRHVzFdm

* fix(sessions): let Enter act on the focused answer of the new-session offer

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VkrstcgtV4AC4jZRHVzFdm

* feat(sessions): start on the item instead of resuming a stale session from the rail

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VkrstcgtV4AC4jZRHVzFdm

* fix(sessions): hand the rail's item entry through the editor's own hand-off

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VkrstcgtV4AC4jZRHVzFdm

* fix(sessions): snap the rail toggle back when a session switch does not navigate

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VkrstcgtV4AC4jZRHVzFdm

---------

Co-authored-by: Nathan A. Ferch <nf+github@marginal.net>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .../sessions/SessionModeSwitch.svelte         |  23 ++-
 .../components/sessions/SessionPicker.svelte  |  74 +++++++-
 .../sessions/openInSessionContext.ts          |  36 +++-
 .../sessions/sessionSwitch.svelte.ts          | 104 +++++++++--
 .../components/sessions/sessionSwitch.test.ts | 163 +++++++++++++++++-
 5 files changed, 374 insertions(+), 26 deletions(-)

diff --git a/frontend/src/lib/components/sessions/SessionModeSwitch.svelte b/frontend/src/lib/components/sessions/SessionModeSwitch.svelte
index d721b6f16f..9a7fb20bd6 100644
--- a/frontend/src/lib/components/sessions/SessionModeSwitch.svelte
+++ b/frontend/src/lib/components/sessions/SessionModeSwitch.svelte
@@ -2,8 +2,9 @@
 	import { Building, MessagesSquare } from 'lucide-svelte'
 	import ToggleButtonGroup from '$lib/components/common/toggleButton-v2/ToggleButtonGroup.svelte'
 	import ToggleButton from '$lib/components/common/toggleButton-v2/ToggleButton.svelte'
-	import { enterSessionMode, exitSessionMode } from './sessionSwitch.svelte'
+	import { enterSessionModeFromNav, exitSessionMode } from './sessionSwitch.svelte'
 	import { goto } from '$lib/navigation'
+	import { sendUserToast } from '$lib/toast'
 	import { page } from '$app/state'
 	import { base } from '$lib/base'
 
@@ -17,11 +18,25 @@
 		onToggle
 	}: { mode: 'nav' | 'session'; isCollapsed?: boolean; onToggle?: () => void } = $props()
 
+	// The group's highlighted side. Melt moves it on click, before the navigation
+	// that would change `mode`, so it is derived from the route (which wins once
+	// a switch navigates) and pushed back when one does not, or the rail would
+	// read "AI Sessions" on an editor page with the clicked side inert until
+	// "Workspace" was pressed first.
+	let selected: string | string[] | null | undefined = $derived(mode)
+
 	function onSelected(next: 'nav' | 'session') {
 		if (next === mode) return
 		onToggle?.()
-		if (next === 'session') void enterSessionMode()
-		else void exitSessionMode()
+		if (next === 'session') {
+			// An editor whose draft could not be persisted keeps the user on the
+			// page, as its own "Open in AI session" button does, rather than open a
+			// session on an older draft than the one on screen.
+			void enterSessionModeFromNav().catch((e) => {
+				selected = mode
+				sendUserToast(e instanceof Error ? e.message : String(e), true)
+			})
+		} else void exitSessionMode()
 	}
 
 	// Pressing the already-active "Workspace" side goes home, so the toggle doubles
@@ -41,7 +56,7 @@
      child of the group's track — so the buttons fill the rail width only if those
      wrappers grow. `[&>*]:flex-1` makes every direct child split the track evenly. -->
 <ToggleButtonGroup
-	selected={mode}
+	bind:selected
 	{onSelected}
 	tabListClass={isCollapsed ? 'flex-col w-full [&>*]:w-full' : 'w-full [&>*]:flex-1'}
 >
diff --git a/frontend/src/lib/components/sessions/SessionPicker.svelte b/frontend/src/lib/components/sessions/SessionPicker.svelte
index 87462e301b..e5b62da0eb 100644
--- a/frontend/src/lib/components/sessions/SessionPicker.svelte
+++ b/frontend/src/lib/components/sessions/SessionPicker.svelte
@@ -1,5 +1,6 @@
 <script lang="ts">
 	import ConfirmationModal from '$lib/components/common/confirmationModal/ConfirmationModal.svelte'
+	import Modal from '$lib/components/common/modal/Modal.svelte'
 	import Checkbox from '$lib/components/common/checkbox/Checkbox.svelte'
 	import { Badge, Button } from '$lib/components/common'
 	import {
@@ -22,6 +23,7 @@
 	import { twMerge } from 'tailwind-merge'
 	import TextInput from '$lib/components/text_input/TextInput.svelte'
 	import { goto } from '$lib/navigation'
+	import { takeNewSessionSeed, type NewSessionSeed } from './sessionSwitch.svelte'
 	import { useLocalStorageValue } from '$lib/svelte5Utils.svelte'
 	import { slide } from 'svelte/transition'
 	import {
@@ -414,17 +416,52 @@
 	}
 
 	async function createAndOpen() {
-		const fresh = createSession()
 		// A new session opened from a Windmill page adopts that page as its first
-		// preview tab. Skip when already on the sessions page (nothing meaningful to
-		// capture) so the preview starts empty until the chat opens something.
+		// preview tab.
 		if (!onSessionsPage) {
-			const url = page.url.pathname + page.url.search
-			resetSessionPreviewTabs(fresh.id, url)
+			await createAndOpenWith(page.url.pathname + page.url.search)
+			return
 		}
+		// On the sessions page there is nothing meaningful on screen to capture,
+		// except the item the user just left to get here: that one is offered (once)
+		// before the session is created, and answerSeedOffer picks up from there.
+		const seed = takeNewSessionSeed()
+		if (seed) {
+			seedOffer = seed
+			seedOfferOpen = true
+			return
+		}
+		await createAndOpenWith(undefined)
+	}
+
+	// `previewUrl` undefined leaves the preview empty until the chat opens something.
+	async function createAndOpenWith(previewUrl: string | undefined) {
+		const fresh = createSession()
+		if (previewUrl) resetSessionPreviewTabs(fresh.id, previewUrl)
 		await activate(fresh)
 	}
 
+	// The item createAndOpen is asking about. Closing the dialog any other way than
+	// answering (Escape, the corner X, the backdrop) creates nothing: the click was
+	// met with a question, not a session. Kept after the dialog closes, since the
+	// title reads it through the close fade; `seedOfferOpen` alone gates rendering.
+	let seedOffer = $state<NewSessionSeed | undefined>(undefined)
+	let seedOfferOpen = $state(false)
+	// Focus moves onto the primary answer as the dialog opens. Enter is left to
+	// the focused button (the dialog does not bind it), and the "New session"
+	// button that opened the dialog would otherwise keep focus and answer Enter
+	// with a second, unasked session underneath.
+	let keepButton: Button | undefined = $state(undefined)
+	$effect(() => {
+		if (seedOfferOpen) keepButton?.focus()
+	})
+	async function answerSeedOffer(keep: boolean) {
+		const offer = seedOffer
+		seedOfferOpen = false
+		if (!offer) return
+		await createAndOpenWith(keep ? offer.url : undefined)
+	}
+
 	// The `+` on a workspace group header: a new session parked on that group's
 	// workspace rather than the one currently open.
 	async function createAndOpenIn(workspaceId: string) {
@@ -1300,3 +1337,30 @@
 		{/if}
 	</div>
 </ConfirmationModal>
+
+<!-- Two answers of equal standing, so Enter is left to whichever button has
+     focus rather than bound to one of them by the dialog. -->
+<Modal
+	bind:open={seedOfferOpen}
+	kind="X"
+	enterConfirms={false}
+	title="Keep this {seedOffer?.route.kind ?? 'item'} in the new session?"
+	description="You came here from {seedOffer?.route.itemPath ?? ''}."
+>
+	<p class="text-sm text-secondary">
+		Keeping it opens it in the preview, so the chat starts with it as context.
+	</p>
+	<div class="flex justify-end gap-2 mt-4">
+		<Button variant="default" unifiedSize="sm" onClick={() => answerSeedOffer(false)}>
+			Start empty
+		</Button>
+		<Button
+			bind:this={keepButton}
+			variant="accent"
+			unifiedSize="sm"
+			onClick={() => answerSeedOffer(true)}
+		>
+			Keep in preview
+		</Button>
+	</div>
+</Modal>
diff --git a/frontend/src/lib/components/sessions/openInSessionContext.ts b/frontend/src/lib/components/sessions/openInSessionContext.ts
index 27284802cc..ddecb01b4f 100644
--- a/frontend/src/lib/components/sessions/openInSessionContext.ts
+++ b/frontend/src/lib/components/sessions/openInSessionContext.ts
@@ -1,5 +1,6 @@
-import { getContext, setContext } from 'svelte'
+import { getContext, onDestroy, setContext } from 'svelte'
 import type { OpenInSessionSource } from './OpenInSessionButton.svelte'
+import type { PreviewItemRoute } from './previewPaths'
 
 // The "Open in AI session" hand-off, published by the component that owns the
 // item being edited (FlowBuilder, RawAppEditor) for AI entry points too deep in
@@ -14,10 +15,43 @@ export type OpenInSessionHandoff = {
 	source: (opts?: { moduleId?: string }) => OpenInSessionSource | undefined
 }
 
+// The hand-offs of every editor currently mounted. The navigation rail's "AI
+// Sessions" switch sits above every page, out of reach of the context, and
+// looks the editor of the item it is leaving up here instead.
+const mounted = new Set<OpenInSessionHandoff>()
+
 export function setOpenInSessionHandoff(handoff: OpenInSessionHandoff): void {
 	setContext(KEY, handoff)
+	onDestroy(registerMountedOpenInSessionHandoff(handoff))
+}
+
+/** Count `handoff` as mounted until the returned unregister runs. Split from
+ * setOpenInSessionHandoff so the registry can be driven outside a component. */
+export function registerMountedOpenInSessionHandoff(handoff: OpenInSessionHandoff): () => void {
+	mounted.add(handoff)
+	return () => {
+		mounted.delete(handoff)
+	}
 }
 
 export function getOpenInSessionHandoff(): OpenInSessionHandoff | undefined {
 	return getContext<OpenInSessionHandoff | undefined>(KEY)
 }
+
+/** The mounted editor's hand-off for the item `route` names, or undefined when
+ * no editor on screen publishes one for it (a legacy app, a detail page).
+ * Matched on the item rather than taken as "the latest registered": a script
+ * editor mounted in a flow's drawer registers too, and the rail wants the
+ * page's own item. */
+export function findMountedOpenInSessionSource(
+	route: PreviewItemRoute
+): OpenInSessionSource | undefined {
+	const kind = route.kind === 'app' ? (route.raw_app ? 'raw_app' : undefined) : route.kind
+	if (!kind) return undefined
+	for (const handoff of mounted) {
+		const source = handoff.source()
+		const target = source?.target
+		if (target && target.kind === kind && target.path === route.itemPath) return source
+	}
+	return undefined
+}
diff --git a/frontend/src/lib/components/sessions/sessionSwitch.svelte.ts b/frontend/src/lib/components/sessions/sessionSwitch.svelte.ts
index aded390394..a7a492b874 100644
--- a/frontend/src/lib/components/sessions/sessionSwitch.svelte.ts
+++ b/frontend/src/lib/components/sessions/sessionSwitch.svelte.ts
@@ -5,13 +5,17 @@ import {
 	createSession,
 	selectSession,
 	sessionInCurrentFamily,
+	sessionLastActivityAt,
 	sessionState,
 	setSessionAutoSend,
 	setSessionDraftPrompt,
 	setSessionPendingWorkspace,
+	type Session,
 	type SessionTarget
 } from './sessionState.svelte'
 import { sessionTargetHref, withPreviewParams } from './sessionMode.svelte'
+import { parsePreviewItemRoute, type PreviewItemRoute } from './previewPaths'
+import { findMountedOpenInSessionSource } from './openInSessionContext'
 // Type-only: erased at compile time, so the component graph stays out of this
 // navigation seam (see the dynamic import in openEditorInSession).
 import type { OpenInSessionSource } from './OpenInSessionButton.svelte'
@@ -27,33 +31,100 @@ import type { OpenInSessionSource } from './OpenInSessionButton.svelte'
 // is safe. Plain module state: it is read only inside click handlers, never
 // rendered, so it needs no reactivity.
 let lastNavRoute = '/'
+// Whether `lastNavRoute` has been offered as a new session's starting point since
+// it was remembered (see takeNewSessionSeed).
+let navRouteOffered = false
 
 export function rememberNavRoute(pathnameWithSearch: string): void {
 	lastNavRoute = pathnameWithSearch
+	navRouteOffered = false
 }
 
-// Enter session mode: open the active session if one is selected, else the most
-// recent non-archived session, else spin up a fresh one — then route to it.
-// Restore candidates are scoped to the active workspace family: reviving a
-// session from another family would pull that family's scope (sidebar list,
-// "Acting on" workspace) into the one the user is actually in.
+/** An item editor the user reached session mode from, as the in-app href a new
+ * session's preview can open, plus the item it edits (for naming it). */
+export type NewSessionSeed = { url: string; route: PreviewItemRoute }
+
+// The item (flow, script, app) the user came to session mode from, or undefined
+// when they came from anywhere else. A "New session" asked for after arriving
+// from an item is usually a session about that item, but the arrival route
+// (`enterSessionMode`) resumes whatever session was open, so the picker offers
+// the item back. Offered once per remembered route: the first "New session" of
+// a visit gets the question, however long the visit has run and whatever was
+// done in between; later ones start empty without asking, and a dismissed offer
+// is not repeated until the user leaves for another page and comes back.
+export function takeNewSessionSeed(): NewSessionSeed | undefined {
+	if (navRouteOffered) return undefined
+	navRouteOffered = true
+	const route = parsePreviewItemRoute(lastNavRoute)
+	return route ? { url: lastNavRoute, route } : undefined
+}
+
+// The session entering session mode resumes: the active one if selected, else
+// the most recent non-archived one. Scoped to the active workspace family:
+// reviving a session from another family would pull that family's scope
+// (sidebar list, "Acting on" workspace) into the one the user is actually in.
+function resumableSession(): Session | undefined {
+	const current = sessionState.currentSessionId
+		? sessionState.sessions.find((s) => s.id === sessionState.currentSessionId)
+		: undefined
+	return (
+		(current && sessionInCurrentFamily(current) ? current : undefined) ??
+		sessionState.sessions.find((s) => !s.archived && sessionInCurrentFamily(s))
+	)
+}
+
+// Enter session mode: resume the session `resumableSession` picks, else spin up
+// a fresh one — then route to it.
 // `replace` swaps the current history entry instead of pushing — for the
 // sessions page's family reconcile, where Back must not return to the
 // redirected-away URL just to bounce here again.
 export async function enterSessionMode(opts?: { replace?: boolean }): Promise<void> {
-	const current = sessionState.currentSessionId
-		? sessionState.sessions.find((s) => s.id === sessionState.currentSessionId)
-		: undefined
-	const target =
-		(current && sessionInCurrentFamily(current) ? current : undefined) ??
-		sessionState.sessions.find((s) => !s.archived && sessionInCurrentFamily(s)) ??
-		createSession()
+	const target = resumableSession() ?? createSession()
 	selectSession(target.id)
 	await goto(`/sessions?session_name=${encodeURIComponent(target.name)}`, {
 		replaceState: opts?.replace ?? false
 	})
 }
 
+// How long the resumable session may have sat idle before entering from an item
+// editor starts a session on that item instead. Long enough that stepping out to
+// the editor in the middle of a conversation comes back to the same chat; short
+// enough that a session left since the previous day is not taken for the task
+// the user is now on.
+const RESUME_IDLE_LIMIT_MS = 60 * 60 * 1000
+
+// Enter session mode from the navigation rail. Coming from an item editor with
+// no session to resume, or one idle past RESUME_IDLE_LIMIT_MS, opens a fresh
+// session on that item straight away: a session that old is rarely what a visit
+// from a flow or app is about, and landing in it would only lead to "New
+// session" and the offer takeNewSessionSeed makes. Anything else resumes as
+// enterSessionMode does. Rejects when the editor could not persist its draft,
+// so the caller can stay on the page and say so.
+export async function enterSessionModeFromNav(): Promise<void> {
+	const route = parsePreviewItemRoute(lastNavRoute)
+	if (route) {
+		const resumable = resumableSession()
+		if (!resumable || Date.now() - sessionLastActivityAt(resumable) > RESUME_IDLE_LIMIT_MS) {
+			// The editor's own hand-off is what its "Open in AI session" button uses:
+			// it persists the draft the preview loads (an edit still inside the
+			// autosave debounce, the row of a never-saved new item) and names the
+			// workspace the item lives in. Only an item with no such editor on
+			// screen (a legacy app, a detail page) is opened by route, as last
+			// persisted, in the workspace the route was scoped to.
+			const source = findMountedOpenInSessionSource(route)
+			if (source) await openSourceInSession(source)
+			else await openPageInSession(lastNavRoute, workspaceParamOf(lastNavRoute))
+			return
+		}
+	}
+	await enterSessionMode()
+}
+
+function workspaceParamOf(pathnameWithSearch: string): string | undefined {
+	const query = pathnameWithSearch.split('?')[1]
+	return query ? (new URLSearchParams(query).get('workspace') ?? undefined) : undefined
+}
+
 // Exit session mode: back to the last navigation route (home as a fallback).
 export async function exitSessionMode(): Promise<void> {
 	let target = lastNavRoute || '/'
@@ -90,9 +161,9 @@ export async function openEditorInSession(
 	)
 }
 
-// Open a fresh AI session showing a workspace page (Runs, a trigger list) in its
-// preview. A page is not an editable item, so callers hand over the in-app href
-// they want the tab to load rather than a SessionTarget.
+// Open a fresh AI session showing an in-app href in its preview: a workspace
+// page (Runs, a trigger list), which is not an editable item and so has no
+// SessionTarget, or a location captured as the user left it.
 export async function openPageInSession(
 	href: string,
 	workspaceId?: string,
@@ -121,6 +192,9 @@ async function openInSession(
 		// node-run unit tests.
 		const { resetSessionPreviewTabs } = await import('./sessionRuntime.svelte')
 		resetSessionPreviewTabs(session.id, url)
+		// Hand-offs seed the page they leave, so the arrival has opened the item
+		// itself and "New session" need not offer it again.
+		navRouteOffered = true
 	}
 	selectSession(session.id)
 	await goto(`/sessions?session_name=${encodeURIComponent(session.name)}`)
diff --git a/frontend/src/lib/components/sessions/sessionSwitch.test.ts b/frontend/src/lib/components/sessions/sessionSwitch.test.ts
index 616f5fe751..23ca52a693 100644
--- a/frontend/src/lib/components/sessions/sessionSwitch.test.ts
+++ b/frontend/src/lib/components/sessions/sessionSwitch.test.ts
@@ -2,8 +2,11 @@ import { describe, it, expect, vi, beforeEach } from 'vitest'
 import { get } from 'svelte/store'
 import {
 	enterSessionMode,
+	enterSessionModeFromNav,
 	openSourceInSession,
-	startSessionWithPrompt
+	rememberNavRoute,
+	startSessionWithPrompt,
+	takeNewSessionSeed
 } from './sessionSwitch.svelte'
 import {
 	peekSessionAutoSend,
@@ -20,6 +23,8 @@ import { goto } from '$lib/navigation'
 // monaco (hence that import being dynamic in the first place) and cannot load
 // under node.
 vi.mock('./sessionRuntime.svelte', () => ({ resetSessionPreviewTabs: vi.fn() }))
+import { resetSessionPreviewTabs } from './sessionRuntime.svelte'
+import { registerMountedOpenInSessionHandoff } from './openInSessionContext'
 
 function session(over: Partial<Session> = {}): Session {
 	return { id: 's1', name: 'sess', createdAt: 0, ...over }
@@ -248,3 +253,159 @@ describe('startSessionWithPrompt', () => {
 		}
 	})
 })
+
+describe('takeNewSessionSeed', () => {
+	it('offers the item editor the user came from, once per arrival', () => {
+		rememberNavRoute('/flows/edit/u/me/my_flow?workspace=ws')
+		expect(takeNewSessionSeed()).toEqual({
+			url: '/flows/edit/u/me/my_flow?workspace=ws',
+			route: { kind: 'flow', raw_app: false, itemPath: 'u/me/my_flow' }
+		})
+		// A dismissed or taken offer is not repeated until the user leaves again.
+		expect(takeNewSessionSeed()).toBeUndefined()
+		rememberNavRoute('/apps_raw/edit/f/team/dashboard?workspace=ws')
+		expect(takeNewSessionSeed()?.route).toEqual({
+			kind: 'app',
+			raw_app: true,
+			itemPath: 'f/team/dashboard'
+		})
+	})
+
+	it('offers nothing for a non-item page', () => {
+		rememberNavRoute('/runs?workspace=ws')
+		expect(takeNewSessionSeed()).toBeUndefined()
+	})
+})
+
+describe('enterSessionModeFromNav', () => {
+	const HOUR = 60 * 60 * 1000
+	beforeEach(() => {
+		vi.mocked(goto).mockClear()
+		vi.mocked(resetSessionPreviewTabs).mockClear()
+	})
+
+	// One session in the active family (rootA), as the one the rail would resume.
+	// Restores everything the test touched, the module-level nav route included,
+	// and drops whatever session the call under test created.
+	function withResumable(over: Partial<Session>): { restore: () => void } {
+		const restoreFamilies = withTwoFamilies('rootA')
+		const prevCurrent = sessionState.currentSessionId
+		const before = new Set(sessionState.sessions.map((s) => s.id))
+		const s = session({ workspace_id: 'rootA', ...over })
+		sessionState.sessions.push(s)
+		sessionState.currentSessionId = s.id
+		return {
+			restore: () => {
+				sessionState.sessions = sessionState.sessions.filter((x) => before.has(x.id))
+				sessionState.currentSessionId = prevCurrent
+				rememberNavRoute('/')
+				restoreFamilies()
+			}
+		}
+	}
+
+	it('resumes a recently active session even when coming from an item', async () => {
+		const { restore } = withResumable({
+			id: 'nav-recent',
+			name: 'session-921',
+			lastActivityAt: Date.now() - HOUR / 2
+		})
+		try {
+			rememberNavRoute('/flows/edit/u/me/f?workspace=rootA')
+			await enterSessionModeFromNav()
+			expect(sessionState.currentSessionId).toBe('nav-recent')
+			expect(resetSessionPreviewTabs).not.toHaveBeenCalled()
+		} finally {
+			restore()
+		}
+	})
+
+	it('starts a session on the item, by route, instead of resuming one idle for hours', async () => {
+		const { restore } = withResumable({
+			id: 'nav-stale',
+			name: 'session-922',
+			lastActivityAt: Date.now() - 3 * HOUR
+		})
+		try {
+			rememberNavRoute('/flows/edit/u/me/f?workspace=forkA')
+			await enterSessionModeFromNav()
+			const createdId = sessionState.currentSessionId
+			expect(createdId).not.toBe('nav-stale')
+			expect(resetSessionPreviewTabs).toHaveBeenCalledWith(
+				createdId,
+				'/flows/edit/u/me/f?workspace=forkA'
+			)
+			// The route's workspace, not createSession's pick for the active one.
+			const created = sessionState.sessions.find((s) => s.id === createdId)
+			expect(created?.pending_workspace_id).toBe('forkA')
+			// The arrival opened the item itself, so "New session" does not offer it.
+			expect(takeNewSessionSeed()).toBeUndefined()
+		} finally {
+			restore()
+		}
+	})
+
+	// The editor's hand-off is what its own "Open in AI session" button uses: its
+	// beforeOpen persists the draft the preview loads, and it names the item's
+	// workspace. The rail must take it over opening the route as last persisted.
+	it('hands off through the mounted editor of the item, running its beforeOpen first', async () => {
+		const { restore } = withResumable({
+			id: 'nav-stale-editor',
+			name: 'session-924',
+			lastActivityAt: Date.now() - 3 * HOUR
+		})
+		const order: string[] = []
+		vi.mocked(goto).mockImplementation((async () => {
+			order.push('goto')
+		}) as never)
+		// A script editor mounted alongside (a flow's drawer) must not be taken
+		// for the page's own item.
+		const unregisterScript = registerMountedOpenInSessionHandoff({
+			source: () => ({ target: { kind: 'script', path: 'u/me/s' }, workspaceId: 'rootB' })
+		})
+		const unregisterFlow = registerMountedOpenInSessionHandoff({
+			source: () => ({
+				target: { kind: 'flow', path: 'u/me/f' },
+				workspaceId: 'forkA',
+				beforeOpen: () => {
+					order.push('beforeOpen')
+				}
+			})
+		})
+		try {
+			rememberNavRoute('/flows/edit/u/me/f?workspace=rootA')
+			await enterSessionModeFromNav()
+			const createdId = sessionState.currentSessionId
+			expect(createdId).not.toBe('nav-stale-editor')
+			expect(order).toEqual(['beforeOpen', 'goto'])
+			expect(resetSessionPreviewTabs).toHaveBeenCalledWith(
+				createdId,
+				expect.stringMatching(/\/flows\/edit\/u\/me\/f$/)
+			)
+			const created = sessionState.sessions.find((s) => s.id === createdId)
+			expect(created?.pending_workspace_id).toBe('forkA')
+		} finally {
+			unregisterFlow()
+			unregisterScript()
+			vi.mocked(goto).mockReset()
+			vi.mocked(goto).mockResolvedValue(undefined as never)
+			restore()
+		}
+	})
+
+	it('resumes a stale session when coming from a non-item page', async () => {
+		const { restore } = withResumable({
+			id: 'nav-stale-runs',
+			name: 'session-923',
+			lastActivityAt: Date.now() - 3 * HOUR
+		})
+		try {
+			rememberNavRoute('/runs?workspace=rootA')
+			await enterSessionModeFromNav()
+			expect(sessionState.currentSessionId).toBe('nav-stale-runs')
+			expect(resetSessionPreviewTabs).not.toHaveBeenCalled()
+		} finally {
+			restore()
+		}
+	})
+})

From ccf84761dd664b9228dfe2f65867e8c32cd20c21 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Wed, 2 Sep 2026 17:18:50 +0200
Subject: [PATCH 06/31] feat: restore owner and label filter chips on the
 homepage (#10942)

* feat: restore label filter chips on the homepage

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AbM6X8fYEQWKMTjUyp6aqy

* feat: restore owner filter chips on the homepage

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AbM6X8fYEQWKMTjUyp6aqy

* refactor: render homepage label chips through ListFilters with a 20-chip cap

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AbM6X8fYEQWKMTjUyp6aqy

* chore: drop no-op small prop and stale chip comments on the homepage filters

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AbM6X8fYEQWKMTjUyp6aqy

* feat: homepage owner and label chips on one line, capped at 10, labels ranked by count

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AbM6X8fYEQWKMTjUyp6aqy

* fix: count a homepage label once per row and describe the window-local ranking

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AbM6X8fYEQWKMTjUyp6aqy

---------

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
---
 .../src/lib/components/home/ItemsList.svelte  | 76 +++++++++++++++----
 .../lib/components/home/ListFilters.svelte    | 27 +++++--
 2 files changed, 85 insertions(+), 18 deletions(-)

diff --git a/frontend/src/lib/components/home/ItemsList.svelte b/frontend/src/lib/components/home/ItemsList.svelte
index 0f0cb6a6c0..84432112a3 100644
--- a/frontend/src/lib/components/home/ItemsList.svelte
+++ b/frontend/src/lib/components/home/ItemsList.svelte
@@ -24,7 +24,8 @@
 		ChevronsDownUp,
 		ChevronsUpDown,
 		Code2,
-		LayoutDashboard
+		LayoutDashboard,
+		Tag
 	} from 'lucide-svelte'
 	import DropdownV2 from '$lib/components/DropdownV2.svelte'
 	import CreateActionsMenu from './CreateActionsMenu.svelte'
@@ -39,6 +40,7 @@
 		type FilterSchemaRec
 	} from '$lib/components/FilterSearchbar.svelte'
 	import NoItemFound from './NoItemFound.svelte'
+	import ListFilters from './ListFilters.svelte'
 	import ToggleButtonGroup from '../common/toggleButton-v2/ToggleButtonGroup.svelte'
 	import ToggleButton from '../common/toggleButton-v2/ToggleButton.svelte'
 	import FlowIcon from './FlowIcon.svelte'
@@ -74,10 +76,10 @@
 	)
 
 	// FilterSearchbar schema — `_default_` is the free-text search; the rest mirror the
-	// boolean/kind list filters. Owner and label scoping are offered as searchbar presets
-	// (searchPresets) and resolve server-side (path_start / label) rather than filtering
-	// client-side. `content` is a distinct mode: it swaps the list for the client-side
-	// content-match view below (usable on any instance, not EE-gated).
+	// boolean/kind list filters. Owner and label are also reachable as searchbar presets
+	// (searchPresets) and as on-page chip rows (the ListFilters markup below). `content` is
+	// a distinct mode: it swaps the list for the client-side content-match view below
+	// (usable on any instance, not EE-gated).
 	let searchFilterSchema = $derived({
 		_default_: { type: 'string' as const, hidden: true },
 		content: {
@@ -86,8 +88,8 @@
 			description: 'Search across item contents'
 		},
 		// Owner (u/<user> or f/<folder>) and label are offered as presets built from what the
-		// list actually holds (see searchPresets); they drive the same server path-scope / label
-		// filter the old on-page chips did.
+		// list actually holds (see searchPresets); owner is a server path-scope, label a
+		// client-side filter over the loaded rows.
 		owner: { type: 'string' as const, label: 'Owner' },
 		label: { type: 'string' as const, label: 'Label' },
 		kind: {
@@ -717,11 +719,20 @@
 		return true // should not happen
 	}
 
-	// Owner/label scope now live on the URL-synced searchbar filters (set via the presets),
-	// not standalone chip state — the whole data layer below still reads these two, so keep
-	// them as the single derived source. Empty string reads as "no filter".
+	// The whole data layer below reads these two derived views of the searchbar filters, so
+	// keep them the single source. Empty string reads as "no filter".
 	let ownerFilter = $derived((filterValues.val.owner || undefined) as string | undefined)
 	let labelFilter = $derived((filterValues.val.label || undefined) as string | undefined)
+	// Chip-row setters. Clearing deletes the key rather than writing null, which the
+	// searchbar would otherwise render as a `key: null` tag.
+	function setOwnerFilter(o: string | undefined) {
+		if (o == undefined) delete filterValues.val.owner
+		else filterValues.val.owner = o
+	}
+	function setLabelFilter(l: string | undefined) {
+		if (l == undefined) delete filterValues.val.label
+		else filterValues.val.label = l
+	}
 
 	const cmp = new Intl.Collator('en').compare
 
@@ -1155,11 +1166,26 @@
 	function itemLabels(x: { labels?: string[]; inherited_labels?: string[] }): string[] {
 		return [...(x.labels ?? []), ...(x.inherited_labels ?? [])]
 	}
-	let allLabels = $derived(
-		Array.from(new Set(combinedItems?.flatMap((x) => itemLabels(x)) ?? [])).sort()
+	// Labels ranked by how many loaded rows carry them (ties alphabetical). Unlike the owner
+	// chips there is no workspace-wide count endpoint, so the order is window-local and can
+	// shift as later pages load. A row carrying a label both directly and by inheritance
+	// counts once.
+	let allLabels = $derived.by(() => {
+		const counts = new Map<string, number>()
+		for (const x of combinedItems ?? [])
+			for (const l of new Set(itemLabels(x))) counts.set(l, (counts.get(l) ?? 0) + 1)
+		return [...counts.keys()].sort(
+			(a, b) => (counts.get(b) ?? 0) - (counts.get(a) ?? 0) || cmp(a, b)
+		)
+	})
+	let hasChips = $derived(
+		owners.length > 0 ||
+			allLabels.length > 0 ||
+			ownerFilter != undefined ||
+			labelFilter != undefined
 	)
 	// FilterSearchbar presets: the owner prefixes and labels the list actually holds, so
-	// scoping to one is a click in the searchbar dropdown instead of a wall of on-page chips.
+	// scoping to one is a click in the searchbar dropdown.
 	// Owner sets the `owner` filter (server path-scope), label sets `label` (client filter).
 	// The `:\ ` separator and escaped spaces match the canonical `key:\ value` form parseToText
 	// emits, so the "already applied" check finds them after a reparse and won't re-offer a
@@ -1743,6 +1769,30 @@
 			{/if}
 		</div>
 	</div>
+	{#if !contentActive && hasChips}
+		<!-- Owner and label chips on one line. Each function binding routes the chip's
+		     selection into the searchbar key of the same name, and `queryName` points
+		     ListFilters' own mount-time URL read at the param the filter instance syncs, so
+		     the two writers agree. No `syncQuery`: the filter instance owns the URL. -->
+		<div class="gap-2 w-full flex flex-wrap mt-3">
+			<ListFilters
+				inline
+				bind:selectedFilter={() => ownerFilter, setOwnerFilter}
+				filters={owners}
+				queryName="owner"
+				maxDisplayed={10}
+			/>
+			<ListFilters
+				inline
+				bind:selectedFilter={() => labelFilter, setLabelFilter}
+				filters={allLabels}
+				queryName="label"
+				maxDisplayed={10}
+				color="blue"
+				icon={Tag}
+			/>
+		</div>
+	{/if}
 	{#if filteredItems?.length == 0}
 		<div class="mt-10"></div>
 	{/if}
diff --git a/frontend/src/lib/components/home/ListFilters.svelte b/frontend/src/lib/components/home/ListFilters.svelte
index 38921a5ec3..ecddfec11a 100644
--- a/frontend/src/lib/components/home/ListFilters.svelte
+++ b/frontend/src/lib/components/home/ListFilters.svelte
@@ -1,6 +1,7 @@
 <script lang="ts">
 	import { Folder, User } from 'lucide-svelte'
 	import { Badge } from '../common'
+	import type { BadgeColor, BadgeIconProps } from '../common/badge/model'
 	import { appIconComponent } from '../icons'
 	import { onDestroy, onMount } from 'svelte'
 
@@ -14,6 +15,14 @@
 		// Keep only the first N filters visible, the rest behind a "…" toggle. Unset
 		// shows every one.
 		maxDisplayed?: number
+		// Chip look. `icon` is drawn before every chip; unset, the icon follows the value
+		// (user/folder prefix, or the app icon under `resourceType`).
+		color?: BadgeColor
+		icon?: BadgeIconProps['icon']
+		// Emit the chips as flex items of the parent instead of a row of their own, so several
+		// ListFilters can share one line. The parent owns layout and spacing, so
+		// `bottomMargin` does not apply.
+		inline?: boolean
 	}
 
 	let {
@@ -23,7 +32,10 @@
 		queryName = 'filter',
 		syncQuery = false,
 		bottomMargin = true,
-		maxDisplayed
+		maxDisplayed,
+		color = 'transparent',
+		icon,
+		inline = false
 	}: Props = $props()
 
 	const queryChange: (value: URL) => void = (url: URL) => {
@@ -87,7 +99,9 @@
 </script>
 
 {#if Array.isArray(filtersAndSelected) && filtersAndSelected.length > 0}
-	<div class={`gap-2 w-full flex flex-wrap ${bottomMargin ? 'my-4' : 'mt-4'}`}>
+	<div
+		class={inline ? 'contents' : `gap-2 w-full flex flex-wrap ${bottomMargin ? 'my-4' : 'mt-4'}`}
+	>
 		{#each displayedFilters as filter (filter)}
 			<div>
 				<Badge
@@ -100,12 +114,15 @@
 							setQuery(new URL(window.location.href), queryName, undefined)
 						}
 					}}
-					color={'transparent'}
+					{color}
 					clickable
 					selected={filter === selectedFilter}
 				>
 					<span style="height: 12px" class="-mt-0.5">
-						{#if resourceType}
+						{#if icon}
+							{@const Icon = icon}
+							<Icon class="mr-0.5" size={12} />
+						{:else if resourceType}
 							{@const SvelteComponent = appIconComponent(filter)}
 							<SvelteComponent height="14px" width="14px" />
 						{:else if filter.startsWith('u/')}
@@ -123,7 +140,7 @@
 			<div>
 				<Badge
 					class="inline-flex items-center gap-1 align-middle"
-					color={'transparent'}
+					{color}
 					clickable
 					title={expanded ? 'Show fewer' : `Show ${hiddenCount} more`}
 					onclick={() => (expanded = !expanded)}

From fdd3b36423344a2e1a464674179406581074e926 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Wed, 2 Sep 2026 17:21:10 +0200
Subject: [PATCH 07/31] feat: workspace setting to hide the AI assistant, agent
 steps unaffected (#10941)

* feat: workspace setting to hide the AI assistant, agent steps unaffected

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011eNweUugVqerex6MLxjbeL

* fix: load workspace AI config on cold /sessions load and say hidden, not disabled

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011eNweUugVqerex6MLxjbeL

* fix: follow workspace switches on /sessions gate and drop deprecated button size

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011eNweUugVqerex6MLxjbeL

* fix: key the /sessions hidden-assistant gate on the acting workspace's own config

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011eNweUugVqerex6MLxjbeL

* fix: tag the /sessions hidden-assistant verdict with its workspace and drop superseded reads

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011eNweUugVqerex6MLxjbeL

* fix: overlay the /sessions hidden-assistant gate so warm sessions survive workspace switches

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011eNweUugVqerex6MLxjbeL

* fix: hide the pipeline insert menu AI prompt and refuse chat turns where the assistant is hidden

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011eNweUugVqerex6MLxjbeL

* fix: shrink the home Build with AI / CLI / Hub line to a flush hint row

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011eNweUugVqerex6MLxjbeL

* fix: frame the workspace toggle as hide AI sessions at the bottom of the AI settings

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011eNweUugVqerex6MLxjbeL

---------

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
---
 .../tests/workspaces.rs                       |  62 ++-
 backend/windmill-api/openapi.yaml             |   7 +
 backend/windmill-api/src/ai.rs                |   6 +
 backend/windmill-api/src/workspaces.rs        |  38 +-
 frontend/src/lib/aiStore.test.ts              |  18 +
 frontend/src/lib/aiStore.ts                   |  14 +-
 .../AssetGraph/PipelineInsertMenu.svelte      |  45 +-
 .../components/copilot/AIFormAssistant.svelte |  79 +--
 .../components/copilot/AIFormSettings.svelte  |  67 +--
 .../src/lib/components/copilot/CronGen.svelte | 124 +++--
 .../lib/components/copilot/RegexGen.svelte    |  48 +-
 .../lib/components/copilot/ResourceGen.svelte | 130 ++---
 .../lib/components/copilot/ScriptFix.svelte   |   2 +-
 .../lib/components/copilot/ScriptGen.svelte   |   2 +-
 .../components/copilot/StepGenQuick.svelte    |   6 +-
 .../components/copilot/StepInputsGen.svelte   |   2 +-
 .../components/copilot/chat/AIButton.svelte   |   2 +-
 .../lib/components/copilot/chat/AIChat.svelte |  12 +-
 .../copilot/chat/AIChatManager.svelte.ts      |  13 +
 .../copilot/chat/AiChatLayout.svelte          |   9 +
 .../flows/content/FlowInputsQuick.svelte      |   1 +
 .../src/lib/components/home/HomeAIChat.svelte |  17 +-
 .../raw_apps/RawAppTemplatePicker.svelte      | 121 ++--
 .../search/GlobalSearchModal.svelte           |  25 +-
 .../sessions/OpenInSessionButton.svelte       |  10 +-
 .../workspaceSettings/AISettings.svelte       |  46 +-
 .../src/routes/(root)/(logged)/+layout.svelte |  45 +-
 .../(root)/(logged)/sessions/+page.svelte     | 521 ++++++++++--------
 28 files changed, 860 insertions(+), 612 deletions(-)

diff --git a/backend/windmill-api-integration-tests/tests/workspaces.rs b/backend/windmill-api-integration-tests/tests/workspaces.rs
index 65fe4241cc..25312cae27 100644
--- a/backend/windmill-api-integration-tests/tests/workspaces.rs
+++ b/backend/windmill-api-integration-tests/tests/workspaces.rs
@@ -889,6 +889,53 @@ async fn test_get_copilot_info_ignores_empty_instance_ai_row(
     Ok(())
 }
 
+/// A workspace with no provider of its own is served the instance config, but the
+/// `copilot_disabled` flag must still come from the workspace's own row.
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn test_get_copilot_info_keeps_workspace_copilot_disabled_over_instance_fallback(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let base = format!("http://localhost:{port}/api/w/test-workspace/workspaces");
+
+    sqlx::query("UPDATE workspace_settings SET ai_config = $1 WHERE workspace_id = $2")
+        .bind(json!({ "copilot_disabled": true }))
+        .bind("test-workspace")
+        .execute(&db)
+        .await?;
+    sqlx::query(
+        "INSERT INTO global_settings (name, value) VALUES ($1, $2) \
+         ON CONFLICT (name) DO UPDATE SET value = EXCLUDED.value",
+    )
+    .bind("ai_config")
+    .bind(json!({
+        "providers": {
+            "openai": {
+                "resource_path": "u/test-user/openai_instance",
+                "models": ["gpt-4o-mini"]
+            }
+        }
+    }))
+    .execute(&db)
+    .await?;
+
+    let resp = authed(client().get(format!("{base}/get_copilot_info")))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 200);
+    let settings = resp.json::<serde_json::Value>().await?;
+    assert_eq!(
+        settings["providers"]["openai"]["models"][0], "gpt-4o-mini",
+        "instance providers are still served"
+    );
+    assert_eq!(settings["copilot_disabled"], true);
+
+    Ok(())
+}
+
 #[sqlx::test(migrations = "../migrations", fixtures("base"))]
 async fn test_error_handler_instance_alerts_fallback(db: Pool<Postgres>) -> anyhow::Result<()> {
     initialize_tracing().await;
@@ -941,7 +988,12 @@ async fn test_error_handler_instance_alerts_fallback(db: Pool<Postgres>) -> anyh
         .send()
         .await
         .unwrap();
-    assert_eq!(resp.status(), 200, "disable on fork: {}", resp.text().await?);
+    assert_eq!(
+        resp.status(),
+        200,
+        "disable on fork: {}",
+        resp.text().await?
+    );
     assert!(!stored().await?);
 
     Ok(())
@@ -1044,9 +1096,11 @@ async fn test_create_service_account_drops_orphaned_group_memberships(
     .await?;
 
     // Same username, different workspace, and very much alive — must not be touched.
-    sqlx::query("INSERT INTO workspace (id, name, owner) VALUES ('other-workspace', 'other', 'svc_acct')")
-        .execute(&db)
-        .await?;
+    sqlx::query(
+        "INSERT INTO workspace (id, name, owner) VALUES ('other-workspace', 'other', 'svc_acct')",
+    )
+    .execute(&db)
+    .await?;
     sqlx::query(
         "INSERT INTO group_ (workspace_id, name, summary) VALUES
          ('other-workspace', 'all', 'All users'),
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 29266603da..2878797e69 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -27135,6 +27135,13 @@ components:
           type: object
           additionalProperties:
             $ref: "#/components/schemas/ModelPriceOverride"
+        copilot_disabled:
+          type: boolean
+          description: >-
+            Hides the Windmill AI assistant (chat, sessions, code generation, completion,
+            fixes) from the workspace UI. Read from the workspace's own settings even when
+            the providers served fall back to the instance config. AI agent steps and the
+            AI sandbox in flows are unaffected.
 
     FreeTierInfo:
       type: object
diff --git a/backend/windmill-api/src/ai.rs b/backend/windmill-api/src/ai.rs
index c684830b27..e70cc19544 100644
--- a/backend/windmill-api/src/ai.rs
+++ b/backend/windmill-api/src/ai.rs
@@ -445,6 +445,12 @@ pub struct AIConfig {
     /// Only models whose rates differ from the built-in table are stored.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub model_pricing: Option<HashMap<String, ModelPriceOverride>>,
+    /// Hides the Windmill AI assistant (chat, sessions, generation, completion, fixes) from
+    /// the workspace UI. Only the workspace's own row is consulted: the flag holds even when
+    /// the providers served come from the instance config or the free tier. AI agent steps
+    /// and the AI sandbox are unaffected, so the providers stay in force.
+    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
+    pub copilot_disabled: bool,
 }
 
 /// Negotiated rates in USD per million tokens. An unset cache rate is read as the
diff --git a/backend/windmill-api/src/workspaces.rs b/backend/windmill-api/src/workspaces.rs
index 76378e335a..da8532e9d1 100644
--- a/backend/windmill-api/src/workspaces.rs
+++ b/backend/windmill-api/src/workspaces.rs
@@ -146,6 +146,7 @@ async fn edit_copilot_config(
     .await?;
 
     let workspace_has_config = ai_config.has_providers();
+    let copilot_disabled = ai_config.copilot_disabled;
     let instance_ai_config =
         sqlx::query_scalar!("SELECT value FROM global_settings WHERE name = 'ai_config'")
             .fetch_optional(&db)
@@ -158,7 +159,7 @@ async fn edit_copilot_config(
         .as_ref()
         .and_then(|v| serde_json::from_value::<AIConfig>(v.clone()).ok())
         .filter(|c| c.has_providers());
-    let effective_ai_config = if workspace_has_config {
+    let mut effective_ai_config = if workspace_has_config {
         ai_config
     } else if let Some(instance_config) = instance_config_with_providers {
         instance_config
@@ -172,6 +173,7 @@ async fn edit_copilot_config(
     } else {
         AIConfig::default()
     };
+    effective_ai_config.copilot_disabled = copilot_disabled;
 
     Ok(Json(EditCopilotConfigResponse {
         effective_ai_config,
@@ -207,6 +209,9 @@ async fn get_copilot_info(
         ))
     })?;
 
+    let copilot_disabled = workspace_ai_config
+        .as_ref()
+        .is_some_and(|c| c.0.copilot_disabled);
     let instance_config =
         sqlx::query_scalar!("SELECT value FROM global_settings WHERE name = 'ai_config'")
             .fetch_optional(&db)
@@ -215,20 +220,23 @@ async fn get_copilot_info(
             // A provider-less instance config (e.g. `{}`) is unconfigured; don't let it shadow the
             // free-tier fallback, matching the proxy and edit_copilot_config paths.
             .filter(|c| c.has_providers());
-    if let Some(workspace_ai_config) = workspace_ai_config.filter(|c| c.0.has_providers()) {
-        Ok(Json(workspace_ai_config.0))
-    } else if let Some(instance_config) = instance_config {
-        Ok(Json(instance_config))
-    } else if let Some(free_config) =
-        crate::ai_free_tier_oss::free_tier_copilot_config(&db, &authed.email).await?
-    {
-        // Nothing configured: fall back to Windmill's free tier (EE-only). The config
-        // carries a `free_tier` marker even once the user's grant is spent — with no
-        // providers, but telling the client *why* AI is off.
-        Ok(Json(free_config))
-    } else {
-        Ok(Json(AIConfig::default()))
-    }
+    let mut effective =
+        if let Some(workspace_ai_config) = workspace_ai_config.filter(|c| c.0.has_providers()) {
+            workspace_ai_config.0
+        } else if let Some(instance_config) = instance_config {
+            instance_config
+        } else if let Some(free_config) =
+            crate::ai_free_tier_oss::free_tier_copilot_config(&db, &authed.email).await?
+        {
+            // Nothing configured: fall back to Windmill's free tier (EE-only). The config
+            // carries a `free_tier` marker even once the user's grant is spent — with no
+            // providers, but telling the client *why* AI is off.
+            free_config
+        } else {
+            AIConfig::default()
+        };
+    effective.copilot_disabled = copilot_disabled;
+    Ok(Json(effective))
 }
 
 #[cfg(feature = "enterprise")]
diff --git a/frontend/src/lib/aiStore.test.ts b/frontend/src/lib/aiStore.test.ts
index fed6147b62..be8980e93a 100644
--- a/frontend/src/lib/aiStore.test.ts
+++ b/frontend/src/lib/aiStore.test.ts
@@ -35,6 +35,24 @@ describe('setCopilotInfo legacy /thinking migration', () => {
 		expect(info.aiModels.map((m) => m.model)).toEqual(['claude-sonnet-4-6'])
 	})
 
+	it('keeps the models but turns the assistant off when the workspace disabled it', () => {
+		setCopilotInfo({
+			providers: {
+				anthropic: {
+					resource_path: 'u/admin/anthropic',
+					models: ['claude-sonnet-4-6']
+				}
+			},
+			copilot_disabled: true
+		})
+
+		const info = get(copilotInfo)
+		expect(info.enabled).toBe(false)
+		expect(info.workspaceDisabled).toBe(true)
+		// The providers still describe what AI agent steps can run on.
+		expect(info.aiModels.map((m) => m.model)).toEqual(['claude-sonnet-4-6'])
+	})
+
 	it('defaults provider web search on unless explicitly disabled', () => {
 		setCopilotInfo({
 			providers: {
diff --git a/frontend/src/lib/aiStore.ts b/frontend/src/lib/aiStore.ts
index 2d6a98c625..6ac98d69e8 100644
--- a/frontend/src/lib/aiStore.ts
+++ b/frontend/src/lib/aiStore.ts
@@ -41,6 +41,10 @@ export const copilotSessionModel = writable<ReasoningProviderModel | undefined>(
 
 export const copilotInfo = writable<{
 	enabled: boolean
+	// The workspace hid the assistant (`ai_config.copilot_disabled`). `enabled` is then false
+	// whatever the providers say, and the AI entry points that nudge "configure AI" when
+	// `enabled` is off render nothing at all instead.
+	workspaceDisabled: boolean
 	codeCompletionModel?: AIProviderModel
 	defaultModel?: AIProviderModel
 	metadataModel?: AIProviderModel
@@ -56,6 +60,7 @@ export const copilotInfo = writable<{
 	freeTier?: FreeTierInfo
 }>({
 	enabled: false,
+	workspaceDisabled: false,
 	codeCompletionModel: undefined,
 	defaultModel: undefined,
 	metadataModel: undefined,
@@ -71,7 +76,7 @@ export const copilotInfo = writable<{
 aiUserDisabled.subscribe((disabled) => {
 	copilotInfo.update((info) => ({
 		...info,
-		enabled: info.aiModels.length > 0 && !disabled
+		enabled: info.aiModels.length > 0 && !disabled && !info.workspaceDisabled
 	}))
 })
 
@@ -126,9 +131,11 @@ export function setCopilotInfo(aiConfig: AIConfig) {
 			return model
 		})
 
+		const workspaceDisabled = aiConfig.copilot_disabled === true
 		copilotInfo.set({
-			// Providers are configured; the per-user opt-out is the only thing that can gate it off.
-			enabled: !get(aiUserDisabled),
+			// Providers are configured; only the workspace or per-user opt-outs can gate it off.
+			enabled: !workspaceDisabled && !get(aiUserDisabled),
+			workspaceDisabled,
 			// Strip the deprecated /thinking suffix from the configured model slots too,
 			// otherwise a workspace whose default still carries it sends an invalid model id.
 			codeCompletionModel: stripModelSuffix(aiConfig.code_completion_model),
@@ -146,6 +153,7 @@ export function setCopilotInfo(aiConfig: AIConfig) {
 
 		copilotInfo.set({
 			enabled: false,
+			workspaceDisabled: aiConfig.copilot_disabled === true,
 			codeCompletionModel: undefined,
 			defaultModel: undefined,
 			metadataModel: undefined,
diff --git a/frontend/src/lib/components/assets/AssetGraph/PipelineInsertMenu.svelte b/frontend/src/lib/components/assets/AssetGraph/PipelineInsertMenu.svelte
index e3c6c04378..e341707250 100644
--- a/frontend/src/lib/components/assets/AssetGraph/PipelineInsertMenu.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/PipelineInsertMenu.svelte
@@ -28,6 +28,7 @@
 <script lang="ts">
 	import Popover from '$lib/components/meltComponents/Popover.svelte'
 	import Button from '$lib/components/common/button/Button.svelte'
+	import { copilotInfo } from '$lib/aiStore'
 	import LanguageIcon from '$lib/components/common/languageIcons/LanguageIcon.svelte'
 	import { twMerge } from 'tailwind-merge'
 	import {
@@ -79,9 +80,11 @@
 	// focus off to the first tabbable in the next column.
 	let languageEl: HTMLElement | undefined
 	let outputEl: HTMLElement | undefined
-	// Refs into the bottom panel for the Output → Path → AI Prompt → Save chain.
+	// Refs into the bottom panel for the Output → Path → AI Prompt → Save chain. The AI
+	// prompt is absent where the workspace hid the assistant, so Path advances to Save.
 	let pathEl: HTMLElement | undefined
 	let aiPromptEl: HTMLElement | undefined
+	let saveEl: HTMLElement | undefined
 
 	let compatibleKinds = $derived.by<PipelineOutputKind[]>(() => {
 		if (!selected.language) return []
@@ -261,7 +264,7 @@
 {#snippet bottomSection(close: () => void)}
 	<Label label="Path">
 		<!-- svelte-ignore a11y_no_static_element_interactions -->
-		<div bind:this={pathEl} class="flex" onkeydown={selectAndAdvanceTo(() => aiPromptEl)}>
+		<div bind:this={pathEl} class="flex" onkeydown={selectAndAdvanceTo(() => aiPromptEl ?? saveEl)}>
 			<div
 				class="border rounded-md rounded-r-none border-r-0 text-xs w-fit shrink-0 whitespace-nowrap flex items-center px-2 text-secondary bg-surface-input"
 			>
@@ -270,25 +273,27 @@
 			<TextInput bind:value={selected.scriptPath} class="rounded-l-none" />
 		</div>
 	</Label>
-	<Label label="AI Prompt (optional)">
-		<!-- svelte-ignore a11y_no_static_element_interactions -->
-		<div
-			bind:this={aiPromptEl}
-			onkeydown={(e) =>
-				(e.metaKey || e.ctrlKey) && e.key === 'Enter' && (confirm(close), e.stopPropagation())}
-		>
-			<TextInput
-				class="resize-none h-12 !max-h-12"
-				underlyingInputEl="textarea"
-				inputProps={{
-					placeholder: 'Describe what the script should do — leave empty to use a template'
-				}}
-				bind:value={selected.aiPrompt}
-			/>
-		</div>
-	</Label>
+	{#if !$copilotInfo.workspaceDisabled}
+		<Label label="AI Prompt (optional)">
+			<!-- svelte-ignore a11y_no_static_element_interactions -->
+			<div
+				bind:this={aiPromptEl}
+				onkeydown={(e) =>
+					(e.metaKey || e.ctrlKey) && e.key === 'Enter' && (confirm(close), e.stopPropagation())}
+			>
+				<TextInput
+					class="resize-none h-12 !max-h-12"
+					underlyingInputEl="textarea"
+					inputProps={{
+						placeholder: 'Describe what the script should do — leave empty to use a template'
+					}}
+					bind:value={selected.aiPrompt}
+				/>
+			</div>
+		</Label>
+	{/if}
 	{@const hasAiPrompt = !!selected.aiPrompt?.trim()}
-	<div class="ml-auto">
+	<div class="ml-auto" bind:this={saveEl}>
 		<Button
 			variant="accent"
 			btnClasses="w-fit"
diff --git a/frontend/src/lib/components/copilot/AIFormAssistant.svelte b/frontend/src/lib/components/copilot/AIFormAssistant.svelte
index db6a341c58..9c7b3cb411 100644
--- a/frontend/src/lib/components/copilot/AIFormAssistant.svelte
+++ b/frontend/src/lib/components/copilot/AIFormAssistant.svelte
@@ -5,6 +5,7 @@
 	import OpenInSessionButton from '$lib/components/sessions/OpenInSessionButton.svelte'
 	import { AIBtnClasses } from './chat/AIButtonStyle'
 	import { workspaceStore } from '$lib/stores'
+	import { copilotInfo } from '$lib/aiStore'
 	import { logFeatureUsage } from '$lib/utils/featureUsage'
 
 	interface Props {
@@ -49,45 +50,47 @@
 	)
 </script>
 
-<div class="my-3 p-3 bg-surface-secondary rounded-md relative flex flex-col gap-3">
-	<div class="flex flex-row gap-2 justify-between items-center">
-		<!-- Heading stays neutral because the two branches do different things: the
+{#if !$copilotInfo.workspaceDisabled}
+	<div class="my-3 p-3 bg-surface-secondary rounded-md relative flex flex-col gap-3">
+		<div class="flex flex-row gap-2 justify-between items-center">
+			<!-- Heading stays neutral because the two branches do different things: the
 		     hand-off runs the item, the legacy path fills the form. Each button
 		     names its own action. A plain Button rather than AskAiButton, whose own
 		     session branch would fire here too and open an empty session. -->
-		<h3 class="text-sm font-medium">AI can help with these inputs</h3>
-		<OpenInSessionButton
-			source={sessionSource}
-			label="Run in AI session"
-			tooltip="Open an AI session that picks inputs and runs this"
-			btnProps={{ iconOnly: false, startIcon: { icon: WandSparkles } }}
-		>
-			{#snippet fallback()}
-				<Button
-					unifiedSize="md"
-					startIcon={{ icon: WandSparkles }}
-					btnClasses={AIBtnClasses('default')}
-					on:click={fillFormWithAI}
-				>
-					Fill with AI
-				</Button>
-			{/snippet}
-		</OpenInSessionButton>
+			<h3 class="text-sm font-medium">AI can help with these inputs</h3>
+			<OpenInSessionButton
+				source={sessionSource}
+				label="Run in AI session"
+				tooltip="Open an AI session that picks inputs and runs this"
+				btnProps={{ iconOnly: false, startIcon: { icon: WandSparkles } }}
+			>
+				{#snippet fallback()}
+					<Button
+						unifiedSize="md"
+						startIcon={{ icon: WandSparkles }}
+						btnClasses={AIBtnClasses('default')}
+						on:click={fillFormWithAI}
+					>
+						Fill with AI
+					</Button>
+				{/snippet}
+			</OpenInSessionButton>
+		</div>
+		<div class="flex flex-row gap-2 items-center">
+			<p class="text-sm text-primary">
+				{instructions
+					? 'Instructions: ' + instructions
+					: 'No AI instructions provided. Click edit to add guidance for AI form filling.'}
+			</p>
+			<Button
+				color="light"
+				size="xs2"
+				startIcon={{
+					icon: Pencil
+				}}
+				iconOnly
+				on:click={onEditInstructions}
+			/>
+		</div>
 	</div>
-	<div class="flex flex-row gap-2 items-center">
-		<p class="text-sm text-primary">
-			{instructions
-				? 'Instructions: ' + instructions
-				: 'No AI instructions provided. Click edit to add guidance for AI form filling.'}
-		</p>
-		<Button
-			color="light"
-			size="xs2"
-			startIcon={{
-				icon: Pencil
-			}}
-			iconOnly
-			on:click={onEditInstructions}
-		/>
-	</div>
-</div>
+{/if}
diff --git a/frontend/src/lib/components/copilot/AIFormSettings.svelte b/frontend/src/lib/components/copilot/AIFormSettings.svelte
index 44151a01b3..ef627ace4b 100644
--- a/frontend/src/lib/components/copilot/AIFormSettings.svelte
+++ b/frontend/src/lib/components/copilot/AIFormSettings.svelte
@@ -3,6 +3,7 @@
 	import Label from '../Label.svelte'
 	import Toggle from '../Toggle.svelte'
 	import Tooltip from '../Tooltip.svelte'
+	import { copilotInfo } from '$lib/aiStore'
 
 	interface Props {
 		prompt?: string | undefined
@@ -12,35 +13,37 @@
 	let { prompt = $bindable(undefined), type = 'script' }: Props = $props()
 </script>
 
-<div>
-	<Toggle
-		textClass="font-medium"
-		size="xs"
-		checked={prompt !== undefined}
-		on:change={() => {
-			if (prompt !== undefined) {
-				prompt = undefined
-			} else {
-				prompt = ''
-			}
-		}}
-		options={{ right: `Enable filling ${type} inputs with AI` }}
-	/>
-	{#if prompt !== undefined}
-		<div transition:slide={{ duration: 120 }} class="mt-6">
-			<Label label="Additional prompt for AI">
-				{#snippet header()}
-					<Tooltip>
-						AI will use script description and each field description to fill the inputs form. In
-						addition, any prompt passed here will be used by AI to guide it. You can mention
-						specific fields and interaction between fields here.
-					</Tooltip>
-				{/snippet}
-				<textarea
-					bind:value={prompt}
-					placeholder="Instructions for the AI about how to fill the form"
-				></textarea>
-			</Label>
-		</div>
-	{/if}
-</div>
+{#if !$copilotInfo.workspaceDisabled}
+	<div>
+		<Toggle
+			textClass="font-medium"
+			size="xs"
+			checked={prompt !== undefined}
+			on:change={() => {
+				if (prompt !== undefined) {
+					prompt = undefined
+				} else {
+					prompt = ''
+				}
+			}}
+			options={{ right: `Enable filling ${type} inputs with AI` }}
+		/>
+		{#if prompt !== undefined}
+			<div transition:slide={{ duration: 120 }} class="mt-6">
+				<Label label="Additional prompt for AI">
+					{#snippet header()}
+						<Tooltip>
+							AI will use script description and each field description to fill the inputs form. In
+							addition, any prompt passed here will be used by AI to guide it. You can mention
+							specific fields and interaction between fields here.
+						</Tooltip>
+					{/snippet}
+					<textarea
+						bind:value={prompt}
+						placeholder="Instructions for the AI about how to fill the form"
+					></textarea>
+				</Label>
+			</div>
+		{/if}
+	</div>
+{/if}
diff --git a/frontend/src/lib/components/copilot/CronGen.svelte b/frontend/src/lib/components/copilot/CronGen.svelte
index 6a8dc6892e..94715a0f18 100644
--- a/frontend/src/lib/components/copilot/CronGen.svelte
+++ b/frontend/src/lib/components/copilot/CronGen.svelte
@@ -79,66 +79,68 @@
 	})
 </script>
 
-<Popover floatingConfig={{ strategy: 'absolute', placement: 'bottom-end' }}>
-	{#snippet trigger()}
-		<Button
-			color={genLoading ? 'red' : 'light'}
-			size="xs"
-			nonCaptureEvent={!genLoading}
-			startIcon={{ icon: Wand2 }}
-			iconOnly
-			title="AI Assistant"
-			btnClasses="text-ai bg-violet-100 dark:bg-gray-700"
-			loading={genLoading}
-			clickableWhileLoading
-			on:click={genLoading ? () => abortController?.abort() : () => {}}
-		/>
-	{/snippet}
-	{#snippet content({ close })}
-		<div class="border rounded-lg shadow-lg p-4 bg-surface">
-			{#if $copilotInfo.enabled}
-				<div class="flex w-96">
-					<input
-						bind:this={instructionsField}
-						type="text"
-						placeholder="CRON schedule description"
-						bind:value={instructions}
-						onkeypress={({ key }) => {
-							if (key === 'Enter' && instructions.length > 0) {
+{#if !$copilotInfo.workspaceDisabled}
+	<Popover floatingConfig={{ strategy: 'absolute', placement: 'bottom-end' }}>
+		{#snippet trigger()}
+			<Button
+				color={genLoading ? 'red' : 'light'}
+				size="xs"
+				nonCaptureEvent={!genLoading}
+				startIcon={{ icon: Wand2 }}
+				iconOnly
+				title="AI Assistant"
+				btnClasses="text-ai bg-violet-100 dark:bg-gray-700"
+				loading={genLoading}
+				clickableWhileLoading
+				on:click={genLoading ? () => abortController?.abort() : () => {}}
+			/>
+		{/snippet}
+		{#snippet content({ close })}
+			<div class="border rounded-lg shadow-lg p-4 bg-surface">
+				{#if $copilotInfo.enabled}
+					<div class="flex w-96">
+						<input
+							bind:this={instructionsField}
+							type="text"
+							placeholder="CRON schedule description"
+							bind:value={instructions}
+							onkeypress={({ key }) => {
+								if (key === 'Enter' && instructions.length > 0) {
+									close()
+									generateCron()
+								}
+							}}
+						/>
+						<Button
+							size="xs"
+							color="light"
+							variant="contained"
+							buttonType="button"
+							btnClasses="!ml-2 text-ai bg-violet-100 dark:bg-gray-700"
+							title="Generate CRON schedule from prompt"
+							aria-label="Generate"
+							iconOnly
+							on:click={() => {
 								close()
 								generateCron()
-							}
-						}}
-					/>
-					<Button
-						size="xs"
-						color="light"
-						variant="contained"
-						buttonType="button"
-						btnClasses="!ml-2 text-ai bg-violet-100 dark:bg-gray-700"
-						title="Generate CRON schedule from prompt"
-						aria-label="Generate"
-						iconOnly
-						on:click={() => {
-							close()
-							generateCron()
-						}}
-						disabled={instructions.length == 0}
-						startIcon={{ icon: Wand2 }}
-					/>
-				</div>
-			{:else}
-				<div class="block text-primary">
-					<p class="text-sm"
-						>Enable Windmill AI in the <a
-							href="{base}/workspace_settings?tab=ai"
-							target="_blank"
-							class="inline-flex flex-row items-center gap-1"
-							>workspace settings <ExternalLink size={16} /></a
-						></p
-					>
-				</div>
-			{/if}
-		</div>
-	{/snippet}
-</Popover>
+							}}
+							disabled={instructions.length == 0}
+							startIcon={{ icon: Wand2 }}
+						/>
+					</div>
+				{:else}
+					<div class="block text-primary">
+						<p class="text-sm"
+							>Enable Windmill AI in the <a
+								href="{base}/workspace_settings?tab=ai"
+								target="_blank"
+								class="inline-flex flex-row items-center gap-1"
+								>workspace settings <ExternalLink size={16} /></a
+							></p
+						>
+					</div>
+				{/if}
+			</div>
+		{/snippet}
+	</Popover>
+{/if}
diff --git a/frontend/src/lib/components/copilot/RegexGen.svelte b/frontend/src/lib/components/copilot/RegexGen.svelte
index e61ab5cbf2..f399726988 100644
--- a/frontend/src/lib/components/copilot/RegexGen.svelte
+++ b/frontend/src/lib/components/copilot/RegexGen.svelte
@@ -1,5 +1,5 @@
 <script lang="ts">
-	import { run } from 'svelte/legacy';
+	import { run } from 'svelte/legacy'
 
 	import { base } from '$lib/base'
 	import { Button } from '../common'
@@ -55,7 +55,7 @@
 
 	run(() => {
 		input && setTimeout(() => input?.focus(), 100)
-	});
+	})
 
 	let promptHistory: string[] = $state(JSON.parse(getPromptsRegex() || '[]'))
 
@@ -93,17 +93,17 @@
 	}
 </script>
 
-<Popover
-	floatingConfig={{
-		middleware: [
-			autoPlacement({
-				allowedPlacements: ['bottom-start', 'bottom-end', 'top-start', 'top-end', 'top', 'bottom']
-			})
-		]
-	}}
->
-	{#snippet trigger()}
-	
+{#if !$copilotInfo.workspaceDisabled}
+	<Popover
+		floatingConfig={{
+			middleware: [
+				autoPlacement({
+					allowedPlacements: ['bottom-start', 'bottom-end', 'top-start', 'top-end', 'top', 'bottom']
+				})
+			]
+		}}
+	>
+		{#snippet trigger()}
 			<Button
 				title="Generate regexes from prompt"
 				btnClasses="text-ai bg-violet-100 dark:bg-gray-700"
@@ -116,10 +116,8 @@
 				clickableWhileLoading
 				on:click={genLoading ? () => abortController?.abort() : () => {}}
 			/>
-		
-	{/snippet}
-	{#snippet content({ close })}
-	
+		{/snippet}
+		{#snippet content({ close })}
 			<div class="block text-primary p-4">
 				{#if $copilotInfo.enabled}
 					<div class="flex flex-col gap-4">
@@ -129,11 +127,11 @@
 								bind:this={input}
 								bind:value={funcDesc}
 								onkeypress={({ key }) => {
-								if (key === 'Enter' && funcDesc?.length > 0) {
-									close()
-									onGenerate()
-								}
-							}}
+									if (key === 'Enter' && funcDesc?.length > 0) {
+										close()
+										onGenerate()
+									}
+								}}
 								placeholder="Describe what the regex should do"
 							/>
 							<Button
@@ -183,6 +181,6 @@
 					</p>
 				{/if}
 			</div>
-		
-	{/snippet}
-</Popover>
+		{/snippet}
+	</Popover>
+{/if}
diff --git a/frontend/src/lib/components/copilot/ResourceGen.svelte b/frontend/src/lib/components/copilot/ResourceGen.svelte
index 34534285b4..2fc3cfa646 100644
--- a/frontend/src/lib/components/copilot/ResourceGen.svelte
+++ b/frontend/src/lib/components/copilot/ResourceGen.svelte
@@ -119,69 +119,71 @@
 	})
 </script>
 
-<Popover floatingConfig={{ strategy: 'absolute', placement: 'bottom-end' }}>
-	{#snippet trigger()}
-		<Button
-			color={genLoading ? 'red' : 'light'}
-			size="xs"
-			unifiedSize="md"
-			nonCaptureEvent={!genLoading}
-			startIcon={{ icon: Wand2 }}
-			iconOnly
-			title="AI Assistant"
-			btnClasses="text-ai bg-violet-100 dark:bg-gray-700"
-			loading={genLoading}
-			clickableWhileLoading
-			on:click={genLoading ? () => abortController?.abort() : () => {}}
-		/>
-	{/snippet}
-	{#snippet content({ close })}
-		<div class="border rounded-lg shadow-lg p-4 bg-surface">
-			{#if $copilotInfo.enabled}
-				<div class="flex flex-col w-80 gap-2">
-					<textarea
-						bind:this={instructionsField}
-						placeholder="Describe the resource values to generate..."
-						bind:value={instructions}
-						rows={3}
-						class="text-xs"
-						onkeydown={(e) => {
-							if (e.key === 'Enter' && !e.shiftKey && instructions.length > 0) {
-								e.preventDefault()
+{#if !$copilotInfo.workspaceDisabled}
+	<Popover floatingConfig={{ strategy: 'absolute', placement: 'bottom-end' }}>
+		{#snippet trigger()}
+			<Button
+				color={genLoading ? 'red' : 'light'}
+				size="xs"
+				unifiedSize="md"
+				nonCaptureEvent={!genLoading}
+				startIcon={{ icon: Wand2 }}
+				iconOnly
+				title="AI Assistant"
+				btnClasses="text-ai bg-violet-100 dark:bg-gray-700"
+				loading={genLoading}
+				clickableWhileLoading
+				on:click={genLoading ? () => abortController?.abort() : () => {}}
+			/>
+		{/snippet}
+		{#snippet content({ close })}
+			<div class="border rounded-lg shadow-lg p-4 bg-surface">
+				{#if $copilotInfo.enabled}
+					<div class="flex flex-col w-80 gap-2">
+						<textarea
+							bind:this={instructionsField}
+							placeholder="Describe the resource values to generate..."
+							bind:value={instructions}
+							rows={3}
+							class="text-xs"
+							onkeydown={(e) => {
+								if (e.key === 'Enter' && !e.shiftKey && instructions.length > 0) {
+									e.preventDefault()
+									close()
+									generateResource()
+								}
+							}}
+						></textarea>
+						<Button
+							size="xs"
+							color="light"
+							variant="contained"
+							buttonType="button"
+							btnClasses="text-ai bg-violet-100 dark:bg-gray-700"
+							title="Generate resource from prompt"
+							on:click={() => {
 								close()
 								generateResource()
-							}
-						}}
-					></textarea>
-					<Button
-						size="xs"
-						color="light"
-						variant="contained"
-						buttonType="button"
-						btnClasses="text-ai bg-violet-100 dark:bg-gray-700"
-						title="Generate resource from prompt"
-						on:click={() => {
-							close()
-							generateResource()
-						}}
-						disabled={instructions.length == 0}
-						startIcon={{ icon: Wand2 }}
-					>
-						Generate
-					</Button>
-				</div>
-			{:else}
-				<div class="block text-primary">
-					<p class="text-sm"
-						>Enable Windmill AI in the <a
-							href="{base}/workspace_settings?tab=ai"
-							target="_blank"
-							class="inline-flex flex-row items-center gap-1"
-							>workspace settings <ExternalLink size={16} /></a
-						></p
-					>
-				</div>
-			{/if}
-		</div>
-	{/snippet}
-</Popover>
+							}}
+							disabled={instructions.length == 0}
+							startIcon={{ icon: Wand2 }}
+						>
+							Generate
+						</Button>
+					</div>
+				{:else}
+					<div class="block text-primary">
+						<p class="text-sm"
+							>Enable Windmill AI in the <a
+								href="{base}/workspace_settings?tab=ai"
+								target="_blank"
+								class="inline-flex flex-row items-center gap-1"
+								>workspace settings <ExternalLink size={16} /></a
+							></p
+						>
+					</div>
+				{/if}
+			</div>
+		{/snippet}
+	</Popover>
+{/if}
diff --git a/frontend/src/lib/components/copilot/ScriptFix.svelte b/frontend/src/lib/components/copilot/ScriptFix.svelte
index d6ccb26ab8..f586ad1aaf 100644
--- a/frontend/src/lib/components/copilot/ScriptFix.svelte
+++ b/frontend/src/lib/components/copilot/ScriptFix.svelte
@@ -77,7 +77,7 @@
 	const sessionScopedManager = getContext<AIChatManager | undefined>('aiChatManager')
 </script>
 
-{#if SUPPORTED_LANGUAGES.has(lang)}
+{#if SUPPORTED_LANGUAGES.has(lang) && !$copilotInfo.workspaceDisabled}
 	{#if sessionScopedManager}
 		<Button
 			title="Fix the failing run in this chat"
diff --git a/frontend/src/lib/components/copilot/ScriptGen.svelte b/frontend/src/lib/components/copilot/ScriptGen.svelte
index 0c7156002d..fea738b8f1 100644
--- a/frontend/src/lib/components/copilot/ScriptGen.svelte
+++ b/frontend/src/lib/components/copilot/ScriptGen.svelte
@@ -355,7 +355,7 @@
 		</div>
 	{/if}
 {/if}
-{#if ($generatedCode.length === 0 || genLoading) && SUPPORTED_LANGUAGES.has(lang ?? '')}
+{#if ($generatedCode.length === 0 || genLoading) && SUPPORTED_LANGUAGES.has(lang ?? '') && !$copilotInfo.workspaceDisabled}
 	<Popover
 		floatingConfig={{
 			middleware: [
diff --git a/frontend/src/lib/components/copilot/StepGenQuick.svelte b/frontend/src/lib/components/copilot/StepGenQuick.svelte
index 22858c98c9..0be2fecb4c 100644
--- a/frontend/src/lib/components/copilot/StepGenQuick.svelte
+++ b/frontend/src/lib/components/copilot/StepGenQuick.svelte
@@ -1,5 +1,6 @@
 <script lang="ts">
 	import { workspaceStore } from '$lib/stores'
+	import { copilotInfo } from '$lib/aiStore'
 	import { ScriptService, type Script } from '$lib/gen'
 
 	import { Wand2, Loader2 } from 'lucide-svelte'
@@ -27,6 +28,7 @@
 		filteredItems = $bindable([])
 	}: Props = $props()
 	let prefilteredItems = $derived(scripts ?? [])
+	let aiHidden = $derived(disableAi || $copilotInfo.workspaceDisabled)
 
 	const dispatch = createEventDispatcher()
 
@@ -80,7 +82,7 @@
 				onkeydown: (e) => {
 					if (e.key === 'Escape') dispatch('escape')
 				},
-				placeholder: `Search ${trigger ? 'triggers' : 'scripts'} ${disableAi ? '' : 'or AI gen'}`
+				placeholder: `Search ${trigger ? 'triggers' : 'scripts'} ${aiHidden ? '' : 'or AI gen'}`
 			}}
 			size="sm"
 		/>
@@ -89,7 +91,7 @@
 		{#if loading}
 			<Loader2 size={12} class="animate-spin text-gray-400" />
 		{/if}
-		{#if funcDesc?.length === 0 && !loading && !disableAi}
+		{#if funcDesc?.length === 0 && !loading && !aiHidden}
 			<Wand2 size={12} class="fill-current opacity-70 text-ai" />
 		{/if}
 	</div>
diff --git a/frontend/src/lib/components/copilot/StepInputsGen.svelte b/frontend/src/lib/components/copilot/StepInputsGen.svelte
index 5b1ddb741b..c9ef616aa5 100644
--- a/frontend/src/lib/components/copilot/StepInputsGen.svelte
+++ b/frontend/src/lib/components/copilot/StepInputsGen.svelte
@@ -226,7 +226,7 @@ input_name2: expression2
 				Fill inputs
 			{/if}
 		</Button>
-	{:else}
+	{:else if !$copilotInfo.workspaceDisabled}
 		<Popover
 			floatingConfig={{
 				placement: 'top-end'
diff --git a/frontend/src/lib/components/copilot/chat/AIButton.svelte b/frontend/src/lib/components/copilot/chat/AIButton.svelte
index ade1bd2d86..7420e8d6b7 100644
--- a/frontend/src/lib/components/copilot/chat/AIButton.svelte
+++ b/frontend/src/lib/components/copilot/chat/AIButton.svelte
@@ -38,7 +38,7 @@
 		{/snippet}
 		{@render button({ onPress: () => togglePanel() })}
 	</DarkPopover>
-{:else}
+{:else if !$copilotInfo.workspaceDisabled}
 	<Popover placement="bottom" class="h-full">
 		{#snippet trigger()}
 			{@render button({ onPress: () => togglePanel() })}
diff --git a/frontend/src/lib/components/copilot/chat/AIChat.svelte b/frontend/src/lib/components/copilot/chat/AIChat.svelte
index 414be0a741..fd95613f2e 100644
--- a/frontend/src/lib/components/copilot/chat/AIChat.svelte
+++ b/frontend/src/lib/components/copilot/chat/AIChat.svelte
@@ -69,11 +69,13 @@
 				: freeTierExhausted
 					? ''
 					: !hasCopilot
-						? $aiUserDisabled
-							? 'Windmill AI is disabled in your account settings'
-							: isAdmin
-								? `Enable Windmill AI in your [workspace settings](${base}/workspace_settings?tab=ai) to use this chat`
-								: 'Ask an admin to enable Windmill AI in this workspace to use this chat'
+						? $copilotInfo.workspaceDisabled
+							? 'Windmill AI is hidden in this workspace'
+							: $aiUserDisabled
+								? 'Windmill AI is disabled in your account settings'
+								: isAdmin
+									? `Enable Windmill AI in your [workspace settings](${base}/workspace_settings?tab=ai) to use this chat`
+									: 'Ask an admin to enable Windmill AI in this workspace to use this chat'
 						: aiChatManager.mode === AIMode.SCRIPT &&
 							  aiChatManager.scriptEditorOptions?.lang &&
 							  !SUPPORTED_CHAT_SCRIPT_LANGUAGES.includes(aiChatManager.scriptEditorOptions.lang)
diff --git a/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts b/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
index 61ed493a66..fb54204fe9 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
+++ b/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
@@ -2350,6 +2350,10 @@ export class AIChatManager {
 	}
 
 	openChat = () => {
+		// Nothing may open the docked pane in a workspace that hid the assistant.
+		if (get(copilotInfo).workspaceDisabled) {
+			return
+		}
 		chatState.size = this.savedSize > 0 ? this.savedSize : DEFAULT_SIZE
 		localStorage.setItem('ai-chat-open', 'true')
 	}
@@ -2361,6 +2365,9 @@ export class AIChatManager {
 	}
 
 	toggleOpen = () => {
+		if (chatState.size === 0 && get(copilotInfo).workspaceDisabled) {
+			return
+		}
 		if (chatState.size > 0) {
 			this.savedSize = chatState.size
 		}
@@ -2880,6 +2887,12 @@ export class AIChatManager {
 			sendUserToast('This action needs the AI chat. Start an AI session to continue.', true)
 			return
 		}
+		// The workspace hid the assistant: every entry point is gone from the UI, so a turn
+		// reaching here comes from a path that missed the gate and would stream unseen.
+		if (!this.isSessionChat && get(copilotInfo).workspaceDisabled) {
+			sendUserToast('Windmill AI is hidden in this workspace.', true)
+			return
+		}
 		// Refused before anything mutates, so there is nothing to unwind: the
 		// draft (already taken by the composer) goes back where the user can see
 		// it, and the turn never starts. Only the message's own send restores it
diff --git a/frontend/src/lib/components/copilot/chat/AiChatLayout.svelte b/frontend/src/lib/components/copilot/chat/AiChatLayout.svelte
index 1a9df4816c..4f3ef368ad 100644
--- a/frontend/src/lib/components/copilot/chat/AiChatLayout.svelte
+++ b/frontend/src/lib/components/copilot/chat/AiChatLayout.svelte
@@ -7,6 +7,7 @@
 	import { userStore, workspaceStore } from '$lib/stores'
 	import { chatState } from './sharedChatState.svelte'
 	import { loadCopilot } from '$lib/components/copilot/loadCopilot'
+	import { copilotInfo } from '$lib/aiStore'
 	import { aiChatManager } from './AIChatManager.svelte'
 	import { onDestroy } from 'svelte'
 	import Button from '$lib/components/common/button/Button.svelte'
@@ -66,6 +67,14 @@
 		}
 	})
 
