diff --git a/.claude/settings.json b/.claude/settings.json
index a464ca3719..37aaeeb0f5 100644
--- a/.claude/settings.json
+++ b/.claude/settings.json
@@ -55,22 +55,18 @@
       "mcp__claude_ai_Gmail__list_drafts"
     ],
     "deny": [
-      "Read(.env)",
-      "Read(.env.*)",
-      "Read(**/.env)",
-      "Read(**/.env.*)",
-      "Read(**/secrets/**)",
-      "Read(**/*.pem)",
-      "Read(**/*.key)",
-      "Read(**/credentials.json)",
-      "Read(**/.secret*)",
-      "Read(**/.secrets*)",
-      "Read(**/*.secret)",
-      "Read(**/*.secrets)",
       "Edit(.env)",
       "Edit(.env.*)",
       "Edit(**/.env)",
-      "Edit(**/.env.*)"
+      "Edit(**/.env.*)",
+      "Edit(**/secrets/**)",
+      "Edit(**/*.pem)",
+      "Edit(**/*.key)",
+      "Edit(**/credentials.json)",
+      "Edit(**/.secret*)",
+      "Edit(**/.secrets*)",
+      "Edit(**/*.secret)",
+      "Edit(**/*.secrets)"
     ],
     "ask": [
       "Bash(rmdir:*)",
diff --git a/.github/workflows/backend-test.yml b/.github/workflows/backend-test.yml
index cdd0e2a212..9f65c2ae47 100644
--- a/.github/workflows/backend-test.yml
+++ b/.github/workflows/backend-test.yml
@@ -61,7 +61,7 @@ jobs:
           bun-version: 1.4.0
       - uses: actions/setup-node@v4
         with:
-          node-version: "20"
+          node-version: "24"
       - uses: astral-sh/setup-uv@v6.2.1
         with:
           version: "0.11.24"
diff --git a/.github/workflows/git-sync-test.yml b/.github/workflows/git-sync-test.yml
index ee732569dd..bd15ec8876 100644
--- a/.github/workflows/git-sync-test.yml
+++ b/.github/workflows/git-sync-test.yml
@@ -9,6 +9,7 @@ on:
       - "backend/windmill-api-integration-tests/tests/git_sync*"
       - "backend/ee-repo-ref.txt"
       - "backend/windmill-common/src/workspaces.rs"
+      - "frontend/src/lib/hubPaths.json"
       - "backend/windmill-worker/src/result_processor.rs"
       - "backend/windmill-api-workspaces/**"
       - "cli/src/commands/sync/**"
@@ -22,6 +23,7 @@ on:
       - "backend/windmill-api-integration-tests/tests/git_sync*"
       - "backend/ee-repo-ref.txt"
       - "backend/windmill-common/src/workspaces.rs"
+      - "frontend/src/lib/hubPaths.json"
       - "backend/windmill-worker/src/result_processor.rs"
       - "backend/windmill-api-workspaces/**"
       - "cli/src/commands/sync/**"
@@ -59,7 +61,7 @@ jobs:
           echo "$CHANGED_FILES"
 
           # Direct git sync file changes — always relevant.
-          if echo "$CHANGED_FILES" | grep -qE '^(backend/windmill-git-sync/|backend/windmill-worker/src/result_processor\.rs|backend/windmill-api-workspaces/|backend/windmill-api-integration-tests/tests/git_sync|backend/windmill-common/src/workspaces\.rs|cli/src/commands/sync/|cli/src/utils/git\.ts|integration_tests/test/git_sync|\.github/workflows/git-sync-test\.yml)'; then
+          if echo "$CHANGED_FILES" | grep -qE '^(backend/windmill-git-sync/|backend/windmill-worker/src/result_processor\.rs|backend/windmill-api-workspaces/|backend/windmill-api-integration-tests/tests/git_sync|backend/windmill-common/src/workspaces\.rs|frontend/src/lib/hubPaths\.json|cli/src/commands/sync/|cli/src/utils/git\.ts|integration_tests/test/git_sync|\.github/workflows/git-sync-test\.yml)'; then
             echo "should_run=true" >> "$GITHUB_OUTPUT"
             echo "Relevant: direct git sync file changes"
             exit 0
diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index ab80d05f6b..249f8350ae 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "1.800.1"
+  ".": "1.803.0"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2cc8ecb481..33e24c0c00 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,58 @@
 # Changelog
 
+## [1.803.0](https://github.com/windmill-labs/windmill/compare/v1.802.0...v1.803.0) (2026-09-03)
+
+
+### Features
+
+* expose request headers to scripts invoked via MCP ([#10903](https://github.com/windmill-labs/windmill/issues/10903)) ([e474e88](https://github.com/windmill-labs/windmill/commit/e474e8803ce2ff5c2df09a58dab51d45f5c922ca))
+* reuse an existing workspace resource in the project import wizard ([#10935](https://github.com/windmill-labs/windmill/issues/10935)) ([582761e](https://github.com/windmill-labs/windmill/commit/582761e37c776e92dc1c6ebfee8c4efe7c35d822))
+
+
+### Bug Fixes
+
+* bump git sync hub scripts to cli 1.802.1, test the fork ui pull ([#10955](https://github.com/windmill-labs/windmill/issues/10955)) ([ca88009](https://github.com/windmill-labs/windmill/commit/ca8800959aa6a0017cc29bad187c9f49e0d13cc4))
+* **cli:** make a sync push into a fork converge on schedules and inline names ([#10951](https://github.com/windmill-labs/windmill/issues/10951)) ([0f5a1db](https://github.com/windmill-labs/windmill/commit/0f5a1db2abba8df30a2f975f4498e269f13cf93d))
+* fade the home Build with AI placeholder every 10s instead of typing it ([#10953](https://github.com/windmill-labs/windmill/issues/10953)) ([3d089b5](https://github.com/windmill-labs/windmill/commit/3d089b57344f5814086e6176301c5031dc519674))
+* let operators use wmill.datatable() from within running jobs ([#10931](https://github.com/windmill-labs/windmill/issues/10931)) ([9b64a89](https://github.com/windmill-labs/windmill/commit/9b64a89cd46ae718d6c58fa12f925fa041fb1032))
+
+## [1.802.0](https://github.com/windmill-labs/windmill/compare/v1.801.0...v1.802.0) (2026-09-02)
+
+
+### Features
+
+* add retention cleanup for the otel_traces table ([#10949](https://github.com/windmill-labs/windmill/issues/10949)) ([d472193](https://github.com/windmill-labs/windmill/commit/d472193e5bf5f6428e0096a402eb2c9299634fb2))
+* open path links from chat messages in the session preview panel ([#10881](https://github.com/windmill-labs/windmill/issues/10881)) ([f10ac6c](https://github.com/windmill-labs/windmill/commit/f10ac6c2b3644fb16697e650efbc4f7cd3c6944c))
+* restore owner and label filter chips on the homepage ([#10942](https://github.com/windmill-labs/windmill/issues/10942)) ([ccf8476](https://github.com/windmill-labs/windmill/commit/ccf84761dd664b9228dfe2f65867e8c32cd20c21))
+* **sessions:** offer the item you came from when starting a new session ([#10940](https://github.com/windmill-labs/windmill/issues/10940)) ([d3747d6](https://github.com/windmill-labs/windmill/commit/d3747d62555ebcb09c78cfabcaa3b6177758d6ea))
+* workspace setting to hide the AI assistant, agent steps unaffected ([#10941](https://github.com/windmill-labs/windmill/issues/10941)) ([fdd3b36](https://github.com/windmill-labs/windmill/commit/fdd3b36423344a2e1a464674179406581074e926))
+
+
+### Bug Fixes
+
+* apply object-storage test SSRF validation to all non-super-admins ([#10933](https://github.com/windmill-labs/windmill/issues/10933)) ([4fef119](https://github.com/windmill-labs/windmill/commit/4fef1195adaa9fa036a219884bd6c996460ca37f))
+* connect to dev server instead of localhost ([#10912](https://github.com/windmill-labs/windmill/issues/10912)) ([337154b](https://github.com/windmill-labs/windmill/commit/337154b8304a5969f35216add627b5c1153c0f6c))
+* preselect first row of AI agent and AI sandbox insert panes ([#10937](https://github.com/windmill-labs/windmill/issues/10937)) ([95b6bbd](https://github.com/windmill-labs/windmill/commit/95b6bbd46ada11d96a914ae5b0e92aba4dd02530))
+* record supplied script lock hashes so importers can skip relocking ([#10915](https://github.com/windmill-labs/windmill/issues/10915)) ([17ba521](https://github.com/windmill-labs/windmill/commit/17ba521c352aec65a8270893752bbadd7f3d6eaa))
+* sandbox script-controlled content types in result_to_response ([#10932](https://github.com/windmill-labs/windmill/issues/10932)) ([419741e](https://github.com/windmill-labs/windmill/commit/419741e5d226c67c51429094fb6ded9474afed99))
+
+## [1.801.0](https://github.com/windmill-labs/windmill/compare/v1.800.1...v1.801.0) (2026-09-01)
+
+
+### Features
+
+* **ai-chat:** make reusable skills ai_skill resources you select per workspace ([#10914](https://github.com/windmill-labs/windmill/issues/10914)) ([cfcfe29](https://github.com/windmill-labs/windmill/commit/cfcfe298dd9ab50196bd64926ef78c4563f58c2c))
+* **ai-sessions:** show a running session across tabs and reload finished turns ([#10916](https://github.com/windmill-labs/windmill/issues/10916)) ([816dc9d](https://github.com/windmill-labs/windmill/commit/816dc9dcd2c310e499d2d210a0abcd403469f29c))
+* edit folders and groups in a drawer that saves once ([#10873](https://github.com/windmill-labs/windmill/issues/10873)) ([5d5ad4e](https://github.com/windmill-labs/windmill/commit/5d5ad4e8974e076ef53a26a5584e4209255a2248))
+* make the home Build with AI composer dismissible, quiet the rest of the home page ([#10930](https://github.com/windmill-labs/windmill/issues/10930)) ([772fafe](https://github.com/windmill-labs/windmill/commit/772fafec8316a1e0c0e76b9a0737cc41d40a9a8c))
+
+
+### Bug Fixes
+
+* let a principal without a login account own a draft ([#10925](https://github.com/windmill-labs/windmill/issues/10925)) ([94af8d0](https://github.com/windmill-labs/windmill/commit/94af8d0fb5aceebe83936fd6761c6c1c02c75323))
+* resolve chat path links against the session's operating workspace ([#10924](https://github.com/windmill-labs/windmill/issues/10924)) ([9074de2](https://github.com/windmill-labs/windmill/commit/9074de25ea730ca02653c9a2e2b8b99eda6f3137))
+* tolerate string app_id in GHES app config deserialization ([#10923](https://github.com/windmill-labs/windmill/issues/10923)) ([af8ff38](https://github.com/windmill-labs/windmill/commit/af8ff3868748412cb658c803ebc8a71edc3cd8fb))
+
 ## [1.800.1](https://github.com/windmill-labs/windmill/compare/v1.800.0...v1.800.1) (2026-09-01)
 
 
diff --git a/CONTEXT.md b/CONTEXT.md
index 6efb92b669..64aa1b93d8 100644
--- a/CONTEXT.md
+++ b/CONTEXT.md
@@ -36,3 +36,22 @@ _Avoid_: argument field, param
 **Expression input**:
 Any other place a property can be picked into: the loop iterator, skip and early-stop predicates, the retry condition, a branch predicate, timeout. Its prop picker opens in a popover from the connect button rather than taking a pane.
 _Avoid_: JS field, code input
+
+### Permissions
+
+**Member**:
+A user or group granted a role on a folder, a group, or an item's extra ACL. The list of them is
+"Members (n)" everywhere it is shown, and one is added with "Add member".
+_Avoid_: participant, collaborator, owner, ACL entry, permission (that names the concept, not the people)
+
+**Role**:
+The access level a member holds: viewer, writer or admin on a folder; member or admin on a group.
+Viewers read, writers also edit, admins also manage the members. A group role of **manager** —
+manages the group without belonging to it — is a legacy state the UI shows and can leave, but
+offers no way to enter.
+_Avoid_: permission level, access level, rank
+
+**Owner**:
+Reserved for the path prefix that says where an item lives — `u/alice` or `f/team`. A folder's
+`owners` column in the database is its admin members; call those admins, never owners, in the UI.
+_Avoid_: using "owner" for a folder admin
diff --git a/Dockerfile b/Dockerfile
index 8ecee96725..6a290c3553 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -141,9 +141,9 @@ FROM ${DEBIAN_IMAGE}
 ARG TARGETPLATFORM
 ARG POWERSHELL_VERSION=7.5.0
 ARG KUBECTL_VERSION=1.36.2
-ARG HELM_VERSION=3.21.2
+ARG HELM_VERSION=3.21.4
 # NOTE: If changing, also change go version in workspace dependencies template at WorkspaceDependenciesEditor.svelte
-ARG GO_VERSION=1.26.0
+ARG GO_VERSION=1.26.8
 ARG APP=/usr/src/app
 ARG WITH_POWERSHELL=true
 ARG WITH_KUBECTL=true
@@ -250,8 +250,8 @@ RUN UV_CACHE_DIR=/tmp/build_cache/uv UV_PYTHON_INSTALL_DIR=/tmp/build_cache/py_r
 RUN UV_CACHE_DIR=/tmp/build_cache/uv UV_PYTHON_INSTALL_DIR=/tmp/build_cache/py_runtime uv python install $LATEST_STABLE_PY --compile-bytecode
 
 
-RUN curl -sL https://deb.nodesource.com/setup_20.x | bash -
-RUN apt-get -y update && apt-get install -y curl procps nodejs awscli && apt-get clean \
+RUN curl -sL https://deb.nodesource.com/setup_24.x | bash -
+RUN apt-get -y update && apt-get install -y --no-install-recommends curl procps nodejs awscli && apt-get clean \
     && rm -rf /var/lib/apt/lists/*
 
 # go build is slower the first time it is ran, so we prewarm it in the build
@@ -299,7 +299,7 @@ RUN bun install -g windmill-cli \
 RUN curl -fsSL https://claude.ai/install.sh | bash \
     && cp /root/.local/share/claude/versions/* /usr/bin/claude
 
-COPY --from=php:8.3.30-cli-trixie /usr/local/bin/php /usr/bin/php
+COPY --from=php:8.3.33-cli-trixie /usr/local/bin/php /usr/bin/php
 COPY --from=composer:2.9.5 /usr/bin/composer /usr/bin/composer
 
 # add the docker client to call docker from a worker if enabled
diff --git a/ai_evals/adapters/frontend/mockBackend.ts b/ai_evals/adapters/frontend/mockBackend.ts
index 5c682be5eb..6d80f19197 100644
--- a/ai_evals/adapters/frontend/mockBackend.ts
+++ b/ai_evals/adapters/frontend/mockBackend.ts
@@ -7,6 +7,7 @@ import type {
 	ListableApp,
 	ListableResource,
 	ListableVariable,
+	Resource,
 	Script
 } from '../../../frontend/src/lib/gen'
 import type {
@@ -81,6 +82,15 @@ export interface BenchmarkWorkspaceAiProvider {
 	isDefault?: boolean
 }
 
+/** A plain (non-AI) resource of the benchmark workspace, for cases about referencing a
+ * credential — passing one as a run argument, say. `value` is what `get_resource` returns. */
+export interface BenchmarkWorkspaceResource {
+	path: string
+	resource_type: string
+	value?: Record<string, unknown>
+	description?: string
+}
+
 export interface BenchmarkWorkspaceJob {
 	/** Stable id so a case prompt can reference a specific run (e.g. for get_job_logs). */
 	id?: string
@@ -98,6 +108,7 @@ export interface BenchmarkWorkspaceRunnables {
 	apps?: BenchmarkWorkspaceApp[]
 	variables?: BenchmarkWorkspaceVariable[]
 	aiProviders?: BenchmarkWorkspaceAiProvider[]
+	resources?: BenchmarkWorkspaceResource[]
 	datatables?: BenchmarkDatatableSeed[]
 	jobs?: BenchmarkWorkspaceJob[]
 }
@@ -284,15 +295,71 @@ export function listBenchmarkAiProviderResources(workspace: string): ListableRes
 	}))
 }
 
-/** The value of a seeded AI provider resource. Only the endpoint fields are modelled — a key is
- * never needed, because no eval run calls the provider through this resource. */
+/** Plain seeded resources of a benchmark workspace, shaped like `ResourceService.listResource`
+ * rows. Null when the workspace is not a benchmark one. */
+export function listBenchmarkPlainResources(workspace: string): ListableResource[] | null {
+	const runnables = benchmarkWorkspaceRunnables.get(workspace)
+	if (!runnables) {
+		return null
+	}
+	return (runnables.resources ?? []).map((seed) => ({
+		workspace_id: workspace,
+		path: seed.path,
+		resource_type: seed.resource_type,
+		description: seed.description,
+		value: null,
+		is_oauth: false,
+		is_linked: false,
+		is_refreshed: false,
+		extra_perms: {},
+		edited_at: BENCHMARK_TIMESTAMP
+	}))
+}
+
+/** A seeded resource with its value, as `ResourceService.getResource` returns it. Covers both
+ * seed kinds, so it agrees with `existsResource` and `listResource` — both of those report AI
+ * providers too, and a case that lists resources and then reads one by path would otherwise get
+ * a row it cannot fetch. */
+export function getBenchmarkResource(workspace: string, path: string): Resource | null {
+	const runnables = benchmarkWorkspaceRunnables.get(workspace)
+	const seed = runnables?.resources?.find((entry) => entry.path === path)
+	if (seed) {
+		return {
+			workspace_id: workspace,
+			path: seed.path,
+			resource_type: seed.resource_type,
+			description: seed.description,
+			value: seed.value ?? {},
+			is_oauth: false,
+			extra_perms: {}
+		} as Resource
+	}
+	const provider = runnables?.aiProviders?.find((entry) => entry.path === path)
+	if (!provider) {
+		return null
+	}
+	return {
+		workspace_id: workspace,
+		path: provider.path,
+		resource_type: provider.kind,
+		value: getBenchmarkResourceValue(workspace, path) ?? {},
+		is_oauth: false,
+		extra_perms: {}
+	} as Resource
+}
+
+/** The value of a seeded resource. For an AI provider only the endpoint fields are modelled — a
+ * key is never needed, because no eval run calls the provider through this resource. */
 export function getBenchmarkResourceValue(
 	workspace: string,
 	path: string
 ): Record<string, unknown> | null {
-	const seed = benchmarkWorkspaceRunnables
-		.get(workspace)
-		?.aiProviders?.find((entry) => entry.path === path)
+	const runnables = benchmarkWorkspaceRunnables.get(workspace)
+	const plain = runnables?.resources?.find((entry) => entry.path === path)
+	if (plain) {
+		return plain.value ?? {}
+	}
+	const seed = runnables?.aiProviders?.find((entry) => entry.path === path)
 	if (!seed) {
 		return null
 	}
diff --git a/ai_evals/adapters/frontend/vitestAdapter.test.ts b/ai_evals/adapters/frontend/vitestAdapter.test.ts
index e59ec11ad9..338ed8504c 100644
--- a/ai_evals/adapters/frontend/vitestAdapter.test.ts
+++ b/ai_evals/adapters/frontend/vitestAdapter.test.ts
@@ -70,7 +70,9 @@ vi.mock('$lib/gen', async () => {
 		getBenchmarkResourceValue,
 		getBenchmarkVariableByPath,
 		hasBenchmarkWorkspace,
+		getBenchmarkResource,
 		listBenchmarkAiProviderResources,
+		listBenchmarkPlainResources,
 		listBenchmarkApps,
 		listBenchmarkDatatables,
 		listBenchmarkDrafts,
@@ -359,18 +361,24 @@ vi.mock('$lib/gen', async () => {
 				hasBenchmarkWorkspace(data.workspace)
 					? Boolean(getBenchmarkResourceValue(data.workspace, data.path))
 					: actual.ResourceService.existsResource(data),
-			// Only AI provider resources are modelled: they are what an AI agent step references.
 			listResource: async (data: { workspace: string; resourceType?: string }) => {
 				if (!hasBenchmarkWorkspace(data.workspace)) {
 					return actual.ResourceService.listResource(data)
 				}
-				const seeded = listBenchmarkAiProviderResources(data.workspace) ?? []
+				const seeded = [
+					...(listBenchmarkAiProviderResources(data.workspace) ?? []),
+					...(listBenchmarkPlainResources(data.workspace) ?? [])
+				]
 				const wanted = data.resourceType?.split(',')
 				return wanted ? seeded.filter((r) => wanted.includes(r.resource_type)) : seeded
 			},
 			getResource: async (data: { workspace: string; path: string }) => {
 				if (hasBenchmarkWorkspace(data.workspace)) {
-					throw new Error(`Resource "${data.path}" not found in benchmark workspace`)
+					const resource = getBenchmarkResource(data.workspace, data.path)
+					if (!resource) {
+						throw new Error(`Resource "${data.path}" not found in benchmark workspace`)
+					}
+					return resource
 				}
 				return actual.ResourceService.getResource(data)
 			},
diff --git a/ai_evals/cases/global.yaml b/ai_evals/cases/global.yaml
index 21f80bef7e..94ecb5c029 100644
--- a/ai_evals/cases/global.yaml
+++ b/ai_evals/cases/global.yaml
@@ -2365,3 +2365,37 @@
     - the step uses the workspace's anthropic resource f/evals/global/anthropic_main
     - the model is the Opus one the user asked for, taken from the models that resource serves
     - the diff flow input reaches the agent
+
+# The failure this pins: passing a resource as `{"$res": "<path>"}` (or as a bare path), which
+# reaches the script unresolved because the backend only substitutes a string value that itself
+# starts with `$res:`. The mock preview echoes args back and reports success, so nothing in the
+# loop corrects a wrong shape — the arg form is the whole test.
+- id: global-run-arg-resource-reference
+  prompt: |-
+    Run `f/evals/global/github_repo_stats` against the `windmill-labs/windmill` repo, passing our
+    GitHub credentials at `f/evals/global/github_main` as its `gh_auth` input, and tell me whether
+    it went through.
+  initial: ai_evals/fixtures/frontend/global/initial/github_repo_stats_script.json
+  runtime:
+    maxTurns: 10
+  validate:
+    draftCountExactly: 0
+  toolExpect:
+    requiredToolsUsed:
+      - test_run_script
+    forbiddenToolsUsed:
+      - write_script
+      - deploy_workspace_item
+    toolCallArgs:
+      # Exact: the mock never resolves the reference, so a near-miss path like
+      # `$res:f/evals/global/github_main_backup` would otherwise pass.
+      - tool: test_run_script
+        field: args.gh_auth
+        stringEqualsAnyOf:
+          - "$res:f/evals/global/github_main"
+  # The judge only sees drafts, and this case makes none — the deliverable is the shape of the
+  # run argument, checked deterministically above.
+  skipJudge: true
+  judgeChecklist:
+    - runs the existing script rather than rewriting it
+    - passes the GitHub resource as the bare string $res:f/evals/global/github_main
diff --git a/ai_evals/core/types.ts b/ai_evals/core/types.ts
index c9a4f7830e..4107dc53da 100644
--- a/ai_evals/core/types.ts
+++ b/ai_evals/core/types.ts
@@ -160,6 +160,13 @@ export interface ToolCallArgumentRule {
   field: string;
   stringStartsWithAnyOf?: string[];
   stringMustNotStartWithAnyOf?: string[];
+  /**
+   * Universal over calls: every recorded call to `tool` must carry `field` as
+   * exactly one of these strings. Use when a near-miss would still satisfy a
+   * prefix — a resource reference like `$res:f/a/b` shares its prefix with the
+   * wrong `$res:f/a/b_backup`, and the mock never resolves it to catch that.
+   */
+  stringEqualsAnyOf?: string[];
   /**
    * Case-insensitive "contains", existential over calls: at least one recorded
    * call to `tool` must have `field` containing one of these substrings. Other
diff --git a/ai_evals/core/validators.test.ts b/ai_evals/core/validators.test.ts
index 9b606c1c85..4b7891f67e 100644
--- a/ai_evals/core/validators.test.ts
+++ b/ai_evals/core/validators.test.ts
@@ -228,6 +228,43 @@ describe("validateToolExpectations", () => {
     });
   });
 
+  // A resource reference shares its prefix with a wrong sibling path, and the mock
+  // never resolves it, so only exact matching separates the two.
+  it("rejects a resource reference whose path merely shares the prefix", () => {
+    const checks = validateToolExpectations({
+      run: {
+        success: true,
+        actual: {},
+        assistantMessageCount: 1,
+        toolCallCount: 1,
+        toolsUsed: ["test_run_script"],
+        toolCallDetails: [
+          {
+            name: "test_run_script",
+            arguments: { args: { gh_auth: "$res:f/evals/global/github_main_backup" } },
+          },
+        ],
+        skillsInvoked: [],
+      },
+      toolExpect: {
+        toolCallArgs: [
+          {
+            tool: "test_run_script",
+            field: "args.gh_auth",
+            stringEqualsAnyOf: ["$res:f/evals/global/github_main"],
+          },
+        ],
+      },
+    });
+
+    expect(checks).toContainEqual({
+      name: "test_run_script.args.gh_auth matches an accepted value",
+      passed: false,
+      details:
+        'accepted values: $res:f/evals/global/github_main; values: "$res:f/evals/global/github_main_backup"',
+    });
+  });
+
   // The whole point of the same-call rule: the per-field rules are existential over
   // calls, so two single-filter pages would satisfy them while never opening the
   // combined view the case asks for.
diff --git a/ai_evals/core/validators.ts b/ai_evals/core/validators.ts
index 7150dab0c3..132a9ff3d0 100644
--- a/ai_evals/core/validators.ts
+++ b/ai_evals/core/validators.ts
@@ -278,6 +278,20 @@ export function validateToolExpectations(input: {
       );
     }
 
+    if (rule.stringEqualsAnyOf && rule.stringEqualsAnyOf.length > 0) {
+      const invalidValues = values.filter(
+        (value) =>
+          typeof value !== "string" || !rule.stringEqualsAnyOf!.includes(value)
+      );
+      checks.push(
+        check(
+          `${rule.tool}.${rule.field} matches an accepted value`,
+          invalidValues.length === 0,
+          `accepted values: ${rule.stringEqualsAnyOf.join(", ")}; values: ${summarizeToolValues(values)}`
+        )
+      );
+    }
+
     if (rule.stringMustNotStartWithAnyOf && rule.stringMustNotStartWithAnyOf.length > 0) {
       const invalidValues = values.filter(
         (value) =>
diff --git a/ai_evals/fixtures/frontend/global/initial/github_repo_stats_script.json b/ai_evals/fixtures/frontend/global/initial/github_repo_stats_script.json
new file mode 100644
index 0000000000..80e1b960c5
--- /dev/null
+++ b/ai_evals/fixtures/frontend/global/initial/github_repo_stats_script.json
@@ -0,0 +1,37 @@
+{
+  "workspace": {
+    "resources": [
+      {
+        "path": "f/evals/global/github_main",
+        "resource_type": "github",
+        "description": "GitHub credentials",
+        "value": { "token": "$var:f/evals/global/github_token" }
+      }
+    ],
+    "scripts": [
+      {
+        "path": "f/evals/global/github_repo_stats",
+        "summary": "Count open issues on a GitHub repository",
+        "description": "Reads the open issue count for a repository using GitHub credentials.",
+        "language": "bun",
+        "schema": {
+          "$schema": "https://json-schema.org/draft/2020-12/schema",
+          "type": "object",
+          "properties": {
+            "gh_auth": {
+              "type": "object",
+              "format": "resource-github",
+              "description": "GitHub credentials"
+            },
+            "repo": {
+              "type": "string",
+              "description": "Repository in owner/name form"
+            }
+          },
+          "required": ["gh_auth", "repo"]
+        },
+        "content": "type Github = { token: string }\n\nexport async function main(gh_auth: Github, repo: string) {\n  const res = await fetch(`https://api.github.com/repos/${repo}/issues?state=open`, {\n    headers: { Authorization: `Bearer ${gh_auth.token}` }\n  })\n  const issues = await res.json()\n  return { repo, open_issues: issues.length }\n}\n"
+      }
+    ]
+  }
+}
diff --git a/backend/.sqlx/query-032b51ce97c2f31dc2aea8ddf64e6971818ea3b19b4d4866d16e1bf9f7f2ec6f.json b/backend/.sqlx/query-032b51ce97c2f31dc2aea8ddf64e6971818ea3b19b4d4866d16e1bf9f7f2ec6f.json
new file mode 100644
index 0000000000..304efc22d2
--- /dev/null
+++ b/backend/.sqlx/query-032b51ce97c2f31dc2aea8ddf64e6971818ea3b19b4d4866d16e1bf9f7f2ec6f.json
@@ -0,0 +1,65 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT COALESCE(u.username, p.username, CASE WHEN p.email IS NOT NULL THEN d.email END) as \"username?\",\n                  d.created_at as \"draft_saved_at!\"\n           FROM draft d\n           LEFT JOIN usr u\n                  ON u.workspace_id = d.workspace_id\n                 AND u.email = d.email\n           LEFT JOIN password p\n                  ON p.email = d.email\n                 AND p.super_admin = true\n           WHERE d.workspace_id = $1\n             AND d.path = $2\n             AND d.typ = $3\n             AND (d.email IS NULL OR d.email <> $4)\n             AND (d.email IS NULL OR u.username IS NOT NULL OR p.email IS NOT NULL)\n           ORDER BY d.email NULLS LAST",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "username?",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "draft_saved_at!",
+        "type_info": "Timestamptz"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        {
+          "Custom": {
+            "name": "draft_kind",
+            "kind": {
+              "Enum": [
+                "script",
+                "flow",
+                "app",
+                "raw_app",
+                "resource",
+                "variable",
+                "trigger_schedule",
+                "trigger_webhook",
+                "trigger_default_email",
+                "trigger_email",
+                "trigger_http",
+                "trigger_websocket",
+                "trigger_postgres",
+                "trigger_kafka",
+                "trigger_nats",
+                "trigger_mqtt",
+                "trigger_sqs",
+                "trigger_gcp",
+                "trigger_azure",
+                "trigger_poll",
+                "trigger_cli",
+                "trigger_nextcloud",
+                "trigger_google",
+                "trigger_github",
+                "data_pipeline",
+                "trigger_amqp"
+              ]
+            }
+          }
+        },
+        "Text"
+      ]
+    },
+    "nullable": [
+      null,
+      false
+    ]
+  },
+  "hash": "032b51ce97c2f31dc2aea8ddf64e6971818ea3b19b4d4866d16e1bf9f7f2ec6f"
+}
diff --git a/backend/.sqlx/query-0a02678e3f062c8854226d6d5eb7e493c229d205048eeac78a7cbe328c689b88.json b/backend/.sqlx/query-0a02678e3f062c8854226d6d5eb7e493c229d205048eeac78a7cbe328c689b88.json
new file mode 100644
index 0000000000..8275796e90
--- /dev/null
+++ b/backend/.sqlx/query-0a02678e3f062c8854226d6d5eb7e493c229d205048eeac78a7cbe328c689b88.json
@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO draft(workspace_id, path, typ, value, email) VALUES\n            ('test-workspace', 'u/ext/s', 'script', '{}'::json, 'ext-jwt@windmill.dev'),\n            ('test-workspace', 'u/two/s', 'script', '{\"summary\": \"moving\"}'::json, 'test2@windmill.dev'),\n            ('test-workspace', 'u/two/s', 'script', '{\"summary\": \"displaced\"}'::json, 'renamed@windmill.dev'),\n            ('test-workspace', 'u/three/s', 'script', '{}'::json, 'test3@windmill.dev')",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "0a02678e3f062c8854226d6d5eb7e493c229d205048eeac78a7cbe328c689b88"
+}
diff --git a/backend/.sqlx/query-1572b7348a05b7e357031f8d44b5bbee155569488352c10b334ce57d83ce1c0a.json b/backend/.sqlx/query-1572b7348a05b7e357031f8d44b5bbee155569488352c10b334ce57d83ce1c0a.json
new file mode 100644
index 0000000000..03f11ef137
--- /dev/null
+++ b/backend/.sqlx/query-1572b7348a05b7e357031f8d44b5bbee155569488352c10b334ce57d83ce1c0a.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT lockfile_hash FROM lock_hash WHERE workspace_id = $1 AND path = $2",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "lockfile_hash",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "1572b7348a05b7e357031f8d44b5bbee155569488352c10b334ce57d83ce1c0a"
+}
diff --git a/backend/.sqlx/query-16b174aaa944fd94458ce3108f0fec23514ae0419f77b632064b75473b5636c3.json b/backend/.sqlx/query-16b174aaa944fd94458ce3108f0fec23514ae0419f77b632064b75473b5636c3.json
new file mode 100644
index 0000000000..693d84173a
--- /dev/null
+++ b/backend/.sqlx/query-16b174aaa944fd94458ce3108f0fec23514ae0419f77b632064b75473b5636c3.json
@@ -0,0 +1,20 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT trace_id FROM otel_traces ORDER BY trace_id",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "trace_id",
+        "type_info": "Bytea"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "16b174aaa944fd94458ce3108f0fec23514ae0419f77b632064b75473b5636c3"
+}
diff --git a/backend/.sqlx/query-188d024a53b2ef37442412824f73ab5cd81242501d9e7a476698ea7acccd4aef.json b/backend/.sqlx/query-188d024a53b2ef37442412824f73ab5cd81242501d9e7a476698ea7acccd4aef.json
new file mode 100644
index 0000000000..73d5000f2d
--- /dev/null
+++ b/backend/.sqlx/query-188d024a53b2ef37442412824f73ab5cd81242501d9e7a476698ea7acccd4aef.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM draft dest\n         WHERE dest.email = $1\n           AND EXISTS (SELECT 1 FROM draft src\n                       WHERE src.email = $2\n                         AND src.workspace_id = dest.workspace_id\n                         AND src.path = dest.path\n                         AND src.typ = dest.typ)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "188d024a53b2ef37442412824f73ab5cd81242501d9e7a476698ea7acccd4aef"
+}
diff --git a/backend/.sqlx/query-1b244f65ee6a2607ebc1c333d4359fbbf8be5a81276a3050a42770e4a5b5aa5e.json b/backend/.sqlx/query-1b244f65ee6a2607ebc1c333d4359fbbf8be5a81276a3050a42770e4a5b5aa5e.json
new file mode 100644
index 0000000000..f35dbc23e4
--- /dev/null
+++ b/backend/.sqlx/query-1b244f65ee6a2607ebc1c333d4359fbbf8be5a81276a3050a42770e4a5b5aa5e.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM otel_traces WHERE ctid IN (\n                 SELECT ctid FROM otel_traces\n                 WHERE start_time_unix_nano < EXTRACT(\n                     EPOCH FROM now() - ($1::bigint::text || ' s')::interval\n                 )::bigint * 1000000000\n                 LIMIT $2\n             )",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Int8",
+        "Int8"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "1b244f65ee6a2607ebc1c333d4359fbbf8be5a81276a3050a42770e4a5b5aa5e"
+}
diff --git a/backend/.sqlx/query-43ea7d0cf7f3c50ec1e79b4d2384d49b6c65bc442263f228912a24c1c5740cc8.json b/backend/.sqlx/query-43ea7d0cf7f3c50ec1e79b4d2384d49b6c65bc442263f228912a24c1c5740cc8.json
new file mode 100644
index 0000000000..f7c39c21fc
--- /dev/null
+++ b/backend/.sqlx/query-43ea7d0cf7f3c50ec1e79b4d2384d49b6c65bc442263f228912a24c1c5740cc8.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE draft SET email = $1 WHERE email = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "43ea7d0cf7f3c50ec1e79b4d2384d49b6c65bc442263f228912a24c1c5740cc8"
+}
diff --git a/backend/.sqlx/query-49b18e987e2dfa3c7ab915757ff3b9c0e6e371136b565f9b0f5a3393ef8d8d57.json b/backend/.sqlx/query-49b18e987e2dfa3c7ab915757ff3b9c0e6e371136b565f9b0f5a3393ef8d8d57.json
deleted file mode 100644
index 8d86ff3db6..0000000000
--- a/backend/.sqlx/query-49b18e987e2dfa3c7ab915757ff3b9c0e6e371136b565f9b0f5a3393ef8d8d57.json
+++ /dev/null
@@ -1,19 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "WITH update_lock AS (\n                    UPDATE script SET lock = $1, modules = COALESCE($6, modules) WHERE hash = $2 AND workspace_id = $3\n                )\n                INSERT INTO lock_hash (workspace_id, path, lockfile_hash)\n                VALUES ($3, $4, $5)\n                ON CONFLICT (workspace_id, path) DO UPDATE SET lockfile_hash = $5",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Int8",
-        "Text",
-        "Varchar",
-        "Int8",
-        "Jsonb"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "49b18e987e2dfa3c7ab915757ff3b9c0e6e371136b565f9b0f5a3393ef8d8d57"
-}
diff --git a/backend/.sqlx/query-4bc43a5e1c95cb8989962aeb1393a50df05437a2f1909ad5d303e2c2b89a0668.json b/backend/.sqlx/query-4bc43a5e1c95cb8989962aeb1393a50df05437a2f1909ad5d303e2c2b89a0668.json
new file mode 100644
index 0000000000..681206a381
--- /dev/null
+++ b/backend/.sqlx/query-4bc43a5e1c95cb8989962aeb1393a50df05437a2f1909ad5d303e2c2b89a0668.json
@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM draft WHERE email = $1",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "4bc43a5e1c95cb8989962aeb1393a50df05437a2f1909ad5d303e2c2b89a0668"
+}
diff --git a/backend/.sqlx/query-62ed1fe52bc2c22d199101309cbbadb9842318c4c7a1d2526ac567ce41b7fbdc.json b/backend/.sqlx/query-62ed1fe52bc2c22d199101309cbbadb9842318c4c7a1d2526ac567ce41b7fbdc.json
new file mode 100644
index 0000000000..67b672228f
--- /dev/null
+++ b/backend/.sqlx/query-62ed1fe52bc2c22d199101309cbbadb9842318c4c7a1d2526ac567ce41b7fbdc.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO otel_traces (trace_id, span_id, name, kind, start_time_unix_nano, end_time_unix_nano)\n             VALUES ($1, $2, 'GET /', 3, $3, $3)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Bytea",
+        "Bytea",
+        "Int8"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "62ed1fe52bc2c22d199101309cbbadb9842318c4c7a1d2526ac567ce41b7fbdc"
+}
diff --git a/backend/.sqlx/query-8da59f1ace46dc9830cb0fc5a640df68f552e38d4b587839e0e41285a2d55455.json b/backend/.sqlx/query-8da59f1ace46dc9830cb0fc5a640df68f552e38d4b587839e0e41285a2d55455.json
new file mode 100644
index 0000000000..610030cffc
--- /dev/null
+++ b/backend/.sqlx/query-8da59f1ace46dc9830cb0fc5a640df68f552e38d4b587839e0e41285a2d55455.json
@@ -0,0 +1,28 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT DISTINCT ON (path) path, lock FROM script\n             WHERE workspace_id = $1 AND NOT archived AND NOT deleted AND lock IS NOT NULL\n             ORDER BY path, created_at DESC",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "path",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "lock",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      true
+    ]
+  },
+  "hash": "8da59f1ace46dc9830cb0fc5a640df68f552e38d4b587839e0e41285a2d55455"
+}
diff --git a/backend/.sqlx/query-96aa1db2859c80d37ffecc2885442ae6d6d4b6731c3f62e7b85ae7a4f1b666a7.json b/backend/.sqlx/query-96aa1db2859c80d37ffecc2885442ae6d6d4b6731c3f62e7b85ae7a4f1b666a7.json
deleted file mode 100644
index 733478e0e9..0000000000
--- a/backend/.sqlx/query-96aa1db2859c80d37ffecc2885442ae6d6d4b6731c3f62e7b85ae7a4f1b666a7.json
+++ /dev/null
@@ -1,16 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n    INSERT INTO script\n    (workspace_id, hash, path, parent_hashes, summary, description, content, created_by, schema, is_template, extra_perms, lock, language, kind, tag, envs, concurrent_limit, concurrency_time_window_s, cache_ttl, cache_ignore_s3_path, dedicated_worker, ws_error_handler_muted, priority, restart_unless_cancelled, delete_after_use, delete_after_secs, timeout, concurrency_key, visible_to_runner_only, auto_kind, codebase, has_preprocessor, on_behalf_of, on_behalf_of_email, schema_validation, assets, debounce_key, debounce_delay_s, runnable_settings_handle, modules, labels)\n\n    SELECT  workspace_id, $1, path, array_prepend($2::bigint, COALESCE(parent_hashes, '{}'::bigint[])), summary, description, content, created_by, schema, is_template, extra_perms, NULL, language, kind, tag, envs, concurrent_limit, concurrency_time_window_s, cache_ttl, cache_ignore_s3_path, dedicated_worker, ws_error_handler_muted, priority, restart_unless_cancelled, delete_after_use, delete_after_secs, timeout, concurrency_key, visible_to_runner_only, auto_kind, codebase, has_preprocessor, on_behalf_of, on_behalf_of_email, schema_validation, assets, debounce_key, debounce_delay_s, runnable_settings_handle, modules, labels\n\n    FROM script WHERE hash = $2 AND workspace_id = $3;\n            ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Int8",
-        "Int8",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "96aa1db2859c80d37ffecc2885442ae6d6d4b6731c3f62e7b85ae7a4f1b666a7"
-}
diff --git a/backend/.sqlx/query-97691b88d43442e1f1984562372590428895b2bab67687c12efefe0b0d48881e.json b/backend/.sqlx/query-97691b88d43442e1f1984562372590428895b2bab67687c12efefe0b0d48881e.json
new file mode 100644
index 0000000000..c7db67f4d6
--- /dev/null
+++ b/backend/.sqlx/query-97691b88d43442e1f1984562372590428895b2bab67687c12efefe0b0d48881e.json
@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO draft(workspace_id, path, typ, value, email) VALUES\n            ('test-workspace', 'u/ext/s', 'script', '{}'::json, 'ext-jwt@windmill.dev'),\n            ('test-workspace', 'u/two/s', 'script', '{}'::json, 'test2@windmill.dev'),\n            ('test-workspace', 'u/three/s', 'script', '{}'::json, 'test3@windmill.dev')",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "97691b88d43442e1f1984562372590428895b2bab67687c12efefe0b0d48881e"
+}
diff --git a/backend/.sqlx/query-9e503b65fe8bb1509f0d486829ce13ec9d93bb94192ddd85c3dacb9ff16cd032.json b/backend/.sqlx/query-9e503b65fe8bb1509f0d486829ce13ec9d93bb94192ddd85c3dacb9ff16cd032.json
new file mode 100644
index 0000000000..0a0f8b4732
--- /dev/null
+++ b/backend/.sqlx/query-9e503b65fe8bb1509f0d486829ce13ec9d93bb94192ddd85c3dacb9ff16cd032.json
@@ -0,0 +1,26 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT email, value->>'summary' AS summary FROM draft WHERE path = 'u/two/s'",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "email",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "summary",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      true,
+      null
+    ]
+  },
+  "hash": "9e503b65fe8bb1509f0d486829ce13ec9d93bb94192ddd85c3dacb9ff16cd032"
+}
diff --git a/backend/.sqlx/query-a0ec5048ddb7640b4407013ed45b7a545959c209c550e48bf108734f293e18e4.json b/backend/.sqlx/query-a0ec5048ddb7640b4407013ed45b7a545959c209c550e48bf108734f293e18e4.json
new file mode 100644
index 0000000000..f4c4fd31de
--- /dev/null
+++ b/backend/.sqlx/query-a0ec5048ddb7640b4407013ed45b7a545959c209c550e48bf108734f293e18e4.json
@@ -0,0 +1,19 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "WITH update_lock AS (\n                        UPDATE script SET lock = $1, modules = COALESCE($6, modules) WHERE hash = $2 AND workspace_id = $3\n                    )\n                    INSERT INTO lock_hash (workspace_id, path, lockfile_hash)\n                    VALUES ($3, $4, $5)\n                    ON CONFLICT (workspace_id, path) DO UPDATE SET lockfile_hash = $5",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Int8",
+        "Text",
+        "Varchar",
+        "Int8",
+        "Jsonb"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "a0ec5048ddb7640b4407013ed45b7a545959c209c550e48bf108734f293e18e4"
+}
diff --git a/backend/.sqlx/query-abdf62ef0e4eeb8c3213d2e8837e7032f710fe20dd272b7840c9bfbdb92554db.json b/backend/.sqlx/query-abdf62ef0e4eeb8c3213d2e8837e7032f710fe20dd272b7840c9bfbdb92554db.json
new file mode 100644
index 0000000000..c3ef22f973
--- /dev/null
+++ b/backend/.sqlx/query-abdf62ef0e4eeb8c3213d2e8837e7032f710fe20dd272b7840c9bfbdb92554db.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT COUNT(*) FROM script WHERE workspace_id = $1 AND path = $2",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "count",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "abdf62ef0e4eeb8c3213d2e8837e7032f710fe20dd272b7840c9bfbdb92554db"
+}
diff --git a/backend/.sqlx/query-cc507843e00c83a42cc4a463999656ce9a8b0499d6b9282a3ecfae3164b17c2a.json b/backend/.sqlx/query-cc507843e00c83a42cc4a463999656ce9a8b0499d6b9282a3ecfae3164b17c2a.json
new file mode 100644
index 0000000000..19dc4781a6
--- /dev/null
+++ b/backend/.sqlx/query-cc507843e00c83a42cc4a463999656ce9a8b0499d6b9282a3ecfae3164b17c2a.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO lock_hash (workspace_id, path, lockfile_hash)\n         SELECT $1, * FROM UNNEST($2::text[], $3::bigint[])\n         ON CONFLICT (workspace_id, path) DO UPDATE SET lockfile_hash = EXCLUDED.lockfile_hash\n         WHERE lock_hash.lockfile_hash IS DISTINCT FROM EXCLUDED.lockfile_hash",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "TextArray",
+        "Int8Array"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "cc507843e00c83a42cc4a463999656ce9a8b0499d6b9282a3ecfae3164b17c2a"
+}
diff --git a/backend/.sqlx/query-f0070b36f7c4fc84dc9c23bb6c73d8ba80993a28b2c2e5df70968acf6d7cebe4.json b/backend/.sqlx/query-cfdd5ac1dfc7276fc37d49ddfe1b8880eaafb2d3fe71d75b676f1719e26f660f.json
similarity index 72%
rename from backend/.sqlx/query-f0070b36f7c4fc84dc9c23bb6c73d8ba80993a28b2c2e5df70968acf6d7cebe4.json
rename to backend/.sqlx/query-cfdd5ac1dfc7276fc37d49ddfe1b8880eaafb2d3fe71d75b676f1719e26f660f.json
index b31e532fc2..2947dd8413 100644
--- a/backend/.sqlx/query-f0070b36f7c4fc84dc9c23bb6c73d8ba80993a28b2c2e5df70968acf6d7cebe4.json
+++ b/backend/.sqlx/query-cfdd5ac1dfc7276fc37d49ddfe1b8880eaafb2d3fe71d75b676f1719e26f660f.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "VACUUM v2_job, v2_job_completed, job_result_stream_v2, job_stats, job_logs, job_perms, concurrency_key, log_file, metrics",
+  "query": "VACUUM v2_job, v2_job_completed, job_result_stream_v2, job_stats, job_logs, job_perms, concurrency_key, log_file, metrics, otel_traces",
   "describe": {
     "columns": [],
     "parameters": {
@@ -8,5 +8,5 @@
     },
     "nullable": []
   },
-  "hash": "f0070b36f7c4fc84dc9c23bb6c73d8ba80993a28b2c2e5df70968acf6d7cebe4"
+  "hash": "cfdd5ac1dfc7276fc37d49ddfe1b8880eaafb2d3fe71d75b676f1719e26f660f"
 }
diff --git a/backend/.sqlx/query-dd15827cbac128ec53cf03fa305e4cad34e540a2cc09c92e262491145a0de05a.json b/backend/.sqlx/query-dd15827cbac128ec53cf03fa305e4cad34e540a2cc09c92e262491145a0de05a.json
new file mode 100644
index 0000000000..eba1b0da99
--- /dev/null
+++ b/backend/.sqlx/query-dd15827cbac128ec53cf03fa305e4cad34e540a2cc09c92e262491145a0de05a.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM lock_hash WHERE workspace_id = $1 AND path = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "dd15827cbac128ec53cf03fa305e4cad34e540a2cc09c92e262491145a0de05a"
+}
diff --git a/backend/.sqlx/query-e3c4922e315b75951b5ea07cdfca4cfb32747b52dc62c9e3eccacf9c69e29b3a.json b/backend/.sqlx/query-e3c4922e315b75951b5ea07cdfca4cfb32747b52dc62c9e3eccacf9c69e29b3a.json
new file mode 100644
index 0000000000..fc42c451f8
--- /dev/null
+++ b/backend/.sqlx/query-e3c4922e315b75951b5ea07cdfca4cfb32747b52dc62c9e3eccacf9c69e29b3a.json
@@ -0,0 +1,20 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT email FROM draft WHERE path = 'u/two/s'",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "email",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      true
+    ]
+  },
+  "hash": "e3c4922e315b75951b5ea07cdfca4cfb32747b52dc62c9e3eccacf9c69e29b3a"
+}
diff --git a/backend/.sqlx/query-ede523c0b0027f7bc1dacd3a5448031783fa7fbbbf86a291b6f8f8f875d45637.json b/backend/.sqlx/query-ede523c0b0027f7bc1dacd3a5448031783fa7fbbbf86a291b6f8f8f875d45637.json
new file mode 100644
index 0000000000..bea6be2a7f
--- /dev/null
+++ b/backend/.sqlx/query-ede523c0b0027f7bc1dacd3a5448031783fa7fbbbf86a291b6f8f8f875d45637.json
@@ -0,0 +1,19 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n    INSERT INTO script\n    (workspace_id, hash, path, parent_hashes, summary, description, content, created_by, schema, is_template, extra_perms, lock, language, kind, tag, envs, concurrent_limit, concurrency_time_window_s, cache_ttl, cache_ignore_s3_path, dedicated_worker, ws_error_handler_muted, priority, restart_unless_cancelled, delete_after_use, delete_after_secs, timeout, concurrency_key, visible_to_runner_only, auto_kind, codebase, has_preprocessor, on_behalf_of, on_behalf_of_email, schema_validation, assets, debounce_key, debounce_delay_s, runnable_settings_handle, modules, labels, lock_error_logs, created_at)\n\n    SELECT  workspace_id, $1, path, array_prepend($2::bigint, COALESCE(parent_hashes, '{}'::bigint[])), summary, description, content, created_by, schema, is_template, extra_perms, $4::text, language, kind, tag, envs, concurrent_limit, concurrency_time_window_s, cache_ttl, cache_ignore_s3_path, dedicated_worker, ws_error_handler_muted, priority, restart_unless_cancelled, delete_after_use, delete_after_secs, timeout, concurrency_key, visible_to_runner_only, auto_kind, codebase, has_preprocessor, on_behalf_of, on_behalf_of_email, schema_validation, assets, debounce_key, debounce_delay_s, runnable_settings_handle, COALESCE($5::jsonb, modules), labels, $6::text, clock_timestamp()\n\n    FROM script WHERE hash = $2 AND workspace_id = $3;\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Int8",
+        "Int8",
+        "Text",
+        "Text",
+        "Jsonb",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "ede523c0b0027f7bc1dacd3a5448031783fa7fbbbf86a291b6f8f8f875d45637"
+}
diff --git a/backend/.sqlx/query-f496f06f117f5c91104fc759df35b883070da938dea7c7975332afb876cc4691.json b/backend/.sqlx/query-f496f06f117f5c91104fc759df35b883070da938dea7c7975332afb876cc4691.json
new file mode 100644
index 0000000000..24f957a4e2
--- /dev/null
+++ b/backend/.sqlx/query-f496f06f117f5c91104fc759df35b883070da938dea7c7975332afb876cc4691.json
@@ -0,0 +1,20 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT path FROM draft ORDER BY path",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "path",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "f496f06f117f5c91104fc759df35b883070da938dea7c7975332afb876cc4691"
+}
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index c79abcb78e..d314168b35 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -970,9 +970,9 @@ dependencies = [
 
 [[package]]
 name = "aws-lc-rs"
-version = "1.18.0"
+version = "1.18.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce2b2dcc879c3bae0d371e77c99f2238400ef24ec001394befa67b6e543add9e"
+checksum = "b281d307588d634de920874890732659e2e7672f72b5e10e81badc1a8a83621e"
 dependencies = [
  "aws-lc-sys",
  "untrusted 0.7.1",
@@ -981,9 +981,9 @@ dependencies = [
 
 [[package]]
 name = "aws-lc-sys"
-version = "0.44.0"
+version = "0.45.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f09fae7be8bb3174e05c6afdb34199e6dc0c7c04ba9fa237b1967adfbde27483"
+checksum = "9bff6c3b54fad79a2e60b8102caf565819711497c1f5f092f49508e2f5c31b27"
 dependencies = [
  "cc",
  "cmake",
@@ -5177,9 +5177,9 @@ dependencies = [
 
 [[package]]
 name = "frostem"
-version = "1.20260821.3"
+version = "1.20260821.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca2e81eab151ba68484704bb3d21b4b4d2747314d3081fa86fa6c7300a4c42e2"
+checksum = "481ace7f781f5ae54a5c0a6d6d8edb30adba737cfa1230fbd5632d63ba8dfd80"
 
 [[package]]
 name = "fs3"
@@ -7262,9 +7262,9 @@ dependencies = [
 
 [[package]]
 name = "libredox"
-version = "0.1.21"
+version = "0.1.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7955dfc218a8afb29dfeffd540e3a6e96baeb94fe7138228dd7cc6937fbbf96"
+checksum = "8d8f1ea3f21fd3405dcaf6c9b5c1630af9afc422d9073ea39c5f6d6c772e08ed"
 dependencies = [
  "bitflags 2.13.1",
  "libc",
@@ -7387,9 +7387,9 @@ dependencies = [
 
 [[package]]
 name = "lru"
-version = "0.18.3"
+version = "0.18.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d317b4b9eb398e6acce275758ec6125535505e7a146fb1a9b8bda2451b0ff4c"
+checksum = "ff9840bcc50b71349309900da0ce7279aa336ae71d73250b07998932c7d97c25"
 dependencies = [
  "hashbrown 0.17.1",
 ]
@@ -7776,9 +7776,9 @@ dependencies = [
 
 [[package]]
 name = "mio"
-version = "1.2.2"
+version = "1.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "30d65c71f1ce40ab09135ce117d742b9f8a19ff91a41a8b57ed50bc2de59c427"
+checksum = "4b18443e9c262bfe8fa82f51666e2642c53393f7e5c27b3e1aeab922cff5b9d8"
 dependencies = [
  "libc",
  "wasi 0.11.1+wasi-snapshot-preview1",
@@ -7870,10 +7870,11 @@ dependencies = [
 
 [[package]]
 name = "mysql_async"
-version = "0.37.0"
+version = "0.37.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3519e91b0d254ac1ffa495bc42053286cb2172ad7241d5b3b1b9f8a891f21ee2"
+checksum = "40d11da0e2d9fad4640c9f9198ee431c6d68444568f83ef1f10f3367270071e4"
 dependencies = [
+ "arc-swap",
  "bytes",
  "crossbeam-queue",
  "crossbeam-utils",
@@ -7882,7 +7883,7 @@ dependencies = [
  "futures-sink",
  "futures-util",
  "keyed_priority_queue",
- "lru 0.18.3",
+ "lru 0.18.4",
  "mysql_common",
  "native-tls",
  "pem 3.0.6",
@@ -11753,9 +11754,9 @@ checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
 
 [[package]]
 name = "smallvec"
-version = "1.15.2"
+version = "1.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90"
+checksum = "b9be42f50aa861c555654aa3a37f52f4b1074bacf4e48fe0ef7fa584e80f1f0f"
 dependencies = [
  "serde",
 ]
@@ -12812,7 +12813,7 @@ dependencies = [
  "itertools 0.14.0",
  "levenshtein_automata",
  "log",
- "lru 0.18.3",
+ "lru 0.18.4",
  "lz4_flex 0.14.0",
  "measure_time",
  "memmap2",
@@ -14746,7 +14747,7 @@ dependencies = [
 