+	// The pane restores its last open state from localStorage before the config can say
+	// the workspace hid the assistant; close it as soon as that is known.
+	$effect(() => {
+		if ($copilotInfo.workspaceDisabled && chatState.size > 0) {
+			aiChatManager.closeChat()
+		}
+	})
+
 	const historyManager = aiChatManager.historyManager
 	historyManager.init()
 
diff --git a/frontend/src/lib/components/flows/content/FlowInputsQuick.svelte b/frontend/src/lib/components/flows/content/FlowInputsQuick.svelte
index dd72dc95af..eb875973dc 100644
--- a/frontend/src/lib/components/flows/content/FlowInputsQuick.svelte
+++ b/frontend/src/lib/components/flows/content/FlowInputsQuick.svelte
@@ -245,6 +245,7 @@
 	// on indices that render nothing.
 	let showAiRows = $derived(
 		!disableAi &&
+			!$copilotInfo.workspaceDisabled &&
 			funcDesc?.length > 0 &&
 			kind != 'failure' &&
 			kind != 'preprocessor' &&
diff --git a/frontend/src/lib/components/home/HomeAIChat.svelte b/frontend/src/lib/components/home/HomeAIChat.svelte
index 41c2930596..2d57f669b7 100644
--- a/frontend/src/lib/components/home/HomeAIChat.svelte
+++ b/frontend/src/lib/components/home/HomeAIChat.svelte
@@ -96,11 +96,18 @@
 
 	// The composer hands off to /sessions, which refuses operators — so hide it from them (the
 	// prompt would be silently dropped) while the AI-independent CLI/MCP row below stays.
-	let showComposer = $derived(prefersSessionHandoff($userStore?.operator) && !runOnlyWorkspace)
+	let showComposer = $derived(
+		prefersSessionHandoff($userStore?.operator) &&
+			!runOnlyWorkspace &&
+			!$copilotInfo.workspaceDisabled
+	)
 
-	// The hero's margins are for the full block; around the lone button row left by a collapsed,
-	// operator or run-only view they would just be empty page.
-	let outerSpacing = $derived(showComposer && !collapsed ? 'mt-20 mb-16' : 'mt-8 mb-2')
+	// The hero's margins and centered column are for the full block. The lone button row left
+	// by a collapsed, operator, run-only or hidden-assistant view is a hint line and should
+	// cost the page almost nothing: no top margin, and the content column's full width so it
+	// hugs the right edge instead of floating centered in empty space.
+	let hero = $derived(showComposer && !collapsed)
+	let outerSpacing = $derived(hero ? 'mt-20 mb-16' : 'mt-0 mb-1')
 
 	let starting = $state(false)
 	async function start() {
@@ -167,7 +174,7 @@
 </script>
 
 <div class="w-full flex justify-center {outerSpacing}">
-	<div class="max-w-[40rem] grow relative group">
+	<div class="{hero ? 'max-w-[40rem]' : ''} grow relative group">
 		{#if showComposer && !collapsed}
 			{#if !disabled}
 				<!-- The one dismiss control while the composer is usable; the overlay below carries its
diff --git a/frontend/src/lib/components/raw_apps/RawAppTemplatePicker.svelte b/frontend/src/lib/components/raw_apps/RawAppTemplatePicker.svelte
index fc8abd5d5c..7ead1f6fb0 100644
--- a/frontend/src/lib/components/raw_apps/RawAppTemplatePicker.svelte
+++ b/frontend/src/lib/components/raw_apps/RawAppTemplatePicker.svelte
@@ -345,70 +345,73 @@
 				{/if}
 			</div>
 
-			<div class="pt-6">
-				<h2 class="text-xs font-semibold text-emphasis mb-1 flex items-center gap-2">
-					<Sparkles size={16} class="text-ai" />
-					Start with AI
-					<span class="text-xs font-normal text-tertiary">(optional)</span>
-				</h2>
+			{#if !$copilotInfo.workspaceDisabled}
+				<div class="pt-6">
+					<h2 class="text-xs font-semibold text-emphasis mb-1 flex items-center gap-2">
+						<Sparkles size={16} class="text-ai" />
+						Start with AI
+						<span class="text-xs font-normal text-tertiary">(optional)</span>
+					</h2>
 
-				{#if !aiConfigLoaded}
-					<div class="flex items-center gap-2 text-xs text-tertiary">
-						<Loader2 size={14} class="animate-spin" />
-						Loading AI settings...
-					</div>
-				{:else if !isAiEnabled}
-					<Alert type="info" title="AI is not configured.">
-						You can still create an app manually but using AI is highly recommended.
-						<br />
-						{#if $userStore?.is_admin}
-							Configure AI in
-							<a
-								href="{base}/workspace_settings?tab=ai"
-								target="_blank"
-								class="inline-flex items-center gap-1 font-semibold"
-								>workspace settings <ExternalLinkIcon size={16} />
-							</a>
-							{#if $superadmin}
-								or
+					{#if !aiConfigLoaded}
+						<div class="flex items-center gap-2 text-xs text-tertiary">
+							<Loader2 size={14} class="animate-spin" />
+							Loading AI settings...
+						</div>
+					{:else if !isAiEnabled}
+						<Alert type="info" title="AI is not configured.">
+							You can still create an app manually but using AI is highly recommended.
+							<br />
+							{#if $userStore?.is_admin}
+								Configure AI in
+								<a
+									href="{base}/workspace_settings?tab=ai"
+									target="_blank"
+									class="inline-flex items-center gap-1 font-semibold"
+									>workspace settings <ExternalLinkIcon size={16} />
+								</a>
+								{#if $superadmin}
+									or
+									<a
+										href="{base}/?workspace=admins#superadmin-settings"
+										target="_blank"
+										class="inline-flex items-center gap-1 font-semibold"
+										>instance settings <ExternalLinkIcon size={16} />
+									</a>
+								{/if} to enable this feature.
+							{:else if $superadmin}
+								Configure AI in
 								<a
 									href="{base}/?workspace=admins#superadmin-settings"
 									target="_blank"
 									class="inline-flex items-center gap-1 font-semibold"
 									>instance settings <ExternalLinkIcon size={16} />
-								</a>
-							{/if} to enable this feature.
-						{:else if $superadmin}
-							Configure AI in
-							<a
-								href="{base}/?workspace=admins#superadmin-settings"
-								target="_blank"
-								class="inline-flex items-center gap-1 font-semibold"
-								>instance settings <ExternalLinkIcon size={16} />
-							</a> to enable this feature.
-						{:else}
-							Ask your workspace admin to configure AI in workspace settings to enable this feature.
-						{/if}
-					</Alert>
-				{:else}
-					<div class="flex flex-col gap-2">
-						<TextInput
-							underlyingInputEl="textarea"
-							bind:value={initialPrompt}
-							inputProps={{
-								rows: 3,
-								placeholder:
-									"Describe what you want to build... (e.g., 'Create a todo list app with user authentication')"
-							}}
-						/>
-						<p class="text-xs text-tertiary">
-							{handsOffToSession
-								? 'Leave empty to start with a blank template, or describe your app to open an AI session that builds it.'
-								: 'Leave empty to start with a blank template, or describe your app to get AI assistance right away.'}
-						</p>
-					</div>
-				{/if}
-			</div>
+								</a> to enable this feature.
+							{:else}
+								Ask your workspace admin to configure AI in workspace settings to enable this
+								feature.
+							{/if}
+						</Alert>
+					{:else}
+						<div class="flex flex-col gap-2">
+							<TextInput
+								underlyingInputEl="textarea"
+								bind:value={initialPrompt}
+								inputProps={{
+									rows: 3,
+									placeholder:
+										"Describe what you want to build... (e.g., 'Create a todo list app with user authentication')"
+								}}
+							/>
+							<p class="text-xs text-tertiary">
+								{handsOffToSession
+									? 'Leave empty to start with a blank template, or describe your app to open an AI session that builds it.'
+									: 'Leave empty to start with a blank template, or describe your app to get AI assistance right away.'}
+							</p>
+						</div>
+					{/if}
+				</div>
+			{/if}
 
 			<div class="pt-6 flex justify-end gap-3">
 				<Button
@@ -417,7 +420,7 @@
 					on:click={() => start(false)}
 					disabled={!templates[selectedTemplateIndex] || newSchemaAlreadyExists}
 				>
-					Start without AI
+					{$copilotInfo.workspaceDisabled ? 'Start' : 'Start without AI'}
 				</Button>
 				{#if isAiEnabled}
 					<Button
diff --git a/frontend/src/lib/components/search/GlobalSearchModal.svelte b/frontend/src/lib/components/search/GlobalSearchModal.svelte
index 3df633d167..a117d2769c 100644
--- a/frontend/src/lib/components/search/GlobalSearchModal.svelte
+++ b/frontend/src/lib/components/search/GlobalSearchModal.svelte
@@ -49,6 +49,7 @@
 	import NatsIcon from '../icons/NatsIcon.svelte'
 	import RunsSearch from './RunsSearch.svelte'
 	import AskAiButton from '../copilot/AskAiButton.svelte'
+	import { copilotInfo } from '$lib/aiStore'
 
 	let open: boolean = $state(false)
 
@@ -648,7 +649,7 @@
 							{placeholderFromPrefix(searchTerm)}
 						</label>
 					</div>
-					{#if (itemMap[tab] ?? []).length === 0 && searchTerm.length > 0}
+					{#if (itemMap[tab] ?? []).length === 0 && searchTerm.length > 0 && !$copilotInfo.workspaceDisabled}
 						<AskAiButton
 							bind:this={askAiButton}
 							label="Ask AI"
@@ -724,16 +725,18 @@
 
 						{#if (itemMap[tab] ?? []).length === 0}
 							<div class="p-2">
-								<QuickMenuItem
-									onselect={() => {
-										askAiButton?.onClick()
-									}}
-									id={'ai:no-results-ask-ai'}
-									hovered={true}
-									label={`Try asking \`${searchTerm}\` to AI`}
-									icon={WandSparkles}
-									bind:mouseMoved
-								/>
+								{#if !$copilotInfo.workspaceDisabled}
+									<QuickMenuItem
+										onselect={() => {
+											askAiButton?.onClick()
+										}}
+										id={'ai:no-results-ask-ai'}
+										hovered={true}
+										label={`Try asking \`${searchTerm}\` to AI`}
+										icon={WandSparkles}
+										bind:mouseMoved
+									/>
+								{/if}
 								<div class="flex w-full justify-center items-center">
 									<div class="text-primary text-center">
 										<div class="pt-1 text-sm">Tip: press `esc` to quickly clear the search bar</div>
diff --git a/frontend/src/lib/components/sessions/OpenInSessionButton.svelte b/frontend/src/lib/components/sessions/OpenInSessionButton.svelte
index 00bf1c829e..03ce21589e 100644
--- a/frontend/src/lib/components/sessions/OpenInSessionButton.svelte
+++ b/frontend/src/lib/components/sessions/OpenInSessionButton.svelte
@@ -40,6 +40,7 @@
 	import AIButton from '$lib/components/copilot/chat/AIButton.svelte'
 	import { AIBtnClasses } from '$lib/components/copilot/chat/AIButtonStyle'
 	import { prefersSessionHandoff } from '$lib/components/copilot/chat/global/gate'
+	import { copilotInfo } from '$lib/aiStore'
 	import { userStore } from '$lib/stores'
 	import { sendUserToast } from '$lib/toast'
 	import { openSourceInSession } from './sessionSwitch.svelte'
@@ -80,7 +81,9 @@
 	// them, so an entry point on a page they can reach (Runs, the trigger lists)
 	// would only route them into that refusal.
 	const show = $derived(
-		!inSessionPanel && !!(source?.target || source?.page) && prefersSessionHandoff($userStore?.operator)
+		!inSessionPanel &&
+			!!(source?.target || source?.page) &&
+			prefersSessionHandoff($userStore?.operator)
 	)
 
 	// Not $state: only read inside open() as a re-entrancy latch, never rendered.
@@ -102,7 +105,10 @@
 	}
 </script>
 
-{#if show}
+{#if $copilotInfo.workspaceDisabled}
+	<!-- The workspace hid the assistant: neither the hand-off nor the docked-chat
+	     fallback has anywhere to lead, so no host renders an AI button at all. -->
+{:else if show}
 	<AIButton
 		togglePanel={open}
 		btnClasses={btnClasses ?? AIBtnClasses('default')}
diff --git a/frontend/src/lib/components/workspaceSettings/AISettings.svelte b/frontend/src/lib/components/workspaceSettings/AISettings.svelte
index 467003ef12..65187d98c8 100644
--- a/frontend/src/lib/components/workspaceSettings/AISettings.svelte
+++ b/frontend/src/lib/components/workspaceSettings/AISettings.svelte
@@ -78,6 +78,7 @@
 	let modelPricing: Record<string, ModelPriceOverride> = $state({})
 	let usingOpenaiClientCredentialsOauth = $state(false)
 	let workspaceOverrideEditorOpened = $state(false)
+	let copilotDisabled = $state(false)
 
 	// --- Initial state for dirty tracking ---
 	let initialAiProviders: Exclude<AIConfig['providers'], undefined> = $state({})
@@ -88,6 +89,7 @@
 	let initialMaxTokensPerModel: Record<string, number> = $state({})
 	let initialModelPricing: Record<string, ModelPriceOverride> = $state({})
 	let initialPrompts: Record<string, string> = $state({})
+	let initialCopilotDisabled = $state(false)
 	let lastLoadedConfigKey = $state<string | undefined>(undefined)
 
 	function clone<T>(v: T): T {
@@ -115,6 +117,7 @@
 		customPrompts = clone(config?.custom_prompts ?? {})
 		maxTokensPerModel = clone(config?.max_tokens_per_model ?? {})
 		modelPricing = clone(config?.model_pricing ?? {})
+		copilotDisabled = config?.copilot_disabled === true
 		for (const mode of ['edit', 'fix', 'gen']) {
 			if (!(mode in customPrompts)) {
 				customPrompts[mode] = ''
@@ -131,6 +134,7 @@
 		initialMaxTokensPerModel = clone(maxTokensPerModel)
 		initialModelPricing = clone(modelPricing)
 		initialPrompts = clone(customPrompts)
+		initialCopilotDisabled = copilotDisabled
 	}
 
 	export function loadFromConfig(config: AIConfig | undefined) {
@@ -146,6 +150,7 @@
 		customPrompts = clone(initialCustomPrompts)
 		maxTokensPerModel = clone(initialMaxTokensPerModel)
 		modelPricing = clone(initialModelPricing)
+		copilotDisabled = initialCopilotDisabled
 	}
 
 	$effect(() => {
@@ -180,7 +185,8 @@
 			codeCompletionModel !== initialCodeCompletionModel ||
 			JSON.stringify(customPrompts) !== JSON.stringify(initialCustomPrompts) ||
 			JSON.stringify(maxTokensPerModel) !== JSON.stringify(initialMaxTokensPerModel) ||
-			JSON.stringify(modelPricing) !== JSON.stringify(initialModelPricing)
+			JSON.stringify(modelPricing) !== JSON.stringify(initialModelPricing) ||
+			copilotDisabled !== initialCopilotDisabled
 	)
 
 	$effect(() => {
@@ -285,6 +291,8 @@
 			.filter(([_, prompt]) => prompt.trim().length > 0)
 			.reduce((acc, [mode, prompt]) => ({ ...acc, [mode]: prompt }), {})
 
+		// The flag is the one thing a workspace on instance defaults still stores of its own.
+		const copilot_disabled = copilotDisabled ? true : undefined
 		return Object.keys(aiProviders ?? {}).length > 0
 			? {
 					providers: aiProviders,
@@ -294,9 +302,10 @@
 					custom_prompts: Object.keys(custom_prompts).length > 0 ? custom_prompts : undefined,
 					max_tokens_per_model:
 						Object.keys(maxTokensPerModel).length > 0 ? maxTokensPerModel : undefined,
-					model_pricing: Object.keys(modelPricing).length > 0 ? modelPricing : undefined
+					model_pricing: Object.keys(modelPricing).length > 0 ? modelPricing : undefined,
+					copilot_disabled
 				}
-			: {}
+			: { copilot_disabled }
 	}
 
 	function isSaveDisabled(): boolean {
@@ -633,12 +642,27 @@
 	<ModelPricing {aiProviders} bind:modelPricing />
 {/if}
 
-{#if showWorkspaceOverrideEditor}
-	<SettingsFooter
-		hasUnsavedChanges={dirty}
-		onSave={editCopilotConfig}
-		onDiscard={discard}
-		saveLabel="Save AI settings"
-		disabled={isSaveDisabled()}
-	/>
+{#if promptScope === 'workspace'}
+	<SettingCard
+		label="Hide AI sessions"
+		description="Hides AI sessions and every other AI assistant button (chat, code generation and completion, AI fix) from all members of this workspace. AI agent steps and the AI sandbox in flows are not affected and keep using the providers configured above. This hides the assistant in the UI only; it does not restrict API access to the configured providers."
+	>
+		<Toggle
+			checked={copilotDisabled}
+			on:change={(e) => {
+				copilotDisabled = e.detail
+			}}
+			options={{ right: 'Hide AI sessions in this workspace' }}
+		/>
+	</SettingCard>
 {/if}
+
+<!-- Not gated on `showWorkspaceOverrideEditor`: a workspace on instance defaults still has
+     the hide toggle above to save. -->
+<SettingsFooter
+	hasUnsavedChanges={dirty}
+	onSave={editCopilotConfig}
+	onDiscard={discard}
+	saveLabel="Save AI settings"
+	disabled={isSaveDisabled()}
+/>
diff --git a/frontend/src/routes/(root)/(logged)/+layout.svelte b/frontend/src/routes/(root)/(logged)/+layout.svelte
index 257af0fbbd..a20c61f2ff 100644
--- a/frontend/src/routes/(root)/(logged)/+layout.svelte
+++ b/frontend/src/routes/(root)/(logged)/+layout.svelte
@@ -83,6 +83,7 @@
 	import SessionPicker from '$lib/components/sessions/SessionPicker.svelte'
 	import SessionModeSwitch from '$lib/components/sessions/SessionModeSwitch.svelte'
 	import { isGlobalAiEnabled } from '$lib/components/copilot/chat/global/gate'
+	import { copilotInfo } from '$lib/aiStore'
 	import { parsePreviewItemRoute } from '$lib/components/sessions/previewPaths'
 	import { rememberNavRoute } from '$lib/components/sessions/sessionSwitch.svelte'
 	import { sessionState } from '$lib/components/sessions/sessionState.svelte'
@@ -250,6 +251,10 @@
 	// so it follows the gate; opted-out users get the legacy Ask-AI pane instead.
 	// The /sessions page has its own gate for direct navigation.
 	const globalAiEnabled = isGlobalAiEnabled()
+	// A workspace that hid the assistant (`ai_config.copilot_disabled`) loses both entry
+	// points: the Workspace ⇄ Sessions switch and the legacy Ask-AI button.
+	const sessionsSwitchShown = $derived(globalAiEnabled && !$copilotInfo.workspaceDisabled)
+	const askAiShown = $derived(!globalAiEnabled && !$copilotInfo.workspaceDisabled)
 
 	if (page.status == 404) {
 		goto('/user/login')
@@ -999,7 +1004,7 @@
 										</Menubar>
 									</div>
 
-									{#if !embedded && globalAiEnabled}
+									{#if !embedded && sessionsSwitchShown}
 										<!-- The switch: workspace navigation ⇄ sessions sidebar. -->
 										<div class="px-2 pb-1 w-52">
 											<SessionModeSwitch
@@ -1011,7 +1016,7 @@
 
 									{#if !sessionMode}
 										<!-- Workspace scope (fork picker): part of the top workspace group. -->
-										<div class="pb-1 w-52 {globalAiEnabled ? '' : '-mt-1'}">
+										<div class="pb-1 w-52 {sessionsSwitchShown ? '' : '-mt-1'}">
 											<WorkspaceScopeHeader isCollapsed={false} />
 										</div>
 									{/if}
@@ -1047,7 +1052,7 @@
 													class="!text-xs"
 													shortcut={`${getModifierKey()}k`}
 												/>
-												{#if !globalAiEnabled}
+												{#if askAiShown}
 													<!-- Legacy Ask-AI pane, shown only when the user opted out of the
 													     AI Sessions beta (otherwise SessionModeSwitch replaces it). -->
 													<MenuButton
@@ -1134,7 +1139,7 @@
 								</Menubar>
 							</div>
 
-							{#if !embedded && globalAiEnabled}
+							{#if !embedded && sessionsSwitchShown}
 								<!-- The switch: workspace navigation ⇄ sessions sidebar. -->
 								<div class="px-2 pb-1 {isCollapsed ? 'flex justify-center' : ''}">
 									<SessionModeSwitch mode={sessionMode ? 'session' : 'nav'} {isCollapsed} />
@@ -1145,7 +1150,7 @@
 								<!-- Workspace scope (fork picker): part of the top workspace group,
 								     together with the family menu and the mode switch above. Without
 								     the switch, pull it up so the group still reads as one block. -->
-								<div class="pb-1 {globalAiEnabled ? '' : '-mt-1'}">
+								<div class="pb-1 {sessionsSwitchShown ? '' : '-mt-1'}">
 									<WorkspaceScopeHeader {isCollapsed} />
 								</div>
 							{/if}
@@ -1184,7 +1189,7 @@
 											class="!text-xs"
 											shortcut={`${getModifierKey()}k`}
 										/>
-										{#if !globalAiEnabled}
+										{#if askAiShown}
 											<!-- Legacy Ask-AI pane, shown only when the user opted out of the
 											     AI Sessions beta (otherwise SessionModeSwitch replaces it). -->
 											<MenuButton
@@ -1323,19 +1328,21 @@
 									class="!text-xs"
 									shortcut={`${getModifierKey()}k`}
 								/>
-								<MenuButton
-									stopPropagationOnClick={true}
-									on:click={() => aiChatManager.toggleOpen()}
-									{isCollapsed}
-									icon={WandSparkles}
-									iconProps={{
-										forceDarkMode: true
-									}}
-									label="Ask AI"
-									class="!text-xs"
-									iconClasses="!text-ai"
-									shortcut={`${getModifierKey()}L`}
-								/>
+								{#if !$copilotInfo.workspaceDisabled}
+									<MenuButton
+										stopPropagationOnClick={true}
+										on:click={() => aiChatManager.toggleOpen()}
+										{isCollapsed}
+										icon={WandSparkles}
+										iconProps={{
+											forceDarkMode: true
+										}}
+										label="Ask AI"
+										class="!text-xs"
+										iconClasses="!text-ai"
+										shortcut={`${getModifierKey()}L`}
+									/>
+								{/if}
 							</div>
 
 							<SidebarContent
diff --git a/frontend/src/routes/(root)/(logged)/sessions/+page.svelte b/frontend/src/routes/(root)/(logged)/sessions/+page.svelte
index fbf045fe19..cbcbe92e82 100644
--- a/frontend/src/routes/(root)/(logged)/sessions/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/sessions/+page.svelte
@@ -21,6 +21,8 @@
 		type Scope
 	} from '$lib/components/sessions/PreviewRouterPicker.svelte'
 	import { goto } from '$lib/navigation'
+	import { resource } from 'runed'
+	import { WorkspaceService } from '$lib/gen'
 	import SessionWrapper from '$lib/components/sessions/SessionWrapper.svelte'
 	import PreviewTabHost from '$lib/components/sessions/PreviewTabHost.svelte'
 	import { useIsDarkMode } from '$lib/components/DarkModeObserver.svelte'
@@ -278,6 +280,36 @@
 		(activeSession ? getEffectiveWorkspaceId(activeSession) : undefined) ?? $workspaceStore
 	)
 
+	// Whether that workspace hid the AI assistant (`ai_config.copilot_disabled`). Read
+	// directly rather than from `copilotInfo`: that store holds whichever workspace loaded
+	// last, and the gate below unmounts the session wrapper that would refresh it, so a
+	// hidden verdict would stick across session and workspace switches. Tagged with its
+	// workspace and guarded against a superseded response like the protection-rules
+	// resource: runed keeps the previous `current` while a new source loads, so a switch
+	// would otherwise be judged on the previous workspace's verdict. A failed read leaves
+	// the page usable, as an unloaded config does everywhere else.
+	const workspaceAiHidden = resource(
+		() => previewWorkspace,
+		async (workspace, _prev, { signal }) => {
+			if (!workspace) return { workspace, hidden: false }
+			let hidden = false
+			try {
+				hidden = (await WorkspaceService.getCopilotInfo({ workspace })).copilot_disabled === true
+			} catch (e) {
+				console.error(`Failed to read the AI config of workspace ${workspace}:`, e)
+			}
+			// The generated client can't take an abort signal, so drop a superseded response here.
+			if (signal.aborted) throw new DOMException('superseded', 'AbortError')
+			return { workspace, hidden }
+		}
+	)
+	// Only a verdict for the workspace currently judged counts; `undefined` means it has not
+	// landed yet.
+	const aiHiddenVerdict = $derived.by(() => {
+		const current = workspaceAiHidden.current
+		return current && current.workspace === previewWorkspace ? current.hidden : undefined
+	})
+
 	// Lazy-mount gate: a tab's content only renders once its key lands here (on
 	// first activation) — so restoring a session with N saved tabs boots just
 	// the active one instead of N full Windmill apps at once. Pure "has this
@@ -836,284 +868,309 @@
 			<Loader2 class="animate-spin" />
 		</div>
 	{:else}
-		<div class="flex-1 min-h-0 flex flex-row relative" use:splitterPointerCapture>
-			<Splitpanes
-				horizontal={false}
-				class="flex-1 min-h-0 session-splitter {previewCollapsed ? 'splitter-off' : ''}"
+		<!-- The hidden-assistant verdict overlays the session stack rather than replacing
+		     it: warm sessions and mounted preview editors must survive a cross-workspace
+		     switch, and a verdict still loading would otherwise tear them down on every
+		     one. The covered stack is inert so nothing under the overlay takes focus. -->
+		<div class="flex-1 min-h-0 flex flex-col relative">
+			<div
+				class="flex-1 min-h-0 flex flex-row relative z-0"
+				use:splitterPointerCapture
+				inert={aiHiddenVerdict !== false}
 			>
-				{#if !fullscreen}
-					<!-- Chat column. Warm sessions stay mounted (stacked, visibility-toggled)
+				<Splitpanes
+					horizontal={false}
+					class="flex-1 min-h-0 session-splitter {previewCollapsed ? 'splitter-off' : ''}"
+				>
+					{#if !fullscreen}
+						<!-- Chat column. Warm sessions stay mounted (stacked, visibility-toggled)
 					     so switching between them preserves chat scroll/draft state. -->
-					<Pane bind:size={chatPaneSize} minSize={25} class="flex flex-col min-h-0">
-						<div class="relative flex-1 min-h-0">
-							{#each warmSessions as s (s.id)}
-								<div
-									class="absolute inset-0 flex flex-col {s.id === activeSession?.id
-										? 'z-10 opacity-100 pointer-events-auto'
-										: 'z-0 opacity-0 pointer-events-none'}"
-									aria-hidden={s.id !== activeSession?.id}
-								>
-									<SessionWrapper sessionId={s.id} />
-								</div>
-							{/each}
-						</div>
-					</Pane>
-				{/if}
+						<Pane bind:size={chatPaneSize} minSize={25} class="flex flex-col min-h-0">
+							<div class="relative flex-1 min-h-0">
+								{#each warmSessions as s (s.id)}
+									<div
+										class="absolute inset-0 flex flex-col {s.id === activeSession?.id
+											? 'z-10 opacity-100 pointer-events-auto'
+											: 'z-0 opacity-0 pointer-events-none'}"
+										aria-hidden={s.id !== activeSession?.id}
+									>
+										<SessionWrapper sessionId={s.id} />
+									</div>
+								{/each}
+							</div>
+						</Pane>
+					{/if}
 
-				<!-- Preview panel: the live Windmill page, framed like the editor pane.
+					<!-- Preview panel: the live Windmill page, framed like the editor pane.
 				     Always mounted (collapse resizes it to 0 — see previewPaneSize) so
 				     warm sessions' preview hosts survive a collapsed active session. -->
-				<Pane
-					bind:size={previewPaneSize}
-					minSize={previewCollapsed ? 0 : 30}
-					maxSize={previewCollapsed ? 0 : 100}
-					class="flex flex-col min-h-0"
-				>
-					<div class="flex-1 min-h-0 flex flex-col {fullscreen ? 'p-0' : 'p-2 pl-0'}">
-						<div
-							class="flex flex-col flex-1 min-h-0 overflow-hidden relative bg-surface {fullscreen
-								? ''
-								: 'rounded-md border border-light'}"
-						>
-							{#if !fullscreen}
-								<!-- Collapse the preview panel — floats over the top-left corner so
+					<Pane
+						bind:size={previewPaneSize}
+						minSize={previewCollapsed ? 0 : 30}
+						maxSize={previewCollapsed ? 0 : 100}
+						class="flex flex-col min-h-0"
+					>
+						<div class="flex-1 min-h-0 flex flex-col {fullscreen ? 'p-0' : 'p-2 pl-0'}">
+							<div
+								class="flex flex-col flex-1 min-h-0 overflow-hidden relative bg-surface {fullscreen
+									? ''
+									: 'rounded-md border border-light'}"
+							>
+								{#if !fullscreen}
+									<!-- Collapse the preview panel — floats over the top-left corner so
 									     the tab strip keeps the full width. -->
-								<button
-									type="button"
-									onclick={() => owner?.setCollapsed(true)}
-									title="Collapse preview"
-									aria-label="Collapse preview"
-									class="absolute top-1 left-1 z-30 inline-flex items-center justify-center w-6 h-6 rounded text-tertiary hover:text-primary hover:bg-surface-hover"
-								>
-									<PanelRightClose size={14} />
-								</button>
-							{/if}
+									<button
+										type="button"
+										onclick={() => owner?.setCollapsed(true)}
+										title="Collapse preview"
+										aria-label="Collapse preview"
+										class="absolute top-1 left-1 z-30 inline-flex items-center justify-center w-6 h-6 rounded text-tertiary hover:text-primary hover:bg-surface-hover"
+									>
+										<PanelRightClose size={14} />
+									</button>
+								{/if}
 
-							<!-- Open-in-full-page + full-screen toggle, floating over the top-right
+								<!-- Open-in-full-page + full-screen toggle, floating over the top-right
 								     corner to mirror the collapse control. -->
-							<div class="absolute top-1 right-1 z-30 flex items-center gap-0.5">
-								{#if !activeTabIsArtifact}
-									<a
-										href={withWorkspaceParam(
-											owner?.activeTab?.loc || owner?.activeTab?.url || `${base}/`,
-											previewWorkspace
-										)}
-										title="Open in workspace"
-										aria-label="Open in workspace"
+								<div class="absolute top-1 right-1 z-30 flex items-center gap-0.5">
+									{#if !activeTabIsArtifact}
+										<a
+											href={withWorkspaceParam(
+												owner?.activeTab?.loc || owner?.activeTab?.url || `${base}/`,
+												previewWorkspace
+											)}
+											title="Open in workspace"
+											aria-label="Open in workspace"
+											class="inline-flex items-center justify-center w-6 h-6 rounded text-tertiary hover:text-primary hover:bg-surface-hover"
+										>
+											<ExternalLink size={14} />
+										</a>
+									{/if}
+									<button
+										type="button"
+										onclick={() => (fullscreen = !fullscreen)}
+										title={fullscreen ? 'Exit full screen' : 'Full screen'}
+										aria-label={fullscreen ? 'Exit full screen' : 'Full screen'}
 										class="inline-flex items-center justify-center w-6 h-6 rounded text-tertiary hover:text-primary hover:bg-surface-hover"
 									>
-										<ExternalLink size={14} />
-									</a>
-								{/if}
-								<button
-									type="button"
-									onclick={() => (fullscreen = !fullscreen)}
-									title={fullscreen ? 'Exit full screen' : 'Full screen'}
-									aria-label={fullscreen ? 'Exit full screen' : 'Full screen'}
-									class="inline-flex items-center justify-center w-6 h-6 rounded text-tertiary hover:text-primary hover:bg-surface-hover"
-								>
-									{#if fullscreen}
-										<Minimize2 size={14} />
-									{:else}
-										<Maximize2 size={14} />
-									{/if}
-								</button>
-							</div>
+										{#if fullscreen}
+											<Minimize2 size={14} />
+										{:else}
+											<Maximize2 size={14} />
+										{/if}
+									</button>
+								</div>
 
-							<!-- Tab strip: open preview pages, shared with the raw-app editor
+								<!-- Tab strip: open preview pages, shared with the raw-app editor
 								     (DraggableTabs). Clicking the active tab (label or accessory chevron)
 								     toggles its breadcrumb picker; the "+" trailing opens the router picker.
 								     Left/right padding clears the floating collapse/fullscreen buttons. -->
-							<DraggableTabs
-								tabs={previewTabItems}
-								activeId={owner?.activeId ?? ''}
-								onSelect={selectTab}
-								onActiveClick={() => (activeTabPickerOpen = !activeTabPickerOpen)}
-								onClose={closeTab}
-								onReorder={reorderTabs}
-								class="session-preview-tab-strip h-8 border-b border-light bg-surface-secondary/50 {fullscreen
-									? 'pl-1.5'
-									: 'pl-9'} pr-16"
-							>
-								{#snippet tabAccessory(_tab, isActive)}
-									{#if isActive}
-										<!-- Any active-tab click toggles the picker (`onActiveClick`); the tab
+								<DraggableTabs
+									tabs={previewTabItems}
+									activeId={owner?.activeId ?? ''}
+									onSelect={selectTab}
+									onActiveClick={() => (activeTabPickerOpen = !activeTabPickerOpen)}
+									onClose={closeTab}
+									onReorder={reorderTabs}
+									class="session-preview-tab-strip h-8 border-b border-light bg-surface-secondary/50 {fullscreen
+										? 'pl-1.5'
+										: 'pl-9'} pr-16"
+								>
+									{#snippet tabAccessory(_tab, isActive)}
+										{#if isActive}
+											<!-- Any active-tab click toggles the picker (`onActiveClick`); the tab
 										     is excluded from pointerdown-outside so toggle doesn't race close.
 										     The trigger is an inert whole-tab overlay (anchor only — clickable
 										     would break dnd reorder); the chevron is purely visual. -->
-										<Popover
-											placement="bottom-start"
-											usePointerDownOutside
-											excludeSelectors=".drawer, .session-preview-tab-strip [role='tab'][aria-selected='true']"
-											disableFocusTrap
-											closeOnOtherPopoverOpen
-											enableFlyTransition
-											bind:isOpen={activeTabPickerOpen}
-											openFocus="[data-workspace-picker-search]"
-											contentClasses="flex flex-col overflow-hidden"
-											class="absolute inset-0 pointer-events-none"
-											triggerAttrs={{
-												'aria-label': 'Change preview',
-												tabindex: -1,
-												// The inert trigger only ever receives focus from melt's
-												// close-time restore; hand it straight to the tab so
-												// arrow/Delete tab shortcuts keep working.
-												onfocus: (e: FocusEvent) =>
-													(e.currentTarget as HTMLElement)
-														.closest<HTMLElement>('[role="tab"]')
-														?.focus()
-											}}
-										>
-											{#snippet content()}
-												<!-- The picker snapshots its scope at mount, but `friendlyPath` is
+											<Popover
+												placement="bottom-start"
+												usePointerDownOutside
+												excludeSelectors=".drawer, .session-preview-tab-strip [role='tab'][aria-selected='true']"
+												disableFocusTrap
+												closeOnOtherPopoverOpen
+												enableFlyTransition
+												bind:isOpen={activeTabPickerOpen}
+												openFocus="[data-workspace-picker-search]"
+												contentClasses="flex flex-col overflow-hidden"
+												class="absolute inset-0 pointer-events-none"
+												triggerAttrs={{
+													'aria-label': 'Change preview',
+													tabindex: -1,
+													// The inert trigger only ever receives focus from melt's
+													// close-time restore; hand it straight to the tab so
+													// arrow/Delete tab shortcuts keep working.
+													onfocus: (e: FocusEvent) =>
+														(e.currentTarget as HTMLElement)
+															.closest<HTMLElement>('[role="tab"]')
+															?.focus()
+												}}
+											>
+												{#snippet content()}
+													<!-- The picker snapshots its scope at mount, but `friendlyPath` is
 												     stamped async once the editor cell loads — a picker opened
 												     before the stamp is scoped to the `draft_<uuid>` storage
 												     folder while the tree groups the draft under its friendly
 												     folder. Remount on the scope dir so it re-lands on the item. -->
-												{#key activePickerScope?.dir ?? ''}
-													<PreviewRouterPicker
-														initialScope={activePickerScope}
-														initialHighlight={activePickerHighlight}
-														{currentItem}
-														workspaceId={previewWorkspace}
-														artifacts={sessionArtifacts}
-														onPick={(t) => {
-															activeTabPickerOpen = false
-															navigatePreviewTo(t)
-														}}
-													/>
-												{/key}
-											{/snippet}
-										</Popover>
-										<ChevronDown
-											size={12}
-											class="shrink-0 text-tertiary group-hover:text-primary"
-										/>
-									{/if}
-								{/snippet}
-								{#snippet afterTabs()}
-									<Popover
-										placement="bottom-start"
-										usePointerDownOutside
-										excludeSelectors=".drawer"
-										disableFocusTrap
-										closeOnOtherPopoverOpen
-										bind:isOpen={newTabOpen}
-										enableFlyTransition
-										openFocus="[data-workspace-picker-search]"
-										contentClasses="flex flex-col overflow-hidden"
-										class="shrink-0 inline-flex items-center justify-center w-6 h-6 rounded text-tertiary hover:text-primary hover:bg-surface-hover cursor-pointer"
-									>
-										{#snippet trigger()}
-											<Plus size={14} />
-										{/snippet}
-										{#snippet content()}
-											<PreviewRouterPicker
-												workspaceId={previewWorkspace}
-												artifacts={sessionArtifacts}
-												onPick={(t) => {
-													newTabOpen = false
-													openInNewTab(t)
-												}}
+													{#key activePickerScope?.dir ?? ''}
+														<PreviewRouterPicker
+															initialScope={activePickerScope}
+															initialHighlight={activePickerHighlight}
+															{currentItem}
+															workspaceId={previewWorkspace}
+															artifacts={sessionArtifacts}
+															onPick={(t) => {
+																activeTabPickerOpen = false
+																navigatePreviewTo(t)
+															}}
+														/>
+													{/key}
+												{/snippet}
+											</Popover>
+											<ChevronDown
+												size={12}
+												class="shrink-0 text-tertiary group-hover:text-primary"
 											/>
-										{/snippet}
-									</Popover>
-								{/snippet}
-							</DraggableTabs>
-
-							<!-- One host per tab of every warm session, stacked and
-								     visibility-toggled so switching tabs or sessions never reloads
-								     a mounted tab — hosts live as long as the session's runtime,
-								     content-gated by the shared mount MRU. Each host renders a
-								     live editor (script/flow/raw_app target) or an iframe fallback. -->
-							<div class="relative flex-1 min-h-0">
-								{#each warmSessions as s (s.id)}
-									{@const rt = getRuntime(s.id)}
-									{@const tabs = rt?.previewTabs}
-									{#each tabs?.tabs ?? [] as tab (tab.id)}
-										<!-- tabHosts is an imperative ref-bag (only tabHosts[key]?.reload() in
-										     reloadTabs); it is intentionally a plain object so component
-										     instances aren't proxied. Nothing reads it reactively, so the
-										     non-reactive binding is fine. -->
-										<!-- svelte-ignore binding_property_non_reactive -->
-										<PreviewTabHost
-											bind:this={tabHosts[tabKey(s.id, tab.id)]}
-											{tab}
-											session={s}
-											runtime={rt}
-											active={s.id === activeSession?.id && tab.id === tabs?.activeId}
-											collapsed={(tabs?.collapsed ?? false) && !fullscreen}
-											mounted={mountedTabKeys.has(tabKey(s.id, tab.id))}
-											label={tabLabelFor(tab, s.workspace_id ?? '')}
-											darkMode={isDarkMode.val}
-											{fullscreen}
-											onNavigate={navigateEditorTo}
-											onLoad={(frame) => tabs && onTabLoad(tabs, tab, frame)}
-										/>
-									{/each}
-								{/each}
-								{#if (owner?.tabs.length ?? 0) === 0}
-									<!-- New session with nothing to preview: an empty state with a
-										     picker to open one, instead of defaulting to the home page. -->
-									<div
-										class="absolute inset-0 flex flex-col items-center justify-center gap-3 text-center px-6 bg-surface"
-									>
-										<MonitorPlay size={28} class="text-tertiary" />
-										<div class="flex flex-col gap-1">
-											<span class="text-sm font-medium text-secondary">No preview open</span>
-											<span class="text-xs text-tertiary max-w-xs"
-												>Open a page, flow, script or app to preview it alongside the chat.</span
-											>
-										</div>
+										{/if}
+									{/snippet}
+									{#snippet afterTabs()}
 										<Popover
-											placement="bottom"
+											placement="bottom-start"
 											usePointerDownOutside
 											excludeSelectors=".drawer"
 											disableFocusTrap
 											closeOnOtherPopoverOpen
-											bind:isOpen={emptyStateNewTabOpen}
+											bind:isOpen={newTabOpen}
 											enableFlyTransition
 											openFocus="[data-workspace-picker-search]"
 											contentClasses="flex flex-col overflow-hidden"
+											class="shrink-0 inline-flex items-center justify-center w-6 h-6 rounded text-tertiary hover:text-primary hover:bg-surface-hover cursor-pointer"
 										>
 											{#snippet trigger()}
-												<span
-													class="inline-flex items-center gap-1.5 px-2.5 py-1.5 rounded-md text-xs border border-light text-secondary hover:bg-surface-hover cursor-pointer"
-												>
-													<Plus size={14} /> Open a preview
-												</span>
+												<Plus size={14} />
 											{/snippet}
 											{#snippet content()}
 												<PreviewRouterPicker
 													workspaceId={previewWorkspace}
 													artifacts={sessionArtifacts}
 													onPick={(t) => {
-														emptyStateNewTabOpen = false
+														newTabOpen = false
 														openInNewTab(t)
 													}}
 												/>
 											{/snippet}
 										</Popover>
-									</div>
-								{/if}
+									{/snippet}
+								</DraggableTabs>
+
+								<!-- One host per tab of every warm session, stacked and
+								     visibility-toggled so switching tabs or sessions never reloads
+								     a mounted tab — hosts live as long as the session's runtime,
+								     content-gated by the shared mount MRU. Each host renders a
+								     live editor (script/flow/raw_app target) or an iframe fallback. -->
+								<div class="relative flex-1 min-h-0">
+									{#each warmSessions as s (s.id)}
+										{@const rt = getRuntime(s.id)}
+										{@const tabs = rt?.previewTabs}
+										{#each tabs?.tabs ?? [] as tab (tab.id)}
+											<!-- tabHosts is an imperative ref-bag (only tabHosts[key]?.reload() in
+										     reloadTabs); it is intentionally a plain object so component
+										     instances aren't proxied. Nothing reads it reactively, so the
+										     non-reactive binding is fine. -->
+											<!-- svelte-ignore binding_property_non_reactive -->
+											<PreviewTabHost
+												bind:this={tabHosts[tabKey(s.id, tab.id)]}
+												{tab}
+												session={s}
+												runtime={rt}
+												active={s.id === activeSession?.id && tab.id === tabs?.activeId}
+												collapsed={(tabs?.collapsed ?? false) && !fullscreen}
+												mounted={mountedTabKeys.has(tabKey(s.id, tab.id))}
+												label={tabLabelFor(tab, s.workspace_id ?? '')}
+												darkMode={isDarkMode.val}
+												{fullscreen}
+												onNavigate={navigateEditorTo}
+												onLoad={(frame) => tabs && onTabLoad(tabs, tab, frame)}
+											/>
+										{/each}
+									{/each}
+									{#if (owner?.tabs.length ?? 0) === 0}
+										<!-- New session with nothing to preview: an empty state with a
+										     picker to open one, instead of defaulting to the home page. -->
+										<div
+											class="absolute inset-0 flex flex-col items-center justify-center gap-3 text-center px-6 bg-surface"
+										>
+											<MonitorPlay size={28} class="text-tertiary" />
+											<div class="flex flex-col gap-1">
+												<span class="text-sm font-medium text-secondary">No preview open</span>
+												<span class="text-xs text-tertiary max-w-xs"
+													>Open a page, flow, script or app to preview it alongside the chat.</span
+												>
+											</div>
+											<Popover
+												placement="bottom"
+												usePointerDownOutside
+												excludeSelectors=".drawer"
+												disableFocusTrap
+												closeOnOtherPopoverOpen
+												bind:isOpen={emptyStateNewTabOpen}
+												enableFlyTransition
+												openFocus="[data-workspace-picker-search]"
+												contentClasses="flex flex-col overflow-hidden"
+											>
+												{#snippet trigger()}
+													<span
+														class="inline-flex items-center gap-1.5 px-2.5 py-1.5 rounded-md text-xs border border-light text-secondary hover:bg-surface-hover cursor-pointer"
+													>
+														<Plus size={14} /> Open a preview
+													</span>
+												{/snippet}
+												{#snippet content()}
+													<PreviewRouterPicker
+														workspaceId={previewWorkspace}
+														artifacts={sessionArtifacts}
+														onPick={(t) => {
+															emptyStateNewTabOpen = false
+															openInNewTab(t)
+														}}
+													/>
+												{/snippet}
+											</Popover>
+										</div>
+									{/if}
+								</div>
 							</div>
 						</div>
-					</div>
-				</Pane>
-			</Splitpanes>
-			{#if previewCollapsed && !fullscreen}
-				<!-- Collapsed preview: no rail — a floating launcher in the top-right to
+					</Pane>
+				</Splitpanes>
+				{#if previewCollapsed && !fullscreen}
+					<!-- Collapsed preview: no rail — a floating launcher in the top-right to
 				     reopen the side panel. -->
-				<div class="absolute top-2 right-3 z-50">
-					<Button
-						variant="subtle"
-						unifiedSize="sm"
-						startIcon={{ icon: PanelRightOpen }}
-						title="Open side panel"
-						onclick={() => owner?.setCollapsed(false)}
-					>
-						Open side panel
-					</Button>
+					<div class="absolute top-2 right-3 z-50">
+						<Button
+							variant="subtle"
+							unifiedSize="sm"
+							startIcon={{ icon: PanelRightOpen }}
+							title="Open side panel"
+							onclick={() => owner?.setCollapsed(false)}
+						>
+							Open side panel
+						</Button>
+					</div>
+				{/if}
+			</div>
+			{#if aiHiddenVerdict === undefined}
+				<div class="absolute inset-0 z-20 flex items-center justify-center bg-surface">
+					<Loader2 class="animate-spin" />
+				</div>
+			{:else if aiHiddenVerdict}
+				<!-- The workspace hid the assistant, and the sidebar switch with it, so only a
+				     direct URL or a session acting on such a workspace lands here. -->
+				<div
+					class="absolute inset-0 z-20 bg-surface p-8 flex flex-col items-start gap-3 text-secondary text-sm"
+				>
+					<p class="text-primary font-medium">AI Sessions are hidden in this workspace</p>
+					<p>A workspace admin hid AI sessions in the workspace settings.</p>
+					<Button unifiedSize="sm" onclick={() => goto('/')}>Back to workspace</Button>
 				</div>
 			{/if}
 		</div>

From 419741e5d226c67c51429094fb6ded9474afed99 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Wed, 2 Sep 2026 17:27:18 +0200
Subject: [PATCH 08/31] fix: sandbox script-controlled content types in
 result_to_response (#10932)

* fix: sandbox script-controlled content type in result_to_response

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WFhu2MHsJVMqdMfdgbwNkT

* fix: reject hop-by-hop wm_headers so a proxy cannot strip the sandbox

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WFhu2MHsJVMqdMfdgbwNkT

* docs: condense sandbox comments and record the surface in the threat model

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WFhu2MHsJVMqdMfdgbwNkT

---------

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
---
 backend/THREAT_MODEL.md                    |  4 +-
 backend/windmill-api-jobs/src/execution.rs | 86 ++++++++++++++++++++++
 2 files changed, 88 insertions(+), 2 deletions(-)

diff --git a/backend/THREAT_MODEL.md b/backend/THREAT_MODEL.md
index 0468ebf721..f5725d65a3 100644
--- a/backend/THREAT_MODEL.md
+++ b/backend/THREAT_MODEL.md
@@ -85,7 +85,7 @@ published advisory history (73 GHSA advisories, several rated 9.9 critical).
 | EP9 Worker sandbox | nsjail / unshare / dind / rootless podman isolating user code | user code → host & cross-tenant filesystem/network | Worker host, isolation, downstream |
 | EP10 Worker code generation / wrappers | Entrypoint override, env-var names, workspace env interpolated into generated wrapper code | user-controlled identifier → executable code | Worker host, isolation |
 | EP11 OAuth / OIDC / SAML / MCP-OAuth / logout | Login callbacks, MCP OAuth client registration, logout `rd` redirect | untrusted IdP / redirect input → session | Session tokens, accounts |
-| EP12 Stored-content rendering | App builder HTML component, markdown, S3 download response headers | stored user content → admin browser (same origin) | Admin session, account takeover |
+| EP12 Stored-content rendering | App builder HTML component, markdown, S3 download response headers, script-controlled `wm_content_type`/`wm_headers` on `run_wait_result` and sync HTTP-route responses | stored user content → admin browser (same origin) | Admin session, account takeover |
 | EP13 Log/file reading & export endpoints | `service_logs`, `jobs_u/getupdate` log file read (symlinks), workspace/tarball export | authed/unauth request → arbitrary file or admin-only config | Arbitrary files, global settings |
 | EP14 Secret-value & resource-value caches | In-memory caches in `windmill-store` keyed (historically un-keyed) by path | cache lookup crossing identity/folder boundary | Secret variables, resource creds |
 | EP15 Deployment & runtime config | docker-compose defaults: dind, debugger (`REQUIRE_SIGNED_DEBUG_REQUESTS` now defaults to `true`; can still be overridden to `false`), CORS `Any`, default admin/`changeme`, exposed Postgres, `SUPERADMIN_SECRET`, `ENABLE_NSJAIL=false`, privileged containers | operator/infra default → full instance | All assets |
@@ -106,7 +106,7 @@ published advisory history (73 GHSA advisories, several rated 9.9 critical).
 | T8 | Unauthenticated RCE via the Debugger WebSocket: `/ws_debug/*` exposed by the gateway/ingress with the debugger service as the auth boundary; signature gate was bypassable via `program`-mode launches (read+exec an arbitrary server-side file path, never signed) even with signing on, and the WS handshake had no Origin check (CSWSH) | remote_unauth | EP15 | Worker host, all assets | critical | possible | partially_mitigated | `program`-mode launches now rejected when `REQUIRE_SIGNED_DEBUG_REQUESTS` is on (signing covers every launch, not just inline `code`); shipped `docker-compose` now defaults `REQUIRE_SIGNED_DEBUG_REQUESTS=true`; opt-in `DEBUG_ALLOWED_ORIGINS` allowlist rejects cross-origin handshakes. Residual: code default is secure but operators can still set `=false`; origin allowlist is opt-in | GHSA-725h-99vx-9xr4 |
 | T9 | Supply-chain compromise via cached hub scripts, GitHub workflow command injection, or vulnerable base-image deps | supply_chain | EP16 | Worker host, build integrity | critical | possible | partially_mitigated | hub-script re-pin to patched versions; HUB_BASE_URL override | GHSA-w2m9-q5f7-3gpq, edf340c4d4, GHSA-8rq7-w7g6-8wvr, GHSA-vch9-39v5-4wg7 (CVE-2024-37371) |
 | T10 | Unauthenticated disclosure of job results, args, logs, and admin config via missing-authz public endpoints | remote_unauth | EP2, EP13 | Job results/args/logs, global settings, scripts | high | likely | partially_mitigated | anonymous-job checks, log-endpoint authz hardening | GHSA-qfg7-x243-5hg4, GHSA-v448-fmm4-52fp, 108a88a180, bb90f4ce83 |
-| T11 | Stored XSS leading to admin/account takeover via app HTML component, markdown, or S3 download content-type | remote_auth | EP12 | Admin session, accounts | high | likely | partially_mitigated | DOMPurify markdown sanitization, `X-Content-Type-Options: nosniff` + CSP sandbox on downloads | GHSA-9c5c-hh3c-r9mc, GHSA-qxj7-hpx3-r892, GHSA-cf2x-rg8c-v63v, bb78b1c06d, 625b67dff0 |
+| T11 | Stored XSS leading to admin/account takeover via app HTML component, markdown, S3 download content-type, or a script-chosen `text/html` content type on `run_wait_result` / sync HTTP-route responses (GET-reachable with the `SameSite=Lax` session cookie) | remote_auth | EP12 | Admin session, accounts | high | likely | partially_mitigated | DOMPurify markdown sanitization, `X-Content-Type-Options: nosniff` + CSP sandbox on downloads and on every `result_to_response` composite result (inserted after `wm_headers`; hop-by-hop names such as `Connection` rejected so a proxy cannot strip them) | GHSA-9c5c-hh3c-r9mc, GHSA-qxj7-hpx3-r892, GHSA-cf2x-rg8c-v63v, bb78b1c06d, 625b67dff0, WIN-2471 |
 | T12 | Webhook authentication bypass / signature replay forges trigger invocations and approvals | remote_unauth | EP3 | Job execution integrity, approvals | high | likely | partially_mitigated | HMAC verification on some triggers; signing-oracle fix | GHSA-jw8c-h45c-xpjw, GHSA-hh9x-rcf8-xjr2, GHSA-q9g3-q6fj-hc2x, GHSA-8jc4-wj2p-2vmp, ab2a15b2a8 |
 | T13 | Path traversal / arbitrary file read via log-reading and MCP path endpoints (incl. symlink following) | remote_auth | EP13 | Arbitrary files on server, global settings | high | likely | partially_mitigated | traversal checks + no-symlink-follow added | GHSA-4hrf-mgvv-xp9x, bb90f4ce83, df451aa64f, ad5ec293b5, 5f2d3e6812 |
 | T14 | Privilege escalation via token rescope/refresh, script-issued JWTs, or operator-permission gaps | remote_auth | EP17, EP5 | Tokens, isolation, accounts | high | likely | partially_mitigated | monotonic-privilege enforcement on token lifecycle; SECURITY DEFINER triggers | GHSA-p62p-67xp-v775, GHSA-vv9w-wx3c-q3x2, 2ddf93de96, 865ab70c89, 33fb08cf3d |
diff --git a/backend/windmill-api-jobs/src/execution.rs b/backend/windmill-api-jobs/src/execution.rs
index fbfd656cdf..e897bf5eaf 100644
--- a/backend/windmill-api-jobs/src/execution.rs
+++ b/backend/windmill-api-jobs/src/execution.rs
@@ -416,11 +416,31 @@ pub fn result_to_response(result: Box<RawValue>, success: bool) -> error::Result
 
             let mut headers = HeaderMap::new();
 
+            // A reverse proxy consumes hop-by-hop headers instead of forwarding them and
+            // drops every header named by `Connection`, so a script could use one to strip
+            // the sandbox headers this function adds before they reach the browser.
+            const HOP_BY_HOP_HEADERS: [&str; 9] = [
+                "connection",
+                "keep-alive",
+                "proxy-authenticate",
+                "proxy-authorization",
+                "proxy-connection",
+                "te",
+                "trailer",
+                "transfer-encoding",
+                "upgrade",
+            ];
+
             if let Some(windmill_headers) = windmill_headers {
                 for (k, v) in windmill_headers {
                     let k = HeaderName::from_str(k.as_str()).map_err(|err| {
                         Error::internal_err(format!("Invalid header name {k}: {err}"))
                     })?;
+                    if HOP_BY_HOP_HEADERS.contains(&k.as_str()) {
+                        return Err(Error::ExecutionErr(format!(
+                            "windmill_headers cannot set the hop-by-hop header \"{k}\""
+                        )));
+                    }
                     let v = HeaderValue::from_str(v.as_str()).map_err(|err| {
                         Error::internal_err(format!("Invalid header value {v}: {err}"))
                     })?;
@@ -428,6 +448,22 @@ pub fn result_to_response(result: Box<RawValue>, success: bool) -> error::Result
                 }
             }
 
+            // The script controls the content type and body, and run_wait_result and sync
+            // HTTP routes are reachable by top-level GET navigation with the session cookie:
+            // sandbox the document into an opaque origin so HTML can never run with the
+            // viewer's session. Inserted after `wm_headers` so a script cannot override it.
+            headers.insert(
+                http::header::X_CONTENT_TYPE_OPTIONS,
+                HeaderValue::from_static("nosniff"),
+            );
+            headers.insert(
+                http::header::CONTENT_SECURITY_POLICY,
+                HeaderValue::from_static(
+                    "sandbox allow-scripts allow-forms allow-popups \
+                     allow-popups-to-escape-sandbox allow-downloads allow-modals",
+                ),
+            );
+
             if let Some(content_type) = windmill_content_type {
                 let serialized_json_result = result_value
                     .map(|val| val.get().to_owned())
@@ -1104,6 +1140,56 @@ mod result_to_response_tests {
             resp.headers().get(http::header::CONTENT_TYPE).unwrap(),
             "text/html"
         );
+        assert_sandboxed(resp.headers());
         assert_eq!(body_bytes(resp).await, b"<h1>hi</h1>");
     }
+
+    fn assert_sandboxed(headers: &HeaderMap) {
+        assert_eq!(
+            headers.get(http::header::X_CONTENT_TYPE_OPTIONS).unwrap(),
+            "nosniff"
+        );
+        let csp = headers
+            .get(http::header::CONTENT_SECURITY_POLICY)
+            .expect("content-security-policy")
+            .to_str()
+            .unwrap();
+        assert!(csp.starts_with("sandbox "), "csp: {csp}");
+        assert!(!csp.contains("allow-same-origin"), "csp: {csp}");
+    }
+
+    #[tokio::test]
+    async fn custom_headers_cannot_override_sandbox() {
+        // wm_headers is script-controlled: a content-type set there replaces the JSON
+        // one even without wm_content_type, and the sandbox headers must survive an
+        // attempt to override them.
+        let resp = result_to_response(
+            raw(
+                r#"{"wm_headers":{"content-type":"text/html","content-security-policy":"default-src *","x-content-type-options":"none"},"result":"<h1>hi</h1>"}"#,
+            ),
+            true,
+        )
+        .expect("response");
+
+        assert_eq!(
+            resp.headers().get(http::header::CONTENT_TYPE).unwrap(),
+            "text/html"
+        );
+        assert_sandboxed(resp.headers());
+    }
+
+    #[tokio::test]
+    async fn hop_by_hop_custom_headers_are_rejected() {
+        // A proxy drops every header named by `Connection`, which would strip the
+        // sandbox headers on the way to the browser.
+        for name in ["connection", "Connection", "transfer-encoding", "upgrade"] {
+            let res = result_to_response(
+                raw(&format!(
+                    r#"{{"wm_content_type":"text/html","wm_headers":{{"{name}":"content-security-policy, x-content-type-options"}},"result":"<h1>hi</h1>"}}"#
+                )),
+                true,
+            );
+            assert!(res.is_err(), "hop-by-hop header must be rejected: {name}");
+        }
+    }
 }

From 17ba521c352aec65a8270893752bbadd7f3d6eaa Mon Sep 17 00:00:00 2001
From: hugocasa <hugo@casademont.ch>
Date: Wed, 2 Sep 2026 19:20:49 +0200
Subject: [PATCH 09/31] fix: record supplied script lock hashes so importers
 can skip relocking (#10915)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix: record supplied script lock hashes so importers can skip relocking

Creating a script with a caller-supplied lock — a CLI push, a git-sync deploy,
any create carrying a lockfile — stored the lock on `script` but never wrote the
matching `lock_hash(workspace_id, path, hash_script(lock))` row. Only
worker-generated locks did.

`try_skip_relock` treats a missing hash for an imported script as changed, so no
importer of such a script could ever satisfy the skip predicate: every deploy of
it relocked every importer, forever.

The create transaction now records the hash for any lock it accepts, including
the empty one a codebase or a language with no lock generation carries — the
worker writes `hash_script("")` there, and a path going from a real lock to an
empty one has to stop matching what its importers recorded. Only a lock left to
a dependency job is skipped, because that job writes it.

A workspace clone now carries `lock_hash` too, without which every
dependency-map snapshot the clone later recorded held NULL and nothing in it
could ever skip. `dependency_map.imported_lockfile_hash` is deliberately not
copied: it records what an importer resolved against when it was last locked,
the clone runs READ COMMITTED, and a relock landing in the source between the
scripts being cloned and that statement would attach a hash the cloned
importer's lock was never resolved against — a hash older than the cloned
scripts costs one relock, a newer one skips a relock that was needed.

Lock generation is untouched, as is everything a relock does once it runs. The
only behavior that moves is which relocks are skipped.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0138oct9a6SLEZvFyCQgHRBx

* fix: narrow to the create-path lock hash

Drop the workspace-clone copy of lock_hash. It sits outside the reported
bug, and its double join over `script` can emit a path twice where two
versions are live, which the unique key on (workspace_id, path) then
rejects, failing the whole fork.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0138oct9a6SLEZvFyCQgHRBx

* fix: restore the workspace-clone lock hash copy, guarded against fanout

A path can hold two live versions, and both joins match on path alone, so
the select can emit it four times against a primary key that admits one.
Every such row carries the single hash the path has, so ON CONFLICT DO
NOTHING settles it rather than aborting the fork.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0138oct9a6SLEZvFyCQgHRBx

* fix: hash a clone's own locks rather than copying the source's rows

A source row is only as current as the last write to it, and a supplied
lock deployed before this was recorded leaves one naming a lock the path
no longer holds. Copying that into a fork hands an importer a hash it
never resolved against; hashing what the clone holds cannot.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0138oct9a6SLEZvFyCQgHRBx

* test: pin the lock hash written on a no-op push

Removing that write leaves the assertion with no row, which is the state
a script deployed before this shipped would stay in.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0138oct9a6SLEZvFyCQgHRBx

* refactor: share one lock hash writer between the create and clone paths

Both wrote the same upsert with different SQL. The existing writers fold
theirs into the statement that writes the lock itself, which is what keeps
the two consistent; these two have nothing to fold it into, so they take a
shared one instead. The clone walks its pages by path rather than listing
them first, dropping a query with it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0138oct9a6SLEZvFyCQgHRBx

* fix: stream a clone's locks rather than reading them in pages

script.lock is unbounded, so a page of them is bounded only by how many
it holds. Hashing each as it arrives keeps one in memory at a time and
lets the clone site collapse to a single call.

Also states on both writers that they check no access to the workspace
they write, which their callers are the ones to have established.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0138oct9a6SLEZvFyCQgHRBx

* fix: make the lock hash writer safe to repeat and free when unchanged

A path given twice in one call would have Postgres reject the whole
statement, so the last hash for each wins. And recording a hash a path
already has cut a row version for nothing on every unchanged sync, which
is the mode the no-op push runs in.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0138oct9a6SLEZvFyCQgHRBx

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
---
 ...5bbee155569488352c10b334ce57d83ce1c0a.json | 23 +++++
 ...0df68f552e38d4b587839e0e41285a2d55455.json | 28 ++++++
 ...e7032f710fe20dd272b7840c9bfbdb92554db.json | 23 +++++
 ...656ce9a8b0499d6b9282a3ecfae3164b17c2a.json | 16 ++++
 ...e4cad34e540a2cc09c92e262491145a0de05a.json | 15 +++
 backend/Cargo.lock                            |  1 +
 .../tests/scripts.rs                          | 94 ++++++++++++++++++-
 backend/windmill-api-scripts/src/scripts.rs   | 23 ++++-
 .../windmill-api-workspaces/src/workspaces.rs | 12 ++-
 backend/windmill-dep-map/Cargo.toml           |  1 +
 backend/windmill-dep-map/src/lib.rs           |  1 +
 backend/windmill-dep-map/src/lock_hash.rs     | 79 ++++++++++++++++
 12 files changed, 309 insertions(+), 7 deletions(-)
 create mode 100644 backend/.sqlx/query-1572b7348a05b7e357031f8d44b5bbee155569488352c10b334ce57d83ce1c0a.json
 create mode 100644 backend/.sqlx/query-8da59f1ace46dc9830cb0fc5a640df68f552e38d4b587839e0e41285a2d55455.json
 create mode 100644 backend/.sqlx/query-abdf62ef0e4eeb8c3213d2e8837e7032f710fe20dd272b7840c9bfbdb92554db.json
 create mode 100644 backend/.sqlx/query-cc507843e00c83a42cc4a463999656ce9a8b0499d6b9282a3ecfae3164b17c2a.json
 create mode 100644 backend/.sqlx/query-dd15827cbac128ec53cf03fa305e4cad34e540a2cc09c92e262491145a0de05a.json
 create mode 100644 backend/windmill-dep-map/src/lock_hash.rs

diff --git a/backend/.sqlx/query-1572b7348a05b7e357031f8d44b5bbee155569488352c10b334ce57d83ce1c0a.json b/backend/.sqlx/query-1572b7348a05b7e357031f8d44b5bbee155569488352c10b334ce57d83ce1c0a.json
new file mode 100644
index 0000000000..03f11ef137
--- /dev/null
+++ b/backend/.sqlx/query-1572b7348a05b7e357031f8d44b5bbee155569488352c10b334ce57d83ce1c0a.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT lockfile_hash FROM lock_hash WHERE workspace_id = $1 AND path = $2",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "lockfile_hash",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "1572b7348a05b7e357031f8d44b5bbee155569488352c10b334ce57d83ce1c0a"
+}
diff --git a/backend/.sqlx/query-8da59f1ace46dc9830cb0fc5a640df68f552e38d4b587839e0e41285a2d55455.json b/backend/.sqlx/query-8da59f1ace46dc9830cb0fc5a640df68f552e38d4b587839e0e41285a2d55455.json
new file mode 100644
index 0000000000..610030cffc
--- /dev/null
+++ b/backend/.sqlx/query-8da59f1ace46dc9830cb0fc5a640df68f552e38d4b587839e0e41285a2d55455.json
@@ -0,0 +1,28 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT DISTINCT ON (path) path, lock FROM script\n             WHERE workspace_id = $1 AND NOT archived AND NOT deleted AND lock IS NOT NULL\n             ORDER BY path, created_at DESC",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "path",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "lock",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      true
+    ]
+  },
+  "hash": "8da59f1ace46dc9830cb0fc5a640df68f552e38d4b587839e0e41285a2d55455"
+}
diff --git a/backend/.sqlx/query-abdf62ef0e4eeb8c3213d2e8837e7032f710fe20dd272b7840c9bfbdb92554db.json b/backend/.sqlx/query-abdf62ef0e4eeb8c3213d2e8837e7032f710fe20dd272b7840c9bfbdb92554db.json
new file mode 100644
index 0000000000..c3ef22f973
--- /dev/null
+++ b/backend/.sqlx/query-abdf62ef0e4eeb8c3213d2e8837e7032f710fe20dd272b7840c9bfbdb92554db.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT COUNT(*) FROM script WHERE workspace_id = $1 AND path = $2",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "count",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "abdf62ef0e4eeb8c3213d2e8837e7032f710fe20dd272b7840c9bfbdb92554db"
+}
diff --git a/backend/.sqlx/query-cc507843e00c83a42cc4a463999656ce9a8b0499d6b9282a3ecfae3164b17c2a.json b/backend/.sqlx/query-cc507843e00c83a42cc4a463999656ce9a8b0499d6b9282a3ecfae3164b17c2a.json
new file mode 100644
index 0000000000..19dc4781a6
--- /dev/null
+++ b/backend/.sqlx/query-cc507843e00c83a42cc4a463999656ce9a8b0499d6b9282a3ecfae3164b17c2a.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO lock_hash (workspace_id, path, lockfile_hash)\n         SELECT $1, * FROM UNNEST($2::text[], $3::bigint[])\n         ON CONFLICT (workspace_id, path) DO UPDATE SET lockfile_hash = EXCLUDED.lockfile_hash\n         WHERE lock_hash.lockfile_hash IS DISTINCT FROM EXCLUDED.lockfile_hash",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "TextArray",
+        "Int8Array"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "cc507843e00c83a42cc4a463999656ce9a8b0499d6b9282a3ecfae3164b17c2a"
+}
diff --git a/backend/.sqlx/query-dd15827cbac128ec53cf03fa305e4cad34e540a2cc09c92e262491145a0de05a.json b/backend/.sqlx/query-dd15827cbac128ec53cf03fa305e4cad34e540a2cc09c92e262491145a0de05a.json
new file mode 100644
index 0000000000..eba1b0da99
--- /dev/null
+++ b/backend/.sqlx/query-dd15827cbac128ec53cf03fa305e4cad34e540a2cc09c92e262491145a0de05a.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM lock_hash WHERE workspace_id = $1 AND path = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "dd15827cbac128ec53cf03fa305e4cad34e540a2cc09c92e262491145a0de05a"
+}
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index 913e0eda75..144605d28f 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -15650,6 +15650,7 @@ name = "windmill-dep-map"
 version = "1.801.0"
 dependencies = [
  "chrono",
+ "futures",
  "itertools 0.14.0",
  "lazy_static",
  "serde",
diff --git a/backend/windmill-api-integration-tests/tests/scripts.rs b/backend/windmill-api-integration-tests/tests/scripts.rs
index 8c88c53454..3a146add27 100644
--- a/backend/windmill-api-integration-tests/tests/scripts.rs
+++ b/backend/windmill-api-integration-tests/tests/scripts.rs
@@ -38,6 +38,85 @@ fn new_script(path: &str, summary: &str, content: &str) -> serde_json::Value {
     })
 }
 
+/// A supplied lock queues no dependency job, so if the create does not record its hash nothing
+/// ever will, and every importer of this script relocks on each of its deploys forever after.
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn test_create_script_persists_supplied_lock_hash(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let path = "u/test-user/supplied_lock";
+    let lock = r#"{"version":"4","remote":{}}"#;
+    let mut script = new_script(
+        path,
+        "Supplied lock",
+        "export async function main() { return 42; }",
+    );
+    script["lock"] = json!(lock);
+
+    let resp = authed(client().post(format!(
+        "http://localhost:{port}/api/w/test-workspace/scripts/create"
+    )))
+    .json(&script)
+    .send()
+    .await?;
+    assert_eq!(resp.status(), 201, "create: {}", resp.text().await?);
+
+    let stored_hash = sqlx::query_scalar!(
+        "SELECT lockfile_hash FROM lock_hash WHERE workspace_id = $1 AND path = $2",
+        "test-workspace",
+        path,
+    )
+    .fetch_one(&db)
+    .await?;
+    assert_eq!(stored_hash, windmill_common::scripts::hash_script(lock));
+
+    // A script deployed before the create recorded hashes has no row, and pushing it unchanged
+    // creates no version to hang one off. Without the write on that path it would keep its
+    // importers relocking until someone edited it.
+    sqlx::query!(
+        "DELETE FROM lock_hash WHERE workspace_id = $1 AND path = $2",
+        "test-workspace",
+        path,
+    )
+    .execute(&db)
+    .await?;
+
+    // The no-op comparison covers every field, so the push has to carry what the first deploy
+    // filled in by itself; `auto_parent` both resolves the parent and keeps the hash distinct.
+    script["auto_parent"] = json!(true);
+    script["ws_error_handler_muted"] = json!(false);
+    script["assets"] = json!([]);
+    let resp = authed(client().post(format!(
+        "http://localhost:{port}/api/w/test-workspace/scripts/create?skip_if_noop=true"
+    )))
+    .json(&script)
+    .send()
+    .await?;
+    assert_eq!(resp.status(), 201, "no-op push: {}", resp.text().await?);
+
+    let versions: i64 = sqlx::query_scalar!(
+        "SELECT COUNT(*) FROM script WHERE workspace_id = $1 AND path = $2",
+        "test-workspace",
+        path,
+    )
+    .fetch_one(&db)
+    .await?
+    .unwrap_or_default();
+    assert_eq!(versions, 1, "no-op push must not create a version");
+
+    let repaired_hash = sqlx::query_scalar!(
+        "SELECT lockfile_hash FROM lock_hash WHERE workspace_id = $1 AND path = $2",
+        "test-workspace",
+        path,
+    )
+    .fetch_one(&db)
+    .await?;
+    assert_eq!(repaired_hash, windmill_common::scripts::hash_script(lock));
+
+    Ok(())
+}
+
 #[sqlx::test(migrations = "../migrations", fixtures("base"))]
 async fn test_script_endpoints(db: Pool<Postgres>) -> anyhow::Result<()> {
     initialize_tracing().await;
@@ -797,10 +876,12 @@ async fn test_update_script_reports_losing_to_a_concurrent_deploy(
 
     // What a deploy leaves behind: the old head archived, a new one live at the path.
     // Copied through a temp table so this does not have to restate every column.
-    sqlx::query("CREATE TEMP TABLE superseding ON COMMIT DROP AS SELECT * FROM script WHERE hash = $1")
-        .bind(head)
-        .execute(&mut *winner)
-        .await?;
+    sqlx::query(
+        "CREATE TEMP TABLE superseding ON COMMIT DROP AS SELECT * FROM script WHERE hash = $1",
+    )
+    .bind(head)
+    .execute(&mut *winner)
+    .await?;
     sqlx::query("UPDATE superseding SET hash = $1, archived = false, parent_hashes = ARRAY[$2]")
         .bind(head + 1)
         .bind(head)
@@ -818,7 +899,10 @@ async fn test_update_script_reports_losing_to_a_concurrent_deploy(
     let resp = tokio::time::timeout(std::time::Duration::from_secs(20), update).await??;
     let status = resp.status();
     let body = resp.text().await?;
-    assert_eq!(status, 400, "losing the race should not read as success: {body}");
+    assert_eq!(
+        status, 400,
+        "losing the race should not read as success: {body}"
+    );
     assert!(
         body.contains("deployed to concurrently"),
         "the loser must say it was superseded, not that the script is missing: {body}"
diff --git a/backend/windmill-api-scripts/src/scripts.rs b/backend/windmill-api-scripts/src/scripts.rs
index 817ff6fc07..ccc5815aa7 100644
--- a/backend/windmill-api-scripts/src/scripts.rs
+++ b/backend/windmill-api-scripts/src/scripts.rs
@@ -39,7 +39,7 @@ use sqlx::{FromRow, Postgres, Transaction};
 use std::{collections::HashMap, sync::Arc};
 use windmill_audit::audit_oss::{audit_log, AuditAuthorable};
 use windmill_audit::ActionKind;
-use windmill_dep_map::process_relative_imports;
+use windmill_dep_map::{lock_hash::record_lock_hashes, process_relative_imports};
 use windmill_dep_map::scoped_dependency_map::ScopedDependencyMap;
 
 use windmill_common::{
@@ -1073,6 +1073,14 @@ fn modules_eq(
     }
 }
 
+/// Recorded for the empty lock a codebase or a language with no lock generation carries as well as
+/// for a real one: the worker writes `hash_script("")` in the same situation, and a path going from
+/// a real lock to an empty one has to stop matching what its importers recorded, or they wrongly
+/// skip rather than merely relock too often.
+fn lock_hash_entry(path: &str, lock: &str) -> [(String, i64); 1] {
+    [(path.to_string(), hash_script(lock))]
+}
+
 async fn create_script_internal<'c>(
     mut ns: NewScript,
     w_id: String,
@@ -1340,6 +1348,12 @@ async fn create_script_internal<'c>(
                     parent_hash = %p_hash.0,
                     "Skipping no-op script deploy (identical to parent)"
                 );
+                // The version is unchanged, but the row recording its lock's hash may never have
+                // been written — nothing else writes it for a supplied lock, and a path only ever
+                // pushed unchanged would otherwise keep its importers relocking forever.
+                if let Some(lock) = ps.lock.as_deref() {
+                    record_lock_hashes(&mut tx, &w_id, &lock_hash_entry(&ns.path, lock)).await?;
+                }
                 return Ok((p_hash.clone(), tx, None, Vec::new()));
             }
 
@@ -1887,6 +1901,13 @@ async fn create_script_internal<'c>(
     .execute(&mut *tx)
     .await?;
 
+    // A lock that is not left to a dependency job queues none, so this is the only place its hash
+    // can be recorded. `try_skip_relock` treats a missing hash for an imported script as changed,
+    // so leaving the row out makes every importer of this path relock on every deploy of it.
+    if let Some(lock) = lock.as_deref() {
+        record_lock_hashes(&mut tx, &w_id, &lock_hash_entry(&ns.path, lock)).await?;
+    }
+
     // Update ci_test_reference table for test scripts
     // Delete by both new and old path to handle renames
     let old_path = parent_hashes_and_perms.as_ref().map(|x| x.p_path.as_str());
diff --git a/backend/windmill-api-workspaces/src/workspaces.rs b/backend/windmill-api-workspaces/src/workspaces.rs
index 2aa59b20ff..cb5c639d46 100644
--- a/backend/windmill-api-workspaces/src/workspaces.rs
+++ b/backend/windmill-api-workspaces/src/workspaces.rs
@@ -12,6 +12,7 @@ use windmill_api_auth::{
 };
 use windmill_api_users::users::WorkspaceInvite;
 use windmill_common::email_oss::send_email_if_possible;
+use windmill_dep_map::lock_hash::record_lock_hashes_for_workspace;
 use windmill_common::usernames::{get_instance_username_or_create_pending, VALID_USERNAME};
 use windmill_common::webhook::WebhookShared;
 use windmill_common::{BASE_URL, DB};
@@ -7139,7 +7140,16 @@ async fn clone_workspace_runnable_dependencies(
     .execute(&mut **tx)
     .await?;
 
-    // Clone dependency_map to preserve import relationships
+    // Recorded so the clone's own relocks have something to match; with no row they record NULL
+    // and nothing in it ever skips. Hashed from the locks the clone holds rather than copied from
+    // the source's rows, which are only as current as the last write to them: one left stale by a
+    // supplied lock deployed before this was recorded names a lock the clone no longer has, and an
+    // importer that resolved against the real one would then skip a relock it needed.
+    record_lock_hashes_for_workspace(tx, target_workspace_id).await?;
+
+    // Deliberately without `imported_lockfile_hash`: it records what an importer resolved against
+    // when it was last locked, which nothing here can establish for the version the clone got.
+    // Left NULL, every importer relocks once and re-anchors both sides to what the clone holds.
     sqlx::query!(
         "INSERT INTO dependency_map (workspace_id, importer_path, importer_kind, imported_path, importer_node_id)
          SELECT $1, importer_path, importer_kind, imported_path, importer_node_id
diff --git a/backend/windmill-dep-map/Cargo.toml b/backend/windmill-dep-map/Cargo.toml
index 28b8552e8e..a93376d167 100644
--- a/backend/windmill-dep-map/Cargo.toml
+++ b/backend/windmill-dep-map/Cargo.toml
@@ -26,4 +26,5 @@ tracing.workspace = true
 lazy_static.workspace = true
 chrono.workspace = true
 itertools.workspace = true
+futures.workspace = true
 uuid.workspace = true
diff --git a/backend/windmill-dep-map/src/lib.rs b/backend/windmill-dep-map/src/lib.rs
index ee6a3c3fd4..650e0e5f99 100644
--- a/backend/windmill-dep-map/src/lib.rs
+++ b/backend/windmill-dep-map/src/lib.rs
@@ -1,6 +1,7 @@
 pub mod ci_tests;
 #[cfg(feature = "private")]
 pub mod ci_tests_ee;
+pub mod lock_hash;
 pub mod scoped_dependency_map;
 pub mod trigger_dependents;
 pub mod workspace_dependencies;
diff --git a/backend/windmill-dep-map/src/lock_hash.rs b/backend/windmill-dep-map/src/lock_hash.rs
new file mode 100644
index 0000000000..50bd18a8ee
--- /dev/null
+++ b/backend/windmill-dep-map/src/lock_hash.rs
@@ -0,0 +1,79 @@
+use std::collections::HashMap;
+
+use futures::TryStreamExt;
+use sqlx::{Postgres, Transaction};
+use windmill_common::error::Result;
+use windmill_common::scripts::hash_script;
+
+/// Records what the lock now at each path hashes to, which is one half of the comparison a relock
+/// skip makes against what each importer resolved against.
+///
+/// Writes any path in `w_id` and checks nothing: callers are responsible for having established
+/// the caller's access to that workspace. A path repeated in `entries` keeps its last hash.
+///
+/// Callers that write the lock itself in the same statement fold the upsert into that statement
+/// instead; this is for the ones with nothing to fold it into.
+pub async fn record_lock_hashes(
+    tx: &mut Transaction<'_, Postgres>,
+    w_id: &str,
+    entries: &[(String, i64)],
+) -> Result<()> {
+    // Postgres rejects a whole statement that resolves a conflict on one key twice, so a path
+    // given more than once keeps its last hash, as it would if the two were written in order.
+    let mut deduped: HashMap<&str, i64> = HashMap::with_capacity(entries.len());
+    for (path, hash) in entries {
+        deduped.insert(path.as_str(), *hash);
+    }
+    if deduped.is_empty() {
+        return Ok(());
+    }
+    let (paths, hashes): (Vec<String>, Vec<i64>) = deduped
+        .into_iter()
+        .map(|(path, hash)| (path.to_string(), hash))
+        .unzip();
+    // Recording a hash a path already has would still cut a row version, and the no-op push this
+    // is reached from is the mode a git-sync of an unchanged workspace runs in.
+    sqlx::query!(
+        "INSERT INTO lock_hash (workspace_id, path, lockfile_hash)
+         SELECT $1, * FROM UNNEST($2::text[], $3::bigint[])
+         ON CONFLICT (workspace_id, path) DO UPDATE SET lockfile_hash = EXCLUDED.lockfile_hash
+         WHERE lock_hash.lockfile_hash IS DISTINCT FROM EXCLUDED.lockfile_hash",
+        w_id,
+        &paths[..],
+        &hashes[..]
+    )
+    .execute(&mut **tx)
+    .await?;
+    Ok(())
+}
+
+/// Records the hash of every live lock in `w_id`, for a workspace whose scripts arrived without
+/// going through a deploy — a clone, which copies their locks verbatim and so would otherwise hold
+/// none of the hashes describing them.
+///
+/// Carries the same caller obligation as [`record_lock_hashes`].
+///
+/// `script.lock` is unbounded and a workspace holds one per script, so the rows are streamed and
+/// each lock is hashed and dropped before the next arrives; only the hashes accumulate.
+pub async fn record_lock_hashes_for_workspace(
+    tx: &mut Transaction<'_, Postgres>,
+    w_id: &str,
+) -> Result<()> {
+    let mut entries: Vec<(String, i64)> = Vec::new();
+    {
+        let mut rows = sqlx::query!(
+            "SELECT DISTINCT ON (path) path, lock FROM script
+             WHERE workspace_id = $1 AND NOT archived AND NOT deleted AND lock IS NOT NULL
+             ORDER BY path, created_at DESC",
+            w_id
+        )
+        .fetch(&mut **tx);
+
+        while let Some(row) = rows.try_next().await? {
+            if let Some(lock) = row.lock {
+                entries.push((row.path, hash_script(&lock)));
+            }
+        }
+    }
+    record_lock_hashes(tx, w_id, &entries).await
+}

From f10ac6c2b3644fb16697e650efbc4f7cd3c6944c Mon Sep 17 00:00:00 2001
From: AlexRV12 <71396855+AlexRV12@users.noreply.github.com>
Date: Wed, 2 Sep 2026 19:30:54 +0200
Subject: [PATCH 10/31] feat: open path links from chat messages in the session
 preview panel (#10881)

A workspace path mentioned in a chat message rendered as a link that always
opened a new browser tab. On the sessions page, which hosts a preview panel,
a plain click now opens the item in that panel instead. Modifier clicks still
reach a new tab, and surfaces with no panel keep their previous behaviour.