 [[package]]
 name = "windmill"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -14831,7 +14832,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-ai"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "async-stream",
  "async-trait",
@@ -14864,7 +14865,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-alerting"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14877,7 +14878,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "argon2",
@@ -15017,7 +15018,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-agent-workers"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15040,7 +15041,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-assets"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15057,7 +15058,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-auth"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15083,7 +15084,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-client"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "reqwest 0.12.28",
  "serde",
@@ -15093,7 +15094,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-configs"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15110,7 +15111,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-debug"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "axum 0.8.9",
  "base64 0.22.1",
@@ -15132,7 +15133,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-embeddings"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15155,7 +15156,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flow-conversations"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15171,7 +15172,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flows"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15193,7 +15194,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-groups"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15214,7 +15215,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-inputs"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15228,7 +15229,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-integration-tests"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -15263,7 +15264,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-jobs"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15288,7 +15289,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-npm-proxy"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15316,7 +15317,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-openapi"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15338,7 +15339,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-schedule"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15358,7 +15359,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-scripts"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15396,7 +15397,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-settings"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15424,7 +15425,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-sse"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "lazy_static",
  "serde",
@@ -15436,7 +15437,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-users"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "argon2",
  "axum 0.8.9",
@@ -15460,7 +15461,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workers"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15474,7 +15475,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workspaces"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15509,7 +15510,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-audit"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "chrono",
  "lazy_static",
@@ -15523,7 +15524,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-autoscaling"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15542,7 +15543,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-common"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "aes-gcm",
  "aho-corasick",
@@ -15646,9 +15647,10 @@ dependencies = [
 
 [[package]]
 name = "windmill-dep-map"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "chrono",
+ "futures",
  "itertools 0.14.0",
  "lazy_static",
  "serde",
@@ -15665,7 +15667,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-git-sync"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "regex",
  "serde",
@@ -15680,7 +15682,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-indexer"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "astral-tokio-tar",
@@ -15707,7 +15709,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-jseval"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "futures",
@@ -15724,7 +15726,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "itertools 0.14.0",
  "lazy_static",
@@ -15740,7 +15742,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-mcp"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15761,7 +15763,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-native-triggers"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15792,7 +15794,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-oauth"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "arc-swap",
@@ -15817,7 +15819,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-object-store"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "async-stream",
@@ -15851,7 +15853,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-operator"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "futures",
@@ -15869,7 +15871,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "convert_case 0.6.0",
  "serde",
@@ -15878,7 +15880,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15890,7 +15892,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15902,7 +15904,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -15914,7 +15916,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15926,7 +15928,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15938,7 +15940,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -15949,7 +15951,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15960,7 +15962,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15972,7 +15974,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -15983,7 +15985,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -16005,7 +16007,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -16017,7 +16019,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -16031,7 +16033,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "convert_case 0.6.0",
@@ -16048,7 +16050,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -16061,7 +16063,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -16073,7 +16075,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -16091,7 +16093,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -16107,7 +16109,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -16123,7 +16125,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -16137,7 +16139,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-queue"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -16176,7 +16178,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-runtime-nativets"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "const_format",
@@ -16216,7 +16218,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-sql-datatype-parser-wasm"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "getrandom 0.3.4",
  "wasm-bindgen",
@@ -16227,7 +16229,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-store"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -16262,7 +16264,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-test-utils"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16286,7 +16288,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16319,7 +16321,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-amqp"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16346,7 +16348,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-azure"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16379,7 +16381,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-email"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16399,7 +16401,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-gcp"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16433,7 +16435,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-http"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16469,7 +16471,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-kafka"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16492,7 +16494,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-mqtt"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16516,7 +16518,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-nats"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -16540,7 +16542,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-postgres"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16575,7 +16577,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-sqs"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16603,7 +16605,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-websocket"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16628,7 +16630,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "bitflags 2.13.1",
@@ -16647,7 +16649,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "async-once-cell",
@@ -16764,7 +16766,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker-volumes"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "bytes",
  "futures",
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index 491f3cb48a..f432f022c5 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.800.1"
+version = "1.803.0"
 authors.workspace = true
 edition.workspace = true
 
@@ -88,7 +88,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal", "./parsers/windmill-parser-wasm"]
 
 [workspace.package]
-version = "1.800.1"
+version = "1.803.0"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 
diff --git a/backend/THREAT_MODEL.md b/backend/THREAT_MODEL.md
index 0468ebf721..f5725d65a3 100644
--- a/backend/THREAT_MODEL.md
+++ b/backend/THREAT_MODEL.md
@@ -85,7 +85,7 @@ published advisory history (73 GHSA advisories, several rated 9.9 critical).
 | EP9 Worker sandbox | nsjail / unshare / dind / rootless podman isolating user code | user code → host & cross-tenant filesystem/network | Worker host, isolation, downstream |
 | EP10 Worker code generation / wrappers | Entrypoint override, env-var names, workspace env interpolated into generated wrapper code | user-controlled identifier → executable code | Worker host, isolation |
 | EP11 OAuth / OIDC / SAML / MCP-OAuth / logout | Login callbacks, MCP OAuth client registration, logout `rd` redirect | untrusted IdP / redirect input → session | Session tokens, accounts |
-| EP12 Stored-content rendering | App builder HTML component, markdown, S3 download response headers | stored user content → admin browser (same origin) | Admin session, account takeover |
+| EP12 Stored-content rendering | App builder HTML component, markdown, S3 download response headers, script-controlled `wm_content_type`/`wm_headers` on `run_wait_result` and sync HTTP-route responses | stored user content → admin browser (same origin) | Admin session, account takeover |
 | EP13 Log/file reading & export endpoints | `service_logs`, `jobs_u/getupdate` log file read (symlinks), workspace/tarball export | authed/unauth request → arbitrary file or admin-only config | Arbitrary files, global settings |
 | EP14 Secret-value & resource-value caches | In-memory caches in `windmill-store` keyed (historically un-keyed) by path | cache lookup crossing identity/folder boundary | Secret variables, resource creds |
 | EP15 Deployment & runtime config | docker-compose defaults: dind, debugger (`REQUIRE_SIGNED_DEBUG_REQUESTS` now defaults to `true`; can still be overridden to `false`), CORS `Any`, default admin/`changeme`, exposed Postgres, `SUPERADMIN_SECRET`, `ENABLE_NSJAIL=false`, privileged containers | operator/infra default → full instance | All assets |
@@ -106,7 +106,7 @@ published advisory history (73 GHSA advisories, several rated 9.9 critical).
 | T8 | Unauthenticated RCE via the Debugger WebSocket: `/ws_debug/*` exposed by the gateway/ingress with the debugger service as the auth boundary; signature gate was bypassable via `program`-mode launches (read+exec an arbitrary server-side file path, never signed) even with signing on, and the WS handshake had no Origin check (CSWSH) | remote_unauth | EP15 | Worker host, all assets | critical | possible | partially_mitigated | `program`-mode launches now rejected when `REQUIRE_SIGNED_DEBUG_REQUESTS` is on (signing covers every launch, not just inline `code`); shipped `docker-compose` now defaults `REQUIRE_SIGNED_DEBUG_REQUESTS=true`; opt-in `DEBUG_ALLOWED_ORIGINS` allowlist rejects cross-origin handshakes. Residual: code default is secure but operators can still set `=false`; origin allowlist is opt-in | GHSA-725h-99vx-9xr4 |
 | T9 | Supply-chain compromise via cached hub scripts, GitHub workflow command injection, or vulnerable base-image deps | supply_chain | EP16 | Worker host, build integrity | critical | possible | partially_mitigated | hub-script re-pin to patched versions; HUB_BASE_URL override | GHSA-w2m9-q5f7-3gpq, edf340c4d4, GHSA-8rq7-w7g6-8wvr, GHSA-vch9-39v5-4wg7 (CVE-2024-37371) |
 | T10 | Unauthenticated disclosure of job results, args, logs, and admin config via missing-authz public endpoints | remote_unauth | EP2, EP13 | Job results/args/logs, global settings, scripts | high | likely | partially_mitigated | anonymous-job checks, log-endpoint authz hardening | GHSA-qfg7-x243-5hg4, GHSA-v448-fmm4-52fp, 108a88a180, bb90f4ce83 |
-| T11 | Stored XSS leading to admin/account takeover via app HTML component, markdown, or S3 download content-type | remote_auth | EP12 | Admin session, accounts | high | likely | partially_mitigated | DOMPurify markdown sanitization, `X-Content-Type-Options: nosniff` + CSP sandbox on downloads | GHSA-9c5c-hh3c-r9mc, GHSA-qxj7-hpx3-r892, GHSA-cf2x-rg8c-v63v, bb78b1c06d, 625b67dff0 |
+| T11 | Stored XSS leading to admin/account takeover via app HTML component, markdown, S3 download content-type, or a script-chosen `text/html` content type on `run_wait_result` / sync HTTP-route responses (GET-reachable with the `SameSite=Lax` session cookie) | remote_auth | EP12 | Admin session, accounts | high | likely | partially_mitigated | DOMPurify markdown sanitization, `X-Content-Type-Options: nosniff` + CSP sandbox on downloads and on every `result_to_response` composite result (inserted after `wm_headers`; hop-by-hop names such as `Connection` rejected so a proxy cannot strip them) | GHSA-9c5c-hh3c-r9mc, GHSA-qxj7-hpx3-r892, GHSA-cf2x-rg8c-v63v, bb78b1c06d, 625b67dff0, WIN-2471 |
 | T12 | Webhook authentication bypass / signature replay forges trigger invocations and approvals | remote_unauth | EP3 | Job execution integrity, approvals | high | likely | partially_mitigated | HMAC verification on some triggers; signing-oracle fix | GHSA-jw8c-h45c-xpjw, GHSA-hh9x-rcf8-xjr2, GHSA-q9g3-q6fj-hc2x, GHSA-8jc4-wj2p-2vmp, ab2a15b2a8 |
 | T13 | Path traversal / arbitrary file read via log-reading and MCP path endpoints (incl. symlink following) | remote_auth | EP13 | Arbitrary files on server, global settings | high | likely | partially_mitigated | traversal checks + no-symlink-follow added | GHSA-4hrf-mgvv-xp9x, bb90f4ce83, df451aa64f, ad5ec293b5, 5f2d3e6812 |
 | T14 | Privilege escalation via token rescope/refresh, script-issued JWTs, or operator-permission gaps | remote_auth | EP17, EP5 | Tokens, isolation, accounts | high | likely | partially_mitigated | monotonic-privilege enforcement on token lifecycle; SECURITY DEFINER triggers | GHSA-p62p-67xp-v775, GHSA-vv9w-wx3c-q3x2, 2ddf93de96, 865ab70c89, 33fb08cf3d |
diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index 3b1e88066e..e718b67f0e 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-e11dbe96407f2831cfb71ecadad94e38113eb61f
+05512fd5ac1e4ff9226cec2dc84799a117ade2dc
diff --git a/backend/migrations/20260901130041_drop_draft_password_fkey.down.sql b/backend/migrations/20260901130041_drop_draft_password_fkey.down.sql
new file mode 100644
index 0000000000..e62fc02975
--- /dev/null
+++ b/backend/migrations/20260901130041_drop_draft_password_fkey.down.sql
@@ -0,0 +1,12 @@
+-- Drafts owned by a principal with no login account cannot exist under the constraint; drop them
+-- before restoring it.
+DELETE FROM draft
+WHERE email IS NOT NULL
+  AND NOT EXISTS (SELECT 1 FROM password WHERE password.email = draft.email);
+
+ALTER TABLE draft
+    ADD CONSTRAINT draft_password_fkey
+    FOREIGN KEY (email)
+    REFERENCES password(email)
+    ON DELETE CASCADE
+    ON UPDATE CASCADE;
diff --git a/backend/migrations/20260901130041_drop_draft_password_fkey.up.sql b/backend/migrations/20260901130041_drop_draft_password_fkey.up.sql
new file mode 100644
index 0000000000..65a6686e95
--- /dev/null
+++ b/backend/migrations/20260901130041_drop_draft_password_fkey.up.sql
@@ -0,0 +1,3 @@
+-- The delete and rename this cascaded are now explicit, at the sites that remove or rename an
+-- account; `windmill_common::user_drafts::delete_drafts_of_email` carries the reasoning.
+ALTER TABLE draft DROP CONSTRAINT IF EXISTS draft_password_fkey;
diff --git a/backend/oauth_connect.json b/backend/oauth_connect.json
index cb874eb2c7..3f8c265a4a 100644
--- a/backend/oauth_connect.json
+++ b/backend/oauth_connect.json
@@ -29,6 +29,10 @@
     "auth_url": "https://accounts.google.com/o/oauth2/v2/auth",
     "token_url": "https://oauth2.googleapis.com/token",
     "scopes": ["https://www.googleapis.com/auth/spreadsheets"],
+    "scope_options": [
+      "https://www.googleapis.com/auth/spreadsheets",
+      "https://www.googleapis.com/auth/spreadsheets.readonly"
+    ],
     "extra_params": {
       "access_type": "offline",
       "prompt": "consent"
@@ -38,6 +42,11 @@
     "auth_url": "https://accounts.google.com/o/oauth2/v2/auth",
     "token_url": "https://oauth2.googleapis.com/token",
     "scopes": ["https://www.googleapis.com/auth/drive"],
+    "scope_options": [
+      "https://www.googleapis.com/auth/drive.file",
+      "https://www.googleapis.com/auth/drive.readonly",
+      "https://www.googleapis.com/auth/drive"
+    ],
     "extra_params": {
       "access_type": "offline",
       "prompt": "consent"
@@ -47,6 +56,13 @@
     "auth_url": "https://accounts.google.com/o/oauth2/v2/auth",
     "token_url": "https://oauth2.googleapis.com/token",
     "scopes": ["https://www.googleapis.com/auth/gmail.send"],
+    "scope_options": [
+      "https://www.googleapis.com/auth/gmail.send",
+      "https://www.googleapis.com/auth/gmail.readonly",
+      "https://www.googleapis.com/auth/gmail.compose",
+      "https://www.googleapis.com/auth/gmail.modify",
+      "https://www.googleapis.com/auth/gmail.labels"
+    ],
     "extra_params": {
       "access_type": "offline",
       "prompt": "consent"
@@ -56,6 +72,12 @@
     "auth_url": "https://accounts.google.com/o/oauth2/v2/auth",
     "token_url": "https://oauth2.googleapis.com/token",
     "scopes": ["https://www.googleapis.com/auth/calendar.events"],
+    "scope_options": [
+      "https://www.googleapis.com/auth/calendar.events",
+      "https://www.googleapis.com/auth/calendar.events.readonly",
+      "https://www.googleapis.com/auth/calendar.readonly",
+      "https://www.googleapis.com/auth/calendar"
+    ],
     "extra_params": {
       "access_type": "offline",
       "prompt": "consent"
@@ -65,6 +87,12 @@
     "auth_url": "https://accounts.google.com/o/oauth2/v2/auth",
     "token_url": "https://oauth2.googleapis.com/token",
     "scopes": ["https://www.googleapis.com/auth/forms"],
+    "scope_options": [
+      "https://www.googleapis.com/auth/forms",
+      "https://www.googleapis.com/auth/forms.body",
+      "https://www.googleapis.com/auth/forms.body.readonly",
+      "https://www.googleapis.com/auth/forms.responses.readonly"
+    ],
     "extra_params": {
       "access_type": "offline",
       "prompt": "consent"
@@ -74,6 +102,10 @@
     "auth_url": "https://accounts.google.com/o/oauth2/v2/auth",
     "token_url": "https://oauth2.googleapis.com/token",
     "scopes": ["https://www.googleapis.com/auth/cloud-platform"],
+    "scope_options": [
+      "https://www.googleapis.com/auth/cloud-platform",
+      "https://www.googleapis.com/auth/cloud-platform.read-only"
+    ],
     "extra_params": {
       "access_type": "offline",
       "prompt": "consent"
@@ -88,6 +120,15 @@
       "https://www.googleapis.com/auth/admin.directory.user.security",
       "https://www.googleapis.com/auth/admin.directory.orgunit"
     ],
+    "scope_options": [
+      "https://www.googleapis.com/auth/admin.directory.user",
+      "https://www.googleapis.com/auth/admin.directory.user.readonly",
+      "https://www.googleapis.com/auth/admin.directory.group",
+      "https://www.googleapis.com/auth/admin.directory.group.readonly",
+      "https://www.googleapis.com/auth/admin.directory.orgunit",
+      "https://www.googleapis.com/auth/admin.directory.orgunit.readonly",
+      "https://www.googleapis.com/auth/admin.directory.user.security"
+    ],
     "extra_params": {
       "access_type": "offline",
       "prompt": "consent"
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.lock b/backend/parsers/windmill-parser-wasm/Cargo.lock
index 1b09928903..395e692623 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.lock
+++ b/backend/parsers/windmill-parser-wasm/Cargo.lock
@@ -6191,7 +6191,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windmill-common"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "aho-corasick",
  "anyhow",
@@ -6274,7 +6274,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -6286,7 +6286,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "convert_case",
  "serde",
@@ -6295,7 +6295,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6307,7 +6307,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6319,7 +6319,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -6331,7 +6331,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6343,7 +6343,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6355,7 +6355,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -6366,7 +6366,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6377,7 +6377,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6389,7 +6389,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6400,7 +6400,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -6422,7 +6422,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6434,7 +6434,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6448,7 +6448,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "convert_case",
@@ -6465,7 +6465,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6478,7 +6478,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -6490,7 +6490,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6508,7 +6508,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -6524,7 +6524,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6540,7 +6540,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wasm"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "getrandom 0.2.17",
@@ -6572,7 +6572,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6586,7 +6586,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.800.1"
+version = "1.803.0"
 dependencies = [
  "anyhow",
  "bitflags",
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.toml b/backend/parsers/windmill-parser-wasm/Cargo.toml
index 752d80a1e3..45c8b0d94e 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.toml
+++ b/backend/parsers/windmill-parser-wasm/Cargo.toml
@@ -12,7 +12,7 @@ resolver = "2"
 members = ["."]
 
 [workspace.package]
-version = "1.800.1"
+version = "1.803.0"
 edition = "2021"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 
diff --git a/backend/src/main.rs b/backend/src/main.rs
index 5ec78b0b06..f84812151d 100644
--- a/backend/src/main.rs
+++ b/backend/src/main.rs
@@ -53,9 +53,9 @@ use windmill_common::{
         KEEP_JOB_DIR_SETTING, LICENSE_KEY_SETTING, MAVEN_REPOS_SETTING, MAVEN_SETTINGS_XML_SETTING,
         MONITOR_LOGS_ON_OBJECT_STORE_SETTING, NO_DEFAULT_MAVEN_SETTING,
         NPM_CONFIG_REGISTRY_SETTING, NSJAIL_TMPFS_SIZE_MB_SETTING, NSJAIL_TMP_BACKING_SETTING,
-        NUGET_CONFIG_SETTING, OAUTH_SETTING, OTEL_SETTING, OTEL_TRACING_PROXY_SETTING,
-        PIP_INDEX_URL_SETTING, POWERSHELL_REPO_PAT_SETTING, POWERSHELL_REPO_URL_SETTING,
-        PREVIEW_TAGS_OVERRIDE_SETTING, REQUEST_SIZE_LIMIT_SETTING,
+        NUGET_CONFIG_SETTING, OAUTH_SETTING, OTEL_SETTING, OTEL_TRACES_RETENTION_SECS_SETTING,
+        OTEL_TRACING_PROXY_SETTING, PIP_INDEX_URL_SETTING, POWERSHELL_REPO_PAT_SETTING,
+        POWERSHELL_REPO_URL_SETTING, PREVIEW_TAGS_OVERRIDE_SETTING, REQUEST_SIZE_LIMIT_SETTING,
         REQUIRE_PREEXISTING_USER_FOR_OAUTH_SETTING, RESTART_COORDINATION_SETTING,
         RETENTION_PERIOD_SECS_OVERRIDES_SETTING, RETENTION_PERIOD_SECS_SETTING, RUBY_REPOS_SETTING,
         SAML_METADATA_SETTING, SANDBOX_IMAGE_CACHE_MAX_MB_SETTING,
@@ -140,12 +140,12 @@ use crate::monitor::{
     reload_instance_events_webhook_setting, reload_job_default_timeout_setting,
     reload_job_isolation_setting, reload_jwt_secret_setting, reload_license_key,
     reload_npm_config_registry_setting, reload_nsjail_tmp_backing_setting,
-    reload_nsjail_tmpfs_size_setting, reload_otel_tracing_proxy_setting,
-    reload_pip_index_url_setting, reload_retention_period_setting,
-    reload_sandbox_image_cache_max_setting, reload_sandbox_image_default_registry_setting,
-    reload_sandbox_image_max_size_setting, reload_sandbox_image_pull_policy_setting,
-    reload_sandbox_registry_auth_setting, reload_scim_token_setting,
-    reload_service_log_retention_secs_setting, reload_smtp_config,
+    reload_nsjail_tmpfs_size_setting, reload_otel_traces_retention_secs_setting,
+    reload_otel_tracing_proxy_setting, reload_pip_index_url_setting,
+    reload_retention_period_setting, reload_sandbox_image_cache_max_setting,
+    reload_sandbox_image_default_registry_setting, reload_sandbox_image_max_size_setting,
+    reload_sandbox_image_pull_policy_setting, reload_sandbox_registry_auth_setting,
+    reload_scim_token_setting, reload_service_log_retention_secs_setting, reload_smtp_config,
     reload_store_audit_logs_s3_setting, reload_uv_exclude_newer_setting,
     reload_uv_index_strategy_setting, reload_uv_python_install_mirror_setting,
     reload_worker_config, MonitorIteration,
@@ -2013,6 +2013,9 @@ async fn process_notify_event(
                 SERVICE_LOG_RETENTION_SECS_SETTING => {
                     reload_service_log_retention_secs_setting(conn).await
                 }
+                OTEL_TRACES_RETENTION_SECS_SETTING => {
+                    reload_otel_traces_retention_secs_setting(conn).await
+                }
                 RETENTION_PERIOD_SECS_OVERRIDES_SETTING => {
                     if let Err(e) = load_retention_period_overrides(db).await {
                         tracing::error!("Error loading per-workspace retention overrides: {e:#}");
diff --git a/backend/src/monitor.rs b/backend/src/monitor.rs
index ce09cebe71..86e75b7de9 100644
--- a/backend/src/monitor.rs
+++ b/backend/src/monitor.rs
@@ -64,10 +64,11 @@ use windmill_common::{
         JOB_ISOLATION_SETTING, JWT_SECRET_SETTING, KEEP_JOB_DIR_SETTING, LICENSE_KEY_SETTING,
         MONITOR_LOGS_ON_OBJECT_STORE_SETTING, NPMRC_SETTING, NPM_CONFIG_REGISTRY_SETTING,
         NSJAIL_TMPFS_SIZE_MB_SETTING, NSJAIL_TMP_BACKING_SETTING, NUGET_CONFIG_SETTING,
-        OTEL_SETTING, OTEL_TRACING_PROXY_SETTING, PIP_INDEX_URL_SETTING,
-        POWERSHELL_REPO_PAT_SETTING, POWERSHELL_REPO_URL_SETTING, PREVIEW_TAGS_OVERRIDE_SETTING,
-        REQUEST_SIZE_LIMIT_SETTING, REQUIRE_PREEXISTING_USER_FOR_OAUTH_SETTING,
-        RETENTION_PERIOD_SECS_SETTING, SAML_METADATA_SETTING, SANDBOX_IMAGE_CACHE_MAX_MB_SETTING,
+        OTEL_SETTING, OTEL_TRACES_RETENTION_SECS_SETTING, OTEL_TRACING_PROXY_SETTING,
+        PIP_INDEX_URL_SETTING, POWERSHELL_REPO_PAT_SETTING, POWERSHELL_REPO_URL_SETTING,
+        PREVIEW_TAGS_OVERRIDE_SETTING, REQUEST_SIZE_LIMIT_SETTING,
+        REQUIRE_PREEXISTING_USER_FOR_OAUTH_SETTING, RETENTION_PERIOD_SECS_SETTING,
+        SAML_METADATA_SETTING, SANDBOX_IMAGE_CACHE_MAX_MB_SETTING,
         SANDBOX_IMAGE_DEFAULT_REGISTRY_SETTING, SANDBOX_IMAGE_MAX_SIZE_MB_SETTING,
         SANDBOX_IMAGE_PULL_POLICY_SETTING, SANDBOX_REGISTRY_AUTH_SETTING, SCIM_TOKEN_SETTING,
         SERVICE_LOG_RETENTION_SECS_SETTING, SMTP_SETTING, STORE_AUDIT_LOGS_S3_SETTING,
@@ -97,10 +98,10 @@ use windmill_common::{
     KillpillSender, AUDIT_LOG_RETENTION_DAYS, BASE_URL, CRITICAL_ALERTS_ON_DB_OVERSIZE,
     CRITICAL_ALERTS_ON_TOKEN_EXPIRY, CRITICAL_ALERT_MUTE_UI_ENABLED,
     CRITICAL_ALERT_MUTE_ZOMBIE_JOB_RESTART, CRITICAL_ERROR_CHANNELS, DB, DEFAULT_HUB_BASE_URL,
-    DEFAULT_SERVICE_LOG_RETENTION_SECS, HUB_BASE_URL, JOB_RETENTION_SECS,
-    JOB_RETENTION_SECS_OVERRIDES, JOB_RETENTION_SECS_OVERRIDES_LOADED, METRICS_DEBUG_ENABLED,
-    METRICS_ENABLED, MONITOR_LOGS_ON_OBJECT_STORE, OTEL_LOGS_ENABLED, OTEL_METRICS_ENABLED,
-    OTEL_TRACING_ENABLED, STORE_AUDIT_LOGS_S3,
+    DEFAULT_OTEL_TRACES_RETENTION_SECS, DEFAULT_SERVICE_LOG_RETENTION_SECS, HUB_BASE_URL,
+    JOB_RETENTION_SECS, JOB_RETENTION_SECS_OVERRIDES, JOB_RETENTION_SECS_OVERRIDES_LOADED,
+    METRICS_DEBUG_ENABLED, METRICS_ENABLED, MONITOR_LOGS_ON_OBJECT_STORE, OTEL_LOGS_ENABLED,
+    OTEL_METRICS_ENABLED, OTEL_TRACING_ENABLED, STORE_AUDIT_LOGS_S3,
 };
 use windmill_common::{
     client::AuthedClient,
@@ -514,6 +515,15 @@ pub async fn initial_load(
                 Ordering::Relaxed,
             )
         });
+        pass.setting(OTEL_TRACES_RETENTION_SECS_SETTING, true, |v| async move {
+            windmill_common::set_otel_traces_retention_secs(parse_setting_value::<i64>(
+                v,
+                OTEL_TRACES_RETENTION_SECS_SETTING,
+                "OTEL_TRACES_RETENTION_SECS",
+                DEFAULT_OTEL_TRACES_RETENTION_SECS,
+                |x| x,
+            ))
+        });
         pass.setting(STORE_AUDIT_LOGS_S3_SETTING, true, |v| async move {
             STORE_AUDIT_LOGS_S3.store(
                 parse_setting_value::<bool>(
@@ -1682,6 +1692,57 @@ const SERVICE_LOG_DELETE_BATCH: i64 = 2_000;
 /// across ticks rather than inside one, the way the neighbouring sweeps already do.
 const SERVICE_LOG_DELETE_MAX_BATCHES: usize = 10;
 
+/// One span per HTTP request made from a job script, so the table grows far faster than the
+/// job table it is keyed against; batched for the same reason the service log sweep is.
+const OTEL_TRACES_DELETE_BATCH: i64 = 10_000;
+const OTEL_TRACES_DELETE_MAX_BATCHES: usize = 10;
+
+/// Delete HTTP request tracing spans older than `retention_secs`, returning how many went.
+///
+/// `retention_secs` is a parameter rather than a read of the process-wide setting so a test can
+/// pin a window without writing state the other tests in this binary run against concurrently.
+async fn delete_expired_otel_traces(db: &DB, retention_secs: i64) -> u64 {
+    // `start_time_unix_nano` is the proto field stored verbatim, so the cutoff is built in that
+    // unit rather than compared against `now()`. Truncating the epoch to whole seconds first
+    // keeps the multiplication inside `bigint`.
+    //
+    // Batched on `ctid`, not on the `(trace_id, span_id)` primary key: with the key the planner
+    // hashes the LIMITed subquery and Seq Scans the whole table to probe it, which at the size
+    // this table reaches is the cost the batching exists to avoid. `ctid` plans as a Tid Scan, so
+    // each batch touches only the rows it deletes. Safe because the subquery and the delete share
+    // one snapshot, and spans are never updated after insert.
+    let mut deleted = 0;
+    for _ in 0..OTEL_TRACES_DELETE_MAX_BATCHES {
+        let batch = sqlx::query!(
+            "DELETE FROM otel_traces WHERE ctid IN (
+                 SELECT ctid FROM otel_traces
+                 WHERE start_time_unix_nano < EXTRACT(
+                     EPOCH FROM now() - ($1::bigint::text || ' s')::interval
+                 )::bigint * 1000000000
+                 LIMIT $2
+             )",
+            retention_secs,
+            OTEL_TRACES_DELETE_BATCH,
+        )
+        .execute(db)
+        .await;
+
+        match batch {
+            Ok(res) => {
+                deleted += res.rows_affected();
+                if (res.rows_affected() as i64) < OTEL_TRACES_DELETE_BATCH {
+                    break;
+                }
+            }
+            Err(e) => {
+                tracing::error!("Error deleting expired otel trace spans: {:?}", e);
+                break;
+            }
+        }
+    }
+    deleted
+}
+
 pub async fn delete_expired_items(db: &DB) -> () {
     let expired_tokens_r = sqlx::query_as!(
         TokenRow,
@@ -1808,6 +1869,12 @@ pub async fn delete_expired_items(db: &DB) -> () {
         }
     }
 
+    let deleted_spans =
+        delete_expired_otel_traces(db, windmill_common::otel_traces_retention_secs()).await;
+    if deleted_spans > 0 {
+        tracing::info!("deleted {} expired otel trace spans", deleted_spans);
+    }
+
     let audit_retention_days = audit_log_retention_days().await;
     let audit_retention_secs: i64 = audit_retention_days * 60 * 60 * 24;
 
@@ -2927,6 +2994,21 @@ pub async fn reload_service_log_retention_secs_setting(conn: &Connection) {
     }
 }
 
+pub async fn reload_otel_traces_retention_secs_setting(conn: &Connection) {
+    match load_setting_value::<i64>(
+        conn,
+        OTEL_TRACES_RETENTION_SECS_SETTING,
+        "OTEL_TRACES_RETENTION_SECS",
+        DEFAULT_OTEL_TRACES_RETENTION_SECS,
+        |x| x,
+    )
+    .await
+    {
+        Ok(v) => windmill_common::set_otel_traces_retention_secs(v),
+        Err(e) => tracing::error!("Error reloading otel traces retention period: {:?}", e),
+    }
+}
+
 pub async fn reload_audit_log_retention_days_setting(conn: &Connection) {
     match load_setting_value::<i64>(
         conn,
@@ -4839,7 +4921,7 @@ async fn poll_git_fork_branches(
 }
 
 async fn vacuuming_tables(db: &Pool<Postgres>) -> error::Result<()> {
-    sqlx::query!("VACUUM v2_job, v2_job_completed, job_result_stream_v2, job_stats, job_logs, job_perms, concurrency_key, log_file, metrics")
+    sqlx::query!("VACUUM v2_job, v2_job_completed, job_result_stream_v2, job_stats, job_logs, job_perms, concurrency_key, log_file, metrics, otel_traces")
         .execute(db)
         .await?;
     Ok(())
@@ -6975,6 +7057,46 @@ mod zombie_worker_memory_pct_tests {
     }
 }
 
+#[cfg(test)]
+mod otel_traces_retention_tests {
+    use super::{delete_expired_otel_traces, DB};
+
+    async fn insert_span(db: &DB, id: u8, age_secs: i64) {
+        sqlx::query!(
+            "INSERT INTO otel_traces (trace_id, span_id, name, kind, start_time_unix_nano, end_time_unix_nano)
+             VALUES ($1, $2, 'GET /', 3, $3, $3)",
+            &[id; 16][..],
+            &[id; 8][..],
+            (chrono::Utc::now() - chrono::Duration::seconds(age_secs))
+                .timestamp_nanos_opt()
+                .unwrap(),
+        )
+        .execute(db)
+        .await
+        .unwrap();
+    }
+
+    /// The cutoff crosses two units: a retention configured in seconds against a column holding
+    /// nanoseconds. Getting that conversion wrong is silent in both directions — a window a
+    /// billion times too wide never deletes anything, one a billion times too narrow deletes
+    /// every span on the next tick — so pin it on either side of the boundary.
+    #[sqlx::test(migrations = "./migrations")]
+    async fn deletes_only_spans_past_the_window(db: DB) -> anyhow::Result<()> {
+        let day = 60 * 60 * 24;
+        insert_span(&db, 1, 60).await;
+        insert_span(&db, 2, 6 * day).await;
+        insert_span(&db, 3, 8 * day).await;
+
+        assert_eq!(delete_expired_otel_traces(&db, 7 * day).await, 1);
+
+        let kept = sqlx::query_scalar!("SELECT trace_id FROM otel_traces ORDER BY trace_id")
+            .fetch_all(&db)
+            .await?;
+        assert_eq!(kept, vec![vec![1u8; 16], vec![2u8; 16]]);
+        Ok(())
+    }
+}
+
 #[cfg(test)]
 mod log_file_listing_tests {
     use super::{rotated_log_files, sorted_log_files};
diff --git a/backend/tests/fixtures/inline_preview_auth.sql b/backend/tests/fixtures/inline_preview_auth.sql
index 59fe2dc917..67ca598bda 100644
--- a/backend/tests/fixtures/inline_preview_auth.sql
+++ b/backend/tests/fixtures/inline_preview_auth.sql
@@ -2,7 +2,9 @@
 -- Layered on top of `base` (which provides test-workspace and the non-operator
 -- `test-user-2`/SECRET_TOKEN_2). Adds an Operator member so we can assert that
 -- Operators cannot reach the arbitrary-code inline preview path
--- (`POST /jobs/run_inline/preview`).
+-- (`POST /jobs/run_inline/preview`) with their own token, plus two deployed script
+-- jobs of the operator: one running, so we can assert that its WM_TOKEN can, and
+-- one queued but not yet pulled, so we can assert that "queued" is not enough.
 
 INSERT INTO password(email, password_hash, login_type, super_admin, verified, name)
     VALUES ('operator@windmill.dev', 'not-a-real-hash', 'password', false, true, 'Operator User');
@@ -12,3 +14,11 @@ INSERT INTO usr(workspace_id, email, username, is_admin, operator, role) VALUES
 
 INSERT INTO token(token_hash, token_prefix, token, email, label, super_admin) VALUES
 	(encode(sha256('OPERATOR_TOKEN'::bytea), 'hex'), 'OPERATOR_T', 'OPERATOR_TOKEN', 'operator@windmill.dev', 'operator token', false);
+
+INSERT INTO v2_job(id, workspace_id, kind, runnable_path, created_by, permissioned_as, permissioned_as_email) VALUES
+	('2aa0c0de-0000-4000-8000-000000000001', 'test-workspace', 'script', 'u/test-user/deployed', 'operator-user', 'u/operator-user', 'operator@windmill.dev'),
+	('2aa0c0de-0000-4000-8000-000000000002', 'test-workspace', 'script', 'u/test-user/deployed', 'operator-user', 'u/operator-user', 'operator@windmill.dev');
+
+INSERT INTO v2_job_queue(id, workspace_id, scheduled_for, running) VALUES
+	('2aa0c0de-0000-4000-8000-000000000001', 'test-workspace', now(), true),
+	('2aa0c0de-0000-4000-8000-000000000002', 'test-workspace', now(), false);
diff --git a/backend/tests/inline_preview_auth.rs b/backend/tests/inline_preview_auth.rs
index 97b70fb545..8841719962 100644
--- a/backend/tests/inline_preview_auth.rs
+++ b/backend/tests/inline_preview_auth.rs
@@ -9,16 +9,33 @@
 //! was the incomplete-fix residual of CVE-2026-22683, whose v1.615.0 patch only
 //! covered the entity-CRUD endpoints and left this direct inline-exec sink open.
 //!
+//! The guard on both routes has one exemption: `wmill.datatable()` called from
+//! inside a job the operator is running. Operators can only run deployed code,
+//! so a request the job's WM_TOKEN authenticates comes from code a non-operator
+//! authored, and the exemption is limited to the request shape the helper sends
+//! (PostgreSQL against a `datatable://` database) so a leaked WM_TOKEN cannot
+//! be replayed to run anything else.
+//!
 //! This test pins down:
-//!   - an Operator is rejected by the operator guard (the core fix; pre-fix this
-//!     reached the inline executor instead of returning 401), and
+//!   - an Operator's own token is rejected by the operator guard (the core fix;
+//!     pre-fix this reached the inline executor instead of returning 401),
 //!   - a regular non-operator passes the guard (the fix must not over-block the
 //!     legitimate inline preview flow): in the test harness the worker inline
 //!     utils are not registered, so a caller past the guard gets the distinct
-//!     "worker inline functions" error rather than the operator rejection.
+//!     "worker inline functions" error rather than the operator rejection,
+//!   - an Operator's job token passes the guard for a datatable query while its
+//!     job is running, on the inline route and on the `/jobs/run/preview`
+//!     fallback the SDKs use when the worker has no internal server,
+//!   - the same token is rejected for any other payload (in-process DuckDB, or a
+//!     `-- database` directive redirecting the query, whether written literally or
+//!     reached through a `WM_INTERNAL_DB` marker) and for a deferred run,
+//!   - an Operator's job token for a job that is not running, whether finished or
+//!     merely queued, is rejected.
 
 use serde_json::json;
 use sqlx::{Pool, Postgres};
+use windmill_common::auth::create_jwt_token;
+use windmill_common::db::Authed;
 use windmill_test_utils::*;
 
 fn client() -> reqwest::Client {
@@ -38,11 +55,65 @@ fn inline_preview_body() -> serde_json::Value {
     })
 }
 
+/// The request `wmill.datatable("main")` sends: PostgreSQL against `datatable://main`.
+fn datatable_query_body() -> serde_json::Value {
+    json!({
+        "language": "postgresql",
+        "content": "SELECT 1 AS x;",
+        "args": { "database": "datatable://main" }
+    })
+}
+
+/// Mint the WM_TOKEN a job hands its own code: an internally-signed job JWT
+/// (note the `job_id` claim) for the fixture's operator, exactly as the worker
+/// issues it when the operator runs a deployed script.
+async fn operator_job_token(job_id: uuid::Uuid) -> String {
+    let authed = Authed {
+        email: "operator@windmill.dev".to_string(),
+        username: "operator-user".to_string(),
+        is_admin: false,
+        is_operator: true,
+        groups: vec![],
+        folders: vec![],
+        scopes: None,
+        token_prefix: None,
+    };
+    create_jwt_token(
+        authed,
+        "test-workspace",
+        3600,
+        Some(job_id),
+        Some("ephemeral-script".to_string()),
+        None,
+        None,
+    )
+    .await
+    .expect("mint operator job token")
+}
+
 const OPERATOR_GUARD_MSG: &str = "Operators cannot run preview jobs";
 
+/// The fixture's deployed-script jobs of the operator: one running, one queued.
+const RUNNING_JOB_ID: &str = "2aa0c0de-0000-4000-8000-000000000001";
+const QUEUED_JOB_ID: &str = "2aa0c0de-0000-4000-8000-000000000002";
+
+async fn post(url: &str, token: &str, body: &serde_json::Value) -> (u16, String) {
+    let resp = authed(client().post(url), token)
+        .json(body)
+        .send()
+        .await
+        .expect("request");
+    let status = resp.status().as_u16();
+    let body = resp.text().await.expect("body");
+    (status, body)
+}
+
 #[sqlx::test(fixtures("base", "inline_preview_auth"))]
 async fn test_inline_preview_authorization(db: Pool<Postgres>) -> anyhow::Result<()> {
     initialize_tracing().await;
+    // The server decodes WM_TOKENs with the same in-process JWT secret, so
+    // setting it once lets us mint valid ones below.
+    set_jwt_secret().await;
 
     let server = ApiServer::start(db.clone()).await?;
     let port = server.addr.port();
@@ -51,12 +122,7 @@ async fn test_inline_preview_authorization(db: Pool<Postgres>) -> anyhow::Result
     // 1. CORE REGRESSION: an Operator must be rejected by the operator guard.
     //    Pre-fix this fell through to the inline executor (arbitrary code
     //    execution); post-fix it returns 401 with the operator guard message.
-    let resp = authed(client().post(&url), "OPERATOR_TOKEN")
-        .json(&inline_preview_body())
-        .send()
-        .await?;
-    let status = resp.status();
-    let body = resp.text().await?;
+    let (status, body) = post(&url, "OPERATOR_TOKEN", &inline_preview_body()).await;
     assert_eq!(
         status, 401,
         "Operator must be rejected from inline preview (got {status}): {body}"
@@ -71,12 +137,7 @@ async fn test_inline_preview_authorization(db: Pool<Postgres>) -> anyhow::Result
     //    the worker inline utils, so the request proceeds past the guard and
     //    fails later with the distinct "worker inline functions" error — proving
     //    the operator guard did not reject it.
-    let resp = authed(client().post(&url), "SECRET_TOKEN_2")
-        .json(&inline_preview_body())
-        .send()
-        .await?;
-    let status = resp.status();
-    let body = resp.text().await?;
+    let (status, body) = post(&url, "SECRET_TOKEN_2", &inline_preview_body()).await;
     assert_ne!(
         status, 401,
         "non-operator must not be blocked by the operator guard (got {status}): {body}"
@@ -86,5 +147,113 @@ async fn test_inline_preview_authorization(db: Pool<Postgres>) -> anyhow::Result
         "non-operator must not hit the operator guard, got: {body}"
     );
 
+    // 3. The WM_TOKEN of a deployed-script job the Operator is running passes the
+    //    guard for a datatable query: this is `wmill.datatable()` called from
+    //    inside that job. As in 2, the harness then fails with the "worker inline
+    //    functions" error.
+    let running_job_token =
+        operator_job_token(uuid::Uuid::parse_str(RUNNING_JOB_ID).unwrap()).await;
+    let (status, body) = post(&url, &running_job_token, &datatable_query_body()).await;
+    assert_ne!(
+        status, 401,
+        "operator job token of a running job must pass the guard for a datatable query (got {status}): {body}"
+    );
+    assert!(
+        !body.contains(OPERATOR_GUARD_MSG),
+        "operator job token of a running job must not hit the operator guard, got: {body}"
+    );
+
+    // 4. The same token is rejected for any other payload: the exemption covers
+    //    the datatable request shape only, never in-process DuckDB, and never a
+    //    `-- database` directive, which the executor honors over `args.database`.
+    let mut redirected = datatable_query_body();
+    redirected["content"] = json!("-- database u/test-user/other_db\nSELECT 1 AS x;");
+    let mut to_s3 = datatable_query_body();
+    to_s3["content"] = json!("-- s3\nSELECT 1 AS x;");
+    let mut resource_db = datatable_query_body();
+    resource_db["args"]["database"] = json!("$res:u/test-user/other_db");
+    // A marker is a single line the directive regexes cannot match; the directive only
+    // appears once the executor expands it, so the guard must check the expansion.
+    let mut marker = datatable_query_body();
+    marker["content"] = json!(concat!(
+        r#"-- WM_INTERNAL_DB_SELECT {"table":"t","columnDefs":[{"field":"id","datatype":"int4"}],"#,
+        r#""whereClause":"true\n-- database u/test-user/other_db\n AND true"}"#
+    ));
+    for (label, payload) in [
+        ("DuckDB", inline_preview_body()),
+        ("database directive", redirected),
+        ("s3 directive", to_s3),
+        ("resource database", resource_db),
+        ("marker-expanded database directive", marker),
+    ] {
+        let (status, body) = post(&url, &running_job_token, &payload).await;
+        assert_eq!(
+            status, 401,
+            "operator job token must be rejected for a {label} payload (got {status}): {body}"
+        );
+        assert!(
+            body.contains(OPERATOR_GUARD_MSG),
+            "rejection for a {label} payload must be the operator guard, got: {body}"
+        );
+    }
+
+    // 5. An Operator's job token whose job is not running is rejected like the
+    //    operator's own token, whether the job is over (no queue row) or merely
+    //    queued: a WM_TOKEN that leaked through logs cannot be replayed once the
+    //    job is over.
+    for (label, job_id) in [
+        ("finished", uuid::Uuid::new_v4()),
+        ("queued", uuid::Uuid::parse_str(QUEUED_JOB_ID).unwrap()),
+    ] {
+        let token = operator_job_token(job_id).await;
+        let (status, body) = post(&url, &token, &datatable_query_body()).await;
+        assert_eq!(
+            status, 401,
+            "operator job token of a {label} job must be rejected (got {status}): {body}"
+        );
+        assert!(
+            body.contains(OPERATOR_GUARD_MSG),
+            "rejection for a {label} job must be the operator guard, got: {body}"
+        );
+    }
+
+    // 6. The SDKs fall back to `/jobs/run/preview` when the worker has no internal
+    //    server (agent workers). The same exemption applies there: the running
+    //    job's token queues the datatable query (201 with the job id), the
+    //    operator's own token is still refused.
+    let fallback_url = format!("http://localhost:{port}/api/w/test-workspace/jobs/run/preview");
+    let (status, body) = post(&fallback_url, &running_job_token, &datatable_query_body()).await;
+    assert_eq!(
+        status, 201,
+        "operator job token of a running job must queue a datatable preview (got {status}): {body}"
+    );
+    let (status, body) = post(&fallback_url, "OPERATOR_TOKEN", &datatable_query_body()).await;
+    assert_eq!(
+        status, 401,
+        "Operator must be rejected from the preview fallback (got {status}): {body}"
+    );
+    assert!(
+        body.contains(OPERATOR_GUARD_MSG),
+        "rejection must be the operator guard, got: {body}"
+    );
+
+    // 7. A deferred run on the fallback would outlive the running job the
+    //    exemption keys off, so the running job's token cannot schedule one.
+    for deferral in [
+        "scheduled_in_secs=86400",
+        "scheduled_for=2099-01-01T00:00:00Z",
+    ] {
+        let deferred_url = format!("{fallback_url}?{deferral}");
+        let (status, body) = post(&deferred_url, &running_job_token, &datatable_query_body()).await;
+        assert_eq!(
+            status, 401,
+            "operator job token must not schedule a deferred preview with {deferral} (got {status}): {body}"
+        );
+        assert!(
+            body.contains(OPERATOR_GUARD_MSG),
+            "rejection for {deferral} must be the operator guard, got: {body}"
+        );
+    }
+
     Ok(())
 }
diff --git a/backend/tests/object_storage_test_ssrf.rs b/backend/tests/object_storage_test_ssrf.rs
new file mode 100644
index 0000000000..aa9eaaf74c
--- /dev/null
+++ b/backend/tests/object_storage_test_ssrf.rs
@@ -0,0 +1,97 @@
+//! `POST /api/settings/test_object_storage_config` runs the probe on the API server and reflects the
+//! upstream response, so every non-super-admin must be rejected for private/loopback endpoints and
+//! the Filesystem backend on every deployment (`CLOUD_HOSTED` is unset here), while a super admin's
+//! Filesystem probe still round-trips. Requires the `parquet` feature, like the route.
+#![cfg(feature = "parquet")]
+
+use serde_json::json;
+use sqlx::{Pool, Postgres};
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::Arc;
+use windmill_test_utils::*;
+
+const SUPER_ADMIN_TOKEN: &str = "SECRET_TOKEN";
+const USER_TOKEN: &str = "SECRET_TOKEN_2";
+
+async fn test_object_storage(
+    url: &str,
+    token: &str,
+    body: serde_json::Value,
+) -> anyhow::Result<(u16, String)> {
+    let resp = reqwest::Client::new()
+        .post(url)
+        .header("Authorization", format!("Bearer {token}"))
+        .json(&body)
+        .send()
+        .await?;
+    Ok((resp.status().as_u16(), resp.text().await?))
+}
+
+#[sqlx::test(fixtures("base"))]
+async fn object_storage_test_is_restricted_for_non_super_admins_off_cloud(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let url = format!(
+        "http://localhost:{}/api/settings/test_object_storage_config",
+        server.addr.port()
+    );
+
+    // A loopback "S3 endpoint" standing in for an internal service: the probe must be rejected
+    // before the server opens a connection to it.
+    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await?;
+    let internal_port = listener.local_addr()?.port();
+    let connected = Arc::new(AtomicBool::new(false));
+    tokio::spawn({
+        let connected = connected.clone();
+        async move {
+            while listener.accept().await.is_ok() {
+                connected.store(true, Ordering::SeqCst);
+            }
+        }
+    });
+    let internal_s3 = json!({
+        "type": "S3",
+        "bucket": "bucket",
+        "region": "us-east-1",
+        "access_key": "key",
+        "secret_key": "secret",
+        "endpoint": format!("http://127.0.0.1:{internal_port}"),
+        "allow_http": true,
+        "path_style": true,
+    });
+    let (status, body) = test_object_storage(&url, USER_TOKEN, internal_s3).await?;
+    assert_eq!(
+        status, 401,
+        "non-super-admin must be rejected for a loopback endpoint (got {status}): {body}"
+    );
+    assert!(
+        body.contains("requires a super admin"),
+        "unexpected rejection: {body}"
+    );
+    assert!(
+        !connected.load(Ordering::SeqCst),
+        "the server must not connect to the rejected endpoint"
+    );
+
+    let tmp = tempfile::tempdir()?;
+    let filesystem = json!({ "type": "Filesystem", "root_path": tmp.path().to_str().unwrap() });
+    let (status, body) = test_object_storage(&url, USER_TOKEN, filesystem.clone()).await?;
+    assert_eq!(
+        status, 401,
+        "non-super-admin must be rejected for a Filesystem backend (got {status}): {body}"
+    );
+    assert!(
+        body.contains("requires a super admin"),
+        "unexpected rejection: {body}"
+    );
+
+    // Super admins keep the unrestricted path.
+    let (status, body) = test_object_storage(&url, SUPER_ADMIN_TOKEN, filesystem).await?;
+    assert_eq!(
+        status, 200,
+        "super admin must be able to test a Filesystem backend (got {status}): {body}"
+    );
+    Ok(())
+}
diff --git a/backend/tests/relock_noop.rs b/backend/tests/relock_noop.rs
new file mode 100644
index 0000000000..5cb8e3f51e
--- /dev/null
+++ b/backend/tests/relock_noop.rs
@@ -0,0 +1,415 @@
+use sqlx::{Pool, Postgres};
+use tokio_stream::StreamExt;
+use windmill_api_client::types::NewScript;
+use windmill_common::scripts::{deploy_relocked_version, fetch_script_for_update};
+use windmill_test_utils::*;
+
+const W: &str = "test-workspace";
+
+const A: &str = r#"export async function main() { return "a" }"#;
+const A_COMMENTED: &str = r#"// same dependencies, different content
+export async function main() { return "a" }"#;
+const A_WITH_LODASH: &str = r#"import _ from "lodash@4.17.21";
+export async function main() { return _.trim(" a ") }"#;
+const B: &str = r#"import { main as a } from "/f/rel/a.ts";
+export async function main() { return "b" + (await a()) }"#;
+const C: &str = r#"import { main as b } from "/f/rel/b.ts";
+export async function main() { return "c" + (await b()) }"#;
+
+fn bun_script(path: &str, content: &str, parent_hash: Option<String>) -> NewScript {
+    NewScript {
+        draft_only: None,
+        content: content.into(),
+        language: windmill_api_client::types::ScriptLang::Bun,
+        lock: None,
+        parent_hash,
+        path: path.into(),
+        concurrent_limit: None,
+        concurrency_time_window_s: None,
+        cache_ttl: None,
+        dedicated_worker: None,
+        description: "".to_string(),
+        envs: vec![],
+        is_template: None,
+        kind: None,
+        summary: "".to_string(),
+        tag: None,
+        schema: std::collections::HashMap::new(),
+        ws_error_handler_muted: Some(false),
+        priority: None,
+        delete_after_secs: None,
+        timeout: None,
+        restart_unless_cancelled: None,
+        deployment_message: None,
+        concurrency_key: None,
+        visible_to_runner_only: None,
+        auto_kind: None,
+        codebase: None,
+        has_preprocessor: None,
+        on_behalf_of_email: None,
+        assets: vec![],
+        modules: None,
+    }
+}
+
+#[derive(sqlx::FromRow, Debug)]
+struct Version {
+    hash: i64,
+    archived: bool,
+    lock: Option<String>,
+    created_at: chrono::DateTime<chrono::Utc>,
+}
+
+/// Every version of `path`, oldest first.
+async fn versions(db: &Pool<Postgres>, path: &str) -> Vec<Version> {
+    sqlx::query_as(
+        "SELECT hash, archived, lock, created_at FROM script
+         WHERE workspace_id = $1 AND path = $2 ORDER BY created_at",
+    )
+    .bind(W)
+    .bind(path)
+    .fetch_all(db)
+    .await
+    .unwrap()
+}
+
+fn live(versions: &[Version]) -> &Version {
+    versions.iter().rev().find(|v| !v.archived).unwrap()
+}
+
+/// `(path, status, logs)` of every dependency job created after `since`, in completion order.
+async fn dependency_jobs_since(
+    db: &Pool<Postgres>,
+    since: chrono::DateTime<chrono::Utc>,
+) -> Vec<(String, String, String)> {
+    sqlx::query_as(
+        "SELECT j.runnable_path, c.status::text, COALESCE(l.logs, '') FROM v2_job_completed c
+         JOIN v2_job j ON j.id = c.id
+         LEFT JOIN job_logs l ON l.job_id = c.id
+         WHERE j.kind = 'dependencies' AND j.created_at > $1
+         ORDER BY c.started_at",
+    )
+    .bind(since)
+    .fetch_all(db)
+    .await
+    .unwrap()
+}
+
+async fn wait_for_jobs(
+    completed: &mut (impl futures::Stream<Item = uuid::Uuid> + Unpin),
+    count: usize,
+) {
+    for _ in 0..count {
+        completed.next().await;
+    }
+    // Then let anything else that was queued run out, so a job the assertions say must not
+    // exist would have shown up here.
+    while let Ok(Some(_)) =
+        tokio::time::timeout(std::time::Duration::from_secs(2), completed.next()).await
+    {}
+}
+
+/// A redeploy of an imported script whose dependencies did not move relocks its importer,
+/// and that relock must deploy nothing: no new version, and no dependency job for the
+/// importer's own importers. A redeploy that does change the dependencies still walks the
+/// whole chain with a new version at each step.
+#[sqlx::test(fixtures("base"))]
+async fn relative_import_relock_deploys_only_when_the_lock_changed(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    std::env::set_var("DEPENDENCY_JOB_DEBOUNCE_DELAY", "0");
+    let (client, port, _s) = init_client(db.clone()).await;
+    let mut completed = listen_for_completed_jobs(&db).await;
+
+    in_test_worker(
+        &db,
+        async {
+            // One at a time: each deploy's dependency job records the importer's edges, and an
+            // importer whose edges are recorded is what a later relock of it can skip on.
+            for (path, content) in [("f/rel/a", A), ("f/rel/b", B), ("f/rel/c", C)] {
+                client
+                    .create_script(W, &bun_script(path, content, None))
+                    .await
+                    .unwrap();
+                wait_for_jobs(&mut completed, 1).await;
+            }
+            let b_before = versions(&db, "f/rel/b").await;
+            let c_before = versions(&db, "f/rel/c").await;
+            assert_eq!(b_before.len(), 1);
+            assert_eq!(c_before.len(), 1);
+
+            // Content-only change on the leaf.
+            let since = chrono::Utc::now();
+            let a_hash = live(&versions(&db, "f/rel/a").await).hash;
+            client
+                .create_script(
+                    W,
+                    &bun_script("f/rel/a", A_COMMENTED, Some(format!("{a_hash:016x}"))),
+                )
+                .await
+                .unwrap();
+            wait_for_jobs(&mut completed, 2).await;
+
+            let jobs = dependency_jobs_since(&db, since).await;
+            let paths: Vec<&str> = jobs.iter().map(|(p, _, _)| p.as_str()).collect();
+            assert_eq!(
+                paths,
+                ["f/rel/a", "f/rel/b"],
+                "the leaf's own job and one no-op relock of its importer, and nothing for c"
+            );
+            assert!(
+                jobs[1]
+                    .2
+                    .contains("Lock unchanged: no new version deployed"),
+                "b's relock should have found its lock unchanged: {}",
+                jobs[1].2
+            );
+            let b_after = versions(&db, "f/rel/b").await;
+            let c_after = versions(&db, "f/rel/c").await;
+            assert_eq!(
+                b_after.len(),
+                1,
+                "an unchanged relock must not mint a version"
+            );
+            assert_eq!(live(&b_after).hash, live(&b_before).hash);
+            assert_eq!(c_after.len(), 1);
+            assert_eq!(live(&c_after).hash, live(&c_before).hash);
+
+            // A dependency change on the leaf.
+            let since = chrono::Utc::now();
+            let a_hash = live(&versions(&db, "f/rel/a").await).hash;
+            client
+                .create_script(
+                    W,
+                    &bun_script("f/rel/a", A_WITH_LODASH, Some(format!("{a_hash:016x}"))),
+                )
+                .await
+                .unwrap();
+            wait_for_jobs(&mut completed, 3).await;
+
+            let jobs = dependency_jobs_since(&db, since).await;
+            let paths: Vec<&str> = jobs.iter().map(|(p, _, _)| p.as_str()).collect();
+            assert_eq!(paths, ["f/rel/a", "f/rel/b", "f/rel/c"]);
+            for path in ["f/rel/b", "f/rel/c"] {
+                let vs = versions(&db, path).await;
+                assert_eq!(
+                    vs.len(),
+                    2,
+                    "{path}: a changed relock deploys a new version"
+                );
+                assert!(
+                    vs[0].archived && !vs[1].archived,
+                    "{path}: parent archived, child live"
+                );
+                assert!(vs[0].created_at < vs[1].created_at, "{path}: lineage order");
+                assert!(
+                    vs[1].lock.as_deref().unwrap_or("").contains("lodash"),
+                    "{path}: the new version carries the new lock: {:?}",
+                    vs[1].lock
+                );
+            }
+        },
+        port,
+    )
+    .await;
+
+    Ok(())
+}
+
+/// A relock that has to wait on its head's row lock, because a deploy of the same path holds
+/// it, must find the version that deploy left and requeue itself for it rather than fail. The
+/// blocked statement re-checks only the row it selected, which the deploy archived, and comes
+/// back empty; the successor is only visible to a fresh read.
+#[sqlx::test(fixtures("base"))]
+async fn relock_waiting_on_a_deploy_requeues_for_its_successor(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    std::env::set_var("DEPENDENCY_JOB_DEBOUNCE_DELAY", "0");
+    let (client, port, _s) = init_client(db.clone()).await;
+    let mut completed = listen_for_completed_jobs(&db).await;
+
+    in_test_worker(
+        &db,
+        async {
+            for (path, content) in [("f/rel/a", A), ("f/rel/b", B)] {
+                client
+                    .create_script(W, &bun_script(path, content, None))
+                    .await
+                    .unwrap();
+                wait_for_jobs(&mut completed, 1).await;
+            }
+
+            // A deploy of b that holds its head's row lock for as long as this transaction lives.
+            let mut deploy = db.begin().await.unwrap();
+            let head = fetch_script_for_update("f/rel/b", W, &mut *deploy)
+                .await
+                .unwrap()
+                .unwrap();
+
+            let since = chrono::Utc::now();
+            let a_hash = live(&versions(&db, "f/rel/a").await).hash;
+            client
+                .create_script(
+                    W,
+                    &bun_script("f/rel/a", A_COMMENTED, Some(format!("{a_hash:016x}"))),
+                )
+                .await
+                .unwrap();
+
+            // b's relock skips generation and reaches its commit, where it waits on the lock.
+            let mut waiting = false;
+            for _ in 0..300 {
+                waiting = sqlx::query_scalar(
+                    "SELECT EXISTS (SELECT 1 FROM pg_stat_activity
+                     WHERE datname = current_database() AND wait_event_type = 'Lock'
+                       AND query LIKE '%FROM script WHERE path = $1%FOR UPDATE%')",
+                )
+                .fetch_one(&db)
+                .await
+                .unwrap();
+                if waiting {
+                    break;
+                }
+                tokio::time::sleep(std::time::Duration::from_millis(100)).await;
+            }
+            assert!(waiting, "b's relock never reached the row lock");
+
+            // The deploy lands: the head is archived and a successor with its own lock takes
+            // its place, while the relock is still waiting.
+            let lock = head.lock.clone().unwrap();
+            let successor =
+                deploy_relocked_version(&mut deploy, head, None, Some(&lock), None, None)
+                    .await
+                    .unwrap();
+            deploy.commit().await.unwrap();
+
+            // a's own job, the relock that waited, and the relock it queued for the successor.
+            wait_for_jobs(&mut completed, 3).await;
+
+            let jobs = dependency_jobs_since(&db, since).await;
+            let paths: Vec<&str> = jobs.iter().map(|(p, _, _)| p.as_str()).collect();
+            assert_eq!(paths, ["f/rel/a", "f/rel/b", "f/rel/b"], "{jobs:?}");
+            assert!(
+                jobs.iter().all(|(_, status, _)| status == "success"),
+                "no relock may fail on the wait: {jobs:?}"
+            );
+            assert!(
+                jobs[1]
+                    .2
+                    .contains("was deployed while this lock was generated"),
+                "the waiting relock should have seen the successor: {}",
+                jobs[1].2
+            );
+            assert!(
+                jobs[2]
+                    .2
+                    .contains("Lock unchanged: no new version deployed"),
+                "the requeued relock should find the successor's lock current: {}",
+                jobs[2].2
+            );
+            let vs = versions(&db, "f/rel/b").await;
+            assert_eq!(
+                vs.len(),
+                2,
+                "the deploy's successor and nothing else: {vs:?}"
+            );
+            assert_eq!(live(&vs).hash, successor);
+        },
+        port,
+    )
+    .await;
+
+    Ok(())
+}
+
+/// A multi-file importer: on a skipped relock each module gets its own last lock back, not the
+/// parent script's, so an import's content-only redeploy leaves the importer alone as well.
+#[cfg(feature = "python")]
+#[sqlx::test(fixtures("base"))]
+async fn multi_file_importer_relock_is_a_no_op_too(db: Pool<Postgres>) -> anyhow::Result<()> {
+    std::env::set_var("DEPENDENCY_JOB_DEBOUNCE_DELAY", "0");
+    let (client, port, _s) = init_client(db.clone()).await;
+    let mut completed = listen_for_completed_jobs(&db).await;
+
+    let py = |path: &str, content: &str, parent_hash: Option<String>, with_module: bool| {
+        let mut ns = bun_script(path, content, parent_hash);
+        ns.language = windmill_api_client::types::ScriptLang::Python3;
+        if with_module {
+            ns.modules = Some(std::collections::HashMap::from([(
+                "helper.py".to_string(),
+                serde_json::json!({
+                    "content": "def greet(x):\n    return 'hi ' + x\n",
+                    "language": "python3"
+                }),
+            )]));
+        }
+        ns
+    };
+    async fn module_lock(db: &Pool<Postgres>) -> Option<String> {
+        sqlx::query_scalar(
+            "SELECT modules->'helper.py'->>'lock' FROM script
+             WHERE workspace_id = $1 AND path = 'f/rel/pb' AND archived = false",
+        )
+        .bind(W)
+        .fetch_one(db)
+        .await
+        .unwrap()
+    }
+
+    in_test_worker(
+        &db,
+        async {
+            client
+                .create_script(W, &py("f/rel/pa", "def main():\n    return 'a'\n", None, false))
+                .await
+                .unwrap();
+            wait_for_jobs(&mut completed, 1).await;
+            client
+                .create_script(
+                    W,
+                    &py(
+                        "f/rel/pb",
+                        "from f.rel.pa import main as a\nfrom .helper import greet\n\ndef main():\n    return greet(a())\n",
+                        None,
+                        true,
+                    ),
+                )
+                .await
+                .unwrap();
+            wait_for_jobs(&mut completed, 1).await;
+            let lock_before = module_lock(&db).await;
+            assert!(lock_before.is_some(), "the module got a lock of its own on deploy");
+
+            let since = chrono::Utc::now();
+            let pa_hash = live(&versions(&db, "f/rel/pa").await).hash;
+            client
+                .create_script(
+                    W,
+                    &py(
+                        "f/rel/pa",
+                        "# same dependencies\ndef main():\n    return 'a'\n",
+                        Some(format!("{pa_hash:016x}")),
+                        false,
+                    ),
+                )
+                .await
+                .unwrap();
+            wait_for_jobs(&mut completed, 2).await;
+
+            let jobs = dependency_jobs_since(&db, since).await;
+            let paths: Vec<&str> = jobs.iter().map(|(p, _, _)| p.as_str()).collect();
+            assert_eq!(paths, ["f/rel/pa", "f/rel/pb"], "{jobs:?}");
+            assert!(
+                jobs[1].2.contains("Lock unchanged: no new version deployed"),
+                "the multi-file importer's relock should be a no-op: {}",
+                jobs[1].2
+            );
+            assert_eq!(versions(&db, "f/rel/pb").await.len(), 1);
+            assert_eq!(module_lock(&db).await, lock_before, "the module keeps its own lock");
+        },
+        port,
+    )
+    .await;
+
+    Ok(())
+}
diff --git a/backend/tests/relock_skip.rs b/backend/tests/relock_skip.rs
index 8262a38cf4..bf5cb24cbf 100644
--- a/backend/tests/relock_skip.rs
+++ b/backend/tests/relock_skip.rs
@@ -266,7 +266,10 @@ def main():
         .await
         .unwrap();
 
-        in_test_worker(&db, wait_for_jobs_ge(&mut completed, 10), port).await;
+        // Empty content leaves every importer's lock as it was, so only the five direct
+        // importers of the default deps run a job: an unchanged script relock deploys no
+        // version and so queues nothing for its own importers.
+        in_test_worker(&db, wait_for_jobs_ge(&mut completed, 5), port).await;
 
         // Note: within a cascade, the same script may be triggered multiple times.
         // After the first trigger relocks and stores the hash, subsequent triggers skip.
@@ -295,7 +298,7 @@ def main():
         .await
         .unwrap();
 
-        in_test_worker(&db, wait_for_jobs_ge(&mut completed, 10), port).await;
+        in_test_worker(&db, wait_for_jobs_ge(&mut completed, 5), port).await;
 
         let skipping_count = count_pattern_in_job_logs(&db, "Skipping relock", before).await;
         assert!(
diff --git a/backend/windmill-api-flows/src/flows.rs b/backend/windmill-api-flows/src/flows.rs
index 6353cd429a..ecb7ba405b 100644
--- a/backend/windmill-api-flows/src/flows.rs
+++ b/backend/windmill-api-flows/src/flows.rs
@@ -157,7 +157,8 @@ async fn list_flows(
               FROM draft d \
               LEFT JOIN usr u ON u.workspace_id = d.workspace_id AND u.email = d.email \
               LEFT JOIN password p ON p.email = d.email AND p.super_admin = true \
-              WHERE d.workspace_id = o.workspace_id AND d.path = o.path AND d.typ = 'flow') as draft_users",
+              WHERE d.workspace_id = o.workspace_id AND d.path = o.path AND d.typ = 'flow' \
+                AND (d.email IS NULL OR u.username IS NOT NULL OR p.email IS NOT NULL)) as draft_users",
             "folder_labels(o.workspace_id, o.path) as inherited_labels"
         ])
         .left()
diff --git a/backend/windmill-api-groups/src/granular_acls.rs b/backend/windmill-api-groups/src/granular_acls.rs
index 5a7af05cbe..c6f88dace5 100644
--- a/backend/windmill-api-groups/src/granular_acls.rs
+++ b/backend/windmill-api-groups/src/granular_acls.rs
@@ -183,9 +183,9 @@ async fn add_granular_acl(
 
     if kind == "folder" {
         let change_type = if write.unwrap_or(false) {
-            "grant_read"
-        } else {
             "grant_write"
+        } else {
+            "grant_read"
         };
         crate::folders::log_folder_permission_change(
             &mut *tx,
diff --git a/backend/windmill-api-integration-tests/tests/mcp_preprocessor_headers.rs b/backend/windmill-api-integration-tests/tests/mcp_preprocessor_headers.rs
new file mode 100644
index 0000000000..3e1035ff82
--- /dev/null
+++ b/backend/windmill-api-integration-tests/tests/mcp_preprocessor_headers.rs
@@ -0,0 +1,186 @@
+//! Request headers reaching a runnable's preprocessor over MCP.
+//!
+//! The property this pins is structural rather than a filter: the model writes
+//! the tool's arguments, which become `event.body`, while the server writes
+//! `event.headers`. A model that guesses a header's name can only ever land in
+//! `body`, so an identity read from `headers` is one prompt injection cannot
+//! forge. Nothing else in the suite exercises MCP argument shaping end to end.
+//!
+//! Requires: bun runtime, live database (migrations applied by sqlx::test).
+#![cfg(feature = "mcp")]
+
+use serde_json::{json, Value};
+use sqlx::{Pool, Postgres};
+use windmill_test_utils::*;
+
+const SCRIPT_PATH: &str = "u/test-user/mcp_hdr_probe";
+
+/// Echoes the two halves of the event separately, so the assertions can tell
+/// which one a value arrived in.
+const PREPROCESSOR_SCRIPT: &str = r#"
+export async function preprocessor(event: any) {
+  return {
+    kind: event.kind,
+    from_headers: event.headers?.["x-user-id"] ?? "",
+    from_body: event.body?.x_user_id ?? "",
+    header_names: Object.keys(event.headers ?? {}).sort(),
+  };
+}
+
+export async function main(kind: string, from_headers: string, from_body: string, header_names: string[]) {
+  return { kind, from_headers, from_body, header_names };
+}
+"#;
+
+async fn insert_mcp_token(db: &Pool<Postgres>) -> anyhow::Result<()> {
+    sqlx::query(
+        "INSERT INTO token (token_hash, token_prefix, token, email, label, super_admin, scopes)
+         VALUES (encode(sha256('MCP_TOKEN'::bytea), 'hex'), 'MCP_TOK', 'MCP_TOKEN', 'test@windmill.dev', 'mcp token', true, ARRAY['mcp:all'])",
+    )
+    .execute(db)
+    .await?;
+    Ok(())
+}
+
+/// POST one JSON-RPC message. The endpoint answers either `application/json` or
+/// a single-event SSE stream, so strip the `data: ` framing before parsing.
+async fn mcp_post(port: u16, headers: &[(&str, &str)], body: Value) -> anyhow::Result<Value> {
+    let mut req = reqwest::Client::new()
+        .post(format!(
+            "http://localhost:{port}/api/mcp/w/test-workspace/mcp"
+        ))
+        .header("Authorization", "Bearer MCP_TOKEN")
+        .header("Accept", "application/json, text/event-stream")
+        .json(&body);
+    for (k, v) in headers {
+        req = req.header(*k, *v);
+    }
+    let text = req.send().await?.text().await?;
+    let payload = text
+        .lines()
+        .find_map(|l| l.strip_prefix("data: "))
+        .unwrap_or(text.trim());
+    serde_json::from_str(payload).map_err(|e| anyhow::anyhow!("unparseable MCP body {text:?}: {e}"))
+}
+
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn test_mcp_preprocessor_receives_the_callers_headers(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    set_jwt_secret().await;
+    insert_mcp_token(&db).await?;
+    let server = ApiServer::start_mcp(db.clone()).await?;
+    let port = server.addr.port();
+
+    let resp = reqwest::Client::new()
+        .post(format!(
+            "http://localhost:{port}/api/w/test-workspace/scripts/create"
+        ))
+        .header("Authorization", "Bearer SECRET_TOKEN")
+        .json(&json!({
+            "path": SCRIPT_PATH,
+            "summary": "mcp header probe",
+            "description": "",
+            "content": PREPROCESSOR_SCRIPT,
+            "language": "bun",
+            "lock": "",
+            "schema": {
+                "$schema": "https://json-schema.org/draft/2020-12/schema",
+                "type": "object",
+                "properties": { "x_user_id": { "type": "string" } },
+                "required": []
+            }
+        }))
+        .send()
+        .await?;
+    assert_eq!(
+        resp.status(),
+        201,
+        "create script: {}",
+        resp.text().await.unwrap_or_default()
+    );
+
+    // A script counts as deployed once it has a lock, which normally arrives from
+    // a dependency job. Planting an empty one keeps the test to the path under
+    // test instead of a bun resolution whose timing it does not control.
+    sqlx::query("UPDATE script SET lock = '' WHERE path = $1 AND workspace_id = 'test-workspace'")
+        .bind(SCRIPT_PATH)
+        .execute(&db)
+        .await?;
+
+    let tools = mcp_post(
+        port,
+        &[],
+        json!({"jsonrpc": "2.0", "id": 1, "method": "tools/list", "params": {}}),
+    )
+    .await?;
+    let tool_name = tools["result"]["tools"]
+        .as_array()
+        .and_then(|list| {
+            list.iter()
+                .filter_map(|t| t["name"].as_str())
+                .find(|n| n.contains("mcp__hdr__probe"))
+        })
+        .ok_or_else(|| anyhow::anyhow!("the deployed script was not listed as a tool: {tools}"))?
+        .to_string();
+
+    let result = in_test_worker(
+        db.clone(),
+        async {
+            mcp_post(
+                port,
+                // Every name the withheld list covers has to be on the wire, or
+                // asserting its absence proves nothing. `Authorization` is already
+                // set by `mcp_post`, and `extract_token` reads it before the
+                // cookie, so sending one does not disturb auth.
+                &[
+                    ("X-User-Id", "alice@corp.example"),
+                    ("Cookie", "session=secret"),
+                    ("Proxy-Authorization", "Basic Zm9v"),
+                ],
+                json!({
+                    "jsonrpc": "2.0", "id": 2, "method": "tools/call",
+                    // The model names the header it wants to spoof. Its value is an
+                    // argument, so it can only ever reach `event.body`.
+                    "params": { "name": tool_name, "arguments": { "x_user_id": "attacker@evil.test" } }
+                }),
+            )
+            .await
+        },
+        port,
+    )
+    .await?;
+
+    let text = result["result"]["content"][0]["text"]
+        .as_str()
+        .ok_or_else(|| anyhow::anyhow!("tool call returned no text content: {result}"))?;
+    let out: Value = serde_json::from_str(text)?;
+
+    assert_eq!(out["kind"], "mcp", "preprocessor event kind: {out}");
+    assert_eq!(
+        out["from_headers"], "alice@corp.example",
+        "the caller's header must reach event.headers: {out}"
+    );
+    assert_eq!(
+        out["from_body"], "attacker@evil.test",
+        "the model's argument must land in event.body, not overwrite the header: {out}"
+    );
+
+    let names: Vec<&str> = out["header_names"]
+        .as_array()
+        .map(|a| a.iter().filter_map(|v| v.as_str()).collect())
+        .unwrap_or_default();
+    assert!(
+        names.contains(&"x-user-id"),
+        "event.headers must carry the request's own headers: {names:?}"
+    );
+    for withheld in ["authorization", "cookie", "proxy-authorization"] {
+        assert!(
+            !names.contains(&withheld),
+            "{withheld} is withheld from a preprocessor: {names:?}"
+        );
+    }
+
+    Ok(())
+}
diff --git a/backend/windmill-api-integration-tests/tests/scripts.rs b/backend/windmill-api-integration-tests/tests/scripts.rs
index 8c88c53454..3a146add27 100644
--- a/backend/windmill-api-integration-tests/tests/scripts.rs
+++ b/backend/windmill-api-integration-tests/tests/scripts.rs
@@ -38,6 +38,85 @@ fn new_script(path: &str, summary: &str, content: &str) -> serde_json::Value {
     })
 }
 
+/// A supplied lock queues no dependency job, so if the create does not record its hash nothing
+/// ever will, and every importer of this script relocks on each of its deploys forever after.
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn test_create_script_persists_supplied_lock_hash(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let path = "u/test-user/supplied_lock";
+    let lock = r#"{"version":"4","remote":{}}"#;
+    let mut script = new_script(
+        path,
+        "Supplied lock",
+        "export async function main() { return 42; }",
+    );
+    script["lock"] = json!(lock);
+
+    let resp = authed(client().post(format!(
+        "http://localhost:{port}/api/w/test-workspace/scripts/create"
+    )))
+    .json(&script)
+    .send()
+    .await?;
+    assert_eq!(resp.status(), 201, "create: {}", resp.text().await?);
+
+    let stored_hash = sqlx::query_scalar!(
+        "SELECT lockfile_hash FROM lock_hash WHERE workspace_id = $1 AND path = $2",
+        "test-workspace",
+        path,
+    )
+    .fetch_one(&db)
+    .await?;
+    assert_eq!(stored_hash, windmill_common::scripts::hash_script(lock));
+
+    // A script deployed before the create recorded hashes has no row, and pushing it unchanged
+    // creates no version to hang one off. Without the write on that path it would keep its
+    // importers relocking until someone edited it.
+    sqlx::query!(
+        "DELETE FROM lock_hash WHERE workspace_id = $1 AND path = $2",
+        "test-workspace",
+        path,
+    )
+    .execute(&db)
+    .await?;
+
+    // The no-op comparison covers every field, so the push has to carry what the first deploy
+    // filled in by itself; `auto_parent` both resolves the parent and keeps the hash distinct.
+    script["auto_parent"] = json!(true);
+    script["ws_error_handler_muted"] = json!(false);
+    script["assets"] = json!([]);
+    let resp = authed(client().post(format!(
+        "http://localhost:{port}/api/w/test-workspace/scripts/create?skip_if_noop=true"
+    )))
+    .json(&script)
+    .send()
+    .await?;
+    assert_eq!(resp.status(), 201, "no-op push: {}", resp.text().await?);
+
+    let versions: i64 = sqlx::query_scalar!(
+        "SELECT COUNT(*) FROM script WHERE workspace_id = $1 AND path = $2",
+        "test-workspace",
+        path,
+    )
+    .fetch_one(&db)
+    .await?
+    .unwrap_or_default();
+    assert_eq!(versions, 1, "no-op push must not create a version");
+
+    let repaired_hash = sqlx::query_scalar!(
+        "SELECT lockfile_hash FROM lock_hash WHERE workspace_id = $1 AND path = $2",
+        "test-workspace",
+        path,
+    )
+    .fetch_one(&db)
+    .await?;
+    assert_eq!(repaired_hash, windmill_common::scripts::hash_script(lock));
+
+    Ok(())
+}
+
 #[sqlx::test(migrations = "../migrations", fixtures("base"))]
 async fn test_script_endpoints(db: Pool<Postgres>) -> anyhow::Result<()> {
     initialize_tracing().await;
@@ -797,10 +876,12 @@ async fn test_update_script_reports_losing_to_a_concurrent_deploy(
 
     // What a deploy leaves behind: the old head archived, a new one live at the path.
     // Copied through a temp table so this does not have to restate every column.
-    sqlx::query("CREATE TEMP TABLE superseding ON COMMIT DROP AS SELECT * FROM script WHERE hash = $1")
-        .bind(head)
-        .execute(&mut *winner)
-        .await?;
+    sqlx::query(
+        "CREATE TEMP TABLE superseding ON COMMIT DROP AS SELECT * FROM script WHERE hash = $1",
+    )
+    .bind(head)
+    .execute(&mut *winner)
+    .await?;
     sqlx::query("UPDATE superseding SET hash = $1, archived = false, parent_hashes = ARRAY[$2]")
         .bind(head + 1)
         .bind(head)
@@ -818,7 +899,10 @@ async fn test_update_script_reports_losing_to_a_concurrent_deploy(
     let resp = tokio::time::timeout(std::time::Duration::from_secs(20), update).await??;
     let status = resp.status();
     let body = resp.text().await?;
-    assert_eq!(status, 400, "losing the race should not read as success: {body}");
+    assert_eq!(
+        status, 400,
+        "losing the race should not read as success: {body}"
+    );
     assert!(
         body.contains("deployed to concurrently"),
         "the loser must say it was superseded, not that the script is missing: {body}"
diff --git a/backend/windmill-api-integration-tests/tests/users.rs b/backend/windmill-api-integration-tests/tests/users.rs
index bec59ac45a..65d44509d7 100644
--- a/backend/windmill-api-integration-tests/tests/users.rs
+++ b/backend/windmill-api-integration-tests/tests/users.rs
@@ -917,3 +917,79 @@ async fn test_change_user_email_leaves_group_identities(db: Pool<Postgres>) -> a
 
     Ok(())
 }
+
+/// An address with no `password` row can own a draft, and the account paths carry the delete and
+/// rename that no foreign key does any more.
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn test_drafts_follow_their_owner_without_a_fkey(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let global_base = format!("http://localhost:{port}/api/users");
+
+    // The destination of the rename below already holds a draft of the same item — it belongs to
+    // an accountless principal, so `change_email`'s "address is free" check does not see it.
+    sqlx::query!(
+        "INSERT INTO draft(workspace_id, path, typ, value, email) VALUES
+            ('test-workspace', 'u/ext/s', 'script', '{}'::json, 'ext-jwt@windmill.dev'),
+            ('test-workspace', 'u/two/s', 'script', '{\"summary\": \"moving\"}'::json, 'test2@windmill.dev'),
+            ('test-workspace', 'u/two/s', 'script', '{\"summary\": \"displaced\"}'::json, 'renamed@windmill.dev'),
+            ('test-workspace', 'u/three/s', 'script', '{}'::json, 'test3@windmill.dev')"
+    )
+    .execute(&db)
+    .await?;
+
+    // A null username is how the legacy workspace-level row is encoded, so an owner nobody can
+    // name must be absent from the owner circles rather than pose as one.
+    let resp = authed(client().get(format!(
+        "http://localhost:{port}/api/w/test-workspace/drafts/list?all_users=true"
+    )))
+    .send()
+    .await
+    .unwrap();
+    assert_eq!(resp.status(), 200);
+    let listed = resp.json::<serde_json::Value>().await?;
+    let ext = listed
+        .as_array()
+        .unwrap()
+        .iter()
+        .find(|d| d["path"] == "u/ext/s")
+        .expect("the accountless owner's draft is listed");
+    assert_eq!(ext.get("draft_users"), None);
+
+    let resp = authed(client().post(format!("{global_base}/change_email/test2@windmill.dev")))
+        .json(&json!({ "new_email": "renamed@windmill.dev" }))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 200, "change_email: {}", resp.text().await?);
+    let moved = sqlx::query!(
+        "SELECT email, value->>'summary' AS summary FROM draft WHERE path = 'u/two/s'"
+    )
+    .fetch_all(&db)
+    .await?;
+    assert_eq!(
+        moved
+            .iter()
+            .map(|r| (r.email.as_deref(), r.summary.as_deref()))
+            .collect::<Vec<_>>(),
+        vec![(Some("renamed@windmill.dev"), Some("moving"))],
+        "the moving account's draft wins the unique index it now collides on"
+    );
+
+    let resp = authed(client().delete(format!("{global_base}/delete/test3@windmill.dev")))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 200, "delete_user: {}", resp.text().await?);
+    let remaining = sqlx::query_scalar!("SELECT path FROM draft ORDER BY path")
+        .fetch_all(&db)
+        .await?;
+    assert_eq!(
+        remaining,
+        vec!["u/ext/s".to_string(), "u/two/s".to_string()],
+        "the deleted account's draft goes, the accountless owner's stays"
+    );
+
+    Ok(())
+}
diff --git a/backend/windmill-api-integration-tests/tests/workspaces.rs b/backend/windmill-api-integration-tests/tests/workspaces.rs
index 65fe4241cc..25312cae27 100644
--- a/backend/windmill-api-integration-tests/tests/workspaces.rs
+++ b/backend/windmill-api-integration-tests/tests/workspaces.rs
@@ -889,6 +889,53 @@ async fn test_get_copilot_info_ignores_empty_instance_ai_row(
     Ok(())
 }
 
+/// A workspace with no provider of its own is served the instance config, but the
+/// `copilot_disabled` flag must still come from the workspace's own row.
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn test_get_copilot_info_keeps_workspace_copilot_disabled_over_instance_fallback(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let base = format!("http://localhost:{port}/api/w/test-workspace/workspaces");
+
+    sqlx::query("UPDATE workspace_settings SET ai_config = $1 WHERE workspace_id = $2")
+        .bind(json!({ "copilot_disabled": true }))
+        .bind("test-workspace")
+        .execute(&db)
+        .await?;
+    sqlx::query(
+        "INSERT INTO global_settings (name, value) VALUES ($1, $2) \
+         ON CONFLICT (name) DO UPDATE SET value = EXCLUDED.value",
+    )
+    .bind("ai_config")
+    .bind(json!({
+        "providers": {
+            "openai": {
+                "resource_path": "u/test-user/openai_instance",
+                "models": ["gpt-4o-mini"]
+            }
+        }
+    }))
+    .execute(&db)
+    .await?;
+
+    let resp = authed(client().get(format!("{base}/get_copilot_info")))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 200);
+    let settings = resp.json::<serde_json::Value>().await?;
+    assert_eq!(
+        settings["providers"]["openai"]["models"][0], "gpt-4o-mini",
+        "instance providers are still served"
+    );
+    assert_eq!(settings["copilot_disabled"], true);
+
+    Ok(())
+}
+
 #[sqlx::test(migrations = "../migrations", fixtures("base"))]
 async fn test_error_handler_instance_alerts_fallback(db: Pool<Postgres>) -> anyhow::Result<()> {
     initialize_tracing().await;
@@ -941,7 +988,12 @@ async fn test_error_handler_instance_alerts_fallback(db: Pool<Postgres>) -> anyh
         .send()
         .await
         .unwrap();
-    assert_eq!(resp.status(), 200, "disable on fork: {}", resp.text().await?);
+    assert_eq!(
+        resp.status(),
+        200,
+        "disable on fork: {}",
+        resp.text().await?
+    );
     assert!(!stored().await?);
 
     Ok(())
@@ -1044,9 +1096,11 @@ async fn test_create_service_account_drops_orphaned_group_memberships(
     .await?;
 
     // Same username, different workspace, and very much alive — must not be touched.
-    sqlx::query("INSERT INTO workspace (id, name, owner) VALUES ('other-workspace', 'other', 'svc_acct')")
-        .execute(&db)
-        .await?;
+    sqlx::query(
+        "INSERT INTO workspace (id, name, owner) VALUES ('other-workspace', 'other', 'svc_acct')",
+    )
+    .execute(&db)
+    .await?;
     sqlx::query(
         "INSERT INTO group_ (workspace_id, name, summary) VALUES
          ('other-workspace', 'all', 'All users'),
diff --git a/backend/windmill-api-jobs/src/execution.rs b/backend/windmill-api-jobs/src/execution.rs
index fbfd656cdf..e897bf5eaf 100644
--- a/backend/windmill-api-jobs/src/execution.rs
+++ b/backend/windmill-api-jobs/src/execution.rs
@@ -416,11 +416,31 @@ pub fn result_to_response(result: Box<RawValue>, success: bool) -> error::Result
 
             let mut headers = HeaderMap::new();
 
+            // A reverse proxy consumes hop-by-hop headers instead of forwarding them and
+            // drops every header named by `Connection`, so a script could use one to strip
+            // the sandbox headers this function adds before they reach the browser.
+            const HOP_BY_HOP_HEADERS: [&str; 9] = [
+                "connection",
+                "keep-alive",
+                "proxy-authenticate",
+                "proxy-authorization",
+                "proxy-connection",
+                "te",
+                "trailer",
+                "transfer-encoding",
+                "upgrade",
+            ];
+
             if let Some(windmill_headers) = windmill_headers {
                 for (k, v) in windmill_headers {
                     let k = HeaderName::from_str(k.as_str()).map_err(|err| {
                         Error::internal_err(format!("Invalid header name {k}: {err}"))
                     })?;
+                    if HOP_BY_HOP_HEADERS.contains(&k.as_str()) {
+                        return Err(Error::ExecutionErr(format!(
+                            "windmill_headers cannot set the hop-by-hop header \"{k}\""
+                        )));
+                    }
                     let v = HeaderValue::from_str(v.as_str()).map_err(|err| {
                         Error::internal_err(format!("Invalid header value {v}: {err}"))
                     })?;
@@ -428,6 +448,22 @@ pub fn result_to_response(result: Box<RawValue>, success: bool) -> error::Result
                 }
             }
 
+            // The script controls the content type and body, and run_wait_result and sync
+            // HTTP routes are reachable by top-level GET navigation with the session cookie:
+            // sandbox the document into an opaque origin so HTML can never run with the
+            // viewer's session. Inserted after `wm_headers` so a script cannot override it.
+            headers.insert(
+                http::header::X_CONTENT_TYPE_OPTIONS,
+                HeaderValue::from_static("nosniff"),
+            );
+            headers.insert(
+                http::header::CONTENT_SECURITY_POLICY,
+                HeaderValue::from_static(
+                    "sandbox allow-scripts allow-forms allow-popups \
+                     allow-popups-to-escape-sandbox allow-downloads allow-modals",
+                ),
+            );
+
             if let Some(content_type) = windmill_content_type {
                 let serialized_json_result = result_value
                     .map(|val| val.get().to_owned())
@@ -1104,6 +1140,56 @@ mod result_to_response_tests {
             resp.headers().get(http::header::CONTENT_TYPE).unwrap(),
             "text/html"
         );
+        assert_sandboxed(resp.headers());
         assert_eq!(body_bytes(resp).await, b"<h1>hi</h1>");
     }
+
+    fn assert_sandboxed(headers: &HeaderMap) {
+        assert_eq!(
+            headers.get(http::header::X_CONTENT_TYPE_OPTIONS).unwrap(),
+            "nosniff"
+        );
+        let csp = headers
+            .get(http::header::CONTENT_SECURITY_POLICY)
+            .expect("content-security-policy")
+            .to_str()
+            .unwrap();
+        assert!(csp.starts_with("sandbox "), "csp: {csp}");
+        assert!(!csp.contains("allow-same-origin"), "csp: {csp}");
+    }
+
+    #[tokio::test]
+    async fn custom_headers_cannot_override_sandbox() {
+        // wm_headers is script-controlled: a content-type set there replaces the JSON
+        // one even without wm_content_type, and the sandbox headers must survive an
+        // attempt to override them.
+        let resp = result_to_response(
+            raw(
+                r#"{"wm_headers":{"content-type":"text/html","content-security-policy":"default-src *","x-content-type-options":"none"},"result":"<h1>hi</h1>"}"#,
+            ),
+            true,
+        )
+        .expect("response");
+
+        assert_eq!(
+            resp.headers().get(http::header::CONTENT_TYPE).unwrap(),
+            "text/html"
+        );
+        assert_sandboxed(resp.headers());
+    }
+
+    #[tokio::test]
+    async fn hop_by_hop_custom_headers_are_rejected() {
+        // A proxy drops every header named by `Connection`, which would strip the
+        // sandbox headers on the way to the browser.
+        for name in ["connection", "Connection", "transfer-encoding", "upgrade"] {
+            let res = result_to_response(
+                raw(&format!(
+                    r#"{{"wm_content_type":"text/html","wm_headers":{{"{name}":"content-security-policy, x-content-type-options"}},"result":"<h1>hi</h1>"}}"#
+                )),
+                true,
+            );
+            assert!(res.is_err(), "hop-by-hop header must be rejected: {name}");
+        }
+    }
 }
diff --git a/backend/windmill-api-scripts/src/scripts.rs b/backend/windmill-api-scripts/src/scripts.rs
index 79c6c99b9b..ccc5815aa7 100644
--- a/backend/windmill-api-scripts/src/scripts.rs
+++ b/backend/windmill-api-scripts/src/scripts.rs
@@ -39,7 +39,7 @@ use sqlx::{FromRow, Postgres, Transaction};
 use std::{collections::HashMap, sync::Arc};
 use windmill_audit::audit_oss::{audit_log, AuditAuthorable};
 use windmill_audit::ActionKind;
-use windmill_dep_map::process_relative_imports;
+use windmill_dep_map::{lock_hash::record_lock_hashes, process_relative_imports};
 use windmill_dep_map::scoped_dependency_map::ScopedDependencyMap;
 
 use windmill_common::{
@@ -216,12 +216,15 @@ async fn list_scripts(
             // a member of has no `usr` row, so fall back to their instance-derived username
             // (`password.username`), or their email when derivation is disabled — this keeps the
             // raw email out of the payload whenever a derived username exists. The genuine
-            // NULL-email legacy row stays None (no `usr`/`password` match, `d.email` is NULL).
+            // NULL-email legacy row stays None (no `usr`/`password` match, `d.email` is NULL),
+            // which is why an owner that resolves to no name at all — an external JWT's subject
+            // has neither row — is dropped: None is read as "legacy" downstream.
             "(SELECT json_agg(json_build_object('username', COALESCE(u.username, p.username, CASE WHEN p.email IS NOT NULL THEN d.email END)) ORDER BY COALESCE(u.username, p.username, CASE WHEN p.email IS NOT NULL THEN d.email END) NULLS LAST) \
               FROM draft d \
               LEFT JOIN usr u ON u.workspace_id = d.workspace_id AND u.email = d.email \
               LEFT JOIN password p ON p.email = d.email AND p.super_admin = true \
-              WHERE d.workspace_id = o.workspace_id AND d.path = o.path AND d.typ = 'script') as draft_users",
+              WHERE d.workspace_id = o.workspace_id AND d.path = o.path AND d.typ = 'script' \
+                AND (d.email IS NULL OR u.username IS NOT NULL OR p.email IS NOT NULL)) as draft_users",
             "folder_labels(o.workspace_id, o.path) as inherited_labels"
         ])
         .left()
@@ -1070,6 +1073,14 @@ fn modules_eq(
     }
 }
 
+/// Recorded for the empty lock a codebase or a language with no lock generation carries as well as
+/// for a real one: the worker writes `hash_script("")` in the same situation, and a path going from
+/// a real lock to an empty one has to stop matching what its importers recorded, or they wrongly
+/// skip rather than merely relock too often.
+fn lock_hash_entry(path: &str, lock: &str) -> [(String, i64); 1] {
+    [(path.to_string(), hash_script(lock))]
+}
+
 async fn create_script_internal<'c>(
     mut ns: NewScript,
     w_id: String,
@@ -1337,6 +1348,12 @@ async fn create_script_internal<'c>(
                     parent_hash = %p_hash.0,
                     "Skipping no-op script deploy (identical to parent)"
                 );
+                // The version is unchanged, but the row recording its lock's hash may never have
+                // been written — nothing else writes it for a supplied lock, and a path only ever
+                // pushed unchanged would otherwise keep its importers relocking forever.
+                if let Some(lock) = ps.lock.as_deref() {
+                    record_lock_hashes(&mut tx, &w_id, &lock_hash_entry(&ns.path, lock)).await?;
+                }
                 return Ok((p_hash.clone(), tx, None, Vec::new()));
             }
 
@@ -1884,6 +1901,13 @@ async fn create_script_internal<'c>(
     .execute(&mut *tx)
     .await?;
 
+    // A lock that is not left to a dependency job queues none, so this is the only place its hash
+    // can be recorded. `try_skip_relock` treats a missing hash for an imported script as changed,
+    // so leaving the row out makes every importer of this path relock on every deploy of it.
+    if let Some(lock) = lock.as_deref() {
+        record_lock_hashes(&mut tx, &w_id, &lock_hash_entry(&ns.path, lock)).await?;
+    }
+
     // Update ci_test_reference table for test scripts
     // Delete by both new and old path to handle renames
     let old_path = parent_hashes_and_perms.as_ref().map(|x| x.p_path.as_str());
diff --git a/backend/windmill-api-settings/src/lib.rs b/backend/windmill-api-settings/src/lib.rs
index 2cda80f458..18a8d52ac0 100644
--- a/backend/windmill-api-settings/src/lib.rs
+++ b/backend/windmill-api-settings/src/lib.rs
@@ -284,15 +284,28 @@ pub async fn test_s3_bucket(
     use bytes::Bytes;
     use futures::StreamExt;
 
-    // The probe executes on the API server itself. On multi-tenant Cloud that is a shared control
-    // plane, so we constrain untrusted callers to remove the SSRF / credential-exfiltration /
-    // local-filesystem surface (see validate_object_storage_test). On self-hosted instances the
-    // object store usually lives on the local/private network and all authenticated users are
-    // trusted, so testing there stays unrestricted. Super admins keep the unrestricted path too.
+    // The probe executes on the API server itself and reflects the upstream response into the
+    // error, so any authenticated caller could otherwise use it as an SSRF / port-scan primitive
+    // against the server's network, exfiltrate its ambient credentials, or write to its local
+    // disk (see validate_object_storage_test). That holds on self-hosted instances as much as on
+    // Cloud, so only super admins get the unrestricted path.
     let is_super_admin = windmill_api_auth::is_super_admin_authed(&db, &authed).await?;
-    let restrict = !is_super_admin && *CLOUD_HOSTED;
+    let restrict = !is_super_admin;
     if restrict {
-        validate_object_storage_test(&test_s3_bucket).await?;
+        validate_object_storage_test(&test_s3_bucket)
+            .await
+            .map_err(|e| match e {
+                // A job token never counts as a super admin (it is capped at workspace admin), so
+                // a super admin calling this route from a script is told why rather than that
+                // they lack a privilege they hold.
+                error::Error::NotAuthorized(msg) if authed.job_id.is_some() => {
+                    error::Error::NotAuthorized(format!(
+                        "{msg} A job token ($WM_TOKEN) is never treated as a super admin; call \
+                         this route with a user token instead."
+                    ))
+                }
+                e => e,
+            })?;
     }
 
     let client = build_object_store_from_settings(test_s3_bucket, Some(&db))
@@ -355,8 +368,8 @@ pub async fn test_s3_bucket(
     }
 }
 
-// Hardening for the object-storage connectivity test by an untrusted (non-super-admin) caller on
-// Cloud. The probe runs on the shared API server, so without these constraints an authenticated
+// Hardening for the object-storage connectivity test by an untrusted (non-super-admin) caller.
+// The probe runs on the API server, so without these constraints an authenticated
 // user could coerce the server into connecting to arbitrary internal endpoints (SSRF), signing
 // requests with the instance role (credential exfiltration), or reading/writing the server's local
 // disk (filesystem object store).
@@ -366,6 +379,11 @@ async fn validate_object_storage_test(settings: &ObjectSettings) -> error::Resul
         opt.as_ref().is_some_and(|s| !s.is_empty())
     }
 
+    // Every refusal names the way out: the resource usually works in jobs (workers reach the
+    // endpoint directly), so without it the refusal reads as a broken resource.
+    const ALTERNATIVE: &str =
+        "Ask a super admin to run it, or test the resource from a script, which runs on a worker.";
+
     // Reject backends that rely on the server's identity or local filesystem, require explicit
     // credentials for the rest (so the server never falls back to its own ambient credentials), and
     // resolve the host the client will actually connect to. We derive the *effective* endpoint here
@@ -376,20 +394,25 @@ async fn validate_object_storage_test(settings: &ObjectSettings) -> error::Resul
     let effective_endpoint: Option<String> = match settings {
         ObjectSettings::Filesystem(_) => {
             return Err(error::Error::NotAuthorized(
-                "Testing a local filesystem object store requires a super admin".to_string(),
+                "Testing a local filesystem object store requires a super admin: it runs on the \
+                 Windmill server and reads and writes the server's local disk. Ask a super admin \
+                 to run it."
+                    .to_string(),
             ));
         }
         ObjectSettings::AwsOidc(_) => {
-            return Err(error::Error::NotAuthorized(
-                "Testing OIDC-based object storage requires a super admin".to_string(),
-            ));
+            return Err(error::Error::NotAuthorized(format!(
+                "Testing OIDC-based object storage requires a super admin: it runs on the \
+                 Windmill server with the server's own identity. {ALTERNATIVE}"
+            )));
         }
         ObjectSettings::S3(s3) => {
             if !(non_empty(&s3.access_key) && non_empty(&s3.secret_key)) {
-                return Err(error::Error::NotAuthorized(
-                    "Testing S3 storage without explicit credentials requires a super admin"
-                        .to_string(),
-                ));
+                return Err(error::Error::NotAuthorized(format!(
+                    "Testing S3 storage without an explicit access key and secret key requires a \
+                     super admin: it runs on the Windmill server, which would use its own ambient \
+                     credentials. {ALTERNATIVE}"
+                )));
             }
             let region = s3
                 .region
@@ -413,10 +436,11 @@ async fn validate_object_storage_test(settings: &ObjectSettings) -> error::Resul
         }
         ObjectSettings::Azure(azure) => {
             if !non_empty(&azure.access_key) {
-                return Err(error::Error::NotAuthorized(
-                    "Testing Azure storage without an explicit access key requires a super admin"
-                        .to_string(),
-                ));
+                return Err(error::Error::NotAuthorized(format!(
+                    "Testing Azure storage without an explicit access key requires a super admin: \
+                     it runs on the Windmill server, which would use its own ambient credentials. \
+                     {ALTERNATIVE}"
+                )));
             }
             Some(
                 azure
@@ -432,10 +456,11 @@ async fn validate_object_storage_test(settings: &ObjectSettings) -> error::Resul
             // otherwise an untrusted caller could probe with the server's identity (the very
             // SSRF/credential-exfil this function guards against).
             if windmill_object_store::gcs_service_account_key_is_blank(&gcs.service_account_key) {
-                return Err(error::Error::NotAuthorized(
-                    "Testing GCS storage without a service account key requires a super admin"
-                        .to_string(),
-                ));
+                return Err(error::Error::NotAuthorized(format!(
+                    "Testing GCS storage without a service account key requires a super admin: \
+                     it runs on the Windmill server, which would use its own ambient credentials. \
+                     {ALTERNATIVE}"
+                )));
             }
             // The service-account-key JSON can override the data-plane URL (`gcs_base_url`) and the
             // OAuth token endpoint (`token_uri`); the GCS client connects to whatever they point at.
@@ -492,10 +517,15 @@ async fn validate_public_endpoint(endpoint: &str) -> error::Result<()> {
     // attempts (a name resolving to both a public and a private address).
     for addr in addrs {
         if is_forbidden_ip(addr.ip()) {
-            return Err(error::Error::NotAuthorized(
-                "Testing object storage at a private, loopback, or link-local endpoint requires a super admin"
-                    .to_string(),
-            ));
+            // The resolved address stays out of the message: it is the server's resolver's
+            // answer, and this message is only ever shown to the caller being constrained.
+            return Err(error::Error::NotAuthorized(format!(
+                "Testing object storage at '{host}', which resolves to a private, loopback, or \
+                 link-local address, requires a super admin: this test runs on the Windmill \
+                 server, which is not allowed to probe internal addresses for non-super-admins. \
+                 Ask a super admin to run it, or test the resource from a script, which runs on \
+                 a worker."
+            )));
         }
     }
     Ok(())
@@ -2008,7 +2038,10 @@ struct CachedResourceType {
     /// decodes the on-disk cache, where an absent key means "written before the
     /// column, leave the stored extension alone" and an explicit null means the hub
     /// dropped it. Plain serde folds both into `None`.
-    #[serde(default, deserialize_with = "windmill_common::more_serde::double_option")]
+    #[serde(
+        default,
+        deserialize_with = "windmill_common::more_serde::double_option"
+    )]
     format_extension: Option<Option<String>>,
 }
 
diff --git a/backend/windmill-api-users/src/users.rs b/backend/windmill-api-users/src/users.rs
index 8daa414b46..47b520736a 100644
--- a/backend/windmill-api-users/src/users.rs
+++ b/backend/windmill-api-users/src/users.rs
@@ -1239,6 +1239,7 @@ async fn leave_instance(Extension(db): Extension<DB>, authed: ApiAuthed) -> Resu
     sqlx::query!("DELETE FROM password WHERE email = $1", &authed.email)
         .execute(&mut *tx)
         .await?;
+    windmill_common::user_drafts::delete_drafts_of_email(&mut *tx, &authed.email).await?;
 
     audit_log(
         &mut *tx,
@@ -1661,6 +1662,7 @@ async fn delete_user(
     sqlx::query!("DELETE FROM password WHERE email = $1", &email_to_delete)
         .execute(&mut *tx)
         .await?;
+    windmill_common::user_drafts::delete_drafts_of_email(&mut *tx, &email_to_delete).await?;
 
     let usernames = sqlx::query_scalar!(
         "DELETE FROM usr WHERE email = $1 RETURNING username",
@@ -1869,7 +1871,7 @@ async fn change_user_email(
         .execute(&mut *tx)
         .await?;
 
-    // ---- account ---- (draft.email follows through its ON UPDATE CASCADE fkey)
+    // ---- account ----
     sqlx::query!(
         "UPDATE password SET email = $1 WHERE email = $2",
         &new_email,
@@ -1883,6 +1885,7 @@ async fn change_user_email(
         }
         _ => e.into(),
     })?;
+    windmill_common::user_drafts::rename_drafts_of_email(&mut *tx, &old_email, &new_email).await?;
 
     sqlx::query!(
         "UPDATE usr SET email = $1 WHERE email = $2",
@@ -3539,6 +3542,9 @@ async fn overwrite_global_users(
     require_super_admin(&db, &authed).await?;
     forbid_superadmin_job_token(&db, &authed.email, job_id).await?;
     let mut tx = db.begin().await?;
+    // Replaces the account table, so — unlike the paths that remove one account — it deliberately
+    // does not call `delete_drafts_of_email`: the addresses are about to be reinstated, and
+    // dropping every draft on the instance to restore accounts would be pure collateral.
     sqlx::query!("DELETE FROM password")
         .execute(&mut *tx)
         .await?;
diff --git a/backend/windmill-api-workspaces/src/workspaces.rs b/backend/windmill-api-workspaces/src/workspaces.rs
index c8c49416d8..cb5c639d46 100644
--- a/backend/windmill-api-workspaces/src/workspaces.rs
+++ b/backend/windmill-api-workspaces/src/workspaces.rs
@@ -12,6 +12,7 @@ use windmill_api_auth::{
 };
 use windmill_api_users::users::WorkspaceInvite;
 use windmill_common::email_oss::send_email_if_possible;
+use windmill_dep_map::lock_hash::record_lock_hashes_for_workspace;
 use windmill_common::usernames::{get_instance_username_or_create_pending, VALID_USERNAME};
 use windmill_common::webhook::WebhookShared;
 use windmill_common::{BASE_URL, DB};
@@ -5799,9 +5800,8 @@ async fn clone_workspace_data(
     // Clone the forker's own per-user drafts (plus the legacy NULL-email
     // workspace draft, if any) so they keep their pending edits in the
     // fork. Other users' drafts are intentionally NOT cloned — they don't
-    // own a `usr` row in the fork (see `clone_workspace_full`) so their
-    // drafts would dangle and the home-page `draft_users` aggregate would
-    // surface them as duplicate legacy entries.
+    // own a `usr` row in the fork (see `clone_workspace_full`), so those
+    // drafts would belong to someone the fork holds no membership for.
     clone_drafts(tx, source_workspace_id, target_workspace_id, &authed.email).await?;
 
     // Clone workspace runnable dependencies and dependency map
@@ -7140,7 +7140,16 @@ async fn clone_workspace_runnable_dependencies(
     .execute(&mut **tx)
     .await?;
 
-    // Clone dependency_map to preserve import relationships
+    // Recorded so the clone's own relocks have something to match; with no row they record NULL
+    // and nothing in it ever skips. Hashed from the locks the clone holds rather than copied from
+    // the source's rows, which are only as current as the last write to them: one left stale by a
+    // supplied lock deployed before this was recorded names a lock the clone no longer has, and an
+    // importer that resolved against the real one would then skip a relock it needed.
+    record_lock_hashes_for_workspace(tx, target_workspace_id).await?;
+
+    // Deliberately without `imported_lockfile_hash`: it records what an importer resolved against
+    // when it was last locked, which nothing here can establish for the version the clone got.
+    // Left NULL, every importer relocks once and re-anchors both sides to what the clone holds.
     sqlx::query!(
         "INSERT INTO dependency_map (workspace_id, importer_path, importer_kind, imported_path, importer_node_id)
          SELECT $1, importer_path, importer_kind, imported_path, importer_node_id
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 3daa0b6133..a27be7d295 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.800.1
+  version: 1.803.0
   title: Windmill API
 
   contact:
@@ -10456,7 +10456,7 @@ paths:
       summary: run script by path
       operationId: runScriptByPath
       x-mcp-tool: true
-      x-mcp-instructions: "You should first use getScriptByPath to retrieve the script's schema and understand what arguments are expected."
+      x-mcp-instructions: "You should first use getScriptByPath to retrieve the script's schema and understand what arguments are expected. A resource argument (schema format `resource-<type>`) is the bare string `$res:<path>` as that whole argument value -- not a wrapper object, not a plain path. A variable is `$var:<path>`."
       x-mcp-tool-include-query-params: []
       tags:
         - job
@@ -13814,7 +13814,7 @@ paths:
       summary: run flow by path
       operationId: runFlowByPath
       x-mcp-tool: true
-      x-mcp-instructions: "You should first use getFlowByPath to retrieve the flow's schema and understand what arguments are expected."
+      x-mcp-instructions: "You should first use getFlowByPath to retrieve the flow's schema and understand what arguments are expected. A resource argument (schema format `resource-<type>`) is the bare string `$res:<path>` as that whole argument value -- not a wrapper object, not a plain path. A variable is `$var:<path>`."
       x-mcp-tool-include-query-params: []
       tags:
         - job
@@ -27135,6 +27135,13 @@ components:
           type: object
           additionalProperties:
             $ref: "#/components/schemas/ModelPriceOverride"
+        copilot_disabled:
+          type: boolean
+          description: >-
+            Hides the Windmill AI assistant (chat, sessions, code generation, completion,
+            fixes) from the workspace UI. Read from the workspace's own settings even when
+            the providers served fall back to the instance config. AI agent steps and the
+            AI sandbox in flows are unaffected.
 