Scripts, flows and raw apps are supported. Legacy drag-and-drop apps are not:
the panel has no editor that can host one, so their links stay outbound.

The link pill's kind icon and action icon now cross-fade inside a fixed 12px
box, so the pill is the same width at rest and on hover and the surrounding
sentence never reflows.

`openItemPreviewAction` moves to a new import-free leaf module so a chat
message can reach it at runtime without dragging monaco, zod and the openai
client into the render path.


Claude-Session: https://claude.ai/code/session_01RjbVL7h9NiTLGTgyfiHvXG

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .../copilot/chat/LinkRenderer.svelte          | 52 ++++++++++++++-----
 .../components/copilot/chat/itemPreview.ts    | 30 +++++++++++
 .../src/lib/components/copilot/chat/shared.ts | 34 +++---------
 .../copilot/chat/workspaceItems.svelte.ts     | 31 ++++++++++-
 .../copilot/chat/workspaceItems.test.ts       | 41 +++++++++++++--
 .../(root)/(logged)/sessions/+page.svelte     |  4 +-
 6 files changed, 146 insertions(+), 46 deletions(-)
 create mode 100644 frontend/src/lib/components/copilot/chat/itemPreview.ts

diff --git a/frontend/src/lib/components/copilot/chat/LinkRenderer.svelte b/frontend/src/lib/components/copilot/chat/LinkRenderer.svelte
index 491c2e11d5..1e885fa304 100644
--- a/frontend/src/lib/components/copilot/chat/LinkRenderer.svelte
+++ b/frontend/src/lib/components/copilot/chat/LinkRenderer.svelte
@@ -19,6 +19,7 @@
 		'data-wm-kind'?: WindmillItemKind
 		'data-wm-path'?: string
 		'data-wm-target-kind'?: WorkspaceItemTargetKind
+		'data-wm-raw-app'?: string
 		title?: string
 	}
 	let {
@@ -27,15 +28,25 @@
 		'data-wm-kind': wmKind,
 		'data-wm-path': wmPath,
 		'data-wm-target-kind': wmTargetKind,
+		'data-wm-raw-app': wmRawApp,
 		title
 	}: Props = $props()
 
 	// The drawers ride with the docked chat, so a surface can render this pill with nothing
 	// able to open one.
-	const drawerAction = $derived.by(() => {
-		const action = workspaceItemAction(wmKind, wmPath, wmTargetKind)
+	const available = $derived.by(() => {
+		const action = workspaceItemAction(wmKind, wmPath, wmTargetKind, wmRawApp === 'true')
 		return action && hasToolDisplayActionHandler(action.type) ? action : undefined
 	})
+	// Only the preview panel takes the plain click. A drawer keeps its own button beside an
+	// outbound link: the docked chat mounts drawer handlers on nearly every page, so claiming
+	// that click would redirect these pills far outside the sessions page.
+	const previewAction = $derived(available?.type === 'open_item_preview' ? available : undefined)
+	const drawerAction = $derived(available?.type === 'open_created_resource' ? available : undefined)
+
+	const hint = $derived(
+		previewAction ? `Open ${wmPath} in the preview panel` : `Open ${wmPath} in a new tab`
+	)
 
 	async function openDrawer(event?: Event) {
 		event?.preventDefault()
@@ -44,6 +55,14 @@
 			await runToolDisplayAction(drawerAction)
 		}
 	}
+
+	async function onclick(event: MouseEvent) {
+		// Modifier clicks are the only remaining route to the tab once the plain click is
+		// spoken for, so leave them to the browser.
+		if (!previewAction || event.metaKey || event.ctrlKey || event.shiftKey || event.altKey) return
+		event.preventDefault()
+		await runToolDisplayAction(previewAction)
+	}
 </script>
 
 {#if href}
@@ -51,20 +70,29 @@
 		<span class="group inline-flex items-baseline">
 			<a
 				{href}
-				target="_blank"
-				rel="noopener noreferrer"
-				title={title || wmPath || href}
+				target={previewAction ? undefined : '_blank'}
+				rel={previewAction ? undefined : 'noopener noreferrer'}
+				title={title || hint}
+				{onclick}
 				class="inline-flex items-baseline gap-1 px-1 rounded hover:bg-surface-hover text-primary no-underline font-mono text-[0.9em] align-baseline"
 			>
-				<span class="inline-flex self-center shrink-0">
-					<RowIcon kind={wmKind} size={12} />
+				<!-- Kind icon and action icon share one fixed 12px box, so the pill is the same
+				     width at rest and on hover and the surrounding sentence never reflows. -->
+				<span class="relative inline-flex self-center shrink-0 w-3 h-3">
+					<span class="absolute inset-0 transition-opacity group-hover:opacity-0">
+						<RowIcon kind={wmKind} size={12} />
+					</span>
+					<span
+						class="absolute inset-0 flex items-center justify-center text-tertiary opacity-0 transition-opacity group-hover:opacity-100"
+					>
+						{#if previewAction}
+							<PanelRight size={12} />
+						{:else}
+							<ExternalLink size={11} />
+						{/if}
+					</span>
 				</span>
 				{@render children?.()}
-				<span
-					class="inline-flex self-center shrink-0 text-tertiary opacity-0 group-hover:opacity-100 transition-opacity"
-				>
-					<ExternalLink size={10} />
-				</span>
 			</a>
 			{#if drawerAction}
 				<Button
diff --git a/frontend/src/lib/components/copilot/chat/itemPreview.ts b/frontend/src/lib/components/copilot/chat/itemPreview.ts
new file mode 100644
index 0000000000..ef9f14ddc9
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/itemPreview.ts
@@ -0,0 +1,30 @@
+// The session preview panel's action, kept out of `shared.ts` so the chat message render
+// path can import it at runtime without pulling in that module's graph and risking the
+// chunk cycles docs/frontend-import-cycles.md exists to prevent. Keep this file import-free.
+
+/** Item kinds a session preview can host: the three live editors, which are also the
+ * subset a write tool can land. */
+export type PreviewCardKind = 'script' | 'flow' | 'raw_app'
+
+// Dispatched by a preview card on a tool call that created or updated a workspace item,
+// and by a path link in a chat message. Opens the item's live editor in the session side
+// panel — or focuses the tab if it is already open. The handler is registered by the
+// sessions page (the only surface with a preview panel).
+export type OpenItemPreviewAction = {
+	id: string
+	type: 'open_item_preview'
+	label: string
+	previewKind: PreviewCardKind
+	path: string
+}
+
+/** Build the action a preview card or path link dispatches from its (kind, path). */
+export function openItemPreviewAction(kind: PreviewCardKind, path: string): OpenItemPreviewAction {
+	return {
+		id: `open-item-preview:${kind}:${path}`,
+		type: 'open_item_preview',
+		label: `Open ${kind === 'raw_app' ? 'app' : kind} preview`,
+		previewKind: kind,
+		path
+	}
+}
diff --git a/frontend/src/lib/components/copilot/chat/shared.ts b/frontend/src/lib/components/copilot/chat/shared.ts
index b485be51b3..6d6794b56c 100644
--- a/frontend/src/lib/components/copilot/chat/shared.ts
+++ b/frontend/src/lib/components/copilot/chat/shared.ts
@@ -7,6 +7,12 @@ import type { UserDraftItemKind } from '$lib/gen'
 // The gate's two refusals, from a module that holds prose and one size limit: under the
 // shallow-import rule below, the rest of plan mode is not reachable from here.
 import { PLAN_MODE_MESSAGES } from './planModeMessages'
+// Import-free leaf, so it satisfies the shallow-import rule below.
+import {
+	openItemPreviewAction,
+	type OpenItemPreviewAction,
+	type PreviewCardKind
+} from './itemPreview'
 
 // The tool modules that import this one (workspaceTools, flow/core, global/core, ...)
 // call createToolDef and read SPECIAL_MODULE_IDS at *module scope*, so if a chunk cycle
@@ -526,35 +532,11 @@ export type NavigateAction = {
 	page: string
 }
 
-/** Kinds of previewable item a write tool can land — the subset of draft item
- * kinds a session preview can host. */
-export type PreviewCardKind = 'script' | 'flow' | 'raw_app'
-
-// A discrete card shown on a tool call that created or updated a workspace item.
-// Clicking it opens the item's live preview in the session side panel — or focuses
-// the tab if it is already open. The handler is registered by the sessions page
-// (the only surface with a preview panel).
-export type OpenItemPreviewAction = {
-	id: string
-	type: 'open_item_preview'
-	label: string
-	previewKind: PreviewCardKind
-	path: string
-}
+// Re-exported: most consumers reach these through this module.
+export { openItemPreviewAction, type PreviewCardKind, type OpenItemPreviewAction }
 
 export type ToolDisplayAction = CreatedResourceAction | NavigateAction | OpenItemPreviewAction
 
-/** Build the action a preview card dispatches from its (kind, path). */
-export function openItemPreviewAction(kind: PreviewCardKind, path: string): OpenItemPreviewAction {
-	return {
-		id: `open-item-preview:${kind}:${path}`,
-		type: 'open_item_preview',
-		label: `Open ${kind === 'raw_app' ? 'app' : kind} preview`,
-		previewKind: kind,
-		path
-	}
-}
-
 export type UserQuestionDisplay = {
 	question: string
 	choices: string[]
diff --git a/frontend/src/lib/components/copilot/chat/workspaceItems.svelte.ts b/frontend/src/lib/components/copilot/chat/workspaceItems.svelte.ts
index b1a6f695d3..1e02573a32 100644
--- a/frontend/src/lib/components/copilot/chat/workspaceItems.svelte.ts
+++ b/frontend/src/lib/components/copilot/chat/workspaceItems.svelte.ts
@@ -22,6 +22,8 @@ import { findAndReplace } from 'mdast-util-find-and-replace'
 import { visit } from 'unist-util-visit'
 import type { Root, InlineCode, Link } from 'mdast'
 import type { CreatedResourceAction, ToolDisplayAction } from './shared'
+// Leaf module, deliberately not './shared' — see the header of itemPreview.ts.
+import { openItemPreviewAction } from './itemPreview'
 
 export type WindmillItemKind =
 	| 'script'
@@ -46,6 +48,9 @@ export interface WorkspaceItemEntry {
 	kind: WindmillItemKind
 	path: string
 	targetKind?: WorkspaceItemTargetKind
+	/** Apps only. Both kinds share the `app` kind and the same `/apps/get/<path>` route,
+	 * so this flag is all that tells them apart downstream. */
+	rawApp?: boolean
 }
 
 export type WorkspaceItemTargetKind = 'script' | 'flow'
@@ -96,6 +101,7 @@ export function itemHref(entry: WorkspaceItemEntry, workspace?: string): string
 type WorkspaceItemListResult = Array<{
 	path: string
 	is_flow?: boolean | null
+	raw_app?: boolean | null
 }>
 
 const workspaceItemLoaders: Array<{
@@ -165,7 +171,8 @@ class WorkspaceItemRegistry {
 						kind,
 						path: it.path,
 						targetKind:
-							typeof it.is_flow === 'boolean' ? (it.is_flow ? 'flow' : 'script') : undefined
+							typeof it.is_flow === 'boolean' ? (it.is_flow ? 'flow' : 'script') : undefined,
+						rawApp: kind === 'app' ? it.raw_app === true : undefined
 					})
 				}
 			}
@@ -213,13 +220,30 @@ export function extractCandidatePaths(text: string | undefined | null): string[]
 	return [...seen]
 }
 
+/**
+ * The in-app action a resolved path link runs instead of opening a new tab, or undefined
+ * when the kind has none (its link then stays outbound). Returning an action does not mean
+ * it can run on this surface — only the sessions page hosts a preview panel, so callers
+ * gate on `hasToolDisplayActionHandler(action.type)`.
+ */
 export function workspaceItemAction(
 	kind: WindmillItemKind | undefined,
 	path: string | undefined,
-	targetKind?: WorkspaceItemTargetKind
+	targetKind?: WorkspaceItemTargetKind,
+	rawApp?: boolean
 ): ToolDisplayAction | undefined {
 	if (!kind || !path) return undefined
 
+	if (kind === 'script' || kind === 'flow') {
+		return openItemPreviewAction(kind, path)
+	}
+
+	// Raw apps only. A legacy drag-and-drop app has no editor the panel can host, and
+	// legacy items are not extended onto new surfaces — its link stays outbound.
+	if (kind === 'app') {
+		return rawApp ? openItemPreviewAction('raw_app', path) : undefined
+	}
+
 	const base = {
 		id: `open_workspace_item:${kind}:${path}`,
 		type: 'open_created_resource' as const,
@@ -253,6 +277,9 @@ function buildPathLinkNode(
 	if (entry.targetKind) {
 		hProperties['data-wm-target-kind'] = entry.targetKind
 	}
+	if (entry.rawApp) {
+		hProperties['data-wm-raw-app'] = 'true'
+	}
 
 	return {
 		type: 'link',
diff --git a/frontend/src/lib/components/copilot/chat/workspaceItems.test.ts b/frontend/src/lib/components/copilot/chat/workspaceItems.test.ts
index 9bb477fa83..70810dad9a 100644
--- a/frontend/src/lib/components/copilot/chat/workspaceItems.test.ts
+++ b/frontend/src/lib/components/copilot/chat/workspaceItems.test.ts
@@ -153,10 +153,27 @@ describe('workspaceItemAction', () => {
 		})
 	})
 
-	it('skips non-drawerable items and trigger items without target kind', () => {
-		expect(workspaceItemAction('script', 'f/a/b')).toBeUndefined()
-		expect(workspaceItemAction('flow', 'f/a/b')).toBeUndefined()
+	it('creates preview actions for scripts, flows and raw apps', () => {
+		expect(workspaceItemAction('script', 'f/a/b')).toMatchObject({
+			type: 'open_item_preview',
+			previewKind: 'script',
+			path: 'f/a/b'
+		})
+		expect(workspaceItemAction('flow', 'f/a/b')).toMatchObject({
+			type: 'open_item_preview',
+			previewKind: 'flow'
+		})
+		expect(workspaceItemAction('app', 'f/a/b', undefined, true)).toMatchObject({
+			previewKind: 'raw_app'
+		})
+	})
+
+	it('leaves legacy apps as plain links', () => {
+		expect(workspaceItemAction('app', 'f/a/b', undefined, false)).toBeUndefined()
 		expect(workspaceItemAction('app', 'f/a/b')).toBeUndefined()
+	})
+
+	it('skips trigger items without target kind', () => {
 		expect(workspaceItemAction('schedule', 'f/a/b')).toBeUndefined()
 		expect(workspaceItemAction('http_trigger', 'f/a/b')).toBeUndefined()
 	})
@@ -172,6 +189,7 @@ const SAMPLE_ENTRIES: Record<string, WorkspaceItemEntry> = {
 		path: 'u/admin/cleanup_old_jobs'
 	},
 	'f/ops/dashboard': { kind: 'app', path: 'f/ops/dashboard' },
+	'f/ops/live_board': { kind: 'app', path: 'f/ops/live_board', rawApp: true },
 	'f/etl/daily': {
 		kind: 'schedule',
 		path: 'f/etl/daily',
@@ -249,6 +267,23 @@ describe('remarkWindmillPaths (mdast)', () => {
 		expect(props['data-wm-target-kind']).toBe('flow')
 	})
 
+	// Both app kinds reach the renderer as the same `app` kind and route, so this flag is
+	// the only thing that keeps a legacy app off the preview panel.
+	it('marks raw apps so the renderer can tell them from legacy apps', () => {
+		const processor = buildProcessor('admins')
+		const tree = processor.runSync(
+			processor.parse('Open f/ops/live_board and f/ops/dashboard.')
+		) as MdastRoot
+		const byPath = Object.fromEntries(
+			findLinks(tree).map((l) => [
+				(l.data?.hProperties as Record<string, string>)['data-wm-path'],
+				l.data?.hProperties as Record<string, string>
+			])
+		)
+		expect(byPath['f/ops/live_board']['data-wm-raw-app']).toBe('true')
+		expect(byPath['f/ops/dashboard']['data-wm-raw-app']).toBeUndefined()
+	})
+
 	it('leaves unknown paths as plain text', () => {
 		const processor = buildProcessor()
 		const tree = processor.runSync(
diff --git a/frontend/src/routes/(root)/(logged)/sessions/+page.svelte b/frontend/src/routes/(root)/(logged)/sessions/+page.svelte
index cbcbe92e82..da8fc31c65 100644
--- a/frontend/src/routes/(root)/(logged)/sessions/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/sessions/+page.svelte
@@ -591,9 +591,7 @@
 		}
 	})
 
-	// Preview cards on create/update tool calls dispatch here. Open
-	// (or focus, if already shown) the item's preview in the active session's panel —
-	// the visible chat is always the active session, so `owner` is its panel. Read
+	// The visible chat is always the active session, so `owner` is its panel. Read
 	// `owner` lazily inside the handler (not in the effect body) so this registers
 	// once, not on every session switch.
 	$effect(() => {

From d472193e5bf5f6428e0096a402eb2c9299634fb2 Mon Sep 17 00:00:00 2001
From: hugocasa <hugo@casademont.ch>
Date: Wed, 2 Sep 2026 19:41:46 +0200
Subject: [PATCH 11/31] feat: add retention cleanup for the otel_traces table
 (#10949)

* feat: add retention cleanup for the otel_traces table

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NLhUaCPpLRAa29rSZDjS28

* fix: vacuum otel_traces and badge its retention setting EE

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NLhUaCPpLRAa29rSZDjS28

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 ...fec23514ae0419f77b632064b75473b5636c3.json |  20 +++
 ...59fbbf8be5a81276a3050a42770e4a5b5aa5e.json |  15 ++
 ...badb9842318c4c7a1d2526ac567ce41b7fbdc.json |  16 ++
 ...8880eaafb2d3fe71d75b676f1719e26f660f.json} |   4 +-
 backend/src/main.rs                           |  21 +--
 backend/src/monitor.rs                        | 140 ++++++++++++++++--
 .../windmill-common/src/global_settings.rs    |   1 +
 backend/windmill-common/src/lib.rs            |  77 +++++++---
 .../src/lib/components/InstanceSetting.svelte |   4 +-
 .../src/lib/components/instanceSettings.ts    |  24 +++
 10 files changed, 279 insertions(+), 43 deletions(-)
 create mode 100644 backend/.sqlx/query-16b174aaa944fd94458ce3108f0fec23514ae0419f77b632064b75473b5636c3.json
 create mode 100644 backend/.sqlx/query-1b244f65ee6a2607ebc1c333d4359fbbf8be5a81276a3050a42770e4a5b5aa5e.json
 create mode 100644 backend/.sqlx/query-62ed1fe52bc2c22d199101309cbbadb9842318c4c7a1d2526ac567ce41b7fbdc.json
 rename backend/.sqlx/{query-f0070b36f7c4fc84dc9c23bb6c73d8ba80993a28b2c2e5df70968acf6d7cebe4.json => query-cfdd5ac1dfc7276fc37d49ddfe1b8880eaafb2d3fe71d75b676f1719e26f660f.json} (72%)

diff --git a/backend/.sqlx/query-16b174aaa944fd94458ce3108f0fec23514ae0419f77b632064b75473b5636c3.json b/backend/.sqlx/query-16b174aaa944fd94458ce3108f0fec23514ae0419f77b632064b75473b5636c3.json
new file mode 100644
index 0000000000..693d84173a
--- /dev/null
+++ b/backend/.sqlx/query-16b174aaa944fd94458ce3108f0fec23514ae0419f77b632064b75473b5636c3.json
@@ -0,0 +1,20 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT trace_id FROM otel_traces ORDER BY trace_id",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "trace_id",
+        "type_info": "Bytea"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "16b174aaa944fd94458ce3108f0fec23514ae0419f77b632064b75473b5636c3"
+}
diff --git a/backend/.sqlx/query-1b244f65ee6a2607ebc1c333d4359fbbf8be5a81276a3050a42770e4a5b5aa5e.json b/backend/.sqlx/query-1b244f65ee6a2607ebc1c333d4359fbbf8be5a81276a3050a42770e4a5b5aa5e.json
new file mode 100644
index 0000000000..f35dbc23e4
--- /dev/null
+++ b/backend/.sqlx/query-1b244f65ee6a2607ebc1c333d4359fbbf8be5a81276a3050a42770e4a5b5aa5e.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM otel_traces WHERE ctid IN (\n                 SELECT ctid FROM otel_traces\n                 WHERE start_time_unix_nano < EXTRACT(\n                     EPOCH FROM now() - ($1::bigint::text || ' s')::interval\n                 )::bigint * 1000000000\n                 LIMIT $2\n             )",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Int8",
+        "Int8"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "1b244f65ee6a2607ebc1c333d4359fbbf8be5a81276a3050a42770e4a5b5aa5e"
+}
diff --git a/backend/.sqlx/query-62ed1fe52bc2c22d199101309cbbadb9842318c4c7a1d2526ac567ce41b7fbdc.json b/backend/.sqlx/query-62ed1fe52bc2c22d199101309cbbadb9842318c4c7a1d2526ac567ce41b7fbdc.json
new file mode 100644
index 0000000000..67b672228f
--- /dev/null
+++ b/backend/.sqlx/query-62ed1fe52bc2c22d199101309cbbadb9842318c4c7a1d2526ac567ce41b7fbdc.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO otel_traces (trace_id, span_id, name, kind, start_time_unix_nano, end_time_unix_nano)\n             VALUES ($1, $2, 'GET /', 3, $3, $3)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Bytea",
+        "Bytea",
+        "Int8"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "62ed1fe52bc2c22d199101309cbbadb9842318c4c7a1d2526ac567ce41b7fbdc"
+}
diff --git a/backend/.sqlx/query-f0070b36f7c4fc84dc9c23bb6c73d8ba80993a28b2c2e5df70968acf6d7cebe4.json b/backend/.sqlx/query-cfdd5ac1dfc7276fc37d49ddfe1b8880eaafb2d3fe71d75b676f1719e26f660f.json
similarity index 72%
rename from backend/.sqlx/query-f0070b36f7c4fc84dc9c23bb6c73d8ba80993a28b2c2e5df70968acf6d7cebe4.json
rename to backend/.sqlx/query-cfdd5ac1dfc7276fc37d49ddfe1b8880eaafb2d3fe71d75b676f1719e26f660f.json
index b31e532fc2..2947dd8413 100644
--- a/backend/.sqlx/query-f0070b36f7c4fc84dc9c23bb6c73d8ba80993a28b2c2e5df70968acf6d7cebe4.json
+++ b/backend/.sqlx/query-cfdd5ac1dfc7276fc37d49ddfe1b8880eaafb2d3fe71d75b676f1719e26f660f.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "VACUUM v2_job, v2_job_completed, job_result_stream_v2, job_stats, job_logs, job_perms, concurrency_key, log_file, metrics",
+  "query": "VACUUM v2_job, v2_job_completed, job_result_stream_v2, job_stats, job_logs, job_perms, concurrency_key, log_file, metrics, otel_traces",
   "describe": {
     "columns": [],
     "parameters": {
@@ -8,5 +8,5 @@
     },
     "nullable": []
   },
-  "hash": "f0070b36f7c4fc84dc9c23bb6c73d8ba80993a28b2c2e5df70968acf6d7cebe4"
+  "hash": "cfdd5ac1dfc7276fc37d49ddfe1b8880eaafb2d3fe71d75b676f1719e26f660f"
 }
diff --git a/backend/src/main.rs b/backend/src/main.rs
index 5ec78b0b06..f84812151d 100644
--- a/backend/src/main.rs
+++ b/backend/src/main.rs
@@ -53,9 +53,9 @@ use windmill_common::{
         KEEP_JOB_DIR_SETTING, LICENSE_KEY_SETTING, MAVEN_REPOS_SETTING, MAVEN_SETTINGS_XML_SETTING,
         MONITOR_LOGS_ON_OBJECT_STORE_SETTING, NO_DEFAULT_MAVEN_SETTING,
         NPM_CONFIG_REGISTRY_SETTING, NSJAIL_TMPFS_SIZE_MB_SETTING, NSJAIL_TMP_BACKING_SETTING,
-        NUGET_CONFIG_SETTING, OAUTH_SETTING, OTEL_SETTING, OTEL_TRACING_PROXY_SETTING,
-        PIP_INDEX_URL_SETTING, POWERSHELL_REPO_PAT_SETTING, POWERSHELL_REPO_URL_SETTING,
-        PREVIEW_TAGS_OVERRIDE_SETTING, REQUEST_SIZE_LIMIT_SETTING,
+        NUGET_CONFIG_SETTING, OAUTH_SETTING, OTEL_SETTING, OTEL_TRACES_RETENTION_SECS_SETTING,
+        OTEL_TRACING_PROXY_SETTING, PIP_INDEX_URL_SETTING, POWERSHELL_REPO_PAT_SETTING,
+        POWERSHELL_REPO_URL_SETTING, PREVIEW_TAGS_OVERRIDE_SETTING, REQUEST_SIZE_LIMIT_SETTING,
         REQUIRE_PREEXISTING_USER_FOR_OAUTH_SETTING, RESTART_COORDINATION_SETTING,
         RETENTION_PERIOD_SECS_OVERRIDES_SETTING, RETENTION_PERIOD_SECS_SETTING, RUBY_REPOS_SETTING,
         SAML_METADATA_SETTING, SANDBOX_IMAGE_CACHE_MAX_MB_SETTING,
@@ -140,12 +140,12 @@ use crate::monitor::{
     reload_instance_events_webhook_setting, reload_job_default_timeout_setting,
     reload_job_isolation_setting, reload_jwt_secret_setting, reload_license_key,
     reload_npm_config_registry_setting, reload_nsjail_tmp_backing_setting,
-    reload_nsjail_tmpfs_size_setting, reload_otel_tracing_proxy_setting,
-    reload_pip_index_url_setting, reload_retention_period_setting,
-    reload_sandbox_image_cache_max_setting, reload_sandbox_image_default_registry_setting,
-    reload_sandbox_image_max_size_setting, reload_sandbox_image_pull_policy_setting,
-    reload_sandbox_registry_auth_setting, reload_scim_token_setting,
-    reload_service_log_retention_secs_setting, reload_smtp_config,
+    reload_nsjail_tmpfs_size_setting, reload_otel_traces_retention_secs_setting,
+    reload_otel_tracing_proxy_setting, reload_pip_index_url_setting,
+    reload_retention_period_setting, reload_sandbox_image_cache_max_setting,
+    reload_sandbox_image_default_registry_setting, reload_sandbox_image_max_size_setting,
+    reload_sandbox_image_pull_policy_setting, reload_sandbox_registry_auth_setting,
+    reload_scim_token_setting, reload_service_log_retention_secs_setting, reload_smtp_config,
     reload_store_audit_logs_s3_setting, reload_uv_exclude_newer_setting,
     reload_uv_index_strategy_setting, reload_uv_python_install_mirror_setting,
     reload_worker_config, MonitorIteration,
@@ -2013,6 +2013,9 @@ async fn process_notify_event(
                 SERVICE_LOG_RETENTION_SECS_SETTING => {
                     reload_service_log_retention_secs_setting(conn).await
                 }
+                OTEL_TRACES_RETENTION_SECS_SETTING => {
+                    reload_otel_traces_retention_secs_setting(conn).await
+                }
                 RETENTION_PERIOD_SECS_OVERRIDES_SETTING => {
                     if let Err(e) = load_retention_period_overrides(db).await {
                         tracing::error!("Error loading per-workspace retention overrides: {e:#}");
diff --git a/backend/src/monitor.rs b/backend/src/monitor.rs
index ce09cebe71..86e75b7de9 100644
--- a/backend/src/monitor.rs
+++ b/backend/src/monitor.rs
@@ -64,10 +64,11 @@ use windmill_common::{
         JOB_ISOLATION_SETTING, JWT_SECRET_SETTING, KEEP_JOB_DIR_SETTING, LICENSE_KEY_SETTING,
         MONITOR_LOGS_ON_OBJECT_STORE_SETTING, NPMRC_SETTING, NPM_CONFIG_REGISTRY_SETTING,
         NSJAIL_TMPFS_SIZE_MB_SETTING, NSJAIL_TMP_BACKING_SETTING, NUGET_CONFIG_SETTING,
-        OTEL_SETTING, OTEL_TRACING_PROXY_SETTING, PIP_INDEX_URL_SETTING,
-        POWERSHELL_REPO_PAT_SETTING, POWERSHELL_REPO_URL_SETTING, PREVIEW_TAGS_OVERRIDE_SETTING,
-        REQUEST_SIZE_LIMIT_SETTING, REQUIRE_PREEXISTING_USER_FOR_OAUTH_SETTING,
-        RETENTION_PERIOD_SECS_SETTING, SAML_METADATA_SETTING, SANDBOX_IMAGE_CACHE_MAX_MB_SETTING,
+        OTEL_SETTING, OTEL_TRACES_RETENTION_SECS_SETTING, OTEL_TRACING_PROXY_SETTING,
+        PIP_INDEX_URL_SETTING, POWERSHELL_REPO_PAT_SETTING, POWERSHELL_REPO_URL_SETTING,
+        PREVIEW_TAGS_OVERRIDE_SETTING, REQUEST_SIZE_LIMIT_SETTING,
+        REQUIRE_PREEXISTING_USER_FOR_OAUTH_SETTING, RETENTION_PERIOD_SECS_SETTING,
+        SAML_METADATA_SETTING, SANDBOX_IMAGE_CACHE_MAX_MB_SETTING,
         SANDBOX_IMAGE_DEFAULT_REGISTRY_SETTING, SANDBOX_IMAGE_MAX_SIZE_MB_SETTING,
         SANDBOX_IMAGE_PULL_POLICY_SETTING, SANDBOX_REGISTRY_AUTH_SETTING, SCIM_TOKEN_SETTING,
         SERVICE_LOG_RETENTION_SECS_SETTING, SMTP_SETTING, STORE_AUDIT_LOGS_S3_SETTING,
@@ -97,10 +98,10 @@ use windmill_common::{
     KillpillSender, AUDIT_LOG_RETENTION_DAYS, BASE_URL, CRITICAL_ALERTS_ON_DB_OVERSIZE,
     CRITICAL_ALERTS_ON_TOKEN_EXPIRY, CRITICAL_ALERT_MUTE_UI_ENABLED,
     CRITICAL_ALERT_MUTE_ZOMBIE_JOB_RESTART, CRITICAL_ERROR_CHANNELS, DB, DEFAULT_HUB_BASE_URL,
-    DEFAULT_SERVICE_LOG_RETENTION_SECS, HUB_BASE_URL, JOB_RETENTION_SECS,
-    JOB_RETENTION_SECS_OVERRIDES, JOB_RETENTION_SECS_OVERRIDES_LOADED, METRICS_DEBUG_ENABLED,
-    METRICS_ENABLED, MONITOR_LOGS_ON_OBJECT_STORE, OTEL_LOGS_ENABLED, OTEL_METRICS_ENABLED,
-    OTEL_TRACING_ENABLED, STORE_AUDIT_LOGS_S3,
+    DEFAULT_OTEL_TRACES_RETENTION_SECS, DEFAULT_SERVICE_LOG_RETENTION_SECS, HUB_BASE_URL,
+    JOB_RETENTION_SECS, JOB_RETENTION_SECS_OVERRIDES, JOB_RETENTION_SECS_OVERRIDES_LOADED,
+    METRICS_DEBUG_ENABLED, METRICS_ENABLED, MONITOR_LOGS_ON_OBJECT_STORE, OTEL_LOGS_ENABLED,
+    OTEL_METRICS_ENABLED, OTEL_TRACING_ENABLED, STORE_AUDIT_LOGS_S3,
 };
 use windmill_common::{
     client::AuthedClient,
@@ -514,6 +515,15 @@ pub async fn initial_load(
                 Ordering::Relaxed,
             )
         });
+        pass.setting(OTEL_TRACES_RETENTION_SECS_SETTING, true, |v| async move {
+            windmill_common::set_otel_traces_retention_secs(parse_setting_value::<i64>(
+                v,
+                OTEL_TRACES_RETENTION_SECS_SETTING,
+                "OTEL_TRACES_RETENTION_SECS",
+                DEFAULT_OTEL_TRACES_RETENTION_SECS,
+                |x| x,
+            ))
+        });
         pass.setting(STORE_AUDIT_LOGS_S3_SETTING, true, |v| async move {
             STORE_AUDIT_LOGS_S3.store(
                 parse_setting_value::<bool>(
@@ -1682,6 +1692,57 @@ const SERVICE_LOG_DELETE_BATCH: i64 = 2_000;
 /// across ticks rather than inside one, the way the neighbouring sweeps already do.
 const SERVICE_LOG_DELETE_MAX_BATCHES: usize = 10;
 
+/// One span per HTTP request made from a job script, so the table grows far faster than the
+/// job table it is keyed against; batched for the same reason the service log sweep is.
+const OTEL_TRACES_DELETE_BATCH: i64 = 10_000;
+const OTEL_TRACES_DELETE_MAX_BATCHES: usize = 10;
+
+/// Delete HTTP request tracing spans older than `retention_secs`, returning how many went.
+///
+/// `retention_secs` is a parameter rather than a read of the process-wide setting so a test can
+/// pin a window without writing state the other tests in this binary run against concurrently.
+async fn delete_expired_otel_traces(db: &DB, retention_secs: i64) -> u64 {
+    // `start_time_unix_nano` is the proto field stored verbatim, so the cutoff is built in that
+    // unit rather than compared against `now()`. Truncating the epoch to whole seconds first
+    // keeps the multiplication inside `bigint`.
+    //
+    // Batched on `ctid`, not on the `(trace_id, span_id)` primary key: with the key the planner
+    // hashes the LIMITed subquery and Seq Scans the whole table to probe it, which at the size
+    // this table reaches is the cost the batching exists to avoid. `ctid` plans as a Tid Scan, so
+    // each batch touches only the rows it deletes. Safe because the subquery and the delete share
+    // one snapshot, and spans are never updated after insert.
+    let mut deleted = 0;
+    for _ in 0..OTEL_TRACES_DELETE_MAX_BATCHES {
+        let batch = sqlx::query!(
+            "DELETE FROM otel_traces WHERE ctid IN (
+                 SELECT ctid FROM otel_traces
+                 WHERE start_time_unix_nano < EXTRACT(
+                     EPOCH FROM now() - ($1::bigint::text || ' s')::interval
+                 )::bigint * 1000000000
+                 LIMIT $2
+             )",
+            retention_secs,
+            OTEL_TRACES_DELETE_BATCH,
+        )
+        .execute(db)
+        .await;
+
+        match batch {
+            Ok(res) => {
+                deleted += res.rows_affected();
+                if (res.rows_affected() as i64) < OTEL_TRACES_DELETE_BATCH {
+                    break;
+                }
+            }
+            Err(e) => {
+                tracing::error!("Error deleting expired otel trace spans: {:?}", e);
+                break;
+            }
+        }
+    }
+    deleted
+}
+
 pub async fn delete_expired_items(db: &DB) -> () {
     let expired_tokens_r = sqlx::query_as!(
         TokenRow,
@@ -1808,6 +1869,12 @@ pub async fn delete_expired_items(db: &DB) -> () {
         }
     }
 
+    let deleted_spans =
+        delete_expired_otel_traces(db, windmill_common::otel_traces_retention_secs()).await;
+    if deleted_spans > 0 {
+        tracing::info!("deleted {} expired otel trace spans", deleted_spans);
+    }
+
     let audit_retention_days = audit_log_retention_days().await;
     let audit_retention_secs: i64 = audit_retention_days * 60 * 60 * 24;
 
@@ -2927,6 +2994,21 @@ pub async fn reload_service_log_retention_secs_setting(conn: &Connection) {
     }
 }
 
+pub async fn reload_otel_traces_retention_secs_setting(conn: &Connection) {
+    match load_setting_value::<i64>(
+        conn,
+        OTEL_TRACES_RETENTION_SECS_SETTING,
+        "OTEL_TRACES_RETENTION_SECS",
+        DEFAULT_OTEL_TRACES_RETENTION_SECS,
+        |x| x,
+    )
+    .await
+    {
+        Ok(v) => windmill_common::set_otel_traces_retention_secs(v),
+        Err(e) => tracing::error!("Error reloading otel traces retention period: {:?}", e),
+    }
+}
+
 pub async fn reload_audit_log_retention_days_setting(conn: &Connection) {
     match load_setting_value::<i64>(
         conn,
@@ -4839,7 +4921,7 @@ async fn poll_git_fork_branches(
 }
 
 async fn vacuuming_tables(db: &Pool<Postgres>) -> error::Result<()> {
-    sqlx::query!("VACUUM v2_job, v2_job_completed, job_result_stream_v2, job_stats, job_logs, job_perms, concurrency_key, log_file, metrics")
+    sqlx::query!("VACUUM v2_job, v2_job_completed, job_result_stream_v2, job_stats, job_logs, job_perms, concurrency_key, log_file, metrics, otel_traces")
         .execute(db)
         .await?;
     Ok(())
@@ -6975,6 +7057,46 @@ mod zombie_worker_memory_pct_tests {
     }
 }
 
+#[cfg(test)]
+mod otel_traces_retention_tests {
+    use super::{delete_expired_otel_traces, DB};
+
+    async fn insert_span(db: &DB, id: u8, age_secs: i64) {
+        sqlx::query!(
+            "INSERT INTO otel_traces (trace_id, span_id, name, kind, start_time_unix_nano, end_time_unix_nano)
+             VALUES ($1, $2, 'GET /', 3, $3, $3)",
+            &[id; 16][..],
+            &[id; 8][..],
+            (chrono::Utc::now() - chrono::Duration::seconds(age_secs))
+                .timestamp_nanos_opt()
+                .unwrap(),
+        )
+        .execute(db)
+        .await
+        .unwrap();
+    }
+
+    /// The cutoff crosses two units: a retention configured in seconds against a column holding
+    /// nanoseconds. Getting that conversion wrong is silent in both directions — a window a
+    /// billion times too wide never deletes anything, one a billion times too narrow deletes
+    /// every span on the next tick — so pin it on either side of the boundary.
+    #[sqlx::test(migrations = "./migrations")]
+    async fn deletes_only_spans_past_the_window(db: DB) -> anyhow::Result<()> {
+        let day = 60 * 60 * 24;
+        insert_span(&db, 1, 60).await;
+        insert_span(&db, 2, 6 * day).await;
+        insert_span(&db, 3, 8 * day).await;
+
+        assert_eq!(delete_expired_otel_traces(&db, 7 * day).await, 1);
+
+        let kept = sqlx::query_scalar!("SELECT trace_id FROM otel_traces ORDER BY trace_id")
+            .fetch_all(&db)
+            .await?;
+        assert_eq!(kept, vec![vec![1u8; 16], vec![2u8; 16]]);
+        Ok(())
+    }
+}
+
 #[cfg(test)]
 mod log_file_listing_tests {
     use super::{rotated_log_files, sorted_log_files};
diff --git a/backend/windmill-common/src/global_settings.rs b/backend/windmill-common/src/global_settings.rs
index b1ad2edd01..5c4b4bddab 100644
--- a/backend/windmill-common/src/global_settings.rs
+++ b/backend/windmill-common/src/global_settings.rs
@@ -108,6 +108,7 @@ pub const JWT_SECRET_SETTING: &str = "jwt_secret";
 pub const EMAIL_DOMAIN_SETTING: &str = "email_domain";
 pub const OTEL_SETTING: &str = "otel";
 pub const OTEL_TRACING_PROXY_SETTING: &str = "otel_tracing_proxy";
+pub const OTEL_TRACES_RETENTION_SECS_SETTING: &str = "otel_traces_retention_secs";
 pub const APP_WORKSPACED_ROUTE_SETTING: &str = "app_workspaced_route";
 pub const HTTP_ROUTE_WORKSPACED_ROUTE_SETTING: &str = "http_route_workspaced_route";
 pub const SECRET_BACKEND_SETTING: &str = "secret_backend";
diff --git a/backend/windmill-common/src/lib.rs b/backend/windmill-common/src/lib.rs
index f1784e9841..b4128f80d2 100644
--- a/backend/windmill-common/src/lib.rs
+++ b/backend/windmill-common/src/lib.rs
@@ -148,43 +148,76 @@ pub const DEFAULT_MAX_CONNECTIONS_INDEXER: u32 = 5;
 pub const DEFAULT_HUB_BASE_URL: &str = "https://hub.windmill.dev";
 pub const PRIVATE_HUB_MIN_VERSION: i32 = 10_000_000;
 pub const DEFAULT_SERVICE_LOG_RETENTION_SECS: i64 = 60 * 60 * 24 * 14; // 2 weeks retention period for logs
+pub const DEFAULT_OTEL_TRACES_RETENTION_SECS: i64 = 60 * 60 * 24 * 7; // 1 week retention period for HTTP request spans
 pub const WM_DEPLOYERS_GROUP: &str = "wm_deployers";
 
 /// A century. Every consumer has to survive `now - retention`, and the ceilings are much lower
 /// than an `i64`: `DateTime` subtraction panics past year 262143, and the `(<n> s)::interval`
 /// the cleanup queries build overflows Postgres' microsecond field.
-const MAX_SERVICE_LOG_RETENTION_SECS: i64 = 60 * 60 * 24 * 365 * 100;
+const MAX_RETENTION_SECS: i64 = 60 * 60 * 24 * 365 * 100;
 
-/// Apply a configured service log retention, in seconds.
+/// Clamp a configured retention window, in seconds, to one a cutoff can be built from.
 ///
-/// The only way into [`SERVICE_LOG_RETENTION_SECS`], so an unusable value can never reach a
-/// cutoff. The two unusable directions are not the same mistake and must not share a landing
-/// point: too large still says "keep these for a very long time", so it is capped and the
-/// intent survives, whereas falling back would delete logs the operator meant to keep. A
-/// non-positive value has no such reading — every cutoff is `now - retention`, so it lands at
-/// or after `now` and the next sweep expires the entire history, rows and object-storage files
-/// alike. Unlike job retention there is no "keep forever" spelling here, so `0` — what an
-/// operator types by analogy with it, and what the settings UI writes into a field that was
-/// merely focused — falls back to the default.
-pub fn set_service_log_retention_secs(configured: i64) {
-    let effective = if configured > MAX_SERVICE_LOG_RETENTION_SECS {
+/// Shared by the retention windows that have no "keep forever" spelling, so that an unusable
+/// value can never reach a cutoff. The two unusable directions are not the same mistake and must
+/// not share a landing point: too large still says "keep these for a very long time", so it is
+/// capped and the intent survives, whereas falling back would delete data the operator meant to
+/// keep. A non-positive value has no such reading — every cutoff is `now - retention`, so it
+/// lands at or after `now` and the next sweep expires the entire history. `0` is both what an
+/// operator types by analogy with job retention, where it does mean keep forever, and what the
+/// settings UI writes into a field that was merely focused, so it falls back to the default.
+fn clamp_retention_secs(configured: i64, default: i64, what: &str) -> i64 {
+    if configured > MAX_RETENTION_SECS {
         tracing::warn!(
-            "service log retention of {configured}s exceeds the maximum of \
-             {MAX_SERVICE_LOG_RETENTION_SECS}s, capping it there"
+            "{what} retention of {configured}s exceeds the maximum of {MAX_RETENTION_SECS}s, \
+             capping it there"
         );
-        MAX_SERVICE_LOG_RETENTION_SECS
+        MAX_RETENTION_SECS
     } else if configured >= 1 {
         configured
     } else {
         tracing::warn!(
-            "service log retention of {configured}s would expire every service log, \
-             falling back to the default of {DEFAULT_SERVICE_LOG_RETENTION_SECS}s"
+            "{what} retention of {configured}s would expire the entire history, \
+             falling back to the default of {default}s"
         );
-        DEFAULT_SERVICE_LOG_RETENTION_SECS
-    };
+        default
+    }
+}
+
+/// Apply a configured service log retention, in seconds.
+///
+/// The only way into [`SERVICE_LOG_RETENTION_SECS`]. Expiry reaches every copy of a log line:
+/// the row, the file on disk, and the object-storage object.
+pub fn set_service_log_retention_secs(configured: i64) {
+    let effective = clamp_retention_secs(
+        configured,
+        DEFAULT_SERVICE_LOG_RETENTION_SECS,
+        "service log",
+    );
     SERVICE_LOG_RETENTION_SECS.store(effective, std::sync::atomic::Ordering::Relaxed);
 }
 
+/// Apply a configured OTEL trace retention, in seconds.
+///
+/// The only way into [`OTEL_TRACES_RETENTION_SECS`].
+pub fn set_otel_traces_retention_secs(configured: i64) {
+    let effective = clamp_retention_secs(
+        configured,
+        DEFAULT_OTEL_TRACES_RETENTION_SECS,
+        "otel traces",
+    );
+    OTEL_TRACES_RETENTION_SECS.store(effective, std::sync::atomic::Ordering::Relaxed);
+}
+
+/// How long an HTTP request tracing span stays in `otel_traces`, in seconds.
+///
+/// Spans are keyed by the job they were captured for and read back by the job detail view, so
+/// this is the outer bound on how far back that view can show a job's HTTP requests. It is
+/// independent of job retention: a span can outlive its job, or be swept while the job remains.
+pub fn otel_traces_retention_secs() -> i64 {
+    OTEL_TRACES_RETENTION_SECS.load(std::sync::atomic::Ordering::Relaxed)
+}
+
 /// How long a service log line stays retrievable, in seconds.
 ///
 /// The outer bound on everything service-log: the `log_file` rows, the raw files in object
@@ -423,6 +456,10 @@ lazy_static::lazy_static! {
     /// would expire every service log cannot reach a cutoff. Read it with
     /// [`service_log_retention_secs`].
     static ref SERVICE_LOG_RETENTION_SECS: AtomicI64 = AtomicI64::new(DEFAULT_SERVICE_LOG_RETENTION_SECS);
+    /// Private on purpose, same as [`SERVICE_LOG_RETENTION_SECS`]:
+    /// [`set_otel_traces_retention_secs`] is the only writer, [`otel_traces_retention_secs`] the
+    /// only reader.
+    static ref OTEL_TRACES_RETENTION_SECS: AtomicI64 = AtomicI64::new(DEFAULT_OTEL_TRACES_RETENTION_SECS);
 
     pub static ref MONITOR_LOGS_ON_OBJECT_STORE: AtomicBool = AtomicBool::new(false);
 
diff --git a/frontend/src/lib/components/InstanceSetting.svelte b/frontend/src/lib/components/InstanceSetting.svelte
index a85ea0a575..19b5ddb533 100644
--- a/frontend/src/lib/components/InstanceSetting.svelte
+++ b/frontend/src/lib/components/InstanceSetting.svelte
@@ -846,9 +846,7 @@
 				{:else if setting.fieldType == 'seconds'}
 					<div>
 						<SecondsInput
-							max={setting.ee_only != undefined && !$enterpriseLicense
-								? 60 * 60 * 24 * 30
-								: undefined}
+							max={!$enterpriseLicense ? setting.ceMaxSeconds : undefined}
 							bind:seconds={$values[setting.key]}
 							clearable
 						/>
diff --git a/frontend/src/lib/components/instanceSettings.ts b/frontend/src/lib/components/instanceSettings.ts
index 24e7ac6438..eb8c4c86c4 100644
--- a/frontend/src/lib/components/instanceSettings.ts
+++ b/frontend/src/lib/components/instanceSettings.ts
@@ -30,6 +30,10 @@ export interface Setting {
 	placeholder?: string
 	cloudonly?: boolean
 	ee_only?: string
+	/** Ceiling a `seconds` field enforces on a build without a license, when CE genuinely caps
+	 * the value. Not implied by `ee_only`: a setting can be EE-badged because the feature it
+	 * configures is EE while the value itself has the same range on either edition. */
+	ceMaxSeconds?: number
 	tooltip?: string
 	key: string
 	// If value is not specified for first element, it will automatcally use undefined
@@ -283,6 +287,8 @@ export const settings: Record<string, Setting[]> = {
 			placeholder: '30',
 			storage: 'setting',
 			ee_only: 'You can only adjust this setting to above 30 days in the EE version',
+			// Mirrors CE_MAX_RETENTION_PERIOD_SECS, which the backend clamps to on write.
+			ceMaxSeconds: 60 * 60 * 24 * 30,
 			cloudonly: false
 		},
 		{
@@ -971,6 +977,24 @@ export const settings: Record<string, Setting[]> = {
 			triggersRestart: true,
 			defaultValue: () => ({ enabled: false, enabled_languages: [...OTEL_TRACING_PROXY_LANGUAGES] })
 		},
+		{
+			label: 'HTTP Request Tracing retention in secs',
+			key: 'otel_traces_retention_secs',
+			description:
+				'How long a captured HTTP request span is kept in the database, and therefore how far back the job details view can show a job its requests. Independent of the job retention period, so a span may outlive its job or be swept while the job remains. Defaults to 7 days. Leave it empty for the default.',
+			fieldType: 'seconds',
+			storage: 'setting',
+			cloudonly: false,
+			// Badged EE because only the EE proxy captures spans, but deliberately no
+			// `ceMaxSeconds`: a CE build still sweeps rows an EE-era instance left behind, and
+			// the backend accepts the same range on either edition.
+			ee_only: 'HTTP Request Tracing is an EE feature',
+			error:
+				'HTTP Request Tracing retention must be between 1 second and 100 years, leave it empty for the default',
+			isValid: (value: any) =>
+				value == undefined ||
+				(typeof value === 'number' && value > 0 && value <= 60 * 60 * 24 * 365 * 100)
+		},
 		{
 			label: 'Prometheus',
 			description:

From 4fef1195adaa9fa036a219884bd6c996460ca37f Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Wed, 2 Sep 2026 22:29:01 +0200
Subject: [PATCH 12/31] fix: apply object-storage test SSRF validation to all
 non-super-admins (#10933)

* fix: apply object-storage test SSRF validation to all non-super-admins

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FJLqsE5br9r5e7qy8ULwUg

* fix: name the job-token case in object-storage test rejections

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FJLqsE5br9r5e7qy8ULwUg

* fix: run object-storage connection tests with a short-lived user token

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FJLqsE5br9r5e7qy8ULwUg

* fix: test object-storage resources from the browser, mint a token only for the worker test

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FJLqsE5br9r5e7qy8ULwUg

* fix: resolve variable and resource references before the browser-side object-storage test

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FJLqsE5br9r5e7qy8ULwUg

* fix: bound the browser-side object-storage test to 15s

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FJLqsE5br9r5e7qy8ULwUg

* fix: explain object-storage test rejections and name the way out

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FJLqsE5br9r5e7qy8ULwUg

* fix: keep the server-resolved address out of the object-storage test rejection

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FJLqsE5br9r5e7qy8ULwUg

---------

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
---
 backend/tests/object_storage_test_ssrf.rs     |  97 ++++++
 backend/windmill-api-settings/src/lib.rs      |  93 ++++--
 .../ObjectStoreConfigSettings.svelte          |   1 +
 .../src/lib/components/TestConnection.svelte  | 286 ++++++++++++------
 4 files changed, 354 insertions(+), 123 deletions(-)
 create mode 100644 backend/tests/object_storage_test_ssrf.rs

diff --git a/backend/tests/object_storage_test_ssrf.rs b/backend/tests/object_storage_test_ssrf.rs
new file mode 100644
index 0000000000..aa9eaaf74c
--- /dev/null
+++ b/backend/tests/object_storage_test_ssrf.rs
@@ -0,0 +1,97 @@
+//! `POST /api/settings/test_object_storage_config` runs the probe on the API server and reflects the
+//! upstream response, so every non-super-admin must be rejected for private/loopback endpoints and
+//! the Filesystem backend on every deployment (`CLOUD_HOSTED` is unset here), while a super admin's
+//! Filesystem probe still round-trips. Requires the `parquet` feature, like the route.
+#![cfg(feature = "parquet")]
+
+use serde_json::json;
+use sqlx::{Pool, Postgres};
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::Arc;
+use windmill_test_utils::*;
+
+const SUPER_ADMIN_TOKEN: &str = "SECRET_TOKEN";
+const USER_TOKEN: &str = "SECRET_TOKEN_2";
+
+async fn test_object_storage(
+    url: &str,
+    token: &str,
+    body: serde_json::Value,
+) -> anyhow::Result<(u16, String)> {
+    let resp = reqwest::Client::new()
+        .post(url)
+        .header("Authorization", format!("Bearer {token}"))
+        .json(&body)
+        .send()
+        .await?;
+    Ok((resp.status().as_u16(), resp.text().await?))
+}
+
+#[sqlx::test(fixtures("base"))]
+async fn object_storage_test_is_restricted_for_non_super_admins_off_cloud(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let url = format!(
+        "http://localhost:{}/api/settings/test_object_storage_config",
+        server.addr.port()
+    );
+
+    // A loopback "S3 endpoint" standing in for an internal service: the probe must be rejected
+    // before the server opens a connection to it.
+    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await?;
+    let internal_port = listener.local_addr()?.port();
+    let connected = Arc::new(AtomicBool::new(false));
+    tokio::spawn({
+        let connected = connected.clone();
+        async move {
+            while listener.accept().await.is_ok() {
+                connected.store(true, Ordering::SeqCst);
+            }
+        }
+    });
+    let internal_s3 = json!({
+        "type": "S3",
+        "bucket": "bucket",
+        "region": "us-east-1",
+        "access_key": "key",
+        "secret_key": "secret",
+        "endpoint": format!("http://127.0.0.1:{internal_port}"),
+        "allow_http": true,
+        "path_style": true,
+    });
+    let (status, body) = test_object_storage(&url, USER_TOKEN, internal_s3).await?;
+    assert_eq!(
+        status, 401,
+        "non-super-admin must be rejected for a loopback endpoint (got {status}): {body}"
+    );
+    assert!(
+        body.contains("requires a super admin"),
+        "unexpected rejection: {body}"
+    );
+    assert!(
+        !connected.load(Ordering::SeqCst),
+        "the server must not connect to the rejected endpoint"
+    );
+
+    let tmp = tempfile::tempdir()?;
+    let filesystem = json!({ "type": "Filesystem", "root_path": tmp.path().to_str().unwrap() });
+    let (status, body) = test_object_storage(&url, USER_TOKEN, filesystem.clone()).await?;
+    assert_eq!(
+        status, 401,
+        "non-super-admin must be rejected for a Filesystem backend (got {status}): {body}"
+    );
+    assert!(
+        body.contains("requires a super admin"),
+        "unexpected rejection: {body}"
+    );
+
+    // Super admins keep the unrestricted path.
+    let (status, body) = test_object_storage(&url, SUPER_ADMIN_TOKEN, filesystem).await?;
+    assert_eq!(
+        status, 200,
+        "super admin must be able to test a Filesystem backend (got {status}): {body}"
+    );
+    Ok(())
+}
diff --git a/backend/windmill-api-settings/src/lib.rs b/backend/windmill-api-settings/src/lib.rs
index 2cda80f458..18a8d52ac0 100644
--- a/backend/windmill-api-settings/src/lib.rs
+++ b/backend/windmill-api-settings/src/lib.rs
@@ -284,15 +284,28 @@ pub async fn test_s3_bucket(
     use bytes::Bytes;
     use futures::StreamExt;
 
-    // The probe executes on the API server itself. On multi-tenant Cloud that is a shared control
-    // plane, so we constrain untrusted callers to remove the SSRF / credential-exfiltration /
-    // local-filesystem surface (see validate_object_storage_test). On self-hosted instances the
-    // object store usually lives on the local/private network and all authenticated users are
-    // trusted, so testing there stays unrestricted. Super admins keep the unrestricted path too.
+    // The probe executes on the API server itself and reflects the upstream response into the
+    // error, so any authenticated caller could otherwise use it as an SSRF / port-scan primitive
+    // against the server's network, exfiltrate its ambient credentials, or write to its local
+    // disk (see validate_object_storage_test). That holds on self-hosted instances as much as on
+    // Cloud, so only super admins get the unrestricted path.
     let is_super_admin = windmill_api_auth::is_super_admin_authed(&db, &authed).await?;
-    let restrict = !is_super_admin && *CLOUD_HOSTED;
+    let restrict = !is_super_admin;
     if restrict {
-        validate_object_storage_test(&test_s3_bucket).await?;
+        validate_object_storage_test(&test_s3_bucket)
+            .await
+            .map_err(|e| match e {
+                // A job token never counts as a super admin (it is capped at workspace admin), so
+                // a super admin calling this route from a script is told why rather than that
+                // they lack a privilege they hold.
+                error::Error::NotAuthorized(msg) if authed.job_id.is_some() => {
+                    error::Error::NotAuthorized(format!(
+                        "{msg} A job token ($WM_TOKEN) is never treated as a super admin; call \
+                         this route with a user token instead."
+                    ))
+                }
+                e => e,
+            })?;
     }
 
     let client = build_object_store_from_settings(test_s3_bucket, Some(&db))
@@ -355,8 +368,8 @@ pub async fn test_s3_bucket(
     }
 }
 
-// Hardening for the object-storage connectivity test by an untrusted (non-super-admin) caller on
-// Cloud. The probe runs on the shared API server, so without these constraints an authenticated
+// Hardening for the object-storage connectivity test by an untrusted (non-super-admin) caller.
+// The probe runs on the API server, so without these constraints an authenticated
 // user could coerce the server into connecting to arbitrary internal endpoints (SSRF), signing
 // requests with the instance role (credential exfiltration), or reading/writing the server's local
 // disk (filesystem object store).
@@ -366,6 +379,11 @@ async fn validate_object_storage_test(settings: &ObjectSettings) -> error::Resul
         opt.as_ref().is_some_and(|s| !s.is_empty())
     }
 
+    // Every refusal names the way out: the resource usually works in jobs (workers reach the
+    // endpoint directly), so without it the refusal reads as a broken resource.
+    const ALTERNATIVE: &str =
+        "Ask a super admin to run it, or test the resource from a script, which runs on a worker.";
+
     // Reject backends that rely on the server's identity or local filesystem, require explicit
     // credentials for the rest (so the server never falls back to its own ambient credentials), and
     // resolve the host the client will actually connect to. We derive the *effective* endpoint here
@@ -376,20 +394,25 @@ async fn validate_object_storage_test(settings: &ObjectSettings) -> error::Resul
     let effective_endpoint: Option<String> = match settings {
         ObjectSettings::Filesystem(_) => {
             return Err(error::Error::NotAuthorized(
-                "Testing a local filesystem object store requires a super admin".to_string(),
+                "Testing a local filesystem object store requires a super admin: it runs on the \
+                 Windmill server and reads and writes the server's local disk. Ask a super admin \
+                 to run it."
+                    .to_string(),
             ));
         }
         ObjectSettings::AwsOidc(_) => {
-            return Err(error::Error::NotAuthorized(
-                "Testing OIDC-based object storage requires a super admin".to_string(),
-            ));
+            return Err(error::Error::NotAuthorized(format!(
+                "Testing OIDC-based object storage requires a super admin: it runs on the \
+                 Windmill server with the server's own identity. {ALTERNATIVE}"
+            )));
         }
         ObjectSettings::S3(s3) => {
             if !(non_empty(&s3.access_key) && non_empty(&s3.secret_key)) {
-                return Err(error::Error::NotAuthorized(
-                    "Testing S3 storage without explicit credentials requires a super admin"
-                        .to_string(),
-                ));
+                return Err(error::Error::NotAuthorized(format!(
+                    "Testing S3 storage without an explicit access key and secret key requires a \
+                     super admin: it runs on the Windmill server, which would use its own ambient \
+                     credentials. {ALTERNATIVE}"
+                )));
             }
             let region = s3
                 .region
@@ -413,10 +436,11 @@ async fn validate_object_storage_test(settings: &ObjectSettings) -> error::Resul
         }
         ObjectSettings::Azure(azure) => {
             if !non_empty(&azure.access_key) {
-                return Err(error::Error::NotAuthorized(
-                    "Testing Azure storage without an explicit access key requires a super admin"
-                        .to_string(),
-                ));
+                return Err(error::Error::NotAuthorized(format!(
+                    "Testing Azure storage without an explicit access key requires a super admin: \
+                     it runs on the Windmill server, which would use its own ambient credentials. \
+                     {ALTERNATIVE}"
+                )));
             }
             Some(
                 azure
@@ -432,10 +456,11 @@ async fn validate_object_storage_test(settings: &ObjectSettings) -> error::Resul
             // otherwise an untrusted caller could probe with the server's identity (the very
             // SSRF/credential-exfil this function guards against).
             if windmill_object_store::gcs_service_account_key_is_blank(&gcs.service_account_key) {
-                return Err(error::Error::NotAuthorized(
-                    "Testing GCS storage without a service account key requires a super admin"
-                        .to_string(),
-                ));
+                return Err(error::Error::NotAuthorized(format!(
+                    "Testing GCS storage without a service account key requires a super admin: \
+                     it runs on the Windmill server, which would use its own ambient credentials. \
+                     {ALTERNATIVE}"
+                )));
             }
             // The service-account-key JSON can override the data-plane URL (`gcs_base_url`) and the
             // OAuth token endpoint (`token_uri`); the GCS client connects to whatever they point at.
@@ -492,10 +517,15 @@ async fn validate_public_endpoint(endpoint: &str) -> error::Result<()> {
     // attempts (a name resolving to both a public and a private address).
     for addr in addrs {
         if is_forbidden_ip(addr.ip()) {
-            return Err(error::Error::NotAuthorized(
-                "Testing object storage at a private, loopback, or link-local endpoint requires a super admin"
-                    .to_string(),
-            ));
+            // The resolved address stays out of the message: it is the server's resolver's
+            // answer, and this message is only ever shown to the caller being constrained.
+            return Err(error::Error::NotAuthorized(format!(
+                "Testing object storage at '{host}', which resolves to a private, loopback, or \
+                 link-local address, requires a super admin: this test runs on the Windmill \
+                 server, which is not allowed to probe internal addresses for non-super-admins. \
+                 Ask a super admin to run it, or test the resource from a script, which runs on \
+                 a worker."
+            )));
         }
     }
     Ok(())
@@ -2008,7 +2038,10 @@ struct CachedResourceType {
     /// decodes the on-disk cache, where an absent key means "written before the
     /// column, leave the stored extension alone" and an explicit null means the hub
     /// dropped it. Plain serde folds both into `None`.
-    #[serde(default, deserialize_with = "windmill_common::more_serde::double_option")]
+    #[serde(
+        default,
+        deserialize_with = "windmill_common::more_serde::double_option"
+    )]
     format_extension: Option<Option<String>>,
 }
 
diff --git a/frontend/src/lib/components/ObjectStoreConfigSettings.svelte b/frontend/src/lib/components/ObjectStoreConfigSettings.svelte
index c7f7065565..14658a4228 100644
--- a/frontend/src/lib/components/ObjectStoreConfigSettings.svelte
+++ b/frontend/src/lib/components/ObjectStoreConfigSettings.svelte
@@ -305,6 +305,7 @@
 				resourceType="s3_bucket"
 				workspaceOverride="admins"
 				buttonTextOverride="Test from a worker"
+				viaWorker
 			/>
 		</div>
 
diff --git a/frontend/src/lib/components/TestConnection.svelte b/frontend/src/lib/components/TestConnection.svelte
index 37e3e152db..6a58af8031 100644
--- a/frontend/src/lib/components/TestConnection.svelte
+++ b/frontend/src/lib/components/TestConnection.svelte
@@ -1,5 +1,13 @@
 <script lang="ts">
-	import { type CompletedJob, JobService, type Preview } from '$lib/gen'
+	import {
+		type CompletedJob,
+		JobService,
+		type Preview,
+		ResourceService,
+		SettingService,
+		UserService,
+		VariableService
+	} from '$lib/gen'
 
 	import { Database, Loader2 } from 'lucide-svelte'
 	import Button from './common/button/Button.svelte'
@@ -13,15 +21,57 @@
 		resourceType: string | undefined
 		args?: Record<string, any> | any
 		buttonTextOverride?: string | undefined
+		// Object-storage types only: probe from a preview job (proves a worker reaches the API)
+		// instead of the browser. The job gets a short-lived token minted for the caller, since a
+		// job token is never a super admin, and that token is readable in the job's stored args
+		// until revoked: only use it where the workspace's job readers may hold the caller's rights.
+		viaWorker?: boolean
 	}
 
 	let {
 		workspaceOverride = undefined,
 		resourceType,
 		args = {},
-		buttonTextOverride = undefined
+		buttonTextOverride = undefined,
+		viaWorker = false
 	}: Props = $props()
 
+	// Object-storage resource types share one probe, the API's own connectivity test, which runs
+	// on the API server with the caller's privileges. Each type maps its resource to the
+	// ObjectSettings body that route expects.
+	const objectStorageBody: { [key: string]: (args: any) => Record<string, any> } = {
+		s3: (s3) => ({
+			type: 'S3',
+			region: s3.region,
+			bucket: s3.bucket,
+			endpoint: s3.endPoint,
+			port: s3.port,
+			allow_http: !s3.useSSL,
+			access_key: s3.accessKey,
+			secret_key: s3.secretKey,
+			path_style: s3.pathStyle
+		}),
+		azure_blob: (s3) => ({ type: 'Azure', ...s3 }),
+		s3_bucket: (bucket) => bucket
+	}
+
+	const OBJECT_STORAGE_TEST_SCRIPT = `
+export async function main(bucket: any, api_token: string) {
+	const res = await fetch(process.env.BASE_URL + '/api/settings/test_object_storage_config', {
+		method: 'POST',
+		headers: {
+			'Content-Type': 'application/json',
+			Authorization: 'Bearer ' + api_token,
+		},
+		body: JSON.stringify(bucket),
+	})
+	if (!res.ok) {
+		throw new Error(await res.text())
+	}
+	return await res.text()
+}
+`
+
 	const scripts: {
 		[key: string]: {
 			code: string
@@ -68,71 +118,18 @@
 			argName: 'database'
 		},
 		s3: {
-			code: `
-import * as wmill from "windmill-client"
-
-type S3 = object
-
-export async function main(s3: S3) {
-	return fetch(process.env["BASE_URL"] + '/api/settings/test_object_storage_config', {
-		method: 'POST',
-		headers: {
-			'Content-Type': 'application/json',
-			Authorization: 'Bearer ' + process.env["WM_TOKEN"],
-		},
-		body: JSON.stringify({
-			type: "S3",
-			region: s3.region,
-			bucket: s3.bucket,
-			endpoint: s3.endPoint,
-			port: s3.port,
-			allow_http: !s3.useSSL,
-			access_key: s3.accessKey,
-			secret_key: s3.secretKey,
-			path_style: s3.pathStyle,
-		}),
-	}).then(async (res) => {
-		if (!res.ok) {
-			throw new Error(await res.text())
-		}
-		return res.text()
-	})
-}
-`,
+			code: OBJECT_STORAGE_TEST_SCRIPT,
 			lang: 'bun',
-			argName: 's3',
+			argName: 'bucket',
 			tooltip:
-				'The storage operations of this test run on the Windmill server (the API process), not on the worker. If no access key/secret key is set, the ambient AWS credentials of the server (environment variables, instance role) are used — scripts using this resource directly through an S3 SDK resolve credentials on the worker instead, so results may differ.'
+				'The storage operations of this test run on the Windmill server (the API process) with your permissions, not on the worker. Non-super-admins can only test public endpoints with an explicit access key and secret key; super admins can also test private endpoints and rely on the ambient AWS credentials of the server (environment variables, instance role). Scripts using this resource directly through an S3 SDK resolve credentials on the worker instead, so results may differ.'
 		},
 		azure_blob: {
-			code: `
-import * as wmill from "windmill-client"
-
-type S3 = object
-
-export async function main(s3: S3) {
-	return fetch(process.env["BASE_URL"] + '/api/settings/test_object_storage_config', {
-		method: 'POST',
-		headers: {
-			'Content-Type': 'application/json',
-			Authorization: 'Bearer ' + process.env["WM_TOKEN"],
-		},
-		body: JSON.stringify({
-			type: "Azure",
-			...s3
-		}),
-	}).then(async (res) => {
-		if (!res.ok) {
-			throw new Error(await res.text())
-		}
-		return res.text()
-	})
-}
-`,
+			code: OBJECT_STORAGE_TEST_SCRIPT,
 			lang: 'bun',
-			argName: 's3',
+			argName: 'bucket',
 			tooltip:
-				'The storage operations of this test run on the Windmill server (the API process), not on the worker.'
+				'The storage operations of this test run on the Windmill server (the API process) with your permissions, not on the worker. Non-super-admins can only test public endpoints with an explicit access key.'
 		},
 		graphql: {
 			code: '{ __typename }',
@@ -158,61 +155,163 @@ export async function main(s3: S3) {
 			}
 		},
 		s3_bucket: {
-			code: `
-
-const process = require('process');
-
-export async function main(bucket: any) {
-	const req = await fetch(process.env.BASE_URL + '/api/settings/test_object_storage_config', {
-		method: 'POST',
-		headers: {
-			'Content-Type': 'application/json',
-			Authorization: 'Bearer ' + process.env.WM_TOKEN,
-		},
-		body: JSON.stringify(bucket),
-	});
-	if (!req.ok) {
-		throw new Error(await req.text());
-	}
-	return await req.text();
-}
-`,
+			code: OBJECT_STORAGE_TEST_SCRIPT,
 			lang: 'bun',
 			argName: 'bucket',
 			tooltip:
-				"The storage operations of this test run on the Windmill server (the API process). If no credentials are configured, the server's ambient credentials for the configured provider (environment variables, instance role) are used."
+				"The storage operations of this test run on the Windmill server (the API process) with your permissions. Non-super-admins can only test public endpoints with explicit credentials; super admins can also test private endpoints and rely on the server's ambient credentials for the configured provider (environment variables, instance role)."
 		}
 	}
 
 	let loading = $state(false)
+
+	// The token is revoked as soon as the job settles; the expiry only covers a browser that
+	// goes away mid-test. It is readable in the job's stored args until then, hence the short life.
+	const API_TOKEN_TTL_MS = 60_000
+	// Tokens are addressed by their first 10 characters (TOKEN_PREFIX_LEN on the backend).
+	const API_TOKEN_PREFIX_LEN = 10
+
+	async function mintApiToken(): Promise<string> {
+		return await UserService.createToken({
+			requestBody: {
+				label: `test connection: ${resourceType}`,
+				expiration: new Date(Date.now() + API_TOKEN_TTL_MS).toISOString(),
+				scopes: ['settings:write']
+			}
+		})
+	}
+
+	async function revokeApiToken(token: string | undefined) {
+		if (!token) return
+		try {
+			await UserService.deleteToken({ tokenPrefix: token.slice(0, API_TOKEN_PREFIX_LEN) })
+		} catch (err) {
+			console.error(err)
+		}
+	}
+
+	// A preview job gets its arguments interpolated on the worker: `$var:`, `$jsonvar:` and
+	// `$res:` references are replaced with the job's privileges before the script runs. The
+	// browser path has to do the same with the caller's session, or a secret stored as a linked
+	// variable (what the "Add resource" drawer saves) is sent verbatim as the credential.
+	async function resolveReferences(value: any, workspace: string): Promise<any> {
+		if (typeof value === 'string') {
+			if (value.startsWith('$var:')) {
+				return await VariableService.getVariableValue({
+					workspace,
+					path: value.slice('$var:'.length)
+				})
+			}
+			if (value.startsWith('$jsonvar:')) {
+				return JSON.parse(
+					await VariableService.getVariableValue({
+						workspace,
+						path: value.slice('$jsonvar:'.length)
+					})
+				)
+			}
+			if (value.startsWith('$res:')) {
+				return await ResourceService.getResourceValueInterpolated({
+					workspace,
+					path: value.slice('$res:'.length)
+				})
+			}
+			return value
+		}
+		if (Array.isArray(value)) {
+			return await Promise.all(value.map((v) => resolveReferences(v, workspace)))
+		}
+		if (value && typeof value === 'object') {
+			const resolved: Record<string, any> = {}
+			for (const [key, v] of Object.entries(value)) {
+				resolved[key] = await resolveReferences(v, workspace)
+			}
+			return resolved
+		}
+		return value
+	}
+
+	// The route bounds the probe only for non-super-admins; a super admin's probe against an
+	// endpoint that accepts the connection and never answers would otherwise spin here forever.
+	const BROWSER_TEST_TIMEOUT_MS = 15_000
+
+	async function testObjectStorageFromBrowser(body: Record<string, any>, workspace: string) {
+		let timer: ReturnType<typeof setTimeout> | undefined = undefined
+		try {
+			const request = SettingService.testObjectStorageConfig({
+				requestBody: await resolveReferences(body, workspace)
+			})
+			await Promise.race([
+				request,
+				new Promise<never>((_, reject) => {
+					timer = setTimeout(() => {
+						request.cancel()
+						reject(
+							new Error(
+								`no answer from the storage endpoint after ${BROWSER_TEST_TIMEOUT_MS / 1000}s`
+							)
+						)
+					}, BROWSER_TEST_TIMEOUT_MS)
+				})
+			])
+			sendUserToast('Connection successful', false)
+		} catch (err: any) {
+			sendUserToast('Connection error: ' + (err?.body ?? err?.message ?? err), true)
+		} finally {
+			clearTimeout(timer)
+			loading = false
+		}
+	}
+
 	async function testConnection() {
 		if (!resourceType) return
 		loading = true
 
 		const resourceScript = scripts[resourceType]
+		const workspace = workspaceOverride ?? $workspaceStore!
+		const objectStorageArgs: Record<string, any> | undefined =
+			resourceType in objectStorageBody ? objectStorageBody[resourceType](args) : undefined
 
-		const job = await JobService.runScriptPreview({
-			workspace: workspaceOverride ?? $workspaceStore!,
-			requestBody: {
-				path: `testConnection: ${resourceType}`,
-				language: resourceScript.lang as Preview['language'],
-				content: resourceScript.code,
-				args: {
-					[resourceScript.argName]: args
-				}
+		if (objectStorageArgs && !viaWorker) {
+			await testObjectStorageFromBrowser(objectStorageArgs, workspace)
+			return
+		}
+
+		let apiToken: string | undefined = undefined
+		let job: string
+		try {
+			if (objectStorageArgs) {
+				apiToken = await mintApiToken()
 			}
-		})
+			job = await JobService.runScriptPreview({
+				workspace,
+				requestBody: {
+					path: `testConnection: ${resourceType}`,
+					language: resourceScript.lang as Preview['language'],
+					content: resourceScript.code,
+					args: objectStorageArgs
+						? { bucket: objectStorageArgs, api_token: apiToken }
+						: { [resourceScript.argName]: args }
+				}
+			})
+		} catch (err: any) {
+			loading = false
+			await revokeApiToken(apiToken)
+			sendUserToast('Connection error: ' + (err?.body ?? err?.message ?? err), true)
+			return
+		}
 
 		tryEvery({
 			tryCode: async () => {
 				let testResult = await JobService.getCompletedJob({
-					workspace: workspaceOverride ?? $workspaceStore!,
+					workspace,
 					id: job
 				})
 				if (resourceScript.additionalCheck) {
 					testResult = resourceScript.additionalCheck(testResult)
 				}
 				loading = false
+				revokeApiToken(apiToken)
 				sendUserToast(
 					testResult.success
 						? 'Connection successful'
@@ -222,13 +321,14 @@ export async function main(bucket: any) {
 			},
 			timeoutCode: async () => {
 				loading = false
+				revokeApiToken(apiToken)
 				sendUserToast(
 					'Connection did not resolve after 5s or job did not start. Do you have native workers or a worker group listening to the proper tag available?',
 					true
 				)
 				try {
 					await JobService.cancelQueuedJob({
-						workspace: workspaceOverride ?? $workspaceStore!,
+						workspace,
 						id: job,
 						requestBody: {
 							reason:

From 06ff9ff45f6187629f950e57c297e67652fc6259 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Wed, 2 Sep 2026 22:37:43 +0200
Subject: [PATCH 13/31] chore(main): release 1.802.0 (#10934)

---
 .release-please-manifest.json |  2 +-
 CHANGELOG.md                  | 20 ++++++++++++++++++++
 version.txt                   |  2 +-
 3 files changed, 22 insertions(+), 2 deletions(-)

diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index 238a566433..d720ec7aca 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "1.801.0"
+  ".": "1.802.0"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2a7512989f..9c2b87cbd0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,25 @@
 # Changelog
 
+## [1.802.0](https://github.com/windmill-labs/windmill/compare/v1.801.0...v1.802.0) (2026-09-02)
+
+
+### Features
+
+* add retention cleanup for the otel_traces table ([#10949](https://github.com/windmill-labs/windmill/issues/10949)) ([d472193](https://github.com/windmill-labs/windmill/commit/d472193e5bf5f6428e0096a402eb2c9299634fb2))
+* open path links from chat messages in the session preview panel ([#10881](https://github.com/windmill-labs/windmill/issues/10881)) ([f10ac6c](https://github.com/windmill-labs/windmill/commit/f10ac6c2b3644fb16697e650efbc4f7cd3c6944c))
+* restore owner and label filter chips on the homepage ([#10942](https://github.com/windmill-labs/windmill/issues/10942)) ([ccf8476](https://github.com/windmill-labs/windmill/commit/ccf84761dd664b9228dfe2f65867e8c32cd20c21))
+* **sessions:** offer the item you came from when starting a new session ([#10940](https://github.com/windmill-labs/windmill/issues/10940)) ([d3747d6](https://github.com/windmill-labs/windmill/commit/d3747d62555ebcb09c78cfabcaa3b6177758d6ea))
+* workspace setting to hide the AI assistant, agent steps unaffected ([#10941](https://github.com/windmill-labs/windmill/issues/10941)) ([fdd3b36](https://github.com/windmill-labs/windmill/commit/fdd3b36423344a2e1a464674179406581074e926))
+
+
+### Bug Fixes
+
+* apply object-storage test SSRF validation to all non-super-admins ([#10933](https://github.com/windmill-labs/windmill/issues/10933)) ([4fef119](https://github.com/windmill-labs/windmill/commit/4fef1195adaa9fa036a219884bd6c996460ca37f))
+* connect to dev server instead of localhost ([#10912](https://github.com/windmill-labs/windmill/issues/10912)) ([337154b](https://github.com/windmill-labs/windmill/commit/337154b8304a5969f35216add627b5c1153c0f6c))
+* preselect first row of AI agent and AI sandbox insert panes ([#10937](https://github.com/windmill-labs/windmill/issues/10937)) ([95b6bbd](https://github.com/windmill-labs/windmill/commit/95b6bbd46ada11d96a914ae5b0e92aba4dd02530))
+* record supplied script lock hashes so importers can skip relocking ([#10915](https://github.com/windmill-labs/windmill/issues/10915)) ([17ba521](https://github.com/windmill-labs/windmill/commit/17ba521c352aec65a8270893752bbadd7f3d6eaa))
+* sandbox script-controlled content types in result_to_response ([#10932](https://github.com/windmill-labs/windmill/issues/10932)) ([419741e](https://github.com/windmill-labs/windmill/commit/419741e5d226c67c51429094fb6ded9474afed99))
+
 ## [1.801.0](https://github.com/windmill-labs/windmill/compare/v1.800.1...v1.801.0) (2026-09-01)
 
 
diff --git a/version.txt b/version.txt
index a0a936e59b..8b528eb361 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-1.801.0
+1.802.0

From 9b64a89cd46ae718d6c58fa12f925fa041fb1032 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Thu, 3 Sep 2026 08:43:52 +0200
Subject: [PATCH 14/31] fix: let operators use wmill.datatable() from within
 running jobs (#10931)

* fix: let operators use wmill.datatable() from within running jobs

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RHR4fytgt6m4q37WCXs2Rp

* fix: refuse content-driven redirects and deferral in the operator datatable exemption

* fix: check the datatable exemption against the expanded query, not the raw content

* fix: fail closed on a language-overriding expansion and state the exemption's real scope

---------

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
---
 .../tests/fixtures/inline_preview_auth.sql    |  12 +-
 backend/tests/inline_preview_auth.rs          | 199 ++++++++++++++++--
 backend/windmill-api/src/jobs.rs              | 114 +++++++++-
 3 files changed, 299 insertions(+), 26 deletions(-)

diff --git a/backend/tests/fixtures/inline_preview_auth.sql b/backend/tests/fixtures/inline_preview_auth.sql
index 59fe2dc917..67ca598bda 100644
--- a/backend/tests/fixtures/inline_preview_auth.sql
+++ b/backend/tests/fixtures/inline_preview_auth.sql
@@ -2,7 +2,9 @@
 -- Layered on top of `base` (which provides test-workspace and the non-operator
 -- `test-user-2`/SECRET_TOKEN_2). Adds an Operator member so we can assert that
 -- Operators cannot reach the arbitrary-code inline preview path
--- (`POST /jobs/run_inline/preview`).
+-- (`POST /jobs/run_inline/preview`) with their own token, plus two deployed script
+-- jobs of the operator: one running, so we can assert that its WM_TOKEN can, and
+-- one queued but not yet pulled, so we can assert that "queued" is not enough.
 
 INSERT INTO password(email, password_hash, login_type, super_admin, verified, name)
     VALUES ('operator@windmill.dev', 'not-a-real-hash', 'password', false, true, 'Operator User');
@@ -12,3 +14,11 @@ INSERT INTO usr(workspace_id, email, username, is_admin, operator, role) VALUES
 
 INSERT INTO token(token_hash, token_prefix, token, email, label, super_admin) VALUES
 	(encode(sha256('OPERATOR_TOKEN'::bytea), 'hex'), 'OPERATOR_T', 'OPERATOR_TOKEN', 'operator@windmill.dev', 'operator token', false);
+
+INSERT INTO v2_job(id, workspace_id, kind, runnable_path, created_by, permissioned_as, permissioned_as_email) VALUES
+	('2aa0c0de-0000-4000-8000-000000000001', 'test-workspace', 'script', 'u/test-user/deployed', 'operator-user', 'u/operator-user', 'operator@windmill.dev'),
+	('2aa0c0de-0000-4000-8000-000000000002', 'test-workspace', 'script', 'u/test-user/deployed', 'operator-user', 'u/operator-user', 'operator@windmill.dev');
+
+INSERT INTO v2_job_queue(id, workspace_id, scheduled_for, running) VALUES
+	('2aa0c0de-0000-4000-8000-000000000001', 'test-workspace', now(), true),
+	('2aa0c0de-0000-4000-8000-000000000002', 'test-workspace', now(), false);
diff --git a/backend/tests/inline_preview_auth.rs b/backend/tests/inline_preview_auth.rs
index 97b70fb545..8841719962 100644
--- a/backend/tests/inline_preview_auth.rs
+++ b/backend/tests/inline_preview_auth.rs
@@ -9,16 +9,33 @@
 //! was the incomplete-fix residual of CVE-2026-22683, whose v1.615.0 patch only
 //! covered the entity-CRUD endpoints and left this direct inline-exec sink open.
 //!
+//! The guard on both routes has one exemption: `wmill.datatable()` called from
+//! inside a job the operator is running. Operators can only run deployed code,
+//! so a request the job's WM_TOKEN authenticates comes from code a non-operator
+//! authored, and the exemption is limited to the request shape the helper sends
+//! (PostgreSQL against a `datatable://` database) so a leaked WM_TOKEN cannot
+//! be replayed to run anything else.
+//!
 //! This test pins down:
-//!   - an Operator is rejected by the operator guard (the core fix; pre-fix this
-//!     reached the inline executor instead of returning 401), and
+//!   - an Operator's own token is rejected by the operator guard (the core fix;
+//!     pre-fix this reached the inline executor instead of returning 401),
 //!   - a regular non-operator passes the guard (the fix must not over-block the
 //!     legitimate inline preview flow): in the test harness the worker inline
 //!     utils are not registered, so a caller past the guard gets the distinct
-//!     "worker inline functions" error rather than the operator rejection.
+//!     "worker inline functions" error rather than the operator rejection,
+//!   - an Operator's job token passes the guard for a datatable query while its
+//!     job is running, on the inline route and on the `/jobs/run/preview`
+//!     fallback the SDKs use when the worker has no internal server,
+//!   - the same token is rejected for any other payload (in-process DuckDB, or a
+//!     `-- database` directive redirecting the query, whether written literally or
+//!     reached through a `WM_INTERNAL_DB` marker) and for a deferred run,
+//!   - an Operator's job token for a job that is not running, whether finished or
+//!     merely queued, is rejected.
 
 use serde_json::json;
 use sqlx::{Pool, Postgres};
+use windmill_common::auth::create_jwt_token;
+use windmill_common::db::Authed;
 use windmill_test_utils::*;
 
 fn client() -> reqwest::Client {
@@ -38,11 +55,65 @@ fn inline_preview_body() -> serde_json::Value {
     })
 }
 
+/// The request `wmill.datatable("main")` sends: PostgreSQL against `datatable://main`.
+fn datatable_query_body() -> serde_json::Value {
+    json!({
+        "language": "postgresql",
+        "content": "SELECT 1 AS x;",
+        "args": { "database": "datatable://main" }
+    })
+}
+
+/// Mint the WM_TOKEN a job hands its own code: an internally-signed job JWT
+/// (note the `job_id` claim) for the fixture's operator, exactly as the worker
+/// issues it when the operator runs a deployed script.
+async fn operator_job_token(job_id: uuid::Uuid) -> String {
+    let authed = Authed {
+        email: "operator@windmill.dev".to_string(),
+        username: "operator-user".to_string(),
+        is_admin: false,
+        is_operator: true,
+        groups: vec![],
+        folders: vec![],
+        scopes: None,
+        token_prefix: None,
+    };
+    create_jwt_token(
+        authed,
+        "test-workspace",
+        3600,
+        Some(job_id),
+        Some("ephemeral-script".to_string()),
+        None,
+        None,
+    )
+    .await
+    .expect("mint operator job token")
+}
+
 const OPERATOR_GUARD_MSG: &str = "Operators cannot run preview jobs";
 
+/// The fixture's deployed-script jobs of the operator: one running, one queued.
+const RUNNING_JOB_ID: &str = "2aa0c0de-0000-4000-8000-000000000001";
+const QUEUED_JOB_ID: &str = "2aa0c0de-0000-4000-8000-000000000002";
+
+async fn post(url: &str, token: &str, body: &serde_json::Value) -> (u16, String) {
+    let resp = authed(client().post(url), token)
+        .json(body)
+        .send()
+        .await
+        .expect("request");
+    let status = resp.status().as_u16();
+    let body = resp.text().await.expect("body");
+    (status, body)
+}
+
 #[sqlx::test(fixtures("base", "inline_preview_auth"))]
 async fn test_inline_preview_authorization(db: Pool<Postgres>) -> anyhow::Result<()> {
     initialize_tracing().await;
+    // The server decodes WM_TOKENs with the same in-process JWT secret, so
+    // setting it once lets us mint valid ones below.
+    set_jwt_secret().await;
 
     let server = ApiServer::start(db.clone()).await?;
     let port = server.addr.port();
@@ -51,12 +122,7 @@ async fn test_inline_preview_authorization(db: Pool<Postgres>) -> anyhow::Result
     // 1. CORE REGRESSION: an Operator must be rejected by the operator guard.
     //    Pre-fix this fell through to the inline executor (arbitrary code
     //    execution); post-fix it returns 401 with the operator guard message.
-    let resp = authed(client().post(&url), "OPERATOR_TOKEN")
-        .json(&inline_preview_body())
-        .send()
-        .await?;
-    let status = resp.status();
-    let body = resp.text().await?;
+    let (status, body) = post(&url, "OPERATOR_TOKEN", &inline_preview_body()).await;
     assert_eq!(
         status, 401,
         "Operator must be rejected from inline preview (got {status}): {body}"
@@ -71,12 +137,7 @@ async fn test_inline_preview_authorization(db: Pool<Postgres>) -> anyhow::Result
     //    the worker inline utils, so the request proceeds past the guard and
     //    fails later with the distinct "worker inline functions" error — proving
     //    the operator guard did not reject it.
-    let resp = authed(client().post(&url), "SECRET_TOKEN_2")
-        .json(&inline_preview_body())
-        .send()
-        .await?;
-    let status = resp.status();
-    let body = resp.text().await?;
+    let (status, body) = post(&url, "SECRET_TOKEN_2", &inline_preview_body()).await;
     assert_ne!(
         status, 401,
         "non-operator must not be blocked by the operator guard (got {status}): {body}"
@@ -86,5 +147,113 @@ async fn test_inline_preview_authorization(db: Pool<Postgres>) -> anyhow::Result
         "non-operator must not hit the operator guard, got: {body}"
     );
 
+    // 3. The WM_TOKEN of a deployed-script job the Operator is running passes the
+    //    guard for a datatable query: this is `wmill.datatable()` called from
+    //    inside that job. As in 2, the harness then fails with the "worker inline
+    //    functions" error.
+    let running_job_token =
+        operator_job_token(uuid::Uuid::parse_str(RUNNING_JOB_ID).unwrap()).await;
+    let (status, body) = post(&url, &running_job_token, &datatable_query_body()).await;
+    assert_ne!(
+        status, 401,
+        "operator job token of a running job must pass the guard for a datatable query (got {status}): {body}"
+    );
+    assert!(
+        !body.contains(OPERATOR_GUARD_MSG),
+        "operator job token of a running job must not hit the operator guard, got: {body}"
+    );
+
+    // 4. The same token is rejected for any other payload: the exemption covers
+    //    the datatable request shape only, never in-process DuckDB, and never a
+    //    `-- database` directive, which the executor honors over `args.database`.
+    let mut redirected = datatable_query_body();
+    redirected["content"] = json!("-- database u/test-user/other_db\nSELECT 1 AS x;");
+    let mut to_s3 = datatable_query_body();
+    to_s3["content"] = json!("-- s3\nSELECT 1 AS x;");
+    let mut resource_db = datatable_query_body();
+    resource_db["args"]["database"] = json!("$res:u/test-user/other_db");
+    // A marker is a single line the directive regexes cannot match; the directive only
+    // appears once the executor expands it, so the guard must check the expansion.
+    let mut marker = datatable_query_body();
+    marker["content"] = json!(concat!(
+        r#"-- WM_INTERNAL_DB_SELECT {"table":"t","columnDefs":[{"field":"id","datatype":"int4"}],"#,
+        r#""whereClause":"true\n-- database u/test-user/other_db\n AND true"}"#
+    ));
+    for (label, payload) in [
+        ("DuckDB", inline_preview_body()),
+        ("database directive", redirected),
+        ("s3 directive", to_s3),
+        ("resource database", resource_db),
+        ("marker-expanded database directive", marker),
+    ] {
+        let (status, body) = post(&url, &running_job_token, &payload).await;
+        assert_eq!(
+            status, 401,
+            "operator job token must be rejected for a {label} payload (got {status}): {body}"
+        );
+        assert!(
+            body.contains(OPERATOR_GUARD_MSG),
+            "rejection for a {label} payload must be the operator guard, got: {body}"
+        );
+    }
+
+    // 5. An Operator's job token whose job is not running is rejected like the
+    //    operator's own token, whether the job is over (no queue row) or merely
+    //    queued: a WM_TOKEN that leaked through logs cannot be replayed once the
+    //    job is over.
+    for (label, job_id) in [
+        ("finished", uuid::Uuid::new_v4()),
+        ("queued", uuid::Uuid::parse_str(QUEUED_JOB_ID).unwrap()),
+    ] {
+        let token = operator_job_token(job_id).await;
+        let (status, body) = post(&url, &token, &datatable_query_body()).await;
+        assert_eq!(
+            status, 401,
+            "operator job token of a {label} job must be rejected (got {status}): {body}"
+        );
+        assert!(
+            body.contains(OPERATOR_GUARD_MSG),
+            "rejection for a {label} job must be the operator guard, got: {body}"
+        );
+    }
+
+    // 6. The SDKs fall back to `/jobs/run/preview` when the worker has no internal
+    //    server (agent workers). The same exemption applies there: the running
+    //    job's token queues the datatable query (201 with the job id), the
+    //    operator's own token is still refused.
+    let fallback_url = format!("http://localhost:{port}/api/w/test-workspace/jobs/run/preview");
+    let (status, body) = post(&fallback_url, &running_job_token, &datatable_query_body()).await;
+    assert_eq!(
+        status, 201,
+        "operator job token of a running job must queue a datatable preview (got {status}): {body}"
+    );
+    let (status, body) = post(&fallback_url, "OPERATOR_TOKEN", &datatable_query_body()).await;
+    assert_eq!(
+        status, 401,
+        "Operator must be rejected from the preview fallback (got {status}): {body}"
+    );
+    assert!(
+        body.contains(OPERATOR_GUARD_MSG),
+        "rejection must be the operator guard, got: {body}"
+    );
+
+    // 7. A deferred run on the fallback would outlive the running job the
+    //    exemption keys off, so the running job's token cannot schedule one.
+    for deferral in [
+        "scheduled_in_secs=86400",
+        "scheduled_for=2099-01-01T00:00:00Z",
+    ] {
+        let deferred_url = format!("{fallback_url}?{deferral}");
+        let (status, body) = post(&deferred_url, &running_job_token, &datatable_query_body()).await;
+        assert_eq!(
+            status, 401,
+            "operator job token must not schedule a deferred preview with {deferral} (got {status}): {body}"
+        );
+        assert!(
+            body.contains(OPERATOR_GUARD_MSG),
+            "rejection for {deferral} must be the operator guard, got: {body}"
+        );
+    }
+
     Ok(())
 }
diff --git a/backend/windmill-api/src/jobs.rs b/backend/windmill-api/src/jobs.rs
index a30cffbfbf..53044ee020 100644
--- a/backend/windmill-api/src/jobs.rs
+++ b/backend/windmill-api/src/jobs.rs
@@ -18,6 +18,7 @@ use quick_cache::sync::Cache;
 use serde_json::value::RawValue;
 use serde_json::Value;
 use sha2::{Digest, Sha256};
+use std::borrow::Cow;
 use std::collections::HashMap;
 use std::str::FromStr;
 use std::sync::Arc;
@@ -108,6 +109,7 @@ use windmill_common::{
     flows::{add_virtual_items_if_necessary, resolve_maybe_value, FlowValue},
     jobs::{script_path_to_payload, CompletedJob, JobKind, JobPayload, QueuedJob, RawCode},
     oauth2::HmacSha256,
+    query_builders,
     scripts::{ScriptHash, ScriptLang},
     users::username_to_permissioned_as,
     utils::{not_found_if_none, now_from_db, paginate, require_admin, Pagination, StripPath},
@@ -8131,6 +8133,79 @@ pub async fn run_wait_result_flow_by_version(
     .await
 }
 
+/// Whether request-supplied SQL from an operator may run. Operators can only run deployed
+/// code, so a request their job token (`WM_TOKEN`) authenticates comes from code a
+/// non-operator authored. The job must still be running, and the request must have the
+/// shape `wmill.datatable()` sends (PostgreSQL against a `datatable://` database), so a
+/// WM_TOKEN that leaked into job logs cannot be replayed to reach another target while the
+/// job lives, in particular DuckDB, which runs in-process in the worker.
+///
+/// What it does permit is any statement against the workspace's data tables, writes and DDL
+/// included: the helper's body is an unrestricted SQL template and data tables carry no
+/// per-user ACL. Narrowing that is a separate decision from this exemption.
+///
+/// The database argument is only half the target: the executor honors a `-- database`
+/// directive in the SQL over it, and `-- s3` redirects the result set, so both are refused.
+/// Check them against the code the executor runs rather than the request's `content`, which
+/// is not the same string once a `WM_INTERNAL_DB` marker expands.
+async fn operator_may_run_datatable_query(
+    db: &DB,
+    w_id: &str,
+    job_id: Option<Uuid>,
+    language: Option<&ScriptLang>,
+    content: &str,
+    args: Option<&HashMap<String, Box<JsonRawValue>>>,
+) -> error::Result<bool> {
+    let Some(job_id) = job_id else {
+        return Ok(false);
+    };
+    if language != Some(&ScriptLang::Postgresql) {
+        return Ok(false);
+    }
+    // Parse the directives out of the code the executor actually runs: it expands a
+    // `WM_INTERNAL_DB` marker first, and a directive can be embedded in the expansion.
+    // An expansion that overrides the language would run something other than the SQL the
+    // language check above cleared, so it is refused along with a malformed marker.
+    let executed =
+        match query_builders::try_expand_internal_db_query(content, &ScriptLang::Postgresql) {
+            Some(Ok(expanded)) if expanded.language_override.is_none() => Cow::Owned(expanded.code),
+            Some(_) => return Ok(false),
+            None => Cow::Borrowed(content),
+        };
+    if windmill_parser_sql::parse_db_resource(&executed).is_some()
+        || !matches!(windmill_parser_sql::parse_s3_mode(&executed), Ok(None))
+    {
+        return Ok(false);
+    }
+    let targets_datatable = args
+        .and_then(|args| args.get("database"))
+        .and_then(|database| serde_json::from_str::<String>(database.get()).ok())
+        .is_some_and(|database| database.starts_with("datatable://"));
+    if !targets_datatable {
+        return Ok(false);
+    }
+    Ok(sqlx::query_scalar!(
+        "SELECT running AS \"running!\" FROM v2_job_queue WHERE id = $1 AND workspace_id = $2",
+        job_id,
+        w_id
+    )
+    .fetch_optional(db)
+    .await?
+    .unwrap_or(false))
+}
+
+/// The refusal an operator gets from a preview route. Inside a job the caller never ran a
+/// preview themselves, so name the one thing the job's token may do.
+fn operator_preview_refusal(job_id: Option<Uuid>) -> error::Error {
+    let reason = if job_id.is_some() {
+        "Operators cannot run preview jobs for security reasons: from inside a job, an \
+         operator may only run a wmill.datatable() query while that job is running"
+    } else {
+        "Operators cannot run preview jobs for security reasons"
+    };
+    error::Error::NotAuthorized(reason.to_string())
+}
+
 async fn run_preview_script(
     authed: ApiAuthed,
     Extension(db): Extension<DB>,
@@ -8142,9 +8217,20 @@ async fn run_preview_script(
     #[cfg(feature = "enterprise")]
     check_license_key_valid().await?;
     if authed.is_operator {
-        return Err(error::Error::NotAuthorized(
-            "Operators cannot run preview jobs for security reasons".to_string(),
-        ));
+        // A deferred run would outlive the running job the exemption keys off.
+        if run_query.get_scheduled_for(&db).await?.is_some()
+            || !operator_may_run_datatable_query(
+                &db,
+                &w_id,
+                authed.job_id,
+                preview.language.as_ref(),
+                preview.content.as_deref().unwrap_or_default(),
+                preview.args.as_ref(),
+            )
+            .await?
+        {
+            return Err(operator_preview_refusal(authed.job_id));
+        }
     }
     // Preview runs arbitrary, request-supplied code. require_path_read_access_for_preview
     // only checks folder/namespace *read* access (and is a no-op when path is null), so a
@@ -8239,13 +8325,21 @@ async fn run_inline_preview_script(
     Path(w_id): Path<String>,
     Json(preview): Json<PreviewInline>,
 ) -> error::Result<Response> {
-    // Same arbitrary-code class as run_preview_script: operators are blocked from
-    // running request-supplied code, and a narrowly-scoped token must not escape
-    // its scope through inline preview.
-    if authed.is_operator {
-        return Err(error::Error::NotAuthorized(
-            "Operators cannot run preview jobs for security reasons".to_string(),
-        ));
+    // Same arbitrary-code class as run_preview_script, and every worker and standalone
+    // server exposes this route, so an operator is refused on the same terms. A
+    // narrowly-scoped token must not escape its scope through inline preview either.
+    if authed.is_operator
+        && !operator_may_run_datatable_query(
+            &db,
+            &w_id,
+            job_id,
+            Some(&preview.language),
+            &preview.content,
+            preview.args.as_ref(),
+        )
+        .await?
+    {
+        return Err(operator_preview_refusal(job_id));
     }
     check_scopes(&authed, || format!("jobs:run"))?;
     if let Some(job_id) = job_id {

From 0f5a1db2abba8df30a2f975f4498e269f13cf93d Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Thu, 3 Sep 2026 08:45:39 +0200
Subject: [PATCH 15/31] fix(cli): make a sync push into a fork converge on
 schedules and inline names (#10951)

* fix(cli): make a sync push into a fork converge on schedules and inline names

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JcofduXAs9FT948Aj78V8m

* fix(cli): gate the fork schedule lookup, tolerate fork-conflict, keep rendered names unique

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JcofduXAs9FT948Aj78V8m

* test(cli): use the OS path separator in the push convergence fixtures

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JcofduXAs9FT948Aj78V8m

* fix(cli): report a set-aside fork schedule flag and keep checkout inline names inside the flow folder

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JcofduXAs9FT948Aj78V8m

* fix(cli): enable a fork-only schedule on create, and treat a fork with no parent as owning its schedules

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JcofduXAs9FT948Aj78V8m

---------

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
---
 cli/src/commands/schedule/schedule.ts       |  77 ++++-
 cli/src/commands/sync/sync.ts               | 236 ++++++++++++----
 cli/src/core/log.ts                         |   6 +
 cli/src/types.ts                            |   5 +-
 cli/test/push_diff_convergence_unit.test.ts | 298 ++++++++++++++++++++
 5 files changed, 556 insertions(+), 66 deletions(-)
 create mode 100644 cli/test/push_diff_convergence_unit.test.ts

diff --git a/cli/src/commands/schedule/schedule.ts b/cli/src/commands/schedule/schedule.ts
index edbedc2612..2eb6ba42b8 100644
--- a/cli/src/commands/schedule/schedule.ts
+++ b/cli/src/commands/schedule/schedule.ts
@@ -106,7 +106,8 @@ export async function pushSchedule(
   path: string,
   schedule: Schedule | ScheduleFile | undefined,
   localSchedule: ScheduleFile,
-  permissionedAsContext?: PermissionedAsContext
+  permissionedAsContext?: PermissionedAsContext,
+  enabledOwnedByParent?: boolean
 ): Promise<void> {
   path = removeType(path, "schedule").replaceAll(SEP, "/");
   log.debug(`Processing local schedule ${path}`);
@@ -123,6 +124,21 @@ export async function pushSchedule(
   // Strip CLI-only boolean marker before sending to API
   delete (localSchedule as any).has_permissioned_as;
 
+  // In a fork, the file's `enabled` is the parent's for a path the parent
+  // also has (see sync push's `parentOwnedScheduleEnabled`): the fork's own
+  // flag stays as it is.
+  if (enabledOwnedByParent && schedule) {
+    if (
+      localSchedule.enabled !== undefined &&
+      localSchedule.enabled !== schedule.enabled
+    ) {
+      log.warnAlways(
+        `Schedule ${path} stays ${schedule.enabled ? "enabled" : "disabled"}: the file says ${localSchedule.enabled ? "enabled" : "disabled"}, but in a fork that flag is the parent workspace's`
+      );
+    }
+    delete localSchedule.enabled;
+  }
+
   const preserveFields: { permissioned_as?: string; preserve_permissioned_as?: boolean } = {};
   if (permissionedAsContext?.userIsAdminOrDeployer) {
     if (schedule) {
@@ -153,13 +169,9 @@ export async function pushSchedule(
           ...preserveFields,
         },
       });
-      // Tarball export from a fork strips `enabled` from schedule YAMLs so
-      // the fork→parent git-sync round-trip can't flip the parent's state.
-      // Skip the secondary setScheduleEnabled call when the local YAML
-      // doesn't carry `enabled` — sending `{ enabled: undefined }` would
-      // serialize to `{}` and the backend (`SetEnabled.enabled` is required)
-      // would reject the request. Preserving the target's existing flag is
-      // exactly the round-trip-safe behavior.
+      // No `enabled` in the file (absent from the YAML, or set aside above)
+      // leaves the remote flag alone: `SetEnabled.enabled` is required, so
+      // `{ enabled: undefined }` would be rejected rather than ignored.
       if (
         localSchedule.enabled !== undefined &&
         localSchedule.enabled !== schedule.enabled
@@ -167,13 +179,12 @@ export async function pushSchedule(
         log.info(colors.bold.yellow(
           `Schedule ${path} is ${localSchedule.enabled ? "enabled" : "disabled"} locally but not on remote, updating remote`
         ));
-        await wmill.setScheduleEnabled({
-          workspace: workspace,
+        await setEnabledUnlessParentOwned(
+          workspace,
           path,
-          requestBody: {
-            enabled: localSchedule.enabled,
-          },
-        });
+          localSchedule.enabled,
+          schedule.enabled
+        );
       }
     } catch (e) {
       console.error((e as any).body);
@@ -194,6 +205,44 @@ export async function pushSchedule(
       console.error((e as any).body);
       throw e;
     }
+    // A create in a fork lands disabled whatever the request says. A fork-only
+    // path the file wants enabled is enabled here, so one push converges; a
+    // parent-owned one stays disabled.
+    if (enabledOwnedByParent !== undefined && localSchedule.enabled === true) {
+      if (enabledOwnedByParent) {
+        log.warnAlways(
+          `Schedule ${path} created disabled: the file says enabled, but in a fork that flag is the parent workspace's`
+        );
+      } else {
+        await setEnabledUnlessParentOwned(workspace, path, true, false);
+      }
+    }
+  }
+}
+
+// The parent listing behind `enabledOwnedByParent` sees only what the pusher
+// may read; the backend's `fork-conflict` refusal is the last word, so a path
+// it says the parent has keeps the fork's flag rather than failing the push.
+async function setEnabledUnlessParentOwned(
+  workspace: string,
+  path: string,
+  enabled: boolean,
+  remoteEnabled: boolean
+): Promise<void> {
+  try {
+    await wmill.setScheduleEnabled({
+      workspace,
+      path,
+      requestBody: { enabled },
+    });
+  } catch (e) {
+    const conflict = parseForkConflict(e);
+    if (!conflict) {
+      throw e;
+    }
+    log.warnAlways(
+      `Schedule ${path} left ${remoteEnabled ? "enabled" : "disabled"}: the parent workspace '${conflict.parentWorkspaceId}' has the same schedule, so its flag is the parent's to set`
+    );
   }
 }
 
diff --git a/cli/src/commands/sync/sync.ts b/cli/src/commands/sync/sync.ts
index 6aaa72da0d..bab9967b3c 100644
--- a/cli/src/commands/sync/sync.ts
+++ b/cli/src/commands/sync/sync.ts
@@ -25,7 +25,7 @@ import {
 } from "yaml";
 import JSZip from "jszip";
 import { minimatch } from "minimatch";
-import { yamlParseContent } from "../../utils/yaml.ts";
+import { yamlParseContent, yamlParseFile } from "../../utils/yaml.ts";
 import * as wmill from "../../../gen/services.gen.ts";
 
 import {
@@ -1138,7 +1138,7 @@ export function rawAppPathWithinFolder(
   return resolved;
 }
 
-function ZipFSElement(
+export function ZipFSElement(
   zip: JSZip,
   useYaml: boolean,
   defaultTs: "bun" | "deno",
@@ -1146,6 +1146,14 @@ function ZipFSElement(
   resourceTypeToIsFileset: Record<string, boolean>,
   ignoreCodebaseChanges: boolean,
   stripOnBehalfOf: boolean,
+  // Names a flow's rendered inline-script files after the checkout's own
+  // `!inline` references (module id -> file). The export carries script
+  // source, never a reference, so without a checkout to defer to every file
+  // is named from the step summary, and a file the checkout names otherwise
+  // reads as a delete + add on every push while the resolved flows are equal.
+  localFlowInlineMapping?: (
+    flowDir: string,
+  ) => Promise<Record<string, string>>,
 ): DynFSElement {
   // Pre-scan: find zip base paths of scripts that have modules.
   // These scripts use the folder layout: {basePath}__mod/script.{ext}
@@ -1249,59 +1257,71 @@ function ZipFSElement(
               log.error(`Failed to parse flow.yaml at path: ${p}`);
               throw error;
             }
-            let inlineScripts;
+            let inlineScripts: InlineScript[];
             try {
-              const assigner = newPathAssigner(defaultTs, {
-                skipInlineScriptSuffix: getNonDottedPaths(),
-              });
-              // Preserve original !inline filenames from the flow to avoid phantom renames
-              const inlineMapping = extractCurrentMapping(
-                flow.value.modules as any,
-                {},
-                flow.value.failure_module,
-                flow.value.preprocessor_module,
-              );
-              inlineScripts = extractInlineScriptsForFlows(
-                flow.value.modules as any,
-                inlineMapping,
-                SEP,
-                defaultTs,
-                assigner,
-                {
+              // Extraction rewrites the modules' content into `!inline` refs,
+              // so each attempt works on its own copy of the flow.
+              const render = (
+                source: OpenFlow,
+                inlineMapping: Record<string, string>,
+              ): [OpenFlow, InlineScript[]] => {
+                const f: OpenFlow = structuredClone(source);
+                const assigner = newPathAssigner(defaultTs, {
+                  skipInlineScriptSuffix: getNonDottedPaths(),
+                });
+                const options = {
                   skipInlineScriptSuffix: getNonDottedPaths(),
                   failOnInlineDirective: true,
-                },
-              );
-              if (flow.value.failure_module) {
-                inlineScripts.push(
-                  ...extractInlineScriptsForFlows(
-                    [flow.value.failure_module],
-                    inlineMapping,
-                    SEP,
-                    defaultTs,
-                    assigner,
-                    {
-                      skipInlineScriptSuffix: getNonDottedPaths(),
-                      failOnInlineDirective: true,
-                    },
-                  ),
-                );
-              }
-              if (flow.value.preprocessor_module) {
-                inlineScripts.push(
-                  ...extractInlineScriptsForFlows(
-                    [flow.value.preprocessor_module],
-                    inlineMapping,
-                    SEP,
-                    defaultTs,
-                    assigner,
-                    {
-                      skipInlineScriptSuffix: getNonDottedPaths(),
-                      failOnInlineDirective: true,
-                    },
-                  ),
+                };
+                const scripts = extractInlineScriptsForFlows(
+                  f.value.modules as any,
+                  inlineMapping,
+                  SEP,
+                  defaultTs,
+                  assigner,
+                  options,
                 );
+                if (f.value.failure_module) {
+                  scripts.push(
+                    ...extractInlineScriptsForFlows(
+                      [f.value.failure_module],
+                      inlineMapping,
+                      SEP,
+                      defaultTs,
+                      assigner,
+                      options,
+                    ),
+                  );
+                }
+                if (f.value.preprocessor_module) {
+                  scripts.push(
+                    ...extractInlineScriptsForFlows(
+                      [f.value.preprocessor_module],
+                      inlineMapping,
+                      SEP,
+                      defaultTs,
+                      assigner,
+                      options,
+                    ),
+                  );
+                }
+                return [f, scripts];
+              };
+              const inlineMapping = localFlowInlineMapping
+                ? await localFlowInlineMapping(finalPath)
+                : {};
+              let rendered = render(flow, inlineMapping);
+              // The assigner keeps the names it hands out unique, not the
+              // checkout's: one of those equal to another step's
+              // summary-derived name would leave two files at one path, so
+              // such a flow renders the export's way.
+              if (
+                new Set(rendered[1].map((s) => s.path)).size !==
+                rendered[1].length
+              ) {
+                rendered = render(flow, {});
               }
+              [flow, inlineScripts] = rendered;
             } catch (error) {
               log.error(
                 `Failed to extract inline scripts for flow at path: ${p}`,
@@ -2581,7 +2601,7 @@ export function preservePendingScriptLocks(
   }
 }
 
-async function compareDynFSElement(
+export async function compareDynFSElement(
   els1: DynFSElement,
   els2: DynFSElement | undefined,
   ignore: (path: string, isDirectory: boolean) => boolean,
@@ -2594,6 +2614,9 @@ async function compareDynFSElement(
   branchOverride?: string,
   isEls1Remote?: boolean,
   caseInsensitiveFs?: boolean,
+  // Which schedule files carry an `enabled` that is not the target's to set
+  // (see push's `parentOwnedScheduleEnabled`): those compare without it.
+  parentOwnsScheduleEnabled?: (scheduleFilePath: string) => boolean,
 ): Promise<{ changes: Change[]; localMap: Record<string, string> }> {
   let [m1, m2] = els2
     ? await Promise.all([
@@ -2785,12 +2808,28 @@ async function compareDynFSElement(
           );
           throw error;
         }
+        if (
+          parentOwnsScheduleEnabled &&
+          getTypeStrFromPath(k) === "schedule" &&
+          parentOwnsScheduleEnabled(k)
+        ) {
+          delete parsedV?.enabled;
+          delete parsedM2?.enabled;
+        }
         if (deepEqual(parsedV, parsedM2)) {
           continue;
         }
       } else if (k.endsWith(".yaml")) {
         const before = parseYaml(k, m2[k]);
         const after = parseYaml(k, v);
+        if (
+          parentOwnsScheduleEnabled &&
+          getTypeStrFromPath(k) === "schedule" &&
+          parentOwnsScheduleEnabled(k)
+        ) {
+          delete before?.enabled;
+          delete after?.enabled;
+        }
         if (deepEqual(before, after)) {
           continue;
         }
@@ -4543,6 +4582,86 @@ async function checkServerLockJobs(
   }
 }
 
+// The checkout's `!inline` references of one flow (module id -> file), as
+// `ZipFSElement`'s `localFlowInlineMapping` names the remote render. Empty
+// when the flow has no local flow.yaml.
+export async function checkoutInlineNames(
+  flowYamlPath: string,
+): Promise<Record<string, string>> {
+  let flow: any;
+  try {
+    flow = await yamlParseFile(flowYamlPath);
+  } catch {
+    return {};
+  }
+  const mapping = extractCurrentMapping(
+    flow?.value?.modules,
+    {},
+    flow?.value?.failure_module,
+    flow?.value?.preprocessor_module,
+  );
+  // A reference that leaves the flow folder would render the remote step
+  // onto another item's path; such a step keeps its summary-derived name.
+  for (const [id, ref] of Object.entries(mapping)) {
+    if (path.isAbsolute(ref) || ref.split(/[\\/]/).includes("..")) {
+      delete mapping[id];
+    }
+  }
+  return mapping;
+}
+
+// For a path the parent also has, a fork's export writes the parent's
+// `enabled` and the backend refuses to enable the fork's copy: the file's flag
+// is the parent's. A parent that cannot be listed (a fork-scoped job token)
+// may own every path. Undefined when the target is not a fork.
+async function parentOwnedScheduleEnabled(
+  workspaceId: string,
+): Promise<((scheduleFilePath: string) => boolean) | undefined> {
+  let parentWorkspaceId: string | null | undefined;
+  let known = false;
+  try {
+    const { workspaces } = await wmill.listUserWorkspaces();
+    const entry = workspaces?.find((w) => w.id === workspaceId);
+    known = entry !== undefined;
+    parentWorkspaceId = entry?.parent_workspace_id;
+  } catch {
+    // A fork-scoped token cannot list workspaces.
+  }
+  // No parent on record (a fork whose parent was deleted keeps its
+  // `wm-fork-` id): nothing defers to a parent any more.
+  if (known && !parentWorkspaceId) {
+    return undefined;
+  }
+  // Without the listing only the `wm-fork-` prefix says fork: a dev
+  // workspace (custom id) reached with a fork-scoped token counts as none.
+  if (!isForkWorkspace(workspaceId, parentWorkspaceId)) {
+    return undefined;
+  }
+  let parentPaths: Set<string> | undefined;
+  if (parentWorkspaceId) {
+    try {
+      parentPaths = new Set();
+      const perPage = 100;
+      for (let page = 1; ; page++) {
+        const batch = await wmill.listSchedules({
+          workspace: parentWorkspaceId,
+          page,
+          perPage,
+        });
+        batch.forEach((s) => parentPaths!.add(s.path));
+        if (batch.length < perPage) break;
+      }
+    } catch {
+      parentPaths = undefined;
+    }
+  }
+  return (scheduleFilePath) =>
+    parentPaths === undefined ||
+    parentPaths.has(
+      removeType(scheduleFilePath, "schedule").replaceAll(SEP, "/"),
+    );
+}
+
 export async function push(
   opts: GlobalOptions &
     SyncOptions & {
@@ -4633,6 +4752,9 @@ export async function push(
 
   // Merge CLI flags with resolved settings (CLI flags take precedence only for explicit overrides)
   opts = mergeCliWithEffectiveOptions(originalCliOpts, effectiveOpts);
+  const parentOwnsScheduleEnabled = opts.includeSchedules
+    ? await parentOwnedScheduleEnabled(workspace.workspaceId)
+    : undefined;
 
   if (opts.lint) {
     log.info("Running lint validation before push...");
@@ -4696,6 +4818,10 @@ export async function push(
     // ignore
   }
 
+  // See ZipFSElement's `localFlowInlineMapping`.
+  const localFlowInlineMapping = (flowDir: string) =>
+    checkoutInlineNames(path.join(process.cwd(), flowDir, "flow.yaml"));
+
   const remote = ZipFSElement(
     (await downloadZip(
       workspace,
@@ -4721,6 +4847,7 @@ export async function push(
     resourceTypeToIsFileset,
     false,
     parseSyncBehavior(opts.syncBehavior) >= 1,
+    localFlowInlineMapping,
   );
 
   const local = await FSFSElement(
@@ -4741,6 +4868,7 @@ export async function push(
     wsNameForFiles,
     false, // els1 (local) is not the remote source
     await isCaseInsensitiveFilesystem(process.cwd()),
+    parentOwnsScheduleEnabled,
   );
 
   // Detect resources/variables that the local config flags as ws_specific
@@ -5807,6 +5935,9 @@ export async function push(
                   originalLocalPath: originalWorkspaceSpecificPath,
                   permissionedAsContext,
                   wsSpecific: isWsSpecific ? true : undefined,
+                  enabledOwnedByParent: parentOwnsScheduleEnabled?.(
+                    change.path,
+                  ),
                   keyPushOpts: {
                     noninteractive:
                       (opts.yes ?? false) || !process.stdin.isTTY,
@@ -5942,6 +6073,9 @@ export async function push(
                   originalLocalPath: localFilePath,
                   permissionedAsContext,
                   wsSpecific: isAddedWsSpecific ? true : undefined,
+                  enabledOwnedByParent: parentOwnsScheduleEnabled?.(
+                    change.path,
+                  ),
                   keyPushOpts: {
                     noninteractive:
                       (opts.yes ?? false) || !process.stdin.isTTY,
diff --git a/cli/src/core/log.ts b/cli/src/core/log.ts
index e78450597f..c4cf256e9d 100644
--- a/cli/src/core/log.ts
+++ b/cli/src/core/log.ts
@@ -41,6 +41,12 @@ export function warnStderr(msg: unknown) {
   console.error(`\x1b[33m${String(msg)}\x1b[39m`);
 }
 
+// A notice that must reach a log even in silent (`--json-output`) mode:
+// stderr keeps stdout parseable, and a job that runs the CLI records both.
+export function warnAlways(msg: unknown) {
+  console.error(`\x1b[33m${String(msg)}\x1b[39m`);
+}
+
 export function error(msg: unknown) {
   console.error(`\x1b[31m${String(msg)}\x1b[39m`);
 }
diff --git a/cli/src/types.ts b/cli/src/types.ts
index c9244a8f4c..9c517ff3c7 100644
--- a/cli/src/types.ts
+++ b/cli/src/types.ts
@@ -189,6 +189,8 @@ export interface PushObjOptions {
   keyPushOpts?: PushWorkspaceKeyOptions;
   /** TypeScript runtime a bare `.ts` denotes, for raw-app runnables */
   defaultTs?: "bun" | "deno";
+  /** schedule push into a fork: the file's `enabled` is the parent's */
+  enabledOwnedByParent?: boolean;
 }
 
 /**
@@ -217,6 +219,7 @@ export async function pushObj(
     wsSpecific,
     keyPushOpts,
     defaultTs,
+    enabledOwnedByParent,
   } = opts;
   const typeEnding = getTypeStrFromPath(p);
 
@@ -250,7 +253,7 @@ export async function pushObj(
   } else if (typeEnding === "resource-type") {
     await pushResourceType(workspace, p, befObj, newObj);
   } else if (typeEnding === "schedule") {
-    await pushSchedule(workspace, p, befObj, newObj, permissionedAsContext);
+    await pushSchedule(workspace, p, befObj, newObj, permissionedAsContext, enabledOwnedByParent);
   } else if (typeEnding === "http_trigger") {
     await pushTrigger("http", workspace, p, befObj, newObj, permissionedAsContext);
   } else if (typeEnding === "websocket_trigger") {
diff --git a/cli/test/push_diff_convergence_unit.test.ts b/cli/test/push_diff_convergence_unit.test.ts
new file mode 100644
index 0000000000..14e248c03e
--- /dev/null
+++ b/cli/test/push_diff_convergence_unit.test.ts
@@ -0,0 +1,298 @@
+import { afterAll, beforeAll, expect, test } from "bun:test";
+import JSZip from "jszip";
+import { mkdtempSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, sep } from "node:path";
+import {
+  checkoutInlineNames,
+  compareDynFSElement,
+  ZipFSElement,
+} from "../src/commands/sync/sync.ts";
+
+// The differ also reads the working tree (shared lockfiles, dependency files);
+// an empty one keeps that out of the picture.
+const originalCwd = process.cwd();
+beforeAll(() => {
+  process.chdir(mkdtempSync(join(tmpdir(), "wmill-push-diff-")));
+});
+afterAll(() => {
+  process.chdir(originalCwd);
+});
+
+// A push is only useful when a second run of it finds nothing left to do.
+// These pin the two shapes that used to be listed on every run of a push into
+// a fork while the push itself either applied nothing or aborted.
+
+type Mock = {
+  isDirectory: boolean;
+  path: string;
+  getContentText(): Promise<string>;
+  getChildren(): AsyncIterable<Mock>;
+};
+
+// Both sides of the differ use the OS separator; fixtures are written with
+// "/" and rows are read back the same way.
+const osPath = (p: string) => p.split("/").join(sep);
+const slashPath = (p: string) => p.split(sep).join("/");
+
+function local(files: Record<string, string>): Mock {
+  return {
+    isDirectory: true,
+    path: "",
+    async getContentText() {
+      return "";
+    },
+    async *getChildren() {
+      for (const [path, content] of Object.entries(files)) {
+        yield {
+          isDirectory: false,
+          path: osPath(path),
+          async getContentText() {
+            return content;
+          },
+          async *getChildren() {},
+        };
+      }
+    },
+  };
+}
+
+const noIgnore = () => false;
+
+async function diff(
+  localEl: Mock,
+  remoteEl: Mock,
+  skips: Record<string, unknown>,
+  parentOwnsScheduleEnabled?: (scheduleFilePath: string) => boolean,
+) {
+  const { changes } = await compareDynFSElement(
+    localEl as any,
+    remoteEl as any,
+    noIgnore,
+    false,
+    skips as any,
+    true,
+    [],
+    false,
+    undefined,
+    undefined,
+    false,
+    false,
+    parentOwnsScheduleEnabled,
+  );
+  return changes.map((c) => `${c.name} ${slashPath(c.path)}`);
+}
+
+const SCHEDULE = (enabled: string) =>
+  `summary: nightly\nargs: {}\nenabled: ${enabled}\nis_flow: true\nschedule: 0 0 0 * * *\nscript_path: f/mail/flow\ntimezone: UTC\n`;
+
+test("push into a fork: a schedule the parent also has compares without `enabled`", async () => {
+  const remote = local({ "f/mail/nightly.schedule.yaml": SCHEDULE("true") });
+  const skips = { includeSchedules: true };
+  // The parent has `f/mail/nightly`; any other schedule is the fork's own.
+  const parentHas = (filePath: string) =>
+    slashPath(filePath) === "f/mail/nightly.schedule.yaml";
+
+  // Not a fork: `enabled` is compared like any other field.
+  expect(
+    await diff(
+      local({ "f/mail/nightly.schedule.yaml": SCHEDULE("false") }),
+      remote,
+      skips,
+    ),
+  ).toEqual(["edited f/mail/nightly.schedule.yaml"]);
+  expect(
+    await diff(
+      local({ "f/mail/nightly.schedule.yaml": SCHEDULE("false") }),
+      remote,
+      skips,
+      parentHas,
+    ),
+  ).toEqual([]);
+  // The key being absent is the same case as it differing.
+  expect(
+    await diff(
+      local({
+        "f/mail/nightly.schedule.yaml": SCHEDULE("false").replace(
+          "enabled: false\n",
+          "",
+        ),
+      }),
+      remote,
+      skips,
+      parentHas,
+    ),
+  ).toEqual([]);
+  // Only `enabled` is set aside.
+  expect(
+    await diff(
+      local({
+        "f/mail/nightly.schedule.yaml": SCHEDULE("false").replace(
+          "0 0 0 * * *",
+          "0 0 1 * * *",
+        ),
+      }),
+      remote,
+      skips,
+      parentHas,
+    ),
+  ).toEqual(["edited f/mail/nightly.schedule.yaml"]);
+  // A schedule only the fork has keeps toggling from the file.
+  expect(
+    await diff(
+      local({ "f/mail/fork_only.schedule.yaml": SCHEDULE("true") }),
+      local({ "f/mail/fork_only.schedule.yaml": SCHEDULE("false") }),
+      skips,
+      parentHas,
+    ),
+  ).toEqual(["edited f/mail/fork_only.schedule.yaml"]);
+});
+
+const SUMMARY = "process one mail end-to-end (spam check, classify)";
+
+function remoteFlow(content: string) {
+  const zip = new JSZip();
+  zip.file(
+    "f/mail/flow_v2.flow.json",
+    JSON.stringify({
+      summary: "Flow V2",
+      description: "",
+      value: {
+        modules: [
+          {
+            id: "a",
+            summary: SUMMARY,
+            value: {
+              type: "rawscript",
+              content,
+              input_transforms: {},
+              language: "python3",
+            },
+          },
+        ],
+      },
+      schema: { type: "object", properties: {} },
+    }),
+    // The backend's archive carries no directory entries.
+    { createFolders: false },
+  );
+  return zip;
+}
+
+function localFlow(content: string) {
+  return local({
+    "f/mail/flow_v2.flow/flow.yaml": `summary: Flow V2\ndescription: ''\nvalue:\n  modules:\n    - id: a\n      summary: ${SUMMARY}\n      value:\n        type: rawscript\n        content: '!inline process_mail.inline_script.py'\n        input_transforms: {}\n        language: python3\nschema:\n  type: object\n  properties: {}\n`,
+    "f/mail/flow_v2.flow/process_mail.inline_script.py": content,
+  });
+}
+
+// The checkout's `!inline` references, as `push` reads them from its flow.yaml.
+const checkoutNames = async (flowDir: string) =>
+  slashPath(flowDir) === "f/mail/flow_v2.flow"
+    ? { a: "process_mail.inline_script.py" }
+    : {};
+
+test("push: an inline script the checkout names differently from the step summary is not a rename", async () => {
+  const skips = { includeSchedules: false };
+  const render = (content: string, withCheckout: boolean) =>
+    ZipFSElement(
+      remoteFlow(content),
+      true,
+      "bun",
+      {},
+      {},
+      false,
+      true,
+      withCheckout ? checkoutNames : undefined,
+    ) as any;
+
+  // Same content, file named by hand: three rows before, none after.
+  expect(
+    await diff(
+      localFlow("def main():\n    return 1\n"),
+      render("def main():\n    return 1\n", false),
+      skips,
+    ),
+  ).toEqual([
+    "deleted f/mail/flow_v2.flow/process_one_mail_end-to-end_(spam_check,_classify).inline_script.py",
+    "edited f/mail/flow_v2.flow/flow.yaml",
+    "added f/mail/flow_v2.flow/process_mail.inline_script.py",
+  ]);
+  expect(
+    await diff(
+      localFlow("def main():\n    return 1\n"),
+      render("def main():\n    return 1\n", true),
+      skips,
+    ),
+  ).toEqual([]);
+
+  // A real edit is still one.
+  expect(
+    await diff(
+      localFlow("def main():\n    return 2\n"),
+      render("def main():\n    return 1\n", true),
+      skips,
+    ),
+  ).toEqual(["edited f/mail/flow_v2.flow/process_mail.inline_script.py"]);
+});
+
+test("push: a checkout name that collides with another step's summary-derived name keeps two files", async () => {
+  const zip = new JSZip();
+  zip.file(
+    "f/mail/flow_v2.flow.json",
+    JSON.stringify({
+      summary: "Flow V2",
+      description: "",
+      value: {
+        modules: [
+          {
+            id: "a",
+            summary: SUMMARY,
+            value: {
+              type: "rawscript",
+              content: "a",
+              input_transforms: {},
+              language: "python3",
+            },
+          },
+          {
+            id: "b",
+            summary: "process_mail",
+            value: {
+              type: "rawscript",
+              content: "b",
+              input_transforms: {},
+              language: "python3",
+            },
+          },
+        ],
+      },
+      schema: { type: "object", properties: {} },
+    }),
+    { createFolders: false },
+  );
+  // Nothing local: every rendered file is a "deleted" row, one per path.
+  const rows = await diff(
+    local({}),
+    ZipFSElement(zip, true, "bun", {}, {}, false, true, checkoutNames) as any,
+    { includeSchedules: false },
+  );
+  expect(rows.filter((r) => r.endsWith(".py")).sort()).toEqual([
+    "deleted f/mail/flow_v2.flow/process_mail.inline_script.py",
+    "deleted f/mail/flow_v2.flow/process_one_mail_end-to-end_(spam_check,_classify).inline_script.py",
+  ]);
+});
+
+test("push: checkout inline names stay inside the flow folder", async () => {
+  const flowYaml = join(process.cwd(), "flow.yaml");
+  writeFileSync(
+    flowYaml,
+    `summary: x\nvalue:\n  modules:\n    - id: a\n      value:\n        type: rawscript\n        content: '!inline a.inline_script.py'\n        language: python3\n    - id: b\n      value:\n        type: rawscript\n        content: '!inline ../shared/b.py'\n        language: python3\n    - id: c\n      value:\n        type: rawscript\n        content: '!inline /tmp/c.py'\n        language: python3\n`,
+  );
+  expect(await checkoutInlineNames(flowYaml)).toEqual({
+    a: "a.inline_script.py",
+  });
+  expect(
+    await checkoutInlineNames(join(process.cwd(), "missing.yaml")),
+  ).toEqual({});
+});

From 3d089b57344f5814086e6176301c5031dc519674 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Thu, 3 Sep 2026 09:17:16 +0200
Subject: [PATCH 16/31] fix: fade the home Build with AI placeholder every 10s
 instead of typing it (#10953)

* fix: fade the home Build with AI placeholder every 10s instead of typing it

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019FYwgUVWBC2qfk5jv8ZYcn

* fix: restore placeholder visibility when the home composer hides mid-fade

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019FYwgUVWBC2qfk5jv8ZYcn

* fix: smoother and slightly more frequent home placeholder fade

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019FYwgUVWBC2qfk5jv8ZYcn

* fix: keep the home placeholder static under prefers-reduced-motion

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019FYwgUVWBC2qfk5jv8ZYcn

* fix: draw the home example prompt over the textarea so the fade runs in every browser

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019FYwgUVWBC2qfk5jv8ZYcn

---------

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
---
 .../src/lib/components/home/HomeAIChat.svelte | 85 +++++++++++--------
 1 file changed, 48 insertions(+), 37 deletions(-)

diff --git a/frontend/src/lib/components/home/HomeAIChat.svelte b/frontend/src/lib/components/home/HomeAIChat.svelte
index 2d57f669b7..f7154c607f 100644
--- a/frontend/src/lib/components/home/HomeAIChat.svelte
+++ b/frontend/src/lib/components/home/HomeAIChat.svelte
@@ -1,6 +1,6 @@
 <script lang="ts" module>
 	/** Example prompts: the short `label` is shown as a clickable tag under the chat,
-	 * the `prompt` is what gets typed out as the placeholder / dropped into the input. */
+	 * the `prompt` is what rotates through the placeholder / gets dropped into the input. */
 	export const homeAIExamples: { label: string; prompt: string }[] = [
 		{
 			label: 'Sync Salesforce',
@@ -40,6 +40,7 @@
 	import { base } from '$lib/base'
 	import { getLocalSetting, storeLocalSetting } from '$lib/utils'
 	import { isRuleActive } from '$lib/workspaceProtectionRules.svelte'
+	import { useReducedMotion } from '$lib/svelte5Utils.svelte'
 	import { BROWSER } from 'esm-env'
 	import AIChatModelSettings from '../copilot/chat/AIChatModelSettings.svelte'
 	import HomeConnectDrawer from './HomeConnectDrawer.svelte'
@@ -49,7 +50,8 @@
 	const COLLAPSED_SETTING = 'home-ai-composer-collapsed'
 
 	let value = $state('')
-	let placeholder = $state('')
+	let placeholder = $state(homeAIExamples[0].prompt)
+	let placeholderVisible = $state(true)
 	let homeConnectDrawer: HomeConnectDrawer | undefined = $state(undefined)
 
 	// How much of the home page this reader wants the composer to take, so it lives per browser
@@ -130,46 +132,38 @@
 
 	const prompts = homeAIExamples.map((e) => e.prompt)
 
-	const TYPE_MS = 45
-	const DELETE_MS = 25
-	const HOLD_MS = 1800
-	const PAUSE_MS = 400
+	const CYCLE_MS = 7_000
+	// Must match the `duration-*` class on the placeholder overlay: the swap happens once the
+	// fade-out has finished, and Tailwind only emits classes it finds written out in full.
+	const FADE_MS = 600
 
-	// Typewriter effect: type a prompt out, hold, delete, then advance to the next. Only while the
-	// composer is shown — otherwise (operators) it would loop forever driving an unrendered input.
+	// Rotate the example prompt every CYCLE_MS: fade the placeholder out, swap it, fade it back in.
+	// Only while the composer is shown — otherwise (operators) it would loop forever driving an
+	// unrendered input — and not under reduced motion, where the first prompt simply stays put.
+	// The index lives outside the effect so re-showing the composer resumes the rotation from the
+	// prompt currently displayed rather than restarting it.
+	const reducedMotion = useReducedMotion()
+	let promptIndex = 0
 	$effect(() => {
-		if (!showComposer || collapsed) return
-		let promptIndex = 0
-		let charIndex = 0
-		let deleting = false
+		if (!showComposer || collapsed || reducedMotion.val) return
 		let timer: ReturnType<typeof setTimeout>
 
-		function tick() {
-			const current = prompts[promptIndex]
-			if (!deleting) {
-				charIndex++
-				placeholder = current.slice(0, charIndex)
-				if (charIndex >= current.length) {
-					deleting = true
-					timer = setTimeout(tick, HOLD_MS)
-					return
-				}
-				timer = setTimeout(tick, TYPE_MS)
-			} else {
-				charIndex--
-				placeholder = current.slice(0, charIndex)
-				if (charIndex <= 0) {
-					deleting = false
-					promptIndex = (promptIndex + 1) % prompts.length
-					timer = setTimeout(tick, PAUSE_MS)
-					return
-				}
-				timer = setTimeout(tick, DELETE_MS)
-			}
+		function next() {
+			placeholderVisible = false
+			timer = setTimeout(() => {
+				promptIndex = (promptIndex + 1) % prompts.length
+				placeholder = prompts[promptIndex]
+				placeholderVisible = true
+				timer = setTimeout(next, CYCLE_MS)
+			}, FADE_MS)
 		}
 
-		timer = setTimeout(tick, TYPE_MS)
-		return () => clearTimeout(timer)
+		timer = setTimeout(next, CYCLE_MS)
+		return () => {
+			clearTimeout(timer)
+			// Torn down mid-fade, the input would otherwise remount with an invisible placeholder.
+			placeholderVisible = true
+		}
 	})
 </script>
 
@@ -197,8 +191,25 @@
 						bind:value
 						class="resize-none px-4 py-3 pb-9 shadow-sm border-accent"
 						underlyingInputEl="textarea"
-						inputProps={{ rows: 4, placeholder, onkeydown: onKeydown }}
+						inputProps={{
+							rows: 4,
+							'aria-label': 'Describe what you want to build',
+							onkeydown: onKeydown
+						}}
 					/>
+					{#if !value}
+						<!-- Drawn over the textarea instead of set as its `placeholder`: WebKit and Gecko do
+						     not run transitions on `::placeholder`, so the fade would be a hard cut there.
+						     The 1px margin is the textarea's border, so the text sits where typing starts. -->
+						<span
+							aria-hidden="true"
+							class="pointer-events-none absolute inset-x-4 top-3 m-px text-xs text-hint transition-opacity duration-[600ms] ease-in-out {placeholderVisible
+								? 'opacity-100'
+								: 'opacity-0'}"
+						>
+							{placeholder}
+						</span>
+					{/if}
 					<Button
 						endIcon={starting ? {} : { icon: ArrowUp }}
 						wrapperClasses="absolute right-2 bottom-3.5"

From 8a9233ac625708f6d41304fbaf8f017b31e6bb1d Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Thu, 3 Sep 2026 09:30:41 +0200
Subject: [PATCH 17/31] home nit

---
 frontend/src/lib/components/home/HomeAIChat.svelte | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/frontend/src/lib/components/home/HomeAIChat.svelte b/frontend/src/lib/components/home/HomeAIChat.svelte
index f7154c607f..441489db65 100644
--- a/frontend/src/lib/components/home/HomeAIChat.svelte
+++ b/frontend/src/lib/components/home/HomeAIChat.svelte
@@ -270,7 +270,7 @@
 			</div>
 		{/if}
 
-		<div class="flex items-center justify-between gap-2">
+		<div class="flex items-center justify-between gap-2 pt-2">
 			{#if showComposer && !collapsed}
 				<div class="flex flex-row flex-wrap items-center gap-1.5">
 					{#each homeAIExamples as example (example.label)}

From ca8800959aa6a0017cc29bad187c9f49e0d13cc4 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Thu, 3 Sep 2026 11:23:23 +0200
Subject: [PATCH 18/31] fix: bump git sync hub scripts to cli 1.802.1, test the
 fork ui pull (#10955)

* fix: bump git sync hub scripts to cli 1.802.1, test the fork ui pull

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011yMLnAWdjpCEs5VyGMn9ww

* test: guard the ui pull preview shape and pin the pull script ids together

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011yMLnAWdjpCEs5VyGMn9ww

---------

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
---
 .github/workflows/git-sync-test.yml       |   4 +-
 backend/windmill-common/src/workspaces.rs |   4 +-
 frontend/src/lib/hubPaths.json            |   2 +-
 integration_tests/test/git_sync_test.py   | 211 +++++++++++++++++-----
 4 files changed, 176 insertions(+), 45 deletions(-)

diff --git a/.github/workflows/git-sync-test.yml b/.github/workflows/git-sync-test.yml
index ee732569dd..bd15ec8876 100644
--- a/.github/workflows/git-sync-test.yml
+++ b/.github/workflows/git-sync-test.yml
@@ -9,6 +9,7 @@ on:
       - "backend/windmill-api-integration-tests/tests/git_sync*"
       - "backend/ee-repo-ref.txt"
       - "backend/windmill-common/src/workspaces.rs"
+      - "frontend/src/lib/hubPaths.json"
       - "backend/windmill-worker/src/result_processor.rs"
       - "backend/windmill-api-workspaces/**"
       - "cli/src/commands/sync/**"
@@ -22,6 +23,7 @@ on:
       - "backend/windmill-api-integration-tests/tests/git_sync*"
       - "backend/ee-repo-ref.txt"
       - "backend/windmill-common/src/workspaces.rs"
+      - "frontend/src/lib/hubPaths.json"
       - "backend/windmill-worker/src/result_processor.rs"
       - "backend/windmill-api-workspaces/**"
       - "cli/src/commands/sync/**"
@@ -59,7 +61,7 @@ jobs:
           echo "$CHANGED_FILES"
 
           # Direct git sync file changes — always relevant.
-          if echo "$CHANGED_FILES" | grep -qE '^(backend/windmill-git-sync/|backend/windmill-worker/src/result_processor\.rs|backend/windmill-api-workspaces/|backend/windmill-api-integration-tests/tests/git_sync|backend/windmill-common/src/workspaces\.rs|cli/src/commands/sync/|cli/src/utils/git\.ts|integration_tests/test/git_sync|\.github/workflows/git-sync-test\.yml)'; then
+          if echo "$CHANGED_FILES" | grep -qE '^(backend/windmill-git-sync/|backend/windmill-worker/src/result_processor\.rs|backend/windmill-api-workspaces/|backend/windmill-api-integration-tests/tests/git_sync|backend/windmill-common/src/workspaces\.rs|frontend/src/lib/hubPaths\.json|cli/src/commands/sync/|cli/src/utils/git\.ts|integration_tests/test/git_sync|\.github/workflows/git-sync-test\.yml)'; then
             echo "should_run=true" >> "$GITHUB_OUTPUT"
             echo "Relevant: direct git sync file changes"
             exit 0
diff --git a/backend/windmill-common/src/workspaces.rs b/backend/windmill-common/src/workspaces.rs
index c1d8fc00bc..697fc69e44 100644
--- a/backend/windmill-common/src/workspaces.rs
+++ b/backend/windmill-common/src/workspaces.rs
@@ -175,7 +175,7 @@ pub enum ObjectType {
     DatatableMigration,
 }
 
-pub const LATEST_GIT_SYNC_SCRIPT_PATH: &str = "hub/28911/sync-script-to-git-repo-windmill";
+pub const LATEST_GIT_SYNC_SCRIPT_PATH: &str = "hub/28931/sync-script-to-git-repo-windmill";
 
 /// Hub script that applies a repository's state back into a workspace
 /// (the repo → Windmill / "pull" direction). Same script the UI runs from
@@ -183,7 +183,7 @@ pub const LATEST_GIT_SYNC_SCRIPT_PATH: &str = "hub/28911/sync-script-to-git-repo
 /// ignores the slug, so the slug is kept free of characters that would be
 /// percent-encoded into the run URL (a `:` becomes `%3A`, which some hardened
 /// reverse proxies reject as double-encoding when the client re-encodes it).
-pub const GIT_SYNC_PULL_SCRIPT_PATH: &str = "hub/28910/git-sync-init-repository-windmill";
+pub const GIT_SYNC_PULL_SCRIPT_PATH: &str = "hub/28930/git-sync-init-repository-windmill";
 
 /// Prefix used to identify fork workspaces. A workspace whose id starts with this string is a
 /// fork of another workspace.
diff --git a/frontend/src/lib/hubPaths.json b/frontend/src/lib/hubPaths.json
index 2862fc7768..ee60298db4 100644
--- a/frontend/src/lib/hubPaths.json
+++ b/frontend/src/lib/hubPaths.json
@@ -1,6 +1,6 @@
 {
 	"gitSyncTest": "hub/28184/git-repo-test-read-write-windmill",
-	"gitInitRepo": "hub/28910/git-sync-init-repository-windmill",
+	"gitInitRepo": "hub/28930/git-sync-init-repository-windmill",
 	"slackErrorHandler": "hub/28794/workspace-or-schedule-error-handler-slack",
 	"emailErrorHandler": "hub/19795/workspace-or-error-handler-email",
 	"slackRecoveryHandler": "hub/28791/slack/schedule-recovery-handler-slack",
diff --git a/integration_tests/test/git_sync_test.py b/integration_tests/test/git_sync_test.py
index 3cc54f2796..47ac02351e 100644
--- a/integration_tests/test/git_sync_test.py
+++ b/integration_tests/test/git_sync_test.py
@@ -1,9 +1,12 @@
+import json
 import os
+import re
 import shutil
 import tempfile
 import time
 import unittest
 import uuid
+from pathlib import Path
 
 import git as gitpython
 
@@ -19,6 +22,21 @@ def unique_name(prefix: str = "git-sync-test") -> str:
     return f"{prefix}-{uuid.uuid4().hex[:8]}"
 
 
+REPO_ROOT = Path(__file__).resolve().parents[2]
+
+
+def ui_pull_script_path() -> str:
+    """The hub script the git-sync UI runs for a pull (git → workspace)."""
+    with open(REPO_ROOT / "frontend/src/lib/hubPaths.json") as f:
+        return json.load(f)["gitInitRepo"]
+
+
+def backend_pull_script_path() -> str:
+    """The hub script the backend runs for an auto-pull: `GIT_SYNC_PULL_SCRIPT_PATH`."""
+    source = (REPO_ROOT / "backend/windmill-common/src/workspaces.rs").read_text()
+    return re.search(r'GIT_SYNC_PULL_SCRIPT_PATH: &str = "([^"]+)"', source).group(1)
+
+
 class GitSyncTestBase(unittest.TestCase):
     """Shared fixture + helpers for git sync e2e tests (no tests of its own).
 