     FreeTierInfo:
       type: object
@@ -28987,6 +28994,8 @@ components:
             - "igroup.delete"
             - "igroup.adduser"
             - "igroup.removeuser"
+            - "instance_groups.jit_adduser"
+            - "instance_groups.jit_removeuser"
             - "variables.decrypt_secret"
             - "workspaces.read_encryption_key"
             - "workspaces.edit_command_script"
diff --git a/backend/windmill-api/src/ai.rs b/backend/windmill-api/src/ai.rs
index c684830b27..e70cc19544 100644
--- a/backend/windmill-api/src/ai.rs
+++ b/backend/windmill-api/src/ai.rs
@@ -445,6 +445,12 @@ pub struct AIConfig {
     /// Only models whose rates differ from the built-in table are stored.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub model_pricing: Option<HashMap<String, ModelPriceOverride>>,
+    /// Hides the Windmill AI assistant (chat, sessions, generation, completion, fixes) from
+    /// the workspace UI. Only the workspace's own row is consulted: the flag holds even when
+    /// the providers served come from the instance config or the free tier. AI agent steps
+    /// and the AI sandbox are unaffected, so the providers stay in force.
+    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
+    pub copilot_disabled: bool,
 }
 
 /// Negotiated rates in USD per million tokens. An unset cache rate is read as the
diff --git a/backend/windmill-api/src/apps.rs b/backend/windmill-api/src/apps.rs
index 7bc995844d..0d29c1c369 100644
--- a/backend/windmill-api/src/apps.rs
+++ b/backend/windmill-api/src/apps.rs
@@ -491,7 +491,8 @@ async fn list_apps(
               FROM draft d \
               LEFT JOIN usr u ON u.workspace_id = d.workspace_id AND u.email = d.email \
               LEFT JOIN password p ON p.email = d.email AND p.super_admin = true \
-              WHERE d.workspace_id = app.workspace_id AND d.path = app.path AND d.typ IN ('app', 'raw_app')) as draft_users",
+              WHERE d.workspace_id = app.workspace_id AND d.path = app.path AND d.typ IN ('app', 'raw_app') \
+                AND (d.email IS NULL OR u.username IS NOT NULL OR p.email IS NOT NULL)) as draft_users",
             "folder_labels(app.workspace_id, app.path) as inherited_labels",
         ])
         .left()
diff --git a/backend/windmill-api/src/drafts.rs b/backend/windmill-api/src/drafts.rs
index b44b0e64be..e5928f761e 100644
--- a/backend/windmill-api/src/drafts.rs
+++ b/backend/windmill-api/src/drafts.rs
@@ -214,6 +214,9 @@ fn list_drafts_query(all_users: bool) -> String {
     // row: fall back to their instance-derived username (`password.username`), or
     // their email when derivation is disabled (`password.username` is NULL). This
     // keeps the raw email out of the payload whenever a derived username exists.
+    // A null username means the legacy row downstream, so an owner that resolves to
+    // no name at all — an external JWT's subject has neither row — is dropped rather
+    // than surfaced as a second legacy entry.
     let draft_users = r#"CASE WHEN d.typ::text IN ('script', 'flow', 'app', 'raw_app') THEN (
                       SELECT json_agg(json_build_object('username', COALESCE(u.username, p.username, CASE WHEN p.email IS NOT NULL THEN du.email END))
                                       ORDER BY COALESCE(u.username, p.username, CASE WHEN p.email IS NOT NULL THEN du.email END) NULLS LAST)
@@ -221,6 +224,7 @@ fn list_drafts_query(all_users: bool) -> String {
                       LEFT JOIN usr u ON u.workspace_id = du.workspace_id AND u.email = du.email
                       LEFT JOIN password p ON p.email = du.email AND p.super_admin = true
                       WHERE du.workspace_id = d.workspace_id AND du.path = d.path AND du.typ = d.typ
+                        AND (du.email IS NULL OR u.username IS NOT NULL OR p.email IS NOT NULL)
                     ) ELSE NULL END"#;
     // Default lists the user's own drafts AND the legacy NULL-email rows; with
     // `all_users` the filter is dropped to list every workspace draft.
diff --git a/backend/windmill-api/src/jobs.rs b/backend/windmill-api/src/jobs.rs
index a30cffbfbf..53044ee020 100644
--- a/backend/windmill-api/src/jobs.rs
+++ b/backend/windmill-api/src/jobs.rs
@@ -18,6 +18,7 @@ use quick_cache::sync::Cache;
 use serde_json::value::RawValue;
 use serde_json::Value;
 use sha2::{Digest, Sha256};
+use std::borrow::Cow;
 use std::collections::HashMap;
 use std::str::FromStr;
 use std::sync::Arc;
@@ -108,6 +109,7 @@ use windmill_common::{
     flows::{add_virtual_items_if_necessary, resolve_maybe_value, FlowValue},
     jobs::{script_path_to_payload, CompletedJob, JobKind, JobPayload, QueuedJob, RawCode},
     oauth2::HmacSha256,
+    query_builders,
     scripts::{ScriptHash, ScriptLang},
     users::username_to_permissioned_as,
     utils::{not_found_if_none, now_from_db, paginate, require_admin, Pagination, StripPath},
@@ -8131,6 +8133,79 @@ pub async fn run_wait_result_flow_by_version(
     .await
 }
 
+/// Whether request-supplied SQL from an operator may run. Operators can only run deployed
+/// code, so a request their job token (`WM_TOKEN`) authenticates comes from code a
+/// non-operator authored. The job must still be running, and the request must have the
+/// shape `wmill.datatable()` sends (PostgreSQL against a `datatable://` database), so a
+/// WM_TOKEN that leaked into job logs cannot be replayed to reach another target while the
+/// job lives, in particular DuckDB, which runs in-process in the worker.
+///
+/// What it does permit is any statement against the workspace's data tables, writes and DDL
+/// included: the helper's body is an unrestricted SQL template and data tables carry no
+/// per-user ACL. Narrowing that is a separate decision from this exemption.
+///
+/// The database argument is only half the target: the executor honors a `-- database`
+/// directive in the SQL over it, and `-- s3` redirects the result set, so both are refused.
+/// Check them against the code the executor runs rather than the request's `content`, which
+/// is not the same string once a `WM_INTERNAL_DB` marker expands.
+async fn operator_may_run_datatable_query(
+    db: &DB,
+    w_id: &str,
+    job_id: Option<Uuid>,
+    language: Option<&ScriptLang>,
+    content: &str,
+    args: Option<&HashMap<String, Box<JsonRawValue>>>,
+) -> error::Result<bool> {
+    let Some(job_id) = job_id else {
+        return Ok(false);
+    };
+    if language != Some(&ScriptLang::Postgresql) {
+        return Ok(false);
+    }
+    // Parse the directives out of the code the executor actually runs: it expands a
+    // `WM_INTERNAL_DB` marker first, and a directive can be embedded in the expansion.
+    // An expansion that overrides the language would run something other than the SQL the
+    // language check above cleared, so it is refused along with a malformed marker.
+    let executed =
+        match query_builders::try_expand_internal_db_query(content, &ScriptLang::Postgresql) {
+            Some(Ok(expanded)) if expanded.language_override.is_none() => Cow::Owned(expanded.code),
+            Some(_) => return Ok(false),
+            None => Cow::Borrowed(content),
+        };
+    if windmill_parser_sql::parse_db_resource(&executed).is_some()
+        || !matches!(windmill_parser_sql::parse_s3_mode(&executed), Ok(None))
+    {
+        return Ok(false);
+    }
+    let targets_datatable = args
+        .and_then(|args| args.get("database"))
+        .and_then(|database| serde_json::from_str::<String>(database.get()).ok())
+        .is_some_and(|database| database.starts_with("datatable://"));
+    if !targets_datatable {
+        return Ok(false);
+    }
+    Ok(sqlx::query_scalar!(
+        "SELECT running AS \"running!\" FROM v2_job_queue WHERE id = $1 AND workspace_id = $2",
+        job_id,
+        w_id
+    )
+    .fetch_optional(db)
+    .await?
+    .unwrap_or(false))
+}
+
+/// The refusal an operator gets from a preview route. Inside a job the caller never ran a
+/// preview themselves, so name the one thing the job's token may do.
+fn operator_preview_refusal(job_id: Option<Uuid>) -> error::Error {
+    let reason = if job_id.is_some() {
+        "Operators cannot run preview jobs for security reasons: from inside a job, an \
+         operator may only run a wmill.datatable() query while that job is running"
+    } else {
+        "Operators cannot run preview jobs for security reasons"
+    };
+    error::Error::NotAuthorized(reason.to_string())
+}
+
 async fn run_preview_script(
     authed: ApiAuthed,
     Extension(db): Extension<DB>,
@@ -8142,9 +8217,20 @@ async fn run_preview_script(
     #[cfg(feature = "enterprise")]
     check_license_key_valid().await?;
     if authed.is_operator {
-        return Err(error::Error::NotAuthorized(
-            "Operators cannot run preview jobs for security reasons".to_string(),
-        ));
+        // A deferred run would outlive the running job the exemption keys off.
+        if run_query.get_scheduled_for(&db).await?.is_some()
+            || !operator_may_run_datatable_query(
+                &db,
+                &w_id,
+                authed.job_id,
+                preview.language.as_ref(),
+                preview.content.as_deref().unwrap_or_default(),
+                preview.args.as_ref(),
+            )
+            .await?
+        {
+            return Err(operator_preview_refusal(authed.job_id));
+        }
     }
     // Preview runs arbitrary, request-supplied code. require_path_read_access_for_preview
     // only checks folder/namespace *read* access (and is a no-op when path is null), so a
@@ -8239,13 +8325,21 @@ async fn run_inline_preview_script(
     Path(w_id): Path<String>,
     Json(preview): Json<PreviewInline>,
 ) -> error::Result<Response> {
-    // Same arbitrary-code class as run_preview_script: operators are blocked from
-    // running request-supplied code, and a narrowly-scoped token must not escape
-    // its scope through inline preview.
-    if authed.is_operator {
-        return Err(error::Error::NotAuthorized(
-            "Operators cannot run preview jobs for security reasons".to_string(),
-        ));
+    // Same arbitrary-code class as run_preview_script, and every worker and standalone
+    // server exposes this route, so an operator is refused on the same terms. A
+    // narrowly-scoped token must not escape its scope through inline preview either.
+    if authed.is_operator
+        && !operator_may_run_datatable_query(
+            &db,
+            &w_id,
+            job_id,
+            Some(&preview.language),
+            &preview.content,
+            preview.args.as_ref(),
+        )
+        .await?
+    {
+        return Err(operator_preview_refusal(job_id));
     }
     check_scopes(&authed, || format!("jobs:run"))?;
     if let Some(job_id) = job_id {
diff --git a/backend/windmill-api/src/lib.rs b/backend/windmill-api/src/lib.rs
index b6337351a4..054af0f2fa 100644
--- a/backend/windmill-api/src/lib.rs
+++ b/backend/windmill-api/src/lib.rs
@@ -452,15 +452,15 @@ pub async fn run_server(
     // unless they are allowed — hence a separate layer rather than widening the
     // one every other route shares. (`Mcp-Param-*` is only sent for tool inputs
     // annotated with `x-mcp-header`, which no tool here declares.)
+    //
+    // The request's own header list is mirrored rather than enumerated: a browser
+    // MCP client may send any custom name for a preprocessor to read, and no fixed
+    // list could cover them. Nothing is granted by echoing it: the origin is
+    // `Any`, so browsers never attach credentials, and the endpoint authenticates
+    // each request on its own.
     let mcp_cors = CorsLayer::new()
         .allow_methods([http::Method::GET, http::Method::POST, http::Method::DELETE])
-        .allow_headers([
-            http::header::CONTENT_TYPE,
-            http::header::AUTHORIZATION,
-            http::HeaderName::from_static("mcp-protocol-version"),
-            http::HeaderName::from_static("mcp-method"),
-            http::HeaderName::from_static("mcp-name"),
-        ])
+        .allow_headers(tower_http::cors::AllowHeaders::mirror_request())
         // The 401 challenge is how a client discovers where to authorize (RFC 9728),
         // and it is not a safelisted response header, so without this a browser
         // client sees an empty one and has no way to begin the OAuth flow.
diff --git a/backend/windmill-api/src/mcp/auto_generated_endpoints.rs b/backend/windmill-api/src/mcp/auto_generated_endpoints.rs
index 568ad854f9..aa2415f664 100644
--- a/backend/windmill-api/src/mcp/auto_generated_endpoints.rs
+++ b/backend/windmill-api/src/mcp/auto_generated_endpoints.rs
@@ -878,7 +878,7 @@ is, a different one moves it there and archives the old path"),
     EndpointTool {
         name: Cow::Borrowed("runScriptByPath"),
         description: Cow::Borrowed("run script by path"),
-        instructions: Cow::Borrowed("You should first use getScriptByPath to retrieve the script's schema and understand what arguments are expected."),
+        instructions: Cow::Borrowed("You should first use getScriptByPath to retrieve the script's schema and understand what arguments are expected. A resource argument (schema format `resource-<type>`) is the bare string `$res:<path>` as that whole argument value -- not a wrapper object, not a plain path. A variable is `$var:<path>`."),
         path: Cow::Borrowed("/w/{workspace}/jobs/run/p/{path}"),
         method: Cow::Borrowed("POST"),
         path_params_schema: Some(serde_json::json!({
@@ -1419,7 +1419,7 @@ is, a different one moves it there and archives the old path"),
     EndpointTool {
         name: Cow::Borrowed("runFlowByPath"),
         description: Cow::Borrowed("run flow by path"),
-        instructions: Cow::Borrowed("You should first use getFlowByPath to retrieve the flow's schema and understand what arguments are expected."),
+        instructions: Cow::Borrowed("You should first use getFlowByPath to retrieve the flow's schema and understand what arguments are expected. A resource argument (schema format `resource-<type>`) is the bare string `$res:<path>` as that whole argument value -- not a wrapper object, not a plain path. A variable is `$var:<path>`."),
         path: Cow::Borrowed("/w/{workspace}/jobs/run/f/{path}"),
         method: Cow::Borrowed("POST"),
         path_params_schema: Some(serde_json::json!({
diff --git a/backend/windmill-api/src/mcp/core.rs b/backend/windmill-api/src/mcp/core.rs
index 2b4350bcfe..480e3c0841 100644
--- a/backend/windmill-api/src/mcp/core.rs
+++ b/backend/windmill-api/src/mcp/core.rs
@@ -12,7 +12,9 @@ use windmill_mcp::common::transform::transform_property_keys;
 use windmill_mcp::common::types::{
     FlowInfo, HubScriptInfo, ResourceInfo, ResourceType, SchemaType, ScriptInfo, WorkspaceInfo,
 };
-use windmill_mcp::server::{BackendResult, EndpointTool, ErrorData, McpBackend, PathFilter};
+use windmill_mcp::server::{
+    BackendResult, EndpointTool, ErrorData, McpBackend, McpRequest, PathFilter,
+};
 
 use crate::auth::AuthCache;
 use crate::db::ApiAuthed;
@@ -214,8 +216,11 @@ impl McpBackend for WindmillBackend {
         workspace_id: &str,
         path: &str,
         args: Value,
+        request: &McpRequest<'_>,
     ) -> BackendResult<Value> {
-        let push_args = prepare_push_args(args);
+        let push_args = prepare_push_args(&self.db, workspace_id, path, false, args, request)
+            .await
+            .map_err(|e| ErrorData::internal_error(e.to_string(), None))?;
 
         let result = run_wait_result_script_by_path_internal(
             self.db.clone(),
@@ -238,8 +243,11 @@ impl McpBackend for WindmillBackend {
         workspace_id: &str,
         path: &str,
         args: Value,
+        request: &McpRequest<'_>,
     ) -> BackendResult<Value> {
-        let push_args = prepare_push_args(args);
+        let push_args = prepare_push_args(&self.db, workspace_id, path, true, args, request)
+            .await
+            .map_err(|e| ErrorData::internal_error(e.to_string(), None))?;
 
         let result = run_wait_result_flow_by_path_internal(
             self.db.clone(),
diff --git a/backend/windmill-api/src/mcp/utils.rs b/backend/windmill-api/src/mcp/utils.rs
index 94271bb662..65c8069b85 100644
--- a/backend/windmill-api/src/mcp/utils.rs
+++ b/backend/windmill-api/src/mcp/utils.rs
@@ -11,15 +11,19 @@ use serde_json::Value;
 use sql_builder::prelude::*;
 use windmill_common::auth::create_jwt_token;
 use windmill_common::db::{Authed, UserDB};
+use windmill_common::error::Error;
 use windmill_common::scripts::{get_full_hub_script_by_path, Schema};
+use windmill_common::triggers::{RunnableFormat, RunnableFormatVersion, TriggerKind};
 use windmill_common::utils::{query_elems_from_hub, StripPath};
 use windmill_common::worker::to_raw_value;
 use windmill_common::{DB, HUB_BASE_URL};
 use windmill_mcp::server::{
-    non_empty_body_fields, BackendResult, EndpointTool, ErrorData, PathFilter,
+    non_empty_body_fields, BackendResult, EndpointTool, ErrorData, McpRequest, PathFilter,
 };
 use windmill_mcp::{HubResponse, HubScriptInfo, ItemSchema, ResourceInfo, ResourceType};
+use windmill_trigger::trigger_helpers::{get_runnable_format, RunnableId};
 
+use crate::args::build_headers;
 use crate::db::ApiAuthed;
 use crate::HTTP_CLIENT;
 
@@ -641,7 +645,7 @@ fn selects_endpoint_tool(caller_scopes: &[String], tool: &str) -> bool {
         .is_ok_and(|config| config.endpoints.iter().any(|e| e == tool))
 }
 
-/// Create HTTP request with authentication
+/// Create HTTP request with authentication.
 pub async fn create_http_request(
     method: &str,
     url: &str,
@@ -702,17 +706,113 @@ pub async fn create_http_request(
         .map_err(|e| ErrorData::internal_error(format!("Failed to execute request: {}", e), None))
 }
 
-/// Convert a JSON Value into PushArgsOwned for job execution
-pub fn prepare_push_args(args: Value) -> windmill_queue::PushArgsOwned {
+/// The `kind` an MCP-invoked runnable sees on its preprocessor event, alongside
+/// `webhook`, `http` and the trigger kinds.
+const MCP_TRIGGER_KEY: &str = "mcp";
+
+/// A preprocessor's view of the MCP request that ran it. Mirrors the HTTP
+/// trigger event: `body` is what the model sent, everything else describes the
+/// call itself.
+#[derive(serde::Serialize)]
+struct McpPreprocessorEvent<'a> {
+    kind: &'a str,
+    body: Box<serde_json::value::RawValue>,
+    headers: HashMap<String, Box<serde_json::value::RawValue>>,
+    tool_name: &'a str,
+}
+
+/// Headers withheld from a preprocessor because they authenticate the connection.
+///
+/// Not a security boundary: a webhook preprocessor receives all three. Withheld
+/// because nothing needs them yet, and releasing one later is additive while
+/// withdrawing one after runnables read it is not.
+const WITHHELD_FROM_PREPROCESSOR: &[&str] = &["authorization", "cookie", "proxy-authorization"];
+
+/// Every header a preprocessor may see.
+fn preprocessor_headers(
+    headers: &http::HeaderMap,
+) -> HashMap<String, Box<serde_json::value::RawValue>> {
+    let mut selected = build_headers(headers, None, true);
+    selected.retain(|name, _| {
+        !WITHHELD_FROM_PREPROCESSOR
+            .iter()
+            .any(|withheld| withheld.eq_ignore_ascii_case(name))
+    });
+    selected
+}
+
+/// Build the job arguments for a script or flow run as an MCP tool.
+///
+/// Shaped by the runnable's own format: a preprocessor receives the request as
+/// an event, and a runnable without one receives only what the model sent.
+pub async fn prepare_push_args(
+    db: &DB,
+    w_id: &str,
+    path: &str,
+    is_flow: bool,
+    args: Value,
+    request: &McpRequest<'_>,
+) -> Result<windmill_queue::PushArgsOwned, Error> {
+    let mut main_args = HashMap::new();
     if let Value::Object(map) = args {
-        let mut args_hash = HashMap::new();
         for (k, v) in map {
-            args_hash.insert(k, to_raw_value(&v));
+            main_args.insert(k, to_raw_value(&v));
         }
-        windmill_queue::PushArgsOwned { extra: None, args: args_hash }
-    } else {
-        windmill_queue::PushArgsOwned::default()
     }
+
+    let runnable_id = if is_flow {
+        RunnableId::from_flow_path(path)
+    } else {
+        // Resolves a `hub/<version_id>` path to the hub script on its own.
+        RunnableId::from_script_path(path)
+    };
+
+    // MCP is not one of the `TRIGGER_KIND` enum values and does not need to be:
+    // the per-kind arms of the no-preprocessor heuristic are payload-shape
+    // special cases for message triggers, and `Webhook` reaches the same generic
+    // arm MCP wants while sharing that kind's format cache.
+    let runnable_format = get_runnable_format(runnable_id, w_id, db, &TriggerKind::Webhook).await?;
+
+    Ok(match runnable_format {
+        // Without a preprocessor there is nowhere for a header to go that the
+        // model does not also write: its arguments *are* the runnable's
+        // parameters, so a header bound to one of them would be a value the model
+        // could set. The request is reachable through a preprocessor, where it
+        // arrives in a key of the event the model never fills.
+        RunnableFormat { has_preprocessor: false, .. } => {
+            windmill_queue::PushArgsOwned { args: main_args, extra: None }
+        }
+        RunnableFormat { has_preprocessor: true, version } => {
+            let headers = preprocessor_headers(request.headers);
+            match version {
+                RunnableFormatVersion::V2 => {
+                    let event = McpPreprocessorEvent {
+                        kind: MCP_TRIGGER_KEY,
+                        body: to_raw_value(&main_args),
+                        headers,
+                        tool_name: request.tool_name,
+                    };
+                    windmill_queue::PushArgsOwned {
+                        args: HashMap::from([("event".to_string(), to_raw_value(&event))]),
+                        extra: None,
+                    }
+                }
+                RunnableFormatVersion::V1 => windmill_queue::PushArgsOwned {
+                    args: main_args,
+                    extra: Some(HashMap::from([(
+                        "wm_trigger".to_string(),
+                        to_raw_value(&serde_json::json!({
+                            "kind": MCP_TRIGGER_KEY,
+                            MCP_TRIGGER_KEY: {
+                                "headers": headers,
+                                "tool_name": request.tool_name,
+                            }
+                        })),
+                    )])),
+                },
+            }
+        }
+    })
 }
 
 /// Parse an HTTP response body into a JSON Value
diff --git a/backend/windmill-api/src/offboarding.rs b/backend/windmill-api/src/offboarding.rs
index a69441ea75..2998faa7f3 100644
--- a/backend/windmill-api/src/offboarding.rs
+++ b/backend/windmill-api/src/offboarding.rs
@@ -618,6 +618,7 @@ pub(crate) async fn offboard_global_user(
         sqlx::query!("DELETE FROM password WHERE email = $1", &email)
             .execute(&mut *tx)
             .await?;
+        windmill_common::user_drafts::delete_drafts_of_email(&mut *tx, &email).await?;
         sqlx::query!("DELETE FROM workspace_invite WHERE email = $1", &email)
             .execute(&mut *tx)
             .await?;
diff --git a/backend/windmill-api/src/runnables.rs b/backend/windmill-api/src/runnables.rs
index c145252251..ea6d0c5bba 100644
--- a/backend/windmill-api/src/runnables.rs
+++ b/backend/windmill-api/src/runnables.rs
@@ -261,7 +261,8 @@ fn branch_sqls() -> Branches {
               FROM draft d \
               LEFT JOIN usr u ON u.workspace_id = d.workspace_id AND u.email = d.email \
               LEFT JOIN password p ON p.email = d.email AND p.super_admin = true \
-              WHERE d.workspace_id = o.workspace_id AND d.path = o.path AND {typ_pred}) as draft_users"
+              WHERE d.workspace_id = o.workspace_id AND d.path = o.path AND {typ_pred} \
+                AND (d.email IS NULL OR u.username IS NOT NULL OR p.email IS NOT NULL)) as draft_users"
         )
     };
 
diff --git a/backend/windmill-api/src/workspaces.rs b/backend/windmill-api/src/workspaces.rs
index 76378e335a..da8532e9d1 100644
--- a/backend/windmill-api/src/workspaces.rs
+++ b/backend/windmill-api/src/workspaces.rs
@@ -146,6 +146,7 @@ async fn edit_copilot_config(
     .await?;
 
     let workspace_has_config = ai_config.has_providers();
+    let copilot_disabled = ai_config.copilot_disabled;
     let instance_ai_config =
         sqlx::query_scalar!("SELECT value FROM global_settings WHERE name = 'ai_config'")
             .fetch_optional(&db)
@@ -158,7 +159,7 @@ async fn edit_copilot_config(
         .as_ref()
         .and_then(|v| serde_json::from_value::<AIConfig>(v.clone()).ok())
         .filter(|c| c.has_providers());
-    let effective_ai_config = if workspace_has_config {
+    let mut effective_ai_config = if workspace_has_config {
         ai_config
     } else if let Some(instance_config) = instance_config_with_providers {
         instance_config
@@ -172,6 +173,7 @@ async fn edit_copilot_config(
     } else {
         AIConfig::default()
     };
+    effective_ai_config.copilot_disabled = copilot_disabled;
 
     Ok(Json(EditCopilotConfigResponse {
         effective_ai_config,
@@ -207,6 +209,9 @@ async fn get_copilot_info(
         ))
     })?;
 
+    let copilot_disabled = workspace_ai_config
+        .as_ref()
+        .is_some_and(|c| c.0.copilot_disabled);
     let instance_config =
         sqlx::query_scalar!("SELECT value FROM global_settings WHERE name = 'ai_config'")
             .fetch_optional(&db)
@@ -215,20 +220,23 @@ async fn get_copilot_info(
             // A provider-less instance config (e.g. `{}`) is unconfigured; don't let it shadow the
             // free-tier fallback, matching the proxy and edit_copilot_config paths.
             .filter(|c| c.has_providers());
-    if let Some(workspace_ai_config) = workspace_ai_config.filter(|c| c.0.has_providers()) {
-        Ok(Json(workspace_ai_config.0))
-    } else if let Some(instance_config) = instance_config {
-        Ok(Json(instance_config))
-    } else if let Some(free_config) =
-        crate::ai_free_tier_oss::free_tier_copilot_config(&db, &authed.email).await?
-    {
-        // Nothing configured: fall back to Windmill's free tier (EE-only). The config
-        // carries a `free_tier` marker even once the user's grant is spent — with no
-        // providers, but telling the client *why* AI is off.
-        Ok(Json(free_config))
-    } else {
-        Ok(Json(AIConfig::default()))
-    }
+    let mut effective =
+        if let Some(workspace_ai_config) = workspace_ai_config.filter(|c| c.0.has_providers()) {
+            workspace_ai_config.0
+        } else if let Some(instance_config) = instance_config {
+            instance_config
+        } else if let Some(free_config) =
+            crate::ai_free_tier_oss::free_tier_copilot_config(&db, &authed.email).await?
+        {
+            // Nothing configured: fall back to Windmill's free tier (EE-only). The config
+            // carries a `free_tier` marker even once the user's grant is spent — with no
+            // providers, but telling the client *why* AI is off.
+            free_config
+        } else {
+            AIConfig::default()
+        };
+    effective.copilot_disabled = copilot_disabled;
+    Ok(Json(effective))
 }
 
 #[cfg(feature = "enterprise")]
diff --git a/backend/windmill-common/src/global_settings.rs b/backend/windmill-common/src/global_settings.rs
index b1ad2edd01..d38396562b 100644
--- a/backend/windmill-common/src/global_settings.rs
+++ b/backend/windmill-common/src/global_settings.rs
@@ -94,6 +94,9 @@ pub const AUTOMATE_USERNAME_CREATION_SETTING: &str = "automate_username_creation
 pub const DISABLE_WORKSPACE_INVITE_EMAILS_SETTING: &str = "disable_workspace_invite_emails";
 pub const DISABLE_PASSWORD_LOGIN_SETTING: &str = "disable_password_login";
 pub const AUTO_LOGIN_PROVIDER_SETTING: &str = "auto_login_provider";
+/// Name of the SAML attribute or OIDC userinfo claim carrying the user's IdP groups. Unset or
+/// empty leaves instance-group membership entirely to SCIM.
+pub const SSO_GROUPS_CLAIM_SETTING: &str = "sso_groups_claim";
 pub const HUB_BASE_URL_SETTING: &str = "hub_base_url";
 pub const HUB_ACCESSIBLE_URL_SETTING: &str = "hub_accessible_url";
 pub const DISABLE_HUB_SETTING: &str = "disable_hub";
@@ -108,6 +111,7 @@ pub const JWT_SECRET_SETTING: &str = "jwt_secret";
 pub const EMAIL_DOMAIN_SETTING: &str = "email_domain";
 pub const OTEL_SETTING: &str = "otel";
 pub const OTEL_TRACING_PROXY_SETTING: &str = "otel_tracing_proxy";
+pub const OTEL_TRACES_RETENTION_SECS_SETTING: &str = "otel_traces_retention_secs";
 pub const APP_WORKSPACED_ROUTE_SETTING: &str = "app_workspaced_route";
 pub const HTTP_ROUTE_WORKSPACED_ROUTE_SETTING: &str = "http_route_workspaced_route";
 pub const SECRET_BACKEND_SETTING: &str = "secret_backend";
diff --git a/backend/windmill-common/src/lib.rs b/backend/windmill-common/src/lib.rs
index f1784e9841..b4128f80d2 100644
--- a/backend/windmill-common/src/lib.rs
+++ b/backend/windmill-common/src/lib.rs
@@ -148,43 +148,76 @@ pub const DEFAULT_MAX_CONNECTIONS_INDEXER: u32 = 5;
 pub const DEFAULT_HUB_BASE_URL: &str = "https://hub.windmill.dev";
 pub const PRIVATE_HUB_MIN_VERSION: i32 = 10_000_000;
 pub const DEFAULT_SERVICE_LOG_RETENTION_SECS: i64 = 60 * 60 * 24 * 14; // 2 weeks retention period for logs
+pub const DEFAULT_OTEL_TRACES_RETENTION_SECS: i64 = 60 * 60 * 24 * 7; // 1 week retention period for HTTP request spans
 pub const WM_DEPLOYERS_GROUP: &str = "wm_deployers";
 
 /// A century. Every consumer has to survive `now - retention`, and the ceilings are much lower
 /// than an `i64`: `DateTime` subtraction panics past year 262143, and the `(<n> s)::interval`
 /// the cleanup queries build overflows Postgres' microsecond field.
-const MAX_SERVICE_LOG_RETENTION_SECS: i64 = 60 * 60 * 24 * 365 * 100;
+const MAX_RETENTION_SECS: i64 = 60 * 60 * 24 * 365 * 100;
 
-/// Apply a configured service log retention, in seconds.
+/// Clamp a configured retention window, in seconds, to one a cutoff can be built from.
 ///
-/// The only way into [`SERVICE_LOG_RETENTION_SECS`], so an unusable value can never reach a
-/// cutoff. The two unusable directions are not the same mistake and must not share a landing
-/// point: too large still says "keep these for a very long time", so it is capped and the
-/// intent survives, whereas falling back would delete logs the operator meant to keep. A
-/// non-positive value has no such reading — every cutoff is `now - retention`, so it lands at
-/// or after `now` and the next sweep expires the entire history, rows and object-storage files
-/// alike. Unlike job retention there is no "keep forever" spelling here, so `0` — what an
-/// operator types by analogy with it, and what the settings UI writes into a field that was
-/// merely focused — falls back to the default.
-pub fn set_service_log_retention_secs(configured: i64) {
-    let effective = if configured > MAX_SERVICE_LOG_RETENTION_SECS {
+/// Shared by the retention windows that have no "keep forever" spelling, so that an unusable
+/// value can never reach a cutoff. The two unusable directions are not the same mistake and must
+/// not share a landing point: too large still says "keep these for a very long time", so it is
+/// capped and the intent survives, whereas falling back would delete data the operator meant to
+/// keep. A non-positive value has no such reading — every cutoff is `now - retention`, so it
+/// lands at or after `now` and the next sweep expires the entire history. `0` is both what an
+/// operator types by analogy with job retention, where it does mean keep forever, and what the
+/// settings UI writes into a field that was merely focused, so it falls back to the default.
+fn clamp_retention_secs(configured: i64, default: i64, what: &str) -> i64 {
+    if configured > MAX_RETENTION_SECS {
         tracing::warn!(
-            "service log retention of {configured}s exceeds the maximum of \
-             {MAX_SERVICE_LOG_RETENTION_SECS}s, capping it there"
+            "{what} retention of {configured}s exceeds the maximum of {MAX_RETENTION_SECS}s, \
+             capping it there"
         );
-        MAX_SERVICE_LOG_RETENTION_SECS
+        MAX_RETENTION_SECS
     } else if configured >= 1 {
         configured
     } else {
         tracing::warn!(
-            "service log retention of {configured}s would expire every service log, \
-             falling back to the default of {DEFAULT_SERVICE_LOG_RETENTION_SECS}s"
+            "{what} retention of {configured}s would expire the entire history, \
+             falling back to the default of {default}s"
         );
-        DEFAULT_SERVICE_LOG_RETENTION_SECS
-    };
+        default
+    }
+}
+
+/// Apply a configured service log retention, in seconds.
+///
+/// The only way into [`SERVICE_LOG_RETENTION_SECS`]. Expiry reaches every copy of a log line:
+/// the row, the file on disk, and the object-storage object.
+pub fn set_service_log_retention_secs(configured: i64) {
+    let effective = clamp_retention_secs(
+        configured,
+        DEFAULT_SERVICE_LOG_RETENTION_SECS,
+        "service log",
+    );
     SERVICE_LOG_RETENTION_SECS.store(effective, std::sync::atomic::Ordering::Relaxed);
 }
 
+/// Apply a configured OTEL trace retention, in seconds.
+///
+/// The only way into [`OTEL_TRACES_RETENTION_SECS`].
+pub fn set_otel_traces_retention_secs(configured: i64) {
+    let effective = clamp_retention_secs(
+        configured,
+        DEFAULT_OTEL_TRACES_RETENTION_SECS,
+        "otel traces",
+    );
+    OTEL_TRACES_RETENTION_SECS.store(effective, std::sync::atomic::Ordering::Relaxed);
+}
+
+/// How long an HTTP request tracing span stays in `otel_traces`, in seconds.
+///
+/// Spans are keyed by the job they were captured for and read back by the job detail view, so
+/// this is the outer bound on how far back that view can show a job's HTTP requests. It is
+/// independent of job retention: a span can outlive its job, or be swept while the job remains.
+pub fn otel_traces_retention_secs() -> i64 {
+    OTEL_TRACES_RETENTION_SECS.load(std::sync::atomic::Ordering::Relaxed)
+}
+
 /// How long a service log line stays retrievable, in seconds.
 ///
 /// The outer bound on everything service-log: the `log_file` rows, the raw files in object
@@ -423,6 +456,10 @@ lazy_static::lazy_static! {
     /// would expire every service log cannot reach a cutoff. Read it with
     /// [`service_log_retention_secs`].
     static ref SERVICE_LOG_RETENTION_SECS: AtomicI64 = AtomicI64::new(DEFAULT_SERVICE_LOG_RETENTION_SECS);
+    /// Private on purpose, same as [`SERVICE_LOG_RETENTION_SECS`]:
+    /// [`set_otel_traces_retention_secs`] is the only writer, [`otel_traces_retention_secs`] the
+    /// only reader.
+    static ref OTEL_TRACES_RETENTION_SECS: AtomicI64 = AtomicI64::new(DEFAULT_OTEL_TRACES_RETENTION_SECS);
 
     pub static ref MONITOR_LOGS_ON_OBJECT_STORE: AtomicBool = AtomicBool::new(false);
 
diff --git a/backend/windmill-common/src/scripts.rs b/backend/windmill-common/src/scripts.rs
index 31219621e9..d71bc50e60 100644
--- a/backend/windmill-common/src/scripts.rs
+++ b/backend/windmill-common/src/scripts.rs
@@ -358,31 +358,38 @@ pub async fn fetch_script_for_update<'a>(
     .map_err(crate::error::Error::from)
 }
 
-pub struct ClonedScript {
-    pub old_script: NewScript,
-    pub new_hash: i64,
-}
-// TODO: What if dependency job fails, there is script with NULL in the lock
-pub async fn clone_script<'c>(
-    path: &str,
-    w_id: &str,
+/// Deploys the outcome of a relative-import relock as a new version of `head`, the path's live
+/// version that the caller holds `FOR UPDATE`, and archives `head`. A `lock` of `None` records
+/// a failed generation: the version carries `lock_error_logs` instead and runs keep resolving
+/// to the last version that has a lock. A `modules` of `None` keeps the head's module locks.
+///
+/// Writes whatever `head` names and checks nothing: callers are responsible for having
+/// established access to its workspace and path, as a dependency job's push already has.
+///
+/// `created_at` is stamped when the insert runs, not at transaction start. The row lock on
+/// `head` is what orders one relock after another, and with `now()` a transaction that began
+/// first but locked second commits a live child older than its archived parent, which every
+/// "latest version" read then mis-orders.
+pub async fn deploy_relocked_version(
+    tx: &mut sqlx::Transaction<'_, sqlx::Postgres>,
+    head: Script<ScriptRunnableSettingsHandle>,
     deployment_message: Option<String>,
-    db: &DB,
-) -> crate::error::Result<ClonedScript> {
-    let mut tx = db.begin().await?;
-    let s = if let Some(s) = fetch_script_for_update(path, w_id, &mut *tx).await? {
-        s
-    } else {
-        return Err(crate::error::Error::NotFound(format!(
-            "Non-archived script with path '{}' not found",
-            path
-        )));
-    };
+    lock: Option<&str>,
+    modules: Option<&std::collections::HashMap<String, ScriptModule>>,
+    lock_error_logs: Option<&str>,
+) -> crate::error::Result<i64> {
+    let s = head;
+    let w_id = s.workspace_id.as_str();
 
-    let rs = runnable_settings::from_handle(s.runnable_settings.runnable_settings_handle, &mut *tx)
-        .await?;
+    let rs =
+        runnable_settings::from_handle(s.runnable_settings.runnable_settings_handle, &mut **tx)
+            .await?;
     let (debouncing_settings, concurrency_settings) =
-        runnable_settings::prefetch_cached_tx(&rs, &mut tx).await?;
+        runnable_settings::prefetch_cached_tx(&rs, &mut *tx).await?;
+
+    // What the row stores is what the hash covers: the new module locks when there are any.
+    let modules = modules.cloned().or(s.modules);
+    let modules_json = modules.as_ref().map(serde_json::to_value).transpose()?;
 
     let ns = NewScript {
         path: s.path.clone(),
@@ -392,7 +399,7 @@ pub async fn clone_script<'c>(
         content: s.content,
         schema: s.schema,
         is_template: s.is_template,
-        lock: None,
+        lock: lock.map(str::to_string),
         language: s.language,
         kind: Some(s.kind),
         tag: s.tag,
@@ -424,7 +431,7 @@ pub async fn clone_script<'c>(
         on_behalf_of: s.on_behalf_of,
         preserve_on_behalf_of: None,
         assets: s.assets,
-        modules: s.modules,
+        modules,
         auto_parent: None,
         labels: s.labels,
         skip_draft_deletion: None,
@@ -433,7 +440,7 @@ pub async fn clone_script<'c>(
     let new_hash = hash_script(&ns);
 
     tracing::debug!(
-        "cloning script at path {} from '{}' to '{}'",
+        "deploying relocked version of script at path {} from '{}' to '{}'",
         s.path,
         *s.hash,
         new_hash
@@ -446,17 +453,19 @@ pub async fn clone_script<'c>(
     envs, concurrent_limit, concurrency_time_window_s, cache_ttl, cache_ignore_s3_path, \
     dedicated_worker, ws_error_handler_muted, priority, restart_unless_cancelled, \
     delete_after_use, delete_after_secs, timeout, concurrency_key, visible_to_runner_only, auto_kind, \
-    codebase, has_preprocessor, on_behalf_of, on_behalf_of_email, schema_validation, assets, debounce_key, debounce_delay_s, runnable_settings_handle, modules, labels)
+    codebase, has_preprocessor, on_behalf_of, on_behalf_of_email, schema_validation, assets, debounce_key, debounce_delay_s, runnable_settings_handle, modules, labels, \
+    lock_error_logs, created_at)
 
     SELECT  workspace_id, $1, path, array_prepend($2::bigint, COALESCE(parent_hashes, '{}'::bigint[])), summary, description, \
-            content, created_by, schema, is_template, extra_perms, NULL, language, kind, tag, \
+            content, created_by, schema, is_template, extra_perms, $4::text, language, kind, tag, \
             envs, concurrent_limit, concurrency_time_window_s, cache_ttl, cache_ignore_s3_path, \
             dedicated_worker, ws_error_handler_muted, priority, restart_unless_cancelled, \
             delete_after_use, delete_after_secs, timeout, concurrency_key, visible_to_runner_only, auto_kind, \
-            codebase, has_preprocessor, on_behalf_of, on_behalf_of_email, schema_validation, assets, debounce_key, debounce_delay_s, runnable_settings_handle, modules, labels
+            codebase, has_preprocessor, on_behalf_of, on_behalf_of_email, schema_validation, assets, debounce_key, debounce_delay_s, runnable_settings_handle, COALESCE($5::jsonb, modules), labels, \
+            $6::text, clock_timestamp()
 
     FROM script WHERE hash = $2 AND workspace_id = $3;
-            ", new_hash, s.hash.0, w_id).execute(&mut *tx).await?;
+            ", new_hash, s.hash.0, w_id, lock, modules_json, lock_error_logs).execute(&mut **tx).await?;
 
     // Archive base.
     sqlx::query!(
@@ -464,9 +473,8 @@ pub async fn clone_script<'c>(
         *s.hash,
         w_id
     )
-    .execute(&mut *tx)
+    .execute(&mut **tx)
     .await?;
 
-    tx.commit().await?;
-    Ok(ClonedScript { old_script: ns, new_hash })
+    Ok(new_hash)
 }
diff --git a/backend/windmill-common/src/user_drafts.rs b/backend/windmill-common/src/user_drafts.rs
index 84a0e8c3ea..115dae34e7 100644
--- a/backend/windmill-common/src/user_drafts.rs
+++ b/backend/windmill-common/src/user_drafts.rs
@@ -245,7 +245,9 @@ async fn fetch_other_drafts_users(
     // row: fall back to their instance-derived username (`password.username`), or
     // their email when derivation is disabled. Else a real teammate's draft renders
     // as a phantom "Legacy draft". The genuine NULL-email legacy row keeps
-    // `username = None` (no `usr`/`password` match and `d.email` is NULL).
+    // `username = None` (no `usr`/`password` match and `d.email` is NULL), which is
+    // why an owner that resolves to no name at all — an external JWT's subject has
+    // neither row — is dropped instead: `None` is taken to mean "legacy" downstream.
     let rows = sqlx::query_as!(
         OtherDraftUser,
         r#"SELECT COALESCE(u.username, p.username, CASE WHEN p.email IS NOT NULL THEN d.email END) as "username?",
@@ -261,6 +263,7 @@ async fn fetch_other_drafts_users(
              AND d.path = $2
              AND d.typ = $3
              AND (d.email IS NULL OR d.email <> $4)
+             AND (d.email IS NULL OR u.username IS NOT NULL OR p.email IS NOT NULL)
            ORDER BY d.email NULLS LAST"#,
         w_id,
         path,
@@ -426,6 +429,67 @@ pub async fn overlay_or_draft_only<T: serde::Serialize + Send + 'static>(
     }
 }
 
+/// Delete the drafts an address owns, across every workspace.
+///
+/// `draft.email` carries no foreign key to `password`: a draft's owner is any principal the
+/// instance authenticates, and an external JWT's subject never has a `password` row. Deleting an
+/// account is therefore what has to delete its drafts — a delete path that skips this leaves them
+/// behind forever, addressed to someone who no longer exists. Call it in the same transaction as
+/// the account removal.
+///
+/// No authorization of its own: it acts instance-wide on whatever address it is handed, so the
+/// caller must already have authorized removing that account (superadmin, the account's own
+/// holder, or SCIM).
+pub async fn delete_drafts_of_email<'c>(
+    executor: impl sqlx::PgExecutor<'c>,
+    email: &str,
+) -> Result<()> {
+    sqlx::query!("DELETE FROM draft WHERE email = $1", email)
+        .execute(executor)
+        .await?;
+    Ok(())
+}
+
+/// Move the drafts an address owns onto its new address, for the same reason
+/// [`delete_drafts_of_email`] exists: no foreign key follows the rename, so drafts left behind are
+/// stranded on an address that no longer authenticates. Same authorization contract, for a rename.
+///
+/// The two addresses may each already hold a draft of the same item, since the destination can
+/// belong to a principal with no account and so is not covered by the caller's "address is free"
+/// check. `draft_pkey_with_user` admits only one, so the moving account's wins — which is also why
+/// a rename onto the same address returns early: every row would collide with itself and be
+/// cleared. Callers need not compare first (an IdP re-sending an unchanged `userName` does not).
+pub async fn rename_drafts_of_email(
+    conn: &mut sqlx::PgConnection,
+    old_email: &str,
+    new_email: &str,
+) -> Result<()> {
+    if old_email == new_email {
+        return Ok(());
+    }
+    sqlx::query!(
+        "DELETE FROM draft dest
+         WHERE dest.email = $1
+           AND EXISTS (SELECT 1 FROM draft src
+                       WHERE src.email = $2
+                         AND src.workspace_id = dest.workspace_id
+                         AND src.path = dest.path
+                         AND src.typ = dest.typ)",
+        new_email,
+        old_email
+    )
+    .execute(&mut *conn)
+    .await?;
+    sqlx::query!(
+        "UPDATE draft SET email = $1 WHERE email = $2",
+        new_email,
+        old_email
+    )
+    .execute(&mut *conn)
+    .await?;
+    Ok(())
+}
+
 /// Delete EVERY user's draft (and the legacy NULL-email row) at a path+kind.
 /// Use when the item is DELETED outright: it's gone for everyone, so leaving
 /// teammates' drafts behind would orphan them forever. Discarding one's OWN
diff --git a/backend/windmill-common/src/workspaces.rs b/backend/windmill-common/src/workspaces.rs
index c1d8fc00bc..697fc69e44 100644
--- a/backend/windmill-common/src/workspaces.rs
+++ b/backend/windmill-common/src/workspaces.rs
@@ -175,7 +175,7 @@ pub enum ObjectType {
     DatatableMigration,
 }
 
-pub const LATEST_GIT_SYNC_SCRIPT_PATH: &str = "hub/28911/sync-script-to-git-repo-windmill";
+pub const LATEST_GIT_SYNC_SCRIPT_PATH: &str = "hub/28931/sync-script-to-git-repo-windmill";
 
 /// Hub script that applies a repository's state back into a workspace
 /// (the repo → Windmill / "pull" direction). Same script the UI runs from
@@ -183,7 +183,7 @@ pub const LATEST_GIT_SYNC_SCRIPT_PATH: &str = "hub/28911/sync-script-to-git-repo
 /// ignores the slug, so the slug is kept free of characters that would be
 /// percent-encoded into the run URL (a `:` becomes `%3A`, which some hardened
 /// reverse proxies reject as double-encoding when the client re-encodes it).
-pub const GIT_SYNC_PULL_SCRIPT_PATH: &str = "hub/28910/git-sync-init-repository-windmill";
+pub const GIT_SYNC_PULL_SCRIPT_PATH: &str = "hub/28930/git-sync-init-repository-windmill";
 
 /// Prefix used to identify fork workspaces. A workspace whose id starts with this string is a
 /// fork of another workspace.
diff --git a/backend/windmill-common/tests/user_drafts_rename.rs b/backend/windmill-common/tests/user_drafts_rename.rs
new file mode 100644
index 0000000000..35d2b53858
--- /dev/null
+++ b/backend/windmill-common/tests/user_drafts_rename.rs
@@ -0,0 +1,28 @@
+use sqlx::{Pool, Postgres};
+use windmill_common::user_drafts::rename_drafts_of_email;
+
+/// A rename onto the same address has to be a no-op: the helper clears a draft the destination
+/// already holds at the same item, and every row would be its own destination. SCIM PATCH sends
+/// `userName` unconditionally, so an IdP re-sending an unchanged one reaches this.
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn renaming_onto_the_same_address_keeps_the_drafts(db: Pool<Postgres>) {
+    sqlx::query(
+        "INSERT INTO draft(workspace_id, path, typ, value, email) \
+         VALUES ('test-workspace', 'u/test-user/s', 'script', '{}'::json, 'test@windmill.dev')",
+    )
+    .execute(&db)
+    .await
+    .expect("failed to seed draft");
+
+    let mut conn = db.acquire().await.unwrap();
+    rename_drafts_of_email(&mut conn, "test@windmill.dev", "test@windmill.dev")
+        .await
+        .unwrap();
+
+    let kept: i64 =
+        sqlx::query_scalar("SELECT COUNT(*) FROM draft WHERE email = 'test@windmill.dev'")
+            .fetch_one(&db)
+            .await
+            .unwrap();
+    assert_eq!(kept, 1);
+}
diff --git a/backend/windmill-dep-map/Cargo.toml b/backend/windmill-dep-map/Cargo.toml
index 28b8552e8e..a93376d167 100644
--- a/backend/windmill-dep-map/Cargo.toml
+++ b/backend/windmill-dep-map/Cargo.toml
@@ -26,4 +26,5 @@ tracing.workspace = true
 lazy_static.workspace = true
 chrono.workspace = true
 itertools.workspace = true
+futures.workspace = true
 uuid.workspace = true
diff --git a/backend/windmill-dep-map/src/lib.rs b/backend/windmill-dep-map/src/lib.rs
index ee6a3c3fd4..aab50795a9 100644
--- a/backend/windmill-dep-map/src/lib.rs
+++ b/backend/windmill-dep-map/src/lib.rs
@@ -1,6 +1,7 @@
 pub mod ci_tests;
 #[cfg(feature = "private")]
 pub mod ci_tests_ee;
+pub mod lock_hash;
 pub mod scoped_dependency_map;
 pub mod trigger_dependents;
 pub mod workspace_dependencies;
@@ -127,6 +128,40 @@ pub fn extract_referenced_paths(
     }
 }
 
+/// Re-records which paths `script_path` imports and what each one's lock hashes to right now.
+/// That snapshot is what a later relock-skip check of this importer compares against, so it
+/// has to move whenever the imports may have, whether or not the importer's own lock did.
+///
+/// Writes for any path in `w_id` and checks nothing: callers are responsible for having
+/// established access to that workspace and script, as a dependency job's push already has.
+pub async fn refresh_dependency_map(
+    db: &sqlx::Pool<sqlx::Postgres>,
+    w_id: &str,
+    script_path: &str,
+    parent_path: &Option<String>,
+    code: &str,
+    script_lang: &Option<ScriptLang>,
+) -> error::Result<()> {
+    use scoped_dependency_map::ScopedDependencyMap;
+
+    let mut tx = db.begin().await?;
+    let mut dependency_map =
+        ScopedDependencyMap::fetch_maybe_rearranged(w_id, script_path, "script", parent_path, db)
+            .await?;
+
+    tx = dependency_map
+        .patch(
+            extract_referenced_paths(code, script_path, *script_lang),
+            // Ideally should be None, but due to current implementation will use empty string to represent None.
+            "".into(),
+            tx,
+        )
+        .await?;
+
+    dependency_map.dissolve(tx).await.commit().await?;
+    Ok(())
+}
+
 pub async fn process_relative_imports(
     db: &sqlx::Pool<sqlx::Postgres>,
     _job_id: Option<Uuid>,
@@ -144,29 +179,7 @@ pub async fn process_relative_imports(
     use scoped_dependency_map::ScopedDependencyMap;
     use trigger_dependents::trigger_dependents_to_recompute_dependencies;
 
-    // TODO: Should be moved into handle_dependency_job body to be more consistent with how flows and apps are handled
-    {
-        let mut tx = db.begin().await?;
-        let mut dependency_map = ScopedDependencyMap::fetch_maybe_rearranged(
-            &w_id,
-            script_path,
-            "script",
-            &parent_path,
-            db,
-        )
-        .await?;
-
-        tx = dependency_map
-            .patch(
-                extract_referenced_paths(&code, script_path, *script_lang),
-                // Ideally should be None, but due to current implementation will use empty string to represent None.
-                "".into(),
-                tx,
-            )
-            .await?;
-
-        dependency_map.dissolve(tx).await.commit().await?;
-    }
+    refresh_dependency_map(db, w_id, script_path, &parent_path, code, script_lang).await?;
 
     {
         let mut already_visited = args
diff --git a/backend/windmill-dep-map/src/lock_hash.rs b/backend/windmill-dep-map/src/lock_hash.rs
new file mode 100644
index 0000000000..50bd18a8ee
--- /dev/null
+++ b/backend/windmill-dep-map/src/lock_hash.rs
@@ -0,0 +1,79 @@
+use std::collections::HashMap;
+
+use futures::TryStreamExt;
+use sqlx::{Postgres, Transaction};
+use windmill_common::error::Result;
+use windmill_common::scripts::hash_script;
+
+/// Records what the lock now at each path hashes to, which is one half of the comparison a relock
+/// skip makes against what each importer resolved against.
+///
+/// Writes any path in `w_id` and checks nothing: callers are responsible for having established
+/// the caller's access to that workspace. A path repeated in `entries` keeps its last hash.
+///
+/// Callers that write the lock itself in the same statement fold the upsert into that statement
+/// instead; this is for the ones with nothing to fold it into.
+pub async fn record_lock_hashes(
+    tx: &mut Transaction<'_, Postgres>,
+    w_id: &str,
+    entries: &[(String, i64)],
+) -> Result<()> {
+    // Postgres rejects a whole statement that resolves a conflict on one key twice, so a path
+    // given more than once keeps its last hash, as it would if the two were written in order.
+    let mut deduped: HashMap<&str, i64> = HashMap::with_capacity(entries.len());
+    for (path, hash) in entries {
+        deduped.insert(path.as_str(), *hash);
+    }
+    if deduped.is_empty() {
+        return Ok(());
+    }
+    let (paths, hashes): (Vec<String>, Vec<i64>) = deduped
+        .into_iter()
+        .map(|(path, hash)| (path.to_string(), hash))
+        .unzip();
+    // Recording a hash a path already has would still cut a row version, and the no-op push this
+    // is reached from is the mode a git-sync of an unchanged workspace runs in.
+    sqlx::query!(
+        "INSERT INTO lock_hash (workspace_id, path, lockfile_hash)
+         SELECT $1, * FROM UNNEST($2::text[], $3::bigint[])
+         ON CONFLICT (workspace_id, path) DO UPDATE SET lockfile_hash = EXCLUDED.lockfile_hash
+         WHERE lock_hash.lockfile_hash IS DISTINCT FROM EXCLUDED.lockfile_hash",
+        w_id,
+        &paths[..],
+        &hashes[..]
+    )
+    .execute(&mut **tx)
+    .await?;
+    Ok(())
+}
+
+/// Records the hash of every live lock in `w_id`, for a workspace whose scripts arrived without
+/// going through a deploy — a clone, which copies their locks verbatim and so would otherwise hold
+/// none of the hashes describing them.
+///
+/// Carries the same caller obligation as [`record_lock_hashes`].
+///
+/// `script.lock` is unbounded and a workspace holds one per script, so the rows are streamed and
+/// each lock is hashed and dropped before the next arrives; only the hashes accumulate.
+pub async fn record_lock_hashes_for_workspace(
+    tx: &mut Transaction<'_, Postgres>,
+    w_id: &str,
+) -> Result<()> {
+    let mut entries: Vec<(String, i64)> = Vec::new();
+    {
+        let mut rows = sqlx::query!(
+            "SELECT DISTINCT ON (path) path, lock FROM script
+             WHERE workspace_id = $1 AND NOT archived AND NOT deleted AND lock IS NOT NULL
+             ORDER BY path, created_at DESC",
+            w_id
+        )
+        .fetch(&mut **tx);
+
+        while let Some(row) = rows.try_next().await? {
+            if let Some(lock) = row.lock {
+                entries.push((row.path, hash_script(&lock)));
+            }
+        }
+    }
+    record_lock_hashes(tx, w_id, &entries).await
+}
diff --git a/backend/windmill-mcp/src/common/schema.rs b/backend/windmill-mcp/src/common/schema.rs
index 3f88f7e781..d49fa468ae 100644
--- a/backend/windmill-mcp/src/common/schema.rs
+++ b/backend/windmill-mcp/src/common/schema.rs
@@ -101,7 +101,7 @@ fn apply_resource_enrichment(
     let resources_count = resource_cache.len();
     let description = match resource_type {
         Some(rt) => format!(
-            "This is a resource named `{}` with the following description: `{}`.\\nThe path of the resource should be used to specify the resource.\\n{}",
+            "This is a resource named `{}` with the following description: `{}`.\nPass it as the bare string `$res:<path>` — the whole value of this argument, never an object wrapper like {{\"$res\": \"<path>\"}} and never a plain path.\n{}",
             rt.name,
             rt.description.as_deref().unwrap_or("No description"),
             if resources_count == 0 {
@@ -138,7 +138,7 @@ fn apply_resource_enrichment(
                 )
             })
             .collect::<Vec<String>>()
-            .join("\\n");
+            .join("\n");
         let prior_description = prop_map
             .get("description")
             .and_then(Value::as_str)
@@ -147,7 +147,7 @@ fn apply_resource_enrichment(
         prop_map.insert(
             "description".to_string(),
             Value::String(format!(
-                "{}\\nHere are the available resources, in the format title:path. Title can be empty. Path should be used to specify the resource:\\n{}",
+                "{}\nHere are the available resources, one per line as `title: $res:path`. The title is only a label; pass the `$res:path` part verbatim as this argument's value:\n{}",
                 prior_description, resources_description
             )),
         );
@@ -804,6 +804,10 @@ mod tests {
         let desc = node["description"].as_str().unwrap();
         assert!(desc.contains("c_aws_account"));
         assert!(desc.contains("$res:f/platform/aws_dev"));
+        // MCP clients render this description verbatim, so the separators must be
+        // real newlines rather than the two-character escape.
+        assert!(desc.contains('\n'));
+        assert!(!desc.contains("\\n"));
     }
 
     #[test]
diff --git a/backend/windmill-mcp/src/server/backend.rs b/backend/windmill-mcp/src/server/backend.rs
index e42c0dacfc..7ca1eb08a1 100644
--- a/backend/windmill-mcp/src/server/backend.rs
+++ b/backend/windmill-mcp/src/server/backend.rs
@@ -16,6 +16,14 @@ use crate::server::endpoints::EndpointTool;
 /// Result type for backend operations using rmcp's ErrorData directly
 pub type BackendResult<T> = Result<T, ErrorData>;
 
+/// What the backend needs about the HTTP request a tool call arrived on, in order
+/// to hand a runnable the headers of the call that triggered it.
+pub struct McpRequest<'a> {
+    pub headers: &'a http::HeaderMap,
+    /// The MCP tool name the caller invoked, reported to preprocessors.
+    pub tool_name: &'a str,
+}
+
 /// How a script/flow listing is narrowed by path at the SQL layer, *before* the
 /// `ITEMS_FETCH_MAX_LIMIT` cap applies.
 ///
@@ -157,6 +165,7 @@ pub trait McpBackend: Send + Sync + Clone + 'static {
         workspace_id: &str,
         path: &str,
         args: Value,
+        request: &McpRequest<'_>,
     ) -> BackendResult<Value>;
 
     /// Run a flow and wait for result
@@ -166,6 +175,7 @@ pub trait McpBackend: Send + Sync + Clone + 'static {
         workspace_id: &str,
         path: &str,
         args: Value,
+        request: &McpRequest<'_>,
     ) -> BackendResult<Value>;
 
     /// Call an endpoint tool (generated API endpoint)
diff --git a/backend/windmill-mcp/src/server/mod.rs b/backend/windmill-mcp/src/server/mod.rs
index b6fb7a5b0a..b97e374e98 100644
--- a/backend/windmill-mcp/src/server/mod.rs
+++ b/backend/windmill-mcp/src/server/mod.rs
@@ -12,7 +12,7 @@ pub mod tools;
 