@@ -221,6 +239,84 @@ class GitSyncTestBase(unittest.TestCase):
         )
         return matching[0]
 
+    def _seed_wmill_yaml(
+        self, repo_name: str, branch: str = "main", include_schedules: bool = False
+    ):
+        """Commit a minimal wmill.yaml: the pull CLI requires one in the repo.
+        Real setups get it from the init/settings-push flow; pushes alone
+        don't write it."""
+        self._gitea.create_file(
+            repo_name,
+            "wmill.yaml",
+            "defaultTs: bun\n"
+            "includes:\n"
+            '  - "**"\n'
+            "excludes: []\n"
+            "codebases: []\n"
+            "skipVariables: true\n"
+            "skipResources: true\n"
+            "skipResourceTypes: true\n"
+            "skipSecrets: true\n"
+            f"includeSchedules: {'true' if include_schedules else 'false'}\n"
+            "includeTriggers: false\n",
+            branch=branch,
+        )
+
+    def _create_fork(self, client: WindmillClient) -> tuple:
+        """Fork `client`'s workspace the way the UI does (branch job first, then
+        the workspace). Returns (fork_id, fork_branch)."""
+        fork_id = f"wm-fork-{uuid.uuid4().hex[:8]}"
+        self._fork_workspaces_to_cleanup.append(fork_id)
+        job_ids = client.create_workspace_fork_branch(fork_id, f"Fork {fork_id}")
+        if job_ids:
+            client.wait_for_jobs_by_ids(job_ids, timeout=90)
+            time.sleep(3)
+        client.create_workspace_fork(fork_id, f"Fork {fork_id}")
+        return fork_id, f"wm-fork/main/{fork_id[len('wm-fork-'):]}"
+
+    def _run_ui_pull(
+        self,
+        client: WindmillClient,
+        resource_path: str,
+        include_type: list,
+        clone_ref: str = None,
+        dry_run: bool = False,
+        timeout: int = 180,
+    ) -> dict:
+        """Run the pull the git-sync UI runs (git → `client`'s workspace) and
+        return the job's result. `dry_run` is the UI's preview."""
+        payload = {
+            "workspace_id": client._workspace,
+            "repo_url_resource_path": resource_path,
+            "dry_run": dry_run,
+            "pull": True,
+            "only_wmill_yaml": False,
+            "settings_json": json.dumps({
+                "include_path": ["**"],
+                "exclude_path": [],
+                "extra_include_path": [],
+                "include_type": include_type,
+            }),
+            "use_promotion_overrides": False,
+            **({"clone_ref": clone_ref} if clone_ref else {}),
+        }
+        response = client._client.post(
+            f"/api/w/{client._workspace}/jobs/run/p/{ui_pull_script_path()}",
+            params={"skip_preprocessor": "true"},
+            json=payload,
+        )
+        self.assertEqual(
+            response.status_code // 100, 2, f"UI pull failed to start: {response.content.decode()}"
+        )
+        job_id = response.content.decode()
+        client.wait_for_jobs_by_ids([job_id], timeout=timeout)
+        job = client._client.get(f"/api/w/{client._workspace}/jobs_u/get/{job_id}").json()
+        self.assertTrue(
+            job.get("success"),
+            f"UI pull job {job_id} failed: {job.get('result')}\n{job.get('logs')}",
+        )
+        return job.get("result") or {}
+
 
 class TestGitSync(GitSyncTestBase):
     # ──────────────────────────────────────────────────
@@ -802,27 +898,6 @@ class TestGitSyncAutoPull(GitSyncTestBase):
     # Two poll cycles + job execution, with slack for a loaded CI runner.
     PULL_TIMEOUT = 240
 
-    def _seed_wmill_yaml(self, repo_name: str, branch: str = "main"):
-        """Commit a minimal wmill.yaml: the pull CLI requires one in the repo.
-        Real setups get it from the init/settings-push flow; pushes alone
-        don't write it."""
-        self._gitea.create_file(
-            repo_name,
-            "wmill.yaml",
-            "defaultTs: bun\n"
-            "includes:\n"
-            '  - "**"\n'
-            "excludes: []\n"
-            "codebases: []\n"
-            "skipVariables: true\n"
-            "skipResources: true\n"
-            "skipResourceTypes: true\n"
-            "skipSecrets: true\n"
-            "includeSchedules: false\n"
-            "includeTriggers: false\n",
-            branch=branch,
-        )
-
     def _configure_auto_pull(self, resource_path: str, sync_forks: bool = False):
         """Single sync repo with auto-pull enabled in polling mode."""
         auto_pull = {"enabled": True, "mode": "polling"}
@@ -914,16 +989,7 @@ class TestGitSyncAutoPull(GitSyncTestBase):
 
         self._configure_auto_pull(resource_path, sync_forks=True)
 
-        # Create the fork (branch first, then workspace), like the UI does.
-        fork_id = f"wm-fork-{uuid.uuid4().hex[:8]}"
-        self._fork_workspaces_to_cleanup.append(fork_id)
-        job_ids = self._client.create_workspace_fork_branch(fork_id, f"Fork {fork_id}")
-        if job_ids:
-            self._client.wait_for_jobs_by_ids(job_ids, timeout=90)
-            time.sleep(3)
-        self._client.create_workspace_fork(fork_id, f"Fork {fork_id}")
-
-        fork_branch = f"wm-fork/main/{fork_id[len('wm-fork-'):]}"
+        fork_id, fork_branch = self._create_fork(self._client)
         self._gitea.create_file(
             repo_name, script_file, ts_script("return 'fork only'"),
             branch=fork_branch,
@@ -1012,19 +1078,12 @@ class TestGitSyncAutoPull(GitSyncTestBase):
             f"attach_dev_workspace failed: {attach.content.decode()}",
         )
 
-        # Fork the dev workspace (branch first, then workspace) — its parent is
-        # the dev, so this is a fork OF a dev workspace.
-        fork_id = f"wm-fork-{uuid.uuid4().hex[:8]}"
-        self._fork_workspaces_to_cleanup.append(fork_id)
-        job_ids = dev_client.create_workspace_fork_branch(fork_id, f"Fork {fork_id}")
-        if job_ids:
-            dev_client.wait_for_jobs_by_ids(job_ids, timeout=90)
-            time.sleep(3)
-        dev_client.create_workspace_fork(fork_id, f"Fork {fork_id}")
+        # Fork the dev workspace — its parent is the dev, so this is a fork OF
+        # a dev workspace.
+        fork_id, fork_branch = self._create_fork(dev_client)
 
         # The fork branch is named after the tracked branch, not the dev label.
         fork_suffix = fork_id[len("wm-fork-"):]
-        fork_branch = f"wm-fork/main/{fork_suffix}"
         branches = self._get_branches(self._clone_repo_all_branches(repo_name))
         self.assertTrue(
             any(fork_branch in b for b in branches),
@@ -1195,3 +1254,73 @@ class TestGitSyncAutoPull(GitSyncTestBase):
             initial_count,
             "Unknown webhook delivery enqueued a job",
         )
+
+
+class TestGitSyncUiPull(GitSyncTestBase):
+    """The pull the git-sync UI runs (hub init script, git → workspace)."""
+
+    def test_ui_pull_script_is_the_backend_pull_script(self):
+        """The UI's pull and the backend's auto-pull are the same hub script,
+        so the two pins must move together."""
+        self.assertEqual(ui_pull_script_path(), backend_pull_script_path())
+
+    def test_fork_pull_does_not_report_parent_owned_schedule_enabled(self):
+        """In a fork, a schedule the parent also has takes its `enabled` from
+        the parent, so a fork-branch file that disagrees on that flag can never
+        be made to agree: a pull that treated it as a change would list the
+        same row on every run. Pull into the fork, then preview: the schedule
+        must not be reported, while an ordinary fork-branch edit does land."""
+        repo_name, _ = self._create_test_repo()
+        resource_path = self._setup_git_sync_resource(repo_name)
+        include_type = ["script", "schedule"]
+        self._configure_single_repo_sync(resource_path, include_type=include_type)
+
+        script_path = self._deploy_seed_script("forkuipull")
+        schedule_path = f"u/admin/{unique_name('forkuipull_sched')}"
+        initial_count = self._client.count_deployment_callback_jobs()
+        self._client.create_schedule(schedule_path, script_path, schedule="0 0 0 1 1 *")
+        self.addCleanup(self._client.delete_schedule, schedule_path)
+        self._client.wait_for_sync_jobs(initial_count, min_new=1)
+        time.sleep(3)
+        self._seed_wmill_yaml(repo_name, include_schedules=True)
+
+        # Fork after the schedule reached git so the fork branch inherits it
+        # with the parent's `enabled: true`; the fork's own copy lands disabled.
+        fork_id, fork_branch = self._create_fork(self._client)
+
+        schedule_file = f"{schedule_path}.schedule.yaml"
+        fork_dir = self._clone_repo(repo_name, branch=fork_branch)
+        content = self._read_file_content(fork_dir, schedule_file)
+        self.assertIn(
+            "enabled: true", content, f"expected the parent's enabled schedule in git:\n{content}"
+        )
+        self._gitea.create_file(
+            repo_name,
+            schedule_file,
+            content.replace("enabled: true", "enabled: false"),
+            branch=fork_branch,
+        )
+        # A real change alongside it proves the pull ran against the fork branch.
+        script_file = self._repo_script_file(repo_name, script_path, branch=fork_branch)
+        self._gitea.create_file(
+            repo_name, script_file, ts_script("return 'fork ui pull'"), branch=fork_branch
+        )
+
+        fork_client = WindmillClient(workspace=fork_id)
+        self._run_ui_pull(fork_client, resource_path, include_type, clone_ref=fork_branch)
+        self.assertIn(
+            "fork ui pull",
+            fork_client.get_script_content(script_path),
+            "the fork-branch script edit was not applied by the pull",
+        )
+        preview = self._run_ui_pull(
+            fork_client, resource_path, include_type, clone_ref=fork_branch, dry_run=True
+        )
+        self.assertIn("changes", preview, f"preview result has no changes list: {preview}")
+        changes = preview["changes"]
+        self.assertIsInstance(changes, list, f"preview changes is not a list: {preview}")
+        self.assertEqual(
+            [c for c in changes if c.get("path", "").endswith(schedule_file)],
+            [],
+            f"a pull into the fork keeps reporting the parent-owned schedule flag: {changes}",
+        )

From 582761e37c776e92dc1c6ebfee8c4efe7c35d822 Mon Sep 17 00:00:00 2001
From: Guilhem <guilhemlemouel@gmail.com>
Date: Thu, 3 Sep 2026 11:28:54 +0200
Subject: [PATCH 19/31] feat: reuse an existing workspace resource in the
 project import wizard (#10935)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* feat: let the import wizard reuse an existing workspace resource

The project import wizard always opened the create-resource drawer, so a
workspace that already had, say, an SMTP resource still ended up with a second
one. Step 4 now offers a choice: fill in a new resource as before, or pick an
existing one of the same type.

Picking an existing resource rewrites the deployed items to point at it and
then deletes the imported stub. The rewrite covers scripts, flows, apps, raw
apps and every workspace trigger kind, and holds two rules: it writes nothing
unless every referrer can be rewritten, and it only touches items under the
target folder.

Raw apps re-upload the bundle shipped in the project export instead of
rebuilding it, and the retarget refuses when the deployed sources have moved on
since the import — that bundle was built from the export's sources, so
re-uploading it over edited sources would revert them.

Adds `update` to the trigger-kind table for the eleven kinds whose service
takes a plain config body; schedule keeps its own branch because
updateSchedule takes a different shape.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fuzkt6NqsqzvSYSVKpR3pj

* feat: only ask about resources the project actually points at

A project declares one resource per `resource-<type>` input schema as well as one
per `$res:` reference, so an app that pins `f/calendly/google_calendar` for a
script whose schema says `resource-gcal` ships an unreferenced `f/calendly/gcal`
alongside it. Step 4 listed both and asked you to fill in each.

Only the referenced ones have to hold a credential for the project to work. The
rest are still created — a standalone run picks from them in the argument picker
— but they no longer reach the checklist, and `resourceCount` counts the same
set so the wizard does not offer a fourth step that has nothing on it. Across
the twelve published hub projects this drops 9 of 19 rows, including three
non-credential input shapes in `typeform`.

Also fixes a miss in the retarget: a trigger holds its resource as a bare path in
its own `*_resource_path` field rather than as a `$res:` token, so a token-only
scan left it pointing at a stub that was then deleted. Detection now mirrors
`rewriteTriggerConfig` through a shared `referencesResourcePath`, which matches
the parsed structure rather than its serialization — keeping `f/proj/db` out of
`$res:f/proj/db_prod` as well.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fuzkt6NqsqzvSYSVKpR3pj

* fix: refuse a resource retarget the scan or the rewriters cannot cover

Uncompiled trigger features 404 on their list route; that is the instance not
having the kind, not a listing that failed, so it no longer blocks every
retarget on a stock build. The `listSearch*` endpoints cap server-side with no
ordering and no pagination, so a full page is refused rather than read as the
whole workspace. An item that names the resource path outside a `$res:` token is
refused at plan time — no rewriter relocates it — and the trigger row keeps its
own `script_path` so a runnable sharing the path is not repointed. A raw app
whose sources the export cannot yield carries no entry at all, so the refusal
its comment promises actually fires. The reused row offers text instead of a
button that leads to a deleted resource.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fuzkt6NqsqzvSYSVKpR3pj

* refactor: let an incomplete scan keep the stub instead of refusing the retarget

The scan behind "nothing is written unless every referrer can be rewritten"
cannot be proven complete: the listings come back capped, a trigger kind can
fail to list, and a reference can sit where no rewriter reaches. Gating the
whole run on that claim made every such case a refusal.

Rewriting an item onto the chosen resource is safe on its own — the item
resolves whether or not the stub survives — so only the delete needs the claim.
`planRetarget` now answers with the referrers it can move plus the gaps it
cannot account for, `applyRetarget` always moves the first set, and a gap keeps
the stub rather than stopping the run. A referrer outside the project's folder
is one of those gaps: the listings are workspace-wide, so it is seen for free,
it stays the user's own, and its existence is why the stub stays.

The outcome carries what moved and why the stub was kept, so the row settles to
the chosen resource either way and says when the placeholder is still there.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fuzkt6NqsqzvSYSVKpR3pj

* fix: preserve a retargeted item's deployed identity, and send back its own bundle

Every write here edits a deployed item in place, but none of them said so.
Without `preserve_on_behalf_of` the backend replaces the item's stored run
identity with whoever opened the wizard, and `updatePolicy(next, undefined)`
rebuilt an app's policy from nothing — dropping its sandbox rules and forcing
`execution_mode: publisher`, which puts a viewer app on the publisher's
identity even though the backend would otherwise have kept the deployed mode.
The policy is now recomputed from the deployed one, which is what the
triggerables rekeying actually needs.

The raw-app bundle no longer comes from the project export. The browser can
read a deployed bundle back — mint the app's public secret and fetch
`/apps/get_data/v/{secret}.{ext}`, the same route the Hub publish reads — so
the bundle sent back is the deployed one whoever last edited it. That removes
`ExportedAppFiles`, its plumbing through the setup step, `rawSourcesDiverged`,
and the two raw-app gaps: an app "edited since the import" is no longer a case
that exists.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fuzkt6NqsqzvSYSVKpR3pj

* perf: carry the trigger row from the scan into its write

`rewriteTrigger` listed the whole kind again to find the row it had just read,
once per trigger — and for schedules a listing is itself a listing plus a
detail fetch per row. The scan already holds the row, so the referrer carries
it.

Pins two properties that nothing covered: the trigger update body leaves
`enabled` out, so pointing a trigger at a credential cannot also start it; and
a write that fails partway keeps the stub while reporting what had already
moved.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fuzkt6NqsqzvSYSVKpR3pj

* fix: keep unfilled resources out of the reuse chooser

The chooser offered every resource of the row's type except the ones this import
created, so a stub left behind by an earlier import of the same project showed up
as a credential to reuse. Pointing a project at another project's empty
placeholder is never the answer, and nothing downstream would have complained.

Candidates are now read back and the unfilled ones dropped, using the same test
the checklist uses to call one of the project's own resources blank. Past a cap
they are all offered rather than costing a request each: a workspace with that
many resources of the outstanding types is not the case this filters for.

Also drops the chooser's promise that the imported placeholder is removed. That
was true when the delete was unconditional; the stub is now kept whenever the
scan cannot account for everything, and the row says which happened once it has.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fuzkt6NqsqzvSYSVKpR3pj

* fix: move a retargeted item's bundle and identity, and see the paths it spells out

Four gaps between what the retarget claimed and what it did.

A trigger states its run identity as `permissioned_as`, not the `on_behalf_of`
the other kinds use, and the backend keeps the row's value only when
`preserve_permissioned_as` says so. Without the pair, a trigger created under a
folder's `default_permissioned_as` started running as whoever picked the
credential.

A raw app's bundle is compiled from its sources, so a `$res:` a source spells out
is baked into it. The import rewrites that copy — `retargetProjectExport` runs
while `/bundle.js` is still one of `files` — but the retarget fetched the
deployed bundle after that split and sent it back untouched, then deleted the
stub the app still read. The fetched bundle is now rewritten too, and a path it
names any other way keeps the stub instead.

A script's content is one string, so the whole-string match that finds a bare
path in a flow or an app could not see one written inside it. `getResource("f/…")`
was invisible to both the scan, which then deleted the stub under it, and the
step-4 filter, which dropped the row so nobody was asked to fill it.

Trigger listings cap at the server's DEFAULT_PER_PAGE, which this table does not
page past. A full page is now read the way a full `listSearch*` page is: as a
listing that cannot account for the rest.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fuzkt6NqsqzvSYSVKpR3pj

* fix: see a path a flow or app spells out, and name why an item did not move

The script scan was taught to see a resource path written inside code; flows and
apps were left on the whole-string test, which cannot. A flow whose inline module
runs `getResource("f/proj/db")`, or a raw app whose source does, was neither
rewritten nor recorded as a gap, so the stub was deleted while the deployed item
still read it. Reachable from the wizard, because the step-4 filter does see such
a reference and offers the row.

Both branches now use the same test as the script branch, and gap rather than
rewrite: the stub survives either way, so a `$res:` token in the same item still
resolves, and rewriting half an item would only make the plan and the write
disagree about what moved.

Each rewriter now says why it left an item alone instead of answering yes or no,
so a raw-app bundle that spells the path out is reported as a reference nothing
could move rather than as a concurrent edit.

Also corrects the resource-listing comment — `perPage` bounds the answer, the
route does not default to 30 — and asks the askable-resource question against the
export as published rather than the retargeted copy, so the step and the stepper
that decides whether to offer it give one answer. A path spelled out in code is
not retargeted, so only the raw export has its references and its resource paths
agreeing.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fuzkt6NqsqzvSYSVKpR3pj

* fix: a kept placeholder is still something to fill in

Reuse marked the row done and replaced its action with static text even when the
stub survived. A kept stub is empty and is still what every item the scan could
not move reads, so the step reported "You're all set" over a project running on a
placeholder, with no way back to filling it. Reachable from one hub project: a
raw app whose source spells the resource path out gaps everything, nothing is
rewritten, and the row went green anyway.

Such a row now stays outstanding, keeps its button, says which path items still
read, and re-checks on refresh so filling that placeholder in closes it.

Flows and apps also went back to being rewritten as well as gapped, matching what
the script branch already did — the reason given for skipping them was
contradicted by that branch, and a comment merely naming the path was enough to
strand an item's real `$res:` token on the stub.

Two things had to become precise for that to hold. What counts as rewritable is
now the presence of a `$res:` token rather than any reference, since a whole
string equal to the path is the unreachable case, not a movable one. And the
post-rewrite check reads tokens only: a path the item also spells out is the
plan's gap to record, and re-reading it at write time reported one item twice,
as both unmovable and changed underfoot. Writers now skip a write that would
change nothing.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fuzkt6NqsqzvSYSVKpR3pj

* fix: rewrite only the tokens, and let a filled placeholder close its row

The import's flow and app rewriters also remap a runnable's own path on an exact
match. That is right for the folder-wide map the import hands them, where every
path is moving. Here the map holds one entry, a resource path — and scripts,
flows and resources share a namespace, so a project shipping both a script and a
resource named `smtp` had the step calling it repointed at the credential.
Triggers were already guarded against exactly this; flows, apps and raw apps were
not. All three now rewrite the serialized value, which moves the tokens and
leaves every path alone.

A kept placeholder that the user then fills in now closes its row: `stubKept` is
cleared by the read that finds it filled, so the row stops saying items still
need it while showing a green check beside "You're all set".

A kept-stub row's button also goes straight to filling that placeholder rather
than reopening the chooser. A second retarget from there can only be a no-op —
every rewritable referrer is already off the stub — and it would have relabelled
the row after moving nothing.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fuzkt6NqsqzvSYSVKpR3pj

* fix: check staleness where it can be seen, and stop trusting a client-side licence

The post-rewrite check could no longer fail: since the rewrite became token-only
it ran over exactly what the check looked for, so it read as a guard while
guarding nothing. The staleness it named is real — the plan classifies items from
the search listings and each write re-reads its item by path — so the check now
happens on that fresh read, and looks for the spelling no rewrite reaches. A
referrer the plan already recorded as unreachable skips it: the stub survives
either way, and re-reporting the same item would say it was both unmovable and
changed underfoot.

Trigger kinds are no longer skipped by the client-side licence store. That store
is empty on an EE instance whose licence is unset or whose fetch failed, while
the rows are still in the database and the routes still answer — and a kind
skipped that way left no gap, so the stub went while an EE trigger still pointed
at it. On CE those routes are not registered and the 404 branch already says so,
from the server rather than from a store.

`askableResources` now pairs the export's resources with the retargeted ones by
position, the way `retargetProjectExport` maps them, instead of rebuilding the
path by slicing a prefix. An external path the bundle pulled in lands at
`f/<folder>/<name>` with a `_2` suffix on collision, which no slicing recovers —
and the row would have gone missing from a checklist the stepper still counted.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fuzkt6NqsqzvSYSVKpR3pj

* fix: a scan the caller is not shown all of cannot clear the stub for deletion

The listings the scan reads run as the caller, and row-level security filters
them inside the query. For anyone but a workspace admin that means an item they
cannot read is not absent from the answer so much as invisible in it: it does not
appear, and it does not count towards the full-page test that catches a truncated
listing either. A colleague's private script referencing the stub is exactly that
shape, so the scan reported a clean sweep and the stub was deleted out from under
it, with nothing said.

That is the one input to the completeness proof the destructive step rests on
that was never checked. A caller who is not shown the whole workspace now records
a gap like any other, so the rewrite still happens in full and the placeholder
stays.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fuzkt6NqsqzvSYSVKpR3pj

* fix: ask whether this workspace's listings are complete, not a stale record's

`UserExt` is per-workspace and outlives a workspace change, which is why it
carries `workspace_id`. Reading `is_admin` off it without checking which
workspace it describes answers for the wrong one. Step 4 is reachable by reload —
it is built to be — and nothing on that path re-fetches the record, so it still
describes the workspace the user came from. An admin of their own workspace
importing into a shared one they are a plain member of got a clean scan over
row-level-security-filtered listings, and the stub was deleted under a referrer
they were never shown.

The question is now asked of the target workspace, through a predicate that can
be tested. An instance superadmin bypasses the policies everywhere, so that is
asked separately rather than read off the same stale record.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fuzkt6NqsqzvSYSVKpR3pj

* style: format the wizard retarget files

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fuzkt6NqsqzvSYSVKpR3pj

* fix: leave a trigger's runnable references alone, and read the app kind rather than guess it

A trigger's `on_failure`, `on_recovery`, `on_success` and `url` name a runnable,
and `rewriteTriggerConfig` remaps one on an exact match — right for the
folder-wide map the import hands it, wrong for a map holding a single resource
path. A schedule whose error handler ran a script sharing that path had the
handler pointed at the credential instead. The same reason `path` and
`script_path` were already restored; only the two prefixed shapes it remaps are,
so a field holding a `$res:` token still moves.

The scan guessed raw from low-code by looking for `files` and `runnables`,
because `list_search_apps` returns only the path and the value. Both writers
re-read the app anyway, and that record carries `raw_app`, so the write now
dispatches on it. A guess wrong in either direction was a deploy the backend
refuses for changing an app's kind, which aborted the run at that referrer.

Also drops the past-tense clauses from four test comments. Each already states
the invariant it guards; the rest described iterations of this branch that no
reader will have seen.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fuzkt6NqsqzvSYSVKpR3pj

* fix: restore a trigger's bare runnable references too

The prefixed spellings were put back after the rewrite; the bare ones were not.
`dynamic_skip`, `error_handler_path` and a websocket initial message's
`runnable_result.path` each hold a plain script path, which `rewriteTriggerConfig`
remaps on a whole-string match — so a trigger whose error handler ran a script
sharing the stub's path had that handler pointed at the credential.

All of them now come back from the row, taken from what `triggerHandlerRefs`
reads rather than enumerated by hand. A prefixed field is still restored only
when it holds the runnable spelling, so a `$res:` token in one still moves; a
bare field is a path and nothing else, so it is always restored.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fuzkt6NqsqzvSYSVKpR3pj

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .../src/lib/components/ImportSetupStep.svelte | 319 ++++++++-
 .../triggers/workspaceTriggersList.ts         |  50 +-
 .../workspaceSettings/projectBundle.test.ts   |  45 ++
 .../workspaceSettings/projectBundle.ts        |  83 +++
 .../src/lib/importWizard/execution.svelte.ts  |  23 +-
 .../lib/importWizard/retargetDeployed.test.ts | 393 +++++++++++
 .../src/lib/importWizard/retargetDeployed.ts  | 650 ++++++++++++++++++
 .../projects/import/+page@(root).svelte       |   7 +-
 8 files changed, 1535 insertions(+), 35 deletions(-)
 create mode 100644 frontend/src/lib/importWizard/retargetDeployed.test.ts
 create mode 100644 frontend/src/lib/importWizard/retargetDeployed.ts

diff --git a/frontend/src/lib/components/ImportSetupStep.svelte b/frontend/src/lib/components/ImportSetupStep.svelte
index 86670b0817..94691f86d7 100644
--- a/frontend/src/lib/components/ImportSetupStep.svelte
+++ b/frontend/src/lib/components/ImportSetupStep.svelte
@@ -14,16 +14,21 @@
 	import IconedResourceType from '$lib/components/IconedResourceType.svelte'
 	import ImportSetupRow from '$lib/components/ImportSetupRow.svelte'
 	import AppConnectDrawer from '$lib/components/AppConnectDrawer.svelte'
+	import Modal2 from '$lib/components/common/modal/Modal2.svelte'
+	import Select from '$lib/components/select/Select.svelte'
+	import { applyRetarget, seesWholeWorkspace } from '$lib/importWizard/retargetDeployed'
 	import { OauthService } from '$lib/gen'
 	import { registryCcCapableFor } from '$lib/components/oauthRegistry'
 	import { resourceTypeDisplayName } from '$lib/components/resourceTypeDisplay'
 	import { applyOneMigration } from '$lib/components/workspaceSettings/projectInstall'
 	import { probeMigrationsApplied } from '$lib/importWizard/probe'
 	import {
+		projectReferencesResource,
 		retargetProjectExport,
 		type ProjectExport,
 		type ProjectMigration
 	} from '$lib/components/workspaceSettings/projectBundle'
+	import { superadmin, userStore } from '$lib/stores'
 	import { sendUserToast } from '$lib/toast'
 	import { escapeHtml } from '$lib/utils'
 
@@ -82,6 +87,17 @@
 		 * is absent, and removing the row reports "all set" over a credential nobody filled.
 		 */
 		unreadable?: boolean
+		/**
+		 * The workspace resource this row was pointed at. The project's items reference it
+		 * directly now, so this is what the row has to say instead of the path it used to name.
+		 */
+		reusedFrom?: string
+		/**
+		 * The empty placeholder is still at this row's path, because the retarget could not
+		 * account for every item that might read it. Worth saying: the workspace has a resource
+		 * on it that looks unfinished and is not.
+		 */
+		stubKept?: boolean
 	}
 
 	let loading = $state(true)
@@ -89,9 +105,38 @@
 	let rows = $state<Row[]>([])
 	let blanks = $state<Blank[]>([])
 	let projectResources: { path: string; resource_type: string }[] = []
+	/**
+	 * The subset of `projectResources` the checklist asks about: the ones something in the
+	 * project actually points at. The rest are created and left alone — see
+	 * `projectReferencesResource`. Kept apart from `projectResources` because the full list
+	 * is still what a stub may not be replaced by.
+	 */
+	let askableResources: { path: string; resource_type: string }[] = []
 	let working = $state(false)
 	let resourceEditor: ResourceEditorDrawer | undefined = $state(undefined)
 
+	/** The folder the import wrote into, which is where every rewritable referrer lives. */
+	const targetFolder = $derived(folder?.trim() || slug)
+
+	/**
+	 * Resources the workspace already has, by resource type — what a stub can be replaced
+	 * by. Empty for a workspace this import created, which is why the choice is offered
+	 * rather than imposed: with nothing to choose from the button goes straight to the
+	 * editor, exactly as it did before.
+	 */
+	let candidates = $state<Record<string, string[]>>({})
+	/**
+	 * How many candidates are worth reading back to find the unfilled ones. Past this a
+	 * workspace holds too many resources of these types to be the case worth filtering —
+	 * one project's stub offered as another's credential — and they are all offered rather
+	 * than costing a request each.
+	 */
+	const CANDIDATE_READ_CAP = 40
+	/** The credential row whose choice dialog is open. */
+	let choosing = $state<Blank | undefined>(undefined)
+	let chosenPath = $state<string | undefined>(undefined)
+	let reusing = $state(false)
+
 	const pendingTables = $derived(rows.filter((r) => r.status !== 'done'))
 	// Split because the two say different things to the user: one data table was never
 	// created, the other exists and could not be read. Telling someone to set up what they
@@ -248,7 +293,7 @@
 			// Retargeted the same way the import was, so these are where the stubs actually
 			// landed. `retargetProjectExport` is a no-op when the folder is the slug, which is
 			// every new-workspace import.
-			const target = folder?.trim() || slug
+			const target = targetFolder
 			const retargeted = retargetProjectExport(exportData, exportData.project?.slug ?? slug, target)
 			// Contained for the same reason the import contains: a crafted export can name a
 			// path outside the folder, and offering that for editing would reach a resource
@@ -256,6 +301,20 @@
 			projectResources = (retargeted.resources ?? [])
 				.map((r) => ({ path: String(r.path), resource_type: String((r as any).resource_type) }))
 				.filter((r) => r.path.startsWith(`f/${target}/`))
+			// Asked against the export as published, not the retargeted copy: a path the project
+			// spells out in code is not rewritten by the retarget, so only the raw export has
+			// its references and its resource paths agreeing. `resourceCount` asks the same
+			// question the same way, and the step and the stepper have to give one answer.
+			// Paired by position, not by reconstructing the retargeted path: `retargetProjectExport`
+			// maps `resources` in order, and an external path the bundle pulled in lands at
+			// `f/<folder>/<name>` with a `_2` suffix on collision, which no slicing recovers.
+			const askable = new Set(
+				(retargeted.resources ?? [])
+					.map((r, i) => [String(r.path), (exportData.resources ?? [])[i]] as const)
+					.filter(([, raw]) => raw && projectReferencesResource(exportData, String(raw.path)))
+					.map(([path]) => path)
+			)
+			askableResources = projectResources.filter((r) => askable.has(r.path))
 			await refreshBlanks()
 		} catch (e: any) {
 			loadError = e?.body ?? e?.message ?? String(e)
@@ -347,13 +406,19 @@
 	 * it only moves a row from outstanding to done.
 	 */
 	async function refreshBlanks(): Promise<void> {
-		const fresh = await findBlankResources(projectResources)
+		const fresh = await findBlankResources(askableResources)
 		const stillBlank = new Map(fresh.map((b) => [b.path, b]))
 		if (blanks.length === 0) {
 			blanks = fresh
+			await loadCandidates()
 			return
 		}
 		blanks = blanks.map((b) => {
+			// A row pointed at another resource is settled once its own stub is gone: the
+			// project's items read the chosen resource and nothing is left at this path. A row
+			// whose stub was kept is not settled, and re-reading it is how filling that stub in
+			// finally closes the row.
+			if (b.reusedFrom && !b.stubKept) return b
 			const f = stillBlank.get(b.path)
 			// Every field the fresh read decides is taken from it, not merged selectively: these
 			// describe what is at the path *now*. Keeping a stale `unreadable` leaves a resource
@@ -369,12 +434,15 @@
 					justSaved: false
 				}
 			}
-			// Gone from the blank list entirely: it was read, and it is filled.
+			// Gone from the blank list entirely: it was read, and it is filled. `stubKept` goes
+			// with it — the placeholder the items this run could not move read is a credential
+			// now, so there is nothing left to tell anyone to fill in.
 			return {
 				...b,
 				missing: [],
 				unreadable: undefined,
 				occupiedBy: undefined,
+				stubKept: undefined,
 				done: true,
 				justSaved: !b.done
 			}
@@ -387,6 +455,169 @@
 				if (row) row.justSaved = false
 			}, 1500)
 		}
+		await loadCandidates()
+	}
+
+	/**
+	 * Which existing resources each outstanding row could be replaced by. Re-read on every
+	 * refresh rather than once: a resource created from the editor here is a candidate for
+	 * the rows below it.
+	 *
+	 * The project's own resources are never offered — one of this project's stubs standing
+	 * in for another is a reference to something equally unfilled.
+	 */
+	async function loadCandidates(): Promise<void> {
+		const types = [...new Set(blanks.map((b) => b.resourceType))]
+		if (types.length === 0) {
+			candidates = {}
+			return
+		}
+		const own = new Set(projectResources.map((r) => r.path))
+		const next: Record<string, string[]> = Object.fromEntries(types.map((t) => [t, []]))
+		try {
+			// One call for every type at once — `resource_type` takes a comma-separated list —
+			// and every page of it: `perPage` is what bounds the answer, so without the loop a
+			// workspace past one page would have the rest of its resources silently hidden.
+			for (let page = 1; page <= 100; page++) {
+				const rows = await ResourceService.listResource({
+					workspace,
+					resourceType: types.join(','),
+					page,
+					perPage: 100
+				})
+				for (const r of rows) {
+					if (own.has(r.path)) continue
+					next[r.resource_type ?? '']?.push(r.path)
+				}
+				if (rows.length < 100) break
+			}
+		} catch {
+			// Offer nothing rather than a partial list: every row then behaves as it did before
+			// this choice existed, which is a working way to fill a credential.
+			candidates = {}
+			return
+		}
+		// An unfilled resource is never the answer to "which credential should this use" —
+		// another project's stub above all, which the path filter above cannot recognise.
+		const paths = Object.values(next).flat()
+		if (paths.length <= CANDIDATE_READ_CAP) {
+			const settled = await Promise.all(paths.map(async (p) => [p, await isUnfilled(p)] as const))
+			const unfilled = new Set(settled.filter(([, empty]) => empty).map(([p]) => p))
+			for (const t of Object.keys(next)) next[t] = next[t].filter((p) => !unfilled.has(p))
+		}
+		candidates = next
+	}
+
+	/**
+	 * Whether a resource holds nothing. Same test the checklist uses to call one of the
+	 * project's own resources blank, so a resource this drops is exactly one the wizard
+	 * would have asked someone to fill in.
+	 */
+	async function isUnfilled(path: string): Promise<boolean> {
+		try {
+			const found = await ResourceService.getResource({ workspace, path })
+			const value = found?.value
+			if (!value || typeof value !== 'object') return true
+			return !Object.values(value).some((v) => v !== undefined && v !== null && v !== '')
+		} catch {
+			// A read that fails says nothing about the value, and offering it is what this did
+			// before the check existed.
+			return false
+		}
+	}
+
+	/**
+	 * The row's one action. A workspace that already has a resource of this type gets the
+	 * choice first — reusing what is there is usually the answer, and entering the same
+	 * credentials a second time is the thing worth avoiding. With nothing to choose from
+	 * there is no choice to make, so it goes straight where it always went.
+	 */
+	function startFilling(b: Blank): void {
+		// A kept-stub row has already been pointed at a resource; what is left is the empty
+		// placeholder the items this run could not move still read. Reusing a second resource
+		// would move nothing — every rewritable referrer is off the stub — and would relabel
+		// the row after a retarget that did nothing.
+		if (b.done || b.stubKept || (candidates[b.resourceType] ?? []).length === 0) {
+			fillDirectly(b)
+			return
+		}
+		chosenPath = undefined
+		choosing = b
+	}
+
+	/** Connect where the instance can, hand-fill otherwise. */
+	function fillDirectly(b: Blank): void {
+		if (canConnectType(b.resourceType)) appConnect?.open(b.resourceType, b.path)
+		else resourceEditor?.initEdit(b.path)
+	}
+
+	/**
+	 * The chooser's way out: close it and do what the button did before there was a choice.
+	 * The row is read out of the state first — closing the dialog unmounts the block that
+	 * would otherwise be holding it.
+	 */
+	function fillNewInstead(): void {
+		const b = choosing
+		choosing = undefined
+		if (b) fillDirectly(b)
+	}
+
+	/**
+	 * Point the project at an existing resource: every imported item that referenced the stub
+	 * is rewritten to the chosen path. Nothing is copied. The stub is deleted only when
+	 * `applyRetarget` can account for every item that might read it, and kept otherwise — so
+	 * the toast says how many items moved, and whether the placeholder is still there.
+	 */
+	async function reuseChosen(): Promise<void> {
+		const b = choosing
+		const target = chosenPath
+		if (!b || !target) return
+		reusing = true
+		working = true
+		try {
+			const outcome = await applyRetarget({
+				workspace,
+				folder: targetFolder,
+				from: b.path,
+				to: target,
+				// Asked of this workspace, not of whichever one the user record still describes:
+				// reloading on this step leaves `$userStore` pointing at the previous workspace.
+				seesWholeWorkspace: seesWholeWorkspace($userStore, !!$superadmin, workspace)
+			})
+			const moved = `${outcome.rewritten.length} item${outcome.rewritten.length === 1 ? '' : 's'}`
+			if (outcome.error) {
+				sendUserToast(
+					`Could not point the project at ${target}: ${outcome.error}. ${moved} had already been updated, and ${b.path} was kept.`,
+					true
+				)
+				return
+			}
+			choosing = undefined
+			const row = blanks.find((x) => x.path === b.path)
+			if (row) {
+				row.reusedFrom = target
+				row.stubKept = !outcome.stubDeleted
+				// Settled only when the stub is gone. A kept stub is empty and is still what
+				// every item the scan could not move reads, so the row stays outstanding and
+				// keeps its action: filling it in is the thing left to do.
+				row.done = outcome.stubDeleted
+				row.justSaved = outcome.stubDeleted
+			}
+			await refreshBlanks()
+			sendUserToast(
+				outcome.stubDeleted
+					? `The project now uses ${target} — ${moved} updated.`
+					: `The project now uses ${target} — ${moved} updated. ${b.path} was kept, because some items could not be checked.`
+			)
+		} catch (e: any) {
+			sendUserToast(
+				`Could not point the project at ${target}: ${e?.body ?? e?.message ?? String(e)}`,
+				true
+			)
+		} finally {
+			reusing = false
+			working = false
+		}
 	}
 
 	$effect(() => {
@@ -692,7 +923,18 @@
 								</div>
 							{/snippet}
 							{#snippet detail()}
-								{#if b.occupiedBy}
+								{#if b.reusedFrom}
+									<span class="truncate text-secondary">
+										now uses <span class="font-mono">{b.reusedFrom}</span>
+									</span>
+									{#if b.stubKept}
+										<!-- Not a footnote: some items were not moved and still read this path,
+										     so the empty resource on it is a credential someone has to fill in. -->
+										<span class="truncate text-hint">
+											some items still read <span class="font-mono">{b.path}</span> — fill it in too
+										</span>
+									{/if}
+								{:else if b.occupiedBy}
 									<span class="truncate text-secondary">
 										a {resourceTypeDisplayName(b.occupiedBy)} resource already holds this path — the
 										project did not get this one
@@ -719,15 +961,16 @@
 									<span class="whitespace-nowrap text-2xs text-hint">
 										{b.occupiedBy ? 'Resolve in the workspace' : 'Check the workspace'}
 									</span>
+								{:else if b.reusedFrom && !b.stubKept}
+									<!-- No action either: this row is done with, whether its own path was
+									     deleted with the retarget or filled in afterwards. -->
+									<span class="whitespace-nowrap text-2xs text-hint">Reused</span>
 								{:else}
 									<Button
 										variant={b.done ? 'subtle' : 'accent'}
 										unifiedSize="sm"
 										disabled={working}
-										onClick={() =>
-											canConnect
-												? appConnect?.open(b.resourceType, b.path)
-												: resourceEditor?.initEdit(b.path)}
+										onClick={() => startFilling(b)}
 									>
 										{b.done ? 'Saved' : canConnect ? 'Connect' : 'Fill in'}
 									</Button>
@@ -757,15 +1000,17 @@
 				size="xs"
 			>
 				{#if missingTables.length > 0}
-					The tables {missingTables.length === 1 ? 'this data table holds' : 'these data tables hold'}
+					The tables {missingTables.length === 1
+						? 'this data table holds'
+						: 'these data tables hold'}
 					do not exist, and the project's apps and flows read them. Every one of those fails as soon
 					as it opens.
 				{/if}
 				{#if uncheckedTables.length > 0}
 					{#if missingTables.length > 0}<br /><br />{/if}
 					{uncheckedTables.length === 1 ? 'One data table is' : 'Some data tables are'} set up, but
-					{uncheckedTables.length === 1 ? 'its' : 'their'} schema could not be read, so whether the
-					project's tables are there is unknown. Check again once the database is reachable.
+					{uncheckedTables.length === 1 ? 'its' : 'their'} schema could not be read, so whether the project's
+					tables are there is unknown. Check again once the database is reachable.
 				{/if}
 			</Alert>
 		{:else}
@@ -859,3 +1104,55 @@
 <!-- `on:refresh` fires once the connection has been written into the stub — the same moment
      a save is — so the rows settle the same way either route was taken. -->
 <AppConnectDrawer bind:this={appConnect} {workspace} on:refresh={() => void refreshBlanks()} />
+
+<!-- What "Fill in" opens when the workspace already has a resource of the row's type.
+     Portalled to the body for the reason the confirmation above is: this step renders inside
+     the wizard page's CenteredModal, which is its own stacking context. -->
+<Modal2
+	title={choosing ? `Set up ${resourceTypeDisplayName(choosing.resourceType)}` : ''}
+	target="body"
+	fixedWidth="xs"
+	fixedHeight="adaptive"
+	formStyling
+	closeOnOutsideClick={!reusing}
+	bind:isOpen={
+		() => choosing !== undefined,
+		(v) => {
+			if (!v && !reusing) choosing = undefined
+		}
+	}
+>
+	{#if choosing}
+		{@const forRow = choosing}
+		{@const existing = candidates[forRow.resourceType] ?? []}
+		<div class="flex w-full flex-col gap-4 text-xs">
+			<p class="text-secondary">
+				This workspace already has {existing.length}
+				{resourceTypeDisplayName(forRow.resourceType)}
+				{existing.length === 1 ? 'resource' : 'resources'}. Use one and this project's apps, flows
+				and triggers are pointed at it.
+			</p>
+			<Select
+				bind:value={chosenPath}
+				items={existing.map((p) => ({ value: p, label: p }))}
+				placeholder="Pick a resource"
+				disabled={reusing}
+				clearable
+				class="w-full"
+			/>
+			<div class="flex items-center justify-between gap-2">
+				<Button variant="subtle" unifiedSize="sm" disabled={reusing} onClick={fillNewInstead}>
+					{canConnectType(forRow.resourceType) ? 'Connect a new one' : 'Fill in a new one'}
+				</Button>
+				<Button
+					variant="accent"
+					unifiedSize="sm"
+					disabled={!chosenPath || reusing}
+					onClick={() => void reuseChosen()}
+				>
+					{reusing ? 'Pointing the project at it…' : 'Use this resource'}
+				</Button>
+			</div>
+		</div>
+	{/if}
+</Modal2>
diff --git a/frontend/src/lib/components/triggers/workspaceTriggersList.ts b/frontend/src/lib/components/triggers/workspaceTriggersList.ts
index 01f1572813..f0ad24cced 100644
--- a/frontend/src/lib/components/triggers/workspaceTriggersList.ts
+++ b/frontend/src/lib/components/triggers/workspaceTriggersList.ts
@@ -79,6 +79,12 @@ export const TRIGGER_KINDS: Record<
 			onError?: (message: string) => void
 		) => Promise<Array<Record<string, any>>>
 		create?: (workspace: string, requestBody: any) => Promise<unknown>
+		/**
+		 * Write back an existing trigger's config. Used to point an imported trigger at a
+		 * resource the workspace already has; `schedule` has none because its own service
+		 * takes a different body shape, handled by the caller.
+		 */
+		update?: (workspace: string, path: string, requestBody: any) => Promise<unknown>
 	}
 > = {
 	http: {
@@ -101,7 +107,9 @@ export const TRIGGER_KINDS: Record<
 		resourceField: 'authentication_resource_path',
 		list: (workspace) => HttpTriggerService.listHttpTriggers({ workspace }),
 		create: (workspace, requestBody) =>
-			HttpTriggerService.createHttpTrigger({ workspace, requestBody })
+			HttpTriggerService.createHttpTrigger({ workspace, requestBody }),
+		update: (workspace, path, requestBody) =>
+			HttpTriggerService.updateHttpTrigger({ workspace, path, requestBody })
 	},
 	websocket: {
 		configFields: [
@@ -119,7 +127,9 @@ export const TRIGGER_KINDS: Record<
 		note: 'Reconnect WebSocket auth after import if external service requires it.',
 		list: (workspace) => WebsocketTriggerService.listWebsocketTriggers({ workspace }),
 		create: (workspace, requestBody) =>
-			WebsocketTriggerService.createWebsocketTrigger({ workspace, requestBody })
+			WebsocketTriggerService.createWebsocketTrigger({ workspace, requestBody }),
+		update: (workspace, path, requestBody) =>
+			WebsocketTriggerService.updateWebsocketTrigger({ workspace, path, requestBody })
 	},
 	schedule: {
 		configFields: [
@@ -180,7 +190,9 @@ export const TRIGGER_KINDS: Record<
 		eeOnly: true,
 		list: (workspace) => KafkaTriggerService.listKafkaTriggers({ workspace }),
 		create: (workspace, requestBody) =>
-			KafkaTriggerService.createKafkaTrigger({ workspace, requestBody })
+			KafkaTriggerService.createKafkaTrigger({ workspace, requestBody }),
+		update: (workspace, path, requestBody) =>
+			KafkaTriggerService.updateKafkaTrigger({ workspace, path, requestBody })
 	},
 	nats: {
 		configFields: [
@@ -197,7 +209,9 @@ export const TRIGGER_KINDS: Record<
 		eeOnly: true,
 		list: (workspace) => NatsTriggerService.listNatsTriggers({ workspace }),
 		create: (workspace, requestBody) =>
-			NatsTriggerService.createNatsTrigger({ workspace, requestBody })
+			NatsTriggerService.createNatsTrigger({ workspace, requestBody }),
+		update: (workspace, path, requestBody) =>
+			NatsTriggerService.updateNatsTrigger({ workspace, path, requestBody })
 	},
 	sqs: {
 		configFields: [
@@ -212,7 +226,9 @@ export const TRIGGER_KINDS: Record<
 		eeOnly: true,
 		list: (workspace) => SqsTriggerService.listSqsTriggers({ workspace }),
 		create: (workspace, requestBody) =>
-			SqsTriggerService.createSqsTrigger({ workspace, requestBody })
+			SqsTriggerService.createSqsTrigger({ workspace, requestBody }),
+		update: (workspace, path, requestBody) =>
+			SqsTriggerService.updateSqsTrigger({ workspace, path, requestBody })
 	},
 	mqtt: {
 		configFields: [
@@ -228,7 +244,9 @@ export const TRIGGER_KINDS: Record<
 		resourceField: 'mqtt_resource_path',
 		list: (workspace) => MqttTriggerService.listMqttTriggers({ workspace }),
 		create: (workspace, requestBody) =>
-			MqttTriggerService.createMqttTrigger({ workspace, requestBody })
+			MqttTriggerService.createMqttTrigger({ workspace, requestBody }),
+		update: (workspace, path, requestBody) =>
+			MqttTriggerService.updateMqttTrigger({ workspace, path, requestBody })
 	},
 	amqp: {
 		configFields: ['amqp_resource_path', 'queue_name', 'exchange', 'options'],
@@ -238,7 +256,9 @@ export const TRIGGER_KINDS: Record<
 		resourceField: 'amqp_resource_path',
 		list: (workspace) => AmqpTriggerService.listAmqpTriggers({ workspace }),
 		create: (workspace, requestBody) =>
-			AmqpTriggerService.createAmqpTrigger({ workspace, requestBody })
+			AmqpTriggerService.createAmqpTrigger({ workspace, requestBody }),
+		update: (workspace, path, requestBody) =>
+			AmqpTriggerService.updateAmqpTrigger({ workspace, path, requestBody })
 	},
 	gcp: {
 		configFields: [
@@ -256,7 +276,9 @@ export const TRIGGER_KINDS: Record<
 		eeOnly: true,
 		list: (workspace) => GcpTriggerService.listGcpTriggers({ workspace }),
 		create: (workspace, requestBody) =>
-			GcpTriggerService.createGcpTrigger({ workspace, requestBody })
+			GcpTriggerService.createGcpTrigger({ workspace, requestBody }),
+		update: (workspace, path, requestBody) =>
+			GcpTriggerService.updateGcpTrigger({ workspace, path, requestBody })
 	},
 	azure: {
 		configFields: [
@@ -274,7 +296,9 @@ export const TRIGGER_KINDS: Record<
 		eeOnly: true,
 		list: (workspace) => AzureTriggerService.listAzureTriggers({ workspace }),
 		create: (workspace, requestBody) =>
-			AzureTriggerService.createAzureTrigger({ workspace, requestBody })
+			AzureTriggerService.createAzureTrigger({ workspace, requestBody }),
+		update: (workspace, path, requestBody) =>
+			AzureTriggerService.updateAzureTrigger({ workspace, path, requestBody })
 	},
 	postgres: {
 		configFields: [
@@ -288,7 +312,9 @@ export const TRIGGER_KINDS: Record<
 		resourceField: 'postgres_resource_path',
 		list: (workspace) => PostgresTriggerService.listPostgresTriggers({ workspace }),
 		create: (workspace, requestBody) =>
-			PostgresTriggerService.createPostgresTrigger({ workspace, requestBody })
+			PostgresTriggerService.createPostgresTrigger({ workspace, requestBody }),
+		update: (workspace, path, requestBody) =>
+			PostgresTriggerService.updatePostgresTrigger({ workspace, path, requestBody })
 	},
 	email: {
 		configFields: ['local_part', 'workspaced_local_part'],
@@ -297,7 +323,9 @@ export const TRIGGER_KINDS: Record<
 		note: 'Email address regenerates on import.',
 		list: (workspace) => EmailTriggerService.listEmailTriggers({ workspace }),
 		create: (workspace, requestBody) =>
-			EmailTriggerService.createEmailTrigger({ workspace, requestBody })
+			EmailTriggerService.createEmailTrigger({ workspace, requestBody }),
+		update: (workspace, path, requestBody) =>
+			EmailTriggerService.updateEmailTrigger({ workspace, path, requestBody })
 	}
 }
 
diff --git a/frontend/src/lib/components/workspaceSettings/projectBundle.test.ts b/frontend/src/lib/components/workspaceSettings/projectBundle.test.ts
index 669c0a43de..1833a33b33 100644
--- a/frontend/src/lib/components/workspaceSettings/projectBundle.test.ts
+++ b/frontend/src/lib/components/workspaceSettings/projectBundle.test.ts
@@ -16,6 +16,8 @@ import {
 	collectExportVarPaths,
 	extractTriggerConfigResourceRefs,
 	extractVarRefsFromValue,
+	projectReferencesResource,
+	textHoldsBarePath,
 	type ProjectExport,
 	type FetchedItem,
 	type ItemRef
@@ -867,3 +869,46 @@ describe('flow_env and preprocessor_module', () => {
 		expect(out.flow_env.PLAIN).toBe('not-a-ref')
 	})
 })
+
+describe('projectReferencesResource', () => {
+	/**
+	 * A project declares one resource per `resource-<type>` input schema as well as one per
+	 * `$res:` reference, so an app pinning `f/proj/google_calendar` for a script whose schema
+	 * says `resource-gcal` ships both it and an unreferenced `f/proj/gcal`. Only the pinned
+	 * one has to hold a credential for the project to work.
+	 */
+	const bundle = {
+		project: { slug: 'proj', name: 'Proj', summary: '', readme: null },
+		scripts: [{ path: 'f/proj/send', content: 'const c = "$res:f/proj/google_calendar"' }],
+		flows: [],
+		apps: [],
+		resources: [
+			{ path: 'f/proj/gcal', resource_type: 'gcal' },
+			{ path: 'f/proj/google_calendar', resource_type: 'gcal' },
+			{ path: 'f/proj/db', resource_type: 'postgresql' }
+		],
+		triggers: [{ path: 'f/proj/ingest', config: { postgres_resource_path: 'f/proj/db' } }]
+	} as unknown as ProjectExport
+
+	it("sees a $res: token and a trigger's bare path, and not a stub nothing points at", () => {
+		expect(projectReferencesResource(bundle, 'f/proj/google_calendar')).toBe(true)
+		expect(projectReferencesResource(bundle, 'f/proj/db')).toBe(true)
+		// Declared only because a script's input schema names the type.
+		expect(projectReferencesResource(bundle, 'f/proj/gcal')).toBe(false)
+	})
+})
+
+describe('textHoldsBarePath', () => {
+	// Gates three deletion decisions, and its two directions cost differently: a false yes
+	// keeps a stub nobody needed, a false no deletes one something still reads.
+	const P = 'f/proj/db'
+	it.each([
+		['a token only', `const c = "$res:${P}"`, false],
+		['a path written in code', `await getResource("${P}")`, true],
+		['both spellings', `"$res:${P}"; getResource("${P}")`, true],
+		['a longer path that starts the same', `await getResource("${P}_prod")`, false],
+		['the same path inside a longer token', `"$res:${P}_prod"`, false]
+	])('%s', (_label, text, expected) => {
+		expect(textHoldsBarePath(text, P)).toBe(expected)
+	})
+})
diff --git a/frontend/src/lib/components/workspaceSettings/projectBundle.ts b/frontend/src/lib/components/workspaceSettings/projectBundle.ts
index 1fd62498d5..8adedeb559 100644
--- a/frontend/src/lib/components/workspaceSettings/projectBundle.ts
+++ b/frontend/src/lib/components/workspaceSettings/projectBundle.ts
@@ -238,6 +238,89 @@ export function extractTriggerConfigResourceRefs(config: any): string[] {
 	return extractScriptRefs(JSON.stringify(config ?? {})).map((r) => r.path)
 }
 
+/**
+ * Whether a value reaches a resource, in either spelling a rewrite has to handle: a
+ * `$res:`/`res://` token embedded in content, or the bare path standing alone as a string
+ * the way trigger configs hold it (`kafka_resource_path: "f/slug/db"`).
+ *
+ * Matching the parsed structure rather than its serialization is what keeps
+ * `f/slug/db` out of `$res:f/slug/db_prod`.
+ */
+export function referencesResourcePath(value: unknown, path: string): boolean {
+	const walk = (v: any): boolean => {
+		if (typeof v === 'string') {
+			if (v === path) return true
+			RES_TOKEN_RE.lastIndex = 0
+			let m: RegExpExecArray | null
+			while ((m = RES_TOKEN_RE.exec(v)) !== null) if (m[1] === path) return true
+			return false
+		}
+		if (Array.isArray(v)) return v.some(walk)
+		if (v && typeof v === 'object') return Object.values(v).some(walk)
+		return false
+	}
+	return walk(value)
+}
+
+/**
+ * Whether a `$res:`/`res://` token for this path survives anywhere in the value — the one
+ * spelling the rewriters relocate, and so the only one whose survival means a rewrite did
+ * not take. A bare path is deliberately not matched: nothing here moves one, so its presence
+ * says nothing about whether the rewrite worked.
+ */
+export function holdsResourceToken(value: unknown, path: string): boolean {
+	const walk = (v: any): boolean => {
+		if (typeof v === 'string') {
+			RES_TOKEN_RE.lastIndex = 0
+			let m: RegExpExecArray | null
+			while ((m = RES_TOKEN_RE.exec(v)) !== null) if (m[1] === path) return true
+			return false
+		}
+		if (Array.isArray(v)) return v.some(walk)
+		if (v && typeof v === 'object') return Object.values(v).some(walk)
+		return false
+	}
+	return walk(value)
+}
+
+/**
+ * Whether the text names the resource somewhere no rewriter reaches — a path written on its
+ * own rather than inside a `$res:` token, the way `getResource("f/proj/db")` does. The
+ * tokens are stripped first so the ones a rewrite would move do not count, and the match is
+ * bounded so `f/proj/db` is not found inside `f/proj/db_prod`.
+ */
+export function textHoldsBarePath(text: string, path: string): boolean {
+	const withoutTokens = text.replace(RES_TOKEN_RE, '')
+	const boundary = /[\w\-./]/
+	for (let i = withoutTokens.indexOf(path); i !== -1; i = withoutTokens.indexOf(path, i + 1)) {
+		const before = withoutTokens[i - 1] ?? ''
+		const after = withoutTokens[i + path.length] ?? ''
+		if (!boundary.test(before) && !boundary.test(after)) return true
+	}
+	return false
+}
+
+/**
+ * Whether anything the project ships points at one of its own resources.
+ *
+ * A project declares two kinds of resource. One is referenced — an app pins `$res:` for a
+ * script argument, a trigger names it — and the project does not work until it holds a
+ * credential. The other is minted from a `resource-<type>` input schema: it names a type
+ * a script accepts, nothing points at it, and a standalone run picks a resource in the
+ * argument picker instead. Only the first kind is worth asking anyone to fill in.
+ *
+ * The `resources` list is excluded from the walk because a stub's own declaration carries
+ * its path, which would make every stub look referenced.
+ */
+export function projectReferencesResource(bundle: ProjectExport, path: string): boolean {
+	const { resources: _resources, ...rest } = bundle as any
+	if (referencesResourcePath(rest, path)) return true
+	// A script that reads the resource by name rather than through a `$res:` token still needs
+	// it filled in. Asked about is the safe side of this answer: the cost of a wrong yes is a
+	// row nobody had to act on, and of a wrong no a credential nobody was told to set up.
+	return textHoldsBarePath(JSON.stringify(rest ?? {}), path)
+}
+
 /**
  * Trigger configs reference resources as plain path strings (e.g.
  * `kafka_resource_path: "f/slug/db"`), not `$res:` tokens, so token rewriting
diff --git a/frontend/src/lib/importWizard/execution.svelte.ts b/frontend/src/lib/importWizard/execution.svelte.ts
index 06c33f3222..6a2c39b0b6 100644
--- a/frontend/src/lib/importWizard/execution.svelte.ts
+++ b/frontend/src/lib/importWizard/execution.svelte.ts
@@ -8,9 +8,10 @@ import {
 	installProject,
 	type InstallResult
 } from '$lib/components/workspaceSettings/projectInstall'
-import type {
-	ProjectExport,
-	ProjectMigration
+import {
+	projectReferencesResource,
+	type ProjectExport,
+	type ProjectMigration
 } from '$lib/components/workspaceSettings/projectBundle'
 import { planWorkspaceId, type ImportPlan } from './plan'
 import { probeImportedPaths, probeWorkspace } from './probe'
@@ -110,12 +111,16 @@ export class ImportExecution {
 	}
 
 	/**
-	 * How many resources the project shipped. Every one arrives as an empty stub —
-	 * the hub never publishes resource values — so a non-zero count means the setup
-	 * step has something to offer.
+	 * How many of the project's resources the setup step will ask about. Every resource
+	 * arrives as an empty stub — the hub never publishes resource values — but only the ones
+	 * something in the project points at have to hold a credential for it to work, and those
+	 * are the ones the step lists. Counting all of them here would offer a fourth step that
+	 * then has nothing on it.
 	 */
 	get resourceCount(): number {
-		return this.#export?.resources?.length ?? 0
+		const e = this.#export
+		if (!e) return 0
+		return (e.resources ?? []).filter((r) => projectReferencesResource(e, String(r.path))).length
 	}
 
 	get extraCounts(): { triggers: number; migrations: number } | undefined {
@@ -453,9 +458,7 @@ export class ImportExecution {
 		const problems: string[] = []
 		if (failed > 0) problems.push(`${failed} item${failed === 1 ? '' : 's'} failed to import`)
 		if (badMigrations > 0) {
-			problems.push(
-				`${badMigrations} data table migration${badMigrations === 1 ? '' : 's'} failed`
-			)
+			problems.push(`${badMigrations} data table migration${badMigrations === 1 ? '' : 's'} failed`)
 		}
 		if (problems.length) this.error = `${problems.join(', ')}.`
 	}
diff --git a/frontend/src/lib/importWizard/retargetDeployed.test.ts b/frontend/src/lib/importWizard/retargetDeployed.test.ts
new file mode 100644
index 0000000000..adf7a4c795
--- /dev/null
+++ b/frontend/src/lib/importWizard/retargetDeployed.test.ts
@@ -0,0 +1,393 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+/**
+ * The safety property: the stub survives anything the scan cannot account for. Rewriting an
+ * item onto the chosen resource is safe on its own, so it always happens; deleting the stub
+ * while an item still reads it is what breaks the imported project, and that item is exactly
+ * the one nobody looks at afterwards.
+ */
+
+const state = vi.hoisted(() => ({
+	apps: [] as any[],
+	scripts: [] as any[],
+	triggers: [] as any[],
+	scheduleListError: undefined as any,
+	failingTriggerPath: undefined as string | undefined,
+	deployedJs: 'COMPILED',
+	deletedResources: [] as string[],
+	updatedRawApps: [] as any[],
+	updatedApps: [] as any[],
+	updatedFlows: [] as any[],
+	flows: [] as any[],
+	updatedTriggers: [] as any[]
+}))
+
+vi.mock('$lib/gen', () => ({
+	ScriptService: {
+		listSearchScript: vi.fn(async () => state.scripts),
+		getScriptByPath: vi.fn(),
+		createScript: vi.fn()
+	},
+	FlowService: {
+		listSearchFlow: vi.fn(async () => state.flows),
+		getFlowByPath: vi.fn(async ({ path }: any) => state.flows.find((f: any) => f.path === path)),
+		updateFlow: vi.fn(async (p: any) => state.updatedFlows.push(p))
+	},
+	AppService: {
+		listSearchApp: vi.fn(async () => state.apps),
+		getAppByPath: vi.fn(async ({ path }: any) => state.apps.find((a) => a.path === path)),
+		getPublicSecretOfLatestVersionOfApp: vi.fn(async () => 'secret'),
+		updateApp: vi.fn(async (p: any) => state.updatedApps.push(p)),
+		updateAppRaw: vi.fn(async (p: any) => state.updatedRawApps.push(p))
+	},
+	ScheduleService: { updateSchedule: vi.fn() },
+	ResourceService: {
+		deleteResource: vi.fn(async ({ path }: any) => state.deletedResources.push(path))
+	}
+}))
+
+vi.mock('$lib/components/triggers/workspaceTriggersList', () => ({
+	TRIGGER_KINDS: {
+		schedule: {
+			badge: 'Schedule',
+			list: vi.fn(async () => {
+				if (state.scheduleListError) throw state.scheduleListError
+				return []
+			})
+		},
+		postgres: {
+			badge: 'Postgres',
+			list: vi.fn(async () => state.triggers),
+			update: vi.fn(async (_w: string, path: string, body: any) => {
+				if (path === state.failingTriggerPath) throw new Error('the update was rejected')
+				state.updatedTriggers.push({ path, body })
+			})
+		}
+	},
+	WORKSPACE_TRIGGER_KINDS: ['schedule', 'postgres'],
+	createWorkspaceTriggerDisabled: vi.fn(),
+	triggerHandlerRefs: () => []
+}))
+
+vi.mock('$lib/components/apps/editor/appPolicy', () => ({ updatePolicy: vi.fn(async () => ({})) }))
+vi.mock('$lib/sharedUtils', () => ({ updateRawAppPolicy: vi.fn(async () => ({})) }))
+
+// The deployed bundle is served by secret, not through the generated client.
+vi.stubGlobal(
+	'fetch',
+	vi.fn(async (url: string) => ({
+		ok: true,
+		status: 200,
+		text: async () => (url.endsWith('.js') ? state.deployedJs : 'STYLES')
+	}))
+)
+
+import { applyRetarget, seesWholeWorkspace } from './retargetDeployed'
+
+const FROM = 'f/proj/smtp'
+const TO = 'f/shared/company_smtp'
+
+/** A deployed raw app: sources plus runnables, with the bundle stored out of the value. */
+const rawApp = {
+	path: 'f/proj/dash',
+	raw_app: true,
+	value: { files: { '/App.tsx': 'v1' }, runnables: { send: { fields: { smtp: `$res:${FROM}` } } } }
+}
+
+async function run() {
+	return applyRetarget({
+		workspace: 'w',
+		folder: 'proj',
+		from: FROM,
+		to: TO,
+		seesWholeWorkspace: true
+	})
+}
+
+describe('applyRetarget', () => {
+	beforeEach(() => {
+		state.apps = [rawApp]
+		state.scripts = []
+		state.triggers = []
+		state.deployedJs = 'COMPILED'
+		state.scheduleListError = undefined
+		state.failingTriggerPath = undefined
+		state.deletedResources = []
+		state.updatedRawApps = []
+		state.updatedApps = []
+		state.flows = []
+		state.updatedFlows = []
+		state.updatedTriggers = []
+	})
+
+	// `updateAppRaw` refuses without a bundle, and the browser cannot rebuild one. The bundle
+	// that goes back is the deployed one, read back by secret.
+	it('sends the deployed bundle back with the rewritten value, then drops the stub', async () => {
+		const outcome = await run()
+		expect(outcome.error).toBeUndefined()
+		expect(outcome.gaps).toEqual([])
+		expect(outcome.stubDeleted).toBe(true)
+		expect(state.deletedResources).toEqual([FROM])
+		const sent = state.updatedRawApps[0]
+		expect(sent.formData.js).toBe('COMPILED')
+		expect(sent.formData.css).toBe('STYLES')
+		// Rewritten, and the bundle entries stay out of the value the way the import leaves them.
+		expect(JSON.stringify(sent.formData.app.value)).toContain(`$res:${TO}`)
+		expect(Object.keys(sent.formData.app.value.files)).toEqual(['/App.tsx'])
+	})
+
+	// The bundle is compiled from the sources, so a `$res:` a source spells out is baked into
+	// it. `retargetProjectExport` rewrites that copy on import, while /bundle.js is still one
+	// of `files` — sending the deployed bundle back untouched would undo exactly that.
+	it("rewrites the deployed bundle's own tokens before sending it back", async () => {
+		state.deployedJs = `const cfg = "$res:${FROM}"; export default cfg`
+		const outcome = await run()
+		expect(outcome.error).toBeUndefined()
+		expect(outcome.stubDeleted).toBe(true)
+		const sent = state.updatedRawApps[0]
+		expect(sent.formData.js).toContain(`$res:${TO}`)
+		expect(sent.formData.js).not.toContain(`$res:${FROM}`)
+	})
+
+	// A path the bundle names any other way is one nothing here can move, so the app is left
+	// alone and the stub it still reads has to survive.
+	it('keeps the stub when the bundle names the resource outside a $res: token', async () => {
+		state.deployedJs = `const cfg = await getResource("${FROM}")`
+		const outcome = await run()
+		expect(outcome.error).toBeUndefined()
+		expect(outcome.stubDeleted).toBe(false)
+		expect(state.deletedResources).toEqual([])
+		expect(state.updatedRawApps).toEqual([])
+	})
+
+	// The path written inside a source file is a reference too, and no rewriter reaches it.
+	//
+	it('keeps the stub when a source file names the resource in code', async () => {
+		state.apps = [
+			{
+				path: 'f/proj/dash',
+				raw_app: true,
+				value: {
+					files: { '/App.tsx': `const c = await getResource("${FROM}")` },
+					runnables: {}
+				}
+			}
+		]
+		const outcome = await run()
+		expect(outcome.error).toBeUndefined()
+		expect(outcome.stubDeleted).toBe(false)
+		expect(state.deletedResources).toEqual([])
+		expect(state.updatedRawApps).toEqual([])
+	})
+
+	// A trigger holds its resource as a bare path in its own column, not as a `$res:` token.
+	it('finds a trigger that holds the resource as a bare path', async () => {
+		state.apps = []
+		state.triggers = [
+			{
+				path: 'f/proj/ingest',
+				script_path: 'f/proj/run',
+				postgres_resource_path: FROM,
+				permissioned_as: 'u/service_account',
+				enabled: true
+			}
+		]
+		const outcome = await run()
+		expect(outcome.error).toBeUndefined()
+		expect(state.updatedTriggers[0].body.postgres_resource_path).toBe(TO)
+		// The trigger keeps its own path even though it was the string being remapped.
+		expect(state.updatedTriggers[0].path).toBe('f/proj/ingest')
+		// Pointing a trigger at a credential must not also start it: `enabled` is left out so
+		// the backend keeps whatever the trigger is set to.
+		expect(state.updatedTriggers[0].body).not.toHaveProperty('enabled')
+		// Nor run it as whoever picked the credential: a trigger states its identity as
+		// `permissioned_as`, which the backend keeps only when told to preserve it.
+		expect(state.updatedTriggers[0].body.permissioned_as).toBe('u/service_account')
+		expect(state.updatedTriggers[0].body.preserve_permissioned_as).toBe(true)
+		expect(state.deletedResources).toEqual([FROM])
+	})
+
+	// The stub is what a reference this run did not move still resolves through, so a write
+	// that fails partway must not take it: the moved items and the rest both keep working.
+	it('keeps the stub when a write fails, and reports what had already moved', async () => {
+		state.apps = []
+		state.triggers = [
+			{ path: 'f/proj/first', postgres_resource_path: FROM },
+			{ path: 'f/proj/second', postgres_resource_path: FROM }
+		]
+		state.failingTriggerPath = 'f/proj/second'
+		const outcome = await run()
+		expect(outcome.error).toContain('the update was rejected')
+		expect(outcome.rewritten.map((r) => r.path)).toEqual(['f/proj/first'])
+		expect(outcome.stubDeleted).toBe(false)
+		expect(state.deletedResources).toEqual([])
+	})
+
+	// Most trigger kinds are cargo features an instance may not compile in, and their routes
+	// then 404. Reading that as a failed listing keeps the stub on every stock build.
+	it('drops the stub when a trigger kind is not compiled in, keeps it when one truly fails', async () => {
+		state.scheduleListError = { status: 404 }
+		expect((await run()).gaps).toEqual([])
+		expect(state.deletedResources).toEqual([FROM])
+
+		state.deletedResources = []
+		state.scheduleListError = { status: 500 }
+		expect((await run()).gaps.map((g) => g.path)).toContain('Schedule triggers')
+		expect(state.deletedResources).toEqual([])
+	})
+
+	// The referrer scan matches a bare path anywhere in an app's value, while the rewriter only
+	// relocates `$res:` tokens and runnable paths. Rewriting such an app would claim a move that
+	// did not happen, and the stub it still reads would go.
+	it('leaves an app holding the resource path as a bare string alone, and keeps the stub', async () => {
+		state.apps = [
+			{
+				path: 'f/proj/page',
+				value: { grid: [{ data: { input: { type: 'static', value: FROM } } }] }
+			}
+		]
+		const outcome = await run()
+		expect(outcome.rewritten).toEqual([])
+		expect(outcome.gaps.map((g) => g.path)).toEqual(['f/proj/page'])
+		expect(state.deletedResources).toEqual([])
+	})
+
+	// Both spellings at once. The token is moved so the item stops depending on the stub for
+	// what it could, and the mention it spells out still keeps the stub alive.
+	it('rewrites the token of an app that also names the resource in code, and keeps the stub', async () => {
+		state.apps = [
+			{
+				path: 'f/proj/dash',
+				raw_app: true,
+				value: {
+					files: { '/App.tsx': `// the credential lives at ${FROM}` },
+					runnables: { send: { fields: { smtp: `$res:${FROM}` } } }
+				}
+			}
+		]
+		const outcome = await run()
+		expect(outcome.error).toBeUndefined()
+		expect(outcome.rewritten.map((r) => r.path)).toEqual(['f/proj/dash'])
+		expect(outcome.gaps.map((g) => g.path)).toEqual(['f/proj/dash'])
+		expect(outcome.stubDeleted).toBe(false)
+		expect(JSON.stringify(state.updatedRawApps[0].formData.app.value)).toContain(`$res:${TO}`)
+	})
+
+	// Scripts, flows and resources share a path namespace, and the map holds a resource path.
+	// The import's rewriters remap a runnable's own `path` on an exact match, which here would
+	// repoint the step at the credential.
+	it("moves an app's tokens without repointing a runnable that shares the path", async () => {
+		state.apps = [
+			{
+				path: 'f/proj/page',
+				value: {
+					grid: [{ data: { type: 'runnableByPath', runType: 'script', path: FROM } }],
+					inline: `$res:${FROM}`
+				}
+			}
+		]
+		const outcome = await run()
+		expect(outcome.error).toBeUndefined()
+		const sent = state.updatedApps[0]
+		expect(sent.requestBody.value.inline).toBe(`$res:${TO}`)
+		expect(sent.requestBody.value.grid[0].data.path).toBe(FROM)
+	})
+
+	// A token moves wherever it sits in the value, and a step's own path is left alone.
+	it('moves a flow token outside the fields the import rewriter reached', async () => {
+		state.flows = [
+			{
+				path: 'f/proj/pipeline',
+				value: {
+					modules: [
+						{ id: 'a', summary: `reads $res:${FROM}`, value: { type: 'script', path: FROM } }
+					]
+				}
+			}
+		]
+		const outcome = await run()
+		expect(outcome.error).toBeUndefined()
+		const sent = state.updatedFlows[0]
+		expect(sent.requestBody.value.modules[0].summary).toBe(`reads $res:${TO}`)
+		expect(sent.requestBody.value.modules[0].value.path).toBe(FROM)
+	})
+
+	// The listings run as the caller and row-level security filters them inside the query, so
+	// an item a member cannot read is invisible rather than counted. The stub has to outlive
+	// a scan that cannot see the whole workspace.
+	it('keeps the stub when the caller is not shown the whole workspace', async () => {
+		const outcome = await applyRetarget({
+			workspace: 'w',
+			folder: 'proj',
+			from: FROM,
+			to: TO,
+			seesWholeWorkspace: false
+		})
+		expect(outcome.error).toBeUndefined()
+		expect(outcome.stubDeleted).toBe(false)
+		expect(state.deletedResources).toEqual([])
+		expect(outcome.gaps.map((g) => g.path)).toContain('This workspace')
+	})
+
+	// A handler field names a runnable, and the map holds a resource path. A script sharing
+	// that path is not the reference being moved.
+	it("moves a trigger's resource field without repointing its error handler", async () => {
+		state.apps = []
+		state.triggers = [
+			{
+				path: 'f/proj/ingest',
+				script_path: 'f/proj/run',
+				postgres_resource_path: FROM,
+				on_failure: `script/${FROM}`,
+				error_handler_path: FROM,
+				permissioned_as: 'u/service_account'
+			}
+		]
+		const outcome = await run()
+		expect(outcome.error).toBeUndefined()
+		expect(state.updatedTriggers[0].body.postgres_resource_path).toBe(TO)
+		expect(state.updatedTriggers[0].body.on_failure).toBe(`script/${FROM}`)
+		// The bare spelling too: a handler path is a path and never a `$res:` token.
+		expect(state.updatedTriggers[0].body.error_handler_path).toBe(FROM)
+	})
+
+	// `listSearchApp` caps at 1000 rows server-side, unordered and unpaginated, so a full page
+	// may not hold the project's own app — and the stub would go anyway.
+	it('keeps the stub when the app listing comes back at its server-side cap', async () => {
+		state.apps = Array.from({ length: 1000 }, (_, i) => ({ path: `f/other/a${i}`, value: {} }))
+		const outcome = await run()
+		expect(outcome.gaps.map((g) => g.path)).toContain('Apps')
+		expect(state.deletedResources).toEqual([])
+	})
+
+	// The listings are workspace-wide. An item outside the project's folder is the user's own,
+	// so it is not rewritten — and it is exactly why the stub it reads has to stay.
+	it('rewrites what it owns and keeps the stub for a reference outside the project', async () => {
+		state.apps = []
+		state.scripts = [{ path: 'u/alice/report', content: `$res:${FROM}` }]
+		state.triggers = [
+			{ path: 'f/proj/ingest', script_path: 'f/proj/run', postgres_resource_path: FROM }
+		]
+		const outcome = await run()
+		expect(outcome.error).toBeUndefined()
+		expect(state.updatedTriggers[0].body.postgres_resource_path).toBe(TO)
+		expect(outcome.gaps.map((g) => g.path)).toEqual(['u/alice/report'])
+		expect(outcome.stubDeleted).toBe(false)
+		expect(state.deletedResources).toEqual([])
+	})
+})
+
+describe('seesWholeWorkspace', () => {
+	// The user record is per-workspace and survives a workspace change, so reading `is_admin`
+	// without checking which workspace it describes answers for the wrong one — and a wrong
+	// yes here is what lets an RLS-filtered scan clear the stub for deletion.
+	it.each([
+		['admin of this workspace', { workspace_id: 'w', is_admin: true }, false, true],
+		['admin of another workspace', { workspace_id: 'other', is_admin: true }, false, false],
+		['member of this workspace', { workspace_id: 'w', is_admin: false }, false, false],
+		['superadmin, record stale', { workspace_id: 'other', is_admin: false }, true, true],
+		['no user record', undefined, false, false]
+	])('%s', (_label, user, isSuperadmin, expected) => {
+		expect(seesWholeWorkspace(user as any, isSuperadmin, 'w')).toBe(expected)
+	})
+})
diff --git a/frontend/src/lib/importWizard/retargetDeployed.ts b/frontend/src/lib/importWizard/retargetDeployed.ts
new file mode 100644
index 0000000000..b33a69a667
--- /dev/null
+++ b/frontend/src/lib/importWizard/retargetDeployed.ts
@@ -0,0 +1,650 @@
+/**
+ * Point an already-imported project at a resource the workspace already has.
+ *
+ * The import writes `$res:f/<folder>/<name>` into every item that uses the project's
+ * resource — except a trigger, which holds the bare path in its own `*_resource_path`
+ * field. This rewrites those references to an existing resource, so the project reads the
+ * workspace's own credential — the same end state the import would have produced, reached
+ * after the fact.
+ *
+ * Two rules make that safe to run over deployed items:
+ *
+ *  - Only items inside the project's folder are rewritten. The import wrote nothing outside
+ *    it, so a reference from elsewhere is the user's own and not ours to move.
+ *  - The stub is deleted only when the scan can prove it saw every reference to it.
+ *    Listings come back capped, a trigger kind can fail to list, a reference can sit where no
+ *    rewriter reaches, and the listings themselves are row-level-security filtered so a
+ *    caller who is not a workspace admin is not shown every item — each of those is a gap,
+ *    and any gap keeps the stub.
+ *
+ * Rewriting is separable from deleting, and only the delete is destructive. An item moved
+ * onto the chosen resource resolves whether or not the stub survives; an item the scan never
+ * saw resolves only while the stub is there. So an incomplete scan downgrades the run to
+ * "rewritten, stub kept" rather than refusing it — the outcome names the gaps so the caller
+ * can say the placeholder is still around.
+ */
+
+import { AppService, FlowService, ResourceService, ScheduleService, ScriptService } from '$lib/gen'
+import {
+	rewriteContent,
+	rewriteTriggerConfig,
+	referencesResourcePath,
+	holdsResourceToken,
+	textHoldsBarePath
+} from '$lib/components/workspaceSettings/projectBundle'
+import {
+	TRIGGER_KINDS,
+	WORKSPACE_TRIGGER_KINDS,
+	type WorkspaceTriggerKind
+} from '$lib/components/triggers/workspaceTriggersList'
+import { updatePolicy } from '$lib/components/apps/editor/appPolicy'
+import { updateRawAppPolicy } from '$lib/sharedUtils'
+import type { App } from '$lib/components/apps/types'
+import { apiErrorMessage as errorMessage } from '$lib/utils'
+
+export type ReferrerKind = 'script' | 'flow' | 'app' | 'trigger'
+
+export interface Referrer {
+	kind: ReferrerKind
+	path: string
+	/** Present for triggers: which kind's table it lives in. */
+	triggerKind?: WorkspaceTriggerKind
+	/**
+	 * The plan already recorded this item as naming the path somewhere no rewrite reaches, so
+	 * the stub survives whatever the write does. Its tokens are still worth moving, and the
+	 * write's own staleness check has nothing left to add.
+	 */
+	gapped?: true
+	/**
+	 * Present for triggers: the row the scan read, which is also what the write sends back.
+	 * Re-reading it costs another listing of the whole kind per trigger — and for schedules a
+	 * listing plus a detail fetch per row, since `list` resolves each one.
+	 */
+	row?: Record<string, any>
+}
+
+/** Something the scan could not account for. `path` names an item, or a listing standing in
+ *  for every item it failed to return. */
+export interface Gap {
+	path: string
+	reason: string
+}
+
+export interface RetargetPlan {
+	/** Items whose reference this run will move. */
+	referrers: Referrer[]
+	/**
+	 * Why the scan cannot claim it saw every reference to the stub. Empty is the only state
+	 * in which deleting the stub is provably safe.
+	 */
+	gaps: Gap[]
+}
+
+export interface RetargetOutcome {
+	/** Items now reading the chosen resource. */
+	rewritten: Referrer[]
+	/** Why the stub was kept, when it was. */
+	gaps: Gap[]
+	stubDeleted: boolean
+	/** Set when a write failed. The run stopped there and the stub stays, so what was
+	 *  rewritten before it and what was not both resolve. */
+	error?: string
+}
+
+/**
+ * Whether this caller's listings are the whole workspace, and so whether a clean scan proves
+ * anything. Row-level security filters the listings inside the query for everyone else.
+ *
+ * `UserExt` is per-workspace and outlives a workspace change, so the role is only this
+ * workspace's role when the record says it is. On the setup step's reload path nothing
+ * re-fetches it, and it still describes the workspace the user came from — reading
+ * `is_admin` alone there answers for the wrong workspace. An instance superadmin bypasses
+ * the policies everywhere, which is why it is asked separately.
+ */
+export function seesWholeWorkspace(
+	user: { workspace_id?: string; is_admin?: boolean } | undefined,
+	isSuperadmin: boolean,
+	workspace: string
+): boolean {
+	if (isSuperadmin) return true
+	return !!user?.is_admin && user.workspace_id === workspace
+}
+
+/** Everything under the project's folder, which is all this rewrites. */
+function inFolder(path: unknown, folder: string): boolean {
+	return typeof path === 'string' && path.startsWith(`f/${folder}/`)
+}
+
+/**
+ * Whether the item names the resource path anywhere a rewriter would not reach it.
+ *
+ * A script, flow or app spells a reference the rewriters move as a `$res:` token and nothing
+ * else. The path appearing any other way is either a reference beyond them — a static string
+ * value in a component, an argument inline code assembles itself — or not the resource at
+ * all, such as a step running a script that happens to share the path. Neither is rewritable:
+ * moving the first is beyond the rewriters, and moving the second would repoint a runnable at
+ * a credential. Both are reasons the stub has to outlive the run.
+ *
+ * The whole serialized item is searched, because inline code is a string inside it and a path
+ * written in code is no less a reference for being surrounded by other characters. Triggers
+ * are the exception and hold the bare path by design, so they never come here.
+ */
+function namesPathUnreachably(value: unknown, path: string): boolean {
+	return textHoldsBarePath(JSON.stringify(value ?? null), path)
+}
+
+/**
+ * What each `listSearch*` endpoint caps its answer at, server-side. The queries carry no
+ * `ORDER BY` and the routes take no pagination, so a full page is an arbitrary subset with no
+ * page two to ask for.
+ *
+ * A full page is a sound truncation test only for an unscoped caller, which a wizard session
+ * is. The server applies its scope-path predicate to the rows the `LIMIT` already returned,
+ * so a scoped token can be handed a short page cut from a truncated query — reuse this scan
+ * under one and the cap goes undetected.
+ */
+const SEARCH_LIMITS = { script: 10000, flow: 1000, app: 1000 }
+
+/**
+ * What a trigger listing caps at. The kinds' list routes take pagination this table does not
+ * pass, so each answers with the server's `DEFAULT_PER_PAGE`. A full page is read the same
+ * way as a full `listSearch*` page: as a listing that cannot account for the rest.
+ */
+const TRIGGER_LIST_LIMIT = 1000
+
+/**
+ * Where a trigger names a runnable, taken from what `triggerHandlerRefs` reads.
+ *
+ * `rewriteTriggerConfig` remaps a runnable reference on an exact path match, which is right
+ * for the folder-wide map the import hands it and wrong for a map holding one resource path:
+ * a script sharing that path is not the reference being moved, and remapping it makes the
+ * trigger run a resource. So these are put back from the row after the rewrite.
+ *
+ * Split by spelling, because only one of the two can also hold a `$res:` token. A prefixed
+ * field is restored only when it holds the runnable spelling, so a token in it still moves;
+ * a bare field is a path and nothing else, so it is always restored.
+ */
+const PREFIXED_RUNNABLE_FIELDS = ['on_failure', 'on_recovery', 'on_success', 'url']
+const PREFIXED_RUNNABLE_RE = /^(?:\$(?:script|flow):|(?:script|flow)\/)/
+const BARE_RUNNABLE_FIELDS = ['dynamic_skip', 'error_handler_path', 'script_path']
+
+/** The rewritten config with every runnable reference put back as the row holds it. */
+function restoreRunnableRefs(rewritten: any, row: any): any {
+	const out = { ...rewritten }
+	for (const k of PREFIXED_RUNNABLE_FIELDS) {
+		if (typeof row?.[k] === 'string' && PREFIXED_RUNNABLE_RE.test(row[k])) out[k] = row[k]
+	}
+	for (const k of BARE_RUNNABLE_FIELDS) {
+		if (typeof row?.[k] === 'string') out[k] = row[k]
+	}
+	// A websocket's initial messages can each carry a runnable result, whose `path` is bare.
+	// Only that field is put back; the rest of the message is rewritten like any other value.
+	if (Array.isArray(out.initial_messages)) {
+		out.initial_messages = out.initial_messages.map((m: any, i: number) => {
+			const was = row?.initial_messages?.[i]?.runnable_result?.path
+			return m?.runnable_result && typeof was === 'string'
+				? { ...m, runnable_result: { ...m.runnable_result, path: was } }
+				: m
+		})
+	}
+	return out
+}
+
+/** A reference this run will not move, recorded so the stub outlives it. */
+const OUTSIDE_PROJECT = 'reads this resource from outside the project'
+const UNSEEN_BY_CALLER = 'holds items this account is not shown'
+const UNREACHABLE_REFERENCE = 'names the resource path outside a $res: reference'
+
+/**
+ * Which deployed items reference the stub, which of them this run can move, and what it
+ * could not account for.
+ *
+ * The `listSearch*` endpoints return each item's content in one call per kind, so this is
+ * three calls plus one per trigger kind rather than one per item.
+ */
+export async function planRetarget(
+	workspace: string,
+	folder: string,
+	from: string,
+	opts: { seesWholeWorkspace: boolean }
+): Promise<RetargetPlan> {
+	const referrers: Referrer[] = []
+	const gaps: Gap[] = []
+
+	// The listings run as the caller. Row-level security filters the rows out inside the
+	// query, so an item this account cannot read is not merely absent from the answer — it
+	// does not count towards the full-page test either, and nothing downstream can notice it.
+	// A colleague's private script reading this stub is exactly that shape.
+	if (!opts.seesWholeWorkspace) gaps.push({ path: 'This workspace', reason: UNSEEN_BY_CALLER })
+
+	const [scripts, flows, apps] = await Promise.all([
+		ScriptService.listSearchScript({ workspace }),
+		FlowService.listSearchFlow({ workspace }),
+		AppService.listSearchApp({ workspace })
+	])
+
+	for (const [label, rows, limit] of [
+		['Scripts', scripts, SEARCH_LIMITS.script],
+		['Flows', flows, SEARCH_LIMITS.flow],
+		['Apps', apps, SEARCH_LIMITS.app]
+	] as const) {
+		if ((rows?.length ?? 0) >= limit) gaps.push({ path: label, reason: 'could not all be listed' })
+	}
+
+	// The listings are workspace-wide, so an item outside the folder is seen for free. It is
+	// the user's own and stays on the stub, which is the whole reason the stub stays too.
+	for (const s of scripts ?? []) {
+		const content = String(s.content ?? '')
+		const reads = referencesResourcePath(content, from)
+		// `rewriteContent` moves the `$res:` tokens and nothing else, so a path the code spells
+		// out is a reference this run leaves behind.
+		const bare = textHoldsBarePath(content, from)
+		if (!reads && !bare) continue
+		if (!inFolder(s.path, folder)) {
+			gaps.push({ path: s.path!, reason: OUTSIDE_PROJECT })
+			continue
+		}
+		if (bare) {
+			gaps.push({ path: s.path!, reason: UNREACHABLE_REFERENCE })
+			if (!reads) continue
+		}
+		referrers.push({ kind: 'script', path: s.path!, ...(bare ? { gapped: true as const } : {}) })
+	}
+	for (const f of flows ?? []) {
+		const value: any = f.value ?? {}
+		// A token is the only spelling a rewriter moves. `referencesResourcePath` would also
+		// count a whole string equal to the path, which is the unreachable case `bare` covers.
+		const reads = holdsResourceToken(value, from)
+		const bare = namesPathUnreachably(value, from)
+		if (!reads && !bare) continue
+		if (!inFolder(f.path, folder)) {
+			gaps.push({ path: f.path!, reason: OUTSIDE_PROJECT })
+			continue
+		}
+		if (bare) {
+			gaps.push({ path: f.path!, reason: UNREACHABLE_REFERENCE })
+			if (!reads) continue
+		}
+		const gapped = bare ? ({ gapped: true } as const) : undefined
+		referrers.push({ kind: 'flow', path: f.path!, ...gapped })
+	}
+	for (const a of apps ?? []) {
+		const value: any = a.value ?? {}
+		// A token is the only spelling a rewriter moves. `referencesResourcePath` would also
+		// count a whole string equal to the path, which is the unreachable case `bare` covers.
+		const reads = holdsResourceToken(value, from)
+		const bare = namesPathUnreachably(value, from)
+		if (!reads && !bare) continue
+		if (!inFolder(a.path, folder)) {
+			gaps.push({ path: a.path!, reason: OUTSIDE_PROJECT })
+			continue
+		}
+		if (bare) {
+			gaps.push({ path: a.path!, reason: UNREACHABLE_REFERENCE })
+			if (!reads) continue
+		}
+		const gapped = bare ? ({ gapped: true } as const) : undefined
+		referrers.push({ kind: 'app', path: a.path!, ...gapped })
+	}
+
+	for (const kind of WORKSPACE_TRIGGER_KINDS) {
+		const def = TRIGGER_KINDS[kind]
+		// No `eeOnly` skip. That reads a client-side store, which is empty on an EE instance
+		// whose licence is unset or whose fetch failed — while the rows are still in the
+		// database and the routes still answer. A kind skipped that way leaves no gap, so the
+		// stub would go while an EE trigger still points at it. On CE the routes are not
+		// registered and the 404 below says so, from the server.
+		let rows: Array<Record<string, any>> = []
+		// A 404 is not an incomplete listing — the instance has that trigger feature compiled
+		// out, so there is no trigger of the kind to have missed. Anything else means triggers
+		// of this kind may reference the stub without this ever seeing them.
+		let incomplete = false
+		try {
+			rows = await def.list(workspace, () => (incomplete = true))
+		} catch (e: any) {
+			if (e?.status === 404) continue
+			incomplete = true
+		}
+		if (incomplete) {
+			gaps.push({ path: `${def.badge} triggers`, reason: 'could not be listed' })
+			continue
+		}
+		if (rows.length >= TRIGGER_LIST_LIMIT) {
+			gaps.push({ path: `${def.badge} triggers`, reason: 'could not all be listed' })
+			continue
+		}
+		for (const t of rows) {
+			if (!referencesResourcePath(t, from)) continue
+			if (!inFolder(t.path, folder)) {
+				gaps.push({ path: String(t.path), reason: OUTSIDE_PROJECT })
+				continue
+			}
+			// `schedule` has no `update` in the table because its service takes a different body
+			// shape; `rewriteTrigger` handles it directly, the way the import's create does.
+			if (kind !== 'schedule' && !def.update) {
+				gaps.push({
+					path: String(t.path),
+					reason: `${def.badge} triggers cannot be updated from here`
+				})
+				continue
+			}
+			referrers.push({ kind: 'trigger', path: String(t.path), triggerKind: kind, row: t })
+		}
+	}
+
+	return { referrers, gaps }
+}
+
+/**
+ * Rewrite every referrer the plan found, then delete the stub if the plan came back clean.
+ *
+ * A gap never stops the rewriting — moving an item onto the chosen resource is safe on its
+ * own. It stops only the delete, which is the one step that can strand a reference nobody
+ * looked at.
+ */
+export async function applyRetarget(args: {
+	workspace: string
+	folder: string
+	from: string
+	to: string
+	/** Whether the listings the scan reads are the whole workspace. See `planRetarget`. */
+	seesWholeWorkspace: boolean
+}): Promise<RetargetOutcome> {
+	const { workspace, folder, from, to, seesWholeWorkspace } = args
+	const map = new Map([[from, to]])
+	const rewritten: Referrer[] = []
+
+	const plan = await planRetarget(workspace, folder, from, { seesWholeWorkspace })
+	const gaps = [...plan.gaps]
+
+	for (const r of plan.referrers) {
+		let moved: true | string
+		try {
+			if (r.kind === 'script') moved = await rewriteScript(workspace, r, map)
+			else if (r.kind === 'flow') moved = await rewriteFlow(workspace, r, map)
+			else if (r.kind === 'app') moved = await rewriteApp(workspace, r, map)
+			else moved = await rewriteTrigger(workspace, r, map)
+		} catch (e: any) {
+			return { rewritten, gaps, stubDeleted: false, error: errorMessage(e) }
+		}
+		if (moved === true) rewritten.push(r)
+		else gaps.push({ path: r.path, reason: moved })
+	}
+
+	if (gaps.length > 0) return { rewritten, gaps, stubDeleted: false }
+
+	try {
+		await ResourceService.deleteResource({ workspace, path: from })
+	} catch (e: any) {
+		return { rewritten, gaps, stubDeleted: false, error: errorMessage(e) }
+	}
+	return { rewritten, gaps, stubDeleted: true }
+}
+
+/**
+ * The rewrite this module needs: `$res:` tokens and nothing else.
+ *
+ * `rewriteFlowValue` and `rewriteAppValue` also remap a runnable's own `path` on an exact
+ * match. That is right for the folder-wide map the import hands them, where every path is
+ * moving. Here the map holds one entry, a resource path — and scripts, flows and resources
+ * share a namespace, so a project shipping both a script and a resource named `smtp` would
+ * have the step calling `f/<folder>/smtp` repointed at the credential. Rewriting the
+ * serialized value moves the tokens and leaves every path alone.
+ */
+function rewriteTokens<T>(value: T, map: Map<string, string>): T {
+	return JSON.parse(rewriteContent(JSON.stringify(value ?? null), map))
+}
+
+/**
+ * Whether the item as just read names a path where no rewrite reaches it.
+ *
+ * The plan classifies items from the `listSearch*` rows; every rewriter then re-reads its
+ * item by path. A value that has gained an unreachable mention in between is one the plan
+ * cleared and the write must not: rewriting its tokens is fine, but the stub it still names
+ * has to survive. Checking the read the write is about to send is the only place that can be
+ * seen.
+ */
+function readsPathUnreachably(value: unknown, map: Map<string, string>): boolean {
+	for (const from of map.keys()) if (namesPathUnreachably(value, from)) return true
+	return false
+}
+
+/**
+ * Every write here is an in-place edit of a deployed item, not a redeployment by whoever
+ * opened the wizard, so each one has to say so.
+ *
+ * `preserve_on_behalf_of` is the flag that says it. Without it the backend replaces the
+ * item's stored run identity with the caller's — `resolve_on_behalf_of` for scripts and
+ * flows, the `should_preserve` branch of `update_app` for apps — and an imported item that
+ * ran as a service account would silently start running as the person who picked a
+ * credential. The backend still gates it on `wm_deployers` membership, so a caller who
+ * cannot preserve gets what they would have got anyway.
+ *
+ * For apps the policy is the other half: it carries the run identity, the execution mode and
+ * the sandbox rules, so it is read from the deployed app and handed back to the recompute
+ * rather than rebuilt from nothing.
+ */
+const PRESERVE_DEPLOYED_IDENTITY = { preserve_on_behalf_of: true }
+
+/**
+ * A new script version, the way the editor saves one. Spread rather than field-by-field:
+ * `Script` and `NewScript` share their names, and listing them here would silently drop
+ * whichever field someone adds next.
+ */
+async function rewriteScript(
+	workspace: string,
+	r: Referrer,
+	map: Map<string, string>
+): Promise<true | string> {
+	const path = r.path
+	const s: any = await ScriptService.getScriptByPath({ workspace, path })
+	if (!r.gapped)
+		for (const stub of map.keys())
+			if (textHoldsBarePath(String(s.content ?? ''), stub)) return UNREACHABLE_REFERENCE
+	const content = rewriteContent(s.content ?? '', map)
+	if (content === s.content) return true
+	await ScriptService.createScript({
+		workspace,
+		requestBody: {
+			...s,
+			...PRESERVE_DEPLOYED_IDENTITY,
+			content,
+			parent_hash: s.hash,
+			deployment_message: undefined
+		}
+	})
+	return true
+}
+
+async function rewriteFlow(
+	workspace: string,
+	r: Referrer,
+	map: Map<string, string>
+): Promise<true | string> {
+	const path = r.path
+	const f: any = await FlowService.getFlowByPath({ workspace, path })
+	if (!r.gapped && readsPathUnreachably(f.value ?? {}, map)) return UNREACHABLE_REFERENCE
+	const value = rewriteTokens(f.value ?? {}, map)
+	// The tokens the plan saw are gone from the deployed item, so there is nothing to write.
+	if (JSON.stringify(value) === JSON.stringify(f.value ?? {})) return true
+	await FlowService.updateFlow({
+		workspace,
+		path,
+		requestBody: { ...f, ...PRESERVE_DEPLOYED_IDENTITY, path, value }
+	})
+	return true
+}
+
+/**
+ * The deployed policy is recomputed, not rebuilt. Recomputing is required: `triggerables_v2`
+ * is keyed by `<component>:rawscript/<sha256(inline content)>`, and rewriting an inline
+ * runnable's content changes that key, so a policy copied verbatim would leave the component
+ * "forbidden by policy". Handing the deployed policy to the recompute is what keeps the run
+ * identity, the sandbox rules and everything else it does not touch.
+ *
+ * No execution mode is defaulted. The backend keeps the deployed mode when the submitted
+ * policy states none, and stating one here would put a `viewer` app on the publisher's
+ * identity.
+ */
+async function rewriteApp(
+	workspace: string,
+	r: Referrer,
+	map: Map<string, string>
+): Promise<true | string> {
+	const path = r.path
+	const a: any = await AppService.getAppByPath({ workspace, path })
+	// The deployed record says which kind this is. `list_search_apps` returns only the path and
+	// the value, so the scan could only have guessed from the value's shape — and a guess wrong
+	// in either direction is a deploy the backend refuses for changing an app's kind.
+	if (a.raw_app) return rewriteRawApp(workspace, r, map, a)
+	if (!r.gapped && readsPathUnreachably(a.value ?? {}, map)) return UNREACHABLE_REFERENCE
+	const next = rewriteTokens(a.value ?? {}, map)
+	// The tokens the plan saw are gone from the deployed item, so there is nothing to write.
+	if (JSON.stringify(next) === JSON.stringify(a.value ?? {})) return true
+	const policy = (await updatePolicy(next as App, a.policy)) as any
+	await AppService.updateApp({
+		workspace,
+		path,
+		requestBody: { ...PRESERVE_DEPLOYED_IDENTITY, path, value: next, policy }
+	})
+	return true
+}
+
+/**
+ * One half of a deployed raw app's compiled bundle, read back the way the Hub publish reads
+ * it: `/apps/get_data/v/{secret}.{ext}` serves it to anyone holding the secret, and the
+ * secret is minted for the caller against a plain `apps:read:<path>` check.
+ *
+ * A missing `.css` is an app that ships no styles. A missing `.js` is a broken deployment,
+ * and uploading an empty one in its place would break it further.
+ */
+async function fetchBundlePart(
+	workspace: string,
+	secret: string,
+	ext: 'js' | 'css'
+): Promise<string> {
+	const res = await fetch(
+		`/api/w/${encodeURIComponent(workspace)}/apps/get_data/v/${secret}.${ext}`,
+		{ credentials: 'include' }
+	)
+	if (res.ok) return await res.text()
+	if (ext === 'css' && res.status === 404) return ''
+	throw new Error(`the compiled bundle could not be read (${res.status})`)
+}
+
+/**
+ * A raw app: its deployed value carries the sources and the runnables, and `updateAppRaw`
+ * refuses without a bundle. The bundle is the deployed one, read back, rewritten and sent
+ * again — rebuilding it is not possible from the browser and is not needed, but re-uploading
+ * it untouched is not an option either.
+ *
+ * The bundle is compiled from the sources, so a `$res:` a source file spells out is baked
+ * into it. The import rewrites that copy — `retargetProjectExport` runs while `/bundle.js`
+ * is still one of `files`, and only `installProject` splits it out afterwards. Sending the
+ * deployed bundle back unrewritten would undo on reuse what the import got right, and the
+ * app would keep reading a resource this run is about to delete.
+ */
+async function rewriteRawApp(
+	workspace: string,
+	r: Referrer,
+	map: Map<string, string>,
+	a: any
+): Promise<true | string> {
+	const path = r.path
+	const value: any = a.value ?? {}
+	// One walk over the whole value: `$res:` tokens live in the runnables and can appear in
+	// the sources too, and both are plain text inside this JSON.
+	if (!r.gapped && readsPathUnreachably(value, map)) return UNREACHABLE_REFERENCE
+	const next = rewriteTokens(value, map)
+	const runnables = next.runnables ?? {}
+	const policy = (await updateRawAppPolicy(runnables, a.policy)) as any
+	const secret = await AppService.getPublicSecretOfLatestVersionOfApp({ workspace, path })
+	const [deployedJs, deployedCss] = await Promise.all([
+		fetchBundlePart(workspace, secret, 'js'),
+		fetchBundlePart(workspace, secret, 'css')
+	])
+	const js = rewriteContent(deployedJs, map)
+	const css = rewriteContent(deployedCss, map)
+	// `rewriteContent` moves the `$res:` tokens. A path the bundle spells out any other way
+	// is one nothing here can move, and uploading it would leave the app reading a resource
+	// about to be deleted.
+	for (const stub of map.keys()) if (textHoldsBarePath(js, stub)) return UNREACHABLE_REFERENCE
+	// The tokens the plan saw are gone from both the value and the bundle, so there is nothing
+	// to write, and uploading would cut a version differing from the last in nothing.
+	if (js === deployedJs && css === deployedCss && JSON.stringify(next) === JSON.stringify(value))
+		return true
+	const files = { ...(next.files ?? {}) }
+	delete files['/bundle.js']
+	delete files['/bundle.css']
+	await AppService.updateAppRaw({
+		workspace,
+		path,
+		formData: {
+			app: {
+				...PRESERVE_DEPLOYED_IDENTITY,
+				path,
+				summary: a.summary ?? '',
+				value: {
+					files,
+					runnables,
+					...(next.data !== undefined ? { data: next.data } : {}),
+					...(next.datatables !== undefined ? { datatables: next.datatables } : {})
+				},
+				policy
+			},
+			js,
+			css
+		}
+	})
+	return true
+}
+
+/**
+ * The trigger's own row, rewritten and written back. `enabled` is deliberately not sent:
+ * imported triggers are created disabled and re-enabling one is the user's decision, not a
+ * side effect of pointing it at a credential.
+ *
+ * `path` is put back from the row afterwards, and so is every runnable reference — see
+ * `restoreRunnableRefs`. The rewrite remaps any string equal to the stub's path, so a trigger
+ * sitting at the path the resource used to hold would otherwise be renamed along with the
+ * reference.
+ *
+ * A trigger states its run identity as `permissioned_as`, not the `on_behalf_of` the other
+ * kinds use, and `resolve_permissioned_as` keeps the row's value only when
+ * `preserve_permissioned_as` says so. Without the pair a trigger created under a folder's
+ * `default_permissioned_as` would start running as whoever picked the credential.
+ */
+async function rewriteTrigger(
+	workspace: string,
+	r: Referrer,
+	map: Map<string, string>
+): Promise<true | string> {
+	const def = TRIGGER_KINDS[r.triggerKind!]
+	const row: any = r.row ?? {}
+	const { enabled: _enabled, ...rest } = {
+		...restoreRunnableRefs(rewriteTriggerConfig(row, map), row),
+		path: r.path,
+		...(typeof row.permissioned_as === 'string'
+			? { permissioned_as: row.permissioned_as, preserve_permissioned_as: true }
+			: {})
+	}
+	// No unreachable-mention check: a trigger holds the bare path by design, in its own
+	// resource field, and `rewriteTriggerConfig` remaps every bare match at every depth. What
+	// can still read `from` afterwards is a restored identity field, not a reference.
+	if (r.triggerKind === 'schedule') {
+		// `EditSchedule` needs these three; everything else on the row carries over by name.
+		await ScheduleService.updateSchedule({
+			workspace,
+			path: r.path,
+			requestBody: {
+				...rest,
+				schedule: rest.schedule ?? '0 0 * * * *',
+				timezone: rest.timezone ?? 'UTC',
+				args: rest.args ?? {}
+			}
+		})
+		return true
+	}
+	await def.update!(workspace, r.path, rest)
+	return true
+}
diff --git a/frontend/src/routes/(root)/(logged)/projects/import/+page@(root).svelte b/frontend/src/routes/(root)/(logged)/projects/import/+page@(root).svelte
index a1bc2ab970..a6f4632526 100644
--- a/frontend/src/routes/(root)/(logged)/projects/import/+page@(root).svelte
+++ b/frontend/src/routes/(root)/(logged)/projects/import/+page@(root).svelte
@@ -261,9 +261,10 @@
 			setupUndecided = false
 			return
 		}
-		// Every resource the project ships arrives as an empty stub, so any project with
-		// resources has something to fill in. The step itself re-checks and shows only
-		// what is genuinely outstanding, which is what makes a re-import quiet.
+		// `resourceCount` is the referenced subset — the resources something in the project
+		// points at — and each one arrives as an empty stub, so any project that has them has
+		// something to fill in. The step itself re-checks and shows only what is genuinely
+		// outstanding, which is what makes a re-import quiet.
 		if (execution.resourceCount > 0) {
 			setupNeeded = true
 			setupUndecided = false

From e39dd7eb12f380ac111be997b165b0b1c269daa3 Mon Sep 17 00:00:00 2001
From: Guilhem <guilhemlemouel@gmail.com>
Date: Thu, 3 Sep 2026 11:29:54 +0200
Subject: [PATCH 20/31] docs: teach agents to pass a resource as $res:<path> in
 run arguments (#10927)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* docs: teach agents to pass a resource as $res:<path> in run arguments

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XjRARL7JA7xm772iJP4mJk

* docs: extend run-argument rule to in-editor chats, fix run-as wording

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XjRARL7JA7xm772iJP4mJk

* docs: tighten resource run-argument rule after review

- Drop the false rationale that "$var:" only works inside a resource value
  from the write_variable description and its runtime rejection message; keep
  the rule (a variable cannot reference itself).
- MCP resource-argument description: the title fallback renders "No title",
  so say the title is only a label rather than that it can be empty. Guard the
  real-newline fix with asserts in the existing enrichment test.
- Eval: assert the full "$res:f/evals/global/github_main" value as one prefix
  so a wrong path with a right prefix fails.
- resources.md: narrow "a trigger's payload" to its configured static args.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XjRARL7JA7xm772iJP4mJk

* docs: scope the run-argument rule to global chat, add an exact eval matcher

The ai_evals A/B on the two in-editor modes showed no effect: script mode
sonnet 5/5 both with and without the description, flow mode sonnet 5/5 and
haiku 5/5 on the baseline alone. A flow's input schema already carries
`format: resource-<type>`, so those modes have a signal global mode does not
give. Revert both files to keep the tool schemas free of a description that
buys nothing per iteration; global mode keeps it, where haiku goes 0/5 -> 5/5.

Add `stringEqualsAnyOf` to toolCallArgs and use it for the resource reference:
nothing in the eval resolves the value, so a prefix match accepted a near-miss
path like `$res:f/evals/global/github_main_backup`.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XjRARL7JA7xm772iJP4mJk

* docs: address cubic review — CLI wording, mock resource getter

- `-d --data` help on all four run/preview commands: give $res: and $var:
  their own clauses instead of a parenthetical that read as if a resource
  were a kind of variable.
- Mock backend: `getBenchmarkResource` now resolves AI-provider seeds as well
  as plain ones, so it agrees with `existsResource` and `listResource` — both
  report either kind, and a case that listed a resource and then read it by
  path got a row it could not fetch.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XjRARL7JA7xm772iJP4mJk

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 ai_evals/adapters/frontend/mockBackend.ts     | 77 +++++++++++++++++--
 .../adapters/frontend/vitestAdapter.test.ts   | 14 +++-
 ai_evals/cases/global.yaml                    | 34 ++++++++
 ai_evals/core/types.ts                        |  7 ++
 ai_evals/core/validators.test.ts              | 37 +++++++++
 ai_evals/core/validators.ts                   | 14 ++++
 .../initial/github_repo_stats_script.json     | 37 +++++++++
 backend/windmill-api/openapi.yaml             |  4 +-
 .../src/mcp/auto_generated_endpoints.rs       |  4 +-
 backend/windmill-mcp/src/common/schema.rs     | 10 ++-
 cli/src/commands/flow/flow.ts                 |  4 +-
 cli/src/commands/script/script.ts             |  4 +-
 cli/src/guidance/core.ts                      |  2 +
 cli/src/guidance/skills.gen.ts                | 45 ++++++++++-
 .../components/copilot/chat/global/core.ts    | 10 ++-
 frontend/src/lib/mcpEndpointTools.ts          |  4 +-
 .../auto-generated/cli/cli-commands.md        |  8 +-
 system_prompts/auto-generated/prompts.ts      | 43 ++++++++++-
 .../skills/cli-commands/SKILL.md              |  8 +-
 .../auto-generated/skills/resources/SKILL.md  | 35 +++++++++
 .../auto-generated/skills/write-flow/SKILL.md |  2 +
 system_prompts/base/flow-cli.md               |  2 +
 system_prompts/base/resources.md              | 35 +++++++++
 23 files changed, 399 insertions(+), 41 deletions(-)
 create mode 100644 ai_evals/fixtures/frontend/global/initial/github_repo_stats_script.json

diff --git a/ai_evals/adapters/frontend/mockBackend.ts b/ai_evals/adapters/frontend/mockBackend.ts
index 5c682be5eb..6d80f19197 100644
--- a/ai_evals/adapters/frontend/mockBackend.ts
+++ b/ai_evals/adapters/frontend/mockBackend.ts
@@ -7,6 +7,7 @@ import type {
 	ListableApp,
 	ListableResource,
 	ListableVariable,
+	Resource,
 	Script
 } from '../../../frontend/src/lib/gen'
 import type {
@@ -81,6 +82,15 @@ export interface BenchmarkWorkspaceAiProvider {
 	isDefault?: boolean
 }
 
+/** A plain (non-AI) resource of the benchmark workspace, for cases about referencing a
+ * credential — passing one as a run argument, say. `value` is what `get_resource` returns. */
+export interface BenchmarkWorkspaceResource {
+	path: string
+	resource_type: string
+	value?: Record<string, unknown>
+	description?: string
+}
+
 export interface BenchmarkWorkspaceJob {
 	/** Stable id so a case prompt can reference a specific run (e.g. for get_job_logs). */
 	id?: string
@@ -98,6 +108,7 @@ export interface BenchmarkWorkspaceRunnables {
 	apps?: BenchmarkWorkspaceApp[]
 	variables?: BenchmarkWorkspaceVariable[]
 	aiProviders?: BenchmarkWorkspaceAiProvider[]
+	resources?: BenchmarkWorkspaceResource[]
 	datatables?: BenchmarkDatatableSeed[]
 	jobs?: BenchmarkWorkspaceJob[]
 }
@@ -284,15 +295,71 @@ export function listBenchmarkAiProviderResources(workspace: string): ListableRes
 	}))
 }
 
-/** The value of a seeded AI provider resource. Only the endpoint fields are modelled — a key is
- * never needed, because no eval run calls the provider through this resource. */
+/** Plain seeded resources of a benchmark workspace, shaped like `ResourceService.listResource`
+ * rows. Null when the workspace is not a benchmark one. */
+export function listBenchmarkPlainResources(workspace: string): ListableResource[] | null {
+	const runnables = benchmarkWorkspaceRunnables.get(workspace)
+	if (!runnables) {
+		return null
+	}
+	return (runnables.resources ?? []).map((seed) => ({
+		workspace_id: workspace,
+		path: seed.path,
+		resource_type: seed.resource_type,
+		description: seed.description,
+		value: null,
+		is_oauth: false,
+		is_linked: false,
+		is_refreshed: false,
+		extra_perms: {},
+		edited_at: BENCHMARK_TIMESTAMP
+	}))
+}
+
+/** A seeded resource with its value, as `ResourceService.getResource` returns it. Covers both
+ * seed kinds, so it agrees with `existsResource` and `listResource` — both of those report AI
+ * providers too, and a case that lists resources and then reads one by path would otherwise get
+ * a row it cannot fetch. */
+export function getBenchmarkResource(workspace: string, path: string): Resource | null {
+	const runnables = benchmarkWorkspaceRunnables.get(workspace)
+	const seed = runnables?.resources?.find((entry) => entry.path === path)
+	if (seed) {
+		return {
+			workspace_id: workspace,
+			path: seed.path,
+			resource_type: seed.resource_type,
+			description: seed.description,
+			value: seed.value ?? {},
+			is_oauth: false,
+			extra_perms: {}
+		} as Resource
+	}
+	const provider = runnables?.aiProviders?.find((entry) => entry.path === path)
+	if (!provider) {
+		return null
+	}
+	return {
+		workspace_id: workspace,
+		path: provider.path,
+		resource_type: provider.kind,
+		value: getBenchmarkResourceValue(workspace, path) ?? {},
+		is_oauth: false,
+		extra_perms: {}
+	} as Resource
+}
+
+/** The value of a seeded resource. For an AI provider only the endpoint fields are modelled — a
+ * key is never needed, because no eval run calls the provider through this resource. */
 export function getBenchmarkResourceValue(
 	workspace: string,
 	path: string
 ): Record<string, unknown> | null {
-	const seed = benchmarkWorkspaceRunnables
-		.get(workspace)
-		?.aiProviders?.find((entry) => entry.path === path)
+	const runnables = benchmarkWorkspaceRunnables.get(workspace)
+	const plain = runnables?.resources?.find((entry) => entry.path === path)
+	if (plain) {
+		return plain.value ?? {}
+	}
+	const seed = runnables?.aiProviders?.find((entry) => entry.path === path)
 	if (!seed) {
 		return null
 	}
diff --git a/ai_evals/adapters/frontend/vitestAdapter.test.ts b/ai_evals/adapters/frontend/vitestAdapter.test.ts
index e59ec11ad9..338ed8504c 100644
--- a/ai_evals/adapters/frontend/vitestAdapter.test.ts
+++ b/ai_evals/adapters/frontend/vitestAdapter.test.ts
@@ -70,7 +70,9 @@ vi.mock('$lib/gen', async () => {
 		getBenchmarkResourceValue,
 		getBenchmarkVariableByPath,
 		hasBenchmarkWorkspace,
+		getBenchmarkResource,
 		listBenchmarkAiProviderResources,
+		listBenchmarkPlainResources,
 		listBenchmarkApps,
 		listBenchmarkDatatables,
 		listBenchmarkDrafts,
@@ -359,18 +361,24 @@ vi.mock('$lib/gen', async () => {
 				hasBenchmarkWorkspace(data.workspace)
 					? Boolean(getBenchmarkResourceValue(data.workspace, data.path))
 					: actual.ResourceService.existsResource(data),
-			// Only AI provider resources are modelled: they are what an AI agent step references.
 			listResource: async (data: { workspace: string; resourceType?: string }) => {
 				if (!hasBenchmarkWorkspace(data.workspace)) {
 					return actual.ResourceService.listResource(data)
 				}
-				const seeded = listBenchmarkAiProviderResources(data.workspace) ?? []
+				const seeded = [
+					...(listBenchmarkAiProviderResources(data.workspace) ?? []),
+					...(listBenchmarkPlainResources(data.workspace) ?? [])
+				]
 				const wanted = data.resourceType?.split(',')
 				return wanted ? seeded.filter((r) => wanted.includes(r.resource_type)) : seeded
 			},
 			getResource: async (data: { workspace: string; path: string }) => {
 				if (hasBenchmarkWorkspace(data.workspace)) {
-					throw new Error(`Resource "${data.path}" not found in benchmark workspace`)
+					const resource = getBenchmarkResource(data.workspace, data.path)
+					if (!resource) {
+						throw new Error(`Resource "${data.path}" not found in benchmark workspace`)
+					}
+					return resource
 				}
 				return actual.ResourceService.getResource(data)
 			},
diff --git a/ai_evals/cases/global.yaml b/ai_evals/cases/global.yaml
index 21f80bef7e..94ecb5c029 100644
--- a/ai_evals/cases/global.yaml
+++ b/ai_evals/cases/global.yaml
@@ -2365,3 +2365,37 @@
     - the step uses the workspace's anthropic resource f/evals/global/anthropic_main
     - the model is the Opus one the user asked for, taken from the models that resource serves
     - the diff flow input reaches the agent
+
+# The failure this pins: passing a resource as `{"$res": "<path>"}` (or as a bare path), which
+# reaches the script unresolved because the backend only substitutes a string value that itself
+# starts with `$res:`. The mock preview echoes args back and reports success, so nothing in the
+# loop corrects a wrong shape — the arg form is the whole test.
+- id: global-run-arg-resource-reference
+  prompt: |-
+    Run `f/evals/global/github_repo_stats` against the `windmill-labs/windmill` repo, passing our
+    GitHub credentials at `f/evals/global/github_main` as its `gh_auth` input, and tell me whether
+    it went through.
+  initial: ai_evals/fixtures/frontend/global/initial/github_repo_stats_script.json
+  runtime:
+    maxTurns: 10
+  validate:
+    draftCountExactly: 0
+  toolExpect:
+    requiredToolsUsed:
+      - test_run_script
+    forbiddenToolsUsed:
+      - write_script
+      - deploy_workspace_item
+    toolCallArgs:
+      # Exact: the mock never resolves the reference, so a near-miss path like
+      # `$res:f/evals/global/github_main_backup` would otherwise pass.
+      - tool: test_run_script
+        field: args.gh_auth
+        stringEqualsAnyOf:
+          - "$res:f/evals/global/github_main"
+  # The judge only sees drafts, and this case makes none — the deliverable is the shape of the
+  # run argument, checked deterministically above.
+  skipJudge: true
+  judgeChecklist:
+    - runs the existing script rather than rewriting it
+    - passes the GitHub resource as the bare string $res:f/evals/global/github_main
diff --git a/ai_evals/core/types.ts b/ai_evals/core/types.ts
index c9a4f7830e..4107dc53da 100644
--- a/ai_evals/core/types.ts
+++ b/ai_evals/core/types.ts
@@ -160,6 +160,13 @@ export interface ToolCallArgumentRule {
   field: string;
   stringStartsWithAnyOf?: string[];
   stringMustNotStartWithAnyOf?: string[];
+  /**
+   * Universal over calls: every recorded call to `tool` must carry `field` as
+   * exactly one of these strings. Use when a near-miss would still satisfy a
+   * prefix — a resource reference like `$res:f/a/b` shares its prefix with the
+   * wrong `$res:f/a/b_backup`, and the mock never resolves it to catch that.
+   */
+  stringEqualsAnyOf?: string[];
   /**
    * Case-insensitive "contains", existential over calls: at least one recorded
    * call to `tool` must have `field` containing one of these substrings. Other
diff --git a/ai_evals/core/validators.test.ts b/ai_evals/core/validators.test.ts
index 9b606c1c85..4b7891f67e 100644
--- a/ai_evals/core/validators.test.ts
+++ b/ai_evals/core/validators.test.ts
@@ -228,6 +228,43 @@ describe("validateToolExpectations", () => {
     });
   });
 
+  // A resource reference shares its prefix with a wrong sibling path, and the mock
+  // never resolves it, so only exact matching separates the two.
+  it("rejects a resource reference whose path merely shares the prefix", () => {
+    const checks = validateToolExpectations({
+      run: {
+        success: true,
+        actual: {},
+        assistantMessageCount: 1,
+        toolCallCount: 1,
+        toolsUsed: ["test_run_script"],
+        toolCallDetails: [
+          {
+            name: "test_run_script",
+            arguments: { args: { gh_auth: "$res:f/evals/global/github_main_backup" } },
+          },
+        ],
+        skillsInvoked: [],
+      },
+      toolExpect: {
+        toolCallArgs: [
+          {
+            tool: "test_run_script",
+            field: "args.gh_auth",
+            stringEqualsAnyOf: ["$res:f/evals/global/github_main"],
+          },
+        ],
+      },
+    });
+
+    expect(checks).toContainEqual({
+      name: "test_run_script.args.gh_auth matches an accepted value",
+      passed: false,
+      details:
+        'accepted values: $res:f/evals/global/github_main; values: "$res:f/evals/global/github_main_backup"',
+    });
+  });
+
   // The whole point of the same-call rule: the per-field rules are existential over
   // calls, so two single-filter pages would satisfy them while never opening the
   // combined view the case asks for.
diff --git a/ai_evals/core/validators.ts b/ai_evals/core/validators.ts
index 7150dab0c3..132a9ff3d0 100644
--- a/ai_evals/core/validators.ts
+++ b/ai_evals/core/validators.ts
@@ -278,6 +278,20 @@ export function validateToolExpectations(input: {
       );
     }
 
+    if (rule.stringEqualsAnyOf && rule.stringEqualsAnyOf.length > 0) {
+      const invalidValues = values.filter(
+        (value) =>
+          typeof value !== "string" || !rule.stringEqualsAnyOf!.includes(value)
+      );
+      checks.push(
+        check(
+          `${rule.tool}.${rule.field} matches an accepted value`,
+          invalidValues.length === 0,
+          `accepted values: ${rule.stringEqualsAnyOf.join(", ")}; values: ${summarizeToolValues(values)}`
+        )
+      );
+    }
+
     if (rule.stringMustNotStartWithAnyOf && rule.stringMustNotStartWithAnyOf.length > 0) {
       const invalidValues = values.filter(
         (value) =>
diff --git a/ai_evals/fixtures/frontend/global/initial/github_repo_stats_script.json b/ai_evals/fixtures/frontend/global/initial/github_repo_stats_script.json
new file mode 100644
index 0000000000..80e1b960c5
--- /dev/null
+++ b/ai_evals/fixtures/frontend/global/initial/github_repo_stats_script.json
@@ -0,0 +1,37 @@
+{
+  "workspace": {
+    "resources": [
+      {
+        "path": "f/evals/global/github_main",
+        "resource_type": "github",
+        "description": "GitHub credentials",
+        "value": { "token": "$var:f/evals/global/github_token" }
+      }
+    ],
+    "scripts": [
+      {
+        "path": "f/evals/global/github_repo_stats",
+        "summary": "Count open issues on a GitHub repository",
+        "description": "Reads the open issue count for a repository using GitHub credentials.",
+        "language": "bun",
+        "schema": {
+          "$schema": "https://json-schema.org/draft/2020-12/schema",
+          "type": "object",
+          "properties": {
+            "gh_auth": {
+              "type": "object",
+              "format": "resource-github",
+              "description": "GitHub credentials"
+            },
+            "repo": {
+              "type": "string",
+              "description": "Repository in owner/name form"
+            }
+          },
+          "required": ["gh_auth", "repo"]
+        },
+        "content": "type Github = { token: string }\n\nexport async function main(gh_auth: Github, repo: string) {\n  const res = await fetch(`https://api.github.com/repos/${repo}/issues?state=open`, {\n    headers: { Authorization: `Bearer ${gh_auth.token}` }\n  })\n  const issues = await res.json()\n  return { repo, open_issues: issues.length }\n}\n"
+      }
+    ]
+  }
+}
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 2878797e69..5dbfca7f56 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -10456,7 +10456,7 @@ paths:
       summary: run script by path
       operationId: runScriptByPath
       x-mcp-tool: true
-      x-mcp-instructions: "You should first use getScriptByPath to retrieve the script's schema and understand what arguments are expected."
+      x-mcp-instructions: "You should first use getScriptByPath to retrieve the script's schema and understand what arguments are expected. A resource argument (schema format `resource-<type>`) is the bare string `$res:<path>` as that whole argument value -- not a wrapper object, not a plain path. A variable is `$var:<path>`."
       x-mcp-tool-include-query-params: []
       tags:
         - job
@@ -13814,7 +13814,7 @@ paths:
       summary: run flow by path
       operationId: runFlowByPath
       x-mcp-tool: true
-      x-mcp-instructions: "You should first use getFlowByPath to retrieve the flow's schema and understand what arguments are expected."
+      x-mcp-instructions: "You should first use getFlowByPath to retrieve the flow's schema and understand what arguments are expected. A resource argument (schema format `resource-<type>`) is the bare string `$res:<path>` as that whole argument value -- not a wrapper object, not a plain path. A variable is `$var:<path>`."
       x-mcp-tool-include-query-params: []
       tags:
         - job
diff --git a/backend/windmill-api/src/mcp/auto_generated_endpoints.rs b/backend/windmill-api/src/mcp/auto_generated_endpoints.rs
index 568ad854f9..aa2415f664 100644
--- a/backend/windmill-api/src/mcp/auto_generated_endpoints.rs
+++ b/backend/windmill-api/src/mcp/auto_generated_endpoints.rs
@@ -878,7 +878,7 @@ is, a different one moves it there and archives the old path"),
     EndpointTool {
         name: Cow::Borrowed("runScriptByPath"),
         description: Cow::Borrowed("run script by path"),
-        instructions: Cow::Borrowed("You should first use getScriptByPath to retrieve the script's schema and understand what arguments are expected."),
+        instructions: Cow::Borrowed("You should first use getScriptByPath to retrieve the script's schema and understand what arguments are expected. A resource argument (schema format `resource-<type>`) is the bare string `$res:<path>` as that whole argument value -- not a wrapper object, not a plain path. A variable is `$var:<path>`."),
         path: Cow::Borrowed("/w/{workspace}/jobs/run/p/{path}"),
         method: Cow::Borrowed("POST"),
         path_params_schema: Some(serde_json::json!({
@@ -1419,7 +1419,7 @@ is, a different one moves it there and archives the old path"),
     EndpointTool {
         name: Cow::Borrowed("runFlowByPath"),
         description: Cow::Borrowed("run flow by path"),
-        instructions: Cow::Borrowed("You should first use getFlowByPath to retrieve the flow's schema and understand what arguments are expected."),
+        instructions: Cow::Borrowed("You should first use getFlowByPath to retrieve the flow's schema and understand what arguments are expected. A resource argument (schema format `resource-<type>`) is the bare string `$res:<path>` as that whole argument value -- not a wrapper object, not a plain path. A variable is `$var:<path>`."),
         path: Cow::Borrowed("/w/{workspace}/jobs/run/f/{path}"),
         method: Cow::Borrowed("POST"),
         path_params_schema: Some(serde_json::json!({
diff --git a/backend/windmill-mcp/src/common/schema.rs b/backend/windmill-mcp/src/common/schema.rs
index 3f88f7e781..d49fa468ae 100644
--- a/backend/windmill-mcp/src/common/schema.rs
+++ b/backend/windmill-mcp/src/common/schema.rs
@@ -101,7 +101,7 @@ fn apply_resource_enrichment(
     let resources_count = resource_cache.len();
     let description = match resource_type {
         Some(rt) => format!(
-            "This is a resource named `{}` with the following description: `{}`.\\nThe path of the resource should be used to specify the resource.\\n{}",
+            "This is a resource named `{}` with the following description: `{}`.\nPass it as the bare string `$res:<path>` — the whole value of this argument, never an object wrapper like {{\"$res\": \"<path>\"}} and never a plain path.\n{}",
             rt.name,
             rt.description.as_deref().unwrap_or("No description"),
             if resources_count == 0 {
@@ -138,7 +138,7 @@ fn apply_resource_enrichment(
                 )
             })
             .collect::<Vec<String>>()
-            .join("\\n");
+            .join("\n");
         let prior_description = prop_map
             .get("description")
             .and_then(Value::as_str)
@@ -147,7 +147,7 @@ fn apply_resource_enrichment(
         prop_map.insert(
             "description".to_string(),
             Value::String(format!(
-                "{}\\nHere are the available resources, in the format title:path. Title can be empty. Path should be used to specify the resource:\\n{}",
+                "{}\nHere are the available resources, one per line as `title: $res:path`. The title is only a label; pass the `$res:path` part verbatim as this argument's value:\n{}",
                 prior_description, resources_description
             )),
         );
@@ -804,6 +804,10 @@ mod tests {
         let desc = node["description"].as_str().unwrap();
         assert!(desc.contains("c_aws_account"));
         assert!(desc.contains("$res:f/platform/aws_dev"));
+        // MCP clients render this description verbatim, so the separators must be
+        // real newlines rather than the two-character escape.
+        assert!(desc.contains('\n'));
+        assert!(!desc.contains("\\n"));
     }
 
     #[test]
diff --git a/cli/src/commands/flow/flow.ts b/cli/src/commands/flow/flow.ts
index 6ace1eaf48..7a383fcfeb 100644
--- a/cli/src/commands/flow/flow.ts
+++ b/cli/src/commands/flow/flow.ts
@@ -1144,7 +1144,7 @@ const command = new Command()
   .arguments("<path:string>")
   .option(
     "-d --data <data:string>",
-    "Inputs specified as a JSON string or a file using @<filename> or stdin using @-."
+    "Inputs specified as a JSON string or a file using @<filename> or stdin using @-. A resource argument is the bare string $res:<path> as its whole value, and a variable argument is the bare string $var:<path> — not an object wrapper keyed on $res/$var, and not a plain path."
   )
   .option(
     "-s --silent",
@@ -1162,7 +1162,7 @@ const command = new Command()
   .arguments("<flow_path:string>")
   .option(
     "-d --data <data:string>",
-    "Inputs specified as a JSON string or a file using @<filename> or stdin using @-."
+    "Inputs specified as a JSON string or a file using @<filename> or stdin using @-. A resource argument is the bare string $res:<path> as its whole value, and a variable argument is the bare string $var:<path> — not an object wrapper keyed on $res/$var, and not a plain path."
   )
   .option(
     "-s --silent",
diff --git a/cli/src/commands/script/script.ts b/cli/src/commands/script/script.ts
index 8c93bdb963..fada434e0d 100644
--- a/cli/src/commands/script/script.ts
+++ b/cli/src/commands/script/script.ts
@@ -2213,7 +2213,7 @@ const command = new Command()
   .arguments("<path:file>")
   .option(
     "-d --data <data:file>",
-    "Inputs specified as a JSON string or a file using @<filename> or stdin using @-."
+    "Inputs specified as a JSON string or a file using @<filename> or stdin using @-. A resource argument is the bare string $res:<path> as its whole value, and a variable argument is the bare string $var:<path> — not an object wrapper keyed on $res/$var, and not a plain path."
   )
   .option(
     "-s --silent",
@@ -2231,7 +2231,7 @@ const command = new Command()
   .arguments("<path:file>")
   .option(
     "-d --data <data:file>",
-    "Inputs specified as a JSON string or a file using @<filename> or stdin using @-."
+    "Inputs specified as a JSON string or a file using @<filename> or stdin using @-. A resource argument is the bare string $res:<path> as its whole value, and a variable argument is the bare string $var:<path> — not an object wrapper keyed on $res/$var, and not a plain path."
   )
   .option(
     "-s --silent",
diff --git a/cli/src/guidance/core.ts b/cli/src/guidance/core.ts
index 100bea6e53..2a9bb34fe0 100644
--- a/cli/src/guidance/core.ts
+++ b/cli/src/guidance/core.ts
@@ -115,6 +115,8 @@ Local previews exist for every entity type and don't deploy:
 - \`wmill flow preview <flow_path> -d '<args>'\` — run a local flow.yaml.
 - \`wmill app dev\` — live-reload dev server for raw apps.
 
+An argument typed as a resource takes the bare string \`"$res:<path>"\` as its whole value (a variable takes \`"$var:<path>"\`) — never an object wrapper like \`{"$res": "<path>"}\`, and never a plain path. See the \`resources\` skill.
+
 Argument shapes and per-language details live in the \`write-script-<lang>\`, \`write-flow\`, and \`raw-app\` skills.
 
 ## Keeping metadata in sync
diff --git a/cli/src/guidance/skills.gen.ts b/cli/src/guidance/skills.gen.ts
index 62027ab2ef..5271167a07 100644
--- a/cli/src/guidance/skills.gen.ts
+++ b/cli/src/guidance/skills.gen.ts
@@ -5116,6 +5116,8 @@ If the user hasn't already told you to run/test the flow, offer it as a one-sent
 
 If the user already asked to test/run/try the flow in their original request, skip the offer and just execute \`wmill flow preview <path> -d '<args>'\` directly — pick plausible args from the flow's input schema.
 
+An input typed as a resource (\`format: resource-<type>\` in the schema) takes the bare string \`"$res:<path>"\` as its whole value — \`-d '{"db": "$res:f/databases/postgres_prod"}'\`, not \`{"db": {"$res": "..."}}\` and not a plain path. Same for a variable, with \`"$var:<path>"\`. See the \`resources\` skill.
+
 \`wmill flow preview\` is safe to run yourself (it does not deploy). \`wmill generate-metadata\` does not deploy either (it only writes local lock/hash files) but re-resolves deps — offer it and run on agreement, unless the project's \`AGENTS.md\` opts into automatic metadata. After running it, check the regenerated \`.lock\` diff and tell the user which inline-script dependency versions changed, so they can catch an unwanted bump before deploying. Only \`wmill sync push\` deploys; run it only when the user explicitly asks.
 
 ### Visual preview
@@ -6188,6 +6190,41 @@ Reference other resources:
 }
 \`\`\`
 
+## Passing a Resource or Variable as a Run Argument
+
+A script or flow argument typed as a resource (schema \`format: resource-<type>\`) is passed as
+the **bare string** \`$res:<path>\` — the whole argument value. Same for a variable, with
+\`$var:<path>\`. This applies everywhere job arguments are supplied: \`wmill script run/preview\`,
+\`wmill flow run/preview\`, the \`runScriptByPath\` / \`runFlowByPath\` API, a schedule's \`args\`, a
+trigger's configured static args.
+
+\`\`\`json
+{
+  "db": "$res:f/databases/postgres_prod",
+  "api_token": "$var:g/all/api_token"
+}
+\`\`\`
+
+The reference is resolved when the job runs, under the job's run-as identity — the caller for an
+ordinary run, but the configured principal for a schedule, a trigger, or a runnable set to run on
+behalf of someone else. The run fails if that identity cannot read the referenced resource or
+variable.
+
+**Never wrap it in an object.** The resolver only rewrites a JSON value that *is* a string
+starting with \`$res:\` / \`$var:\`; keys are never inspected. These are all wrong and are passed
+through to the script unchanged:
+
+\`\`\`json
+{ "db": { "$res": "f/databases/postgres_prod" } }
+{ "db": { "resource": "f/databases/postgres_prod" } }
+{ "db": "f/databases/postgres_prod" }
+\`\`\`
+
+The string may sit anywhere a string can — a top-level argument, a nested object field
+(\`{ "gh_auth": { "token": "$var:g/all/gh_token" } }\`), or an array element (array elements are
+walked only while nested at most two levels deep, and only for arrays of at most 1000 items).
+The prefix must be on the string itself.
+
 ## Common Resource Types
 
 ### PostgreSQL
@@ -7074,11 +7111,11 @@ flow related commands
 - \`flow push <file_path:string> <remote_path:string>\` - push a local flow spec. This overrides any remote versions.
   - \`--message <message:string>\` - Deployment message
 - \`flow run <path:string>\` - run a flow by path.
-  - \`-d --data <data:string>\` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-.
+  - \`-d --data <data:string>\` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-. A resource argument is the bare string $res:<path> as its whole value, and a variable argument is the bare string $var:<path> — not an object wrapper keyed on $res/$var, and not a plain path.
   - \`-s --silent\` - Do not ouput anything other then the final output. Useful for scripting.
   - \`--tag <tag:string>\` - Override the worker tag the run is dispatched to (e.g. to route it to dev workers instead of the flow's default tag).
 - \`flow preview <flow_path:string>\` - preview a local flow without deploying it. Runs the flow definition from local files and uses local PathScripts by default. Pass --step <id> to run only one module in isolation (resolves nested steps inside branchone/branchall/forloopflow/whileloopflow plus the special preprocessor/failure modules; supported step types: rawscript, script, flow).
-  - \`-d --data <data:string>\` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-.
+  - \`-d --data <data:string>\` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-. A resource argument is the bare string $res:<path> as its whole value, and a variable argument is the bare string $var:<path> — not an object wrapper keyed on $res/$var, and not a plain path.
   - \`-s --silent\` - Do not output anything other then the final output. Useful for scripting.
   - \`--remote\` - Use deployed workspace scripts for PathScript steps instead of local files.
   - \`--step <step_id:string>\` - Run only the named step instead of the whole flow. Honors --data as the step's args and --remote / local-PathScript resolution the same way the full-flow preview does.
@@ -7474,11 +7511,11 @@ script related commands
   - \`--json\` - Output as JSON (for piping to jq)
 - \`script show <path:file>\` - show a script's content (alias for get)
 - \`script run <path:file>\` - run a script by path
-  - \`-d --data <data:file>\` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-.
+  - \`-d --data <data:file>\` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-. A resource argument is the bare string $res:<path> as its whole value, and a variable argument is the bare string $var:<path> — not an object wrapper keyed on $res/$var, and not a plain path.
   - \`-s --silent\` - Do not output anything other then the final output. Useful for scripting.
   - \`--tag <tag:string>\` - Override the worker tag the run is dispatched to (e.g. to route it to dev workers instead of the script's default tag).
 - \`script preview <path:file>\` - preview a local script without deploying it. Supports both regular and codebase scripts.
-  - \`-d --data <data:file>\` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-.
+  - \`-d --data <data:file>\` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-. A resource argument is the bare string $res:<path> as its whole value, and a variable argument is the bare string $var:<path> — not an object wrapper keyed on $res/$var, and not a plain path.
   - \`-s --silent\` - Do not output anything other than the final output. Useful for scripting.
   - \`--tag <tag:string>\` - Override the worker tag the preview is dispatched to (e.g. to route it to dev workers instead of the script's default tag).
 - \`script new <path:file> <language:string>\` - create a new script
diff --git a/frontend/src/lib/components/copilot/chat/global/core.ts b/frontend/src/lib/components/copilot/chat/global/core.ts
index 4e08dcebe9..e919769e7a 100644
--- a/frontend/src/lib/components/copilot/chat/global/core.ts
+++ b/frontend/src/lib/components/copilot/chat/global/core.ts
@@ -645,7 +645,7 @@ const writeVariableSchema = variableRequestSchema.extend({
 		.string()
 		.optional()
 		.describe(
-			'The value of the variable. Omit it to leave the value alone — required only when creating a new variable, or when changing a secret variable into a non-secret one. Never invent or guess the value of an existing variable: you cannot read it, and a "$var:..." reference is NOT a valid value (that syntax only references a variable from inside a resource). Omitting it keeps whatever the draft already holds, so a value you set earlier in this conversation stays set; discard_local_draft abandons it.'
+			'The value of the variable. Omit it to leave the value alone — required only when creating a new variable, or when changing a secret variable into a non-secret one. Never invent or guess the value of an existing variable: you cannot read it, and a "$var:..." reference is NOT a valid value (a variable cannot reference itself). Omitting it keeps whatever the draft already holds, so a value you set earlier in this conversation stays set; discard_local_draft abandons it.'
 		),
 	is_secret: z
 		.boolean()
@@ -854,7 +854,9 @@ const testRunArgsSchema = z
 	.record(z.string(), z.any())
 	.nullable()
 	.optional()
-	.describe('Arguments to pass to the runnable. Omit or pass null when no arguments are needed.')
+	.describe(
+		'Arguments to pass to the runnable. Omit or pass null when no arguments are needed. An argument typed as a resource (format "resource-<type>" in the input schema) takes the bare string "$res:<path>" as its whole value — never an object wrapper like {"$res": "<path>"}, and never a plain path, both of which reach the runnable unresolved. Same for a variable, with "$var:<path>". The prefixed string can also sit in a nested field, e.g. {"gh_auth": {"token": "$var:g/all/gh_token"}}.'
+	)
 
 const backgroundArgSchema = z
 	.boolean()
@@ -2214,7 +2216,7 @@ function getResourceInstructions(): string {
 - Reading a variable returns \`{ type: 'variable', path, summary?, isSecret, isDraft }\` — never its value, secret or not. \`isSecret\` tells you whether the value is encrypted.
 - \`write_variable\` takes \`{ path, value?, is_secret?, description?, account?, is_oauth?, expires_at?, labels? }\`. Creating a variable needs \`value\` and \`is_secret\`; editing one needs only the fields you are changing. Omitting \`value\` keeps the stored value, which is the only way to edit a secret variable — you cannot read its value, so passing any \`value\` you did not get from the user destroys it.
 - For secret fields in a resource value, do NOT inline the raw secret. Create a Variable first with \`is_secret: true\`, then in the resource value reference it as \`"$var:path/to/variable"\`.
-- Reference formats inside resource values: \`$var:g/all/name\` (global), \`$var:u/user/name\` (user), \`$var:f/folder/name\` (folder). Reference another resource with \`$res:path/to/resource\`. These are references FROM a resource value; never store a \`$var:\` string as a variable's own value.
+- Reference formats inside resource values: \`$var:g/all/name\` (global), \`$var:u/user/name\` (user), \`$var:f/folder/name\` (folder). Reference another resource with \`$res:path/to/resource\`. The same strings are also how a resource or variable is passed as a run argument (see the run-argument rule in the resource reference below); what they are never valid as is a variable's own value.
 - When deploying drafts that depend on each other (e.g., a resource and the variables it references), deploy the variables first.
 - Use \`search_resource_types\` to discover valid \`resource_type\` names and their JSON Schemas. Match the resource value to that schema.
 - For OAuth resources, the \`is_oauth: true\` flag is managed by Windmill's OAuth flow; global mode generally creates manual resources, not OAuth ones.
@@ -5105,7 +5107,7 @@ function writeVariableDraft(args: WriteVariableArgs, ctx: WriteDraftCtx): Promis
 	// is always the model echoing the reference syntax back instead of a real value.
 	if (args.value === `$var:${args.path}`) {
 		throw new Error(
-			`"${args.value}" is not a valid value for variable "${args.path}" — it is a self-reference. The "$var:" syntax only references a variable from inside a resource value. Omit value to keep the current one.`
+			`"${args.value}" is not a valid value for variable "${args.path}" — it is a self-reference. Omit value to keep the current one.`
 		)
 	}
 	return writeDraft(VARIABLE_SPEC, 'variable', args.path, args, ctx, { override: args.override })
diff --git a/frontend/src/lib/mcpEndpointTools.ts b/frontend/src/lib/mcpEndpointTools.ts
index 3e8ae4cba0..ce4adf82be 100644
--- a/frontend/src/lib/mcpEndpointTools.ts
+++ b/frontend/src/lib/mcpEndpointTools.ts
@@ -885,7 +885,7 @@ export const mcpEndpointTools: EndpointTool[] = [
     {
         name: "runScriptByPath",
         description: "run script by path",
-        instructions: "You should first use getScriptByPath to retrieve the script's schema and understand what arguments are expected.",
+        instructions: "You should first use getScriptByPath to retrieve the script's schema and understand what arguments are expected. A resource argument (schema format `resource-<type>`) is the bare string `$res:<path>` as that whole argument value -- not a wrapper object, not a plain path. A variable is `$var:<path>`.",
         path: "/w/{workspace}/jobs/run/p/{path}",
         method: "POST",
         pathParamsSchema: {
@@ -1426,7 +1426,7 @@ export const mcpEndpointTools: EndpointTool[] = [
     {
         name: "runFlowByPath",
         description: "run flow by path",
-        instructions: "You should first use getFlowByPath to retrieve the flow's schema and understand what arguments are expected.",
+        instructions: "You should first use getFlowByPath to retrieve the flow's schema and understand what arguments are expected. A resource argument (schema format `resource-<type>`) is the bare string `$res:<path>` as that whole argument value -- not a wrapper object, not a plain path. A variable is `$var:<path>`.",
         path: "/w/{workspace}/jobs/run/f/{path}",
         method: "POST",
         pathParamsSchema: {
diff --git a/system_prompts/auto-generated/cli/cli-commands.md b/system_prompts/auto-generated/cli/cli-commands.md
index e51c8371dc..acf6622dc9 100644
--- a/system_prompts/auto-generated/cli/cli-commands.md
+++ b/system_prompts/auto-generated/cli/cli-commands.md
@@ -160,11 +160,11 @@ flow related commands
 - `flow push <file_path:string> <remote_path:string>` - push a local flow spec. This overrides any remote versions.
   - `--message <message:string>` - Deployment message
 - `flow run <path:string>` - run a flow by path.
-  - `-d --data <data:string>` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-.
+  - `-d --data <data:string>` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-. A resource argument is the bare string $res:<path> as its whole value, and a variable argument is the bare string $var:<path> — not an object wrapper keyed on $res/$var, and not a plain path.
   - `-s --silent` - Do not ouput anything other then the final output. Useful for scripting.
   - `--tag <tag:string>` - Override the worker tag the run is dispatched to (e.g. to route it to dev workers instead of the flow's default tag).
 - `flow preview <flow_path:string>` - preview a local flow without deploying it. Runs the flow definition from local files and uses local PathScripts by default. Pass --step <id> to run only one module in isolation (resolves nested steps inside branchone/branchall/forloopflow/whileloopflow plus the special preprocessor/failure modules; supported step types: rawscript, script, flow).
-  - `-d --data <data:string>` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-.
+  - `-d --data <data:string>` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-. A resource argument is the bare string $res:<path> as its whole value, and a variable argument is the bare string $var:<path> — not an object wrapper keyed on $res/$var, and not a plain path.
   - `-s --silent` - Do not output anything other then the final output. Useful for scripting.
   - `--remote` - Use deployed workspace scripts for PathScript steps instead of local files.
   - `--step <step_id:string>` - Run only the named step instead of the whole flow. Honors --data as the step's args and --remote / local-PathScript resolution the same way the full-flow preview does.
@@ -560,11 +560,11 @@ script related commands
   - `--json` - Output as JSON (for piping to jq)
 - `script show <path:file>` - show a script's content (alias for get)
 - `script run <path:file>` - run a script by path
-  - `-d --data <data:file>` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-.
+  - `-d --data <data:file>` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-. A resource argument is the bare string $res:<path> as its whole value, and a variable argument is the bare string $var:<path> — not an object wrapper keyed on $res/$var, and not a plain path.
   - `-s --silent` - Do not output anything other then the final output. Useful for scripting.
   - `--tag <tag:string>` - Override the worker tag the run is dispatched to (e.g. to route it to dev workers instead of the script's default tag).
 - `script preview <path:file>` - preview a local script without deploying it. Supports both regular and codebase scripts.
-  - `-d --data <data:file>` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-.
+  - `-d --data <data:file>` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-. A resource argument is the bare string $res:<path> as its whole value, and a variable argument is the bare string $var:<path> — not an object wrapper keyed on $res/$var, and not a plain path.
   - `-s --silent` - Do not output anything other than the final output. Useful for scripting.
   - `--tag <tag:string>` - Override the worker tag the preview is dispatched to (e.g. to route it to dev workers instead of the script's default tag).
 - `script new <path:file> <language:string>` - create a new script
diff --git a/system_prompts/auto-generated/prompts.ts b/system_prompts/auto-generated/prompts.ts
index 918b88cb21..1feeadc162 100644
--- a/system_prompts/auto-generated/prompts.ts
+++ b/system_prompts/auto-generated/prompts.ts
@@ -498,6 +498,41 @@ Reference other resources:
 }
 \`\`\`
 
+## Passing a Resource or Variable as a Run Argument
+
+A script or flow argument typed as a resource (schema \`format: resource-<type>\`) is passed as
+the **bare string** \`$res:<path>\` — the whole argument value. Same for a variable, with
+\`$var:<path>\`. This applies everywhere job arguments are supplied: \`wmill script run/preview\`,
+\`wmill flow run/preview\`, the \`runScriptByPath\` / \`runFlowByPath\` API, a schedule's \`args\`, a
+trigger's configured static args.
+
+\`\`\`json
+{
+  "db": "$res:f/databases/postgres_prod",
+  "api_token": "$var:g/all/api_token"
+}
+\`\`\`
+
+The reference is resolved when the job runs, under the job's run-as identity — the caller for an
+ordinary run, but the configured principal for a schedule, a trigger, or a runnable set to run on
+behalf of someone else. The run fails if that identity cannot read the referenced resource or
+variable.
+
+**Never wrap it in an object.** The resolver only rewrites a JSON value that *is* a string
+starting with \`$res:\` / \`$var:\`; keys are never inspected. These are all wrong and are passed
+through to the script unchanged:
+
+\`\`\`json
+{ "db": { "$res": "f/databases/postgres_prod" } }
+{ "db": { "resource": "f/databases/postgres_prod" } }
+{ "db": "f/databases/postgres_prod" }
+\`\`\`
+
+The string may sit anywhere a string can — a top-level argument, a nested object field
+(\`{ "gh_auth": { "token": "$var:g/all/gh_token" } }\`), or an array element (array elements are
+walked only while nested at most two levels deep, and only for arrays of at most 1000 items).
+The prefix must be on the string itself.
+
 ## Common Resource Types
 
 ### PostgreSQL
@@ -3226,11 +3261,11 @@ flow related commands
 - \`flow push <file_path:string> <remote_path:string>\` - push a local flow spec. This overrides any remote versions.
   - \`--message <message:string>\` - Deployment message
 - \`flow run <path:string>\` - run a flow by path.
-  - \`-d --data <data:string>\` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-.
+  - \`-d --data <data:string>\` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-. A resource argument is the bare string $res:<path> as its whole value, and a variable argument is the bare string $var:<path> — not an object wrapper keyed on $res/$var, and not a plain path.
   - \`-s --silent\` - Do not ouput anything other then the final output. Useful for scripting.
   - \`--tag <tag:string>\` - Override the worker tag the run is dispatched to (e.g. to route it to dev workers instead of the flow's default tag).
 - \`flow preview <flow_path:string>\` - preview a local flow without deploying it. Runs the flow definition from local files and uses local PathScripts by default. Pass --step <id> to run only one module in isolation (resolves nested steps inside branchone/branchall/forloopflow/whileloopflow plus the special preprocessor/failure modules; supported step types: rawscript, script, flow).
-  - \`-d --data <data:string>\` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-.
+  - \`-d --data <data:string>\` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-. A resource argument is the bare string $res:<path> as its whole value, and a variable argument is the bare string $var:<path> — not an object wrapper keyed on $res/$var, and not a plain path.
   - \`-s --silent\` - Do not output anything other then the final output. Useful for scripting.
   - \`--remote\` - Use deployed workspace scripts for PathScript steps instead of local files.
   - \`--step <step_id:string>\` - Run only the named step instead of the whole flow. Honors --data as the step's args and --remote / local-PathScript resolution the same way the full-flow preview does.
@@ -3626,11 +3661,11 @@ script related commands
   - \`--json\` - Output as JSON (for piping to jq)
 - \`script show <path:file>\` - show a script's content (alias for get)
 - \`script run <path:file>\` - run a script by path
-  - \`-d --data <data:file>\` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-.
+  - \`-d --data <data:file>\` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-. A resource argument is the bare string $res:<path> as its whole value, and a variable argument is the bare string $var:<path> — not an object wrapper keyed on $res/$var, and not a plain path.
   - \`-s --silent\` - Do not output anything other then the final output. Useful for scripting.
   - \`--tag <tag:string>\` - Override the worker tag the run is dispatched to (e.g. to route it to dev workers instead of the script's default tag).
 - \`script preview <path:file>\` - preview a local script without deploying it. Supports both regular and codebase scripts.
-  - \`-d --data <data:file>\` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-.
+  - \`-d --data <data:file>\` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-. A resource argument is the bare string $res:<path> as its whole value, and a variable argument is the bare string $var:<path> — not an object wrapper keyed on $res/$var, and not a plain path.
   - \`-s --silent\` - Do not output anything other than the final output. Useful for scripting.
   - \`--tag <tag:string>\` - Override the worker tag the preview is dispatched to (e.g. to route it to dev workers instead of the script's default tag).
 - \`script new <path:file> <language:string>\` - create a new script
diff --git a/system_prompts/auto-generated/skills/cli-commands/SKILL.md b/system_prompts/auto-generated/skills/cli-commands/SKILL.md
index 1f3c54ea26..fef40d3341 100644
--- a/system_prompts/auto-generated/skills/cli-commands/SKILL.md
+++ b/system_prompts/auto-generated/skills/cli-commands/SKILL.md
@@ -165,11 +165,11 @@ flow related commands
 - `flow push <file_path:string> <remote_path:string>` - push a local flow spec. This overrides any remote versions.
   - `--message <message:string>` - Deployment message
 - `flow run <path:string>` - run a flow by path.
-  - `-d --data <data:string>` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-.
+  - `-d --data <data:string>` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-. A resource argument is the bare string $res:<path> as its whole value, and a variable argument is the bare string $var:<path> — not an object wrapper keyed on $res/$var, and not a plain path.
   - `-s --silent` - Do not ouput anything other then the final output. Useful for scripting.
   - `--tag <tag:string>` - Override the worker tag the run is dispatched to (e.g. to route it to dev workers instead of the flow's default tag).
 - `flow preview <flow_path:string>` - preview a local flow without deploying it. Runs the flow definition from local files and uses local PathScripts by default. Pass --step <id> to run only one module in isolation (resolves nested steps inside branchone/branchall/forloopflow/whileloopflow plus the special preprocessor/failure modules; supported step types: rawscript, script, flow).
-  - `-d --data <data:string>` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-.
+  - `-d --data <data:string>` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-. A resource argument is the bare string $res:<path> as its whole value, and a variable argument is the bare string $var:<path> — not an object wrapper keyed on $res/$var, and not a plain path.
   - `-s --silent` - Do not output anything other then the final output. Useful for scripting.
   - `--remote` - Use deployed workspace scripts for PathScript steps instead of local files.
   - `--step <step_id:string>` - Run only the named step instead of the whole flow. Honors --data as the step's args and --remote / local-PathScript resolution the same way the full-flow preview does.
@@ -565,11 +565,11 @@ script related commands
   - `--json` - Output as JSON (for piping to jq)
 - `script show <path:file>` - show a script's content (alias for get)
 - `script run <path:file>` - run a script by path
-  - `-d --data <data:file>` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-.
+  - `-d --data <data:file>` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-. A resource argument is the bare string $res:<path> as its whole value, and a variable argument is the bare string $var:<path> — not an object wrapper keyed on $res/$var, and not a plain path.
   - `-s --silent` - Do not output anything other then the final output. Useful for scripting.
   - `--tag <tag:string>` - Override the worker tag the run is dispatched to (e.g. to route it to dev workers instead of the script's default tag).
 - `script preview <path:file>` - preview a local script without deploying it. Supports both regular and codebase scripts.
-  - `-d --data <data:file>` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-.
+  - `-d --data <data:file>` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-. A resource argument is the bare string $res:<path> as its whole value, and a variable argument is the bare string $var:<path> — not an object wrapper keyed on $res/$var, and not a plain path.
   - `-s --silent` - Do not output anything other than the final output. Useful for scripting.
   - `--tag <tag:string>` - Override the worker tag the preview is dispatched to (e.g. to route it to dev workers instead of the script's default tag).
 - `script new <path:file> <language:string>` - create a new script
diff --git a/system_prompts/auto-generated/skills/resources/SKILL.md b/system_prompts/auto-generated/skills/resources/SKILL.md
index 19b8c9f420..396b3b9d8e 100644
--- a/system_prompts/auto-generated/skills/resources/SKILL.md
+++ b/system_prompts/auto-generated/skills/resources/SKILL.md
@@ -64,6 +64,41 @@ Reference other resources:
 }
 ```
 
+## Passing a Resource or Variable as a Run Argument
+
+A script or flow argument typed as a resource (schema `format: resource-<type>`) is passed as
+the **bare string** `$res:<path>` — the whole argument value. Same for a variable, with
+`$var:<path>`. This applies everywhere job arguments are supplied: `wmill script run/preview`,
+`wmill flow run/preview`, the `runScriptByPath` / `runFlowByPath` API, a schedule's `args`, a
+trigger's configured static args.
+
+```json
+{
+  "db": "$res:f/databases/postgres_prod",
+  "api_token": "$var:g/all/api_token"
+}
+```
+
+The reference is resolved when the job runs, under the job's run-as identity — the caller for an
+ordinary run, but the configured principal for a schedule, a trigger, or a runnable set to run on
+behalf of someone else. The run fails if that identity cannot read the referenced resource or
+variable.
+
+**Never wrap it in an object.** The resolver only rewrites a JSON value that *is* a string
+starting with `$res:` / `$var:`; keys are never inspected. These are all wrong and are passed
+through to the script unchanged:
+
+```json
+{ "db": { "$res": "f/databases/postgres_prod" } }
+{ "db": { "resource": "f/databases/postgres_prod" } }
+{ "db": "f/databases/postgres_prod" }
+```
+
+The string may sit anywhere a string can — a top-level argument, a nested object field
+(`{ "gh_auth": { "token": "$var:g/all/gh_token" } }`), or an array element (array elements are
+walked only while nested at most two levels deep, and only for arrays of at most 1000 items).
+The prefix must be on the string itself.
+
 ## Common Resource Types
 
 ### PostgreSQL
diff --git a/system_prompts/auto-generated/skills/write-flow/SKILL.md b/system_prompts/auto-generated/skills/write-flow/SKILL.md
index 6a5f36e9b4..925ffbe6ec 100644
--- a/system_prompts/auto-generated/skills/write-flow/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-flow/SKILL.md
@@ -77,6 +77,8 @@ If the user hasn't already told you to run/test the flow, offer it as a one-sent
 
 If the user already asked to test/run/try the flow in their original request, skip the offer and just execute `wmill flow preview <path> -d '<args>'` directly — pick plausible args from the flow's input schema.
 
+An input typed as a resource (`format: resource-<type>` in the schema) takes the bare string `"$res:<path>"` as its whole value — `-d '{"db": "$res:f/databases/postgres_prod"}'`, not `{"db": {"$res": "..."}}` and not a plain path. Same for a variable, with `"$var:<path>"`. See the `resources` skill.
+
 `wmill flow preview` is safe to run yourself (it does not deploy). `wmill generate-metadata` does not deploy either (it only writes local lock/hash files) but re-resolves deps — offer it and run on agreement, unless the project's `AGENTS.md` opts into automatic metadata. After running it, check the regenerated `.lock` diff and tell the user which inline-script dependency versions changed, so they can catch an unwanted bump before deploying. Only `wmill sync push` deploys; run it only when the user explicitly asks.
 
 ### Visual preview
diff --git a/system_prompts/base/flow-cli.md b/system_prompts/base/flow-cli.md
index d8a2b41b13..fa4ec9cfcc 100644
--- a/system_prompts/base/flow-cli.md
+++ b/system_prompts/base/flow-cli.md
@@ -72,6 +72,8 @@ If the user hasn't already told you to run/test the flow, offer it as a one-sent
 
 If the user already asked to test/run/try the flow in their original request, skip the offer and just execute `wmill flow preview <path> -d '<args>'` directly — pick plausible args from the flow's input schema.
 
+An input typed as a resource (`format: resource-<type>` in the schema) takes the bare string `"$res:<path>"` as its whole value — `-d '{"db": "$res:f/databases/postgres_prod"}'`, not `{"db": {"$res": "..."}}` and not a plain path. Same for a variable, with `"$var:<path>"`. See the `resources` skill.
+
 `wmill flow preview` is safe to run yourself (it does not deploy). `wmill generate-metadata` does not deploy either (it only writes local lock/hash files) but re-resolves deps — offer it and run on agreement, unless the project's `AGENTS.md` opts into automatic metadata. After running it, check the regenerated `.lock` diff and tell the user which inline-script dependency versions changed, so they can catch an unwanted bump before deploying. Only `wmill sync push` deploys; run it only when the user explicitly asks.
 
 ### Visual preview
diff --git a/system_prompts/base/resources.md b/system_prompts/base/resources.md
index 1c548a2484..5252683a81 100644
--- a/system_prompts/base/resources.md
+++ b/system_prompts/base/resources.md
@@ -59,6 +59,41 @@ Reference other resources:
 }
 ```
 