 // Re-export main types
 pub use crate::common::types::{McpToken, MultiWorkspaceMcp, WorkspaceInfo};
-pub use backend::{BackendResult, McpAuth, McpBackend, PathFilter};
+pub use backend::{BackendResult, McpAuth, McpBackend, McpRequest, PathFilter};
 pub use endpoints::{
     endpoint_tool_to_mcp_tool, endpoint_tool_to_mcp_tool_multi, is_endpoint_read_only,
     list_workspaces_tool, non_empty_body_fields, EndpointTool,
diff --git a/backend/windmill-mcp/src/server/runner.rs b/backend/windmill-mcp/src/server/runner.rs
index f407504c4b..e27eaa8470 100644
--- a/backend/windmill-mcp/src/server/runner.rs
+++ b/backend/windmill-mcp/src/server/runner.rs
@@ -9,8 +9,10 @@ use crate::common::transform::{
     extract_hub_version_id_from_hashed, extract_path_prefix_from_hashed, parse_tool_prefix,
     reverse_transform, reverse_transform_key,
 };
-use crate::common::types::{McpToken, MultiWorkspaceMcp, ResourceInfo, ToolableItem, WorkspaceId};
-use crate::server::backend::{McpAuth, McpBackend, PathFilter};
+use crate::common::types::{
+    McpToken, MultiWorkspaceMcp, ResourceInfo, SchemaType, ToolableItem, WorkspaceId,
+};
+use crate::server::backend::{McpAuth, McpBackend, McpRequest, PathFilter};
 use crate::server::endpoints::{
     endpoint_tool_to_mcp_tool, endpoint_tool_to_mcp_tool_multi, list_workspaces_tool, EndpointTool,
 };
@@ -101,16 +103,24 @@ enum McpMode {
     Multi(String),
 }
 
+/// Everything a request carries besides its MCP payload.
+struct McpContext<A> {
+    auth: A,
+    mode: McpMode,
+    headers: http::HeaderMap,
+}
+
 impl<B: McpBackend> Runner<B> {
     /// Create a new Runner with the given backend
     pub fn new(backend: B) -> Self {
         Self { backend: Arc::new(backend) }
     }
 
-    /// Extract authentication and the workspace mode from request context
+    /// Extract authentication, the workspace mode and the HTTP request itself
+    /// from the request context
     fn extract_context(
         context: &RequestContext<RoleServer>,
-    ) -> Result<(B::Auth, McpMode), ErrorData> {
+    ) -> Result<McpContext<B::Auth>, ErrorData> {
         let http_parts = context.extensions.get::<HttpParts>().ok_or_else(|| {
             tracing::error!("http::request::Parts not found");
             ErrorData::internal_error("http::request::Parts not found", None)
@@ -148,7 +158,7 @@ impl<B: McpBackend> Runner<B> {
             McpMode::Single(workspace_id)
         };
 
-        Ok((auth.clone(), mode))
+        Ok(McpContext { auth: auth.clone(), mode, headers: http_parts.headers.clone() })
     }
 }
 
@@ -391,6 +401,18 @@ fn authorize_endpoint_call(
     Ok(())
 }
 
+/// Map the model's argument keys back to the runnable's original parameter names.
+fn transform_call_args(args: Value, item_schema: &Option<SchemaType>) -> Value {
+    let Value::Object(map) = args else {
+        return args;
+    };
+    let mut args_hash = HashMap::new();
+    for (k, v) in map {
+        args_hash.insert(reverse_transform_key(&k, item_schema), v);
+    }
+    Value::Object(args_hash.into_iter().collect())
+}
+
 fn find_matching_path<T: ToolableItem>(candidates: Vec<T>, request_name: &str) -> Option<String> {
     candidates
         .into_iter()
@@ -427,7 +449,7 @@ impl<B: McpBackend> ServerHandler for Runner<B> {
         _request: Option<PaginatedRequestParams>,
         context: RequestContext<RoleServer>,
     ) -> Result<ListToolsResult, ErrorData> {
-        let (auth, mode) = Self::extract_context(&context)?;
+        let McpContext { auth, mode, .. } = Self::extract_context(&context)?;
 
         // Parse MCP scopes to determine what to expose
         let scopes = auth.scopes().unwrap_or(&[]);
@@ -455,7 +477,7 @@ impl<B: McpBackend> ServerHandler for Runner<B> {
         request: CallToolRequestParams,
         context: RequestContext<RoleServer>,
     ) -> Result<CallToolResponse, ErrorData> {
-        let (auth, mode) = Self::extract_context(&context)?;
+        let McpContext { auth, mode, headers } = Self::extract_context(&context)?;
 
         // Parse MCP scopes for authorization
         let scopes = auth.scopes().unwrap_or(&[]);
@@ -464,6 +486,7 @@ impl<B: McpBackend> ServerHandler for Runner<B> {
         let read_only = auth.read_only();
 
         let args = request.arguments.map(Value::Object).unwrap_or(Value::Null);
+        let mcp_request = McpRequest { headers: &headers, tool_name: request.name.as_ref() };
 
         // Every tool here runs to completion in one round trip: none of them ask the
         // client for input, so the MRTR variants of `CallToolResponse` are never built.
@@ -474,14 +497,22 @@ impl<B: McpBackend> ServerHandler for Runner<B> {
                     &workspace_id,
                     &scope_config,
                     read_only,
-                    request.name,
+                    request.name.clone(),
                     args,
+                    &mcp_request,
                 )
                 .await
             }
             McpMode::Multi(token) => {
-                self.call_tool_multi(&auth, &token, &scope_config, read_only, request.name, args)
-                    .await
+                self.call_tool_multi(
+                    &auth,
+                    &token,
+                    &scope_config,
+                    read_only,
+                    request.name.clone(),
+                    args,
+                )
+                .await
             }
         }?;
         Ok(result.into())
@@ -665,6 +696,7 @@ impl<B: McpBackend> Runner<B> {
         read_only: bool,
         name: std::borrow::Cow<'static, str>,
         args: Value,
+        request: &McpRequest<'_>,
     ) -> Result<CallToolResult, ErrorData> {
         // Check if this is an endpoint tool
         let endpoint_tools = self.backend.all_endpoint_tools();
@@ -777,17 +809,7 @@ impl<B: McpBackend> Runner<B> {
                 .map_err(|e| ErrorData::internal_error(e.message, None))?
         };
 
-        // Transform arguments back to original key names
-        let transformed_args = if let Value::Object(map) = args {
-            let mut args_hash = HashMap::new();
-            for (k, v) in map {
-                let original_key = reverse_transform_key(&k, &item_schema);
-                args_hash.insert(original_key, v);
-            }
-            Value::Object(args_hash.into_iter().collect())
-        } else {
-            args
-        };
+        let transformed_args = transform_call_args(args, &item_schema);
 
         let script_or_flow_path = if is_hub {
             format!("hub/{}", path)
@@ -798,11 +820,23 @@ impl<B: McpBackend> Runner<B> {
         // Execute script or flow
         let result = if tool_type == "script" {
             self.backend
-                .run_script(auth, workspace_id, &script_or_flow_path, transformed_args)
+                .run_script(
+                    auth,
+                    workspace_id,
+                    &script_or_flow_path,
+                    transformed_args,
+                    request,
+                )
                 .await
         } else {
             self.backend
-                .run_flow(auth, workspace_id, &script_or_flow_path, transformed_args)
+                .run_flow(
+                    auth,
+                    workspace_id,
+                    &script_or_flow_path,
+                    transformed_args,
+                    request,
+                )
                 .await
         };
 
diff --git a/backend/windmill-oauth/src/lib.rs b/backend/windmill-oauth/src/lib.rs
index 2650b68b4d..32fde93b81 100644
--- a/backend/windmill-oauth/src/lib.rs
+++ b/backend/windmill-oauth/src/lib.rs
@@ -88,6 +88,8 @@ pub struct OAuthConfig {
     #[serde(default = "empty_string")]
     pub token_url: String,
     pub userinfo_url: Option<String>,
+    /// The registry JSON may also carry `scope_options`, a frontend-only pick
+    /// list for the connect dialog; it is deliberately not modelled here.
     pub scopes: Option<Vec<String>>,
     /// Default scopes for the client-credentials (2-legged) flow. These differ
     /// from the authorization-code `scopes` for most providers (member/consent
diff --git a/backend/windmill-queue/src/jobs.rs b/backend/windmill-queue/src/jobs.rs
index c7c119a5a7..8ac4fd390a 100644
--- a/backend/windmill-queue/src/jobs.rs
+++ b/backend/windmill-queue/src/jobs.rs
@@ -4007,33 +4007,10 @@ async fn clone_runnable(j: &mut PulledJob, db: &DB) -> error::Result<()> {
 
     {
         let maybe_new_id = match j.kind {
-            JobKind::Dependencies => {
-                let deployment_message = j
-                    .args
-                    .clone()
-                    .map(|hashmap| {
-                        hashmap
-                            .get("deployment_message")
-                            .map(|map_value| serde_json::from_str::<String>(map_value.get()).ok())
-                            .flatten()
-                    })
-                    .flatten();
-
-                // This way we tell downstream which script we should archive when the resolution is finished.
-                // (not used at the moment)
-                j.args
-                    .as_mut()
-                    .map(|args| args.insert("base_hash".to_owned(), to_raw_value(&*base_hash)));
-
-                windmill_common::scripts::clone_script(
-                    j.runnable_path(),
-                    &j.workspace_id,
-                    deployment_message,
-                    db,
-                )
-                .await?
-                .new_hash
-            }
+            // A script gets its new version from the worker, once the generated lock is known
+            // to differ from the live version's: minting one here would deploy, and walk the
+            // importers of, a version whose lock turns out byte-identical to its parent's.
+            JobKind::Dependencies => *base_hash,
             JobKind::FlowDependencies => {
                 sqlx::query_scalar!(
                     "INSERT INTO flow_version
diff --git a/backend/windmill-types/src/more_serde.rs b/backend/windmill-types/src/more_serde.rs
index 6eb24b60f4..f9cbe739c5 100644
--- a/backend/windmill-types/src/more_serde.rs
+++ b/backend/windmill-types/src/more_serde.rs
@@ -38,6 +38,25 @@ pub fn is_default<T: Default + std::cmp::PartialEq>(t: &T) -> bool {
     &T::default() == t
 }
 
+pub fn maybe_number<'de, T, D>(deserializer: D) -> Result<T, D::Error>
+where
+    D: Deserializer<'de>,
+    T: FromStr + serde::Deserialize<'de>,
+    <T as FromStr>::Err: Display,
+{
+    #[derive(Deserialize)]
+    #[serde(untagged)]
+    enum NumericOrString<T> {
+        String(String),
+        RawT(T),
+    }
+
+    match NumericOrString::<T>::deserialize(deserializer)? {
+        NumericOrString::String(s) => T::from_str(&s).map_err(serde::de::Error::custom),
+        NumericOrString::RawT(i) => Ok(i),
+    }
+}
+
 pub fn maybe_number_opt<'de, T, D>(deserializer: D) -> Result<Option<T>, D::Error>
 where
     D: Deserializer<'de>,
@@ -85,3 +104,41 @@ where
 {
     serde::Deserialize::deserialize(deserializer).map(Some)
 }
+
+#[cfg(test)]
+mod tests {
+    use serde::Deserialize;
+
+    #[derive(Deserialize)]
+    struct WithMaybeNumber {
+        #[serde(deserialize_with = "super::maybe_number")]
+        n: i64,
+    }
+
+    #[test]
+    fn maybe_number_accepts_number() {
+        let v: WithMaybeNumber = serde_json::from_value(serde_json::json!({ "n": 12345 })).unwrap();
+        assert_eq!(v.n, 12345);
+    }
+
+    #[test]
+    fn maybe_number_accepts_string() {
+        let v: WithMaybeNumber =
+            serde_json::from_value(serde_json::json!({ "n": "12345" })).unwrap();
+        assert_eq!(v.n, 12345);
+    }
+
+    #[test]
+    fn maybe_number_rejects_non_numeric_string() {
+        assert!(
+            serde_json::from_value::<WithMaybeNumber>(serde_json::json!({ "n": "abc" })).is_err()
+        );
+    }
+
+    #[test]
+    fn maybe_number_rejects_null() {
+        assert!(
+            serde_json::from_value::<WithMaybeNumber>(serde_json::json!({ "n": null })).is_err()
+        );
+    }
+}
diff --git a/backend/windmill-types/src/scripts.rs b/backend/windmill-types/src/scripts.rs
index 414650e846..19f6a06021 100644
--- a/backend/windmill-types/src/scripts.rs
+++ b/backend/windmill-types/src/scripts.rs
@@ -16,7 +16,7 @@ use crate::{
     runnable_settings::{ConcurrencySettings, DebouncingSettings},
 };
 
-#[derive(Serialize, Deserialize, Debug, Clone, Hash)]
+#[derive(Serialize, Deserialize, Debug, Clone, Hash, PartialEq, Eq)]
 pub struct ScriptModule {
     pub content: String,
     pub language: ScriptLang,
diff --git a/backend/windmill-worker/src/ai_executor.rs b/backend/windmill-worker/src/ai_executor.rs
index d948fee088..2c29721ef6 100644
--- a/backend/windmill-worker/src/ai_executor.rs
+++ b/backend/windmill-worker/src/ai_executor.rs
@@ -1099,7 +1099,7 @@ pub async fn run_agent(
         // For non-Anthropic providers, response_format is handled by the query builder
     }
 
-    let user_wants_streaming = args.streaming.unwrap_or(false);
+    let user_wants_streaming = streaming_requested(args.streaming);
     *has_stream = user_wants_streaming && is_text_output;
 
     let mut final_events_str = String::new();
@@ -1701,6 +1701,17 @@ pub async fn run_agent(
     }))
 }
 
+/// Whether the step asked for its answer as it is generated. Absence means on, matching the
+/// schema's own default: a step that never wrote the key never had an opinion, and an answer
+/// arriving as it is written is what people expect. Only an explicit `false` holds it back.
+///
+/// The chat surfaces decide whether to open a stream from their own reading of the same config,
+/// and a surface that opens one for an answer sent in a single piece re-runs the flow when the
+/// connection times out. So this default is half of a contract, not a local preference.
+fn streaming_requested(streaming: Option<bool>) -> bool {
+    streaming.unwrap_or(true)
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -1713,6 +1724,13 @@ mod tests {
         }
     }
 
+    #[test]
+    fn an_unwritten_streaming_field_streams() {
+        assert!(streaming_requested(None));
+        assert!(streaming_requested(Some(true)));
+        assert!(!streaming_requested(Some(false)));
+    }
+
     /// Over 64 characters OpenAI rejects the key outright, which costs a wasted round
     /// trip per run and silently leaves that step with no prompt caching at all.
     #[test]
diff --git a/backend/windmill-worker/src/worker_lockfiles.rs b/backend/windmill-worker/src/worker_lockfiles.rs
index 57b859075a..9bba9a99e6 100644
--- a/backend/windmill-worker/src/worker_lockfiles.rs
+++ b/backend/windmill-worker/src/worker_lockfiles.rs
@@ -19,14 +19,17 @@ use windmill_common::error::Result;
 use windmill_common::flows::{FlowModule, FlowModuleValue, FlowNodeId};
 use windmill_common::jobs::JobKind;
 use windmill_common::min_version::MIN_VERSION_SUPPORTS_DEBOUNCING_V2;
-use windmill_common::scripts::ScriptHash;
+use windmill_common::scripts::{
+    deploy_relocked_version, fetch_script_for_update, hash_script, ScriptHash, ScriptModule,
+};
 #[cfg(feature = "python")]
 use windmill_common::worker::PythonAnnotations;
 use windmill_common::worker::{to_raw_value, to_raw_value_owned, write_file, Connection};
 use windmill_common::workspace_dependencies::{
     RawWorkspaceDependencies, WorkspaceDependenciesPrefetched,
 };
-use windmill_dep_map::scoped_dependency_map::ScopedDependencyMap;
+use windmill_dep_map::scoped_dependency_map::{DependencyDependent, ScopedDependencyMap};
+use windmill_dep_map::trigger_dependents::trigger_dependents_to_recompute_dependencies;
 #[cfg(feature = "python")]
 use windmill_parser_yaml::AnsibleRequirements;
 
@@ -38,8 +41,10 @@ use windmill_common::{
     scripts::ScriptLang,
     DB,
 };
+use windmill_dep_map::lock_hash::record_lock_hashes;
 pub use windmill_dep_map::{
     extract_referenced_paths, extract_relative_imports, process_relative_imports,
+    refresh_dependency_map,
 };
 use windmill_git_sync::{
     handle_deployment_metadata, tally_deployed_object_changes, DeployedObject,
@@ -86,10 +91,13 @@ use crate::{
 /// has the toolchain and, since the cache key is per OS/arch, the platform the runtime
 /// workers use. Deploys that supply their own lock never reach a dependency job at all and
 /// queue theirs from `create_script_internal` instead.
-async fn maybe_queue_binary_prebuild(db: &DB, job: &MiniPulledJob, lock: &str) -> Result<()> {
-    let (Some(hash), Some(path), Some(lang)) =
-        (job.runnable_id, job.runnable_path.clone(), job.script_lang)
-    else {
+async fn maybe_queue_binary_prebuild(
+    db: &DB,
+    job: &MiniPulledJob,
+    hash: ScriptHash,
+    lock: &str,
+) -> Result<()> {
+    let (Some(path), Some(lang)) = (job.runnable_path.clone(), job.script_lang) else {
         return Ok(());
     };
     let Some(prebuild) =
@@ -283,6 +291,13 @@ pub async fn handle_dependency_job(
         job.runnable_path()
     );
     let script_path = job.runnable_path();
+    let w_id = &job.workspace_id;
+
+    let triggered_by_relative_import = job
+        .args
+        .as_ref()
+        .map(|x| x.get("triggered_by_relative_import").is_some())
+        .unwrap_or_default();
 
     // A build pass reads the same script data but writes none of the deploy state below,
     // including the `lock_error_logs` stamp on a fetch failure: the version it builds is
@@ -296,14 +311,48 @@ pub async fn handle_dependency_job(
         *deployment_tallied = true;
     }
 
+    // A relative-import relock deploys nothing until `commit_relock` says so, while the
+    // caller's fallback tally assumes a failed dependency job left a deployed version behind.
+    // Claim the tally here; the failure path hands it back once it has minted the version
+    // that carries the error.
+    if triggered_by_relative_import {
+        *deployment_tallied = true;
+    }
+
+    // A relative-import relock locks the path's live version as of now, not the hash captured
+    // when the job was pushed: a deploy can land during the debounce delay, after which that
+    // hash names an archived version. What it generates is committed against the live version
+    // re-read under a row lock, so a deploy landing mid-generation is caught there too.
+    let target_hash = if triggered_by_relative_import {
+        Some(ScriptHash(live_head_hash(db, w_id, script_path).await?))
+    } else {
+        job.runnable_id
+    };
+
     // `JobKind::Dependencies` job store either:
     // - A saved script `hash` in the `script_hash` column.
     // - Preview raw lock and code in the `queue` or `job` table.
-    let script_data = &match job.runnable_id {
+    let script_data = &match target_hash {
+        // Read straight from the database: the cache pins a version's data under its hash for
+        // as long as this worker lives, and the live version may still be waiting on its own
+        // dependency job's lock, which lands in place. A run resolving to it on this worker
+        // would then get no lock from the cache at all.
+        Some(hash) if triggered_by_relative_import => {
+            let raw = cache::script::fetch_script_from_db(db, hash, std::panic::Location::caller())
+                .await?;
+            Cow::Owned(std::sync::Arc::new(cache::ScriptData {
+                lock: raw.lock,
+                code: raw.content,
+                modules: raw.modules,
+            }))
+        }
         Some(hash) => match cache::script::fetch(&Connection::from(db.clone()), hash).await {
             Ok(d) => Cow::Owned(d.0),
             Err(e) => {
-                if !is_build_job {
+                // The live version of a relative-import relock is what runs resolve to, and
+                // `lock_error_logs` on it takes it out of resolution; the job carries the
+                // error instead, since it deployed nothing.
+                if !is_build_job && !triggered_by_relative_import {
                     let logs2 = sqlx::query_scalar!(
                         "SELECT logs FROM job_logs WHERE job_id = $1 AND workspace_id = $2",
                         &job.id,
@@ -348,12 +397,6 @@ pub async fn handle_dependency_job(
         .await;
     }
 
-    let triggered_by_relative_import = job
-        .args
-        .as_ref()
-        .map(|x| x.get("triggered_by_relative_import").is_some())
-        .unwrap_or_default();
-
     // Extract temp_script_refs from job args (path -> hash mapping for temp storage)
     let temp_script_refs: Option<HashMap<String, String>> = job
         .args
@@ -391,20 +434,17 @@ pub async fn handle_dependency_job(
     )
     .await;
 
+    let (deployment_message, parent_path) =
+        get_deployment_msg_and_parent_path_from_args(job.args.clone());
+
     match content {
         Ok(content) => {
-            if job.runnable_id.is_none() {
+            let Some(current_hash) = target_hash else {
                 // it a one-off raw script dependency job, no need to update the db
                 return Ok(to_raw_value_owned(
                     json!({ "status": "Successful lock file generation", "lock": content }),
                 ));
-            }
-
-            let current_hash = job.runnable_id.unwrap_or(ScriptHash(0));
-            let w_id = &job.workspace_id;
-
-            let (deployment_message, parent_path) =
-                get_deployment_msg_and_parent_path_from_args(job.args.clone());
+            };
 
             // Generate lockfiles for module files (if any).
             //
@@ -441,7 +481,9 @@ pub async fn handle_dependency_job(
                             occupancy_metrics,
                             &raw_workspace_dependencies_o,
                             module.lock.as_deref(),
-                            triggered_by_relative_import,
+                            // A module that was never locked has nothing a skip could hand
+                            // back; the path's lock is the parent script's, not its own.
+                            triggered_by_relative_import && module.lock.is_some(),
                             script_path,
                             None,
                             "script",
@@ -464,34 +506,83 @@ pub async fn handle_dependency_job(
                     None
                 };
 
-            // We do not create new row for this update
-            // That means we can keep current hash and just update lock
-            // Also store lockfile hash for dependency change detection
-            let lockfile_hash = windmill_common::scripts::hash_script(&content);
-            let updated_modules_json = updated_modules
-                .as_ref()
-                .and_then(|m| serde_json::to_value(m).ok());
-            sqlx::query!(
-                "WITH update_lock AS (
-                    UPDATE script SET lock = $1, modules = COALESCE($6, modules) WHERE hash = $2 AND workspace_id = $3
+            let deployed_hash = if triggered_by_relative_import {
+                match commit_relock(
+                    db,
+                    w_id,
+                    script_path,
+                    current_hash,
+                    Some(&content),
+                    updated_modules.as_ref(),
+                    None,
+                    deployment_message.clone(),
                 )
-                INSERT INTO lock_hash (workspace_id, path, lockfile_hash)
-                VALUES ($3, $4, $5)
-                ON CONFLICT (workspace_id, path) DO UPDATE SET lockfile_hash = $5",
-                &content,
-                &current_hash.0,
-                w_id,
-                script_path,
-                &lockfile_hash,
-                updated_modules_json
-            )
-            .execute(db)
-            .await?;
+                .await?
+                {
+                    RelockOutcome::Deployed(hash) => hash,
+                    RelockOutcome::Unchanged => {
+                        let log_msg = "\nLock unchanged: no new version deployed";
+                        tracing::info!(workspace_id = %w_id, job_id = %job.id, "{log_msg}");
+                        append_logs(&job.id, w_id, log_msg, &db.into()).await;
+                        // The imports may have moved even though the result did not, and the
+                        // map is what this importer's next skip check reads.
+                        refresh_dependency_map(
+                            db,
+                            w_id,
+                            script_path,
+                            &parent_path,
+                            &script_data.code,
+                            &job.script_lang,
+                        )
+                        .await?;
+                        return Ok(to_raw_value_owned(
+                            json!({ "status": "Lock unchanged, no new version deployed", "lock": content }),
+                        ));
+                    }
+                    RelockOutcome::Superseded(head) => {
+                        let log_msg = format!(
+                            "\nVersion {head} was deployed while this lock was generated; discarding it and queueing a relock of that version"
+                        );
+                        tracing::info!(workspace_id = %w_id, job_id = %job.id, "{log_msg}");
+                        append_logs(&job.id, w_id, log_msg, &db.into()).await;
+                        requeue_relock(db, job, script_path, deployment_message, parent_path)
+                            .await?;
+                        return Ok(to_raw_value_owned(
+                            json!({ "status": "Lock generation superseded by a newer version", "lock": content }),
+                        ));
+                    }
+                }
+            } else {
+                // We do not create new row for this update
+                // That means we can keep current hash and just update lock
+                // Also store lockfile hash for dependency change detection
+                let lockfile_hash = windmill_common::scripts::hash_script(&content);
+                let updated_modules_json = updated_modules
+                    .as_ref()
+                    .and_then(|m| serde_json::to_value(m).ok());
+                sqlx::query!(
+                    "WITH update_lock AS (
+                        UPDATE script SET lock = $1, modules = COALESCE($6, modules) WHERE hash = $2 AND workspace_id = $3
+                    )
+                    INSERT INTO lock_hash (workspace_id, path, lockfile_hash)
+                    VALUES ($3, $4, $5)
+                    ON CONFLICT (workspace_id, path) DO UPDATE SET lockfile_hash = $5",
+                    &content,
+                    &current_hash.0,
+                    w_id,
+                    script_path,
+                    &lockfile_hash,
+                    updated_modules_json
+                )
+                .execute(db)
+                .await?;
 
-            // `lock` has been updated; invalidate the cache.
-            // Since only worker that ran this Dependency Job has the cache
-            // we do not need to think about invalidating cache for other workers.
-            cache::script::invalidate(current_hash);
+                // `lock` has been updated; invalidate the cache.
+                // Since only worker that ran this Dependency Job has the cache
+                // we do not need to think about invalidating cache for other workers.
+                cache::script::invalidate(current_hash);
+                current_hash
+            };
             // The version only became runnable now, so this process still resolves the path to
             // the one before it. Only the runnable-hash cache: the import-side caches ignore the
             // lock, so evicting this process' half of that pair here would key a bundle by a
@@ -504,7 +595,7 @@ pub async fn handle_dependency_job(
                 &db,
                 &w_id,
                 DeployedObject::Script {
-                    hash: current_hash,
+                    hash: deployed_hash,
                     path: script_path.to_string(),
                     parent_path: parent_path.clone(),
                 },
@@ -565,7 +656,7 @@ pub async fn handle_dependency_job(
                 });
             }
 
-            if let Err(e) = maybe_queue_binary_prebuild(db, job, &content).await {
+            if let Err(e) = maybe_queue_binary_prebuild(db, job, deployed_hash, &content).await {
                 tracing::error!(%e, "error queueing the auto-build binary job for {script_path}");
             }
 
@@ -583,14 +674,49 @@ pub async fn handle_dependency_job(
             .await?
             .flatten()
             .unwrap_or_else(|| "no logs".to_string());
-            sqlx::query!(
-                "UPDATE script SET lock_error_logs = $1 WHERE hash = $2 AND workspace_id = $3",
-                &format!("{logs2}\n{error}"),
-                &job.runnable_id.unwrap_or(ScriptHash(0)).0,
-                &job.workspace_id
-            )
-            .execute(db)
-            .await?;
+            let error_logs = format!("{logs2}\n{error}");
+            if let (true, Some(hash)) = (triggered_by_relative_import, target_hash) {
+                // The same shape a failed deploy leaves: a version without a lock that carries
+                // the error, so it shows on the script while runs keep resolving to the last
+                // version that has one. Only that version is the caller's fallback to tally;
+                // one that landed meanwhile owns its own lock, and a commit that failed left
+                // nothing.
+                match commit_relock(
+                    db,
+                    w_id,
+                    script_path,
+                    hash,
+                    None,
+                    None,
+                    Some(&error_logs),
+                    deployment_message.clone(),
+                )
+                .await
+                {
+                    Ok(RelockOutcome::Deployed(_)) => *deployment_tallied = false,
+                    Ok(RelockOutcome::Superseded(_)) => {
+                        if let Err(e) =
+                            requeue_relock(db, job, script_path, deployment_message, parent_path)
+                                .await
+                        {
+                            tracing::error!(%e, "error queueing a relock of {script_path}")
+                        }
+                    }
+                    Ok(RelockOutcome::Unchanged) => {}
+                    Err(e) => {
+                        tracing::error!(%e, "error recording the failed relock of {script_path}")
+                    }
+                }
+            } else {
+                sqlx::query!(
+                    "UPDATE script SET lock_error_logs = $1 WHERE hash = $2 AND workspace_id = $3",
+                    &error_logs,
+                    &job.runnable_id.unwrap_or(ScriptHash(0)).0,
+                    &job.workspace_id
+                )
+                .execute(db)
+                .await?;
+            }
             Err(Error::ExecutionErr(format!(
                 "Error locking file: {error}\n\nlogs:\n{}",
                 remove_ansi_codes(&logs2)
@@ -598,6 +724,136 @@ pub async fn handle_dependency_job(
         }
     }
 }
+
+/// The version of `script_path` that runs resolve to, which is what a relative-import relock
+/// locks. `NotFound` when the path holds none, which a job pushed for a path since archived or
+/// deleted reports as its own failure.
+async fn live_head_hash(db: &DB, w_id: &str, script_path: &str) -> error::Result<i64> {
+    sqlx::query_scalar!(
+        "SELECT hash FROM script WHERE path = $1 AND workspace_id = $2 AND deleted = false AND archived = false ORDER BY created_at DESC LIMIT 1",
+        script_path,
+        w_id
+    )
+    .fetch_optional(db)
+    .await?
+    .ok_or_else(|| {
+        Error::NotFound(format!(
+            "Non-archived script with path '{script_path}' not found"
+        ))
+    })
+}
+
+enum RelockOutcome {
+    /// A new version carrying the result is the live one.
+    Deployed(ScriptHash),
+    /// The live version already holds this lock and these module locks; nothing was written.
+    Unchanged,
+    /// The live version is no longer the one the lock was generated for; nothing was written.
+    Superseded(ScriptHash),
+}
+
+/// Commits what a relative-import relock produced against the path's live version, read under
+/// a row lock so relocks of one path serialize on it.
+///
+/// A result equal to the live version's lock and module locks writes nothing: the importer's
+/// dependencies did not move, and a new version would deploy byte-identical content and then
+/// walk its own importers for nothing. A `lock` of `None` is a failed generation and always
+/// deploys, as the version that carries the error.
+async fn commit_relock(
+    db: &DB,
+    w_id: &str,
+    script_path: &str,
+    generated_for: ScriptHash,
+    lock: Option<&str>,
+    modules: Option<&HashMap<String, ScriptModule>>,
+    lock_error_logs: Option<&str>,
+    deployment_message: Option<String>,
+) -> error::Result<RelockOutcome> {
+    let mut tx = db.begin().await?;
+    let mut head = None;
+    for _ in 0..4 {
+        head = fetch_script_for_update(script_path, w_id, &mut *tx).await?;
+        if head.is_some() {
+            break;
+        }
+        // Having waited on the live version's row lock, the statement re-checked that row
+        // once the holder committed, found it archived, and returned nothing: the successor
+        // the holder inserted is not in the statement's snapshot. A fresh statement sees it,
+        // unless yet another writer got there first, so this goes around a few times before
+        // concluding the path holds no live version.
+    }
+    let Some(head) = head else {
+        return Err(Error::NotFound(format!(
+            "Non-archived script with path '{script_path}' not found"
+        )));
+    };
+    if head.hash != generated_for {
+        // A deploy landed while the lock was generated. It carried its own lock or queued its
+        // own dependency job, and this lock describes content that is no longer live.
+        return Ok(RelockOutcome::Superseded(head.hash));
+    }
+    let lock_hash_entry = lock.map(|lock| (script_path.to_string(), hash_script(lock)));
+    if let Some(lock) = lock {
+        let modules_unchanged = modules.map_or(true, |m| head.modules.as_ref() == Some(m));
+        if head.lock.as_deref() == Some(lock) && modules_unchanged {
+            // The hash row is still written, and under the same row lock: a version deployed
+            // before lock hashes were recorded has none, so its importers cannot skip until
+            // it does, and a deploy that takes the lock next must not have the hash it records
+            // overwritten by this one.
+            record_lock_hashes(&mut tx, w_id, lock_hash_entry.as_slice()).await?;
+            tx.commit().await?;
+            return Ok(RelockOutcome::Unchanged);
+        }
+    }
+    let new_hash = deploy_relocked_version(
+        &mut tx,
+        head,
+        deployment_message,
+        lock,
+        modules,
+        lock_error_logs,
+    )
+    .await?;
+    record_lock_hashes(&mut tx, w_id, lock_hash_entry.as_slice()).await?;
+    tx.commit().await?;
+    Ok(RelockOutcome::Deployed(ScriptHash(new_hash)))
+}
+
+/// Queues another relative-import relock of `script_path`, through the same push the fan-out
+/// uses. The version live now was deployed while a lock was generated for its predecessor;
+/// when that deploy was a sibling relock it queued nothing for this path, and the result just
+/// discarded may have been the one generated against the current imports.
+async fn requeue_relock(
+    db: &DB,
+    job: &MiniPulledJob,
+    script_path: &str,
+    deployment_message: Option<String>,
+    parent_path: Option<String>,
+) -> error::Result<()> {
+    let already_visited = job
+        .args
+        .as_ref()
+        .and_then(|x| x.get("already_visited"))
+        .and_then(|v| serde_json::from_str::<Vec<String>>(v.get()).ok())
+        .unwrap_or_default();
+    trigger_dependents_to_recompute_dependencies(
+        &job.workspace_id,
+        vec![DependencyDependent {
+            importer_path: script_path.to_string(),
+            importer_kind: "script".to_string(),
+            importer_node_ids: None,
+        }],
+        deployment_message,
+        parent_path,
+        &job.permissioned_as_email,
+        &job.created_by,
+        &job.permissioned_as,
+        db,
+        already_visited,
+    )
+    .await
+}
+
 fn remove_ansi_codes(s: &str) -> String {
     lazy_static::lazy_static! {
         static ref ANSI_REGEX: regex::Regex = regex::Regex::new(r"\x1b\[[0-9;]*[a-zA-Z]").unwrap();
@@ -2892,8 +3148,12 @@ async fn try_skip_relock(
     }
 
     // Fetch existing lock based on runnable type
-    let lock = match runnable_type {
-        "script" => sqlx::query_scalar!(
+    let lock = match (runnable_type, existing_lock) {
+        // A script's module asks with the script's own type and hands over the lock it last
+        // deployed with. The path's lock below is the parent script's, and a module given
+        // that loses whatever it resolves on its own.
+        ("script", Some(module_lock)) => Some(module_lock.to_string()),
+        ("script", None) => sqlx::query_scalar!(
             "SELECT lock FROM script WHERE path = $1 AND workspace_id = $2 AND lock IS NOT NULL
              AND deleted = false ORDER BY created_at DESC LIMIT 1",
             base_path,
@@ -2903,7 +3163,7 @@ async fn try_skip_relock(
         .await?
         .flatten(),
 
-        "flow" | "app" => existing_lock.map(|s| s.to_string()),
+        ("flow" | "app", existing_lock) => existing_lock.map(|s| s.to_string()),
         _ => None,
     };
 
diff --git a/benchmarks/lib.ts b/benchmarks/lib.ts
index 9085d6a365..6a165901e4 100644
--- a/benchmarks/lib.ts
+++ b/benchmarks/lib.ts
@@ -2,7 +2,7 @@ import { sleep } from "https://deno.land/x/sleep@v1.2.1/mod.ts";
 import * as windmill from "https://deno.land/x/windmill@v1.174.0/mod.ts";
 import * as api from "https://deno.land/x/windmill@v1.174.0/windmill-api/index.ts";
 
-export const VERSION = "v1.800.1";
+export const VERSION = "v1.803.0";
 
 export async function login(email: string, password: string): Promise<string> {
   return await windmill.UserService.login({
diff --git a/cli/src/commands/app/dev.ts b/cli/src/commands/app/dev.ts
index b45666a1e1..2dac8639e2 100644
--- a/cli/src/commands/app/dev.ts
+++ b/cli/src/commands/app/dev.ts
@@ -603,7 +603,7 @@ async function dev(opts: DevOptions, appFolder?: string) {
       build.onLoad(
         { filter: /.*/, namespace: "wmill-virtual" },
         (args: any) => {
-          const contents = wmillTs(port);
+          const contents = wmillTs();
           log.info(
             colors.yellow(
               `[wmill-virtual] Loading virtual module: ${args.path}`,
diff --git a/cli/src/commands/app/wmillTsDev.ts b/cli/src/commands/app/wmillTsDev.ts
index 7cb2ea328b..821060d8e4 100644
--- a/cli/src/commands/app/wmillTsDev.ts
+++ b/cli/src/commands/app/wmillTsDev.ts
@@ -1,5 +1,5 @@
 //comment this line and last to dev
-export function wmillTsDev(port: number) { return `
+export function wmillTsDev() { return `
 let reqs: Record<string, any> = {}
 let ws: WebSocket | null = null
 let wsReady: Promise<void>
@@ -10,7 +10,7 @@ function initWebSocket() {
         wsReadyResolve = resolve
     })
 
-    ws = new WebSocket('ws://localhost:${port}')
+    ws = new WebSocket((window.location.protocol === 'https:' ? 'wss:' : 'ws:') + '//' + window.location.host)
 
     ws.onopen = () => {
         console.log('[wmill] WebSocket connected')
@@ -157,4 +157,4 @@ export function streamJob(
         ws?.send(JSON.stringify({ jobId, type: 'streamJob', reqId }))
     })
 }
-`}
\ No newline at end of file
+`}
diff --git a/cli/src/commands/flow/flow.ts b/cli/src/commands/flow/flow.ts
index 6ace1eaf48..7a383fcfeb 100644
--- a/cli/src/commands/flow/flow.ts
+++ b/cli/src/commands/flow/flow.ts
@@ -1144,7 +1144,7 @@ const command = new Command()
   .arguments("<path:string>")
   .option(
     "-d --data <data:string>",
-    "Inputs specified as a JSON string or a file using @<filename> or stdin using @-."
+    "Inputs specified as a JSON string or a file using @<filename> or stdin using @-. A resource argument is the bare string $res:<path> as its whole value, and a variable argument is the bare string $var:<path> — not an object wrapper keyed on $res/$var, and not a plain path."
   )
   .option(
     "-s --silent",
@@ -1162,7 +1162,7 @@ const command = new Command()
   .arguments("<flow_path:string>")
   .option(
     "-d --data <data:string>",
-    "Inputs specified as a JSON string or a file using @<filename> or stdin using @-."
+    "Inputs specified as a JSON string or a file using @<filename> or stdin using @-. A resource argument is the bare string $res:<path> as its whole value, and a variable argument is the bare string $var:<path> — not an object wrapper keyed on $res/$var, and not a plain path."
   )
   .option(
     "-s --silent",
diff --git a/cli/src/commands/schedule/schedule.ts b/cli/src/commands/schedule/schedule.ts
index edbedc2612..2eb6ba42b8 100644
--- a/cli/src/commands/schedule/schedule.ts
+++ b/cli/src/commands/schedule/schedule.ts
@@ -106,7 +106,8 @@ export async function pushSchedule(
   path: string,
   schedule: Schedule | ScheduleFile | undefined,
   localSchedule: ScheduleFile,
-  permissionedAsContext?: PermissionedAsContext
+  permissionedAsContext?: PermissionedAsContext,
+  enabledOwnedByParent?: boolean
 ): Promise<void> {
   path = removeType(path, "schedule").replaceAll(SEP, "/");
   log.debug(`Processing local schedule ${path}`);
@@ -123,6 +124,21 @@ export async function pushSchedule(
   // Strip CLI-only boolean marker before sending to API
   delete (localSchedule as any).has_permissioned_as;
 
+  // In a fork, the file's `enabled` is the parent's for a path the parent
+  // also has (see sync push's `parentOwnedScheduleEnabled`): the fork's own
+  // flag stays as it is.
+  if (enabledOwnedByParent && schedule) {
+    if (
+      localSchedule.enabled !== undefined &&
+      localSchedule.enabled !== schedule.enabled
+    ) {
+      log.warnAlways(
+        `Schedule ${path} stays ${schedule.enabled ? "enabled" : "disabled"}: the file says ${localSchedule.enabled ? "enabled" : "disabled"}, but in a fork that flag is the parent workspace's`
+      );
+    }
+    delete localSchedule.enabled;
+  }
+
   const preserveFields: { permissioned_as?: string; preserve_permissioned_as?: boolean } = {};
   if (permissionedAsContext?.userIsAdminOrDeployer) {
     if (schedule) {
@@ -153,13 +169,9 @@ export async function pushSchedule(
           ...preserveFields,
         },
       });
-      // Tarball export from a fork strips `enabled` from schedule YAMLs so
-      // the fork→parent git-sync round-trip can't flip the parent's state.
-      // Skip the secondary setScheduleEnabled call when the local YAML
-      // doesn't carry `enabled` — sending `{ enabled: undefined }` would
-      // serialize to `{}` and the backend (`SetEnabled.enabled` is required)
-      // would reject the request. Preserving the target's existing flag is
-      // exactly the round-trip-safe behavior.
+      // No `enabled` in the file (absent from the YAML, or set aside above)
+      // leaves the remote flag alone: `SetEnabled.enabled` is required, so
+      // `{ enabled: undefined }` would be rejected rather than ignored.
       if (
         localSchedule.enabled !== undefined &&
         localSchedule.enabled !== schedule.enabled
@@ -167,13 +179,12 @@ export async function pushSchedule(
         log.info(colors.bold.yellow(
           `Schedule ${path} is ${localSchedule.enabled ? "enabled" : "disabled"} locally but not on remote, updating remote`
         ));
-        await wmill.setScheduleEnabled({
-          workspace: workspace,
+        await setEnabledUnlessParentOwned(
+          workspace,
           path,
-          requestBody: {
-            enabled: localSchedule.enabled,
-          },
-        });
+          localSchedule.enabled,
+          schedule.enabled
+        );
       }
     } catch (e) {
       console.error((e as any).body);
@@ -194,6 +205,44 @@ export async function pushSchedule(
       console.error((e as any).body);
       throw e;
     }
+    // A create in a fork lands disabled whatever the request says. A fork-only
+    // path the file wants enabled is enabled here, so one push converges; a
+    // parent-owned one stays disabled.
+    if (enabledOwnedByParent !== undefined && localSchedule.enabled === true) {
+      if (enabledOwnedByParent) {
+        log.warnAlways(
+          `Schedule ${path} created disabled: the file says enabled, but in a fork that flag is the parent workspace's`
+        );
+      } else {
+        await setEnabledUnlessParentOwned(workspace, path, true, false);
+      }
+    }
+  }
+}
+
+// The parent listing behind `enabledOwnedByParent` sees only what the pusher
+// may read; the backend's `fork-conflict` refusal is the last word, so a path
+// it says the parent has keeps the fork's flag rather than failing the push.
+async function setEnabledUnlessParentOwned(
+  workspace: string,
+  path: string,
+  enabled: boolean,
+  remoteEnabled: boolean
+): Promise<void> {
+  try {
+    await wmill.setScheduleEnabled({
+      workspace,
+      path,
+      requestBody: { enabled },
+    });
+  } catch (e) {
+    const conflict = parseForkConflict(e);
+    if (!conflict) {
+      throw e;
+    }
+    log.warnAlways(
+      `Schedule ${path} left ${remoteEnabled ? "enabled" : "disabled"}: the parent workspace '${conflict.parentWorkspaceId}' has the same schedule, so its flag is the parent's to set`
+    );
   }
 }
 
diff --git a/cli/src/commands/script/script.ts b/cli/src/commands/script/script.ts
index 8c93bdb963..fada434e0d 100644
--- a/cli/src/commands/script/script.ts
+++ b/cli/src/commands/script/script.ts
@@ -2213,7 +2213,7 @@ const command = new Command()
   .arguments("<path:file>")
   .option(
     "-d --data <data:file>",
-    "Inputs specified as a JSON string or a file using @<filename> or stdin using @-."
+    "Inputs specified as a JSON string or a file using @<filename> or stdin using @-. A resource argument is the bare string $res:<path> as its whole value, and a variable argument is the bare string $var:<path> — not an object wrapper keyed on $res/$var, and not a plain path."
   )
   .option(
     "-s --silent",
@@ -2231,7 +2231,7 @@ const command = new Command()
   .arguments("<path:file>")
   .option(
     "-d --data <data:file>",
-    "Inputs specified as a JSON string or a file using @<filename> or stdin using @-."
+    "Inputs specified as a JSON string or a file using @<filename> or stdin using @-. A resource argument is the bare string $res:<path> as its whole value, and a variable argument is the bare string $var:<path> — not an object wrapper keyed on $res/$var, and not a plain path."
   )
   .option(
     "-s --silent",
diff --git a/cli/src/commands/sync/sync.ts b/cli/src/commands/sync/sync.ts
index 6aaa72da0d..bab9967b3c 100644
--- a/cli/src/commands/sync/sync.ts
+++ b/cli/src/commands/sync/sync.ts
@@ -25,7 +25,7 @@ import {
 } from "yaml";
 import JSZip from "jszip";
 import { minimatch } from "minimatch";
-import { yamlParseContent } from "../../utils/yaml.ts";
+import { yamlParseContent, yamlParseFile } from "../../utils/yaml.ts";
 import * as wmill from "../../../gen/services.gen.ts";
 
 import {
@@ -1138,7 +1138,7 @@ export function rawAppPathWithinFolder(
   return resolved;
 }
 
-function ZipFSElement(
+export function ZipFSElement(
   zip: JSZip,
   useYaml: boolean,
   defaultTs: "bun" | "deno",
@@ -1146,6 +1146,14 @@ function ZipFSElement(
   resourceTypeToIsFileset: Record<string, boolean>,
   ignoreCodebaseChanges: boolean,
   stripOnBehalfOf: boolean,
+  // Names a flow's rendered inline-script files after the checkout's own
+  // `!inline` references (module id -> file). The export carries script
+  // source, never a reference, so without a checkout to defer to every file
+  // is named from the step summary, and a file the checkout names otherwise
+  // reads as a delete + add on every push while the resolved flows are equal.
+  localFlowInlineMapping?: (
+    flowDir: string,
+  ) => Promise<Record<string, string>>,
 ): DynFSElement {
   // Pre-scan: find zip base paths of scripts that have modules.
   // These scripts use the folder layout: {basePath}__mod/script.{ext}
@@ -1249,59 +1257,71 @@ function ZipFSElement(
               log.error(`Failed to parse flow.yaml at path: ${p}`);
               throw error;
             }
-            let inlineScripts;
+            let inlineScripts: InlineScript[];
             try {
-              const assigner = newPathAssigner(defaultTs, {
-                skipInlineScriptSuffix: getNonDottedPaths(),
-              });
-              // Preserve original !inline filenames from the flow to avoid phantom renames
-              const inlineMapping = extractCurrentMapping(
-                flow.value.modules as any,
-                {},
-                flow.value.failure_module,
-                flow.value.preprocessor_module,
-              );
-              inlineScripts = extractInlineScriptsForFlows(
-                flow.value.modules as any,
-                inlineMapping,
-                SEP,
-                defaultTs,
-                assigner,
-                {
+              // Extraction rewrites the modules' content into `!inline` refs,
+              // so each attempt works on its own copy of the flow.
+              const render = (
+                source: OpenFlow,
+                inlineMapping: Record<string, string>,
+              ): [OpenFlow, InlineScript[]] => {
+                const f: OpenFlow = structuredClone(source);
+                const assigner = newPathAssigner(defaultTs, {
+                  skipInlineScriptSuffix: getNonDottedPaths(),
+                });
+                const options = {
                   skipInlineScriptSuffix: getNonDottedPaths(),
                   failOnInlineDirective: true,
-                },
-              );
-              if (flow.value.failure_module) {
-                inlineScripts.push(
-                  ...extractInlineScriptsForFlows(
-                    [flow.value.failure_module],
-                    inlineMapping,
-                    SEP,
-                    defaultTs,
-                    assigner,
-                    {
-                      skipInlineScriptSuffix: getNonDottedPaths(),
-                      failOnInlineDirective: true,
-                    },
-                  ),
-                );
-              }
-              if (flow.value.preprocessor_module) {
-                inlineScripts.push(
-                  ...extractInlineScriptsForFlows(
-                    [flow.value.preprocessor_module],
-                    inlineMapping,
-                    SEP,
-                    defaultTs,
-                    assigner,
-                    {
-                      skipInlineScriptSuffix: getNonDottedPaths(),
-                      failOnInlineDirective: true,
-                    },
-                  ),
+                };
+                const scripts = extractInlineScriptsForFlows(
+                  f.value.modules as any,
+                  inlineMapping,
+                  SEP,
+                  defaultTs,
+                  assigner,
+                  options,
                 );
+                if (f.value.failure_module) {
+                  scripts.push(
+                    ...extractInlineScriptsForFlows(
+                      [f.value.failure_module],
+                      inlineMapping,
+                      SEP,
+                      defaultTs,
+                      assigner,
+                      options,
+                    ),
+                  );
+                }
+                if (f.value.preprocessor_module) {
+                  scripts.push(
+                    ...extractInlineScriptsForFlows(
+                      [f.value.preprocessor_module],
+                      inlineMapping,
+                      SEP,
+                      defaultTs,
+                      assigner,
+                      options,
+                    ),
+                  );
+                }
+                return [f, scripts];
+              };
+              const inlineMapping = localFlowInlineMapping
+                ? await localFlowInlineMapping(finalPath)
+                : {};
+              let rendered = render(flow, inlineMapping);
+              // The assigner keeps the names it hands out unique, not the
+              // checkout's: one of those equal to another step's
+              // summary-derived name would leave two files at one path, so
+              // such a flow renders the export's way.
+              if (
+                new Set(rendered[1].map((s) => s.path)).size !==
+                rendered[1].length
+              ) {
+                rendered = render(flow, {});
               }
+              [flow, inlineScripts] = rendered;
             } catch (error) {
               log.error(
                 `Failed to extract inline scripts for flow at path: ${p}`,
@@ -2581,7 +2601,7 @@ export function preservePendingScriptLocks(
   }
 }
 
-async function compareDynFSElement(
+export async function compareDynFSElement(
   els1: DynFSElement,
   els2: DynFSElement | undefined,
   ignore: (path: string, isDirectory: boolean) => boolean,
@@ -2594,6 +2614,9 @@ async function compareDynFSElement(
   branchOverride?: string,
   isEls1Remote?: boolean,
   caseInsensitiveFs?: boolean,
+  // Which schedule files carry an `enabled` that is not the target's to set
+  // (see push's `parentOwnedScheduleEnabled`): those compare without it.
+  parentOwnsScheduleEnabled?: (scheduleFilePath: string) => boolean,
 ): Promise<{ changes: Change[]; localMap: Record<string, string> }> {
   let [m1, m2] = els2
     ? await Promise.all([
@@ -2785,12 +2808,28 @@ async function compareDynFSElement(
           );
           throw error;
         }
+        if (
+          parentOwnsScheduleEnabled &&
+          getTypeStrFromPath(k) === "schedule" &&
+          parentOwnsScheduleEnabled(k)
+        ) {
+          delete parsedV?.enabled;
+          delete parsedM2?.enabled;
+        }
         if (deepEqual(parsedV, parsedM2)) {
           continue;
         }
       } else if (k.endsWith(".yaml")) {
         const before = parseYaml(k, m2[k]);
         const after = parseYaml(k, v);
+        if (
+          parentOwnsScheduleEnabled &&
+          getTypeStrFromPath(k) === "schedule" &&
+          parentOwnsScheduleEnabled(k)
+        ) {
+          delete before?.enabled;
+          delete after?.enabled;
+        }
         if (deepEqual(before, after)) {
           continue;
         }
@@ -4543,6 +4582,86 @@ async function checkServerLockJobs(
   }
 }
 
+// The checkout's `!inline` references of one flow (module id -> file), as
+// `ZipFSElement`'s `localFlowInlineMapping` names the remote render. Empty
+// when the flow has no local flow.yaml.
+export async function checkoutInlineNames(
+  flowYamlPath: string,
+): Promise<Record<string, string>> {
+  let flow: any;
+  try {
+    flow = await yamlParseFile(flowYamlPath);
+  } catch {
+    return {};
+  }
+  const mapping = extractCurrentMapping(
+    flow?.value?.modules,
+    {},
+    flow?.value?.failure_module,
+    flow?.value?.preprocessor_module,
+  );
+  // A reference that leaves the flow folder would render the remote step
+  // onto another item's path; such a step keeps its summary-derived name.
+  for (const [id, ref] of Object.entries(mapping)) {
+    if (path.isAbsolute(ref) || ref.split(/[\\/]/).includes("..")) {
+      delete mapping[id];
+    }
+  }
+  return mapping;
+}
+
+// For a path the parent also has, a fork's export writes the parent's
+// `enabled` and the backend refuses to enable the fork's copy: the file's flag
+// is the parent's. A parent that cannot be listed (a fork-scoped job token)
+// may own every path. Undefined when the target is not a fork.
+async function parentOwnedScheduleEnabled(
+  workspaceId: string,
+): Promise<((scheduleFilePath: string) => boolean) | undefined> {
+  let parentWorkspaceId: string | null | undefined;
+  let known = false;
+  try {
+    const { workspaces } = await wmill.listUserWorkspaces();
+    const entry = workspaces?.find((w) => w.id === workspaceId);
+    known = entry !== undefined;
+    parentWorkspaceId = entry?.parent_workspace_id;
+  } catch {
+    // A fork-scoped token cannot list workspaces.
+  }
+  // No parent on record (a fork whose parent was deleted keeps its
+  // `wm-fork-` id): nothing defers to a parent any more.
+  if (known && !parentWorkspaceId) {
+    return undefined;
+  }
+  // Without the listing only the `wm-fork-` prefix says fork: a dev
+  // workspace (custom id) reached with a fork-scoped token counts as none.
+  if (!isForkWorkspace(workspaceId, parentWorkspaceId)) {
+    return undefined;
+  }
+  let parentPaths: Set<string> | undefined;
+  if (parentWorkspaceId) {
+    try {
+      parentPaths = new Set();
+      const perPage = 100;
+      for (let page = 1; ; page++) {
+        const batch = await wmill.listSchedules({
+          workspace: parentWorkspaceId,
+          page,
+          perPage,
+        });
+        batch.forEach((s) => parentPaths!.add(s.path));
+        if (batch.length < perPage) break;
+      }
+    } catch {
+      parentPaths = undefined;
+    }
+  }
+  return (scheduleFilePath) =>
+    parentPaths === undefined ||
+    parentPaths.has(
+      removeType(scheduleFilePath, "schedule").replaceAll(SEP, "/"),
+    );
+}
+
 export async function push(
   opts: GlobalOptions &
     SyncOptions & {
@@ -4633,6 +4752,9 @@ export async function push(
 
   // Merge CLI flags with resolved settings (CLI flags take precedence only for explicit overrides)
   opts = mergeCliWithEffectiveOptions(originalCliOpts, effectiveOpts);
+  const parentOwnsScheduleEnabled = opts.includeSchedules
+    ? await parentOwnedScheduleEnabled(workspace.workspaceId)
+    : undefined;
 
   if (opts.lint) {
     log.info("Running lint validation before push...");
@@ -4696,6 +4818,10 @@ export async function push(
     // ignore
   }
 
+  // See ZipFSElement's `localFlowInlineMapping`.
+  const localFlowInlineMapping = (flowDir: string) =>
+    checkoutInlineNames(path.join(process.cwd(), flowDir, "flow.yaml"));
+
   const remote = ZipFSElement(
     (await downloadZip(
       workspace,
@@ -4721,6 +4847,7 @@ export async function push(
     resourceTypeToIsFileset,
     false,
     parseSyncBehavior(opts.syncBehavior) >= 1,
+    localFlowInlineMapping,
   );
 
   const local = await FSFSElement(
@@ -4741,6 +4868,7 @@ export async function push(
     wsNameForFiles,
     false, // els1 (local) is not the remote source
     await isCaseInsensitiveFilesystem(process.cwd()),
+    parentOwnsScheduleEnabled,
   );
 
   // Detect resources/variables that the local config flags as ws_specific
@@ -5807,6 +5935,9 @@ export async function push(
                   originalLocalPath: originalWorkspaceSpecificPath,
                   permissionedAsContext,
                   wsSpecific: isWsSpecific ? true : undefined,
+                  enabledOwnedByParent: parentOwnsScheduleEnabled?.(
+                    change.path,
+                  ),
                   keyPushOpts: {
                     noninteractive:
                       (opts.yes ?? false) || !process.stdin.isTTY,
@@ -5942,6 +6073,9 @@ export async function push(
                   originalLocalPath: localFilePath,
                   permissionedAsContext,
                   wsSpecific: isAddedWsSpecific ? true : undefined,
+                  enabledOwnedByParent: parentOwnsScheduleEnabled?.(
+                    change.path,
+                  ),
                   keyPushOpts: {
                     noninteractive:
                       (opts.yes ?? false) || !process.stdin.isTTY,
diff --git a/cli/src/core/constants.ts b/cli/src/core/constants.ts
index 52b000d4c2..7017136a66 100644
--- a/cli/src/core/constants.ts
+++ b/cli/src/core/constants.ts
@@ -10,4 +10,4 @@ export const WM_FORK_PREFIX = "wm-fork";
 // (e.g. utils.ts) can read it without importing main.ts and creating a circular
 // dependency (main → workspace → utils → main) that triggers a TDZ.
 // Re-exported from main.ts for backwards compatibility.
-export const VERSION = "1.800.1";
+export const VERSION = "1.803.0";
diff --git a/cli/src/core/log.ts b/cli/src/core/log.ts
index e78450597f..c4cf256e9d 100644
--- a/cli/src/core/log.ts
+++ b/cli/src/core/log.ts
@@ -41,6 +41,12 @@ export function warnStderr(msg: unknown) {
   console.error(`\x1b[33m${String(msg)}\x1b[39m`);
 }
 
+// A notice that must reach a log even in silent (`--json-output`) mode:
+// stderr keeps stdout parseable, and a job that runs the CLI records both.
+export function warnAlways(msg: unknown) {
+  console.error(`\x1b[33m${String(msg)}\x1b[39m`);
+}
+
 export function error(msg: unknown) {
   console.error(`\x1b[31m${String(msg)}\x1b[39m`);
 }
diff --git a/cli/src/guidance/core.ts b/cli/src/guidance/core.ts
index 100bea6e53..2a9bb34fe0 100644
--- a/cli/src/guidance/core.ts
+++ b/cli/src/guidance/core.ts
@@ -115,6 +115,8 @@ Local previews exist for every entity type and don't deploy:
 - \`wmill flow preview <flow_path> -d '<args>'\` — run a local flow.yaml.
 - \`wmill app dev\` — live-reload dev server for raw apps.
 