+## Passing a Resource or Variable as a Run Argument
+
+A script or flow argument typed as a resource (schema `format: resource-<type>`) is passed as
+the **bare string** `$res:<path>` — the whole argument value. Same for a variable, with
+`$var:<path>`. This applies everywhere job arguments are supplied: `wmill script run/preview`,
+`wmill flow run/preview`, the `runScriptByPath` / `runFlowByPath` API, a schedule's `args`, a
+trigger's configured static args.
+
+```json
+{
+  "db": "$res:f/databases/postgres_prod",
+  "api_token": "$var:g/all/api_token"
+}
+```
+
+The reference is resolved when the job runs, under the job's run-as identity — the caller for an
+ordinary run, but the configured principal for a schedule, a trigger, or a runnable set to run on
+behalf of someone else. The run fails if that identity cannot read the referenced resource or
+variable.
+
+**Never wrap it in an object.** The resolver only rewrites a JSON value that *is* a string
+starting with `$res:` / `$var:`; keys are never inspected. These are all wrong and are passed
+through to the script unchanged:
+
+```json
+{ "db": { "$res": "f/databases/postgres_prod" } }
+{ "db": { "resource": "f/databases/postgres_prod" } }
+{ "db": "f/databases/postgres_prod" }
+```
+
+The string may sit anywhere a string can — a top-level argument, a nested object field
+(`{ "gh_auth": { "token": "$var:g/all/gh_token" } }`), or an array element (array elements are
+walked only while nested at most two levels deep, and only for arrays of at most 1000 items).
+The prefix must be on the string itself.
+
 ## Common Resource Types
 
 ### PostgreSQL

From e474e8803ce2ff5c2df09a58dab51d45f5c922ca Mon Sep 17 00:00:00 2001
From: hugocasa <hugo@casademont.ch>
Date: Thu, 3 Sep 2026 11:30:20 +0200
Subject: [PATCH 21/31] feat: expose request headers to scripts invoked via MCP
 (#10903)

* feat: expose allowlisted request headers to scripts invoked via MCP

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F4i1qCTY9HQMqCPTBeTiV9

* fix: close header-forgery routes flagged in review of MCP header passthrough

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F4i1qCTY9HQMqCPTBeTiV9

* fix: match allowlisted headers exactly and withdraw every model-args run path

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F4i1qCTY9HQMqCPTBeTiV9

* fix: address review nits on MCP header passthrough

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F4i1qCTY9HQMqCPTBeTiV9

* fix: stop over-withdrawing deleteScriptByHash and align schema strip key space

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F4i1qCTY9HQMqCPTBeTiV9

* refactor: move MCP header field detail into a label tooltip

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F4i1qCTY9HQMqCPTBeTiV9

* fix: bound include_header parsing and narrow the duplicate-header drop

* feat: handle runnable-executing tools instead of withdrawing them

* docs: record the preprocessor kind seam on proxied run-by-path

* fix: strip every runnable argument map and open the field to gateway tokens

* fix: withhold connection credentials from runnables unless explicitly named

* fix: keep endpoint control arguments out of the transport-owned strip

* fix: exempt workspace_id from the strip only where it routes the call

* style: reindent the MCP header tooltip block

* refactor: deliver MCP request headers through the preprocessor only

* fix: widen the proxy-owned header set and clear docs left by the redesign

* fix: count proxied header delivery and finish the redesign doc sweep

* fix: forward proxied headers only to a runnable that has a preprocessor

* refactor: drop include_header and the MCP credential deny list

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F4i1qCTY9HQMqCPTBeTiV9

* chore: restore the blank line in CreateToken

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F4i1qCTY9HQMqCPTBeTiV9

* refactor: drop the mcp header_passthrough feature usage counter

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F4i1qCTY9HQMqCPTBeTiV9

* test: pin that a caller credential other than the hop's own travels

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F4i1qCTY9HQMqCPTBeTiV9

* refactor: deliver headers only through the direct script and flow tools

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F4i1qCTY9HQMqCPTBeTiV9

* feat: withhold connection credentials and pin MCP header delivery end to end

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F4i1qCTY9HQMqCPTBeTiV9

* test: send every credential the withheld-list assertions cover

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F4i1qCTY9HQMqCPTBeTiV9

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
---
 .../tests/mcp_preprocessor_headers.rs         | 186 ++++++++++++++++++
 backend/windmill-api/src/lib.rs               |  14 +-
 backend/windmill-api/src/mcp/core.rs          |  14 +-
 backend/windmill-api/src/mcp/utils.rs         | 118 ++++++++++-
 backend/windmill-mcp/src/server/backend.rs    |  10 +
 backend/windmill-mcp/src/server/mod.rs        |   2 +-
 backend/windmill-mcp/src/server/runner.rs     |  80 +++++---
 7 files changed, 381 insertions(+), 43 deletions(-)
 create mode 100644 backend/windmill-api-integration-tests/tests/mcp_preprocessor_headers.rs

diff --git a/backend/windmill-api-integration-tests/tests/mcp_preprocessor_headers.rs b/backend/windmill-api-integration-tests/tests/mcp_preprocessor_headers.rs
new file mode 100644
index 0000000000..3e1035ff82
--- /dev/null
+++ b/backend/windmill-api-integration-tests/tests/mcp_preprocessor_headers.rs
@@ -0,0 +1,186 @@
+//! Request headers reaching a runnable's preprocessor over MCP.
+//!
+//! The property this pins is structural rather than a filter: the model writes
+//! the tool's arguments, which become `event.body`, while the server writes
+//! `event.headers`. A model that guesses a header's name can only ever land in
+//! `body`, so an identity read from `headers` is one prompt injection cannot
+//! forge. Nothing else in the suite exercises MCP argument shaping end to end.
+//!
+//! Requires: bun runtime, live database (migrations applied by sqlx::test).
+#![cfg(feature = "mcp")]
+
+use serde_json::{json, Value};
+use sqlx::{Pool, Postgres};
+use windmill_test_utils::*;
+
+const SCRIPT_PATH: &str = "u/test-user/mcp_hdr_probe";
+
+/// Echoes the two halves of the event separately, so the assertions can tell
+/// which one a value arrived in.
+const PREPROCESSOR_SCRIPT: &str = r#"
+export async function preprocessor(event: any) {
+  return {
+    kind: event.kind,
+    from_headers: event.headers?.["x-user-id"] ?? "",
+    from_body: event.body?.x_user_id ?? "",
+    header_names: Object.keys(event.headers ?? {}).sort(),
+  };
+}
+
+export async function main(kind: string, from_headers: string, from_body: string, header_names: string[]) {
+  return { kind, from_headers, from_body, header_names };
+}
+"#;
+
+async fn insert_mcp_token(db: &Pool<Postgres>) -> anyhow::Result<()> {
+    sqlx::query(
+        "INSERT INTO token (token_hash, token_prefix, token, email, label, super_admin, scopes)
+         VALUES (encode(sha256('MCP_TOKEN'::bytea), 'hex'), 'MCP_TOK', 'MCP_TOKEN', 'test@windmill.dev', 'mcp token', true, ARRAY['mcp:all'])",
+    )
+    .execute(db)
+    .await?;
+    Ok(())
+}
+
+/// POST one JSON-RPC message. The endpoint answers either `application/json` or
+/// a single-event SSE stream, so strip the `data: ` framing before parsing.
+async fn mcp_post(port: u16, headers: &[(&str, &str)], body: Value) -> anyhow::Result<Value> {
+    let mut req = reqwest::Client::new()
+        .post(format!(
+            "http://localhost:{port}/api/mcp/w/test-workspace/mcp"
+        ))
+        .header("Authorization", "Bearer MCP_TOKEN")
+        .header("Accept", "application/json, text/event-stream")
+        .json(&body);
+    for (k, v) in headers {
+        req = req.header(*k, *v);
+    }
+    let text = req.send().await?.text().await?;
+    let payload = text
+        .lines()
+        .find_map(|l| l.strip_prefix("data: "))
+        .unwrap_or(text.trim());
+    serde_json::from_str(payload).map_err(|e| anyhow::anyhow!("unparseable MCP body {text:?}: {e}"))
+}
+
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn test_mcp_preprocessor_receives_the_callers_headers(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    set_jwt_secret().await;
+    insert_mcp_token(&db).await?;
+    let server = ApiServer::start_mcp(db.clone()).await?;
+    let port = server.addr.port();
+
+    let resp = reqwest::Client::new()
+        .post(format!(
+            "http://localhost:{port}/api/w/test-workspace/scripts/create"
+        ))
+        .header("Authorization", "Bearer SECRET_TOKEN")
+        .json(&json!({
+            "path": SCRIPT_PATH,
+            "summary": "mcp header probe",
+            "description": "",
+            "content": PREPROCESSOR_SCRIPT,
+            "language": "bun",
+            "lock": "",
+            "schema": {
+                "$schema": "https://json-schema.org/draft/2020-12/schema",
+                "type": "object",
+                "properties": { "x_user_id": { "type": "string" } },
+                "required": []
+            }
+        }))
+        .send()
+        .await?;
+    assert_eq!(
+        resp.status(),
+        201,
+        "create script: {}",
+        resp.text().await.unwrap_or_default()
+    );
+
+    // A script counts as deployed once it has a lock, which normally arrives from
+    // a dependency job. Planting an empty one keeps the test to the path under
+    // test instead of a bun resolution whose timing it does not control.
+    sqlx::query("UPDATE script SET lock = '' WHERE path = $1 AND workspace_id = 'test-workspace'")
+        .bind(SCRIPT_PATH)
+        .execute(&db)
+        .await?;
+
+    let tools = mcp_post(
+        port,
+        &[],
+        json!({"jsonrpc": "2.0", "id": 1, "method": "tools/list", "params": {}}),
+    )
+    .await?;
+    let tool_name = tools["result"]["tools"]
+        .as_array()
+        .and_then(|list| {
+            list.iter()
+                .filter_map(|t| t["name"].as_str())
+                .find(|n| n.contains("mcp__hdr__probe"))
+        })
+        .ok_or_else(|| anyhow::anyhow!("the deployed script was not listed as a tool: {tools}"))?
+        .to_string();
+
+    let result = in_test_worker(
+        db.clone(),
+        async {
+            mcp_post(
+                port,
+                // Every name the withheld list covers has to be on the wire, or
+                // asserting its absence proves nothing. `Authorization` is already
+                // set by `mcp_post`, and `extract_token` reads it before the
+                // cookie, so sending one does not disturb auth.
+                &[
+                    ("X-User-Id", "alice@corp.example"),
+                    ("Cookie", "session=secret"),
+                    ("Proxy-Authorization", "Basic Zm9v"),
+                ],
+                json!({
+                    "jsonrpc": "2.0", "id": 2, "method": "tools/call",
+                    // The model names the header it wants to spoof. Its value is an
+                    // argument, so it can only ever reach `event.body`.
+                    "params": { "name": tool_name, "arguments": { "x_user_id": "attacker@evil.test" } }
+                }),
+            )
+            .await
+        },
+        port,
+    )
+    .await?;
+
+    let text = result["result"]["content"][0]["text"]
+        .as_str()
+        .ok_or_else(|| anyhow::anyhow!("tool call returned no text content: {result}"))?;
+    let out: Value = serde_json::from_str(text)?;
+
+    assert_eq!(out["kind"], "mcp", "preprocessor event kind: {out}");
+    assert_eq!(
+        out["from_headers"], "alice@corp.example",
+        "the caller's header must reach event.headers: {out}"
+    );
+    assert_eq!(
+        out["from_body"], "attacker@evil.test",
+        "the model's argument must land in event.body, not overwrite the header: {out}"
+    );
+
+    let names: Vec<&str> = out["header_names"]
+        .as_array()
+        .map(|a| a.iter().filter_map(|v| v.as_str()).collect())
+        .unwrap_or_default();
+    assert!(
+        names.contains(&"x-user-id"),
+        "event.headers must carry the request's own headers: {names:?}"
+    );
+    for withheld in ["authorization", "cookie", "proxy-authorization"] {
+        assert!(
+            !names.contains(&withheld),
+            "{withheld} is withheld from a preprocessor: {names:?}"
+        );
+    }
+
+    Ok(())
+}
diff --git a/backend/windmill-api/src/lib.rs b/backend/windmill-api/src/lib.rs
index b6337351a4..054af0f2fa 100644
--- a/backend/windmill-api/src/lib.rs
+++ b/backend/windmill-api/src/lib.rs
@@ -452,15 +452,15 @@ pub async fn run_server(
     // unless they are allowed — hence a separate layer rather than widening the
     // one every other route shares. (`Mcp-Param-*` is only sent for tool inputs
     // annotated with `x-mcp-header`, which no tool here declares.)
+    //
+    // The request's own header list is mirrored rather than enumerated: a browser
+    // MCP client may send any custom name for a preprocessor to read, and no fixed
+    // list could cover them. Nothing is granted by echoing it: the origin is
+    // `Any`, so browsers never attach credentials, and the endpoint authenticates
+    // each request on its own.
     let mcp_cors = CorsLayer::new()
         .allow_methods([http::Method::GET, http::Method::POST, http::Method::DELETE])
-        .allow_headers([
-            http::header::CONTENT_TYPE,
-            http::header::AUTHORIZATION,
-            http::HeaderName::from_static("mcp-protocol-version"),
-            http::HeaderName::from_static("mcp-method"),
-            http::HeaderName::from_static("mcp-name"),
-        ])
+        .allow_headers(tower_http::cors::AllowHeaders::mirror_request())
         // The 401 challenge is how a client discovers where to authorize (RFC 9728),
         // and it is not a safelisted response header, so without this a browser
         // client sees an empty one and has no way to begin the OAuth flow.
diff --git a/backend/windmill-api/src/mcp/core.rs b/backend/windmill-api/src/mcp/core.rs
index 2b4350bcfe..480e3c0841 100644
--- a/backend/windmill-api/src/mcp/core.rs
+++ b/backend/windmill-api/src/mcp/core.rs
@@ -12,7 +12,9 @@ use windmill_mcp::common::transform::transform_property_keys;
 use windmill_mcp::common::types::{
     FlowInfo, HubScriptInfo, ResourceInfo, ResourceType, SchemaType, ScriptInfo, WorkspaceInfo,
 };
-use windmill_mcp::server::{BackendResult, EndpointTool, ErrorData, McpBackend, PathFilter};
+use windmill_mcp::server::{
+    BackendResult, EndpointTool, ErrorData, McpBackend, McpRequest, PathFilter,
+};
 
 use crate::auth::AuthCache;
 use crate::db::ApiAuthed;
@@ -214,8 +216,11 @@ impl McpBackend for WindmillBackend {
         workspace_id: &str,
         path: &str,
         args: Value,
+        request: &McpRequest<'_>,
     ) -> BackendResult<Value> {
-        let push_args = prepare_push_args(args);
+        let push_args = prepare_push_args(&self.db, workspace_id, path, false, args, request)
+            .await
+            .map_err(|e| ErrorData::internal_error(e.to_string(), None))?;
 
         let result = run_wait_result_script_by_path_internal(
             self.db.clone(),
@@ -238,8 +243,11 @@ impl McpBackend for WindmillBackend {
         workspace_id: &str,
         path: &str,
         args: Value,
+        request: &McpRequest<'_>,
     ) -> BackendResult<Value> {
-        let push_args = prepare_push_args(args);
+        let push_args = prepare_push_args(&self.db, workspace_id, path, true, args, request)
+            .await
+            .map_err(|e| ErrorData::internal_error(e.to_string(), None))?;
 
         let result = run_wait_result_flow_by_path_internal(
             self.db.clone(),
diff --git a/backend/windmill-api/src/mcp/utils.rs b/backend/windmill-api/src/mcp/utils.rs
index 94271bb662..65c8069b85 100644
--- a/backend/windmill-api/src/mcp/utils.rs
+++ b/backend/windmill-api/src/mcp/utils.rs
@@ -11,15 +11,19 @@ use serde_json::Value;
 use sql_builder::prelude::*;
 use windmill_common::auth::create_jwt_token;
 use windmill_common::db::{Authed, UserDB};
+use windmill_common::error::Error;
 use windmill_common::scripts::{get_full_hub_script_by_path, Schema};
+use windmill_common::triggers::{RunnableFormat, RunnableFormatVersion, TriggerKind};
 use windmill_common::utils::{query_elems_from_hub, StripPath};
 use windmill_common::worker::to_raw_value;
 use windmill_common::{DB, HUB_BASE_URL};
 use windmill_mcp::server::{
-    non_empty_body_fields, BackendResult, EndpointTool, ErrorData, PathFilter,
+    non_empty_body_fields, BackendResult, EndpointTool, ErrorData, McpRequest, PathFilter,
 };
 use windmill_mcp::{HubResponse, HubScriptInfo, ItemSchema, ResourceInfo, ResourceType};
+use windmill_trigger::trigger_helpers::{get_runnable_format, RunnableId};
 
+use crate::args::build_headers;
 use crate::db::ApiAuthed;
 use crate::HTTP_CLIENT;
 
@@ -641,7 +645,7 @@ fn selects_endpoint_tool(caller_scopes: &[String], tool: &str) -> bool {
         .is_ok_and(|config| config.endpoints.iter().any(|e| e == tool))
 }
 
-/// Create HTTP request with authentication
+/// Create HTTP request with authentication.
 pub async fn create_http_request(
     method: &str,
     url: &str,
@@ -702,17 +706,113 @@ pub async fn create_http_request(
         .map_err(|e| ErrorData::internal_error(format!("Failed to execute request: {}", e), None))
 }
 
-/// Convert a JSON Value into PushArgsOwned for job execution
-pub fn prepare_push_args(args: Value) -> windmill_queue::PushArgsOwned {
+/// The `kind` an MCP-invoked runnable sees on its preprocessor event, alongside
+/// `webhook`, `http` and the trigger kinds.
+const MCP_TRIGGER_KEY: &str = "mcp";
+
+/// A preprocessor's view of the MCP request that ran it. Mirrors the HTTP
+/// trigger event: `body` is what the model sent, everything else describes the
+/// call itself.
+#[derive(serde::Serialize)]
+struct McpPreprocessorEvent<'a> {
+    kind: &'a str,
+    body: Box<serde_json::value::RawValue>,
+    headers: HashMap<String, Box<serde_json::value::RawValue>>,
+    tool_name: &'a str,
+}
+
+/// Headers withheld from a preprocessor because they authenticate the connection.
+///
+/// Not a security boundary: a webhook preprocessor receives all three. Withheld
+/// because nothing needs them yet, and releasing one later is additive while
+/// withdrawing one after runnables read it is not.
+const WITHHELD_FROM_PREPROCESSOR: &[&str] = &["authorization", "cookie", "proxy-authorization"];
+
+/// Every header a preprocessor may see.
+fn preprocessor_headers(
+    headers: &http::HeaderMap,
+) -> HashMap<String, Box<serde_json::value::RawValue>> {
+    let mut selected = build_headers(headers, None, true);
+    selected.retain(|name, _| {
+        !WITHHELD_FROM_PREPROCESSOR
+            .iter()
+            .any(|withheld| withheld.eq_ignore_ascii_case(name))
+    });
+    selected
+}
+
+/// Build the job arguments for a script or flow run as an MCP tool.
+///
+/// Shaped by the runnable's own format: a preprocessor receives the request as
+/// an event, and a runnable without one receives only what the model sent.
+pub async fn prepare_push_args(
+    db: &DB,
+    w_id: &str,
+    path: &str,
+    is_flow: bool,
+    args: Value,
+    request: &McpRequest<'_>,
+) -> Result<windmill_queue::PushArgsOwned, Error> {
+    let mut main_args = HashMap::new();
     if let Value::Object(map) = args {
-        let mut args_hash = HashMap::new();
         for (k, v) in map {
-            args_hash.insert(k, to_raw_value(&v));
+            main_args.insert(k, to_raw_value(&v));
         }
-        windmill_queue::PushArgsOwned { extra: None, args: args_hash }
-    } else {
-        windmill_queue::PushArgsOwned::default()
     }
+
+    let runnable_id = if is_flow {
+        RunnableId::from_flow_path(path)
+    } else {
+        // Resolves a `hub/<version_id>` path to the hub script on its own.
+        RunnableId::from_script_path(path)
+    };
+
+    // MCP is not one of the `TRIGGER_KIND` enum values and does not need to be:
+    // the per-kind arms of the no-preprocessor heuristic are payload-shape
+    // special cases for message triggers, and `Webhook` reaches the same generic
+    // arm MCP wants while sharing that kind's format cache.
+    let runnable_format = get_runnable_format(runnable_id, w_id, db, &TriggerKind::Webhook).await?;
+
+    Ok(match runnable_format {
+        // Without a preprocessor there is nowhere for a header to go that the
+        // model does not also write: its arguments *are* the runnable's
+        // parameters, so a header bound to one of them would be a value the model
+        // could set. The request is reachable through a preprocessor, where it
+        // arrives in a key of the event the model never fills.
+        RunnableFormat { has_preprocessor: false, .. } => {
+            windmill_queue::PushArgsOwned { args: main_args, extra: None }
+        }
+        RunnableFormat { has_preprocessor: true, version } => {
+            let headers = preprocessor_headers(request.headers);
+            match version {
+                RunnableFormatVersion::V2 => {
+                    let event = McpPreprocessorEvent {
+                        kind: MCP_TRIGGER_KEY,
+                        body: to_raw_value(&main_args),
+                        headers,
+                        tool_name: request.tool_name,
+                    };
+                    windmill_queue::PushArgsOwned {
+                        args: HashMap::from([("event".to_string(), to_raw_value(&event))]),
+                        extra: None,
+                    }
+                }
+                RunnableFormatVersion::V1 => windmill_queue::PushArgsOwned {
+                    args: main_args,
+                    extra: Some(HashMap::from([(
+                        "wm_trigger".to_string(),
+                        to_raw_value(&serde_json::json!({
+                            "kind": MCP_TRIGGER_KEY,
+                            MCP_TRIGGER_KEY: {
+                                "headers": headers,
+                                "tool_name": request.tool_name,
+                            }
+                        })),
+                    )])),
+                },
+            }
+        }
+    })
 }
 
 /// Parse an HTTP response body into a JSON Value
diff --git a/backend/windmill-mcp/src/server/backend.rs b/backend/windmill-mcp/src/server/backend.rs
index e42c0dacfc..7ca1eb08a1 100644
--- a/backend/windmill-mcp/src/server/backend.rs
+++ b/backend/windmill-mcp/src/server/backend.rs
@@ -16,6 +16,14 @@ use crate::server::endpoints::EndpointTool;
 /// Result type for backend operations using rmcp's ErrorData directly
 pub type BackendResult<T> = Result<T, ErrorData>;
 
+/// What the backend needs about the HTTP request a tool call arrived on, in order
+/// to hand a runnable the headers of the call that triggered it.
+pub struct McpRequest<'a> {
+    pub headers: &'a http::HeaderMap,
+    /// The MCP tool name the caller invoked, reported to preprocessors.
+    pub tool_name: &'a str,
+}
+
 /// How a script/flow listing is narrowed by path at the SQL layer, *before* the
 /// `ITEMS_FETCH_MAX_LIMIT` cap applies.
 ///
@@ -157,6 +165,7 @@ pub trait McpBackend: Send + Sync + Clone + 'static {
         workspace_id: &str,
         path: &str,
         args: Value,
+        request: &McpRequest<'_>,
     ) -> BackendResult<Value>;
 
     /// Run a flow and wait for result
@@ -166,6 +175,7 @@ pub trait McpBackend: Send + Sync + Clone + 'static {
         workspace_id: &str,
         path: &str,
         args: Value,
+        request: &McpRequest<'_>,
     ) -> BackendResult<Value>;
 
     /// Call an endpoint tool (generated API endpoint)
diff --git a/backend/windmill-mcp/src/server/mod.rs b/backend/windmill-mcp/src/server/mod.rs
index b6fb7a5b0a..b97e374e98 100644
--- a/backend/windmill-mcp/src/server/mod.rs
+++ b/backend/windmill-mcp/src/server/mod.rs
@@ -12,7 +12,7 @@ pub mod tools;
 
 // Re-export main types
 pub use crate::common::types::{McpToken, MultiWorkspaceMcp, WorkspaceInfo};
-pub use backend::{BackendResult, McpAuth, McpBackend, PathFilter};
+pub use backend::{BackendResult, McpAuth, McpBackend, McpRequest, PathFilter};
 pub use endpoints::{
     endpoint_tool_to_mcp_tool, endpoint_tool_to_mcp_tool_multi, is_endpoint_read_only,
     list_workspaces_tool, non_empty_body_fields, EndpointTool,
diff --git a/backend/windmill-mcp/src/server/runner.rs b/backend/windmill-mcp/src/server/runner.rs
index f407504c4b..e27eaa8470 100644
--- a/backend/windmill-mcp/src/server/runner.rs
+++ b/backend/windmill-mcp/src/server/runner.rs
@@ -9,8 +9,10 @@ use crate::common::transform::{
     extract_hub_version_id_from_hashed, extract_path_prefix_from_hashed, parse_tool_prefix,
     reverse_transform, reverse_transform_key,
 };
-use crate::common::types::{McpToken, MultiWorkspaceMcp, ResourceInfo, ToolableItem, WorkspaceId};
-use crate::server::backend::{McpAuth, McpBackend, PathFilter};
+use crate::common::types::{
+    McpToken, MultiWorkspaceMcp, ResourceInfo, SchemaType, ToolableItem, WorkspaceId,
+};
+use crate::server::backend::{McpAuth, McpBackend, McpRequest, PathFilter};
 use crate::server::endpoints::{
     endpoint_tool_to_mcp_tool, endpoint_tool_to_mcp_tool_multi, list_workspaces_tool, EndpointTool,
 };
@@ -101,16 +103,24 @@ enum McpMode {
     Multi(String),
 }
 
+/// Everything a request carries besides its MCP payload.
+struct McpContext<A> {
+    auth: A,
+    mode: McpMode,
+    headers: http::HeaderMap,
+}
+
 impl<B: McpBackend> Runner<B> {
     /// Create a new Runner with the given backend
     pub fn new(backend: B) -> Self {
         Self { backend: Arc::new(backend) }
     }
 
-    /// Extract authentication and the workspace mode from request context
+    /// Extract authentication, the workspace mode and the HTTP request itself
+    /// from the request context
     fn extract_context(
         context: &RequestContext<RoleServer>,
-    ) -> Result<(B::Auth, McpMode), ErrorData> {
+    ) -> Result<McpContext<B::Auth>, ErrorData> {
         let http_parts = context.extensions.get::<HttpParts>().ok_or_else(|| {
             tracing::error!("http::request::Parts not found");
             ErrorData::internal_error("http::request::Parts not found", None)
@@ -148,7 +158,7 @@ impl<B: McpBackend> Runner<B> {
             McpMode::Single(workspace_id)
         };
 
-        Ok((auth.clone(), mode))
+        Ok(McpContext { auth: auth.clone(), mode, headers: http_parts.headers.clone() })
     }
 }
 
@@ -391,6 +401,18 @@ fn authorize_endpoint_call(
     Ok(())
 }
 
+/// Map the model's argument keys back to the runnable's original parameter names.
+fn transform_call_args(args: Value, item_schema: &Option<SchemaType>) -> Value {
+    let Value::Object(map) = args else {
+        return args;
+    };
+    let mut args_hash = HashMap::new();
+    for (k, v) in map {
+        args_hash.insert(reverse_transform_key(&k, item_schema), v);
+    }
+    Value::Object(args_hash.into_iter().collect())
+}
+
 fn find_matching_path<T: ToolableItem>(candidates: Vec<T>, request_name: &str) -> Option<String> {
     candidates
         .into_iter()
@@ -427,7 +449,7 @@ impl<B: McpBackend> ServerHandler for Runner<B> {
         _request: Option<PaginatedRequestParams>,
         context: RequestContext<RoleServer>,
     ) -> Result<ListToolsResult, ErrorData> {
-        let (auth, mode) = Self::extract_context(&context)?;
+        let McpContext { auth, mode, .. } = Self::extract_context(&context)?;
 
         // Parse MCP scopes to determine what to expose
         let scopes = auth.scopes().unwrap_or(&[]);
@@ -455,7 +477,7 @@ impl<B: McpBackend> ServerHandler for Runner<B> {
         request: CallToolRequestParams,
         context: RequestContext<RoleServer>,
     ) -> Result<CallToolResponse, ErrorData> {
-        let (auth, mode) = Self::extract_context(&context)?;
+        let McpContext { auth, mode, headers } = Self::extract_context(&context)?;
 
         // Parse MCP scopes for authorization
         let scopes = auth.scopes().unwrap_or(&[]);
@@ -464,6 +486,7 @@ impl<B: McpBackend> ServerHandler for Runner<B> {
         let read_only = auth.read_only();
 
         let args = request.arguments.map(Value::Object).unwrap_or(Value::Null);
+        let mcp_request = McpRequest { headers: &headers, tool_name: request.name.as_ref() };
 
         // Every tool here runs to completion in one round trip: none of them ask the
         // client for input, so the MRTR variants of `CallToolResponse` are never built.
@@ -474,14 +497,22 @@ impl<B: McpBackend> ServerHandler for Runner<B> {
                     &workspace_id,
                     &scope_config,
                     read_only,
-                    request.name,
+                    request.name.clone(),
                     args,
+                    &mcp_request,
                 )
                 .await
             }
             McpMode::Multi(token) => {
-                self.call_tool_multi(&auth, &token, &scope_config, read_only, request.name, args)
-                    .await
+                self.call_tool_multi(
+                    &auth,
+                    &token,
+                    &scope_config,
+                    read_only,
+                    request.name.clone(),
+                    args,
+                )
+                .await
             }
         }?;
         Ok(result.into())
@@ -665,6 +696,7 @@ impl<B: McpBackend> Runner<B> {
         read_only: bool,
         name: std::borrow::Cow<'static, str>,
         args: Value,
+        request: &McpRequest<'_>,
     ) -> Result<CallToolResult, ErrorData> {
         // Check if this is an endpoint tool
         let endpoint_tools = self.backend.all_endpoint_tools();
@@ -777,17 +809,7 @@ impl<B: McpBackend> Runner<B> {
                 .map_err(|e| ErrorData::internal_error(e.message, None))?
         };
 
-        // Transform arguments back to original key names
-        let transformed_args = if let Value::Object(map) = args {
-            let mut args_hash = HashMap::new();
-            for (k, v) in map {
-                let original_key = reverse_transform_key(&k, &item_schema);
-                args_hash.insert(original_key, v);
-            }
-            Value::Object(args_hash.into_iter().collect())
-        } else {
-            args
-        };
+        let transformed_args = transform_call_args(args, &item_schema);
 
         let script_or_flow_path = if is_hub {
             format!("hub/{}", path)
@@ -798,11 +820,23 @@ impl<B: McpBackend> Runner<B> {
         // Execute script or flow
         let result = if tool_type == "script" {
             self.backend
-                .run_script(auth, workspace_id, &script_or_flow_path, transformed_args)
+                .run_script(
+                    auth,
+                    workspace_id,
+                    &script_or_flow_path,
+                    transformed_args,
+                    request,
+                )
                 .await
         } else {
             self.backend
-                .run_flow(auth, workspace_id, &script_or_flow_path, transformed_args)
+                .run_flow(
+                    auth,
+                    workspace_id,
+                    &script_or_flow_path,
+                    transformed_args,
+                    request,
+                )
                 .await
         };
 

From 38fc0d3a12eebd3fb853714f5b40ee168b5ad68f Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Thu, 3 Sep 2026 13:08:33 +0200
Subject: [PATCH 22/31] chore(main): release 1.803.0 (#10952)

* chore(main): release 1.803.0

* Apply automatic changes

---------

Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com>
---
 .release-please-manifest.json                 |   2 +-
 CHANGELOG.md                                  |  16 ++
 backend/Cargo.lock                            | 174 +++++++++---------
 backend/Cargo.toml                            |   4 +-
 .../parsers/windmill-parser-wasm/Cargo.lock   |  48 ++---
 .../parsers/windmill-parser-wasm/Cargo.toml   |   2 +-
 backend/windmill-api/openapi.yaml             |   2 +-
 benchmarks/lib.ts                             |   2 +-
 cli/src/core/constants.ts                     |   2 +-
 frontend/package-lock.json                    |   4 +-
 frontend/package.json                         |   2 +-
 lsp/Pipfile                                   |   2 +-
 openflow.openapi.yaml                         |   2 +-
 .../WindmillClient/WindmillClient.psd1        |   2 +-
 python-client/wmill/pyproject.toml            |   2 +-
 typescript-client/jsr.json                    |   2 +-
 typescript-client/package.json                |   2 +-
 version.txt                                   |   2 +-
 windmill-yaml-validator/package-lock.json     |   4 +-
 windmill-yaml-validator/package.json          |   2 +-
 20 files changed, 147 insertions(+), 131 deletions(-)

diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index d720ec7aca..249f8350ae 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "1.802.0"
+  ".": "1.803.0"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9c2b87cbd0..33e24c0c00 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,21 @@
 # Changelog
 
+## [1.803.0](https://github.com/windmill-labs/windmill/compare/v1.802.0...v1.803.0) (2026-09-03)
+
+
+### Features
+
+* expose request headers to scripts invoked via MCP ([#10903](https://github.com/windmill-labs/windmill/issues/10903)) ([e474e88](https://github.com/windmill-labs/windmill/commit/e474e8803ce2ff5c2df09a58dab51d45f5c922ca))
+* reuse an existing workspace resource in the project import wizard ([#10935](https://github.com/windmill-labs/windmill/issues/10935)) ([582761e](https://github.com/windmill-labs/windmill/commit/582761e37c776e92dc1c6ebfee8c4efe7c35d822))
+
+
+### Bug Fixes
+
+* bump git sync hub scripts to cli 1.802.1, test the fork ui pull ([#10955](https://github.com/windmill-labs/windmill/issues/10955)) ([ca88009](https://github.com/windmill-labs/windmill/commit/ca8800959aa6a0017cc29bad187c9f49e0d13cc4))
+* **cli:** make a sync push into a fork converge on schedules and inline names ([#10951](https://github.com/windmill-labs/windmill/issues/10951)) ([0f5a1db](https://github.com/windmill-labs/windmill/commit/0f5a1db2abba8df30a2f975f4498e269f13cf93d))
+* fade the home Build with AI placeholder every 10s instead of typing it ([#10953](https://github.com/windmill-labs/windmill/issues/10953)) ([3d089b5](https://github.com/windmill-labs/windmill/commit/3d089b57344f5814086e6176301c5031dc519674))
+* let operators use wmill.datatable() from within running jobs ([#10931](https://github.com/windmill-labs/windmill/issues/10931)) ([9b64a89](https://github.com/windmill-labs/windmill/commit/9b64a89cd46ae718d6c58fa12f925fa041fb1032))
+
 ## [1.802.0](https://github.com/windmill-labs/windmill/compare/v1.801.0...v1.802.0) (2026-09-02)
 
 
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index 144605d28f..d314168b35 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -5177,9 +5177,9 @@ dependencies = [
 
 [[package]]
 name = "frostem"
-version = "1.20260821.3"
+version = "1.20260821.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca2e81eab151ba68484704bb3d21b4b4d2747314d3081fa86fa6c7300a4c42e2"
+checksum = "481ace7f781f5ae54a5c0a6d6d8edb30adba737cfa1230fbd5632d63ba8dfd80"
 
 [[package]]
 name = "fs3"
@@ -7387,9 +7387,9 @@ dependencies = [
 
 [[package]]
 name = "lru"
-version = "0.18.3"
+version = "0.18.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d317b4b9eb398e6acce275758ec6125535505e7a146fb1a9b8bda2451b0ff4c"
+checksum = "ff9840bcc50b71349309900da0ce7279aa336ae71d73250b07998932c7d97c25"
 dependencies = [
  "hashbrown 0.17.1",
 ]
@@ -7776,9 +7776,9 @@ dependencies = [
 
 [[package]]
 name = "mio"
-version = "1.2.2"
+version = "1.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "30d65c71f1ce40ab09135ce117d742b9f8a19ff91a41a8b57ed50bc2de59c427"
+checksum = "4b18443e9c262bfe8fa82f51666e2642c53393f7e5c27b3e1aeab922cff5b9d8"
 dependencies = [
  "libc",
  "wasi 0.11.1+wasi-snapshot-preview1",
@@ -7883,7 +7883,7 @@ dependencies = [
  "futures-sink",
  "futures-util",
  "keyed_priority_queue",
- "lru 0.18.3",
+ "lru 0.18.4",
  "mysql_common",
  "native-tls",
  "pem 3.0.6",
@@ -12813,7 +12813,7 @@ dependencies = [
  "itertools 0.14.0",
  "levenshtein_automata",
  "log",
- "lru 0.18.3",
+ "lru 0.18.4",
  "lz4_flex 0.14.0",
  "measure_time",
  "memmap2",
@@ -14747,7 +14747,7 @@ dependencies = [
 
 [[package]]
 name = "windmill"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -14832,7 +14832,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-ai"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "async-stream",
  "async-trait",
@@ -14865,7 +14865,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-alerting"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14878,7 +14878,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "argon2",
@@ -15018,7 +15018,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-agent-workers"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15041,7 +15041,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-assets"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15058,7 +15058,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-auth"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15084,7 +15084,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-client"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "reqwest 0.12.28",
  "serde",
@@ -15094,7 +15094,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-configs"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15111,7 +15111,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-debug"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "axum 0.8.9",
  "base64 0.22.1",
@@ -15133,7 +15133,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-embeddings"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15156,7 +15156,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flow-conversations"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15172,7 +15172,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flows"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15194,7 +15194,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-groups"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15215,7 +15215,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-inputs"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15229,7 +15229,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-integration-tests"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -15264,7 +15264,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-jobs"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15289,7 +15289,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-npm-proxy"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15317,7 +15317,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-openapi"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15339,7 +15339,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-schedule"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15359,7 +15359,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-scripts"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15397,7 +15397,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-settings"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15425,7 +15425,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-sse"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "lazy_static",
  "serde",
@@ -15437,7 +15437,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-users"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "argon2",
  "axum 0.8.9",
@@ -15461,7 +15461,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workers"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15475,7 +15475,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workspaces"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15510,7 +15510,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-audit"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "chrono",
  "lazy_static",
@@ -15524,7 +15524,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-autoscaling"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15543,7 +15543,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-common"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "aes-gcm",
  "aho-corasick",
@@ -15647,7 +15647,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-dep-map"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "chrono",
  "futures",
@@ -15667,7 +15667,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-git-sync"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "regex",
  "serde",
@@ -15682,7 +15682,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-indexer"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "astral-tokio-tar",
@@ -15709,7 +15709,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-jseval"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "futures",
@@ -15726,7 +15726,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "itertools 0.14.0",
  "lazy_static",
@@ -15742,7 +15742,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-mcp"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15763,7 +15763,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-native-triggers"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15794,7 +15794,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-oauth"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "arc-swap",
@@ -15819,7 +15819,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-object-store"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "async-stream",
@@ -15853,7 +15853,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-operator"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "futures",
@@ -15871,7 +15871,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "convert_case 0.6.0",
  "serde",
@@ -15880,7 +15880,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15892,7 +15892,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15904,7 +15904,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -15916,7 +15916,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15928,7 +15928,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15940,7 +15940,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -15951,7 +15951,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15962,7 +15962,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15974,7 +15974,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -15985,7 +15985,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -16007,7 +16007,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -16019,7 +16019,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -16033,7 +16033,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "convert_case 0.6.0",
@@ -16050,7 +16050,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -16063,7 +16063,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -16075,7 +16075,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -16093,7 +16093,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -16109,7 +16109,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -16125,7 +16125,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -16139,7 +16139,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-queue"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -16178,7 +16178,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-runtime-nativets"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "const_format",
@@ -16218,7 +16218,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-sql-datatype-parser-wasm"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "getrandom 0.3.4",
  "wasm-bindgen",
@@ -16229,7 +16229,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-store"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -16264,7 +16264,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-test-utils"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16288,7 +16288,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16321,7 +16321,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-amqp"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16348,7 +16348,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-azure"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16381,7 +16381,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-email"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16401,7 +16401,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-gcp"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16435,7 +16435,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-http"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16471,7 +16471,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-kafka"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16494,7 +16494,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-mqtt"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16518,7 +16518,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-nats"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -16542,7 +16542,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-postgres"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16577,7 +16577,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-sqs"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16605,7 +16605,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-websocket"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16630,7 +16630,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "bitflags 2.13.1",
@@ -16649,7 +16649,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "async-once-cell",
@@ -16766,7 +16766,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker-volumes"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "bytes",
  "futures",
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index ef62595562..f432f022c5 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.801.0"
+version = "1.803.0"
 authors.workspace = true
 edition.workspace = true
 
@@ -88,7 +88,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal", "./parsers/windmill-parser-wasm"]
 
 [workspace.package]
-version = "1.801.0"
+version = "1.803.0"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.lock b/backend/parsers/windmill-parser-wasm/Cargo.lock
index 15a288cb24..395e692623 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.lock
+++ b/backend/parsers/windmill-parser-wasm/Cargo.lock
@@ -6191,7 +6191,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windmill-common"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "aho-corasick",
  "anyhow",
@@ -6274,7 +6274,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -6286,7 +6286,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "convert_case",
  "serde",
@@ -6295,7 +6295,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6307,7 +6307,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6319,7 +6319,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -6331,7 +6331,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6343,7 +6343,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6355,7 +6355,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -6366,7 +6366,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6377,7 +6377,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6389,7 +6389,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6400,7 +6400,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -6422,7 +6422,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6434,7 +6434,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6448,7 +6448,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "convert_case",
@@ -6465,7 +6465,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6478,7 +6478,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -6490,7 +6490,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6508,7 +6508,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -6524,7 +6524,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6540,7 +6540,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wasm"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "getrandom 0.2.17",
@@ -6572,7 +6572,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6586,7 +6586,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.801.0"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "bitflags",
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.toml b/backend/parsers/windmill-parser-wasm/Cargo.toml
index 4aae8cad13..45c8b0d94e 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.toml
+++ b/backend/parsers/windmill-parser-wasm/Cargo.toml
@@ -12,7 +12,7 @@ resolver = "2"
 members = ["."]
 
 [workspace.package]
-version = "1.801.0"
+version = "1.803.0"
 edition = "2021"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 5dbfca7f56..f2bd3a543c 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.801.0
+  version: 1.803.0
   title: Windmill API
 
   contact:
diff --git a/benchmarks/lib.ts b/benchmarks/lib.ts
index db9077b9cc..6a165901e4 100644
--- a/benchmarks/lib.ts
+++ b/benchmarks/lib.ts
@@ -2,7 +2,7 @@ import { sleep } from "https://deno.land/x/sleep@v1.2.1/mod.ts";
 import * as windmill from "https://deno.land/x/windmill@v1.174.0/mod.ts";
 import * as api from "https://deno.land/x/windmill@v1.174.0/windmill-api/index.ts";
 
-export const VERSION = "v1.801.0";
+export const VERSION = "v1.803.0";
 
 export async function login(email: string, password: string): Promise<string> {
   return await windmill.UserService.login({
diff --git a/cli/src/core/constants.ts b/cli/src/core/constants.ts
index 3d92b31a36..7017136a66 100644
--- a/cli/src/core/constants.ts
+++ b/cli/src/core/constants.ts
@@ -10,4 +10,4 @@ export const WM_FORK_PREFIX = "wm-fork";
 // (e.g. utils.ts) can read it without importing main.ts and creating a circular
 // dependency (main → workspace → utils → main) that triggers a TDZ.
 // Re-exported from main.ts for backwards compatibility.
-export const VERSION = "1.801.0";
+export const VERSION = "1.803.0";
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 66bb47f9ab..6fd6413d59 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -1,12 +1,12 @@
 {
 	"name": "@windmill-labs/components",
-	"version": "1.801.0",
+	"version": "1.803.0",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "@windmill-labs/components",
-			"version": "1.801.0",
+			"version": "1.803.0",
 			"hasInstallScript": true,
 			"license": "AGPL-3.0",
 			"dependencies": {
diff --git a/frontend/package.json b/frontend/package.json
index ab3768066a..f8f952ede6 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@windmill-labs/components",
-	"version": "1.801.0",
+	"version": "1.803.0",
 	"scripts": {
 		"dev": "vite dev",
 		"dev:ui-builder": "mv static/ui_builder static/ui_builder.dev-disabled 2>/dev/null || true ; trap 'mv static/ui_builder.dev-disabled static/ui_builder 2>/dev/null || true' EXIT ; vite dev",
diff --git a/lsp/Pipfile b/lsp/Pipfile
index 1fcca67d5f..0bc31bcb41 100644
--- a/lsp/Pipfile
+++ b/lsp/Pipfile
@@ -4,7 +4,7 @@ verify_ssl = true
 name = "pypi"
 
 [packages]
-wmill = ">=1.801.0"
+wmill = ">=1.803.0"
 sendgrid = "*"
 mysql-connector-python = "*"
 pymongo = "*"
diff --git a/openflow.openapi.yaml b/openflow.openapi.yaml
index c69767b582..bdf8ecce08 100644
--- a/openflow.openapi.yaml
+++ b/openflow.openapi.yaml
@@ -1,7 +1,7 @@
 openapi: '3.0.3'
 
 info:
-  version: 1.801.0
+  version: 1.803.0
   title: OpenFlow Spec
   contact:
     name: Ruben Fiszel
diff --git a/powershell-client/WindmillClient/WindmillClient.psd1 b/powershell-client/WindmillClient/WindmillClient.psd1
index d656f7f8a1..089f7ff05a 100644
--- a/powershell-client/WindmillClient/WindmillClient.psd1
+++ b/powershell-client/WindmillClient/WindmillClient.psd1
@@ -12,7 +12,7 @@
     RootModule        = 'WindmillClient.psm1'
 
     # Version number of this module.
-    ModuleVersion     = '1.801.0'
+    ModuleVersion     = '1.803.0'
 
     # Supported PSEditions
     # CompatiblePSEditions = @()
diff --git a/python-client/wmill/pyproject.toml b/python-client/wmill/pyproject.toml
index ce2cf1b813..35a2b8d857 100644
--- a/python-client/wmill/pyproject.toml
+++ b/python-client/wmill/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill"
-version = "1.801.0"
+version = "1.803.0"
 description = "A client library for accessing Windmill server wrapping the Windmill client API"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/typescript-client/jsr.json b/typescript-client/jsr.json
index f660ecd864..f148f1f03c 100644
--- a/typescript-client/jsr.json
+++ b/typescript-client/jsr.json
@@ -1,6 +1,6 @@
 {
   "name": "@windmill/windmill",
-  "version": "1.801.0",
+  "version": "1.803.0",
   "exports": "./src/index.ts",
   "publish": {
     "exclude": ["!src", "./s3Types.ts", "./sqlUtils.ts", "./client.ts", "./wacError.ts"]
diff --git a/typescript-client/package.json b/typescript-client/package.json
index 5a14a8d431..4970364ccd 100644
--- a/typescript-client/package.json
+++ b/typescript-client/package.json
@@ -1,7 +1,7 @@
 {
   "name": "windmill-client",
   "description": "Windmill SDK client for browsers and Node.js",
-  "version": "1.801.0",
+  "version": "1.803.0",
   "author": "Ruben Fiszel",
   "license": "Apache 2.0",
   "homepage": "https://github.com/windmill-labs/windmill/tree/main/typescript-client#readme",
diff --git a/version.txt b/version.txt
index 8b528eb361..e5952c62ae 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-1.802.0
+1.803.0
diff --git a/windmill-yaml-validator/package-lock.json b/windmill-yaml-validator/package-lock.json
index 3005098884..d8c4b1e0fd 100644
--- a/windmill-yaml-validator/package-lock.json
+++ b/windmill-yaml-validator/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "windmill-yaml-validator",
-  "version": "1.801.0",
+  "version": "1.803.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "windmill-yaml-validator",
-      "version": "1.801.0",
+      "version": "1.803.0",
       "license": "Apache 2.0",
       "dependencies": {
         "@stoplight/yaml": "^4.3.0",
diff --git a/windmill-yaml-validator/package.json b/windmill-yaml-validator/package.json
index 5b5d6d84c0..8245569685 100644
--- a/windmill-yaml-validator/package.json
+++ b/windmill-yaml-validator/package.json
@@ -1,6 +1,6 @@
 {
   "name": "windmill-yaml-validator",
-  "version": "1.801.0",
+  "version": "1.803.0",
   "description": "YAML validator for Windmill flow, schedule, and trigger files",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

From b100606da6a61f2dbcb24516363f43643bc917e3 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Thu, 3 Sep 2026 17:02:08 +0000
Subject: [PATCH 23/31] fix: patch critical CVEs in the worker image (#10962)

* fix: patch critical CVEs in the worker image (go, node, php, helm, libtiff)

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TT3CyQED8iwwmsKMttk6PP

* ci: run the backend tests on node 24 to match the image

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TT3CyQED8iwwmsKMttk6PP

---------

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
---
 .github/workflows/backend-test.yml |  2 +-
 Dockerfile                         | 10 +++++-----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/backend-test.yml b/.github/workflows/backend-test.yml
index cdd0e2a212..9f65c2ae47 100644
--- a/.github/workflows/backend-test.yml
+++ b/.github/workflows/backend-test.yml
@@ -61,7 +61,7 @@ jobs:
           bun-version: 1.4.0
       - uses: actions/setup-node@v4
         with:
-          node-version: "20"
+          node-version: "24"
       - uses: astral-sh/setup-uv@v6.2.1
         with:
           version: "0.11.24"
diff --git a/Dockerfile b/Dockerfile
index 8ecee96725..6a290c3553 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -141,9 +141,9 @@ FROM ${DEBIAN_IMAGE}
 ARG TARGETPLATFORM
 ARG POWERSHELL_VERSION=7.5.0
 ARG KUBECTL_VERSION=1.36.2
-ARG HELM_VERSION=3.21.2
+ARG HELM_VERSION=3.21.4
 # NOTE: If changing, also change go version in workspace dependencies template at WorkspaceDependenciesEditor.svelte
-ARG GO_VERSION=1.26.0
+ARG GO_VERSION=1.26.8
 ARG APP=/usr/src/app
 ARG WITH_POWERSHELL=true
 ARG WITH_KUBECTL=true
@@ -250,8 +250,8 @@ RUN UV_CACHE_DIR=/tmp/build_cache/uv UV_PYTHON_INSTALL_DIR=/tmp/build_cache/py_r
 RUN UV_CACHE_DIR=/tmp/build_cache/uv UV_PYTHON_INSTALL_DIR=/tmp/build_cache/py_runtime uv python install $LATEST_STABLE_PY --compile-bytecode
 
 
-RUN curl -sL https://deb.nodesource.com/setup_20.x | bash -
-RUN apt-get -y update && apt-get install -y curl procps nodejs awscli && apt-get clean \
+RUN curl -sL https://deb.nodesource.com/setup_24.x | bash -
+RUN apt-get -y update && apt-get install -y --no-install-recommends curl procps nodejs awscli && apt-get clean \
     && rm -rf /var/lib/apt/lists/*
 
 # go build is slower the first time it is ran, so we prewarm it in the build
@@ -299,7 +299,7 @@ RUN bun install -g windmill-cli \
 RUN curl -fsSL https://claude.ai/install.sh | bash \
     && cp /root/.local/share/claude/versions/* /usr/bin/claude
 
-COPY --from=php:8.3.30-cli-trixie /usr/local/bin/php /usr/bin/php
+COPY --from=php:8.3.33-cli-trixie /usr/local/bin/php /usr/bin/php
 COPY --from=composer:2.9.5 /usr/bin/composer /usr/bin/composer
 
 # add the docker client to call docker from a worker if enabled

From 07dfa0ba8baf1023efaa20fe8b5d175be2740e8f Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Thu, 3 Sep 2026 22:09:33 +0200
Subject: [PATCH 24/31] fix: drop the dead guest-access helper, name the
 instance setting once, guests tab states, CE save order

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BayTppRCstWX6qTf3LMco5
---
 ...99eca4766ec4f61ae1528e3481fa57c0b3464.json | 22 ---------
 .../windmill-common/src/global_settings.rs    |  3 +-
 backend/windmill-common/src/workspaces.rs     | 49 +++++++------------
 .../components/SuperadminSettingsInner.svelte | 13 ++++-
 .../instanceSettings/GuestActivityList.svelte | 26 ++++++----
 .../(logged)/workspace_settings/+page.svelte  |  8 +--
 6 files changed, 54 insertions(+), 67 deletions(-)
 delete mode 100644 backend/.sqlx/query-03b0658a1bc3e2d8831055d336799eca4766ec4f61ae1528e3481fa57c0b3464.json

diff --git a/backend/.sqlx/query-03b0658a1bc3e2d8831055d336799eca4766ec4f61ae1528e3481fa57c0b3464.json b/backend/.sqlx/query-03b0658a1bc3e2d8831055d336799eca4766ec4f61ae1528e3481fa57c0b3464.json
deleted file mode 100644
index 6a616c93b5..0000000000
--- a/backend/.sqlx/query-03b0658a1bc3e2d8831055d336799eca4766ec4f61ae1528e3481fa57c0b3464.json
+++ /dev/null
@@ -1,22 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT guest_access_enabled FROM workspace_settings WHERE workspace_id = $1",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "guest_access_enabled",
-        "type_info": "Bool"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "03b0658a1bc3e2d8831055d336799eca4766ec4f61ae1528e3481fa57c0b3464"
-}
diff --git a/backend/windmill-common/src/global_settings.rs b/backend/windmill-common/src/global_settings.rs
index ce6bc67a54..31223b8b52 100644
--- a/backend/windmill-common/src/global_settings.rs
+++ b/backend/windmill-common/src/global_settings.rs
@@ -66,7 +66,8 @@ pub const EXPOSE_DEBUG_METRICS_SETTING: &str = "expose_debug_metrics";
 pub const KEEP_JOB_DIR_SETTING: &str = "keep_job_dir";
 pub const REQUIRE_PREEXISTING_USER_FOR_OAUTH_SETTING: &str = "require_preexisting_user_for_oauth";
 /// Superadmin switch over guest sessions for the whole instance, above the per-workspace
-/// one. Read from the table, uncached, by the same gates that read the workspace switch.
+/// one. Read from the table, uncached, by the same gates that read the workspace switch;
+/// the superadmin Guests list writes it through `/settings/global/{key}` by this name.
 pub const GUEST_ACCESS_DISABLED_SETTING: &str = "guest_access_disabled";
 pub const JOB_ISOLATION_SETTING: &str = "job_isolation";
 pub const NSJAIL_TMPFS_SIZE_MB_SETTING: &str = "nsjail_tmpfs_size_mb";
diff --git a/backend/windmill-common/src/workspaces.rs b/backend/windmill-common/src/workspaces.rs
index 7898d89a19..808c938134 100644
--- a/backend/windmill-common/src/workspaces.rs
+++ b/backend/windmill-common/src/workspaces.rs
@@ -834,19 +834,22 @@ pub struct GuestUsage {
     pub guest_seats: i64,
 }
 
-/// SQL for "the instance admits guests": the superadmin switch, absent meaning on.
-const INSTANCE_ADMITS_GUESTS_SQL: &str =
-    "NOT COALESCE((SELECT value::boolean FROM global_settings \
-     WHERE name = 'guest_access_disabled'), false)";
+/// SQL for "the instance admits guests": the superadmin switch, absent meaning on. The
+/// setting is read as text before the cast so `true` and `"true"` both count.
+fn instance_admits_guests_sql() -> String {
+    format!(
+        "NOT COALESCE((SELECT (value #>> '{{}}')::boolean FROM global_settings \
+         WHERE name = '{}'), false)",
+        crate::global_settings::GUEST_ACCESS_DISABLED_SETTING
+    )
+}
 
 pub async fn guest_usage(db: &crate::DB) -> Result<GuestUsage> {
-    let instance_enabled: bool =
-        sqlx::query_scalar(&format!("SELECT {INSTANCE_ADMITS_GUESTS_SQL}"))
-            .fetch_one(db)
-            .await
-            .map_err(|e| {
-                Error::internal_err(format!("reading the instance guest switch: {e:#}"))
-            })?;
+    let instance_admits = instance_admits_guests_sql();
+    let instance_enabled: bool = sqlx::query_scalar(&format!("SELECT {instance_admits}"))
+        .fetch_one(db)
+        .await
+        .map_err(|e| Error::internal_err(format!("reading the instance guest switch: {e:#}")))?;
     let guest_count = guest_count_in_window(db).await?;
     let metered = guests_are_metered().await;
     let billable_guests = if metered {
@@ -899,32 +902,15 @@ pub async fn guest_admission(conn: &mut sqlx::PgConnection, email: &str) -> Resu
     )))
 }
 
-/// Whether `w_id` admits guest sessions (the `guest` app execution mode).
-///
-/// Read uncached where a session is minted ([`guest_app_admits`]) and then once per
-/// request at the auth door (`AuthCache::get_opt_job_authed`) for every guest. An app
-/// carries its own `execution_mode` in its definition, so git-sync and the CLI can
-/// push `guest` past every deploy-time gate; the per-request read is what makes
-/// turning the switch off take effect on sessions already issued.
-pub async fn is_guest_access_enabled(db: &crate::DB, w_id: &str) -> Result<bool> {
-    Ok(sqlx::query_scalar!(
-        "SELECT guest_access_enabled FROM workspace_settings WHERE workspace_id = $1",
-        w_id
-    )
-    .fetch_optional(db)
-    .await
-    .map_err(|e| Error::internal_err(format!("reading guest access of {w_id}: {e:#}")))?
-    .unwrap_or(false))
-}
-
 /// Whether a guest session for `email` in `w_id` still stands: the instance and the
 /// workspace admit guests, and the email still has no account. Read at the auth door on
 /// every guest request, so turning either switch off, or an account provisioned after
 /// the mint (or racing it), ends the session on its next request.
 pub async fn guest_session_stands(db: &crate::DB, w_id: &str, email: &str) -> Result<bool> {
+    let instance_admits = instance_admits_guests_sql();
     let stands: Option<bool> = sqlx::query_scalar(&format!(
         "SELECT guest_access_enabled
-            AND {INSTANCE_ADMITS_GUESTS_SQL}
+            AND {instance_admits}
             AND NOT EXISTS(SELECT 1 FROM password WHERE email = $2)
             AND NOT EXISTS(SELECT 1 FROM usr WHERE email = $2)
          FROM workspace_settings WHERE workspace_id = $1"
@@ -947,9 +933,10 @@ pub async fn guest_app_admits<'c, E: sqlx::Executor<'c, Database = sqlx::Postgre
     w_id: &str,
     app_path: &str,
 ) -> Result<bool> {
+    let instance_admits = instance_admits_guests_sql();
     let admits: Option<bool> = sqlx::query_scalar(&format!(
         "SELECT COALESCE(ws.guest_access_enabled AND app.policy->>'execution_mode' = 'guest', false)
-            AND {INSTANCE_ADMITS_GUESTS_SQL}
+            AND {instance_admits}
          FROM app JOIN workspace_settings ws ON ws.workspace_id = app.workspace_id
          WHERE app.workspace_id = $1 AND app.path = $2"
     ))
diff --git a/frontend/src/lib/components/SuperadminSettingsInner.svelte b/frontend/src/lib/components/SuperadminSettingsInner.svelte
index fe9ec97a37..51ceed9aba 100644
--- a/frontend/src/lib/components/SuperadminSettingsInner.svelte
+++ b/frontend/src/lib/components/SuperadminSettingsInner.svelte
@@ -56,6 +56,7 @@
 	import InstanceAISettings from './instanceSettings/InstanceAISettings.svelte'
 	import ExternalJwtTokens from './instanceSettings/ExternalJwtTokens.svelte'
 	import GuestActivityList from './instanceSettings/GuestActivityList.svelte'
+	import { Alert, Skeleton } from '$lib/components/common'
 
 	let filter = $state('')
 
@@ -370,7 +371,7 @@
 								<Tab value="guests" label="Guests" />
 							</Tabs>
 
-							{#if usersSubTab === 'users' || (usersSubTab === 'ext_jwt' && extJwtTokens.length === 0) || (usersSubTab === 'guests' && !guestList)}
+							{#if usersSubTab === 'users' || (usersSubTab === 'ext_jwt' && extJwtTokens.length === 0)}
 								<SettingsPageHeader
 									title="Instance users ({users.length})"
 									description="Manage all users across your Windmill instance."
@@ -736,6 +737,16 @@
 										loadExtJwtPage(1)
 									}}
 								/>
+							{:else if usersSubTab === 'guests' && !guestList}
+								{#if guestLoading}
+									<Skeleton layout={[[2], 1, [8]]} />
+								{:else}
+									<Alert type="error" title="Could not load guests">
+										<Button unifiedSize="sm" variant="default" onclick={() => loadGuestPage(1)}
+											>Retry</Button
+										>
+									</Alert>
+								{/if}
 							{:else if usersSubTab === 'guests' && guestList}
 								<GuestActivityList
 									usage={guestList.usage}
diff --git a/frontend/src/lib/components/instanceSettings/GuestActivityList.svelte b/frontend/src/lib/components/instanceSettings/GuestActivityList.svelte
index 1faaf1be16..80655a6a67 100644
--- a/frontend/src/lib/components/instanceSettings/GuestActivityList.svelte
+++ b/frontend/src/lib/components/instanceSettings/GuestActivityList.svelte
@@ -20,8 +20,12 @@
 
 	let { usage, guests, hasMore, loading, onLoadMore, onInstanceSwitch }: Props = $props()
 	const loadMoreSize = 50
+	// One write at a time, and the toggle shows the stored value again after either
+	// outcome: a refused write must not leave it showing the click.
+	let switchPending = $state(false)
 
 	async function setInstanceSwitch(enabled: boolean) {
+		switchPending = true
 		try {
 			await SettingService.setGlobal({
 				key: 'guest_access_disabled',
@@ -35,6 +39,7 @@
 		} catch (e) {
 			sendUserToast(`Could not change the instance guest switch: ${e}`, true)
 		}
+		switchPending = false
 		onInstanceSwitch()
 	}
 	// A capped instance refuses the next stranger as soon as the allowance is used up.
@@ -51,15 +56,18 @@
 />
 
 <div class="flex flex-row gap-2 items-center mb-4">
-	<Toggle
-		checked={usage.instance_enabled}
-		on:change={(e) => setInstanceSwitch(e.detail)}
-		options={{
-			right: 'Allow guests on this instance',
-			rightTooltip:
-				'Off, no guest can sign in anywhere, whatever a workspace or an app says, and sessions already issued stop on their next request.'
-		}}
-	/>
+	{#key usage}
+		<Toggle
+			checked={usage.instance_enabled}
+			disabled={switchPending}
+			on:change={(e) => setInstanceSwitch(e.detail)}
+			options={{
+				right: 'Allow guests on this instance',
+				rightTooltip:
+					'Off, no guest can sign in anywhere, whatever a workspace or an app says, and sessions already issued stop on their next request.'
+			}}
+		/>
+	{/key}
 </div>
 
 <div class="mb-4">
diff --git a/frontend/src/routes/(root)/(logged)/workspace_settings/+page.svelte b/frontend/src/routes/(root)/(logged)/workspace_settings/+page.svelte
index 5b5f614929..6e55c5994b 100644
--- a/frontend/src/routes/(root)/(logged)/workspace_settings/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/workspace_settings/+page.svelte
@@ -526,15 +526,17 @@
 	}
 
 	async function saveDefaultAppSettings(): Promise<void> {
+		// Guests first: the only write of this card available on every plan, so a refused
+		// Enterprise-only write after it cannot swallow it.
+		if (guestAccessEnabled !== initialGuestAccessEnabled) {
+			await editGuestAccess()
+		}
 		if (workspaceDefaultAppPath !== initialWorkspaceDefaultAppPath) {
 			await editWorkspaceDefaultApp()
 		}
 		if (publicAppRateLimitPerMinute !== initialPublicAppRateLimitPerMinute) {
 			await editPublicAppRateLimit()
 		}
-		if (guestAccessEnabled !== initialGuestAccessEnabled) {
-			await editGuestAccess()
-		}
 	}
 
 	async function editGuestAccess(): Promise<void> {

From 79426a1a68a6b19e12af4633b8a79d07a103a106 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Thu, 3 Sep 2026 20:23:43 +0000
Subject: [PATCH 25/31] feat: reconcile IdP instance groups from the SSO groups
 claim (#10957)

* feat: add sso_groups_claim setting for login-time instance group sync

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YESxWqzt959S6TY6vbc4eG

* chore: bump ee-repo-ref for the SSO groups claim reconcile

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YESxWqzt959S6TY6vbc4eG

* chore: update ee-repo-ref to 3b89bfc11314a326a191101cfe3ef65f6f7f82a8

This commit updates the EE repository reference after PR #774 was merged in windmill-ee-private.

Previous ee-repo-ref: e388527f9adbbe466fe050ca8d1d236ce3342bc3

New ee-repo-ref: 3b89bfc11314a326a191101cfe3ef65f6f7f82a8

Automated by sync-ee-ref workflow.

---------

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
---
 backend/ee-repo-ref.txt                                |  2 +-
 backend/windmill-api/openapi.yaml                      |  2 ++
 backend/windmill-common/src/global_settings.rs         |  3 +++
 docs/feature-telemetry.md                              |  4 ++--
 frontend/src/lib/components/InstanceSettings.svelte    | 10 ++++++----
 .../lib/components/auditLogs/AuditLogsFilters.svelte   |  2 ++
 frontend/src/lib/components/instanceSettings.ts        | 10 ++++++++++
 7 files changed, 26 insertions(+), 7 deletions(-)

diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index 9f37cbedb0..354e88bef1 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-f5b783d2f7608e1ff3a817caa8b719e06f8b8981
+3b89bfc11314a326a191101cfe3ef65f6f7f82a8
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index f2bd3a543c..a27be7d295 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -28994,6 +28994,8 @@ components:
             - "igroup.delete"
             - "igroup.adduser"
             - "igroup.removeuser"
+            - "instance_groups.jit_adduser"
+            - "instance_groups.jit_removeuser"
             - "variables.decrypt_secret"
             - "workspaces.read_encryption_key"
             - "workspaces.edit_command_script"
diff --git a/backend/windmill-common/src/global_settings.rs b/backend/windmill-common/src/global_settings.rs
index 5c4b4bddab..d38396562b 100644
--- a/backend/windmill-common/src/global_settings.rs
+++ b/backend/windmill-common/src/global_settings.rs
@@ -94,6 +94,9 @@ pub const AUTOMATE_USERNAME_CREATION_SETTING: &str = "automate_username_creation
 pub const DISABLE_WORKSPACE_INVITE_EMAILS_SETTING: &str = "disable_workspace_invite_emails";
 pub const DISABLE_PASSWORD_LOGIN_SETTING: &str = "disable_password_login";
 pub const AUTO_LOGIN_PROVIDER_SETTING: &str = "auto_login_provider";
+/// Name of the SAML attribute or OIDC userinfo claim carrying the user's IdP groups. Unset or
+/// empty leaves instance-group membership entirely to SCIM.
+pub const SSO_GROUPS_CLAIM_SETTING: &str = "sso_groups_claim";
 pub const HUB_BASE_URL_SETTING: &str = "hub_base_url";
 pub const HUB_ACCESSIBLE_URL_SETTING: &str = "hub_accessible_url";
 pub const DISABLE_HUB_SETTING: &str = "disable_hub";
diff --git a/docs/feature-telemetry.md b/docs/feature-telemetry.md
index 5d7f0b2c29..5cef3c9364 100644
--- a/docs/feature-telemetry.md
+++ b/docs/feature-telemetry.md
@@ -4,9 +4,9 @@
 anonymous usage-stats payload. It answers "does anyone use this, and which variant do they pick"
 without any identifying data leaving the instance.
 
-It currently carries 28 registered actions across fourteen features (`ai_session`, `ai_chat`,
+It currently carries 32 registered actions across fifteen features (`ai_session`, `ai_chat`,
 `ai_fix`, `ai_agent`, `ai_agent_eval`, `flow_editor`, `flow_run`, `flow_step`, `run_form`,
-`debugger`, `trigger`, `command_script`, `hub_script`, `usage_meter`). Nearly all of the
+`debugger`, `trigger`, `command_script`, `hub_script`, `usage_meter`, `sso_groups_claim`). Nearly all of the
 product is uninstrumented, so new user-facing work is the opportunity to change that.
 
 ## When to instrument
diff --git a/frontend/src/lib/components/InstanceSettings.svelte b/frontend/src/lib/components/InstanceSettings.svelte
index ce5323fe2b..b321e76693 100644
--- a/frontend/src/lib/components/InstanceSettings.svelte
+++ b/frontend/src/lib/components/InstanceSettings.svelte
@@ -1071,8 +1071,9 @@
 							>feature usage (counts of which product features are used, including AI provider and
 							model identifiers, the names of public hub scripts used, the languages debug sessions
 							are started for, whether AI chat skills are turned on or off and how often one is
-							loaded, and the plan tier and quota shown when the execution meter is opened, last 30
-							days)</li
+							loaded, whether SSO logins evaluate an IdP groups claim (SAML or OIDC) and change a
+							membership, and the plan tier and quota shown when the execution meter is opened, last
+							30 days)</li
 						>
 						<li
 							>feature adoption (counts of which flow, script, trigger and worker features your
@@ -1125,8 +1126,9 @@
 							>feature usage (counts of which product features are used, including AI provider and
 							model identifiers, the names of public hub scripts used, the languages debug sessions
 							are started for, whether AI chat skills are turned on or off and how often one is
-							loaded, and the plan tier and quota shown when the execution meter is opened, last 30
-							days)</li
+							loaded, whether SSO logins evaluate an IdP groups claim (SAML or OIDC) and change a
+							membership, and the plan tier and quota shown when the execution meter is opened, last
+							30 days)</li
 						>
 						<li
 							>feature adoption (counts of which flow, script, trigger and worker features your
diff --git a/frontend/src/lib/components/auditLogs/AuditLogsFilters.svelte b/frontend/src/lib/components/auditLogs/AuditLogsFilters.svelte
index 213beda001..96d341dc72 100644
--- a/frontend/src/lib/components/auditLogs/AuditLogsFilters.svelte
+++ b/frontend/src/lib/components/auditLogs/AuditLogsFilters.svelte
@@ -216,6 +216,8 @@
 		INSTANCE_GROUPS_SCIM_CREATE: 'instance_groups.scim_create',
 		INSTANCE_GROUPS_SCIM_DELETE: 'instance_groups.scim_delete',
 		INSTANCE_GROUPS_SCIM_UPDATE: 'instance_groups.scim_update',
+		INSTANCE_GROUPS_JIT_ADDUSER: 'instance_groups.jit_adduser',
+		INSTANCE_GROUPS_JIT_REMOVEUSER: 'instance_groups.jit_removeuser',
 		VARIABLES_DECRYPT_SECRET: 'variables.decrypt_secret',
 		WORKSPACES_READ_ENCRYPTION_KEY: 'workspaces.read_encryption_key',
 		WORKSPACES_EDIT_COMMAND_SCRIPT: 'workspaces.edit_command_script',
diff --git a/frontend/src/lib/components/instanceSettings.ts b/frontend/src/lib/components/instanceSettings.ts
index eb8c4c86c4..8bbca5b4be 100644
--- a/frontend/src/lib/components/instanceSettings.ts
+++ b/frontend/src/lib/components/instanceSettings.ts
@@ -662,6 +662,16 @@ export const settings: Record<string, Setting[]> = {
 			fieldType: 'text',
 			placeholder: 'okta',
 			storage: 'setting'
+		},
+		{
+			label: 'SSO groups claim',
+			description:
+				'Name of the SAML attribute or OIDC userinfo claim carrying the user\'s IdP groups ("http://schemas.microsoft.com/ws/2008/06/identity/claims/groups" on Entra SAML, "groups" for most OIDC providers). Its values must be the same group ids that SCIM stored as the instance groups\' external id (Entra emits object ids in both), since matching is by external id only. When set, every SSO login reconciles the user\'s membership in those SCIM-provisioned instance groups against the claim, so IdP group changes take effect at the next login instead of waiting for the SCIM push. Instance groups without an external id are never touched, and a login whose claim is absent or empty changes nothing. Leave empty to disable.',
+			key: 'sso_groups_claim',
+			fieldType: 'text',
+			placeholder: 'groups',
+			storage: 'setting',
+			ee_only: ''
 		}
 	],
 	'DB Health': [],

From 3e3d2a636334146014926841949372083e6e8516 Mon Sep 17 00:00:00 2001
From: Diego Imbert <70353967+diegoimbert@users.noreply.github.com>
Date: Thu, 3 Sep 2026 22:30:19 +0200
Subject: [PATCH 26/31] fix: keep braces inside string tool arguments out of
 JSON depth count (#10965)

Claude-Session: https://claude.ai/code/session_013vvU4UWCpib25ovmmAD7HH

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .../components/copilot/lib.toolCalls.test.ts  | 31 +++++++++++++++++++
 frontend/src/lib/components/copilot/lib.ts    | 16 ++++++++--
 2 files changed, 45 insertions(+), 2 deletions(-)

diff --git a/frontend/src/lib/components/copilot/lib.toolCalls.test.ts b/frontend/src/lib/components/copilot/lib.toolCalls.test.ts
index ef2708e570..c665cc964e 100644
--- a/frontend/src/lib/components/copilot/lib.toolCalls.test.ts
+++ b/frontend/src/lib/components/copilot/lib.toolCalls.test.ts
@@ -134,6 +134,37 @@ describe('parseOpenAICompletion tool call arguments', () => {
 		expect(addedMessages).toEqual(messages)
 	})
 
+	it('keeps braces inside string arguments out of the object-depth count', async () => {
+		const { parseOpenAICompletion } = await import('./lib')
+		const fn = vi.fn().mockResolvedValue('tool ok')
+		const messages: ChatCompletionMessageParam[] = []
+
+		await parseOpenAICompletion(
+			streamOf([
+				toolCallChunk({
+					id: 'call_1',
+					function: { name: 'patch_app_file', arguments: '{"new_string": ' }
+				}),
+				toolCallChunk({ function: { arguments: '"hello } goodbye \\" } "}' } })
+			]),
+			createCallbacks(),
+			messages,
+			[],
+			[createTool(fn)] as any,
+			{},
+			undefined,
+			{ workspace: 'test' }
+		)
+
+		expect(fn).toHaveBeenCalledWith(
+			expect.objectContaining({ args: { new_string: 'hello } goodbye " } ' } })
+		)
+		const assistant = messages.find((m) => m.role === 'assistant') as any
+		expect(assistant.tool_calls[0].function.arguments).toBe(
+			'{"new_string": "hello } goodbye \\" } "}'
+		)
+	})
+
 	it('marks only the executing tool call as loading when one message has several', async () => {
 		const { parseOpenAICompletion } = await import('./lib')
 		const statuses: Record<string, any> = {}
diff --git a/frontend/src/lib/components/copilot/lib.ts b/frontend/src/lib/components/copilot/lib.ts
index fc8a00727f..19f350a665 100644
--- a/frontend/src/lib/components/copilot/lib.ts
+++ b/frontend/src/lib/components/copilot/lib.ts
@@ -1177,9 +1177,21 @@ export async function getCompletion(
 function extractFirstJSON(str: string) {
 	let depth = 0,
 		i = 0
+	// Braces inside string values are not depth changes, so the scan tracks
+	// quoting and escaping: otherwise an argument such as {"a": "} "} is cut short.
+	let inString = false,
+		escaped = false
 	for (; i < str.length; i++) {
-		if (str[i] === '{') depth++
-		else if (str[i] === '}' && --depth === 0) break
+		const ch = str[i]
+		if (inString) {
+			if (escaped) escaped = false
+			else if (ch === '\\') escaped = true
+			else if (ch === '"') inString = false
+			continue
+		}
+		if (ch === '"') inString = true
+		else if (ch === '{') depth++
+		else if (ch === '}' && --depth === 0) break
 	}
 	return str.slice(0, i + 1)
 }

From 6a7a6d9144fce55ef6850a1f63274bba548b2e8b Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Thu, 3 Sep 2026 22:40:34 +0000
Subject: [PATCH 27/31] chore: stop denying reads of secret files in claude
 settings (#10968)

Any Read() deny rule makes Claude Code resolve the file operands of every
Bash command that reads files. A path it cannot resolve, such as one that
follows a cd into a directory the analyzer does not track, escalates to a
permission prompt even under bypassPermissions. A plain recursive grep in
the repo root escalates too, because it could reach .env.

Drop the read rules and widen the write rules to cover the same files, so
secrets still cannot be written through Edit, Write, or a shell redirect.
Reads of those files are no longer blocked.


Claude-Session: https://claude.ai/code/session_01RNCupPk2yewQT1JMNjkV8M

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .claude/settings.json | 22 +++++++++-------------
 1 file changed, 9 insertions(+), 13 deletions(-)

diff --git a/.claude/settings.json b/.claude/settings.json
index a464ca3719..37aaeeb0f5 100644
--- a/.claude/settings.json
+++ b/.claude/settings.json
@@ -55,22 +55,18 @@
       "mcp__claude_ai_Gmail__list_drafts"
     ],
     "deny": [
-      "Read(.env)",
-      "Read(.env.*)",
-      "Read(**/.env)",
-      "Read(**/.env.*)",
-      "Read(**/secrets/**)",
-      "Read(**/*.pem)",
-      "Read(**/*.key)",
-      "Read(**/credentials.json)",
-      "Read(**/.secret*)",
-      "Read(**/.secrets*)",
-      "Read(**/*.secret)",
-      "Read(**/*.secrets)",
       "Edit(.env)",
       "Edit(.env.*)",
       "Edit(**/.env)",
-      "Edit(**/.env.*)"
+      "Edit(**/.env.*)",
+      "Edit(**/secrets/**)",
+      "Edit(**/*.pem)",
+      "Edit(**/*.key)",
+      "Edit(**/credentials.json)",
+      "Edit(**/.secret*)",
+      "Edit(**/.secrets*)",
+      "Edit(**/*.secret)",
+      "Edit(**/*.secrets)"
     ],
     "ask": [
       "Bash(rmdir:*)",

From 11138284acc4c1d8673e86823c7f74c9e1f419e6 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Thu, 3 Sep 2026 23:01:36 +0000
Subject: [PATCH 28/31] fix: deploy a relocked script version only when its
 lock changed (#10966)

* fix: deploy a relocked script version only when its lock changed

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GdEb6gzCZ2qXmAQJAeMf9W

* fix: write the unchanged relock hash under the row lock and skip the phantom tally

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GdEb6gzCZ2qXmAQJAeMf9W

* fix: requeue a superseded relock and read the live head past the script cache

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GdEb6gzCZ2qXmAQJAeMf9W

* fix: re-read the relock head after waiting on its lock and keep module locks

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GdEb6gzCZ2qXmAQJAeMf9W

* fix: bound the relock head re-read instead of reading once

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GdEb6gzCZ2qXmAQJAeMf9W

* chore: refresh the sqlx cache entry for the re-indented lock write

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GdEb6gzCZ2qXmAQJAeMf9W

* test: pin the waiting-relock requeue and the multi-file importer no-op

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GdEb6gzCZ2qXmAQJAeMf9W

---------

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
---
 ...3b9c0e6e371136b565f9b0f5a3393ef8d8d57.json |  19 -
 ...42ae6d6d4b6731c3f62e7b85ae7a4f1b666a7.json |  16 -
 ...b7a545959c209c550e48bf108734f293e18e4.json |  19 +
 ...8031783fa7fbbbf86a291b6f8f8f875d45637.json |  19 +
 backend/tests/relock_noop.rs                  | 415 ++++++++++++++++++
 backend/tests/relock_skip.rs                  |   7 +-
 backend/windmill-common/src/scripts.rs        |  72 +--
 backend/windmill-dep-map/src/lib.rs           |  58 ++-
 backend/windmill-queue/src/jobs.rs            |  31 +-
 backend/windmill-types/src/scripts.rs         |   2 +-
 .../windmill-worker/src/worker_lockfiles.rs   | 384 +++++++++++++---
 11 files changed, 860 insertions(+), 182 deletions(-)
 delete mode 100644 backend/.sqlx/query-49b18e987e2dfa3c7ab915757ff3b9c0e6e371136b565f9b0f5a3393ef8d8d57.json
 delete mode 100644 backend/.sqlx/query-96aa1db2859c80d37ffecc2885442ae6d6d4b6731c3f62e7b85ae7a4f1b666a7.json
 create mode 100644 backend/.sqlx/query-a0ec5048ddb7640b4407013ed45b7a545959c209c550e48bf108734f293e18e4.json
 create mode 100644 backend/.sqlx/query-ede523c0b0027f7bc1dacd3a5448031783fa7fbbbf86a291b6f8f8f875d45637.json
 create mode 100644 backend/tests/relock_noop.rs

diff --git a/backend/.sqlx/query-49b18e987e2dfa3c7ab915757ff3b9c0e6e371136b565f9b0f5a3393ef8d8d57.json b/backend/.sqlx/query-49b18e987e2dfa3c7ab915757ff3b9c0e6e371136b565f9b0f5a3393ef8d8d57.json
deleted file mode 100644
index 8d86ff3db6..0000000000
--- a/backend/.sqlx/query-49b18e987e2dfa3c7ab915757ff3b9c0e6e371136b565f9b0f5a3393ef8d8d57.json
+++ /dev/null
@@ -1,19 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "WITH update_lock AS (\n                    UPDATE script SET lock = $1, modules = COALESCE($6, modules) WHERE hash = $2 AND workspace_id = $3\n                )\n                INSERT INTO lock_hash (workspace_id, path, lockfile_hash)\n                VALUES ($3, $4, $5)\n                ON CONFLICT (workspace_id, path) DO UPDATE SET lockfile_hash = $5",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Int8",
-        "Text",
-        "Varchar",
-        "Int8",
-        "Jsonb"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "49b18e987e2dfa3c7ab915757ff3b9c0e6e371136b565f9b0f5a3393ef8d8d57"
-}
diff --git a/backend/.sqlx/query-96aa1db2859c80d37ffecc2885442ae6d6d4b6731c3f62e7b85ae7a4f1b666a7.json b/backend/.sqlx/query-96aa1db2859c80d37ffecc2885442ae6d6d4b6731c3f62e7b85ae7a4f1b666a7.json
deleted file mode 100644
index 733478e0e9..0000000000
--- a/backend/.sqlx/query-96aa1db2859c80d37ffecc2885442ae6d6d4b6731c3f62e7b85ae7a4f1b666a7.json
+++ /dev/null
@@ -1,16 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n    INSERT INTO script\n    (workspace_id, hash, path, parent_hashes, summary, description, content, created_by, schema, is_template, extra_perms, lock, language, kind, tag, envs, concurrent_limit, concurrency_time_window_s, cache_ttl, cache_ignore_s3_path, dedicated_worker, ws_error_handler_muted, priority, restart_unless_cancelled, delete_after_use, delete_after_secs, timeout, concurrency_key, visible_to_runner_only, auto_kind, codebase, has_preprocessor, on_behalf_of, on_behalf_of_email, schema_validation, assets, debounce_key, debounce_delay_s, runnable_settings_handle, modules, labels)\n\n    SELECT  workspace_id, $1, path, array_prepend($2::bigint, COALESCE(parent_hashes, '{}'::bigint[])), summary, description, content, created_by, schema, is_template, extra_perms, NULL, language, kind, tag, envs, concurrent_limit, concurrency_time_window_s, cache_ttl, cache_ignore_s3_path, dedicated_worker, ws_error_handler_muted, priority, restart_unless_cancelled, delete_after_use, delete_after_secs, timeout, concurrency_key, visible_to_runner_only, auto_kind, codebase, has_preprocessor, on_behalf_of, on_behalf_of_email, schema_validation, assets, debounce_key, debounce_delay_s, runnable_settings_handle, modules, labels\n\n    FROM script WHERE hash = $2 AND workspace_id = $3;\n            ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Int8",
-        "Int8",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "96aa1db2859c80d37ffecc2885442ae6d6d4b6731c3f62e7b85ae7a4f1b666a7"
-}
diff --git a/backend/.sqlx/query-a0ec5048ddb7640b4407013ed45b7a545959c209c550e48bf108734f293e18e4.json b/backend/.sqlx/query-a0ec5048ddb7640b4407013ed45b7a545959c209c550e48bf108734f293e18e4.json
new file mode 100644
index 0000000000..f4c4fd31de
--- /dev/null
+++ b/backend/.sqlx/query-a0ec5048ddb7640b4407013ed45b7a545959c209c550e48bf108734f293e18e4.json
@@ -0,0 +1,19 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "WITH update_lock AS (\n                        UPDATE script SET lock = $1, modules = COALESCE($6, modules) WHERE hash = $2 AND workspace_id = $3\n                    )\n                    INSERT INTO lock_hash (workspace_id, path, lockfile_hash)\n                    VALUES ($3, $4, $5)\n                    ON CONFLICT (workspace_id, path) DO UPDATE SET lockfile_hash = $5",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Int8",
+        "Text",
+        "Varchar",
+        "Int8",
+        "Jsonb"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "a0ec5048ddb7640b4407013ed45b7a545959c209c550e48bf108734f293e18e4"
+}
diff --git a/backend/.sqlx/query-ede523c0b0027f7bc1dacd3a5448031783fa7fbbbf86a291b6f8f8f875d45637.json b/backend/.sqlx/query-ede523c0b0027f7bc1dacd3a5448031783fa7fbbbf86a291b6f8f8f875d45637.json
new file mode 100644
index 0000000000..bea6be2a7f
--- /dev/null
+++ b/backend/.sqlx/query-ede523c0b0027f7bc1dacd3a5448031783fa7fbbbf86a291b6f8f8f875d45637.json
@@ -0,0 +1,19 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n    INSERT INTO script\n    (workspace_id, hash, path, parent_hashes, summary, description, content, created_by, schema, is_template, extra_perms, lock, language, kind, tag, envs, concurrent_limit, concurrency_time_window_s, cache_ttl, cache_ignore_s3_path, dedicated_worker, ws_error_handler_muted, priority, restart_unless_cancelled, delete_after_use, delete_after_secs, timeout, concurrency_key, visible_to_runner_only, auto_kind, codebase, has_preprocessor, on_behalf_of, on_behalf_of_email, schema_validation, assets, debounce_key, debounce_delay_s, runnable_settings_handle, modules, labels, lock_error_logs, created_at)\n\n    SELECT  workspace_id, $1, path, array_prepend($2::bigint, COALESCE(parent_hashes, '{}'::bigint[])), summary, description, content, created_by, schema, is_template, extra_perms, $4::text, language, kind, tag, envs, concurrent_limit, concurrency_time_window_s, cache_ttl, cache_ignore_s3_path, dedicated_worker, ws_error_handler_muted, priority, restart_unless_cancelled, delete_after_use, delete_after_secs, timeout, concurrency_key, visible_to_runner_only, auto_kind, codebase, has_preprocessor, on_behalf_of, on_behalf_of_email, schema_validation, assets, debounce_key, debounce_delay_s, runnable_settings_handle, COALESCE($5::jsonb, modules), labels, $6::text, clock_timestamp()\n\n    FROM script WHERE hash = $2 AND workspace_id = $3;\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Int8",
+        "Int8",
+        "Text",
+        "Text",
+        "Jsonb",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "ede523c0b0027f7bc1dacd3a5448031783fa7fbbbf86a291b6f8f8f875d45637"
+}
diff --git a/backend/tests/relock_noop.rs b/backend/tests/relock_noop.rs
new file mode 100644
index 0000000000..5cb8e3f51e
--- /dev/null
+++ b/backend/tests/relock_noop.rs
@@ -0,0 +1,415 @@
+use sqlx::{Pool, Postgres};
+use tokio_stream::StreamExt;
+use windmill_api_client::types::NewScript;
+use windmill_common::scripts::{deploy_relocked_version, fetch_script_for_update};
+use windmill_test_utils::*;
+
+const W: &str = "test-workspace";
+
+const A: &str = r#"export async function main() { return "a" }"#;
+const A_COMMENTED: &str = r#"// same dependencies, different content
+export async function main() { return "a" }"#;
+const A_WITH_LODASH: &str = r#"import _ from "lodash@4.17.21";
+export async function main() { return _.trim(" a ") }"#;
+const B: &str = r#"import { main as a } from "/f/rel/a.ts";
+export async function main() { return "b" + (await a()) }"#;
+const C: &str = r#"import { main as b } from "/f/rel/b.ts";
+export async function main() { return "c" + (await b()) }"#;
+
+fn bun_script(path: &str, content: &str, parent_hash: Option<String>) -> NewScript {
+    NewScript {
+        draft_only: None,
+        content: content.into(),
+        language: windmill_api_client::types::ScriptLang::Bun,
+        lock: None,
+        parent_hash,
+        path: path.into(),
+        concurrent_limit: None,
+        concurrency_time_window_s: None,
+        cache_ttl: None,
+        dedicated_worker: None,
+        description: "".to_string(),
+        envs: vec![],
+        is_template: None,
+        kind: None,
+        summary: "".to_string(),
+        tag: None,
+        schema: std::collections::HashMap::new(),
+        ws_error_handler_muted: Some(false),
+        priority: None,
+        delete_after_secs: None,
+        timeout: None,
+        restart_unless_cancelled: None,
+        deployment_message: None,
+        concurrency_key: None,
+        visible_to_runner_only: None,
+        auto_kind: None,
+        codebase: None,
+        has_preprocessor: None,
+        on_behalf_of_email: None,
+        assets: vec![],
+        modules: None,
+    }
+}
+
+#[derive(sqlx::FromRow, Debug)]
+struct Version {
+    hash: i64,
+    archived: bool,
+    lock: Option<String>,
+    created_at: chrono::DateTime<chrono::Utc>,
+}
+
+/// Every version of `path`, oldest first.
+async fn versions(db: &Pool<Postgres>, path: &str) -> Vec<Version> {
+    sqlx::query_as(
+        "SELECT hash, archived, lock, created_at FROM script
+         WHERE workspace_id = $1 AND path = $2 ORDER BY created_at",
+    )
+    .bind(W)
+    .bind(path)
+    .fetch_all(db)
+    .await
+    .unwrap()
+}
+
+fn live(versions: &[Version]) -> &Version {
+    versions.iter().rev().find(|v| !v.archived).unwrap()
+}
+
+/// `(path, status, logs)` of every dependency job created after `since`, in completion order.
+async fn dependency_jobs_since(
+    db: &Pool<Postgres>,
+    since: chrono::DateTime<chrono::Utc>,
+) -> Vec<(String, String, String)> {
+    sqlx::query_as(
+        "SELECT j.runnable_path, c.status::text, COALESCE(l.logs, '') FROM v2_job_completed c
+         JOIN v2_job j ON j.id = c.id
+         LEFT JOIN job_logs l ON l.job_id = c.id
+         WHERE j.kind = 'dependencies' AND j.created_at > $1
+         ORDER BY c.started_at",
+    )
+    .bind(since)
+    .fetch_all(db)
+    .await
+    .unwrap()
+}
+
+async fn wait_for_jobs(
+    completed: &mut (impl futures::Stream<Item = uuid::Uuid> + Unpin),
+    count: usize,
+) {
+    for _ in 0..count {
+        completed.next().await;
+    }
+    // Then let anything else that was queued run out, so a job the assertions say must not
+    // exist would have shown up here.
+    while let Ok(Some(_)) =
+        tokio::time::timeout(std::time::Duration::from_secs(2), completed.next()).await
+    {}
+}
+
+/// A redeploy of an imported script whose dependencies did not move relocks its importer,
+/// and that relock must deploy nothing: no new version, and no dependency job for the
+/// importer's own importers. A redeploy that does change the dependencies still walks the
+/// whole chain with a new version at each step.
+#[sqlx::test(fixtures("base"))]
+async fn relative_import_relock_deploys_only_when_the_lock_changed(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    std::env::set_var("DEPENDENCY_JOB_DEBOUNCE_DELAY", "0");
+    let (client, port, _s) = init_client(db.clone()).await;
+    let mut completed = listen_for_completed_jobs(&db).await;
+
+    in_test_worker(
+        &db,
+        async {
+            // One at a time: each deploy's dependency job records the importer's edges, and an
+            // importer whose edges are recorded is what a later relock of it can skip on.
+            for (path, content) in [("f/rel/a", A), ("f/rel/b", B), ("f/rel/c", C)] {
+                client
+                    .create_script(W, &bun_script(path, content, None))
+                    .await
+                    .unwrap();
+                wait_for_jobs(&mut completed, 1).await;
+            }
+            let b_before = versions(&db, "f/rel/b").await;
+            let c_before = versions(&db, "f/rel/c").await;
+            assert_eq!(b_before.len(), 1);
+            assert_eq!(c_before.len(), 1);
+
+            // Content-only change on the leaf.
+            let since = chrono::Utc::now();
+            let a_hash = live(&versions(&db, "f/rel/a").await).hash;
+            client
+                .create_script(
+                    W,
+                    &bun_script("f/rel/a", A_COMMENTED, Some(format!("{a_hash:016x}"))),
+                )
+                .await
+                .unwrap();
+            wait_for_jobs(&mut completed, 2).await;
+
+            let jobs = dependency_jobs_since(&db, since).await;
+            let paths: Vec<&str> = jobs.iter().map(|(p, _, _)| p.as_str()).collect();
+            assert_eq!(
+                paths,
+                ["f/rel/a", "f/rel/b"],
+                "the leaf's own job and one no-op relock of its importer, and nothing for c"
+            );
+            assert!(
+                jobs[1]
+                    .2
+                    .contains("Lock unchanged: no new version deployed"),
+                "b's relock should have found its lock unchanged: {}",
+                jobs[1].2
+            );
+            let b_after = versions(&db, "f/rel/b").await;
+            let c_after = versions(&db, "f/rel/c").await;
+            assert_eq!(
+                b_after.len(),
+                1,
+                "an unchanged relock must not mint a version"
+            );
+            assert_eq!(live(&b_after).hash, live(&b_before).hash);
+            assert_eq!(c_after.len(), 1);
+            assert_eq!(live(&c_after).hash, live(&c_before).hash);
+
+            // A dependency change on the leaf.
+            let since = chrono::Utc::now();
+            let a_hash = live(&versions(&db, "f/rel/a").await).hash;
+            client
+                .create_script(
+                    W,
+                    &bun_script("f/rel/a", A_WITH_LODASH, Some(format!("{a_hash:016x}"))),
+                )
+                .await
+                .unwrap();
+            wait_for_jobs(&mut completed, 3).await;
+
+            let jobs = dependency_jobs_since(&db, since).await;
+            let paths: Vec<&str> = jobs.iter().map(|(p, _, _)| p.as_str()).collect();
+            assert_eq!(paths, ["f/rel/a", "f/rel/b", "f/rel/c"]);
+            for path in ["f/rel/b", "f/rel/c"] {
+                let vs = versions(&db, path).await;
+                assert_eq!(
+                    vs.len(),
+                    2,
+                    "{path}: a changed relock deploys a new version"
+                );
+                assert!(
+                    vs[0].archived && !vs[1].archived,
+                    "{path}: parent archived, child live"
+                );
+                assert!(vs[0].created_at < vs[1].created_at, "{path}: lineage order");
+                assert!(
+                    vs[1].lock.as_deref().unwrap_or("").contains("lodash"),
+                    "{path}: the new version carries the new lock: {:?}",
+                    vs[1].lock
+                );
+            }
+        },
+        port,
+    )
+    .await;
+
+    Ok(())
+}
+
+/// A relock that has to wait on its head's row lock, because a deploy of the same path holds
+/// it, must find the version that deploy left and requeue itself for it rather than fail. The
+/// blocked statement re-checks only the row it selected, which the deploy archived, and comes
+/// back empty; the successor is only visible to a fresh read.
+#[sqlx::test(fixtures("base"))]
+async fn relock_waiting_on_a_deploy_requeues_for_its_successor(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    std::env::set_var("DEPENDENCY_JOB_DEBOUNCE_DELAY", "0");
+    let (client, port, _s) = init_client(db.clone()).await;
+    let mut completed = listen_for_completed_jobs(&db).await;
+
+    in_test_worker(
+        &db,
+        async {
+            for (path, content) in [("f/rel/a", A), ("f/rel/b", B)] {
+                client
+                    .create_script(W, &bun_script(path, content, None))
+                    .await
+                    .unwrap();
+                wait_for_jobs(&mut completed, 1).await;
+            }
+
+            // A deploy of b that holds its head's row lock for as long as this transaction lives.
+            let mut deploy = db.begin().await.unwrap();
+            let head = fetch_script_for_update("f/rel/b", W, &mut *deploy)
+                .await
+                .unwrap()
+                .unwrap();
+
+            let since = chrono::Utc::now();
+            let a_hash = live(&versions(&db, "f/rel/a").await).hash;
+            client
+                .create_script(
+                    W,
+                    &bun_script("f/rel/a", A_COMMENTED, Some(format!("{a_hash:016x}"))),
+                )
+                .await
+                .unwrap();
+
+            // b's relock skips generation and reaches its commit, where it waits on the lock.
+            let mut waiting = false;
+            for _ in 0..300 {
+                waiting = sqlx::query_scalar(
+                    "SELECT EXISTS (SELECT 1 FROM pg_stat_activity
+                     WHERE datname = current_database() AND wait_event_type = 'Lock'
+                       AND query LIKE '%FROM script WHERE path = $1%FOR UPDATE%')",
+                )
+                .fetch_one(&db)
+                .await
+                .unwrap();
+                if waiting {
+                    break;
+                }
+                tokio::time::sleep(std::time::Duration::from_millis(100)).await;
+            }
+            assert!(waiting, "b's relock never reached the row lock");
+
+            // The deploy lands: the head is archived and a successor with its own lock takes
+            // its place, while the relock is still waiting.
+            let lock = head.lock.clone().unwrap();
+            let successor =
+                deploy_relocked_version(&mut deploy, head, None, Some(&lock), None, None)
+                    .await
+                    .unwrap();
+            deploy.commit().await.unwrap();
+
+            // a's own job, the relock that waited, and the relock it queued for the successor.
+            wait_for_jobs(&mut completed, 3).await;
+
+            let jobs = dependency_jobs_since(&db, since).await;
+            let paths: Vec<&str> = jobs.iter().map(|(p, _, _)| p.as_str()).collect();
+            assert_eq!(paths, ["f/rel/a", "f/rel/b", "f/rel/b"], "{jobs:?}");
+            assert!(
+                jobs.iter().all(|(_, status, _)| status == "success"),
+                "no relock may fail on the wait: {jobs:?}"
+            );
+            assert!(
+                jobs[1]
+                    .2
+                    .contains("was deployed while this lock was generated"),
+                "the waiting relock should have seen the successor: {}",
+                jobs[1].2
+            );
+            assert!(
+                jobs[2]
+                    .2
+                    .contains("Lock unchanged: no new version deployed"),
+                "the requeued relock should find the successor's lock current: {}",
+                jobs[2].2
+            );
+            let vs = versions(&db, "f/rel/b").await;
+            assert_eq!(
+                vs.len(),
+                2,
+                "the deploy's successor and nothing else: {vs:?}"
+            );
+            assert_eq!(live(&vs).hash, successor);
+        },
+        port,
+    )
+    .await;
+
+    Ok(())
+}
+
+/// A multi-file importer: on a skipped relock each module gets its own last lock back, not the
+/// parent script's, so an import's content-only redeploy leaves the importer alone as well.
+#[cfg(feature = "python")]
+#[sqlx::test(fixtures("base"))]
+async fn multi_file_importer_relock_is_a_no_op_too(db: Pool<Postgres>) -> anyhow::Result<()> {
+    std::env::set_var("DEPENDENCY_JOB_DEBOUNCE_DELAY", "0");
+    let (client, port, _s) = init_client(db.clone()).await;
+    let mut completed = listen_for_completed_jobs(&db).await;
+
+    let py = |path: &str, content: &str, parent_hash: Option<String>, with_module: bool| {
+        let mut ns = bun_script(path, content, parent_hash);
+        ns.language = windmill_api_client::types::ScriptLang::Python3;
+        if with_module {
+            ns.modules = Some(std::collections::HashMap::from([(
+                "helper.py".to_string(),
+                serde_json::json!({
+                    "content": "def greet(x):\n    return 'hi ' + x\n",
+                    "language": "python3"
+                }),
+            )]));
+        }
+        ns
+    };
+    async fn module_lock(db: &Pool<Postgres>) -> Option<String> {
+        sqlx::query_scalar(
+            "SELECT modules->'helper.py'->>'lock' FROM script
+             WHERE workspace_id = $1 AND path = 'f/rel/pb' AND archived = false",
+        )
+        .bind(W)
+        .fetch_one(db)
+        .await
+        .unwrap()
+    }
+
+    in_test_worker(
+        &db,
+        async {
+            client
+                .create_script(W, &py("f/rel/pa", "def main():\n    return 'a'\n", None, false))
+                .await
+                .unwrap();
+            wait_for_jobs(&mut completed, 1).await;
+            client
+                .create_script(
+                    W,
+                    &py(
+                        "f/rel/pb",
+                        "from f.rel.pa import main as a\nfrom .helper import greet\n\ndef main():\n    return greet(a())\n",
+                        None,
+                        true,
+                    ),
+                )
+                .await
+                .unwrap();
+            wait_for_jobs(&mut completed, 1).await;
+            let lock_before = module_lock(&db).await;
+            assert!(lock_before.is_some(), "the module got a lock of its own on deploy");
+
+            let since = chrono::Utc::now();
+            let pa_hash = live(&versions(&db, "f/rel/pa").await).hash;
+            client
+                .create_script(
+                    W,
+                    &py(
+                        "f/rel/pa",
+                        "# same dependencies\ndef main():\n    return 'a'\n",
+                        Some(format!("{pa_hash:016x}")),
+                        false,
+                    ),
+                )
+                .await
+                .unwrap();
+            wait_for_jobs(&mut completed, 2).await;
+
+            let jobs = dependency_jobs_since(&db, since).await;
+            let paths: Vec<&str> = jobs.iter().map(|(p, _, _)| p.as_str()).collect();
+            assert_eq!(paths, ["f/rel/pa", "f/rel/pb"], "{jobs:?}");
+            assert!(
+                jobs[1].2.contains("Lock unchanged: no new version deployed"),
+                "the multi-file importer's relock should be a no-op: {}",
+                jobs[1].2
+            );
+            assert_eq!(versions(&db, "f/rel/pb").await.len(), 1);
+            assert_eq!(module_lock(&db).await, lock_before, "the module keeps its own lock");
+        },
+        port,
+    )
+    .await;
+
+    Ok(())
+}
diff --git a/backend/tests/relock_skip.rs b/backend/tests/relock_skip.rs
index 8262a38cf4..bf5cb24cbf 100644
--- a/backend/tests/relock_skip.rs
+++ b/backend/tests/relock_skip.rs
@@ -266,7 +266,10 @@ def main():
         .await
         .unwrap();
 
-        in_test_worker(&db, wait_for_jobs_ge(&mut completed, 10), port).await;
+        // Empty content leaves every importer's lock as it was, so only the five direct
+        // importers of the default deps run a job: an unchanged script relock deploys no
+        // version and so queues nothing for its own importers.
+        in_test_worker(&db, wait_for_jobs_ge(&mut completed, 5), port).await;
 
         // Note: within a cascade, the same script may be triggered multiple times.
         // After the first trigger relocks and stores the hash, subsequent triggers skip.
@@ -295,7 +298,7 @@ def main():
         .await
         .unwrap();
 
-        in_test_worker(&db, wait_for_jobs_ge(&mut completed, 10), port).await;
+        in_test_worker(&db, wait_for_jobs_ge(&mut completed, 5), port).await;
 
         let skipping_count = count_pattern_in_job_logs(&db, "Skipping relock", before).await;
         assert!(
diff --git a/backend/windmill-common/src/scripts.rs b/backend/windmill-common/src/scripts.rs
index 31219621e9..d71bc50e60 100644
--- a/backend/windmill-common/src/scripts.rs
+++ b/backend/windmill-common/src/scripts.rs
@@ -358,31 +358,38 @@ pub async fn fetch_script_for_update<'a>(
     .map_err(crate::error::Error::from)
 }
 
-pub struct ClonedScript {
-    pub old_script: NewScript,
-    pub new_hash: i64,
-}
-// TODO: What if dependency job fails, there is script with NULL in the lock
-pub async fn clone_script<'c>(
-    path: &str,
-    w_id: &str,
+/// Deploys the outcome of a relative-import relock as a new version of `head`, the path's live
+/// version that the caller holds `FOR UPDATE`, and archives `head`. A `lock` of `None` records
+/// a failed generation: the version carries `lock_error_logs` instead and runs keep resolving
+/// to the last version that has a lock. A `modules` of `None` keeps the head's module locks.
+///
+/// Writes whatever `head` names and checks nothing: callers are responsible for having
+/// established access to its workspace and path, as a dependency job's push already has.
+///
+/// `created_at` is stamped when the insert runs, not at transaction start. The row lock on
+/// `head` is what orders one relock after another, and with `now()` a transaction that began
+/// first but locked second commits a live child older than its archived parent, which every
+/// "latest version" read then mis-orders.
+pub async fn deploy_relocked_version(
+    tx: &mut sqlx::Transaction<'_, sqlx::Postgres>,
+    head: Script<ScriptRunnableSettingsHandle>,
     deployment_message: Option<String>,
-    db: &DB,
-) -> crate::error::Result<ClonedScript> {
-    let mut tx = db.begin().await?;
-    let s = if let Some(s) = fetch_script_for_update(path, w_id, &mut *tx).await? {
-        s
-    } else {
-        return Err(crate::error::Error::NotFound(format!(
-            "Non-archived script with path '{}' not found",
-            path
-        )));
-    };
+    lock: Option<&str>,
+    modules: Option<&std::collections::HashMap<String, ScriptModule>>,
+    lock_error_logs: Option<&str>,
+) -> crate::error::Result<i64> {
+    let s = head;
+    let w_id = s.workspace_id.as_str();
 
-    let rs = runnable_settings::from_handle(s.runnable_settings.runnable_settings_handle, &mut *tx)
-        .await?;
+    let rs =
+        runnable_settings::from_handle(s.runnable_settings.runnable_settings_handle, &mut **tx)
+            .await?;
     let (debouncing_settings, concurrency_settings) =
-        runnable_settings::prefetch_cached_tx(&rs, &mut tx).await?;
+        runnable_settings::prefetch_cached_tx(&rs, &mut *tx).await?;
+
+    // What the row stores is what the hash covers: the new module locks when there are any.
+    let modules = modules.cloned().or(s.modules);
+    let modules_json = modules.as_ref().map(serde_json::to_value).transpose()?;
 
     let ns = NewScript {
         path: s.path.clone(),
@@ -392,7 +399,7 @@ pub async fn clone_script<'c>(
         content: s.content,
         schema: s.schema,
         is_template: s.is_template,
-        lock: None,
+        lock: lock.map(str::to_string),
         language: s.language,
         kind: Some(s.kind),
         tag: s.tag,
@@ -424,7 +431,7 @@ pub async fn clone_script<'c>(
         on_behalf_of: s.on_behalf_of,
         preserve_on_behalf_of: None,
         assets: s.assets,
-        modules: s.modules,
+        modules,
         auto_parent: None,
         labels: s.labels,
         skip_draft_deletion: None,
@@ -433,7 +440,7 @@ pub async fn clone_script<'c>(
     let new_hash = hash_script(&ns);
 
     tracing::debug!(
-        "cloning script at path {} from '{}' to '{}'",
+        "deploying relocked version of script at path {} from '{}' to '{}'",
         s.path,
         *s.hash,
         new_hash
@@ -446,17 +453,19 @@ pub async fn clone_script<'c>(
     envs, concurrent_limit, concurrency_time_window_s, cache_ttl, cache_ignore_s3_path, \
     dedicated_worker, ws_error_handler_muted, priority, restart_unless_cancelled, \
     delete_after_use, delete_after_secs, timeout, concurrency_key, visible_to_runner_only, auto_kind, \
-    codebase, has_preprocessor, on_behalf_of, on_behalf_of_email, schema_validation, assets, debounce_key, debounce_delay_s, runnable_settings_handle, modules, labels)
+    codebase, has_preprocessor, on_behalf_of, on_behalf_of_email, schema_validation, assets, debounce_key, debounce_delay_s, runnable_settings_handle, modules, labels, \
+    lock_error_logs, created_at)
 
     SELECT  workspace_id, $1, path, array_prepend($2::bigint, COALESCE(parent_hashes, '{}'::bigint[])), summary, description, \
-            content, created_by, schema, is_template, extra_perms, NULL, language, kind, tag, \
+            content, created_by, schema, is_template, extra_perms, $4::text, language, kind, tag, \
             envs, concurrent_limit, concurrency_time_window_s, cache_ttl, cache_ignore_s3_path, \
             dedicated_worker, ws_error_handler_muted, priority, restart_unless_cancelled, \
             delete_after_use, delete_after_secs, timeout, concurrency_key, visible_to_runner_only, auto_kind, \
-            codebase, has_preprocessor, on_behalf_of, on_behalf_of_email, schema_validation, assets, debounce_key, debounce_delay_s, runnable_settings_handle, modules, labels
+            codebase, has_preprocessor, on_behalf_of, on_behalf_of_email, schema_validation, assets, debounce_key, debounce_delay_s, runnable_settings_handle, COALESCE($5::jsonb, modules), labels, \
+            $6::text, clock_timestamp()
 
     FROM script WHERE hash = $2 AND workspace_id = $3;
-            ", new_hash, s.hash.0, w_id).execute(&mut *tx).await?;
+            ", new_hash, s.hash.0, w_id, lock, modules_json, lock_error_logs).execute(&mut **tx).await?;
 
     // Archive base.
     sqlx::query!(
@@ -464,9 +473,8 @@ pub async fn clone_script<'c>(
         *s.hash,
         w_id
     )
-    .execute(&mut *tx)
+    .execute(&mut **tx)
     .await?;
 
-    tx.commit().await?;
-    Ok(ClonedScript { old_script: ns, new_hash })
+    Ok(new_hash)
 }
diff --git a/backend/windmill-dep-map/src/lib.rs b/backend/windmill-dep-map/src/lib.rs
index 650e0e5f99..aab50795a9 100644
--- a/backend/windmill-dep-map/src/lib.rs
+++ b/backend/windmill-dep-map/src/lib.rs
@@ -128,6 +128,40 @@ pub fn extract_referenced_paths(
     }
 }
 
+/// Re-records which paths `script_path` imports and what each one's lock hashes to right now.
+/// That snapshot is what a later relock-skip check of this importer compares against, so it
+/// has to move whenever the imports may have, whether or not the importer's own lock did.
+///
+/// Writes for any path in `w_id` and checks nothing: callers are responsible for having
+/// established access to that workspace and script, as a dependency job's push already has.
+pub async fn refresh_dependency_map(
+    db: &sqlx::Pool<sqlx::Postgres>,
+    w_id: &str,
+    script_path: &str,
+    parent_path: &Option<String>,
+    code: &str,
+    script_lang: &Option<ScriptLang>,
+) -> error::Result<()> {
+    use scoped_dependency_map::ScopedDependencyMap;
+
+    let mut tx = db.begin().await?;
+    let mut dependency_map =
+        ScopedDependencyMap::fetch_maybe_rearranged(w_id, script_path, "script", parent_path, db)
+            .await?;
+
+    tx = dependency_map
+        .patch(
+            extract_referenced_paths(code, script_path, *script_lang),
+            // Ideally should be None, but due to current implementation will use empty string to represent None.
+            "".into(),
+            tx,
+        )
+        .await?;
+
+    dependency_map.dissolve(tx).await.commit().await?;
+    Ok(())
+}
+
 pub async fn process_relative_imports(
     db: &sqlx::Pool<sqlx::Postgres>,
     _job_id: Option<Uuid>,
@@ -145,29 +179,7 @@ pub async fn process_relative_imports(
     use scoped_dependency_map::ScopedDependencyMap;
     use trigger_dependents::trigger_dependents_to_recompute_dependencies;
 
-    // TODO: Should be moved into handle_dependency_job body to be more consistent with how flows and apps are handled
-    {
-        let mut tx = db.begin().await?;
-        let mut dependency_map = ScopedDependencyMap::fetch_maybe_rearranged(
-            &w_id,
-            script_path,
-            "script",
-            &parent_path,
-            db,
-        )
-        .await?;
-
-        tx = dependency_map
-            .patch(
-                extract_referenced_paths(&code, script_path, *script_lang),
-                // Ideally should be None, but due to current implementation will use empty string to represent None.
-                "".into(),
-                tx,
-            )
-            .await?;
-
-        dependency_map.dissolve(tx).await.commit().await?;
-    }
+    refresh_dependency_map(db, w_id, script_path, &parent_path, code, script_lang).await?;
 
     {
         let mut already_visited = args
diff --git a/backend/windmill-queue/src/jobs.rs b/backend/windmill-queue/src/jobs.rs
index c7c119a5a7..8ac4fd390a 100644
--- a/backend/windmill-queue/src/jobs.rs
+++ b/backend/windmill-queue/src/jobs.rs
@@ -4007,33 +4007,10 @@ async fn clone_runnable(j: &mut PulledJob, db: &DB) -> error::Result<()> {
 
     {
         let maybe_new_id = match j.kind {
-            JobKind::Dependencies => {
-                let deployment_message = j
-                    .args
-                    .clone()
-                    .map(|hashmap| {
-                        hashmap
-                            .get("deployment_message")
-                            .map(|map_value| serde_json::from_str::<String>(map_value.get()).ok())
-                            .flatten()
-                    })
-                    .flatten();
-
-                // This way we tell downstream which script we should archive when the resolution is finished.
-                // (not used at the moment)
-                j.args
-                    .as_mut()
-                    .map(|args| args.insert("base_hash".to_owned(), to_raw_value(&*base_hash)));
-
-                windmill_common::scripts::clone_script(
-                    j.runnable_path(),
-                    &j.workspace_id,
-                    deployment_message,
-                    db,
-                )
-                .await?
-                .new_hash
-            }
+            // A script gets its new version from the worker, once the generated lock is known
+            // to differ from the live version's: minting one here would deploy, and walk the
+            // importers of, a version whose lock turns out byte-identical to its parent's.
+            JobKind::Dependencies => *base_hash,
             JobKind::FlowDependencies => {
                 sqlx::query_scalar!(
                     "INSERT INTO flow_version
diff --git a/backend/windmill-types/src/scripts.rs b/backend/windmill-types/src/scripts.rs
index 414650e846..19f6a06021 100644
--- a/backend/windmill-types/src/scripts.rs
+++ b/backend/windmill-types/src/scripts.rs
@@ -16,7 +16,7 @@ use crate::{
     runnable_settings::{ConcurrencySettings, DebouncingSettings},
 };
 
-#[derive(Serialize, Deserialize, Debug, Clone, Hash)]
+#[derive(Serialize, Deserialize, Debug, Clone, Hash, PartialEq, Eq)]
 pub struct ScriptModule {
     pub content: String,
     pub language: ScriptLang,
diff --git a/backend/windmill-worker/src/worker_lockfiles.rs b/backend/windmill-worker/src/worker_lockfiles.rs
index 57b859075a..9bba9a99e6 100644
--- a/backend/windmill-worker/src/worker_lockfiles.rs
+++ b/backend/windmill-worker/src/worker_lockfiles.rs
@@ -19,14 +19,17 @@ use windmill_common::error::Result;
 use windmill_common::flows::{FlowModule, FlowModuleValue, FlowNodeId};
 use windmill_common::jobs::JobKind;
 use windmill_common::min_version::MIN_VERSION_SUPPORTS_DEBOUNCING_V2;
-use windmill_common::scripts::ScriptHash;
+use windmill_common::scripts::{
+    deploy_relocked_version, fetch_script_for_update, hash_script, ScriptHash, ScriptModule,
+};
 #[cfg(feature = "python")]
 use windmill_common::worker::PythonAnnotations;
 use windmill_common::worker::{to_raw_value, to_raw_value_owned, write_file, Connection};
 use windmill_common::workspace_dependencies::{
     RawWorkspaceDependencies, WorkspaceDependenciesPrefetched,
 };
-use windmill_dep_map::scoped_dependency_map::ScopedDependencyMap;
+use windmill_dep_map::scoped_dependency_map::{DependencyDependent, ScopedDependencyMap};
+use windmill_dep_map::trigger_dependents::trigger_dependents_to_recompute_dependencies;
 #[cfg(feature = "python")]
 use windmill_parser_yaml::AnsibleRequirements;
 
@@ -38,8 +41,10 @@ use windmill_common::{
     scripts::ScriptLang,
     DB,
 };
+use windmill_dep_map::lock_hash::record_lock_hashes;
 pub use windmill_dep_map::{
     extract_referenced_paths, extract_relative_imports, process_relative_imports,
+    refresh_dependency_map,
 };
 use windmill_git_sync::{
     handle_deployment_metadata, tally_deployed_object_changes, DeployedObject,
@@ -86,10 +91,13 @@ use crate::{
 /// has the toolchain and, since the cache key is per OS/arch, the platform the runtime
 /// workers use. Deploys that supply their own lock never reach a dependency job at all and
 /// queue theirs from `create_script_internal` instead.
-async fn maybe_queue_binary_prebuild(db: &DB, job: &MiniPulledJob, lock: &str) -> Result<()> {
-    let (Some(hash), Some(path), Some(lang)) =
-        (job.runnable_id, job.runnable_path.clone(), job.script_lang)
-    else {
+async fn maybe_queue_binary_prebuild(
+    db: &DB,
+    job: &MiniPulledJob,
+    hash: ScriptHash,
+    lock: &str,
+) -> Result<()> {
+    let (Some(path), Some(lang)) = (job.runnable_path.clone(), job.script_lang) else {
         return Ok(());
     };
     let Some(prebuild) =
@@ -283,6 +291,13 @@ pub async fn handle_dependency_job(
         job.runnable_path()
     );
     let script_path = job.runnable_path();
+    let w_id = &job.workspace_id;
+
+    let triggered_by_relative_import = job
+        .args
+        .as_ref()
+        .map(|x| x.get("triggered_by_relative_import").is_some())
+        .unwrap_or_default();
 
     // A build pass reads the same script data but writes none of the deploy state below,
     // including the `lock_error_logs` stamp on a fetch failure: the version it builds is
@@ -296,14 +311,48 @@ pub async fn handle_dependency_job(
         *deployment_tallied = true;
     }
 
+    // A relative-import relock deploys nothing until `commit_relock` says so, while the
+    // caller's fallback tally assumes a failed dependency job left a deployed version behind.
+    // Claim the tally here; the failure path hands it back once it has minted the version
+    // that carries the error.
+    if triggered_by_relative_import {
+        *deployment_tallied = true;
+    }
+
+    // A relative-import relock locks the path's live version as of now, not the hash captured
+    // when the job was pushed: a deploy can land during the debounce delay, after which that
+    // hash names an archived version. What it generates is committed against the live version
+    // re-read under a row lock, so a deploy landing mid-generation is caught there too.
+    let target_hash = if triggered_by_relative_import {
+        Some(ScriptHash(live_head_hash(db, w_id, script_path).await?))
+    } else {
+        job.runnable_id
+    };
+
     // `JobKind::Dependencies` job store either:
     // - A saved script `hash` in the `script_hash` column.
     // - Preview raw lock and code in the `queue` or `job` table.
-    let script_data = &match job.runnable_id {
+    let script_data = &match target_hash {
+        // Read straight from the database: the cache pins a version's data under its hash for
+        // as long as this worker lives, and the live version may still be waiting on its own
+        // dependency job's lock, which lands in place. A run resolving to it on this worker
+        // would then get no lock from the cache at all.
+        Some(hash) if triggered_by_relative_import => {
+            let raw = cache::script::fetch_script_from_db(db, hash, std::panic::Location::caller())
+                .await?;
+            Cow::Owned(std::sync::Arc::new(cache::ScriptData {
+                lock: raw.lock,
+                code: raw.content,
+                modules: raw.modules,
+            }))
+        }
         Some(hash) => match cache::script::fetch(&Connection::from(db.clone()), hash).await {
             Ok(d) => Cow::Owned(d.0),
             Err(e) => {
-                if !is_build_job {
+                // The live version of a relative-import relock is what runs resolve to, and
+                // `lock_error_logs` on it takes it out of resolution; the job carries the
+                // error instead, since it deployed nothing.
+                if !is_build_job && !triggered_by_relative_import {
                     let logs2 = sqlx::query_scalar!(
                         "SELECT logs FROM job_logs WHERE job_id = $1 AND workspace_id = $2",
                         &job.id,
@@ -348,12 +397,6 @@ pub async fn handle_dependency_job(
         .await;
     }
 
-    let triggered_by_relative_import = job
-        .args
-        .as_ref()
-        .map(|x| x.get("triggered_by_relative_import").is_some())
-        .unwrap_or_default();
-
     // Extract temp_script_refs from job args (path -> hash mapping for temp storage)
     let temp_script_refs: Option<HashMap<String, String>> = job
         .args
@@ -391,20 +434,17 @@ pub async fn handle_dependency_job(
     )
     .await;
 
+    let (deployment_message, parent_path) =
+        get_deployment_msg_and_parent_path_from_args(job.args.clone());
+
     match content {
         Ok(content) => {
-            if job.runnable_id.is_none() {
+            let Some(current_hash) = target_hash else {
                 // it a one-off raw script dependency job, no need to update the db
                 return Ok(to_raw_value_owned(
                     json!({ "status": "Successful lock file generation", "lock": content }),
                 ));
-            }
-
-            let current_hash = job.runnable_id.unwrap_or(ScriptHash(0));
-            let w_id = &job.workspace_id;
-
-            let (deployment_message, parent_path) =
-                get_deployment_msg_and_parent_path_from_args(job.args.clone());
+            };
 
             // Generate lockfiles for module files (if any).
             //
@@ -441,7 +481,9 @@ pub async fn handle_dependency_job(
                             occupancy_metrics,
                             &raw_workspace_dependencies_o,
                             module.lock.as_deref(),
-                            triggered_by_relative_import,
+                            // A module that was never locked has nothing a skip could hand
+                            // back; the path's lock is the parent script's, not its own.
+                            triggered_by_relative_import && module.lock.is_some(),
                             script_path,
                             None,
                             "script",
@@ -464,34 +506,83 @@ pub async fn handle_dependency_job(
                     None
                 };
 
-            // We do not create new row for this update
-            // That means we can keep current hash and just update lock
-            // Also store lockfile hash for dependency change detection
-            let lockfile_hash = windmill_common::scripts::hash_script(&content);
-            let updated_modules_json = updated_modules
-                .as_ref()
-                .and_then(|m| serde_json::to_value(m).ok());
-            sqlx::query!(
-                "WITH update_lock AS (
-                    UPDATE script SET lock = $1, modules = COALESCE($6, modules) WHERE hash = $2 AND workspace_id = $3
+            let deployed_hash = if triggered_by_relative_import {
+                match commit_relock(
+                    db,
+                    w_id,
+                    script_path,
+                    current_hash,
+                    Some(&content),
+                    updated_modules.as_ref(),
+                    None,
+                    deployment_message.clone(),
                 )
-                INSERT INTO lock_hash (workspace_id, path, lockfile_hash)
-                VALUES ($3, $4, $5)
-                ON CONFLICT (workspace_id, path) DO UPDATE SET lockfile_hash = $5",
-                &content,
-                &current_hash.0,
-                w_id,
-                script_path,
-                &lockfile_hash,
-                updated_modules_json
-            )
-            .execute(db)
-            .await?;
+                .await?
+                {
+                    RelockOutcome::Deployed(hash) => hash,
+                    RelockOutcome::Unchanged => {
+                        let log_msg = "\nLock unchanged: no new version deployed";
+                        tracing::info!(workspace_id = %w_id, job_id = %job.id, "{log_msg}");
+                        append_logs(&job.id, w_id, log_msg, &db.into()).await;
+                        // The imports may have moved even though the result did not, and the
+                        // map is what this importer's next skip check reads.
+                        refresh_dependency_map(
+                            db,
+                            w_id,
+                            script_path,
+                            &parent_path,
+                            &script_data.code,
+                            &job.script_lang,
+                        )
+                        .await?;
+                        return Ok(to_raw_value_owned(
+                            json!({ "status": "Lock unchanged, no new version deployed", "lock": content }),
+                        ));
+                    }
+                    RelockOutcome::Superseded(head) => {
+                        let log_msg = format!(
+                            "\nVersion {head} was deployed while this lock was generated; discarding it and queueing a relock of that version"
+                        );
+                        tracing::info!(workspace_id = %w_id, job_id = %job.id, "{log_msg}");
+                        append_logs(&job.id, w_id, log_msg, &db.into()).await;
+                        requeue_relock(db, job, script_path, deployment_message, parent_path)
+                            .await?;
+                        return Ok(to_raw_value_owned(
+                            json!({ "status": "Lock generation superseded by a newer version", "lock": content }),
+                        ));
+                    }
+                }
+            } else {
+                // We do not create new row for this update
+                // That means we can keep current hash and just update lock
+                // Also store lockfile hash for dependency change detection
+                let lockfile_hash = windmill_common::scripts::hash_script(&content);
+                let updated_modules_json = updated_modules
+                    .as_ref()
+                    .and_then(|m| serde_json::to_value(m).ok());
+                sqlx::query!(
+                    "WITH update_lock AS (
+                        UPDATE script SET lock = $1, modules = COALESCE($6, modules) WHERE hash = $2 AND workspace_id = $3
+                    )
+                    INSERT INTO lock_hash (workspace_id, path, lockfile_hash)
+                    VALUES ($3, $4, $5)
+                    ON CONFLICT (workspace_id, path) DO UPDATE SET lockfile_hash = $5",
+                    &content,
+                    &current_hash.0,
+                    w_id,
+                    script_path,
+                    &lockfile_hash,
+                    updated_modules_json
+                )
+                .execute(db)
+                .await?;
 
-            // `lock` has been updated; invalidate the cache.
-            // Since only worker that ran this Dependency Job has the cache
-            // we do not need to think about invalidating cache for other workers.
-            cache::script::invalidate(current_hash);
+                // `lock` has been updated; invalidate the cache.
+                // Since only worker that ran this Dependency Job has the cache
+                // we do not need to think about invalidating cache for other workers.
+                cache::script::invalidate(current_hash);
+                current_hash
+            };
             // The version only became runnable now, so this process still resolves the path to
             // the one before it. Only the runnable-hash cache: the import-side caches ignore the
             // lock, so evicting this process' half of that pair here would key a bundle by a
@@ -504,7 +595,7 @@ pub async fn handle_dependency_job(
                 &db,
                 &w_id,
                 DeployedObject::Script {
-                    hash: current_hash,
+                    hash: deployed_hash,
                     path: script_path.to_string(),
                     parent_path: parent_path.clone(),
                 },
@@ -565,7 +656,7 @@ pub async fn handle_dependency_job(
                 });
             }
 
-            if let Err(e) = maybe_queue_binary_prebuild(db, job, &content).await {
+            if let Err(e) = maybe_queue_binary_prebuild(db, job, deployed_hash, &content).await {
                 tracing::error!(%e, "error queueing the auto-build binary job for {script_path}");
             }
 
@@ -583,14 +674,49 @@ pub async fn handle_dependency_job(
             .await?
             .flatten()
             .unwrap_or_else(|| "no logs".to_string());
-            sqlx::query!(
-                "UPDATE script SET lock_error_logs = $1 WHERE hash = $2 AND workspace_id = $3",
-                &format!("{logs2}\n{error}"),
-                &job.runnable_id.unwrap_or(ScriptHash(0)).0,
-                &job.workspace_id
-            )
-            .execute(db)
-            .await?;
+            let error_logs = format!("{logs2}\n{error}");
+            if let (true, Some(hash)) = (triggered_by_relative_import, target_hash) {
+                // The same shape a failed deploy leaves: a version without a lock that carries
+                // the error, so it shows on the script while runs keep resolving to the last
+                // version that has one. Only that version is the caller's fallback to tally;
+                // one that landed meanwhile owns its own lock, and a commit that failed left
+                // nothing.
+                match commit_relock(
+                    db,
+                    w_id,
+                    script_path,
+                    hash,
+                    None,
+                    None,
+                    Some(&error_logs),
+                    deployment_message.clone(),
+                )
+                .await
+                {
+                    Ok(RelockOutcome::Deployed(_)) => *deployment_tallied = false,
+                    Ok(RelockOutcome::Superseded(_)) => {
+                        if let Err(e) =
+                            requeue_relock(db, job, script_path, deployment_message, parent_path)
+                                .await
+                        {
+                            tracing::error!(%e, "error queueing a relock of {script_path}")
+                        }
+                    }
+                    Ok(RelockOutcome::Unchanged) => {}
+                    Err(e) => {
+                        tracing::error!(%e, "error recording the failed relock of {script_path}")
+                    }
+                }
+            } else {
+                sqlx::query!(
+                    "UPDATE script SET lock_error_logs = $1 WHERE hash = $2 AND workspace_id = $3",
+                    &error_logs,
+                    &job.runnable_id.unwrap_or(ScriptHash(0)).0,
+                    &job.workspace_id
+                )
+                .execute(db)
+                .await?;
+            }
             Err(Error::ExecutionErr(format!(
                 "Error locking file: {error}\n\nlogs:\n{}",
                 remove_ansi_codes(&logs2)
@@ -598,6 +724,136 @@ pub async fn handle_dependency_job(
         }
     }
 }
+
+/// The version of `script_path` that runs resolve to, which is what a relative-import relock
+/// locks. `NotFound` when the path holds none, which a job pushed for a path since archived or
+/// deleted reports as its own failure.
+async fn live_head_hash(db: &DB, w_id: &str, script_path: &str) -> error::Result<i64> {
+    sqlx::query_scalar!(
+        "SELECT hash FROM script WHERE path = $1 AND workspace_id = $2 AND deleted = false AND archived = false ORDER BY created_at DESC LIMIT 1",
+        script_path,
+        w_id
+    )
+    .fetch_optional(db)
+    .await?
+    .ok_or_else(|| {
+        Error::NotFound(format!(
+            "Non-archived script with path '{script_path}' not found"
+        ))
+    })
+}
+
+enum RelockOutcome {
+    /// A new version carrying the result is the live one.
+    Deployed(ScriptHash),
+    /// The live version already holds this lock and these module locks; nothing was written.
+    Unchanged,
+    /// The live version is no longer the one the lock was generated for; nothing was written.
+    Superseded(ScriptHash),
+}
+
+/// Commits what a relative-import relock produced against the path's live version, read under
+/// a row lock so relocks of one path serialize on it.
+///
+/// A result equal to the live version's lock and module locks writes nothing: the importer's
+/// dependencies did not move, and a new version would deploy byte-identical content and then
+/// walk its own importers for nothing. A `lock` of `None` is a failed generation and always
+/// deploys, as the version that carries the error.
+async fn commit_relock(
+    db: &DB,
+    w_id: &str,
+    script_path: &str,
+    generated_for: ScriptHash,
+    lock: Option<&str>,
+    modules: Option<&HashMap<String, ScriptModule>>,
+    lock_error_logs: Option<&str>,
+    deployment_message: Option<String>,
+) -> error::Result<RelockOutcome> {
+    let mut tx = db.begin().await?;
+    let mut head = None;
+    for _ in 0..4 {
+        head = fetch_script_for_update(script_path, w_id, &mut *tx).await?;
+        if head.is_some() {
+            break;
+        }
+        // Having waited on the live version's row lock, the statement re-checked that row
+        // once the holder committed, found it archived, and returned nothing: the successor
+        // the holder inserted is not in the statement's snapshot. A fresh statement sees it,
+        // unless yet another writer got there first, so this goes around a few times before
+        // concluding the path holds no live version.
+    }
+    let Some(head) = head else {
+        return Err(Error::NotFound(format!(
+            "Non-archived script with path '{script_path}' not found"
+        )));
+    };
+    if head.hash != generated_for {
+        // A deploy landed while the lock was generated. It carried its own lock or queued its
+        // own dependency job, and this lock describes content that is no longer live.
+        return Ok(RelockOutcome::Superseded(head.hash));
+    }
+    let lock_hash_entry = lock.map(|lock| (script_path.to_string(), hash_script(lock)));
+    if let Some(lock) = lock {
+        let modules_unchanged = modules.map_or(true, |m| head.modules.as_ref() == Some(m));
+        if head.lock.as_deref() == Some(lock) && modules_unchanged {
+            // The hash row is still written, and under the same row lock: a version deployed
+            // before lock hashes were recorded has none, so its importers cannot skip until
+            // it does, and a deploy that takes the lock next must not have the hash it records
+            // overwritten by this one.
+            record_lock_hashes(&mut tx, w_id, lock_hash_entry.as_slice()).await?;
+            tx.commit().await?;
+            return Ok(RelockOutcome::Unchanged);
+        }
+    }
+    let new_hash = deploy_relocked_version(
+        &mut tx,
+        head,
+        deployment_message,
+        lock,
+        modules,
+        lock_error_logs,
+    )
+    .await?;
+    record_lock_hashes(&mut tx, w_id, lock_hash_entry.as_slice()).await?;
+    tx.commit().await?;
+    Ok(RelockOutcome::Deployed(ScriptHash(new_hash)))
+}
+
+/// Queues another relative-import relock of `script_path`, through the same push the fan-out
+/// uses. The version live now was deployed while a lock was generated for its predecessor;
+/// when that deploy was a sibling relock it queued nothing for this path, and the result just
+/// discarded may have been the one generated against the current imports.
+async fn requeue_relock(
+    db: &DB,
+    job: &MiniPulledJob,
+    script_path: &str,
+    deployment_message: Option<String>,
+    parent_path: Option<String>,
+) -> error::Result<()> {
+    let already_visited = job
+        .args
+        .as_ref()
+        .and_then(|x| x.get("already_visited"))
+        .and_then(|v| serde_json::from_str::<Vec<String>>(v.get()).ok())
+        .unwrap_or_default();
+    trigger_dependents_to_recompute_dependencies(
+        &job.workspace_id,
+        vec![DependencyDependent {
+            importer_path: script_path.to_string(),
+            importer_kind: "script".to_string(),
+            importer_node_ids: None,
+        }],
+        deployment_message,
+        parent_path,
+        &job.permissioned_as_email,
+        &job.created_by,
+        &job.permissioned_as,
+        db,
+        already_visited,
+    )
+    .await
+}
+
 fn remove_ansi_codes(s: &str) -> String {
     lazy_static::lazy_static! {
         static ref ANSI_REGEX: regex::Regex = regex::Regex::new(r"\x1b\[[0-9;]*[a-zA-Z]").unwrap();
@@ -2892,8 +3148,12 @@ async fn try_skip_relock(
     }
 
     // Fetch existing lock based on runnable type
-    let lock = match runnable_type {
-        "script" => sqlx::query_scalar!(
+    let lock = match (runnable_type, existing_lock) {
+        // A script's module asks with the script's own type and hands over the lock it last
+        // deployed with. The path's lock below is the parent script's, and a module given
+        // that loses whatever it resolves on its own.
+        ("script", Some(module_lock)) => Some(module_lock.to_string()),
+        ("script", None) => sqlx::query_scalar!(
             "SELECT lock FROM script WHERE path = $1 AND workspace_id = $2 AND lock IS NOT NULL
              AND deleted = false ORDER BY created_at DESC LIMIT 1",
             base_path,
@@ -2903,7 +3163,7 @@ async fn try_skip_relock(
         .await?
         .flatten(),
 
-        "flow" | "app" => existing_lock.map(|s| s.to_string()),
+        ("flow" | "app", existing_lock) => existing_lock.map(|s| s.to_string()),
         _ => None,
     };
 

From 0d6bce4a12226adb83fc6050064eb2e80372e36e Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Thu, 3 Sep 2026 23:23:59 +0000
Subject: [PATCH 29/31] keep the SSO group reconciler alive in oauth2-less
 builds (#10969)

* chore: stop denying reads of secret files in claude settings

Any Read() deny rule makes Claude Code resolve the file operands of every
Bash command that reads files. A path it cannot resolve, such as one that
follows a cd into a directory the analyzer does not track, escalates to a
permission prompt even under bypassPermissions. A plain recursive grep in
the repo root escalates too, because it could reach .env.

Drop the read rules and widen the write rules to cover the same files, so
secrets still cannot be written through Edit, Write, or a shell redirect.
Reads of those files are no longer blocked.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RNCupPk2yewQT1JMNjkV8M

* fix: keep the sso group reconciler alive in oauth2-less builds

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01W24T1FjQXQ87AoeC3UxWWC

* chore: update ee-repo-ref to d6297e6844dc2aab4745fce328e32ccab508969f

This commit updates the EE repository reference after PR #777 was merged in windmill-ee-private.

Previous ee-repo-ref: eec88486fb2df0ba15998ef285f52fc67af90b1e

New ee-repo-ref: d6297e6844dc2aab4745fce328e32ccab508969f

Automated by sync-ee-ref workflow.

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
---
 backend/ee-repo-ref.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index 354e88bef1..9e7a10edf0 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-3b89bfc11314a326a191101cfe3ef65f6f7f82a8
+d6297e6844dc2aab4745fce328e32ccab508969f

From fbcb0728f791a4ce016e292d83c6b30e111e93ee Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 4 Sep 2026 08:52:20 +0200
Subject: [PATCH 30/31] fix: a guest app path is refused at the mint if it
 could widen the scope; the instance toggle waits for its reload

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BayTppRCstWX6qTf3LMco5
---
 backend/tests/app_guest_execution_mode.rs     | 42 ++++++++++++++++++-
 backend/windmill-api-users/src/users.rs       | 23 ++++++++--
 backend/windmill-api/openapi.yaml             | 11 ++---
 .../instanceSettings/GuestActivityList.svelte |  7 ++--
 4 files changed, 69 insertions(+), 14 deletions(-)

diff --git a/backend/tests/app_guest_execution_mode.rs b/backend/tests/app_guest_execution_mode.rs
index db1169169d..f3249b48cc 100644
--- a/backend/tests/app_guest_execution_mode.rs
+++ b/backend/tests/app_guest_execution_mode.rs
@@ -454,6 +454,36 @@ async fn guest_cannot_run_another_guest_app(db: Pool<Postgres>) -> anyhow::Resul
     Ok(())
 }
 
+/// The app path is spliced into the session's scopes, whose parser splits resources on
+/// `,` and reads `*` as a wildcard: a path carrying either would scope the guest to more
+/// than the one app it was let in for, so the mint refuses it before anything else.
+#[sqlx::test(fixtures("base"))]
+async fn a_scope_metacharacter_in_the_app_path_is_refused(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    for path in [
+        "u/test-user/entry,u/test-user/hidden",
+        "u/test-user/*",
+        "u/test-user/a b",
+    ] {
+        let mut tx = db.begin().await?;
+        let minted = windmill_api_users::users::create_guest_session_token(
+            "guest@example.com",
+            "test-workspace",
+            path,
+            &mut tx,
+            tower_cookies::Cookies::default(),
+        )
+        .await;
+        assert!(
+            matches!(minted, Err(windmill_common::error::Error::BadRequest(ref m)) if m.contains("cannot be scoped")),
+            "{path}: {minted:?}"
+        );
+    }
+    Ok(())
+}
+
 /// The superadmin switch sits above every workspace's: off, no guest session stands and
 /// no app discovers as open, whatever the workspace and the app say.
 #[sqlx::test(fixtures("base"))]
@@ -494,12 +524,20 @@ async fn the_instance_switch_closes_every_workspace(db: Pool<Postgres>) -> anyho
     let resp = authed(client().get(format!("{ws}/users/whoami")), GUEST_TOKEN)
         .send()
         .await?;
-    assert_eq!(resp.status(), 401, "the instance switch closes an issued session");
+    assert_eq!(
+        resp.status(),
+        401,
+        "the instance switch closes an issued session"
+    );
     let resp = client()
         .get(format!("{ws}/apps_u/guest_entry/{secret}"))
         .send()
         .await?;
-    assert_eq!(resp.status(), 404, "and nothing discovers as open to guests");
+    assert_eq!(
+        resp.status(),
+        404,
+        "and nothing discovers as open to guests"
+    );
 
     set_instance_switch(false).await?.error_for_status()?;
     let resp = authed(client().get(format!("{ws}/users/whoami")), GUEST_TOKEN)
diff --git a/backend/windmill-api-users/src/users.rs b/backend/windmill-api-users/src/users.rs
index c62311c40f..73ea69ce54 100644
--- a/backend/windmill-api-users/src/users.rs
+++ b/backend/windmill-api-users/src/users.rs
@@ -2945,8 +2945,23 @@ lazy_static::lazy_static! {
 ///
 /// The `guest` sentinel here only narrows. What makes the session a guest at all is the
 /// server-minted label ([`windmill_common::auth::GUEST_SESSION_LABEL`]).
-fn guest_session_scopes(app_path: &str) -> Vec<String> {
-    vec![
+pub fn guest_session_scopes(app_path: &str) -> Result<Vec<String>> {
+    // The path is spliced into a scope, whose parser reads `,` as a resource separator
+    // and `*` as a wildcard: a path carrying either would name more than one app.
+    let canonical = app_path.split('/').count() >= 3
+        && app_path.split('/').all(|seg| {
+            !seg.is_empty()
+                && seg
+                    .chars()
+                    .all(|c| c.is_ascii_alphanumeric() || "_-.".contains(c))
+        });
+    if !canonical {
+        return Err(Error::BadRequest(format!(
+            "app path {app_path} cannot be scoped: only letters, digits, `_`, `-` and `.` \
+             in `/`-separated segments"
+        )));
+    }
+    Ok(vec![
         windmill_api_auth::scopes::GUEST_SENTINEL.to_string(),
         "jobs:read".to_string(),
         "resources:run".to_string(),
@@ -2954,7 +2969,7 @@ fn guest_session_scopes(app_path: &str) -> Vec<String> {
         "folders:read".to_string(),
         format!("apps:read:{app_path}"),
         format!("apps:run:{app_path}"),
-    ]
+    ])
 }
 
 /// Mint a browser session for someone the identity provider authenticated who is a
@@ -2988,7 +3003,7 @@ pub async fn create_guest_session_token<'c>(
     } else {
         Some(&token)
     };
-    let scopes = guest_session_scopes(app_path);
+    let scopes = guest_session_scopes(app_path)?;
 
     // No account at all (see `ExecutionMode::Guest`): a deactivated `password` row
     // counts, since the sign-in path's own lookup filters on `disabled = false` and a
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 6aed163961..a2fe3ee19b 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -8901,8 +8901,8 @@ paths:
       description: >-
         The custom-path counterpart of `getGuestEntry`. Unauthenticated; 404 unless
         the app's execution mode is `guest` AND its workspace has
-        `guest_access_enabled`. Returns the workspace too, since a custom URL may not
-        carry it.
+        `guest_access_enabled` AND the instance has not set `guest_access_disabled`.
+        Returns the workspace too, since a custom URL may not carry it.
       operationId: getGuestEntryByCustomPath
       tags:
         - app
@@ -13082,9 +13082,10 @@ paths:
       description: >-
         Unauthenticated: what a signed-out visitor reads to learn that signing in
         would let them in. 404 unless the app's execution mode is `guest` AND the
-        workspace has `guest_access_enabled`, so it says nothing about apps that are
-        not open to guests. Discloses only the app path, to a caller already holding
-        the share secret.
+        workspace has `guest_access_enabled` AND the instance has not set the
+        `guest_access_disabled` global setting, so it says nothing about apps that
+        are not open to guests. Discloses only the app path, to a caller already
+        holding the share secret.
       operationId: getGuestEntry
       tags:
         - app
diff --git a/frontend/src/lib/components/instanceSettings/GuestActivityList.svelte b/frontend/src/lib/components/instanceSettings/GuestActivityList.svelte
index 80655a6a67..000ca4eace 100644
--- a/frontend/src/lib/components/instanceSettings/GuestActivityList.svelte
+++ b/frontend/src/lib/components/instanceSettings/GuestActivityList.svelte
@@ -14,8 +14,9 @@
 		hasMore: boolean
 		loading: boolean
 		onLoadMore: () => void
-		/** The instance switch was written; the caller re-reads usage. */
-		onInstanceSwitch: () => void
+		/** The instance switch was written; the caller re-reads usage and resolves once
+		 * the toggle may show the stored value again. */
+		onInstanceSwitch: () => Promise<void>
 	}
 
 	let { usage, guests, hasMore, loading, onLoadMore, onInstanceSwitch }: Props = $props()
@@ -39,8 +40,8 @@
 		} catch (e) {
 			sendUserToast(`Could not change the instance guest switch: ${e}`, true)
 		}
+		await onInstanceSwitch()
 		switchPending = false
-		onInstanceSwitch()
 	}
 	// A capped instance refuses the next stranger as soon as the allowance is used up.
 	let pastAllowance = $derived(

From 2b4631cedc4c1e5aa7592cdfd37acc87e062e5bd Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 4 Sep 2026 09:07:39 +0200
Subject: [PATCH 31/31] fix: guests stop at the launched-by-me job grant;
 canonical app paths at the mint and discovery; the toggle ends on the stored
 value

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BayTppRCstWX6qTf3LMco5
---
 backend/ee-repo-ref.txt                       |  2 +-
 backend/tests/app_guest_execution_mode.rs     | 51 ++++++++++++++++++-
 backend/windmill-api-users/src/users.rs       | 18 ++-----
 backend/windmill-api/src/jobs.rs              |  6 ++-
 backend/windmill-common/src/workspaces.rs     |  4 ++
 .../components/SuperadminSettingsInner.svelte |  4 +-
 .../instanceSettings/GuestActivityList.svelte | 23 ++++++---
 7 files changed, 82 insertions(+), 26 deletions(-)

diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index d0238e0076..d1fd6020d8 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-7d737d774b03b580999b4994b6a05e53ccddb2a7
\ No newline at end of file
+6bfe1e25001e5de37d51b17108b7b2a335005fd8
\ No newline at end of file
diff --git a/backend/tests/app_guest_execution_mode.rs b/backend/tests/app_guest_execution_mode.rs
index f3249b48cc..e3ddb7a868 100644
--- a/backend/tests/app_guest_execution_mode.rs
+++ b/backend/tests/app_guest_execution_mode.rs
@@ -477,13 +477,62 @@ async fn a_scope_metacharacter_in_the_app_path_is_refused(
         )
         .await;
         assert!(
-            matches!(minted, Err(windmill_common::error::Error::BadRequest(ref m)) if m.contains("cannot be scoped")),
+            matches!(minted, Err(windmill_common::error::Error::BadRequest(ref m)) if m.contains("Invalid path")),
             "{path}: {minted:?}"
         );
     }
     Ok(())
 }
 
+/// A guest reads the jobs it launched and nothing else: with no membership behind it,
+/// it must stop where an app embed token stops, before the share-token and ACL grants
+/// a member would get, and with the same "not found" so it cannot probe for jobs.
+#[sqlx::test(fixtures("base"))]
+async fn a_guest_cannot_read_a_job_it_did_not_launch(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let ws = format!("http://localhost:{port}/api/w/test-workspace");
+
+    enable_guests(port, "test-workspace").await?;
+    insert_guest_token(&db, "test-workspace").await?;
+    let resp = authed(client().post(format!("{ws}/scripts/create")), ADMIN_TOKEN)
+        .json(&json!({
+            "path": "u/test-user/noop",
+            "summary": "",
+            "description": "",
+            "content": "echo 42",
+            "language": "bash",
+        }))
+        .send()
+        .await?;
+    assert_eq!(resp.status(), 201, "{}", resp.text().await?);
+    let resp = authed(
+        client().post(format!("{ws}/jobs/run/p/u/test-user/noop")),
+        ADMIN_TOKEN,
+    )
+    .json(&json!({}))
+    .send()
+    .await?;
+    assert_eq!(resp.status(), 201, "{}", resp.text().await?);
+    let job_id = resp.text().await?;
+
+    let resp = authed(
+        client().get(format!("{ws}/jobs_u/getupdate/{job_id}")),
+        GUEST_TOKEN,
+    )
+    .send()
+    .await?;
+    assert_eq!(
+        resp.status(),
+        404,
+        "another caller's job is not found for a guest: {}",
+        resp.text().await?
+    );
+
+    Ok(())
+}
+
 /// The superadmin switch sits above every workspace's: off, no guest session stands and
 /// no app discovers as open, whatever the workspace and the app say.
 #[sqlx::test(fixtures("base"))]
diff --git a/backend/windmill-api-users/src/users.rs b/backend/windmill-api-users/src/users.rs
index 73ea69ce54..ba565c6376 100644
--- a/backend/windmill-api-users/src/users.rs
+++ b/backend/windmill-api-users/src/users.rs
@@ -2945,22 +2945,10 @@ lazy_static::lazy_static! {
 ///
 /// The `guest` sentinel here only narrows. What makes the session a guest at all is the
 /// server-minted label ([`windmill_common::auth::GUEST_SESSION_LABEL`]).
-pub fn guest_session_scopes(app_path: &str) -> Result<Vec<String>> {
+fn guest_session_scopes(app_path: &str) -> Result<Vec<String>> {
     // The path is spliced into a scope, whose parser reads `,` as a resource separator
-    // and `*` as a wildcard: a path carrying either would name more than one app.
-    let canonical = app_path.split('/').count() >= 3
-        && app_path.split('/').all(|seg| {
-            !seg.is_empty()
-                && seg
-                    .chars()
-                    .all(|c| c.is_ascii_alphanumeric() || "_-.".contains(c))
-        });
-    if !canonical {
-        return Err(Error::BadRequest(format!(
-            "app path {app_path} cannot be scoped: only letters, digits, `_`, `-` and `.` \
-             in `/`-separated segments"
-        )));
-    }
+    // and `*` as a wildcard; a canonical path carries neither.
+    windmill_common::utils::check_proper_path(app_path)?;
     Ok(vec![
         windmill_api_auth::scopes::GUEST_SENTINEL.to_string(),
         "jobs:read".to_string(),
diff --git a/backend/windmill-api/src/jobs.rs b/backend/windmill-api/src/jobs.rs
index 53044ee020..8b1dfe18d6 100644
--- a/backend/windmill-api/src/jobs.rs
+++ b/backend/windmill-api/src/jobs.rs
@@ -1594,7 +1594,11 @@ pub(crate) async fn require_job_read_access(
     // this token, and letting it reach any job merely visible to the viewer would
     // expose unrelated runs' results/logs. Stop at the launched-by-viewer grant.
     // NotFound (not PermissionDenied) so the untrusted app can't probe job existence.
-    if windmill_api_auth::scopes::has_app_embed_sentinel(authed.scopes.as_deref()) {
+    // A guest stops here too: it has no membership behind it, so a share token whose
+    // audience is the workspace's members must not read for it either.
+    if windmill_api_auth::scopes::has_app_embed_sentinel(authed.scopes.as_deref())
+        || windmill_api_auth::scopes::has_guest_sentinel(authed.scopes.as_deref())
+    {
         return Err(Error::NotFound(format!("Job {job_id} not found")));
     }
 
diff --git a/backend/windmill-common/src/workspaces.rs b/backend/windmill-common/src/workspaces.rs
index 4ec545b602..dc535e3d51 100644
--- a/backend/windmill-common/src/workspaces.rs
+++ b/backend/windmill-common/src/workspaces.rs
@@ -933,6 +933,10 @@ pub async fn guest_app_admits<'c, E: sqlx::Executor<'c, Database = sqlx::Postgre
     w_id: &str,
     app_path: &str,
 ) -> Result<bool> {
+    // The mint refuses a path it cannot scope, so discovery must not advertise one.
+    if crate::utils::check_proper_path(app_path).is_err() {
+        return Ok(false);
+    }
     let instance_admits = instance_admits_guests_sql();
     let admits: Option<bool> = sqlx::query_scalar(&format!(
         "SELECT COALESCE(ws.guest_access_enabled AND app.policy->>'execution_mode' = 'guest', false)
diff --git a/frontend/src/lib/components/SuperadminSettingsInner.svelte b/frontend/src/lib/components/SuperadminSettingsInner.svelte
index 51ceed9aba..97b15fe443 100644
--- a/frontend/src/lib/components/SuperadminSettingsInner.svelte
+++ b/frontend/src/lib/components/SuperadminSettingsInner.svelte
@@ -112,7 +112,7 @@
 	let guestLoading = $state(false)
 	const guestPerPage = 50
 
-	async function loadGuestPage(nextPage: number) {
+	async function loadGuestPage(nextPage: number): Promise<boolean> {
 		guestLoading = true
 		try {
 			const res = await UserService.listGuests({ page: nextPage, perPage: guestPerPage })
@@ -121,8 +121,10 @@
 					? res
 					: { usage: res.usage, guests: [...guestList.guests, ...res.guests] }
 			guestHasMore = res.guests.length === guestPerPage
+			return true
 		} catch (e) {
 			sendUserToast(`Failed to load guests: ${e}`, true)
+			return false
 		} finally {
 			guestLoading = false
 		}
diff --git a/frontend/src/lib/components/instanceSettings/GuestActivityList.svelte b/frontend/src/lib/components/instanceSettings/GuestActivityList.svelte
index 000ca4eace..98fb15c4bd 100644
--- a/frontend/src/lib/components/instanceSettings/GuestActivityList.svelte
+++ b/frontend/src/lib/components/instanceSettings/GuestActivityList.svelte
@@ -14,24 +14,30 @@
 		hasMore: boolean
 		loading: boolean
 		onLoadMore: () => void
-		/** The instance switch was written; the caller re-reads usage and resolves once
-		 * the toggle may show the stored value again. */
-		onInstanceSwitch: () => Promise<void>
+		/** The instance switch was written; the caller re-reads usage and says whether
+		 * that read succeeded, so the toggle can show what is actually stored. */
+		onInstanceSwitch: () => Promise<boolean>
 	}
 
 	let { usage, guests, hasMore, loading, onLoadMore, onInstanceSwitch }: Props = $props()
 	const loadMoreSize = 50
-	// One write at a time, and the toggle shows the stored value again after either
-	// outcome: a refused write must not leave it showing the click.
+	// One write at a time, and the toggle always ends on what is stored: the reloaded
+	// value when the reload succeeds, else the write's outcome.
 	let switchPending = $state(false)
+	let switchOn = $state(usage.instance_enabled)
+	$effect(() => {
+		switchOn = usage.instance_enabled
+	})
 
 	async function setInstanceSwitch(enabled: boolean) {
 		switchPending = true
+		let written = false
 		try {
 			await SettingService.setGlobal({
 				key: 'guest_access_disabled',
 				requestBody: { value: !enabled }
 			})
+			written = true
 			sendUserToast(
 				enabled
 					? 'Guests can sign in again where a workspace allows them'
@@ -40,7 +46,10 @@
 		} catch (e) {
 			sendUserToast(`Could not change the instance guest switch: ${e}`, true)
 		}
-		await onInstanceSwitch()
+		const reloaded = await onInstanceSwitch()
+		if (!reloaded) {
+			switchOn = written ? enabled : usage.instance_enabled
+		}
 		switchPending = false
 	}
 	// A capped instance refuses the next stranger as soon as the allowance is used up.
@@ -59,7 +68,7 @@
 <div class="flex flex-row gap-2 items-center mb-4">
 	{#key usage}
 		<Toggle
-			checked={usage.instance_enabled}
+			bind:checked={switchOn}
 			disabled={switchPending}
 			on:change={(e) => setInstanceSwitch(e.detail)}
 			options={{