+An argument typed as a resource takes the bare string \`"$res:<path>"\` as its whole value (a variable takes \`"$var:<path>"\`) — never an object wrapper like \`{"$res": "<path>"}\`, and never a plain path. See the \`resources\` skill.
+
 Argument shapes and per-language details live in the \`write-script-<lang>\`, \`write-flow\`, and \`raw-app\` skills.
 
 ## Keeping metadata in sync
diff --git a/cli/src/guidance/skills.gen.ts b/cli/src/guidance/skills.gen.ts
index 62027ab2ef..5271167a07 100644
--- a/cli/src/guidance/skills.gen.ts
+++ b/cli/src/guidance/skills.gen.ts
@@ -5116,6 +5116,8 @@ If the user hasn't already told you to run/test the flow, offer it as a one-sent
 
 If the user already asked to test/run/try the flow in their original request, skip the offer and just execute \`wmill flow preview <path> -d '<args>'\` directly — pick plausible args from the flow's input schema.
 
+An input typed as a resource (\`format: resource-<type>\` in the schema) takes the bare string \`"$res:<path>"\` as its whole value — \`-d '{"db": "$res:f/databases/postgres_prod"}'\`, not \`{"db": {"$res": "..."}}\` and not a plain path. Same for a variable, with \`"$var:<path>"\`. See the \`resources\` skill.
+
 \`wmill flow preview\` is safe to run yourself (it does not deploy). \`wmill generate-metadata\` does not deploy either (it only writes local lock/hash files) but re-resolves deps — offer it and run on agreement, unless the project's \`AGENTS.md\` opts into automatic metadata. After running it, check the regenerated \`.lock\` diff and tell the user which inline-script dependency versions changed, so they can catch an unwanted bump before deploying. Only \`wmill sync push\` deploys; run it only when the user explicitly asks.
 
 ### Visual preview
@@ -6188,6 +6190,41 @@ Reference other resources:
 }
 \`\`\`
 
+## Passing a Resource or Variable as a Run Argument
+
+A script or flow argument typed as a resource (schema \`format: resource-<type>\`) is passed as
+the **bare string** \`$res:<path>\` — the whole argument value. Same for a variable, with
+\`$var:<path>\`. This applies everywhere job arguments are supplied: \`wmill script run/preview\`,
+\`wmill flow run/preview\`, the \`runScriptByPath\` / \`runFlowByPath\` API, a schedule's \`args\`, a
+trigger's configured static args.
+
+\`\`\`json
+{
+  "db": "$res:f/databases/postgres_prod",
+  "api_token": "$var:g/all/api_token"
+}
+\`\`\`
+
+The reference is resolved when the job runs, under the job's run-as identity — the caller for an
+ordinary run, but the configured principal for a schedule, a trigger, or a runnable set to run on
+behalf of someone else. The run fails if that identity cannot read the referenced resource or
+variable.
+
+**Never wrap it in an object.** The resolver only rewrites a JSON value that *is* a string
+starting with \`$res:\` / \`$var:\`; keys are never inspected. These are all wrong and are passed
+through to the script unchanged:
+
+\`\`\`json
+{ "db": { "$res": "f/databases/postgres_prod" } }
+{ "db": { "resource": "f/databases/postgres_prod" } }
+{ "db": "f/databases/postgres_prod" }
+\`\`\`
+
+The string may sit anywhere a string can — a top-level argument, a nested object field
+(\`{ "gh_auth": { "token": "$var:g/all/gh_token" } }\`), or an array element (array elements are
+walked only while nested at most two levels deep, and only for arrays of at most 1000 items).
+The prefix must be on the string itself.
+
 ## Common Resource Types
 
 ### PostgreSQL
@@ -7074,11 +7111,11 @@ flow related commands
 - \`flow push <file_path:string> <remote_path:string>\` - push a local flow spec. This overrides any remote versions.
   - \`--message <message:string>\` - Deployment message
 - \`flow run <path:string>\` - run a flow by path.
-  - \`-d --data <data:string>\` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-.
+  - \`-d --data <data:string>\` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-. A resource argument is the bare string $res:<path> as its whole value, and a variable argument is the bare string $var:<path> — not an object wrapper keyed on $res/$var, and not a plain path.
   - \`-s --silent\` - Do not ouput anything other then the final output. Useful for scripting.
   - \`--tag <tag:string>\` - Override the worker tag the run is dispatched to (e.g. to route it to dev workers instead of the flow's default tag).
 - \`flow preview <flow_path:string>\` - preview a local flow without deploying it. Runs the flow definition from local files and uses local PathScripts by default. Pass --step <id> to run only one module in isolation (resolves nested steps inside branchone/branchall/forloopflow/whileloopflow plus the special preprocessor/failure modules; supported step types: rawscript, script, flow).
-  - \`-d --data <data:string>\` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-.
+  - \`-d --data <data:string>\` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-. A resource argument is the bare string $res:<path> as its whole value, and a variable argument is the bare string $var:<path> — not an object wrapper keyed on $res/$var, and not a plain path.
   - \`-s --silent\` - Do not output anything other then the final output. Useful for scripting.
   - \`--remote\` - Use deployed workspace scripts for PathScript steps instead of local files.
   - \`--step <step_id:string>\` - Run only the named step instead of the whole flow. Honors --data as the step's args and --remote / local-PathScript resolution the same way the full-flow preview does.
@@ -7474,11 +7511,11 @@ script related commands
   - \`--json\` - Output as JSON (for piping to jq)
 - \`script show <path:file>\` - show a script's content (alias for get)
 - \`script run <path:file>\` - run a script by path
-  - \`-d --data <data:file>\` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-.
+  - \`-d --data <data:file>\` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-. A resource argument is the bare string $res:<path> as its whole value, and a variable argument is the bare string $var:<path> — not an object wrapper keyed on $res/$var, and not a plain path.
   - \`-s --silent\` - Do not output anything other then the final output. Useful for scripting.
   - \`--tag <tag:string>\` - Override the worker tag the run is dispatched to (e.g. to route it to dev workers instead of the script's default tag).
 - \`script preview <path:file>\` - preview a local script without deploying it. Supports both regular and codebase scripts.
-  - \`-d --data <data:file>\` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-.
+  - \`-d --data <data:file>\` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-. A resource argument is the bare string $res:<path> as its whole value, and a variable argument is the bare string $var:<path> — not an object wrapper keyed on $res/$var, and not a plain path.
   - \`-s --silent\` - Do not output anything other than the final output. Useful for scripting.
   - \`--tag <tag:string>\` - Override the worker tag the preview is dispatched to (e.g. to route it to dev workers instead of the script's default tag).
 - \`script new <path:file> <language:string>\` - create a new script
diff --git a/cli/src/types.ts b/cli/src/types.ts
index c9244a8f4c..9c517ff3c7 100644
--- a/cli/src/types.ts
+++ b/cli/src/types.ts
@@ -189,6 +189,8 @@ export interface PushObjOptions {
   keyPushOpts?: PushWorkspaceKeyOptions;
   /** TypeScript runtime a bare `.ts` denotes, for raw-app runnables */
   defaultTs?: "bun" | "deno";
+  /** schedule push into a fork: the file's `enabled` is the parent's */
+  enabledOwnedByParent?: boolean;
 }
 
 /**
@@ -217,6 +219,7 @@ export async function pushObj(
     wsSpecific,
     keyPushOpts,
     defaultTs,
+    enabledOwnedByParent,
   } = opts;
   const typeEnding = getTypeStrFromPath(p);
 
@@ -250,7 +253,7 @@ export async function pushObj(
   } else if (typeEnding === "resource-type") {
     await pushResourceType(workspace, p, befObj, newObj);
   } else if (typeEnding === "schedule") {
-    await pushSchedule(workspace, p, befObj, newObj, permissionedAsContext);
+    await pushSchedule(workspace, p, befObj, newObj, permissionedAsContext, enabledOwnedByParent);
   } else if (typeEnding === "http_trigger") {
     await pushTrigger("http", workspace, p, befObj, newObj, permissionedAsContext);
   } else if (typeEnding === "websocket_trigger") {
diff --git a/cli/test/push_diff_convergence_unit.test.ts b/cli/test/push_diff_convergence_unit.test.ts
new file mode 100644
index 0000000000..14e248c03e
--- /dev/null
+++ b/cli/test/push_diff_convergence_unit.test.ts
@@ -0,0 +1,298 @@
+import { afterAll, beforeAll, expect, test } from "bun:test";
+import JSZip from "jszip";
+import { mkdtempSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, sep } from "node:path";
+import {
+  checkoutInlineNames,
+  compareDynFSElement,
+  ZipFSElement,
+} from "../src/commands/sync/sync.ts";
+
+// The differ also reads the working tree (shared lockfiles, dependency files);
+// an empty one keeps that out of the picture.
+const originalCwd = process.cwd();
+beforeAll(() => {
+  process.chdir(mkdtempSync(join(tmpdir(), "wmill-push-diff-")));
+});
+afterAll(() => {
+  process.chdir(originalCwd);
+});
+
+// A push is only useful when a second run of it finds nothing left to do.
+// These pin the two shapes that used to be listed on every run of a push into
+// a fork while the push itself either applied nothing or aborted.
+
+type Mock = {
+  isDirectory: boolean;
+  path: string;
+  getContentText(): Promise<string>;
+  getChildren(): AsyncIterable<Mock>;
+};
+
+// Both sides of the differ use the OS separator; fixtures are written with
+// "/" and rows are read back the same way.
+const osPath = (p: string) => p.split("/").join(sep);
+const slashPath = (p: string) => p.split(sep).join("/");
+
+function local(files: Record<string, string>): Mock {
+  return {
+    isDirectory: true,
+    path: "",
+    async getContentText() {
+      return "";
+    },
+    async *getChildren() {
+      for (const [path, content] of Object.entries(files)) {
+        yield {
+          isDirectory: false,
+          path: osPath(path),
+          async getContentText() {
+            return content;
+          },
+          async *getChildren() {},
+        };
+      }
+    },
+  };
+}
+
+const noIgnore = () => false;
+
+async function diff(
+  localEl: Mock,
+  remoteEl: Mock,
+  skips: Record<string, unknown>,
+  parentOwnsScheduleEnabled?: (scheduleFilePath: string) => boolean,
+) {
+  const { changes } = await compareDynFSElement(
+    localEl as any,
+    remoteEl as any,
+    noIgnore,
+    false,
+    skips as any,
+    true,
+    [],
+    false,
+    undefined,
+    undefined,
+    false,
+    false,
+    parentOwnsScheduleEnabled,
+  );
+  return changes.map((c) => `${c.name} ${slashPath(c.path)}`);
+}
+
+const SCHEDULE = (enabled: string) =>
+  `summary: nightly\nargs: {}\nenabled: ${enabled}\nis_flow: true\nschedule: 0 0 0 * * *\nscript_path: f/mail/flow\ntimezone: UTC\n`;
+
+test("push into a fork: a schedule the parent also has compares without `enabled`", async () => {
+  const remote = local({ "f/mail/nightly.schedule.yaml": SCHEDULE("true") });
+  const skips = { includeSchedules: true };
+  // The parent has `f/mail/nightly`; any other schedule is the fork's own.
+  const parentHas = (filePath: string) =>
+    slashPath(filePath) === "f/mail/nightly.schedule.yaml";
+
+  // Not a fork: `enabled` is compared like any other field.
+  expect(
+    await diff(
+      local({ "f/mail/nightly.schedule.yaml": SCHEDULE("false") }),
+      remote,
+      skips,
+    ),
+  ).toEqual(["edited f/mail/nightly.schedule.yaml"]);
+  expect(
+    await diff(
+      local({ "f/mail/nightly.schedule.yaml": SCHEDULE("false") }),
+      remote,
+      skips,
+      parentHas,
+    ),
+  ).toEqual([]);
+  // The key being absent is the same case as it differing.
+  expect(
+    await diff(
+      local({
+        "f/mail/nightly.schedule.yaml": SCHEDULE("false").replace(
+          "enabled: false\n",
+          "",
+        ),
+      }),
+      remote,
+      skips,
+      parentHas,
+    ),
+  ).toEqual([]);
+  // Only `enabled` is set aside.
+  expect(
+    await diff(
+      local({
+        "f/mail/nightly.schedule.yaml": SCHEDULE("false").replace(
+          "0 0 0 * * *",
+          "0 0 1 * * *",
+        ),
+      }),
+      remote,
+      skips,
+      parentHas,
+    ),
+  ).toEqual(["edited f/mail/nightly.schedule.yaml"]);
+  // A schedule only the fork has keeps toggling from the file.
+  expect(
+    await diff(
+      local({ "f/mail/fork_only.schedule.yaml": SCHEDULE("true") }),
+      local({ "f/mail/fork_only.schedule.yaml": SCHEDULE("false") }),
+      skips,
+      parentHas,
+    ),
+  ).toEqual(["edited f/mail/fork_only.schedule.yaml"]);
+});
+
+const SUMMARY = "process one mail end-to-end (spam check, classify)";
+
+function remoteFlow(content: string) {
+  const zip = new JSZip();
+  zip.file(
+    "f/mail/flow_v2.flow.json",
+    JSON.stringify({
+      summary: "Flow V2",
+      description: "",
+      value: {
+        modules: [
+          {
+            id: "a",
+            summary: SUMMARY,
+            value: {
+              type: "rawscript",
+              content,
+              input_transforms: {},
+              language: "python3",
+            },
+          },
+        ],
+      },
+      schema: { type: "object", properties: {} },
+    }),
+    // The backend's archive carries no directory entries.
+    { createFolders: false },
+  );
+  return zip;
+}
+
+function localFlow(content: string) {
+  return local({
+    "f/mail/flow_v2.flow/flow.yaml": `summary: Flow V2\ndescription: ''\nvalue:\n  modules:\n    - id: a\n      summary: ${SUMMARY}\n      value:\n        type: rawscript\n        content: '!inline process_mail.inline_script.py'\n        input_transforms: {}\n        language: python3\nschema:\n  type: object\n  properties: {}\n`,
+    "f/mail/flow_v2.flow/process_mail.inline_script.py": content,
+  });
+}
+
+// The checkout's `!inline` references, as `push` reads them from its flow.yaml.
+const checkoutNames = async (flowDir: string) =>
+  slashPath(flowDir) === "f/mail/flow_v2.flow"
+    ? { a: "process_mail.inline_script.py" }
+    : {};
+
+test("push: an inline script the checkout names differently from the step summary is not a rename", async () => {
+  const skips = { includeSchedules: false };
+  const render = (content: string, withCheckout: boolean) =>
+    ZipFSElement(
+      remoteFlow(content),
+      true,
+      "bun",
+      {},
+      {},
+      false,
+      true,
+      withCheckout ? checkoutNames : undefined,
+    ) as any;
+
+  // Same content, file named by hand: three rows before, none after.
+  expect(
+    await diff(
+      localFlow("def main():\n    return 1\n"),
+      render("def main():\n    return 1\n", false),
+      skips,
+    ),
+  ).toEqual([
+    "deleted f/mail/flow_v2.flow/process_one_mail_end-to-end_(spam_check,_classify).inline_script.py",
+    "edited f/mail/flow_v2.flow/flow.yaml",
+    "added f/mail/flow_v2.flow/process_mail.inline_script.py",
+  ]);
+  expect(
+    await diff(
+      localFlow("def main():\n    return 1\n"),
+      render("def main():\n    return 1\n", true),
+      skips,
+    ),
+  ).toEqual([]);
+
+  // A real edit is still one.
+  expect(
+    await diff(
+      localFlow("def main():\n    return 2\n"),
+      render("def main():\n    return 1\n", true),
+      skips,
+    ),
+  ).toEqual(["edited f/mail/flow_v2.flow/process_mail.inline_script.py"]);
+});
+
+test("push: a checkout name that collides with another step's summary-derived name keeps two files", async () => {
+  const zip = new JSZip();
+  zip.file(
+    "f/mail/flow_v2.flow.json",
+    JSON.stringify({
+      summary: "Flow V2",
+      description: "",
+      value: {
+        modules: [
+          {
+            id: "a",
+            summary: SUMMARY,
+            value: {
+              type: "rawscript",
+              content: "a",
+              input_transforms: {},
+              language: "python3",
+            },
+          },
+          {
+            id: "b",
+            summary: "process_mail",
+            value: {
+              type: "rawscript",
+              content: "b",
+              input_transforms: {},
+              language: "python3",
+            },
+          },
+        ],
+      },
+      schema: { type: "object", properties: {} },
+    }),
+    { createFolders: false },
+  );
+  // Nothing local: every rendered file is a "deleted" row, one per path.
+  const rows = await diff(
+    local({}),
+    ZipFSElement(zip, true, "bun", {}, {}, false, true, checkoutNames) as any,
+    { includeSchedules: false },
+  );
+  expect(rows.filter((r) => r.endsWith(".py")).sort()).toEqual([
+    "deleted f/mail/flow_v2.flow/process_mail.inline_script.py",
+    "deleted f/mail/flow_v2.flow/process_one_mail_end-to-end_(spam_check,_classify).inline_script.py",
+  ]);
+});
+
+test("push: checkout inline names stay inside the flow folder", async () => {
+  const flowYaml = join(process.cwd(), "flow.yaml");
+  writeFileSync(
+    flowYaml,
+    `summary: x\nvalue:\n  modules:\n    - id: a\n      value:\n        type: rawscript\n        content: '!inline a.inline_script.py'\n        language: python3\n    - id: b\n      value:\n        type: rawscript\n        content: '!inline ../shared/b.py'\n        language: python3\n    - id: c\n      value:\n        type: rawscript\n        content: '!inline /tmp/c.py'\n        language: python3\n`,
+  );
+  expect(await checkoutInlineNames(flowYaml)).toEqual({
+    a: "a.inline_script.py",
+  });
+  expect(
+    await checkoutInlineNames(join(process.cwd(), "missing.yaml")),
+  ).toEqual({});
+});
diff --git a/docs/feature-telemetry.md b/docs/feature-telemetry.md
index 5d7f0b2c29..5cef3c9364 100644
--- a/docs/feature-telemetry.md
+++ b/docs/feature-telemetry.md
@@ -4,9 +4,9 @@
 anonymous usage-stats payload. It answers "does anyone use this, and which variant do they pick"
 without any identifying data leaving the instance.
 
-It currently carries 28 registered actions across fourteen features (`ai_session`, `ai_chat`,
+It currently carries 32 registered actions across fifteen features (`ai_session`, `ai_chat`,
 `ai_fix`, `ai_agent`, `ai_agent_eval`, `flow_editor`, `flow_run`, `flow_step`, `run_form`,
-`debugger`, `trigger`, `command_script`, `hub_script`, `usage_meter`). Nearly all of the
+`debugger`, `trigger`, `command_script`, `hub_script`, `usage_meter`, `sso_groups_claim`). Nearly all of the
 product is uninstrumented, so new user-facing work is the opportunity to change that.
 
 ## When to instrument
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 536b178852..6fd6413d59 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -1,12 +1,12 @@
 {
 	"name": "@windmill-labs/components",
-	"version": "1.800.1",
+	"version": "1.803.0",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "@windmill-labs/components",
-			"version": "1.800.1",
+			"version": "1.803.0",
 			"hasInstallScript": true,
 			"license": "AGPL-3.0",
 			"dependencies": {
diff --git a/frontend/package.json b/frontend/package.json
index ed8c18768f..f8f952ede6 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@windmill-labs/components",
-	"version": "1.800.1",
+	"version": "1.803.0",
 	"scripts": {
 		"dev": "vite dev",
 		"dev:ui-builder": "mv static/ui_builder static/ui_builder.dev-disabled 2>/dev/null || true ; trap 'mv static/ui_builder.dev-disabled static/ui_builder 2>/dev/null || true' EXIT ; vite dev",
diff --git a/frontend/src/lib/aiStore.test.ts b/frontend/src/lib/aiStore.test.ts
index fed6147b62..be8980e93a 100644
--- a/frontend/src/lib/aiStore.test.ts
+++ b/frontend/src/lib/aiStore.test.ts
@@ -35,6 +35,24 @@ describe('setCopilotInfo legacy /thinking migration', () => {
 		expect(info.aiModels.map((m) => m.model)).toEqual(['claude-sonnet-4-6'])
 	})
 
+	it('keeps the models but turns the assistant off when the workspace disabled it', () => {
+		setCopilotInfo({
+			providers: {
+				anthropic: {
+					resource_path: 'u/admin/anthropic',
+					models: ['claude-sonnet-4-6']
+				}
+			},
+			copilot_disabled: true
+		})
+
+		const info = get(copilotInfo)
+		expect(info.enabled).toBe(false)
+		expect(info.workspaceDisabled).toBe(true)
+		// The providers still describe what AI agent steps can run on.
+		expect(info.aiModels.map((m) => m.model)).toEqual(['claude-sonnet-4-6'])
+	})
+
 	it('defaults provider web search on unless explicitly disabled', () => {
 		setCopilotInfo({
 			providers: {
diff --git a/frontend/src/lib/aiStore.ts b/frontend/src/lib/aiStore.ts
index 2d6a98c625..6ac98d69e8 100644
--- a/frontend/src/lib/aiStore.ts
+++ b/frontend/src/lib/aiStore.ts
@@ -41,6 +41,10 @@ export const copilotSessionModel = writable<ReasoningProviderModel | undefined>(
 
 export const copilotInfo = writable<{
 	enabled: boolean
+	// The workspace hid the assistant (`ai_config.copilot_disabled`). `enabled` is then false
+	// whatever the providers say, and the AI entry points that nudge "configure AI" when
+	// `enabled` is off render nothing at all instead.
+	workspaceDisabled: boolean
 	codeCompletionModel?: AIProviderModel
 	defaultModel?: AIProviderModel
 	metadataModel?: AIProviderModel
@@ -56,6 +60,7 @@ export const copilotInfo = writable<{
 	freeTier?: FreeTierInfo
 }>({
 	enabled: false,
+	workspaceDisabled: false,
 	codeCompletionModel: undefined,
 	defaultModel: undefined,
 	metadataModel: undefined,
@@ -71,7 +76,7 @@ export const copilotInfo = writable<{
 aiUserDisabled.subscribe((disabled) => {
 	copilotInfo.update((info) => ({
 		...info,
-		enabled: info.aiModels.length > 0 && !disabled
+		enabled: info.aiModels.length > 0 && !disabled && !info.workspaceDisabled
 	}))
 })
 
@@ -126,9 +131,11 @@ export function setCopilotInfo(aiConfig: AIConfig) {
 			return model
 		})
 
+		const workspaceDisabled = aiConfig.copilot_disabled === true
 		copilotInfo.set({
-			// Providers are configured; the per-user opt-out is the only thing that can gate it off.
-			enabled: !get(aiUserDisabled),
+			// Providers are configured; only the workspace or per-user opt-outs can gate it off.
+			enabled: !workspaceDisabled && !get(aiUserDisabled),
+			workspaceDisabled,
 			// Strip the deprecated /thinking suffix from the configured model slots too,
 			// otherwise a workspace whose default still carries it sends an invalid model id.
 			codeCompletionModel: stripModelSuffix(aiConfig.code_completion_model),
@@ -146,6 +153,7 @@ export function setCopilotInfo(aiConfig: AIConfig) {
 
 		copilotInfo.set({
 			enabled: false,
+			workspaceDisabled: aiConfig.copilot_disabled === true,
 			codeCompletionModel: undefined,
 			defaultModel: undefined,
 			metadataModel: undefined,
diff --git a/frontend/src/lib/common.ts b/frontend/src/lib/common.ts
index 259d9c1cf9..0d76b1a0b8 100644
--- a/frontend/src/lib/common.ts
+++ b/frontend/src/lib/common.ts
@@ -35,6 +35,8 @@ export interface SchemaProperty {
 	}
 	min?: number
 	max?: number
+	/** Height a string field's text area opens at, in rows. */
+	minRows?: number
 	currency?: string
 	currencyLocale?: string
 	multiselect?: boolean
diff --git a/frontend/src/lib/components/AIProviderPicker.svelte b/frontend/src/lib/components/AIProviderPicker.svelte
index 4392a2d513..19b1346b84 100644
--- a/frontend/src/lib/components/AIProviderPicker.svelte
+++ b/frontend/src/lib/components/AIProviderPicker.svelte
@@ -4,11 +4,7 @@
 	import { fetchAvailableModels, AI_PROVIDERS } from './copilot/lib'
 	import type { AIProvider, ProviderConfig } from '$lib/gen'
 	import { workspaceStore } from '$lib/stores'
-	import { get } from 'svelte/store'
-	import ToggleButtonGroup from './common/toggleButton-v2/ToggleButtonGroup.svelte'
-	import ToggleButton from './common/toggleButton-v2/ToggleButton.svelte'
 	import ResourcePicker from './ResourcePicker.svelte'
-	import ToggleButtonMore from './common/toggleButton-v2/ToggleButtonMore.svelte'
 	import Toggle from './Toggle.svelte'
 	import { saveConfig, removeConfig, isSameAsStoredConfig } from './aiProviderStorage'
 	import AIReasoningEffortPicker from './AIReasoningEffortPicker.svelte'
@@ -17,9 +13,20 @@
 		value: ProviderConfig | undefined
 		disabled?: boolean
 		actions?: Snippet
+		/** The workspace the surface operates on, which a session or fork editor sets to something
+		 *  other than the one being navigated. Resources and the models read off them are per
+		 *  workspace, so without it this offers what the wrong one holds. */
+		workspace?: string | undefined
 	}
 
-	let { value: _uncheckedValue = $bindable(), disabled = false, actions }: Props = $props()
+	let {
+		value: _uncheckedValue = $bindable(),
+		disabled = false,
+		actions,
+		workspace = undefined
+	}: Props = $props()
+
+	let effectiveWorkspace = $derived(workspace ?? $workspaceStore ?? '')
 
 	let value = $derived.by(() => {
 		if (!_uncheckedValue || typeof _uncheckedValue !== 'object') return undefined
@@ -30,7 +37,13 @@
 	let availableModels = $state<string[]>([])
 	let filterText = $state('')
 
-	let modelsCache = new Map<AIProvider, string[]>()
+	// Keyed by provider *and* path: two `customai` resources point at different base URLs, so they
+	// do not share a model list.
+	let modelsCache = new Map<string, string[]>()
+
+	// The resource picker offers every provider type at once and the pick is what names the kind.
+	// One string for the component's life: it is what the picker queries with.
+	const providerResourceTypes = Object.keys(AI_PROVIDERS).join(',')
 
 	if (!_uncheckedValue) {
 		_uncheckedValue = {
@@ -57,12 +70,6 @@
 		return r
 	})
 
-	// Provider options for the toggle button group
-	const providerOptions = Object.entries(AI_PROVIDERS).map(([key, details]) => ({
-		value: key as AIProvider,
-		label: details.label
-	}))
-
 	async function loadModels(signal?: AbortSignal) {
 		const provider = value?.kind
 		const resourceValue = value?.resource
@@ -73,20 +80,20 @@
 		}
 
 		loading = true
-		if (modelsCache.has(provider)) {
-			availableModels = modelsCache.get(provider) || []
+		const cacheKey = `${effectiveWorkspace}:${provider}:${resourcePath}`
+		if (modelsCache.has(cacheKey)) {
+			availableModels = modelsCache.get(cacheKey) || []
 			loading = false
 			return
 		}
 
 		try {
-			const workspace = get(workspaceStore) || ''
-			const models = await fetchAvailableModels(resourcePath, workspace, provider, signal)
+			const models = await fetchAvailableModels(resourcePath, effectiveWorkspace, provider, signal)
 			if (signal?.aborted) {
 				return
 			}
 			availableModels = models
-			modelsCache.set(provider, models)
+			modelsCache.set(cacheKey, models)
 		} catch (e) {
 			if (signal?.aborted) {
 				return
@@ -101,15 +108,24 @@
 		}
 	}
 
-	// Handle provider selection
-	function onProviderChange(selectedProvider: AIProvider) {
-		if (value) {
-			value.kind = selectedProvider
-			value.resource = ''
-			value.model = ''
-			// Reasoning effort is model-specific; reset it with the model.
-			value.reasoning_effort = undefined
+	/**
+	 * The provider kind follows the resource that was picked. Driven by the pick rather than by an
+	 * effect on the picker's `valueType`, which also resolves for the value the field was opened on
+	 * and would rewrite a saved config just for being looked at.
+	 */
+	function onResourcePicked(_path: string | undefined, type: string | undefined) {
+		// An empty type is the placeholder the picker keeps for a saved path it could not find. It
+		// says nothing about the provider, so the kind stands.
+		if (!value || !type || !(type in AI_PROVIDERS)) {
+			return
 		}
+		if (value.kind === type) {
+			return
+		}
+		value.kind = type as AIProvider
+		// Models are per provider, and a reasoning token is per model.
+		value.model = ''
+		value.reasoning_effort = undefined
 	}
 
 	// Helper functions to handle $res: prefix like ObjectResourceInput does
@@ -165,97 +181,74 @@
 	})
 </script>
 
-<div class="w-full flex flex-col gap-1 border rounded-md p-4">
-	<!-- Provider Selection -->
-	<ToggleButtonGroup
-		selected={value?.kind}
-		onSelected={onProviderChange}
-		{disabled}
-		wrap
-		tabListClass="w-full"
-	>
-		{#snippet children({ item })}
-			{#each providerOptions.slice(0, 3) as option}
-				<ToggleButton value={option.value} label={option.label} {item} />
-			{/each}
-			<ToggleButtonMore
-				class="ml-auto"
-				btnText={providerOptions.findIndex((p) => p.value === value?.kind) >= 3 ? '' : 'More'}
-				togglableItems={providerOptions.slice(3)}
-				{item}
-				bind:selected={() => value?.kind, (v) => v && onProviderChange(v)}
-			/>
-		{/snippet}
-	</ToggleButtonGroup>
-
-	<!-- Resource Selection -->
-	<div class="flex flex-col rounded-md pt-2 gap-2">
-		<div class="flex flex-col gap-1">
-			<p class="text-xs font-normal text-primary">resource</p>
-			<ResourcePicker
-				bind:value={
-					() => resourceValueToPath(value?.resource),
-					(v) => {
-						if (value) {
-							value.resource = pathToResourceValue(v) ?? ''
-						}
+<div class="w-full flex flex-col gap-3 border rounded-md p-4">
+	<div class="flex flex-col gap-1">
+		<span class="text-xs font-normal text-secondary">Resource</span>
+		<!-- No auto-select: this picker spans every provider type, so a single candidate means "the
+		     only AI resource in the workspace" rather than "the only one of the kind this agent uses".
+		     Taking it would redefine the agent's provider and drop its model, on open and unasked. -->
+		<ResourcePicker
+			bind:value={
+				() => resourceValueToPath(value?.resource),
+				(v) => {
+					if (value) {
+						value.resource = pathToResourceValue(v) ?? ''
 					}
 				}
-				resourceType={value?.kind}
-				disabled={disabled || !value?.kind}
-				placeholder="Select resource"
-				selectFirst={true}
-			/>
-		</div>
+			}
+			resourceType={providerResourceTypes}
+			{disabled}
+			{workspace}
+			placeholder="Select an AI provider resource"
+			selectFirst={false}
+			onValueChange={onResourcePicked}
+		/>
+	</div>
 
-		<!-- Model Selection -->
+	<div class="flex flex-col gap-1">
+		<span class="text-xs font-normal text-secondary">Model</span>
+		<Select
+			{items}
+			bind:value={() => value?.model, (v) => value && (value.model = v ?? '')}
+			placeholder="Select model"
+			disabled={disabled || !value?.kind || !resourceValueToPath(value?.resource)}
+			onCreateItem={(r) => {
+				availableModels.push(r)
+				if (value) value.model = r
+			}}
+			createText="Press enter to use custom model"
+			{loading}
+			clearable={false}
+			noItemsMsg={'No models available'}
+			bind:filterText
+		/>
+	</div>
+
+	{#if value?.model}
 		<div class="flex flex-col gap-1">
-			<p class="text-xs font-normal text-primary">model</p>
-			<Select
-				{items}
-				bind:value={() => value?.model, (v) => value && (value.model = v ?? '')}
-				placeholder="Select model"
-				disabled={disabled || !value?.kind || !resourceValueToPath(value?.resource)}
-				onCreateItem={(r) => {
-					availableModels.push(r)
-					if (value) value.model = r
-				}}
-				createText="Press enter to use custom model"
-				{loading}
-				clearable={false}
-				noItemsMsg={'No models available'}
-				bind:filterText
+			<span class="text-xs font-normal text-secondary">Reasoning effort</span>
+			<AIReasoningEffortPicker
+				bind:value={() => value?.reasoning_effort, (v) => value && (value.reasoning_effort = v)}
+				providerConfig={value}
+				{disabled}
 			/>
 		</div>
+	{/if}
 
-		<!-- Reasoning Effort (shown once a model is selected) -->
-		{#if value?.model}
-			<div class="flex flex-col gap-1">
-				<p class="text-xs font-normal text-primary">reasoning effort</p>
-				<AIReasoningEffortPicker
-					bind:value={() => value?.reasoning_effort, (v) => value && (value.reasoning_effort = v)}
-					providerConfig={value}
-					{disabled}
-				/>
-			</div>
-		{/if}
-
-		<!-- Use as Default Checkbox -->
-		<div class="flex justify-end pt-1">
-			<Toggle
-				disabled={disabled || !value?.kind || !value?.resource || !value?.model}
-				bind:checked={useAsDefault}
-				options={{ right: 'Use as personal default for other new agents' }}
-				size="xs"
-				on:change={(e) => {
-					if (!e.detail) {
-						removeConfig()
-					} else {
-						saveConfig(value)
-					}
-				}}
-			/>
-		</div>
+	<div class="flex justify-end">
+		<Toggle
+			disabled={disabled || !value?.kind || !value?.resource || !value?.model}
+			bind:checked={useAsDefault}
+			options={{ right: 'Use as personal default for other new agents' }}
+			size="xs"
+			on:change={(e) => {
+				if (!e.detail) {
+					removeConfig()
+				} else {
+					saveConfig(value)
+				}
+			}}
+		/>
 	</div>
 
 	{@render actions?.()}
diff --git a/frontend/src/lib/components/AppConnectInner.svelte b/frontend/src/lib/components/AppConnectInner.svelte
index a9a0837d1f..320b3e36dd 100644
--- a/frontend/src/lib/components/AppConnectInner.svelte
+++ b/frontend/src/lib/components/AppConnectInner.svelte
@@ -21,9 +21,10 @@
 	} from '$lib/gen'
 	import { emptyString, truncateRev, urlize } from '$lib/utils'
 	import { registryEntryFor, registryCcCapableFor, stripSandboxSuffix } from './oauthRegistry'
-	import { createEventDispatcher, onDestroy, tick, untrack } from 'svelte'
+	import { createEventDispatcher, onDestroy, tick } from 'svelte'
 	import Path from './Path.svelte'
-	import { Button, RadioCard, Skeleton } from './common'
+	import { ListRow, RadioCard, Skeleton } from './common'
+	import { useListHighlight } from './common/listRow/listHighlight.svelte'
 	import ApiConnectForm from './ApiConnectForm.svelte'
 	import SearchItems from './SearchItems.svelte'
 	import WhitelistIp from './WhitelistIp.svelte'
@@ -42,7 +43,6 @@
 	import SyncResourceTypes from './SyncResourceTypes.svelte'
 	import Label from './Label.svelte'
 	import ResourcePathHint from './ResourcePathHint.svelte'
-	import { twMerge } from 'tailwind-merge'
 
 	interface Props {
 		step?: number
@@ -1027,15 +1027,8 @@
 	// Both lists start undefined and render skeletons; "nothing found" only means something
 	// once they have landed.
 	let listsLoaded = $derived(rankedConnectsManual !== undefined && rankedConnects !== undefined)
-	let highlightedIndex = $state(-1)
 	const rowDomId = (index: number) => `resource-type-row-${index}`
 
-	// Set at hover time rather than up front, so only the descriptions the row actually cut
-	// off carry a tooltip.
-	function titleIfTruncated(e: MouseEvent & { currentTarget: HTMLElement }) {
-		const el = e.currentTarget
-		el.title = el.scrollWidth > el.clientWidth ? (el.textContent?.trim() ?? '') : ''
-	}
 	const oauthRowOffset = $derived(customKeys.length)
 	const otherRowOffset = $derived(customKeys.length + (rankedConnects?.length ?? 0))
 
@@ -1054,53 +1047,23 @@
 		return best
 	}
 
-	// Filtering reshuffles the rows under the highlight: point it at the best match so Enter
-	// takes the top hit, and drop it entirely once the filter is cleared.
-	$effect(() => {
-		navItems
-		filter
-		untrack(() => (highlightedIndex = searching ? bestMatchIndex() : -1))
+	const highlight = useListHighlight({
+		count: () => navItems.length,
+		rowId: rowDomId,
+		// Sections are rendered in a fixed order, so the best match is not necessarily the
+		// first row; Enter should still take the top hit.
+		restingIndex: () => (searching ? bestMatchIndex() : -1),
+		onActivate: (index) => {
+			const item = navItems[index]
+			if (!item) return
+			item.oauth ? connectOauth(item.key) : selectFromOthers(item.key)
+		},
+		activateEnterFrom: [SEARCH_INPUT_ID]
 	})
 
-	// Scrolling rows under a resting pointer makes the browser fire `mouseenter` on each one,
-	// which would drag the highlight back under the cursor as the arrow keys move it. Only a
-	// real pointer move hands the highlight back to the mouse.
-	let pointerOwnsHighlight = $state(true)
-
-	function highlightHovered(index: number) {
-		if (pointerOwnsHighlight) highlightedIndex = index
-	}
-
-	function moveHighlight(delta: number) {
-		const count = navItems.length
-		if (count === 0) return
-		pointerOwnsHighlight = false
-		// Rows are tabbable buttons, so focus can sit on one. Enter then activates whatever is
-		// focused, which has to stay the highlighted row.
-		const rowWasFocused = document.activeElement?.id?.startsWith('resource-type-row-') ?? false
-		highlightedIndex =
-			highlightedIndex < 0
-				? delta > 0
-					? 0
-					: count - 1
-				: (highlightedIndex + delta + count) % count
-		const row = document.getElementById(rowDomId(highlightedIndex))
-		row?.scrollIntoView({ block: 'nearest' })
-		if (rowWasFocused) row?.focus()
-	}
-
 	function onListKeydown(e: KeyboardEvent) {
 		if (step !== 1) return
-		if (e.key === 'ArrowDown' || e.key === 'ArrowUp') {
-			e.preventDefault()
-			moveHighlight(e.key === 'ArrowDown' ? 1 : -1)
-		} else if (e.key === 'Enter' && (e.target as HTMLElement)?.id === SEARCH_INPUT_ID) {
-			// A focused row activates itself on Enter; this covers Enter typed in the search field.
-			const item = navItems[highlightedIndex]
-			if (!item) return
-			e.preventDefault()
-			item.oauth ? connectOauth(item.key) : selectFromOthers(item.key)
-		}
+		highlight.onKeydown(e)
 	}
 
 	let editScopes = $state(false)
@@ -1132,7 +1095,7 @@
 		<div
 			class="flex flex-col h-full min-h-0"
 			onkeydown={onListKeydown}
-			onpointermove={() => (pointerOwnsHighlight = true)}
+			onpointermove={highlight.pointerMoved}
 		>
 			<div class="shrink-0 pb-4">
 				<div class="relative w-full">
@@ -1146,28 +1109,6 @@
 				</div>
 			</div>
 
-			{#snippet resourceRow(key: string)}
-				<div class="flex flex-row items-center gap-4 w-full min-w-0 text-left">
-					<div class="shrink-0">
-						<IconedResourceType name={key} silent width="20px" height="20px" />
-					</div>
-					<div class="flex flex-col gap-1 min-w-0">
-						<div class="flex flex-row items-baseline gap-2 min-w-0">
-							<span class="truncate leading-5">{resourceTypeDisplayName(key)}</span>
-							<span class="shrink-0 font-mono text-2xs font-normal text-hint">{key}</span>
-						</div>
-						{#if resourceTypeDescriptions[key]}
-							<span
-								class="truncate text-xs font-normal leading-4 text-secondary"
-								onmouseenter={titleIfTruncated}
-							>
-								{plainDescription(resourceTypeDescriptions[key])}
-							</span>
-						{/if}
-					</div>
-				</div>
-			{/snippet}
-
 			{#snippet sectionHeading(title: string, count: number)}
 				<h2 class="mb-3 text-2xs font-normal uppercase text-secondary">
 					{title}{#if searching}<span class="ml-2 text-hint">{count}</span>{/if}
@@ -1175,26 +1116,29 @@
 			{/snippet}
 
 			{#snippet resourceButton(key: string, index: number, oauth: boolean)}
-				<Button
+				{#snippet icon()}
+					<IconedResourceType name={key} silent width="20px" height="20px" />
+				{/snippet}
+				{#snippet title()}
+					<span class="truncate leading-5">{resourceTypeDisplayName(key)}</span>
+					<span class="shrink-0 font-mono text-2xs font-normal text-hint">{key}</span>
+				{/snippet}
+				{#snippet subtitle()}
+					{plainDescription(resourceTypeDescriptions[key])}
+				{/snippet}
+				<!-- `highlighted`: the pointer moves the same highlight the arrow keys move, so
+				     the row's own hover is off — two lit rows at once would be ambiguous. -->
+				<ListRow
 					id={rowDomId(index)}
 					aiId={`app-connect-inner-${oauth ? 'oauth-' : ''}${key}`}
 					aiDescription={`Connect to ${key}${oauth ? ' with the instance OAuth client' : ''}`}
-					unifiedSize="md"
-					variant="subtle"
-					btnClasses={twMerge(
-						'justify-start px-3 h-auto py-3 scroll-my-2',
-						// The pointer moves the same highlight the arrow keys move, so the variant's
-						// own hover is off: two lit rows at once would be ambiguous.
-						'hover:bg-transparent',
-						// `!` so the highlight also wins on the row the pointer is over, whose own
-						// hover was turned off just above.
-						index === highlightedIndex ? '!bg-surface-hover' : ''
-					)}
-					on:mouseenter={() => highlightHovered(index)}
-					on:click={() => (oauth ? connectOauth(key) : selectFromOthers(key))}
-				>
-					{@render resourceRow(key)}
-				</Button>
+					{icon}
+					{title}
+					subtitle={resourceTypeDescriptions[key] ? subtitle : undefined}
+					highlighted={index === highlight.index}
+					onMouseEnter={() => highlight.hovered(index)}
+					onClick={() => (oauth ? connectOauth(key) : selectFromOthers(key))}
+				/>
 			{/snippet}
 
 			<div class="flex-1 min-h-0 overflow-y-auto">
@@ -1213,7 +1157,7 @@
 						{#if customKeys.length > 0}
 							<section>
 								{@render sectionHeading('Custom resource types', customKeys.length)}
-								<div class="flex flex-col gap-1">
+								<div class="flex flex-col gap-0.5">
 									{#each customKeys as key, i}
 										{@render resourceButton(key, i, false)}
 									{/each}
@@ -1227,7 +1171,7 @@
 									'Instance-configured OAuth APIs',
 									rankedConnects?.length ?? 0
 								)}
-								<div class="flex flex-col gap-1">
+								<div class="flex flex-col gap-0.5">
 									{#if rankedConnects}
 										{#each rankedConnects as { key }, i}
 											{@render resourceButton(key, oauthRowOffset + i, true)}
@@ -1259,7 +1203,7 @@
 									</div>
 								{/if}
 
-								<div class="flex flex-col gap-1">
+								<div class="flex flex-col gap-0.5">
 									{#if rankedConnectsManual}
 										{#each otherKeys as key, i}
 											{@render resourceButton(key, otherRowOffset + i, false)}
@@ -1532,7 +1476,7 @@
 					>
 
 					{#if editScopes}
-						<OauthScopes bind:scopes />
+						<OauthScopes bind:scopes options={registryEntry()?.scope_options} />
 					{:else}
 						<div class="flex flex-col gap-1">
 							{#each scopes as scope}
diff --git a/frontend/src/lib/components/ArgInput.svelte b/frontend/src/lib/components/ArgInput.svelte
index 8550a58b57..7f50794a52 100644
--- a/frontend/src/lib/components/ArgInput.svelte
+++ b/frontend/src/lib/components/ArgInput.svelte
@@ -1447,7 +1447,7 @@
 				{showSchemaExplorer}
 			/>
 		{:else if inputCat == 'ai-provider'}
-			<AIProviderPicker bind:value {disabled} {actions} />
+			<AIProviderPicker bind:value {disabled} {actions} {workspace} />
 		{:else if inputCat == 'email'}
 			<input
 				{autofocus}
diff --git a/frontend/src/lib/components/Dev.svelte b/frontend/src/lib/components/Dev.svelte
index c7e83b8a80..c4674d7313 100644
--- a/frontend/src/lib/components/Dev.svelte
+++ b/frontend/src/lib/components/Dev.svelte
@@ -34,6 +34,7 @@
 	import FlowPreviewButtons from './flows/header/FlowPreviewButtons.svelte'
 	import FlowModuleSchemaMap from './flows/map/FlowModuleSchemaMap.svelte'
 	import FlowEditorPanel from './flows/content/FlowEditorPanel.svelte'
+	import AgentEditorModal from './flows/content/AgentEditorModal.svelte'
 	import { deepEqual } from 'fast-equals'
 	import { findModuleInFlow } from './flows/flowDiff'
 	import { writable } from 'svelte/store'
@@ -1310,5 +1311,8 @@
 				</Splitpanes>
 			</div>
 		</div>
+		<!-- Outside the panel, which is keyed on the selection: the dialog stays on the step it was
+		opened for while the graph is used behind it. -->
+		<AgentEditorModal enableAi owns={() => true} />
 	{/if}
 </main>
diff --git a/frontend/src/lib/components/FlowPreviewContent.svelte b/frontend/src/lib/components/FlowPreviewContent.svelte
index d895cb4e2e..bfda6d6f18 100644
--- a/frontend/src/lib/components/FlowPreviewContent.svelte
+++ b/frontend/src/lib/components/FlowPreviewContent.svelte
@@ -44,6 +44,7 @@
 	import FlowRestartButton from './FlowRestartButton.svelte'
 	import { useNestedRestartState } from './useNestedRestartState.svelte'
 	import { buildFlowRecording, downloadRecordingJson } from './recording/runRecording'
+	import { agentStreamingEnabled } from './flows/agentFormFields'
 
 	interface Props {
 		previewMode: 'upTo' | 'whole'
@@ -163,11 +164,8 @@
 	let shouldUseStreaming = $derived.by(() => {
 		const modules = flowStore.val.value?.modules
 		const lastModule = modules && modules.length > 0 ? modules[modules.length - 1] : undefined
-		return (
-			lastModule?.value?.type === 'aiagent' &&
-			lastModule?.value?.input_transforms?.streaming?.type === 'static' &&
-			lastModule?.value?.input_transforms?.streaming?.value === true
-		)
+		if (lastModule?.value?.type !== 'aiagent') return false
+		return agentStreamingEnabled(lastModule.value)
 	})
 
 	function extractFlow(previewMode: 'upTo' | 'whole'): OpenFlow {
diff --git a/frontend/src/lib/components/FolderEditor.svelte b/frontend/src/lib/components/FolderEditor.svelte
index dede17b953..e8f37a625c 100644
--- a/frontend/src/lib/components/FolderEditor.svelte
+++ b/frontend/src/lib/components/FolderEditor.svelte
@@ -6,19 +6,23 @@
 		FolderService,
 		UserService,
 		GranularAclService,
-		GroupService
+		GroupService,
+		type User
 	} from '$lib/gen'
-	import TableCustom from './TableCustom.svelte'
+	import DataTable from './table/DataTable.svelte'
+	import Head from './table/Head.svelte'
+	import Row from './table/Row.svelte'
+	import Cell from './table/Cell.svelte'
 	import { DEMO_RESTRICTION_HINT, isDemoWorkspaceRestricted } from '$lib/cloud'
-	import { Alert, Button, Drawer, DrawerContent } from './common'
+	import { Alert, Button } from './common'
 	import Skeleton from './common/skeleton/Skeleton.svelte'
-	import GroupEditor from './GroupEditor.svelte'
+	import GroupEditorDrawer from './GroupEditorDrawer.svelte'
 	import ToggleButtonGroup from './common/toggleButton-v2/ToggleButtonGroup.svelte'
 	import ToggleButton from './common/toggleButton-v2/ToggleButton.svelte'
-	import { ArrowDown, ArrowUp, Eye, Plus, Trash } from 'lucide-svelte'
+	import { ArrowDown, ArrowUp, Eye, Pen, Plus, Trash } from 'lucide-svelte'
 	import Label from './Label.svelte'
 	import { sendUserToast } from '$lib/toast'
-	import { createEventDispatcher, untrack } from 'svelte'
+	import { onMount, tick, untrack } from 'svelte'
 	import Select from './select/Select.svelte'
 	import { safeSelectItems } from './select/utils.svelte'
 	import TextInput from './text_input/TextInput.svelte'
@@ -28,97 +32,251 @@
 	import CollapseLink from './CollapseLink.svelte'
 	import LabelsInput from './LabelsInput.svelte'
 	import Badge from './common/badge/Badge.svelte'
+	import InputError from './InputError.svelte'
+	import Popover from './meltComponents/Popover.svelte'
+	import { deepEqual } from 'fast-equals'
+	import {
+		folderPermissionDiff,
+		isFolderDraftDirty,
+		type FolderDraft,
+		type FolderRole
+	} from '$lib/folderDraft'
+
+	const VALID_FOLDER_NAME = /^[a-zA-Z_0-9-]+$/
+
+	const ROLE_TOOLTIPS = {
+		viewer:
+			'A viewer of a folder has read-only access to all the elements (scripts/flows/apps/schedules/resources/variables) inside the folder',
+		writer:
+			'A writer of a folder has read AND write access to all the elements (scripts/flows/apps/schedules/resources/variables) inside the folder',
+		admin:
+			'An admin of a folder has read AND write access to all the elements inside the folders and can manage the permissions as well as add new admins'
+	}
+
+	const MEMBERS_EXPLAINER =
+		"A member is a user or group with a role on this folder. The role applies to every script, flow, app, resource, variable and schedule inside it: viewers can read them, writers can also edit them, and admins can additionally manage the folder's members."
+
+	// Edits mutate `draft` only; `save()` is the sole writer to the backend, and `baseline` is
+	// what the folder held when it was loaded, so comparing the two gives both the dirty state
+	// and the permission calls to replay. Both live in `folderDraft.ts`, with tests.
+	type Role = FolderRole
 
 	interface Props {
+		/** In `new` mode this is the name being typed, hence bindable. */
 		name: string
+		mode?: 'edit' | 'new'
+		/** Drives the parent drawer's Save button, which lives above this component. */
+		onCanSaveChange?: (canSave: boolean) => void
+		/** Drives the parent drawer's discard confirmation on close. Unlike `canSave`
+		 * this stays true for edits that cannot be saved yet (an invalid rule, a name
+		 * already taken) — closing would still throw them away. */
+		onUnsavedChange?: (unsaved: boolean) => void
+		/** False while Save would create rather than update, which an `edit` drawer reaches
+		 * when the folder turns out not to exist. The drawer labels itself from this. */
+		onExistsChange?: (exists: boolean) => void
+		/** Edit a folder of this workspace rather than the active one. The folder picker
+		 * can be aimed elsewhere (the project import wizard picks a destination workspace
+		 * before entering it), and the folder must be written where it was listed. */
+		workspace?: string
 	}
 
-	let { name }: Props = $props()
-	let can_write = $state(false)
+	let {
+		name = $bindable(),
+		mode = 'edit',
+		onCanSaveChange,
+		onUnsavedChange,
+		onExistsChange,
+		workspace
+	}: Props = $props()
 
-	type Role = 'viewer' | 'writer' | 'admin'
-	let folder: Folder | undefined
-	let perms: { owner_name: string; role: Role }[] | undefined = $state(undefined)
-	let usernames: string[] = $state([])
-	let groups: string[] = $state([])
-	let ownerItem: string = $state('')
+	const targetWorkspace = $derived(workspace ?? $workspaceStore ?? '')
+	const aimedElsewhere = $derived(!!workspace && workspace !== $workspaceStore)
 
-	let newGroup: Drawer | undefined = $state(undefined)
-	let viewGroup: Drawer | undefined = $state(undefined)
-
-	async function loadUsernames(): Promise<void> {
-		usernames = await UserService.listUsernames({ workspace: $workspaceStore! })
-	}
-
-	async function loadGroups(): Promise<void> {
-		groups = await GroupService.listGroupNames({ workspace: $workspaceStore! })
-	}
-
-	async function load() {
-		loadUsernames()
-		loadGroups()
-		await loadFolder()
-	}
-
-	async function addToFolder() {
-		await GranularAclService.addGranularAcls({
-			workspace: $workspaceStore ?? '',
-			path: name,
-			kind: 'folder',
-			requestBody: {
-				owner: (ownerKind == 'user' ? 'u/' : 'g/') + ownerItem
-			}
-		})
-		ownerItem = ''
-		loadFolder()
-	}
-
-	let folderNotFound: boolean | undefined = $state(undefined)
-
-	async function loadFolder(): Promise<void> {
-		try {
-			folder = await FolderService.getFolder({ workspace: $workspaceStore!, name })
-			summary = folder.summary ?? ''
-			labels = [...(folder.labels ?? [])]
-			defaultPermissionedAs = (folder.default_permissioned_as ?? []).map((r) => ({ ...r }))
-			can_write =
-				$userStore != undefined &&
-				(folder?.owners.includes('u/' + $userStore.username) ||
-					($userStore.is_admin ?? false) ||
-					($userStore.is_super_admin ?? false) ||
-					$userStore.pgroups.findIndex((x) => folder?.owners.includes(x)) != -1)
-
-			perms = Array.from(
-				new Set(
-					Object.entries(folder?.extra_perms ?? {})
-						.map((x) => x[0])
-						.concat(folder?.owners ?? [])
-				)
-			).map((x) => {
-				return {
-					owner_name: x,
-					role: getRole(x)
+	// `$userStore` describes the workspace the app is *in*. Aimed at another one it answers
+	// the wrong question — a folder admin there would get read-only controls, and a
+	// non-member would get write ones — so resolve the membership of the workspace being
+	// edited. `whoami` returns group names unprefixed; `owners` holds them `g/`-prefixed.
+	let targetUser: User | undefined = $state(undefined)
+	const membership = $derived.by(() => {
+		if (!aimedElsewhere) {
+			return $userStore
+				? {
+						username: $userStore.username,
+						is_admin: $userStore.is_admin ?? false,
+						is_super_admin: $userStore.is_super_admin ?? false,
+						pgroups: $userStore.pgroups ?? [],
+						groups: $userStore.groups ?? []
+					}
+				: undefined
+		}
+		return targetUser
+			? {
+					username: targetUser.username,
+					is_admin: targetUser.is_admin ?? false,
+					is_super_admin: targetUser.is_super_admin ?? false,
+					pgroups: (targetUser.groups ?? []).map((g) => 'g/' + g),
+					groups: targetUser.groups ?? []
 				}
-			})
-			reloadHistory++
-		} catch (e) {
-			folderNotFound = true
+			: undefined
+	})
+
+	async function loadTargetUser(): Promise<void> {
+		if (!aimedElsewhere || !workspace) return
+		try {
+			targetUser = await UserService.whoami({ workspace })
+		} catch {
+			// Not a member, or the call failed: no membership means read-only controls,
+			// which is the safe reading — the write would be refused anyway.
+			targetUser = undefined
 		}
 	}
 
-	// --- default_permissioned_as rules editor ---
-	let defaultPermissionedAs: FolderDefaultPermissionedAs = $state([])
+	let can_write = $state(false)
+	let folder: Folder | undefined
+	let usernames: string[] = $state([])
+	let groups: string[] = $state([])
+	let folderNames: string[] = $state([])
+	let ownerItem: string = $state('')
+
+	let groupEditorDrawer: GroupEditorDrawer | undefined = $state(undefined)
+	let addMemberPopover: Popover | undefined = $state(undefined)
+	let nameInput: TextInput | undefined = $state(undefined)
+
+	let baseline: FolderDraft | undefined = $state(undefined)
+	// Empty, not `emptyDraft()`: that one seeds the caller as an admin, which is true of a
+	// folder being created and a lie about one whose read failed. Every path that wants the
+	// seeded row calls `emptyDraft()` itself.
+	let draft: FolderDraft = $state({
+		summary: '',
+		labels: [],
+		defaultPermissionedAs: [],
+		perms: []
+	})
+	let labelsInput: LabelsInput | undefined = $state()
+	let pendingLabel = $state('')
+	let folderNotFound: boolean | undefined = $state(undefined)
+	let loaded = $state(false)
+
+	// A name typed in `new` mode, and one whose folder turned out not to exist, both
+	// end up at `createFolder` on save.
+	const isNew = $derived(mode === 'new' || folderNotFound === true)
+
+	function emptyDraft(): FolderDraft {
+		return {
+			summary: '',
+			labels: [],
+			defaultPermissionedAs: [],
+			// The backend makes the creator an owner whatever we send, so the table
+			// shows that from the start rather than after the first reload.
+			perms: membership ? [{ owner_name: 'u/' + membership.username, role: 'admin' as Role }] : []
+		}
+	}
+
+	function setDraft(value: FolderDraft) {
+		baseline = structuredClone(value)
+		draft = structuredClone(value)
+	}
+
+	async function loadUsernames(): Promise<void> {
+		usernames = await UserService.listUsernames({ workspace: targetWorkspace })
+	}
+
+	async function loadGroups(): Promise<void> {
+		groups = await GroupService.listGroupNames({ workspace: targetWorkspace })
+	}
+
+	async function loadFolderNames(): Promise<void> {
+		folderNames = await FolderService.listFolderNames({ workspace: targetWorkspace })
+	}
+
+	/** Fills a picker or a validation list. The editor is usable before these land, so they
+	 *  run alongside the folder read — but a rejection has to be reported: unhandled, it
+	 *  leaves the list silently empty and duplicate names stop being caught. */
+	function loadAside(load: () => Promise<void>): void {
+		load().catch((e) => sendUserToast(e?.body ?? String(e), true))
+	}
+
+	async function load() {
+		loadAside(loadUsernames)
+		loadAside(loadGroups)
+		// Before the folder read: `can_write` is computed from this membership.
+		await loadTargetUser()
+		if (mode === 'new') {
+			loadAside(loadFolderNames)
+			can_write = true
+			setDraft(emptyDraft())
+			loaded = true
+		} else {
+			await loadFolder()
+		}
+	}
+
+	function grant(close: () => void) {
+		const owner = (ownerKind == 'user' ? 'u/' : 'g/') + ownerItem
+		if (!draft.perms.some((p) => p.owner_name === owner)) {
+			draft.perms.push({ owner_name: owner, role: newMemberRole })
+		}
+		ownerItem = ''
+		close()
+	}
+
+	/** `baselineOnly` re-reads the folder without touching the draft: after a save that
+	 *  committed some of its calls and then failed, the baseline must become what the server
+	 *  actually holds while the draft stays the user's intent — the applied changes then stop
+	 *  counting as dirty, and the ones still missing stay dirty and retryable. */
+	async function loadFolder(opts?: { baselineOnly?: boolean }): Promise<void> {
+		const apply = (value: FolderDraft) =>
+			opts?.baselineOnly ? (baseline = structuredClone(value)) : setDraft(value)
+		try {
+			folder = await FolderService.getFolder({ workspace: targetWorkspace, name })
+			folderNotFound = false
+			can_write =
+				membership != undefined &&
+				(folder?.owners.includes('u/' + membership.username) ||
+					membership.is_admin ||
+					membership.is_super_admin ||
+					membership.pgroups.findIndex((x) => folder?.owners.includes(x)) != -1)
+
+			apply({
+				summary: folder.summary ?? '',
+				labels: [...(folder.labels ?? [])],
+				defaultPermissionedAs: (folder.default_permissioned_as ?? []).map((r) => ({ ...r })),
+				perms: Array.from(
+					new Set(
+						Object.entries(folder?.extra_perms ?? {})
+							.map((x) => x[0])
+							.concat(folder?.owners ?? [])
+					)
+				).map((x) => ({ owner_name: x, role: getRole(x) }))
+			})
+			reloadHistory++
+		} catch (e) {
+			// Only a folder that is genuinely absent may replace the draft — it can be created
+			// from here, so the editor opens on an empty one rather than a dead end. Any other
+			// failure (network, 5xx) must leave the draft alone: overwriting it here would
+			// discard the user's edits and clear `unsaved` with them.
+			if (e?.status === 404) {
+				folderNotFound = true
+				can_write = true
+				apply(emptyDraft())
+			} else {
+				sendUserToast(e?.body ?? String(e), true)
+			}
+		} finally {
+			loaded = true
+		}
+	}
 
 	const restricted = $derived(
-		isDemoWorkspaceRestricted($workspaceStore, $userStore?.is_admin, $userStore?.is_super_admin)
+		isDemoWorkspaceRestricted(targetWorkspace, membership?.is_admin, membership?.is_super_admin)
 	)
 
 	const canEditDefaults = $derived(
 		can_write &&
 			!restricted &&
-			($userStore?.is_admin ||
-				$userStore?.is_super_admin ||
-				($userStore?.groups ?? []).includes('wm_deployers'))
+			(membership?.is_admin ||
+				membership?.is_super_admin ||
+				(membership?.groups ?? []).includes('wm_deployers'))
 	)
 
 	function isValidGlob(glob: string): boolean {
@@ -135,58 +293,47 @@
 		return /^[ug]\/.+/.test(value) || value.includes('@')
 	}
 
-	// Split a permissioned_as value like "u/alice" or "g/prod" into its kind and name.
-	function ruleKind(value: string): 'user' | 'group' {
+	// Split an owner value like "u/alice" or "g/prod" into its kind and name.
+	function ownerKindOf(value: string): 'user' | 'group' {
 		return value.startsWith('g/') ? 'group' : 'user'
 	}
-	function ruleName(value: string): string {
+	function ownerNameOf(value: string): string {
 		if (value.startsWith('u/') || value.startsWith('g/')) return value.slice(2)
 		return value
 	}
 	function setRulePermissionedAs(idx: number, kind: 'user' | 'group', name: string) {
 		const prefix = kind === 'user' ? 'u/' : 'g/'
-		defaultPermissionedAs[idx].permissioned_as = prefix + name
+		draft.defaultPermissionedAs[idx].permissioned_as = prefix + name
 	}
 
+	// Only blocks a save for someone who can see the rules. The backend accepts values this
+	// rejects (`u/` alone passes `validate_default_permissioned_as`), so a folder admin who
+	// is not a workspace admin could otherwise meet a permanently disabled Save with no rule
+	// on screen to explain it.
 	const defaultRulesInvalid = $derived(
-		defaultPermissionedAs.some(
-			(r) => !isValidGlob(r.path_glob) || !isValidPermissionedAs(r.permissioned_as)
-		)
+		canEditDefaults &&
+			draft.defaultPermissionedAs.some(
+				(r) => !isValidGlob(r.path_glob) || !isValidPermissionedAs(r.permissioned_as)
+			)
 	)
 
 	function addDefaultRule() {
-		defaultPermissionedAs = [...defaultPermissionedAs, { path_glob: '**', permissioned_as: '' }]
+		draft.defaultPermissionedAs = [
+			...draft.defaultPermissionedAs,
+			{ path_glob: '**', permissioned_as: '' }
+		]
 	}
 
 	function removeDefaultRule(idx: number) {
-		defaultPermissionedAs = defaultPermissionedAs.filter((_, i) => i !== idx)
+		draft.defaultPermissionedAs = draft.defaultPermissionedAs.filter((_, i) => i !== idx)
 	}
 
 	function moveDefaultRule(idx: number, delta: -1 | 1) {
-		const next = [...defaultPermissionedAs]
+		const next = [...draft.defaultPermissionedAs]
 		const target = idx + delta
 		if (target < 0 || target >= next.length) return
 		;[next[idx], next[target]] = [next[target], next[idx]]
-		defaultPermissionedAs = next
-	}
-
-	async function saveDefaultRules() {
-		if (defaultRulesInvalid) {
-			sendUserToast('Some rules have invalid globs or permissioned_as values', true)
-			return
-		}
-		try {
-			await FolderService.updateFolder({
-				workspace: $workspaceStore ?? '',
-				name,
-				requestBody: { default_permissioned_as: defaultPermissionedAs }
-			})
-			sendUserToast('Default permissioned_as rules updated')
-			dispatch('update')
-			loadFolder()
-		} catch (e) {
-			sendUserToast(e.body ?? String(e), true)
-		}
+		draft.defaultPermissionedAs = next
 	}
 
 	function getRole(x: string): Role {
@@ -204,51 +351,208 @@
 	}
 
 	let ownerKind: 'user' | 'group' = $state('user')
-	let groupCreated: string | undefined = $state(undefined)
-	let newGroupName: string = $state('')
-	let summary: string = $state('')
-	let labels: string[] | undefined = $state(undefined)
+	let newMemberRole: Role = $state('viewer')
 
-	async function saveLabels() {
+	// Set when the group editor is opened from the add-member form, so that saving returns
+	// there. Opened from a member row instead, that group is already a member and reopening
+	// the form on it would offer to add it twice.
+	let groupEditorInterruptedPicker = false
+
+	function openGroupEditor(groupName: string, fromPicker: boolean) {
+		groupEditorInterruptedPicker = fromPicker
+		if (groupName) groupEditorDrawer?.initEdit(groupName)
+		else groupEditorDrawer?.initNew()
+	}
+
+	async function onGroupSaved(groupName: string) {
+		// The group has to be in `groups` before the picker reopens, or the value set below
+		// has no matching item to show.
 		try {
-			await FolderService.updateFolder({
-				workspace: $workspaceStore ?? '',
-				name,
-				requestBody: { labels: labels ?? [] }
-			})
-			sendUserToast('Folder labels updated')
-			dispatch('update')
+			await loadGroups()
 		} catch (e) {
-			sendUserToast(e.body ?? String(e), true)
-			loadFolder()
+			sendUserToast(e?.body ?? String(e), true)
+		}
+		if (!groupEditorInterruptedPicker) return
+		// Editing a group was a detour from adding a member: come back to the form on that
+		// group so the interrupted job can be finished.
+		ownerKind = 'group'
+		ownerItem = groupName
+		addMemberPopover?.open()
+	}
+
+	// Guarded on `mode`, not `isNew`: the name field is rendered only in `new` mode, so on the
+	// not-found branch there is no input to annotate and no name the user could correct.
+	const nameError = $derived(
+		mode !== 'new'
+			? ''
+			: !name
+				? ''
+				: !VALID_FOLDER_NAME.test(name)
+					? 'Folder name can only contain alphanumeric characters, underscores, and hyphens'
+					: folderNames.includes(name)
+						? 'A folder with this name already exists'
+						: ''
+	)
+
+	// `create_folder` folds the caller into `owners` with write whatever the payload says, so
+	// on create their own row is fixed: offering to demote or remove it would be a change the
+	// backend silently discards.
+	// An invalid rule disables Save, so the section holding it is held open rather than merely
+	// opened once: collapsing it would hide the only explanation for the disabled button.
+	let defaultRulesOpen = $state(false)
+
+	function isFixedCreatorRow(owner: string): boolean {
+		return isNew && owner === 'u/' + membership?.username
+	}
+
+	// The label input holds typed text until Enter or a blur, and that text is an edit like
+	// any other: it has to count as dirty here, or Save stays disabled when it is the only
+	// change and closing drops it without asking. `save()` flushes it into `draft.labels`.
+	const dirty = $derived(isFolderDraftDirty(draft, baseline) || pendingLabel !== '')
+	// A typed name is progress too, even before any other field is touched.
+	const unsaved = $derived(dirty || (mode === 'new' && !!name))
+
+	$effect(() => {
+		onCanSaveChange?.(
+			isNew
+				? loaded && !!name && !nameError && !restricted && !defaultRulesInvalid
+				: can_write && dirty && !defaultRulesInvalid
+		)
+	})
+
+	$effect(() => {
+		onUnsavedChange?.(unsaved)
+	})
+
+	$effect(() => {
+		onExistsChange?.(!isNew)
+	})
+
+	/** Replays the permission rows the user changed. `updateFolder` could write
+	 * `owners`/`extra_perms` wholesale in the same call as the settings, but it only
+	 * logs a single "update owners"/"update acl" entry, so the permission history
+	 * would stop naming who was granted what. The diff itself is in `folderDraft.ts`. */
+	async function applyPermissionChanges(next: FolderDraft['perms'], prev: FolderDraft['perms']) {
+		const workspace = targetWorkspace
+		const callerOwners = membership
+			? ['u/' + membership.username, ...(membership.pgroups ?? [])]
+			: []
+		for (const call of folderPermissionDiff(prev, next, callerOwners)) {
+			switch (call.kind) {
+				case 'grantAdmin':
+					await FolderService.addOwnerToFolder({
+						workspace,
+						name,
+						requestBody: { owner: call.owner }
+					})
+					break
+				case 'demoteAdmin':
+					await FolderService.removeOwnerToFolder({
+						workspace,
+						name,
+						requestBody: { owner: call.owner, write: call.write }
+					})
+					break
+				case 'setAcl':
+					await GranularAclService.addGranularAcls({
+						workspace,
+						path: name,
+						kind: 'folder',
+						requestBody: { owner: call.owner, write: call.write }
+					})
+					break
+				case 'remove':
+					// Sequential, and `removeowner` first: the write policy refuses it when the
+					// member being removed is the caller's last admin handle. Failing there leaves
+					// the folder untouched, where the other order strands a member with no grant
+					// but still in `owners`.
+					await FolderService.removeOwnerToFolder({
+						workspace,
+						name,
+						requestBody: { owner: call.owner }
+					})
+					await GranularAclService.removeGranularAcls({
+						workspace,
+						path: name,
+						kind: 'folder',
+						requestBody: { owner: call.owner }
+					})
+					break
+			}
 		}
 	}
 
-	async function addGroup() {
-		await GroupService.createGroup({
-			workspace: $workspaceStore ?? '',
-			requestBody: { name: newGroupName }
-		})
-		groupCreated = newGroupName
-		$userStore?.folders?.push(newGroupName)
-		loadGroups()
-		ownerItem = newGroupName
+	export async function save(): Promise<{ name: string; created: boolean } | undefined> {
+		// Clicking Save blurs the label input, which commits its text on a delay — after the
+		// snapshot below. Take the label first or it is dropped as the drawer closes.
+		labelsInput?.flushPendingLabel()
+		const next = $state.snapshot(draft) as FolderDraft
+		const prev = baseline as FolderDraft
+		// Captured before the write: an edit-branch save reloads, which clears `folderNotFound`.
+		const created = isNew
+		try {
+			if (created) {
+				await FolderService.createFolder({
+					workspace: targetWorkspace,
+					requestBody: {
+						name,
+						summary: next.summary,
+						labels: next.labels,
+						default_permissioned_as: next.defaultPermissionedAs,
+						owners: next.perms.filter((p) => p.role === 'admin').map((p) => p.owner_name),
+						extra_perms: Object.fromEntries(
+							next.perms.map((p) => [p.owner_name, p.role !== 'viewer'])
+						)
+					}
+				})
+				sendUserToast(`Folder ${name} created`)
+			} else {
+				const requestBody: {
+					summary?: string
+					labels?: string[]
+					default_permissioned_as?: FolderDefaultPermissionedAs
+				} = {}
+				if (next.summary !== prev.summary) requestBody.summary = next.summary
+				if (!deepEqual(next.labels, prev.labels)) requestBody.labels = next.labels
+				if (!deepEqual(next.defaultPermissionedAs, prev.defaultPermissionedAs)) {
+					requestBody.default_permissioned_as = next.defaultPermissionedAs
+				}
+				if (Object.keys(requestBody).length > 0) {
+					await FolderService.updateFolder({ workspace: targetWorkspace, name, requestBody })
+				}
+				await applyPermissionChanges(next.perms, prev.perms)
+				await loadFolder()
+				sendUserToast('Folder updated')
+			}
+			return { name, created }
+		} catch (e) {
+			sendUserToast(e.body ?? String(e), true)
+			// A failed create is not proof the folder is absent: `create_folder` commits before a
+			// git-sync step that can still fail the request. Only the name conflict says it was
+			// never written. Report rather than resolve — a folder found by name may be someone
+			// else's, and adopting it would send this draft's writes there.
+			const nameTaken = String(e?.body ?? '').includes('already exists')
+			if (created && !nameTaken) {
+				sendUserToast(`Folder ${name} may have been created anyway — reopen it to check`, true)
+			}
+			// Reconcile after any edit-path failure rather than tracking which calls landed:
+			// these handlers commit before a git-sync step that can still fail the request, so
+			// a rejection is not proof nothing was written. The baseline moves to what the
+			// server now holds and the draft stays, so a retry re-sends only what is missing.
+			if (!created) await loadFolder({ baselineOnly: true })
+			return undefined
+		}
 	}
 
-	const dispatch = createEventDispatcher()
-
-	async function updateFolder() {
-		await FolderService.updateFolder({
-			workspace: $workspaceStore ?? '',
-			name,
-			requestBody: { summary }
-		})
-		sendUserToast('Folder summary updated')
-		dispatch('update')
-		loadFolder()
-	}
+	// The stores are read only to wait until they are populated, and the load runs once: this
+	// editor holds an unsaved draft, and the layout re-`set`s `$userStore` periodically — a
+	// second `load()` would overwrite the draft with the server's state and lose the edits
+	// silently, `unsaved` included. The drawer remounts this component per opening.
+	let loadStarted = false
 	$effect.pre(() => {
+		if (loadStarted) return
 		if ($workspaceStore && $userStore) {
+			loadStarted = true
 			untrack(() => {
 				load()
 			})
@@ -256,47 +560,41 @@
 	})
 
 	let reloadHistory = $state(0)
+
+	onMount(async () => {
+		if (mode !== 'new') return
+		// The editor is remounted per drawer opening, so mount is the moment the
+		// create form appears; the input only exists after the first render.
+		await tick()
+		nameInput?.focus()
+	})
 </script>
 
-<Drawer bind:this={newGroup}>
-	<DrawerContent
-		title="New Group"
-		on:close={() => {
-			newGroup?.closeDrawer()
-			groupCreated = undefined
-		}}
-	>
-		{#if !groupCreated}
-			<div class="flex flex-row">
-				<input class="mr-2" placeholder="New group name" bind:value={newGroupName} />
-				<Button size="md" startIcon={{ icon: Plus }} disabled={!newGroupName} on:click={addGroup}>
-					New&nbsp;group
-				</Button>
-			</div>
-		{:else}
-			<GroupEditor name={groupCreated} />
-		{/if}
-	</DrawerContent>
-</Drawer>
-
-<Drawer bind:this={viewGroup}>
-	<DrawerContent title="Group {ownerItem}" on:close={viewGroup.closeDrawer}>
-		<GroupEditor name={ownerItem} />
-	</DrawerContent>
-</Drawer>
+<GroupEditorDrawer bind:this={groupEditorDrawer} onSaved={onGroupSaved} />
 
 <div class="flex flex-col gap-6">
-	<Label label="Summary">
-		<div class="flex flex-row gap-2">
+	{#if mode === 'new'}
+		<Label label="Folder name">
 			<TextInput
-				inputProps={{ placeholder: 'Short summary to be displayed when listed' }}
-				bind:value={summary}
+				bind:this={nameInput}
+				bind:value={name}
+				error={!!nameError}
 				size="md"
+				inputProps={{ placeholder: 'folder_name' }}
 			/>
-			<Button variant="accent" unifiedSize="md" on:click={updateFolder} disabled={!can_write}
-				>Save</Button
-			>
-		</div>
+			<InputError error={nameError} />
+		</Label>
+	{/if}
+
+	<Label label="Summary">
+		<TextInput
+			inputProps={{
+				placeholder: 'Short summary to be displayed when listed',
+				disabled: !can_write
+			}}
+			bind:value={draft.summary}
+			size="md"
+		/>
 	</Label>
 
 	<Label label="Labels">
@@ -306,10 +604,15 @@
 				are labeled with them.
 			</div>
 			{#if can_write}
-				<LabelsInput bind:labels onchange={saveLabels} />
+				<LabelsInput
+					bind:this={labelsInput}
+					bind:labels={draft.labels}
+					workspace={targetWorkspace}
+					onPendingChange={(v) => (pendingLabel = v)}
+				/>
 			{:else}
 				<div class="inline-flex items-center gap-1 h-5">
-					{#each labels ?? [] as label (label)}
+					{#each draft.labels as label (label)}
 						<Badge color="blue" small>{label}</Badge>
 					{:else}
 						<span class="text-xs text-tertiary">No labels</span>
@@ -319,257 +622,261 @@
 		</div>
 	</Label>
 
-	<Label label={`Permissions (${perms?.length ?? 0})`}>
+	<Label label={`Members (${draft.perms.length})`} tooltip={MEMBERS_EXPLAINER}>
+		{#snippet action()}
+			{#if can_write && !restricted}
+				<Popover
+					bind:this={addMemberPopover}
+					placement="bottom-end"
+					onClose={() => {
+						ownerItem = ''
+						newMemberRole = 'viewer'
+					}}
+				>
+					{#snippet trigger()}
+						<Button
+							variant="default"
+							unifiedSize="sm"
+							nonCaptureEvent={true}
+							startIcon={{ icon: Plus }}
+						>
+							Add member
+						</Button>
+					{/snippet}
+					{#snippet content({ close })}
+						<div class="flex flex-col w-72 p-4 gap-4">
+							<span class="text-sm leading-6 font-semibold">Add a member</span>
+							<Label label="User or group">
+								<div class="flex items-center gap-1">
+									<!-- The toggle group is `w-full`; unwrapped it takes half the row. -->
+									<div>
+										<ToggleButtonGroup
+											bind:selected={ownerKind}
+											on:selected={() => (ownerItem = '')}
+										>
+											{#snippet children({ item })}
+												<ToggleButton value="user" label="User" {item} size="sm" />
+												<ToggleButton value="group" label="Group" {item} size="sm" />
+											{/snippet}
+										</ToggleButtonGroup>
+									</div>
+
+									{#key ownerKind}
+										{@const items =
+											ownerKind === 'user'
+												? usernames.filter(
+														(x) => !draft.perms.some((y) => y.owner_name === 'u/' + x)
+													)
+												: groups.filter((x) => !draft.perms.some((y) => y.owner_name === 'g/' + x))}
+										<Select
+											items={safeSelectItems(items)}
+											bind:value={ownerItem}
+											size="sm"
+											class="grow min-w-0"
+										>
+											{#snippet endSnippet({ item, close: closeSelect })}
+												<!-- GroupEditor reads and writes `$workspaceStore` and takes no workspace of its
+												     own, so it cannot follow a drawer aimed at another one: viewing a group
+												     there would edit the same-named group in the active workspace. -->
+												{#if ownerKind == 'group' && !aimedElsewhere}
+													<Button
+														title="View group"
+														variant="subtle"
+														unifiedSize="xs"
+														wrapperClasses="-mr-2 pl-1 -my-2"
+														btnClasses="hover:bg-surface-tertiary"
+														onClick={() => {
+															closeSelect()
+															close()
+															openGroupEditor(item.value ?? '', true)
+														}}
+														startIcon={{ icon: Eye }}
+														iconOnly
+													/>
+												{/if}
+											{/snippet}
+											{#snippet bottomSnippet({ close: closeSelect })}
+												{#if ownerKind == 'group' && !aimedElsewhere}
+													<Button
+														variant="subtle"
+														unifiedSize="sm"
+														startIcon={{ icon: Plus }}
+														wrapperClasses="border-t border-border-light"
+														btnClasses="w-full rounded-none font-medium"
+														onClick={() => {
+															closeSelect()
+															close()
+															openGroupEditor('', true)
+														}}
+													>
+														New group
+													</Button>
+												{/if}
+											{/snippet}
+										</Select>
+									{/key}
+								</div>
+							</Label>
+							<Label label="Role">
+								<ToggleButtonGroup bind:selected={newMemberRole}>
+									{#snippet children({ item })}
+										<ToggleButton
+											value="viewer"
+											label="Viewer"
+											tooltip={ROLE_TOOLTIPS.viewer}
+											{item}
+											size="sm"
+										/>
+										<ToggleButton
+											value="writer"
+											label="Writer"
+											tooltip={ROLE_TOOLTIPS.writer}
+											{item}
+											size="sm"
+										/>
+										<ToggleButton
+											value="admin"
+											label="Admin"
+											tooltip={ROLE_TOOLTIPS.admin}
+											{item}
+											size="sm"
+										/>
+									{/snippet}
+								</ToggleButtonGroup>
+							</Label>
+							<div class="flex flex-col gap-1">
+								<Button
+									variant="accent"
+									unifiedSize="sm"
+									disabled={ownerItem == ''}
+									onClick={() => grant(close)}
+								>
+									Add
+								</Button>
+								<span class="text-2xs text-hint">
+									New permissions may take up to 60s to apply, due to permissions cache
+									invalidation.
+								</span>
+							</div>
+						</div>
+					{/snippet}
+				</Popover>
+			{/if}
+		{/snippet}
 		<div class="flex flex-col gap-2">
 			{#if can_write && restricted}
 				<Alert type="info" title="Sharing disabled">{DEMO_RESTRICTION_HINT}</Alert>
-			{:else if can_write}
-				<Alert type="info" title="New permissions may take up to 60s to apply">
-					Due to permissions cache invalidation
-				</Alert>
-				<div class="flex items-center gap-1">
-					<div>
-						<ToggleButtonGroup bind:selected={ownerKind} on:selected={() => (ownerItem = '')}>
-							{#snippet children({ item })}
-								<ToggleButton value="user" label="User" {item} />
-								<ToggleButton value="group" label="Group" {item} />
-							{/snippet}
-						</ToggleButtonGroup>
-					</div>
-
-					{#key ownerKind}
-						{@const items =
-							ownerKind === 'user'
-								? usernames.filter((x) => !perms?.map((y) => y.owner_name).includes('u/' + x))
-								: groups.filter((x) => !perms?.map((y) => y.owner_name).includes('g/' + x))}
-						<Select items={safeSelectItems(items)} bind:value={ownerItem} class="grow min-w-24" />
-						{#if ownerKind == 'group'}
-							<Button
-								title="View Group"
-								variant="default"
-								unifiedSize="md"
-								disabled={!ownerItem || ownerItem == ''}
-								on:click={viewGroup.openDrawer}
-								startIcon={{ icon: Eye }}
-								iconOnly
-							/>
-							<Button
-								title="New Group"
-								variant="default"
-								on:click={newGroup.openDrawer}
-								unifiedSize="md"
-								startIcon={{ icon: Plus }}
-								iconOnly
-							/>
-						{/if}
-					{/key}
-					<Button
-						disabled={ownerItem == ''}
-						variant="accent"
-						unifiedSize="md"
-						on:click={addToFolder}
-					>
-						Grant
-					</Button>
-				</div>
 			{/if}
 
 			{#if folderNotFound}
 				<Alert type="warning" title="Folder not found" size="xs">
-					The folder "{name}" does not exist in the workspace. You can create it by clicking the
-					button below. An item can seemingly be in a folder given its path without the folder
-					existing. A windmill folder has settable permissions that its children inherit. If an item
-					is within a non-existing folders, only admins will see it.
+					The folder "{name}" does not exist in the workspace. Saving will create it. An item can
+					seemingly be in a folder given its path without the folder existing. A windmill folder has
+					settable permissions that its children inherit. If an item is within a non-existing
+					folders, only admins will see it.
 				</Alert>
-				{#if !restricted}
-					<Button
-						variant="default"
-						wrapperClasses="w-min"
-						startIcon={{ icon: Plus }}
-						size="xs"
-						on:click={() => {
-							FolderService.createFolder({
-								workspace: $workspaceStore ?? '',
-								requestBody: { name }
-							}).then(() => {
-								loadFolder()
-							})
-						}}
-					>
-						Create folder "{name}"
-					</Button>
-				{/if}
 			{/if}
-			{#if perms}
-				<TableCustom>
-					{#snippet headerRow()}
+			{#if loaded}
+				<DataTable size="sm">
+					<Head>
 						<tr>
-							<th>user/group</th>
-							<th></th>
-							<th></th>
+							<Cell head first class="text-secondary">Name</Cell>
+							<Cell head class="text-secondary">Kind</Cell>
+							<Cell head class="text-secondary">Role</Cell>
+							<Cell head last actions class="text-secondary">Actions</Cell>
 						</tr>
-					{/snippet}
-					{#snippet body()}
-						<tbody>
-							{#each perms ?? [] as { owner_name, role }}<tr>
-									<td>{owner_name}</td>
-									<td>
-										{#if can_write && !restricted}
-											<div>
-												<ToggleButtonGroup
-													disabled={owner_name == 'u/' + $userStore?.username &&
-														!($userStore?.is_admin || $userStore?.is_super_admin)}
-													selected={role}
-													on:selected={async (e) => {
-														const role = e.detail
-														// const wasInFolder = (folder?.owners ?? []).includes(folder)
-														// const inAcl = (
-														// 	folder?.extra_perms ? Object.keys(folder?.extra_perms) : []
-														// ).includes(folder)
-														if (role == 'admin') {
-															await FolderService.addOwnerToFolder({
-																workspace: $workspaceStore ?? '',
-																name,
-																requestBody: {
-																	owner: owner_name
-																}
-															})
-														} else if (role == 'writer') {
-															await FolderService.removeOwnerToFolder({
-																workspace: $workspaceStore ?? '',
-																name,
-																requestBody: {
-																	owner: owner_name,
-																	write: true
-																}
-															})
-														} else if (role == 'viewer') {
-															await FolderService.removeOwnerToFolder({
-																workspace: $workspaceStore ?? '',
-																name,
-																requestBody: {
-																	owner: owner_name,
-																	write: false
-																}
-															})
-														}
-														loadFolder()
-													}}
-												>
-													{#snippet children({ item })}
-														<ToggleButton
-															value="viewer"
-															label="Viewer"
-															tooltip="A viewer of a folder has read-only access to all the elements (scripts/flows/apps/schedules/resources/variables) inside the folder"
-															{item}
-															size="sm"
-														/>
+					</Head>
+					<tbody class="divide-y">
+						{#each draft.perms as perm, idx (perm.owner_name)}
+							<Row>
+								<Cell first>
+									<span class="text-emphasis font-medium">{ownerNameOf(perm.owner_name)}</span>
+								</Cell>
+								<Cell>{ownerKindOf(perm.owner_name) === 'group' ? 'Group' : 'User'}</Cell>
+								<Cell>
+									{#if can_write && !restricted}
+										<div>
+											<ToggleButtonGroup
+												disabled={isFixedCreatorRow(perm.owner_name) ||
+													(perm.owner_name == 'u/' + membership?.username &&
+														!(membership?.is_admin || membership?.is_super_admin))}
+												selected={perm.role}
+												on:selected={(e) => {
+													draft.perms[idx].role = e.detail
+												}}
+											>
+												{#snippet children({ item })}
+													<ToggleButton
+														value="viewer"
+														label="Viewer"
+														tooltip={ROLE_TOOLTIPS.viewer}
+														{item}
+														size="sm"
+													/>
 
-														<ToggleButton
-															value="writer"
-															label="Writer"
-															tooltip="A writer of a folder has read AND write access to all the elements (scripts/flows/apps/schedules/resources/variables) inside the folder"
-															{item}
-															size="sm"
-														/>
+													<ToggleButton
+														value="writer"
+														label="Writer"
+														tooltip={ROLE_TOOLTIPS.writer}
+														{item}
+														size="sm"
+													/>
 
-														<ToggleButton
-															value="admin"
-															label="Admin"
-															tooltip="An admin of a folder has read AND write access to all the elements inside the folders and can manage the permissions as well as add new admins"
-															{item}
-															size="sm"
-														/>
-													{/snippet}
-												</ToggleButtonGroup>
-											</div>
-										{:else}
-											{role}
-										{/if}</td
-									>
-									<td class="flex items-center justify-end">
-										{#if (can_write && owner_name != 'u/' + $userStore?.username) || $userStore?.is_admin}
+													<ToggleButton
+														value="admin"
+														label="Admin"
+														tooltip={ROLE_TOOLTIPS.admin}
+														{item}
+														size="sm"
+													/>
+												{/snippet}
+											</ToggleButtonGroup>
+										</div>
+									{:else}
+										{perm.role}
+									{/if}
+								</Cell>
+								<Cell last actions>
+									<div class="flex items-center justify-end">
+										<!-- The group editor reads `$workspaceStore`, so it can only be opened for the
+										     workspace the app is in — see the picker's own buttons. It decides on its
+										     own whether the group is editable here; a member with no write on it still
+										     gets to see who is in it. -->
+										{#if ownerKindOf(perm.owner_name) === 'group' && !aimedElsewhere}
+											<Button
+												title="Manage group"
+												variant="subtle"
+												unifiedSize="sm"
+												startIcon={{ icon: Pen }}
+												iconOnly
+												onclick={() => openGroupEditor(ownerNameOf(perm.owner_name), false)}
+											/>
+										{/if}
+										{#if !isFixedCreatorRow(perm.owner_name) && ((can_write && perm.owner_name != 'u/' + membership?.username) || membership?.is_admin)}
 											<Button
 												variant="subtle"
 												destructive
-												unifiedSize="md"
+												unifiedSize="sm"
 												startIcon={{ icon: Trash }}
 												iconOnly
-												onclick={async () => {
-													await Promise.all([
-														FolderService.removeOwnerToFolder({
-															workspace: $workspaceStore ?? '',
-															name,
-															requestBody: { owner: owner_name }
-														}),
-														GranularAclService.removeGranularAcls({
-															workspace: $workspaceStore ?? '',
-															path: name,
-															kind: 'folder',
-															requestBody: {
-																owner: owner_name
-															}
-														})
-													])
-
-													loadFolder()
+												onclick={() => {
+													draft.perms = draft.perms.filter((p) => p.owner_name !== perm.owner_name)
 												}}
 											/>
-										{:else if can_write && owner_name == 'u/' + $userStore?.username}
-											<span class="text-primary text-xs">cannot remove yourself</span>
-										{/if}</td
-									>
-								</tr>{/each}
-						</tbody>
-					{/snippet}
-				</TableCustom>
-				<!-- <h2 class="mt-10"
-				>Folders managing this folder <Tooltip
-					>Any owner of those folders can manage this folder</Tooltip
-				></h2
-			>
-			{#if can_write}
-				<div class="flex items-start">
-					<AutoComplete items={folders} bind:selectedItem={new_managing_folder} />
-					<Button variant="accent" size="sm" btnClasses="!ml-4" on:click={addToManagingFolder}>
-						Add folder managing this folder
-					</Button>
-				</div>
-			{/if} -->
-				<!-- {#if managing_folders.length == 0}
-				<p class="text-primary text-sm">No folder is managing this folder</p>
-			{:else}
-				<TableCustom>
-					<tr slot="headerRow">
-						<th>folder</th>
-						<th />
-					</tr>
-					<tbody slot="body">
-						{#each managing_folders as managing_folder}<tr>
-								<td>{managing_folder.split('/')[1]}</td>
-								<td>
-									{#if can_write}
-										<button
-											class="ml-2 text-red-500"
-											on:click={async () => {
-												await GranularAclService.removeGranularAcls({
-													workspace: $workspaceStore ?? '',
-													path: name,
-													kind: 'folder',
-													requestBody: {
-														owner: managing_folder
-													}
-												})
-												loadFolder()
-											}}>remove</button
-										>
-									{/if}</td
-								>
-							</tr>{/each}
+										{:else if can_write && perm.owner_name == 'u/' + membership?.username}
+											<span class="text-2xs text-hint">
+												{isFixedCreatorRow(perm.owner_name)
+													? 'admin as the creator'
+													: 'cannot remove yourself'}
+											</span>
+										{/if}
+									</div>
+								</Cell>
+							</Row>
+						{/each}
 					</tbody>
-				</TableCustom>
-			{/if} -->
-			{:else if folderNotFound === undefined}
+				</DataTable>
+			{:else}
 				<div class="flex flex-col">
 					{#each new Array(6) as _}
 						<Skeleton layout={[[2], 0.7]} />
@@ -580,7 +887,10 @@
 	</Label>
 
 	{#if canEditDefaults}
-		<CollapseLink text="Default permissioned as (advanced, prod only)">
+		<CollapseLink
+			bind:open={() => defaultRulesOpen || defaultRulesInvalid, (v) => (defaultRulesOpen = v)}
+			text="Default permissioned as (advanced, prod only)"
+		>
 			<div class="flex flex-col gap-2">
 				<Alert type="info" title="Advanced — for prod workspaces (least privilege)" size="xs">
 					This setting is mostly relevant on <strong>production workspaces</strong> where you want
@@ -592,30 +902,33 @@
 					never rewritten.
 				</Alert>
 
-				{#if defaultPermissionedAs.length > 0}
-					<TableCustom>
-						{#snippet headerRow()}
+				{#if draft.defaultPermissionedAs.length > 0}
+					<DataTable size="sm">
+						<Head>
 							<tr>
-								<th>path_glob <Tooltip>Glob relative to <code>f/{name}/</code></Tooltip></th>
-								<th>permissioned as</th>
-								<th class="w-24"></th>
+								<Cell head first class="text-secondary">
+									path_glob <Tooltip>Glob relative to <code>f/{name}/</code></Tooltip>
+								</Cell>
+								<Cell head class="text-secondary">Permissioned as</Cell>
+								<Cell head last actions class="text-secondary">Actions</Cell>
 							</tr>
-						{/snippet}
-						{#snippet body()}
-							<tbody>
-								{#each defaultPermissionedAs as rule, idx (idx)}
-									{@const kind = ruleKind(rule.permissioned_as)}
-									{@const itemsForKind = kind === 'user' ? usernames : groups}
-									<tr>
-										<td>
-											<TextInput
-												bind:value={rule.path_glob}
-												inputProps={{ placeholder: '**' }}
-												error={!isValidGlob(rule.path_glob)}
-											/>
-										</td>
-										<td>
-											<div class="flex items-center gap-1">
+						</Head>
+						<tbody class="divide-y">
+							{#each draft.defaultPermissionedAs as rule, idx (idx)}
+								{@const kind = ownerKindOf(rule.permissioned_as)}
+								{@const itemsForKind = kind === 'user' ? usernames : groups}
+								<Row>
+									<Cell first>
+										<TextInput
+											bind:value={rule.path_glob}
+											size="sm"
+											inputProps={{ placeholder: '**' }}
+											error={!isValidGlob(rule.path_glob)}
+										/>
+									</Cell>
+									<Cell>
+										<div class="flex items-center gap-1">
+											<div>
 												<ToggleButtonGroup
 													selected={kind}
 													on:selected={(e) => setRulePermissionedAs(idx, e.detail, '')}
@@ -625,49 +938,51 @@
 														<ToggleButton value="group" label="Group" {item} size="sm" />
 													{/snippet}
 												</ToggleButtonGroup>
-												<Select
-													items={safeSelectItems(itemsForKind)}
-													bind:value={
-														() => ruleName(rule.permissioned_as),
-														(v) => setRulePermissionedAs(idx, kind, v ?? '')
-													}
-													class="grow min-w-32"
-												/>
 											</div>
-										</td>
-										<td>
-											<div class="flex items-center gap-1 justify-end">
-												<Button
-													variant="subtle"
-													unifiedSize="sm"
-													startIcon={{ icon: ArrowUp }}
-													iconOnly
-													disabled={idx === 0}
-													on:click={() => moveDefaultRule(idx, -1)}
-												/>
-												<Button
-													variant="subtle"
-													unifiedSize="sm"
-													startIcon={{ icon: ArrowDown }}
-													iconOnly
-													disabled={idx === defaultPermissionedAs.length - 1}
-													on:click={() => moveDefaultRule(idx, 1)}
-												/>
-												<Button
-													variant="subtle"
-													destructive
-													unifiedSize="sm"
-													startIcon={{ icon: Trash }}
-													iconOnly
-													on:click={() => removeDefaultRule(idx)}
-												/>
-											</div>
-										</td>
-									</tr>
-								{/each}
-							</tbody>
-						{/snippet}
-					</TableCustom>
+											<Select
+												items={safeSelectItems(itemsForKind)}
+												size="sm"
+												error={!isValidPermissionedAs(rule.permissioned_as)}
+												bind:value={
+													() => ownerNameOf(rule.permissioned_as),
+													(v) => setRulePermissionedAs(idx, kind, v ?? '')
+												}
+												class="grow min-w-0"
+											/>
+										</div>
+									</Cell>
+									<Cell last actions>
+										<div class="flex items-center gap-1 justify-end">
+											<Button
+												variant="subtle"
+												unifiedSize="sm"
+												startIcon={{ icon: ArrowUp }}
+												iconOnly
+												disabled={idx === 0}
+												on:click={() => moveDefaultRule(idx, -1)}
+											/>
+											<Button
+												variant="subtle"
+												unifiedSize="sm"
+												startIcon={{ icon: ArrowDown }}
+												iconOnly
+												disabled={idx === draft.defaultPermissionedAs.length - 1}
+												on:click={() => moveDefaultRule(idx, 1)}
+											/>
+											<Button
+												variant="subtle"
+												destructive
+												unifiedSize="sm"
+												startIcon={{ icon: Trash }}
+												iconOnly
+												on:click={() => removeDefaultRule(idx)}
+											/>
+										</div>
+									</Cell>
+								</Row>
+							{/each}
+						</tbody>
+					</DataTable>
 				{:else}
 					<div class="text-xs text-tertiary">No rules defined.</div>
 				{/if}
@@ -681,20 +996,14 @@
 					>
 						Add rule
 					</Button>
-					<Button
-						variant="accent"
-						unifiedSize="sm"
-						disabled={defaultRulesInvalid}
-						on:click={saveDefaultRules}
-					>
-						Save rules
-					</Button>
 				</div>
 			</div>
 		</CollapseLink>
 	{/if}
 
-	{#if reloadHistory > 0}
+	<!-- PermissionHistory fetches against `$workspaceStore`; aimed elsewhere it would show
+	     another folder's history entirely. -->
+	{#if !isNew && !aimedElsewhere && reloadHistory > 0}
 		{#key reloadHistory}
 			<PermissionHistory
 				{name}
diff --git a/frontend/src/lib/components/FolderEditorDrawer.svelte b/frontend/src/lib/components/FolderEditorDrawer.svelte
new file mode 100644
index 0000000000..c1f704082f
--- /dev/null
+++ b/frontend/src/lib/components/FolderEditorDrawer.svelte
@@ -0,0 +1,169 @@
+<script lang="ts">
+	import { Button, Drawer, DrawerContent } from './common'
+	import ConfirmationModal from './common/confirmationModal/ConfirmationModal.svelte'
+	import FolderEditor from './FolderEditor.svelte'
+	import { Save } from 'lucide-svelte'
+	import { sendUserToast } from '$lib/toast'
+
+	let {
+		offset = 0,
+		disableChatOffset = false,
+		onSaved = undefined,
+		workspace = undefined
+	}: {
+		offset?: number
+		disableChatOffset?: boolean
+		onSaved?: (name: string, created: boolean) => void | Promise<void>
+		/** Edit a folder of this workspace rather than the active one. */
+		workspace?: string
+	} = $props()
+
+	let drawer: Drawer | undefined = $state()
+	let mode: 'edit' | 'new' = $state('edit')
+	let name: string = $state('')
+	let canSave = $state(false)
+	let unsaved = $state(false)
+	// An `edit` drawer whose folder turns out not to exist saves by creating it. Calling that
+	// Save would promise an update the click does not perform.
+	let exists = $state(false)
+	let saving = $state(false)
+	let confirmDiscardOpen = $state(false)
+	let discarding = $state(false)
+	let editor: { save: () => Promise<{ name: string; created: boolean } | undefined> } | undefined =
+		$state()
+	// Bumped per open so the editor reloads its draft from the folder it is now
+	// pointed at. Keying on `name` instead would remount on every keystroke of the
+	// name field in `new` mode.
+	let instance = $state(0)
+
+	function open(nextMode: 'edit' | 'new', folderName: string): void {
+		mode = nextMode
+		name = folderName
+		discarding = false
+		confirmDiscardOpen = false
+		exists = nextMode === 'edit'
+		// The remounted editor reports these on its first effect, which is a tick away. Until
+		// then the header would carry the last folder's answers.
+		canSave = false
+		unsaved = false
+		instance++
+		drawer?.openDrawer()
+	}
+
+	export function initEdit(folderName: string): void {
+		open('edit', folderName)
+	}
+
+	export function initNew(initialName: string = ''): void {
+		open('new', initialName)
+	}
+
+	/** The editor keeps its draft in memory only, so closing throws it away. */
+	function requestClose() {
+		// A save is already writing. `unsaved` only clears once it reloads, so closing here
+		// would offer to discard changes the in-flight requests are busy persisting — and
+		// confirming would close on that lie. Saving is the shorter wait; ignore the close.
+		if (saving) return
+		if (discarding || !unsaved) {
+			drawer?.closeDrawer()
+			return
+		}
+		confirmDiscardOpen = true
+	}
+
+	async function save() {
+		saving = true
+		try {
+			// `created` comes from the editor, not from `mode`: a folder whose row turned out
+			// not to exist is created from an `initEdit` drawer.
+			const saved = await editor?.save()
+			if (saved) {
+				// Callers reload a list here. Called from inside the chain, not before it, so a
+				// synchronous throw is caught too — thrown out of `save()` it would skip the
+				// close below and strand the drawer open on a folder that did save.
+				void Promise.resolve()
+					.then(() => onSaved?.(saved.name, saved.created))
+					.catch((e) => sendUserToast(e?.body ?? String(e), true))
+				// The editor reloads its baseline after saving, but that lands a tick
+				// later; close on our own authority rather than racing it.
+				discarding = true
+				// Belt and braces with the `saving` guard on the close paths: nothing that
+				// asked to discard may outlive a save that then succeeded.
+				confirmDiscardOpen = false
+				drawer?.closeDrawer()
+			}
+		} finally {
+			saving = false
+		}
+	}
+</script>
+
+<Drawer
+	bind:this={drawer}
+	{offset}
+	{disableChatOffset}
+	on:close={() => {
+		// Escape and click-away close the drawer before asking. Reopening in the same
+		// tick is how the flow's script editor drawer handles this too: the close
+		// transition has not started, so nothing flickers.
+		if (saving) {
+			drawer?.openDrawer()
+			return
+		}
+		if (!discarding && unsaved) {
+			drawer?.openDrawer()
+			confirmDiscardOpen = true
+		}
+	}}
+>
+	<DrawerContent title={exists ? `Folder ${name}` : 'Create folder'} on:close={requestClose}>
+		<!-- `save()` snapshots the draft and then awaits several requests. An edit landing in
+		     that window would not be in the snapshot, and the drawer closes on success — so
+		     it would be lost without ever being offered as unsaved. `inert` keeps the form
+		     from taking one. -->
+		<div inert={saving} class={saving ? 'opacity-60 transition-opacity' : 'transition-opacity'}>
+			{#key instance}
+				<FolderEditor
+					bind:this={editor}
+					bind:name
+					{mode}
+					{workspace}
+					onCanSaveChange={(v) => (canSave = v)}
+					onUnsavedChange={(v) => (unsaved = v)}
+					onExistsChange={(v) => (exists = v)}
+				/>
+			{/key}
+		</div>
+		{#snippet actions()}
+			<Button
+				variant="accent"
+				unifiedSize="md"
+				startIcon={{ icon: Save }}
+				disabled={!canSave}
+				loading={saving}
+				on:click={save}
+			>
+				{exists ? 'Save' : 'Create'}
+			</Button>
+		{/snippet}
+	</DrawerContent>
+</Drawer>
+
+<!-- `alwaysPortal`: this drawer is opened from inside other drawers (the folder picker of a
+     resource or variable form), and that outer drawer is a stacking context this dialog
+     cannot climb out of on z-index alone. Left in place it paints under the drawer whose
+     unsaved changes it is asking about, which leaves that drawer impossible to close. -->
+<ConfirmationModal
+	alwaysPortal
+	open={confirmDiscardOpen}
+	title="Unsaved changes detected"
+	confirmationText="Discard changes"
+	onCanceled={() => (confirmDiscardOpen = false)}
+	onConfirmed={() => {
+		confirmDiscardOpen = false
+		discarding = true
+		drawer?.closeDrawer()
+	}}
+>
+	<span> Are you sure you want to discard the changes you have made to this folder? </span>
+</ConfirmationModal>
diff --git a/frontend/src/lib/components/FolderPicker.svelte b/frontend/src/lib/components/FolderPicker.svelte
index 325d36346d..6f8a4858c3 100644
--- a/frontend/src/lib/components/FolderPicker.svelte
+++ b/frontend/src/lib/components/FolderPicker.svelte
@@ -3,28 +3,16 @@
 	import { workspaceStore, userStore } from '$lib/stores'
 	import { isDemoWorkspaceRestricted } from '$lib/cloud'
 	import { ChevronDown, Pen, PlusIcon } from 'lucide-svelte'
-	import { Button, Drawer, DrawerContent } from './common'
-	import FolderEditor from './FolderEditor.svelte'
+	import { Button } from './common'
+	import FolderEditorDrawer from './FolderEditorDrawer.svelte'
 	import Select from './select/Select.svelte'
-	import TextInput from './text_input/TextInput.svelte'
-	import Label from './Label.svelte'
-	import InputError from './InputError.svelte'
-	import { tick } from 'svelte'
 	import { sendUserToast } from '$lib/toast'
 
-	const VALID_FOLDER_NAME = /^[a-zA-Z_0-9-]+$/
-
 	let folders: { name: string; write: boolean }[] = $state([])
 	let filterText: string = $state('')
 	let selectOpen: boolean = $state(false)
-	let nameInput: TextInput | undefined = $state()
-	let newFolder: Drawer | null = $state(null)
-	let viewFolder: Drawer | null = $state(null)
-	let newFolderName: string = $state('')
-	let folderCreated: string | undefined = $state(undefined)
-	let creating: boolean = $state(false)
+	let folderEditorDrawer: FolderEditorDrawer | undefined = $state()
 	let loadingFolders: boolean = $state(true)
-	let editingFolder: string = $state('')
 
 	type Props = {
 		folderName: string
@@ -99,45 +87,24 @@
 		}
 	}
 
-	async function openCreateFolder() {
-		newFolderName = filterText
-		folderCreated = undefined
-		newFolder?.openDrawer()
-		await tick()
-		nameInput?.focus()
-	}
-
-	async function addFolder() {
-		if (nameError || !newFolderName || creating) return
-		creating = true
-		try {
-			await FolderService.createFolder({
-				workspace: targetWorkspace,
-				requestBody: { name: newFolderName }
-			})
-			folderCreated = newFolderName
-
+	async function onFolderSaved(saved: string, created: boolean) {
+		if (created) {
 			// The creator owns what they just created. Recorded on whichever membership
 			// this picker is reading, and *before* reloading, so the new folder comes
 			// back selectable rather than `(read-only)` — `loadFolders` derives `write`
 			// from exactly this.
 			if (aimedElsewhere) {
-				if (targetUser) targetUser.folders = [...(targetUser.folders ?? []), newFolderName]
+				if (targetUser) targetUser.folders = [...(targetUser.folders ?? []), saved]
 			} else if ($userStore) {
 				// Writing $userStore.folders = [...] would call userStore.set(),
 				// which re-triggers Path.svelte's $effect.pre and calls initPath()/reset(),
 				// switching the owner toggle from "Folder" back to "User".
 				if (!$userStore.folders) $userStore.folders = []
-				$userStore.folders.push(newFolderName)
+				$userStore.folders.push(saved)
 			}
-
-			await loadFolders()
-			folderName = newFolderName
-		} catch (e) {
-			sendUserToast(`Could not create folder: ${e}`, true)
-		} finally {
-			creating = false
 		}
+		await loadFolders()
+		if (created) folderName = saved
 	}
 
 	let selectItems = $derived(
@@ -148,16 +115,6 @@
 		}))
 	)
 
-	let nameError = $derived(
-		!newFolderName
-			? ''
-			: !VALID_FOLDER_NAME.test(newFolderName)
-				? 'Folder name can only contain alphanumeric characters, underscores, and hyphens'
-				: folders.some((f) => f.name === newFolderName)
-					? 'A folder with this name already exists'
-					: ''
-	)
-
 	let noMatchingItems = $derived(
 		filterText &&
 			!selectItems.some((item) => item.label.toLowerCase().includes(filterText.toLowerCase()))
@@ -167,7 +124,7 @@
 		if (e.key === 'Enter' && selectOpen && noMatchingItems && !restricted) {
 			e.preventDefault()
 			selectOpen = false
-			openCreateFolder()
+			folderEditorDrawer?.initNew(filterText)
 		}
 	}
 
@@ -185,53 +142,12 @@
 	loadTargetUser().then(loadFolders)
 </script>
 
-<Drawer bind:this={newFolder} name="newFolder" offset={drawerOffset}>
-	<DrawerContent
-		title={folderCreated ? `Folder ${folderCreated}` : 'Create folder'}
-		on:close={() => {
-			newFolder?.closeDrawer()
-			folderCreated = undefined
-		}}
-	>
-		{#if folderCreated}
-			<FolderEditor name={folderCreated} />
-		{:else}
-			<div class="flex flex-col gap-4">
-				<Label label="Folder name">
-					<TextInput
-						bind:this={nameInput}
-						bind:value={newFolderName}
-						error={!!nameError}
-						inputProps={{
-							placeholder: 'folder_name',
-							onkeydown: (e: KeyboardEvent) => {
-								if (e.key === 'Enter' && newFolderName) {
-									e.preventDefault()
-									addFolder()
-								}
-							}
-						}}
-					/>
-					<InputError error={nameError} />
-				</Label>
-				<Button
-					variant="accent"
-					disabled={!newFolderName || !!nameError || creating}
-					loading={creating}
-					onClick={addFolder}
-				>
-					Create
-				</Button>
-			</div>
-		{/if}
-	</DrawerContent>
-</Drawer>
-
-<Drawer bind:this={viewFolder} offset={drawerOffset}>
-	<DrawerContent title="Folder {editingFolder}" on:close={viewFolder.closeDrawer}>
-		<FolderEditor name={editingFolder} />
-	</DrawerContent>
-</Drawer>
+<FolderEditorDrawer
+	bind:this={folderEditorDrawer}
+	offset={drawerOffset}
+	workspace={targetWorkspace}
+	onSaved={onFolderSaved}
+/>
 
 <!-- svelte-ignore a11y_no_static_element_interactions -->
 <!-- svelte-ignore a11y_no_noninteractive_element_interactions -->
@@ -262,8 +178,7 @@
 				wrapperClasses="-mr-2 pl-1 -my-2"
 				btnClasses="hover:bg-surface-tertiary"
 				onClick={() => {
-					editingFolder = item.value ?? ''
-					viewFolder?.openDrawer()
+					folderEditorDrawer?.initEdit(item.value ?? '')
 					close()
 				}}
 				startIcon={{ icon: Pen }}
@@ -278,7 +193,7 @@
 						: ''}"
 					onclick={() => {
 						close()
-						openCreateFolder()
+						folderEditorDrawer?.initNew(filterText)
 					}}
 				>
 					<PlusIcon class="inline" size={16} />
diff --git a/frontend/src/lib/components/GroupEditor.svelte b/frontend/src/lib/components/GroupEditor.svelte
index ab1d3a6d63..4fc881be5f 100644
--- a/frontend/src/lib/components/GroupEditor.svelte
+++ b/frontend/src/lib/components/GroupEditor.svelte
@@ -7,10 +7,13 @@
 		type InstanceGroup
 	} from '$lib/gen'
 	import { userStore, workspaceStore } from '$lib/stores'
-	import { createEventDispatcher, untrack } from 'svelte'
+	import { onMount, tick, untrack } from 'svelte'
 	import { Button } from './common'
 	import Skeleton from './common/skeleton/Skeleton.svelte'
-	import TableCustom from './TableCustom.svelte'
+	import DataTable from './table/DataTable.svelte'
+	import Head from './table/Head.svelte'
+	import Row from './table/Row.svelte'
+	import Cell from './table/Cell.svelte'
 	import { sendUserToast } from '$lib/toast'
 	import { canWrite } from '$lib/utils'
 	import ToggleButtonGroup from './common/toggleButton-v2/ToggleButtonGroup.svelte'
@@ -19,42 +22,112 @@
 	import Select from './select/Select.svelte'
 	import { safeSelectItems } from './select/utils.svelte'
 	import TextInput from './text_input/TextInput.svelte'
-	import { Trash } from 'lucide-svelte'
+	import { Plus, Trash } from 'lucide-svelte'
 	import PermissionHistory from './PermissionHistory.svelte'
 	import Alert from './common/alert/Alert.svelte'
+	import InputError from './InputError.svelte'
+	import Popover from './meltComponents/Popover.svelte'
+	import { DEMO_RESTRICTION_HINT, isDemoWorkspaceRestricted } from '$lib/cloud'
+	import {
+		groupMemberDiff,
+		isGroupDraftDirty,
+		type GroupDraft,
+		type GroupRole
+	} from '$lib/groupDraft'
 
-	interface Props {
-		name: string
+	const ROLE_TOOLTIPS = {
+		member:
+			'A Member of a group can see everything the group can see, write to everything the group can write, and generally act on behalf of the group',
+		manager:
+			'A manager of a group can manage the group, adding and removing users and change their roles. Being a manager does not make you a member',
+		admin:
+			'An admin of a group is a member of a group that can also add and remove members to the group, or make them admin.'
 	}
 
-	let { name }: Props = $props()
-	let can_write = $state(false)
+	const MEMBERS_EXPLAINER =
+		'A member is a user with a role on this group. Members act on behalf of the group and see everything it can see; admins can additionally add and remove members.'
 
-	type Role = 'member' | 'manager' | 'admin'
+	// Edits mutate `draft` only; `save()` is the sole writer to the backend, and `baseline` is
+	// what the group held when it was loaded, so comparing the two gives both the dirty state
+	// and the member calls to replay. Both live in `groupDraft.ts`, with tests.
+	interface Props {
+		/** In `new` mode this is the name being typed, hence bindable. */
+		name: string
+		mode?: 'edit' | 'new'
+		/** Drives the parent drawer's Save button, which lives above this component. */
+		onCanSaveChange?: (canSave: boolean) => void
+		/** Drives the parent drawer's discard confirmation on close. Unlike `canSave` this
+		 * stays true for edits that cannot be saved yet (a name already taken) — closing
+		 * would still throw them away. */
+		onUnsavedChange?: (unsaved: boolean) => void
+		/** Turns true once the group exists on the server, which a `new` drawer reaches
+		 * mid-save. The drawer stops calling itself Create from that point. */
+		onExistsChange?: (exists: boolean) => void
+	}
+
+	let {
+		name = $bindable(),
+		mode = 'edit',
+		onCanSaveChange,
+		onUnsavedChange,
+		onExistsChange
+	}: Props = $props()
+
+	const restricted = $derived(
+		isDemoWorkspaceRestricted($workspaceStore, $userStore?.is_admin, $userStore?.is_super_admin)
+	)
+
+	let can_write = $state(false)
 	let group: Group | undefined
 	let instance_group: InstanceGroup | undefined = $state()
-	let members: { member_name: string; role: Role }[] | undefined = $state(undefined)
-	let usernames: string[] | undefined = $state([])
-	let username: string = $state('')
-	let summary = $state('')
+	let usernames: string[] = $state([])
+	let groupNames: string[] = $state([])
+	let loaded = $state(false)
+	let reloadHistory = $state(0)
+	let nameInput: TextInput | undefined = $state(undefined)
 
-	const dispatch = createEventDispatcher()
+	let baseline: GroupDraft | undefined = $state(undefined)
+	// Empty, not `emptyDraft()`: that one seeds the caller as an admin, which is true of a
+	// group being created and a lie about one whose read failed. Every path that wants the
+	// seeded row calls `emptyDraft()` itself.
+	let draft: GroupDraft = $state({ summary: '', members: [] })
+
+	let memberToAdd: string = $state('')
+	let newMemberRole: GroupRole = $state('member')
+
+	// `create_group` puts the caller in the group and gives them the write entry, so a save
+	// on this branch has already happened once the request lands: a retry after a later
+	// member call fails must take the edit path or it recreates a group that now exists.
+	let alreadyCreated = $state(false)
+	const isNew = $derived(mode === 'new' && !alreadyCreated)
+
+	function emptyDraft(): GroupDraft {
+		return {
+			summary: '',
+			// The backend makes the creator an admin whatever we send, so the table shows that
+			// from the start rather than after the first reload.
+			members: $userStore ? [{ member_name: $userStore.username, role: 'admin' as GroupRole }] : []
+		}
+	}
+
+	function setDraft(value: GroupDraft) {
+		baseline = structuredClone(value)
+		draft = structuredClone(value)
+	}
+
+	/** Fills a picker or a validation list. The editor is usable before these land, so they
+	 *  run alongside the group read — but a rejection has to be reported: unhandled, it
+	 *  leaves the list silently empty and duplicate names stop being caught. */
+	function loadAside(load: () => Promise<void>): void {
+		load().catch((e) => sendUserToast(e?.body ?? String(e), true))
+	}
 
 	async function loadUsernames(): Promise<void> {
 		usernames = await UserService.listUsernames({ workspace: $workspaceStore! })
 	}
 
-	async function load() {
-		return Promise.all([loadGroup(), loadInstanceGroup(), loadUsernames()])
-	}
-
-	async function addToGroup() {
-		await GroupService.addUserToGroup({
-			workspace: $workspaceStore ?? '',
-			name,
-			requestBody: { username }
-		})
-		loadGroup()
+	async function loadGroupNames(): Promise<void> {
+		groupNames = (await GroupService.listGroupNames({ workspace: $workspaceStore! })) ?? []
 	}
 
 	async function loadInstanceGroup(): Promise<void> {
@@ -65,55 +138,218 @@
 		}
 	}
 
-	async function loadGroup(): Promise<void> {
-		try {
-			group = await GroupService.getGroup({ workspace: $workspaceStore!, name })
-			can_write = canWrite(name!, group.extra_perms ?? {}, $userStore)
-			members = Array.from(
-				new Set(
-					Object.entries(group?.extra_perms ?? {})
-						.filter(([k, v]) => k.startsWith('u/') && v)
-						.map(([k, _]) => k.split('/')[1])
-						.concat(group?.members ?? [])
-				)
-			).map((x) => {
-				return {
-					member_name: x,
-					role: getRole(x)
-				}
-			})
-			summary = group.summary ?? ''
-			reloadHistory++
-		} catch (e) {
-			can_write = false
-			members = []
-			summary = ''
-			group = {
-				name
-			}
+	async function load() {
+		loadAside(loadUsernames)
+		if (isNew) {
+			loadAside(loadGroupNames)
+			can_write = true
+			setDraft(emptyDraft())
+			loaded = true
+		} else {
+			loadAside(loadInstanceGroup)
+			await loadGroup()
 		}
 	}
 
-	function getRole(x: string): Role {
-		const writer = 'u/' + x in (group?.extra_perms ?? {}) && (group?.extra_perms ?? {})['u/' + x]
-		const member = group?.members?.includes(x)
+	/** `baselineOnly` re-reads the group without touching the draft: after a save that
+	 *  committed some of its calls and then failed, the baseline must become what the server
+	 *  actually holds while the draft stays the user's intent — the applied changes then stop
+	 *  counting as dirty, and the ones still missing stay dirty and retryable. */
+	async function loadGroup(opts?: { baselineOnly?: boolean }): Promise<void> {
+		const apply = (value: GroupDraft) =>
+			opts?.baselineOnly ? (baseline = structuredClone(value)) : setDraft(value)
+		try {
+			group = await GroupService.getGroup({ workspace: $workspaceStore!, name })
+			can_write = canWrite(name, group.extra_perms ?? {}, $userStore)
+			apply({
+				summary: group.summary ?? '',
+				members: Array.from(
+					new Set(
+						Object.entries(group?.extra_perms ?? {})
+							.filter(([k, v]) => k.startsWith('u/') && v)
+							.map(([k, _]) => k.split('/')[1])
+							.concat(group?.members ?? [])
+					)
+				).map((x) => ({ member_name: x, role: getRole(x) }))
+			})
+			reloadHistory++
+		} catch (e) {
+			// The draft must survive a failed read: overwriting it here would discard the
+			// user's edits and clear `unsaved` with them.
+			sendUserToast(e?.body ?? String(e), true)
+			// Only the opening read decides this. Revoking it on a failed reconcile would
+			// disable Save against a draft that is still dirty, with nothing left to reload.
+			if (!opts?.baselineOnly) can_write = false
+		} finally {
+			loaded = true
+		}
+	}
 
-		if (writer && member) {
+	function getRole(x: string): GroupRole {
+		const manages = 'u/' + x in (group?.extra_perms ?? {}) && (group?.extra_perms ?? {})['u/' + x]
+		const belongs = group?.members?.includes(x)
+
+		if (manages && belongs) {
 			return 'admin'
-		} else if (writer) {
+		} else if (manages) {
 			return 'manager'
 		} else {
 			return 'member'
 		}
 	}
+
+	// Guarded on `isNew`, not `mode`: once the group exists the name is frozen, so there is
+	// nothing left to validate.
+	const nameError = $derived(
+		!isNew
+			? ''
+			: !name
+				? ''
+				: groupNames.includes(name)
+					? 'A group with this name already exists'
+					: ''
+	)
+
+	const dirty = $derived(isGroupDraftDirty(draft, baseline))
+	// A typed name is progress too, even before any other field is touched.
+	const unsaved = $derived(dirty || (mode === 'new' && !!name))
+
+	$effect(() => {
+		onCanSaveChange?.(isNew ? loaded && !!name && !nameError && !restricted : can_write && dirty)
+	})
+
+	$effect(() => {
+		onUnsavedChange?.(unsaved)
+	})
+
+	$effect(() => {
+		onExistsChange?.(!isNew)
+	})
+
+	// `create_group` folds the caller into the group as an admin whatever the payload says, so
+	// on create their own row is fixed: offering to demote or remove it would be a change the
+	// backend silently discards.
+	function isFixedCreatorRow(member: string): boolean {
+		return isNew && member === $userStore?.username
+	}
+
+	function addMember(close: () => void) {
+		if (!draft.members.some((m) => m.member_name === memberToAdd)) {
+			draft.members.push({ member_name: memberToAdd, role: newMemberRole })
+		}
+		memberToAdd = ''
+		close()
+	}
+
+	/** Replays the member rows the user changed. `updateGroup` writes the summary only, so
+	 * membership goes through the endpoints that name who was added or promoted — which is
+	 * what the permission history reads back. The diff itself is in `groupDraft.ts`. */
+	async function applyMemberChanges(next: GroupDraft['members'], prev: GroupDraft['members']) {
+		const workspace = $workspaceStore ?? ''
+		for (const call of groupMemberDiff(prev, next, $userStore?.username)) {
+			switch (call.kind) {
+				case 'addUser':
+					await GroupService.addUserToGroup({
+						workspace,
+						name,
+						requestBody: { username: call.username }
+					})
+					break
+				case 'removeUser':
+					await GroupService.removeUserToGroup({
+						workspace,
+						name,
+						requestBody: { username: call.username }
+					})
+					break
+				case 'setAcl':
+					await GranularAclService.addGranularAcls({
+						workspace,
+						path: name,
+						kind: 'group_',
+						requestBody: { owner: 'u/' + call.username, write: true }
+					})
+					break
+				case 'removeAcl':
+					await GranularAclService.removeGranularAcls({
+						workspace,
+						path: name,
+						kind: 'group_',
+						requestBody: { owner: 'u/' + call.username }
+					})
+					break
+			}
+		}
+	}
+
+	export async function save(): Promise<{ name: string; created: boolean } | undefined> {
+		const next = $state.snapshot(draft) as GroupDraft
+		const prev = baseline as GroupDraft
+		const created = isNew
+		try {
+			if (created) {
+				await GroupService.createGroup({
+					workspace: $workspaceStore ?? '',
+					requestBody: { name, summary: next.summary }
+				})
+				alreadyCreated = true
+				// The members the caller added, on top of the admin row `create_group` wrote.
+				await applyMemberChanges(next.members, emptyDraft().members)
+				sendUserToast(`Group ${name} created`)
+			} else {
+				if (next.summary !== prev.summary) {
+					await GroupService.updateGroup({
+						workspace: $workspaceStore ?? '',
+						name,
+						requestBody: { summary: next.summary }
+					})
+				}
+				await applyMemberChanges(next.members, prev.members)
+				await loadGroup()
+				sendUserToast('Group updated')
+			}
+			return { name, created }
+		} catch (e) {
+			sendUserToast(e.body ?? String(e), true)
+			// A failed create is not proof the group is absent: `create_group` commits before a
+			// git-sync step that can still fail the request, including with a 4xx. Only the name
+			// conflict says it was never written. Report rather than resolve — a group found by
+			// name may be someone else's, and adopting it would send this draft's writes there.
+			const nameTaken = String(e?.body ?? '').includes('already exists')
+			if (created && !alreadyCreated && !nameTaken) {
+				sendUserToast(`Group ${name} may have been created anyway — reopen it to check`, true)
+			}
+			// Reconcile after any edit-path failure: the post-commit window means a rejection is
+			// not proof nothing was written. The baseline moves to server truth and the draft
+			// stays, so a retry re-sends only what is missing. `isNew` is read after the create,
+			// so a group that now exists reconciles too.
+			if (!isNew) await loadGroup({ baselineOnly: true })
+			return undefined
+		}
+	}
+
+	// The stores are read only to wait until they are populated, and the load runs once: this
+	// editor holds an unsaved draft, and the layout re-`set`s `$userStore` periodically — a
+	// second `load()` would overwrite the draft with the server's state and lose the edits
+	// silently, `unsaved` included. The drawer remounts this component per opening.
+	let loadStarted = false
 	$effect.pre(() => {
+		if (loadStarted) return
 		if ($workspaceStore && $userStore) {
+			loadStarted = true
 			untrack(() => {
 				load()
 			})
 		}
 	})
-	let reloadHistory = $state(0)
+
+	onMount(async () => {
+		if (mode !== 'new') return
+		// The editor is remounted per drawer opening, so mount is the moment the create form
+		// appears; the input only exists after the first render.
+		await tick()
+		nameInput?.focus()
+	})
 </script>
 
 <div class="flex flex-col gap-6">
@@ -124,207 +360,218 @@
 			permission, deployed items will be reassigned to the deploying user.
 		</Alert>
 	{/if}
-	<Label label="Summary" for="summary">
-		<div class="flex flex-row gap-2">
+
+	{#if mode === 'new'}
+		<Label label="Group name">
+			<!-- Frozen once the group exists: `createGroup` lands before the member calls, so a
+			     save can fail with the group already created under this name. Retyping it would
+			     point the remaining member calls at a different group — one that may not exist,
+			     or worse, one that does. -->
 			<TextInput
-				inputProps={{ placeholder: 'Short summary to be displayed when listed', id: 'summary' }}
-				bind:value={summary}
+				bind:this={nameInput}
+				bind:value={name}
+				error={!!nameError}
 				size="md"
+				inputProps={{ placeholder: 'group_name', disabled: !isNew }}
 			/>
-			<Button
-				unifiedSize="md"
-				variant="accent"
-				on:click={async () => {
-					await GroupService.updateGroup({
-						workspace: $workspaceStore ?? '',
-						name,
-						requestBody: { summary }
-					})
-					dispatch('update')
-					sendUserToast('Group summary updated')
-					loadGroup()
-				}}>Save</Button
-			>
-		</div>
+			<InputError error={nameError} />
+		</Label>
+	{/if}
+
+	<Label label="Summary" for="summary">
+		<TextInput
+			inputProps={{
+				placeholder: 'Short summary to be displayed when listed',
+				id: 'summary',
+				disabled: !can_write
+			}}
+			bind:value={draft.summary}
+			size="md"
+		/>
 	</Label>
 
-	<Label label={`Members (${members?.length ?? 0})`}>
-		{#if can_write}
-			<div class="flex items-start gap-1">
-				<Select items={safeSelectItems(usernames)} bind:value={username} size="md" class="grow" />
-				<Button variant="accent" color="blue" unifiedSize="md" on:click={addToGroup}>
-					Add member
-				</Button>
-			</div>
-		{/if}
-		{#if members}
-			<TableCustom>
-				{#snippet headerRow()}
-					<tr>
-						<th>user</th>
-						<th></th>
-						<th></th>
-					</tr>
-				{/snippet}
-				{#snippet body()}
-					<tbody>
-						{#each members ?? [] as { member_name, role }}<tr>
-								<td>{member_name}</td>
-								<td>
-									{#if can_write}
+	<Label label={`Members (${draft.members.length})`} tooltip={MEMBERS_EXPLAINER}>
+		{#snippet action()}
+			{#if can_write && !restricted}
+				<Popover
+					placement="bottom-end"
+					onClose={() => {
+						memberToAdd = ''
+						newMemberRole = 'member'
+					}}
+				>
+					{#snippet trigger()}
+						<Button
+							variant="default"
+							unifiedSize="sm"
+							nonCaptureEvent={true}
+							startIcon={{ icon: Plus }}
+						>
+							Add member
+						</Button>
+					{/snippet}
+					{#snippet content({ close })}
+						<div class="flex flex-col w-72 p-4 gap-4">
+							<span class="text-sm leading-6 font-semibold">Add a member</span>
+							<Label label="User">
+								<Select
+									items={safeSelectItems(
+										usernames.filter((x) => !draft.members.some((m) => m.member_name === x))
+									)}
+									bind:value={memberToAdd}
+									size="sm"
+									class="grow min-w-0"
+								/>
+							</Label>
+							<Label label="Role">
+								<ToggleButtonGroup bind:selected={newMemberRole}>
+									{#snippet children({ item })}
+										<ToggleButton
+											value="member"
+											label="Member"
+											tooltip={ROLE_TOOLTIPS.member}
+											{item}
+											size="sm"
+										/>
+										<ToggleButton
+											value="admin"
+											label="Admin"
+											tooltip={ROLE_TOOLTIPS.admin}
+											{item}
+											size="sm"
+										/>
+									{/snippet}
+								</ToggleButtonGroup>
+							</Label>
+							<Button
+								variant="accent"
+								unifiedSize="sm"
+								disabled={memberToAdd == ''}
+								onClick={() => addMember(close)}
+							>
+								Add
+							</Button>
+						</div>
+					{/snippet}
+				</Popover>
+			{/if}
+		{/snippet}
+		<div class="flex flex-col gap-2">
+			{#if can_write && restricted}
+				<Alert type="info" title="Sharing disabled">{DEMO_RESTRICTION_HINT}</Alert>
+			{/if}
+
+			{#if loaded}
+				<DataTable size="sm">
+					<Head>
+						<tr>
+							<Cell head first class="text-secondary">Name</Cell>
+							<Cell head class="text-secondary">Role</Cell>
+							<Cell head last actions class="text-secondary">Actions</Cell>
+						</tr>
+					</Head>
+					<tbody class="divide-y">
+						{#each draft.members as member, idx (member.member_name)}
+							<Row>
+								<Cell first>
+									<span class="text-emphasis font-medium">{member.member_name}</span>
+								</Cell>
+								<Cell>
+									{#if can_write && !restricted}
 										<div>
 											<ToggleButtonGroup
-												selected={role}
-												on:selected={async (e) => {
-													const role = e.detail
-													// const wasInGroup = (group?.members ?? []).includes(group)
-													// const inAcl = (
-													// 	group?.extra_perms ? Object.keys(group?.extra_perms) : []
-													// ).includes(group)
-													if (role == 'member') {
-														await GroupService.addUserToGroup({
-															workspace: $workspaceStore ?? '',
-															name,
-															requestBody: {
-																username: member_name
-															}
-														})
-														await GranularAclService.removeGranularAcls({
-															workspace: $workspaceStore ?? '',
-															path: name,
-															kind: 'group_',
-															requestBody: {
-																owner: 'u/' + member_name
-															}
-														})
-													} else if (role == 'manager') {
-														await GroupService.removeUserToGroup({
-															workspace: $workspaceStore ?? '',
-															name,
-															requestBody: {
-																username: member_name
-															}
-														})
-														await GranularAclService.addGranularAcls({
-															workspace: $workspaceStore ?? '',
-															path: name,
-															kind: 'group_',
-															requestBody: {
-																owner: 'u/' + member_name,
-																write: true
-															}
-														})
-													} else if (role == 'admin') {
-														await GroupService.addUserToGroup({
-															workspace: $workspaceStore ?? '',
-															name,
-															requestBody: {
-																username: member_name
-															}
-														})
-														await GranularAclService.addGranularAcls({
-															workspace: $workspaceStore ?? '',
-															path: name,
-															kind: 'group_',
-															requestBody: {
-																owner: 'u/' + member_name,
-																write: true
-															}
-														})
-													}
-													loadGroup()
+												disabled={isFixedCreatorRow(member.member_name)}
+												selected={member.role}
+												on:selected={(e) => {
+													draft.members[idx].role = e.detail
 												}}
 											>
 												{#snippet children({ item })}
 													<ToggleButton
 														value="member"
-														small
 														label="Member"
-														tooltip="A Member of a group can see everything the group can see, write to everything the group can write, and generally act on behalf of the group"
+														tooltip={ROLE_TOOLTIPS.member}
 														{item}
+														size="sm"
 													/>
 													<ToggleButton
 														value="admin"
-														small
 														label="Admin"
-														tooltip="An admin of a group is a member of a group that can also add and remove members to the group, or make them admin."
+														tooltip={ROLE_TOOLTIPS.admin}
 														{item}
+														size="sm"
 													/>
-													{#if role === 'manager'}
+													<!-- Manager is a state the UI can leave but not enter: it is a
+													     write entry without membership, which only older grants hold. -->
+													{#if member.role === 'manager'}
 														<ToggleButton
 															value="manager"
-															small
 															label="Manager"
-															tooltip="A manager of a group can manage the group, adding and removing users and
-													change their roles. Being a manager does not make you a member"
+															tooltip={ROLE_TOOLTIPS.manager}
 															{item}
+															size="sm"
 														/>
 													{/if}
 												{/snippet}
 											</ToggleButtonGroup>
 										</div>
 									{:else}
-										{role}
-									{/if}</td
-								>
-								<td class="flex justify-end">
-									{#if can_write}
-										<Button
-											variant="subtle"
-											destructive
-											unifiedSize="md"
-											startIcon={{ icon: Trash }}
-											iconOnly
-											onclick={async () => {
-												await GroupService.removeUserToGroup({
-													workspace: $workspaceStore ?? '',
-													name,
-													requestBody: { username: member_name }
-												})
-												await GranularAclService.removeGranularAcls({
-													workspace: $workspaceStore ?? '',
-													path: name,
-													kind: 'group_',
-													requestBody: {
-														owner: 'u/' + member_name
-													}
-												})
-												loadGroup()
-											}}
-										/>
-									{/if}</td
-								>
-							</tr>{/each}
+										{member.role}
+									{/if}
+								</Cell>
+								<Cell last actions>
+									<div class="flex items-center justify-end">
+										{#if can_write && !isFixedCreatorRow(member.member_name)}
+											<Button
+												variant="subtle"
+												destructive
+												unifiedSize="sm"
+												startIcon={{ icon: Trash }}
+												iconOnly
+												onclick={() => {
+													draft.members = draft.members.filter(
+														(m) => m.member_name !== member.member_name
+													)
+												}}
+											/>
+										{:else if isFixedCreatorRow(member.member_name)}
+											<span class="text-2xs text-hint">admin as the creator</span>
+										{/if}
+									</div>
+								</Cell>
+							</Row>
+						{/each}
 					</tbody>
-				{/snippet}
-			</TableCustom>
-
-			{#if instance_group?.emails}
-				<h2 class="mt-6 text-emphasis text-xs font-semibold">Members from the instance group</h2>
-				<TableCustom>
-					{#snippet headerRow()}
-						<tr>
-							<th>user</th>
-						</tr>
-					{/snippet}
-					{#snippet body()}
-						<tbody>
-							{#each instance_group?.emails ?? [] as email}<tr>
-									<td>{email}</td>
-								</tr>{/each}
-						</tbody>
-					{/snippet}
-				</TableCustom>
+				</DataTable>
+			{:else}
+				<div class="flex flex-col">
+					{#each new Array(6) as _}
+						<Skeleton layout={[[2], 0.7]} />
+					{/each}
+				</div>
 			{/if}
-		{:else}
-			<div class="flex flex-col">
-				{#each new Array(6) as _}
-					<Skeleton layout={[[2], 0.7]} />
-				{/each}
-			</div>
-		{/if}
+		</div>
 	</Label>
 
+	{#if instance_group?.emails}
+		<Label label="Members from the instance group">
+			<DataTable size="sm">
+				<Head>
+					<tr>
+						<Cell head first last class="text-secondary">Email</Cell>
+					</tr>
+				</Head>
+				<tbody class="divide-y">
+					{#each instance_group?.emails ?? [] as email}
+						<Row>
+							<Cell first last>{email}</Cell>
+						</Row>
+					{/each}
+				</tbody>
+			</DataTable>
+		</Label>
+	{/if}
+
 	{#if reloadHistory > 0}
 		{#key reloadHistory}
 			<PermissionHistory
diff --git a/frontend/src/lib/components/GroupEditorDrawer.svelte b/frontend/src/lib/components/GroupEditorDrawer.svelte
new file mode 100644
index 0000000000..458f0c58fd
--- /dev/null
+++ b/frontend/src/lib/components/GroupEditorDrawer.svelte
@@ -0,0 +1,162 @@
+<script lang="ts">
+	import { Button, Drawer, DrawerContent } from './common'
+	import ConfirmationModal from './common/confirmationModal/ConfirmationModal.svelte'
+	import GroupEditor from './GroupEditor.svelte'
+	import { Save } from 'lucide-svelte'
+	import { sendUserToast } from '$lib/toast'
+
+	let {
+		offset = 0,
+		disableChatOffset = false,
+		onSaved = undefined
+	}: {
+		offset?: number
+		disableChatOffset?: boolean
+		onSaved?: (name: string, created: boolean) => void | Promise<void>
+	} = $props()
+
+	let drawer: Drawer | undefined = $state()
+	let mode: 'edit' | 'new' = $state('edit')
+	let name: string = $state('')
+	let canSave = $state(false)
+	let unsaved = $state(false)
+	// A `new` drawer whose group has been created but whose member calls then failed stays
+	// open on the edit path. Calling it Create there would offer to create what exists.
+	let exists = $state(false)
+	let saving = $state(false)
+	let confirmDiscardOpen = $state(false)
+	let discarding = $state(false)
+	let editor: { save: () => Promise<{ name: string; created: boolean } | undefined> } | undefined =
+		$state()
+	// Bumped per open so the editor reloads its draft from the group it is now pointed at.
+	// Keying on `name` instead would remount on every keystroke of the name field in `new` mode.
+	let instance = $state(0)
+
+	function open(nextMode: 'edit' | 'new', groupName: string): void {
+		mode = nextMode
+		name = groupName
+		discarding = false
+		confirmDiscardOpen = false
+		exists = nextMode === 'edit'
+		// The remounted editor reports these on its first effect, which is a tick away. Until
+		// then the header would carry the last group's answers.
+		canSave = false
+		unsaved = false
+		instance++
+		drawer?.openDrawer()
+	}
+
+	export function initEdit(groupName: string): void {
+		open('edit', groupName)
+	}
+
+	export function initNew(initialName: string = ''): void {
+		open('new', initialName)
+	}
+
+	/** The editor keeps its draft in memory only, so closing throws it away. */
+	function requestClose() {
+		// A save is already writing. `unsaved` only clears once it reloads, so closing here
+		// would offer to discard changes the in-flight requests are busy persisting — and
+		// confirming would close on that lie. Saving is the shorter wait; ignore the close.
+		if (saving) return
+		if (discarding || !unsaved) {
+			drawer?.closeDrawer()
+			return
+		}
+		confirmDiscardOpen = true
+	}
+
+	async function save() {
+		saving = true
+		try {
+			const saved = await editor?.save()
+			if (saved) {
+				// Callers reload a list here. Called from inside the chain, not before it, so a
+				// synchronous throw is caught too — thrown out of `save()` it would skip the
+				// close below and strand the drawer open on a group that did save.
+				void Promise.resolve()
+					.then(() => onSaved?.(saved.name, saved.created))
+					.catch((e) => sendUserToast(e?.body ?? String(e), true))
+				// The editor reloads its baseline after saving, but that lands a tick later;
+				// close on our own authority rather than racing it.
+				discarding = true
+				// Belt and braces with the `saving` guard on the close paths: nothing that
+				// asked to discard may outlive a save that then succeeded.
+				confirmDiscardOpen = false
+				drawer?.closeDrawer()
+			}
+		} finally {
+			saving = false
+		}
+	}
+</script>
+
+<Drawer
+	bind:this={drawer}
+	{offset}
+	{disableChatOffset}
+	on:close={() => {
+		// Escape and click-away close the drawer before asking. Reopening in the same tick is
+		// how the flow's script editor drawer handles this too: the close transition has not
+		// started, so nothing flickers.
+		if (saving) {
+			drawer?.openDrawer()
+			return
+		}
+		if (!discarding && unsaved) {
+			drawer?.openDrawer()
+			confirmDiscardOpen = true
+		}
+	}}
+>
+	<DrawerContent title={exists ? `Group ${name}` : 'Create group'} on:close={requestClose}>
+		<!-- `save()` snapshots the draft and then awaits several requests. An edit landing in
+		     that window would not be in the snapshot, and the drawer closes on success — so it
+		     would be lost without ever being offered as unsaved. `inert` keeps the form from
+		     taking one. -->
+		<div inert={saving} class={saving ? 'opacity-60 transition-opacity' : 'transition-opacity'}>
+			{#key instance}
+				<GroupEditor
+					bind:this={editor}
+					bind:name
+					{mode}
+					onCanSaveChange={(v) => (canSave = v)}
+					onUnsavedChange={(v) => (unsaved = v)}
+					onExistsChange={(v) => (exists = v)}
+				/>
+			{/key}
+		</div>
+		{#snippet actions()}
+			<Button
+				variant="accent"
+				unifiedSize="md"
+				startIcon={{ icon: Save }}
+				disabled={!canSave}
+				loading={saving}
+				on:click={save}
+			>
+				{exists ? 'Save' : 'Create'}
+			</Button>
+		{/snippet}
+	</DrawerContent>
+</Drawer>
+
+<!-- `alwaysPortal`: this drawer is opened from inside another drawer (the folder editor, itself
+     reachable from a resource or variable form), and that outer drawer is a stacking context
+     this dialog cannot climb out of on z-index alone. Left in place it paints under the drawer
+     whose unsaved changes it is asking about, which leaves that drawer impossible to close. -->
+<ConfirmationModal
+	alwaysPortal
+	open={confirmDiscardOpen}
+	title="Unsaved changes detected"
+	confirmationText="Discard changes"
+	onCanceled={() => (confirmDiscardOpen = false)}
+	onConfirmed={() => {
+		confirmDiscardOpen = false
+		discarding = true
+		drawer?.closeDrawer()
+	}}
+>
+	<span> Are you sure you want to discard the changes you have made to this group? </span>
+</ConfirmationModal>
diff --git a/frontend/src/lib/components/ImportSetupStep.svelte b/frontend/src/lib/components/ImportSetupStep.svelte
index 86670b0817..94691f86d7 100644
--- a/frontend/src/lib/components/ImportSetupStep.svelte
+++ b/frontend/src/lib/components/ImportSetupStep.svelte
@@ -14,16 +14,21 @@
 	import IconedResourceType from '$lib/components/IconedResourceType.svelte'
 	import ImportSetupRow from '$lib/components/ImportSetupRow.svelte'
 	import AppConnectDrawer from '$lib/components/AppConnectDrawer.svelte'
+	import Modal2 from '$lib/components/common/modal/Modal2.svelte'
+	import Select from '$lib/components/select/Select.svelte'
+	import { applyRetarget, seesWholeWorkspace } from '$lib/importWizard/retargetDeployed'
 	import { OauthService } from '$lib/gen'
 	import { registryCcCapableFor } from '$lib/components/oauthRegistry'
 	import { resourceTypeDisplayName } from '$lib/components/resourceTypeDisplay'
 	import { applyOneMigration } from '$lib/components/workspaceSettings/projectInstall'
 	import { probeMigrationsApplied } from '$lib/importWizard/probe'
 	import {
+		projectReferencesResource,
 		retargetProjectExport,
 		type ProjectExport,
 		type ProjectMigration
 	} from '$lib/components/workspaceSettings/projectBundle'
+	import { superadmin, userStore } from '$lib/stores'
 	import { sendUserToast } from '$lib/toast'
 	import { escapeHtml } from '$lib/utils'
 
@@ -82,6 +87,17 @@
 		 * is absent, and removing the row reports "all set" over a credential nobody filled.
 		 */
 		unreadable?: boolean
+		/**
+		 * The workspace resource this row was pointed at. The project's items reference it
+		 * directly now, so this is what the row has to say instead of the path it used to name.
+		 */
+		reusedFrom?: string
+		/**
+		 * The empty placeholder is still at this row's path, because the retarget could not
+		 * account for every item that might read it. Worth saying: the workspace has a resource
+		 * on it that looks unfinished and is not.
+		 */
+		stubKept?: boolean
 	}
 
 	let loading = $state(true)
@@ -89,9 +105,38 @@
 	let rows = $state<Row[]>([])
 	let blanks = $state<Blank[]>([])
 	let projectResources: { path: string; resource_type: string }[] = []
+	/**
+	 * The subset of `projectResources` the checklist asks about: the ones something in the
+	 * project actually points at. The rest are created and left alone — see
+	 * `projectReferencesResource`. Kept apart from `projectResources` because the full list
+	 * is still what a stub may not be replaced by.
+	 */
+	let askableResources: { path: string; resource_type: string }[] = []
 	let working = $state(false)
 	let resourceEditor: ResourceEditorDrawer | undefined = $state(undefined)
 
+	/** The folder the import wrote into, which is where every rewritable referrer lives. */
+	const targetFolder = $derived(folder?.trim() || slug)
+
+	/**
+	 * Resources the workspace already has, by resource type — what a stub can be replaced
+	 * by. Empty for a workspace this import created, which is why the choice is offered
+	 * rather than imposed: with nothing to choose from the button goes straight to the
+	 * editor, exactly as it did before.
+	 */
+	let candidates = $state<Record<string, string[]>>({})
+	/**
+	 * How many candidates are worth reading back to find the unfilled ones. Past this a
+	 * workspace holds too many resources of these types to be the case worth filtering —
+	 * one project's stub offered as another's credential — and they are all offered rather
+	 * than costing a request each.
+	 */
+	const CANDIDATE_READ_CAP = 40
+	/** The credential row whose choice dialog is open. */
+	let choosing = $state<Blank | undefined>(undefined)
+	let chosenPath = $state<string | undefined>(undefined)
+	let reusing = $state(false)
+
 	const pendingTables = $derived(rows.filter((r) => r.status !== 'done'))
 	// Split because the two say different things to the user: one data table was never
 	// created, the other exists and could not be read. Telling someone to set up what they
@@ -248,7 +293,7 @@
 			// Retargeted the same way the import was, so these are where the stubs actually
 			// landed. `retargetProjectExport` is a no-op when the folder is the slug, which is
 			// every new-workspace import.
-			const target = folder?.trim() || slug
+			const target = targetFolder
 			const retargeted = retargetProjectExport(exportData, exportData.project?.slug ?? slug, target)
 			// Contained for the same reason the import contains: a crafted export can name a
 			// path outside the folder, and offering that for editing would reach a resource
@@ -256,6 +301,20 @@
 			projectResources = (retargeted.resources ?? [])
 				.map((r) => ({ path: String(r.path), resource_type: String((r as any).resource_type) }))
 				.filter((r) => r.path.startsWith(`f/${target}/`))
+			// Asked against the export as published, not the retargeted copy: a path the project
+			// spells out in code is not rewritten by the retarget, so only the raw export has
+			// its references and its resource paths agreeing. `resourceCount` asks the same
+			// question the same way, and the step and the stepper have to give one answer.
+			// Paired by position, not by reconstructing the retargeted path: `retargetProjectExport`
+			// maps `resources` in order, and an external path the bundle pulled in lands at
+			// `f/<folder>/<name>` with a `_2` suffix on collision, which no slicing recovers.
+			const askable = new Set(
+				(retargeted.resources ?? [])
+					.map((r, i) => [String(r.path), (exportData.resources ?? [])[i]] as const)
+					.filter(([, raw]) => raw && projectReferencesResource(exportData, String(raw.path)))
+					.map(([path]) => path)
+			)
+			askableResources = projectResources.filter((r) => askable.has(r.path))
 			await refreshBlanks()
 		} catch (e: any) {
 			loadError = e?.body ?? e?.message ?? String(e)
@@ -347,13 +406,19 @@
 	 * it only moves a row from outstanding to done.
 	 */
 	async function refreshBlanks(): Promise<void> {
-		const fresh = await findBlankResources(projectResources)
+		const fresh = await findBlankResources(askableResources)
 		const stillBlank = new Map(fresh.map((b) => [b.path, b]))
 		if (blanks.length === 0) {
 			blanks = fresh
+			await loadCandidates()
 			return
 		}
 		blanks = blanks.map((b) => {
+			// A row pointed at another resource is settled once its own stub is gone: the
+			// project's items read the chosen resource and nothing is left at this path. A row
+			// whose stub was kept is not settled, and re-reading it is how filling that stub in
+			// finally closes the row.
+			if (b.reusedFrom && !b.stubKept) return b
 			const f = stillBlank.get(b.path)
 			// Every field the fresh read decides is taken from it, not merged selectively: these
 			// describe what is at the path *now*. Keeping a stale `unreadable` leaves a resource
@@ -369,12 +434,15 @@
 					justSaved: false
 				}
 			}
-			// Gone from the blank list entirely: it was read, and it is filled.
+			// Gone from the blank list entirely: it was read, and it is filled. `stubKept` goes
+			// with it — the placeholder the items this run could not move read is a credential
+			// now, so there is nothing left to tell anyone to fill in.
 			return {
 				...b,
 				missing: [],
 				unreadable: undefined,
 				occupiedBy: undefined,
+				stubKept: undefined,
 				done: true,
 				justSaved: !b.done
 			}
@@ -387,6 +455,169 @@
 				if (row) row.justSaved = false
 			}, 1500)
 		}
+		await loadCandidates()
+	}
+
+	/**
+	 * Which existing resources each outstanding row could be replaced by. Re-read on every
+	 * refresh rather than once: a resource created from the editor here is a candidate for
+	 * the rows below it.
+	 *
+	 * The project's own resources are never offered — one of this project's stubs standing
+	 * in for another is a reference to something equally unfilled.
+	 */
+	async function loadCandidates(): Promise<void> {
+		const types = [...new Set(blanks.map((b) => b.resourceType))]
+		if (types.length === 0) {
+			candidates = {}
+			return
+		}
+		const own = new Set(projectResources.map((r) => r.path))
+		const next: Record<string, string[]> = Object.fromEntries(types.map((t) => [t, []]))
+		try {
+			// One call for every type at once — `resource_type` takes a comma-separated list —
+			// and every page of it: `perPage` is what bounds the answer, so without the loop a
+			// workspace past one page would have the rest of its resources silently hidden.
+			for (let page = 1; page <= 100; page++) {
+				const rows = await ResourceService.listResource({
+					workspace,
+					resourceType: types.join(','),
+					page,
+					perPage: 100
+				})
+				for (const r of rows) {
+					if (own.has(r.path)) continue
+					next[r.resource_type ?? '']?.push(r.path)
+				}
+				if (rows.length < 100) break
+			}
+		} catch {
+			// Offer nothing rather than a partial list: every row then behaves as it did before
+			// this choice existed, which is a working way to fill a credential.
+			candidates = {}
+			return
+		}
+		// An unfilled resource is never the answer to "which credential should this use" —
+		// another project's stub above all, which the path filter above cannot recognise.
+		const paths = Object.values(next).flat()
+		if (paths.length <= CANDIDATE_READ_CAP) {
+			const settled = await Promise.all(paths.map(async (p) => [p, await isUnfilled(p)] as const))
+			const unfilled = new Set(settled.filter(([, empty]) => empty).map(([p]) => p))
+			for (const t of Object.keys(next)) next[t] = next[t].filter((p) => !unfilled.has(p))
+		}
+		candidates = next
+	}
+
+	/**
+	 * Whether a resource holds nothing. Same test the checklist uses to call one of the
+	 * project's own resources blank, so a resource this drops is exactly one the wizard
+	 * would have asked someone to fill in.
+	 */
+	async function isUnfilled(path: string): Promise<boolean> {
+		try {
+			const found = await ResourceService.getResource({ workspace, path })
+			const value = found?.value
+			if (!value || typeof value !== 'object') return true
+			return !Object.values(value).some((v) => v !== undefined && v !== null && v !== '')
+		} catch {
+			// A read that fails says nothing about the value, and offering it is what this did
+			// before the check existed.
+			return false
+		}
+	}
+
+	/**
+	 * The row's one action. A workspace that already has a resource of this type gets the
+	 * choice first — reusing what is there is usually the answer, and entering the same
+	 * credentials a second time is the thing worth avoiding. With nothing to choose from
+	 * there is no choice to make, so it goes straight where it always went.
+	 */
+	function startFilling(b: Blank): void {
+		// A kept-stub row has already been pointed at a resource; what is left is the empty
+		// placeholder the items this run could not move still read. Reusing a second resource
+		// would move nothing — every rewritable referrer is off the stub — and would relabel
+		// the row after a retarget that did nothing.
+		if (b.done || b.stubKept || (candidates[b.resourceType] ?? []).length === 0) {
+			fillDirectly(b)
+			return
+		}
+		chosenPath = undefined
+		choosing = b
+	}
+
+	/** Connect where the instance can, hand-fill otherwise. */
+	function fillDirectly(b: Blank): void {
+		if (canConnectType(b.resourceType)) appConnect?.open(b.resourceType, b.path)
+		else resourceEditor?.initEdit(b.path)
+	}
+
+	/**
+	 * The chooser's way out: close it and do what the button did before there was a choice.
+	 * The row is read out of the state first — closing the dialog unmounts the block that
+	 * would otherwise be holding it.
+	 */
+	function fillNewInstead(): void {
+		const b = choosing
+		choosing = undefined
+		if (b) fillDirectly(b)
+	}
+
+	/**
+	 * Point the project at an existing resource: every imported item that referenced the stub
+	 * is rewritten to the chosen path. Nothing is copied. The stub is deleted only when
+	 * `applyRetarget` can account for every item that might read it, and kept otherwise — so
+	 * the toast says how many items moved, and whether the placeholder is still there.
+	 */
+	async function reuseChosen(): Promise<void> {
+		const b = choosing
+		const target = chosenPath
+		if (!b || !target) return
+		reusing = true
+		working = true
+		try {
+			const outcome = await applyRetarget({
+				workspace,
+				folder: targetFolder,
+				from: b.path,
+				to: target,
+				// Asked of this workspace, not of whichever one the user record still describes:
+				// reloading on this step leaves `$userStore` pointing at the previous workspace.
+				seesWholeWorkspace: seesWholeWorkspace($userStore, !!$superadmin, workspace)
+			})
+			const moved = `${outcome.rewritten.length} item${outcome.rewritten.length === 1 ? '' : 's'}`
+			if (outcome.error) {
+				sendUserToast(
+					`Could not point the project at ${target}: ${outcome.error}. ${moved} had already been updated, and ${b.path} was kept.`,
+					true
+				)
+				return
+			}
+			choosing = undefined
+			const row = blanks.find((x) => x.path === b.path)
+			if (row) {
+				row.reusedFrom = target
+				row.stubKept = !outcome.stubDeleted
+				// Settled only when the stub is gone. A kept stub is empty and is still what
+				// every item the scan could not move reads, so the row stays outstanding and
+				// keeps its action: filling it in is the thing left to do.
+				row.done = outcome.stubDeleted
+				row.justSaved = outcome.stubDeleted
+			}
+			await refreshBlanks()
+			sendUserToast(
+				outcome.stubDeleted
+					? `The project now uses ${target} — ${moved} updated.`
+					: `The project now uses ${target} — ${moved} updated. ${b.path} was kept, because some items could not be checked.`
+			)
+		} catch (e: any) {
+			sendUserToast(
+				`Could not point the project at ${target}: ${e?.body ?? e?.message ?? String(e)}`,
+				true
+			)
+		} finally {
+			reusing = false
+			working = false
+		}
 	}
 
 	$effect(() => {
@@ -692,7 +923,18 @@
 								</div>
 							{/snippet}
 							{#snippet detail()}
-								{#if b.occupiedBy}
+								{#if b.reusedFrom}
+									<span class="truncate text-secondary">
+										now uses <span class="font-mono">{b.reusedFrom}</span>
+									</span>
+									{#if b.stubKept}
+										<!-- Not a footnote: some items were not moved and still read this path,
+										     so the empty resource on it is a credential someone has to fill in. -->
+										<span class="truncate text-hint">
+											some items still read <span class="font-mono">{b.path}</span> — fill it in too
+										</span>
+									{/if}
+								{:else if b.occupiedBy}
 									<span class="truncate text-secondary">
 										a {resourceTypeDisplayName(b.occupiedBy)} resource already holds this path — the
 										project did not get this one
@@ -719,15 +961,16 @@
 									<span class="whitespace-nowrap text-2xs text-hint">
 										{b.occupiedBy ? 'Resolve in the workspace' : 'Check the workspace'}
 									</span>
+								{:else if b.reusedFrom && !b.stubKept}
+									<!-- No action either: this row is done with, whether its own path was
+									     deleted with the retarget or filled in afterwards. -->
+									<span class="whitespace-nowrap text-2xs text-hint">Reused</span>
 								{:else}
 									<Button
 										variant={b.done ? 'subtle' : 'accent'}
 										unifiedSize="sm"
 										disabled={working}
-										onClick={() =>
-											canConnect
-												? appConnect?.open(b.resourceType, b.path)
-												: resourceEditor?.initEdit(b.path)}
+										onClick={() => startFilling(b)}
 									>
 										{b.done ? 'Saved' : canConnect ? 'Connect' : 'Fill in'}
 									</Button>
@@ -757,15 +1000,17 @@
 				size="xs"
 			>
 				{#if missingTables.length > 0}
-					The tables {missingTables.length === 1 ? 'this data table holds' : 'these data tables hold'}
+					The tables {missingTables.length === 1
+						? 'this data table holds'
+						: 'these data tables hold'}
 					do not exist, and the project's apps and flows read them. Every one of those fails as soon
 					as it opens.
 				{/if}
 				{#if uncheckedTables.length > 0}
 					{#if missingTables.length > 0}<br /><br />{/if}
 					{uncheckedTables.length === 1 ? 'One data table is' : 'Some data tables are'} set up, but
-					{uncheckedTables.length === 1 ? 'its' : 'their'} schema could not be read, so whether the
-					project's tables are there is unknown. Check again once the database is reachable.
+					{uncheckedTables.length === 1 ? 'its' : 'their'} schema could not be read, so whether the project's
+					tables are there is unknown. Check again once the database is reachable.
 				{/if}
 			</Alert>
 		{:else}
@@ -859,3 +1104,55 @@
 <!-- `on:refresh` fires once the connection has been written into the stub — the same moment
      a save is — so the rows settle the same way either route was taken. -->
 <AppConnectDrawer bind:this={appConnect} {workspace} on:refresh={() => void refreshBlanks()} />
+
+<!-- What "Fill in" opens when the workspace already has a resource of the row's type.
+     Portalled to the body for the reason the confirmation above is: this step renders inside
+     the wizard page's CenteredModal, which is its own stacking context. -->
+<Modal2
+	title={choosing ? `Set up ${resourceTypeDisplayName(choosing.resourceType)}` : ''}
+	target="body"
+	fixedWidth="xs"
+	fixedHeight="adaptive"
+	formStyling
+	closeOnOutsideClick={!reusing}
+	bind:isOpen={
+		() => choosing !== undefined,
+		(v) => {
+			if (!v && !reusing) choosing = undefined
+		}
+	}
+>
+	{#if choosing}
+		{@const forRow = choosing}
+		{@const existing = candidates[forRow.resourceType] ?? []}
+		<div class="flex w-full flex-col gap-4 text-xs">
+			<p class="text-secondary">
+				This workspace already has {existing.length}
+				{resourceTypeDisplayName(forRow.resourceType)}
+				{existing.length === 1 ? 'resource' : 'resources'}. Use one and this project's apps, flows
+				and triggers are pointed at it.
+			</p>
+			<Select
+				bind:value={chosenPath}
+				items={existing.map((p) => ({ value: p, label: p }))}
+				placeholder="Pick a resource"
+				disabled={reusing}
+				clearable
+				class="w-full"
+			/>
+			<div class="flex items-center justify-between gap-2">
+				<Button variant="subtle" unifiedSize="sm" disabled={reusing} onClick={fillNewInstead}>
+					{canConnectType(forRow.resourceType) ? 'Connect a new one' : 'Fill in a new one'}
+				</Button>
+				<Button
+					variant="accent"
+					unifiedSize="sm"
+					disabled={!chosenPath || reusing}
+					onClick={() => void reuseChosen()}
+				>
+					{reusing ? 'Pointing the project at it…' : 'Use this resource'}
+				</Button>
+			</div>
+		</div>
+	{/if}
+</Modal2>
diff --git a/frontend/src/lib/components/InputTransformForm.svelte b/frontend/src/lib/components/InputTransformForm.svelte
index d766c06603..c5ae65eda2 100644
--- a/frontend/src/lib/components/InputTransformForm.svelte
+++ b/frontend/src/lib/components/InputTransformForm.svelte
@@ -53,6 +53,13 @@
 		label?: string
 		/** Replaces the label header, so a setting's own toggle can name the field. */
 		header?: Snippet
+		/** Renders after the label: a button to unset the field, a badge. */
+		labelExtra?: Snippet
+		/** Drop the schema's description paragraph, for a form that carries it in a tooltip. */
+		hideDescription?: boolean
+		/** Keep the connect and transform controls out of the way until the row is reached, unless
+		 *  the field already holds something the controls are needed to read. */
+		subtleControls?: boolean
 		/** The kind this field always holds, for a value that doesn't carry a `type` of its
 		 *  own — a flow predicate is stored as a bare `{ expr }`. */
 		argType?: InputTransform['type']
@@ -76,6 +83,14 @@
 		/** Hide the static/expression switch, for a field that only ever holds one kind.
 		 *  The connect button and the AI helper stay. */
 		noDynamicToggle?: boolean
+		/** Hide the connect button, for a surface with nothing to connect to. Distinct from
+		 *  `noDynamicToggle`, which a field forced to an expression also sets. */
+		noConnect?: boolean
+		/** Drop the expression option, and every affordance that writes one: an expression reaching
+		 *  such a field is stored and deployed like any other, whichever control put it there. The
+		 *  rest of the switch stays, so a field can still be AI-filled or static. A field already
+		 *  holding an expression keeps the option, or it could not be switched off it. */
+		noJavascript?: boolean
 		/** Replaces the default StepInputGen, for a field with its own AI helper. That
 		 *  helper drives `suggestion` (its ghost text) and `aiOnKeyUp` (Tab to accept),
 		 *  which the built-in one reaches through `stepInputGen` instead. */
@@ -104,6 +119,9 @@
 		argName = $bindable(),
 		label = undefined,
 		header = undefined,
+		labelExtra = undefined,
+		hideDescription = false,
+		subtleControls = false,
 		argType = undefined,
 		collapsed = false,
 		animateAppear = false,
@@ -118,6 +136,8 @@
 		variableEditor = undefined,
 		itemPicker = undefined,
 		noDynamicToggle = false,
+		noConnect = false,
+		noJavascript = false,
 		aiGen = undefined,
 		suggestion = $bindable(),
 		focused = $bindable(),
@@ -183,6 +203,11 @@
 		allowedAiTransforms === undefined || allowedAiTransforms.includes(argName)
 	)
 
+	// A `${}` field is static text that interpolates JavaScript, so it is only on offer where
+	// expressions are. Elsewhere the same field is plain static: labelled `static`, edited in the
+	// ordinary input, with no `${...}` hint promising an escape hatch that isn't there.
+	let staticTemplateOffered = $derived(isStaticTemplate(inputCat) && !noJavascript)
+
 	// `argType` wins over whatever the value carries: a predicate has no `type` field, so
 	// inferring would land it on the static input instead of the expression editor.
 	const argKind = $derived(argType ?? arg?.type)
@@ -250,7 +275,11 @@
 			return
 		}
 
-		if (isCodeInjection(rawValue)) {
+		// `${...}` becomes a JavaScript transform, so it is only read as one where such a transform
+		// can be stored — the same condition `staticTemplateOffered` renders under. Elsewhere the
+		// text stays what was typed, rather than turning into code the store then drops or, worse,
+		// keeps pointing at a flow context this value will never be evaluated in.
+		if (isCodeInjection(rawValue) && !noJavascript) {
 			arg.expr = getDefaultExpr(
 				argName,
 				previousModuleId,
@@ -273,7 +302,12 @@
 
 	let codeInjectionDetected = $state(false)
 
-	function checkCodeInjection(rawValue: string) {
+	// A static value is whatever JSON the field holds, so it need not be a string, and the caller
+	// runs inside an effect: throwing here would take the whole form down rather than one field.
+	function checkCodeInjection(rawValue: unknown): { word: string; value: string }[] | undefined {
+		if (typeof rawValue !== 'string') {
+			return undefined
+		}
 		if (!arg || !rawValue || rawValue.length < 3 || !dynamicTemplateRegexPairs) {
 			return undefined
 		}
@@ -307,6 +341,7 @@
 			isStaticTemplate(inputCat) &&
 			propertyType == 'static' &&
 			!noDynamicToggle &&
+			!noJavascript &&
 			codeInjectionDetected
 		) {
 			setJavaScriptExpr(arg.value)
@@ -561,8 +596,16 @@
 		untrack(() => handleFieldVisibility(schema, arg, otherArgs))
 	})
 	let connecting = $derived($propPickerConfig?.propName == argName)
+	let fieldDescription = $derived(
+		hideDescription ? undefined : schema?.properties?.[argName]?.description
+	)
+	// Fading the controls away is only safe while the row itself says what it holds. An expression
+	// or an AI-filled value is only legible from the toggle, so those keep it on screen.
+	let controlsPinned = $derived(connecting || propertyType !== 'static' || Boolean(suggestion))
+	// Its picker builds an expression, so it goes with the expression option.
 	let shouldShowS3ArrayHelper = $derived(
 		inputCat === 'list' &&
+			!noJavascript &&
 			['s3object', 's3_object'].includes(schema?.properties?.[argName]?.items?.resourceType)
 	)
 
@@ -600,7 +643,9 @@
 						type={schema.properties?.[argName]?.type}
 					/>
 
-					{#if isStaticTemplate(inputCat)}
+					{@render labelExtra?.()}
+
+					{#if staticTemplateOffered}
 						<div>
 							<span
 								class="border text-gray-400 dark:text-gray-500 text-2xs font-medium mr-2 px-1 !py-[1px] rounded ml-2.5 {propertyType ==
@@ -616,13 +661,17 @@
 			</div>
 			<!-- Nothing to connect to or switch while collapsed: there is no value yet. -->
 			<div
-				class="flex flex-row items-end gap-x-2 z-10 absolute right-0 bottom-0 group-hover:bg-surface transition-colors {collapsed
-					? 'hidden'
-					: ''}"
+				class={twMerge(
+					'flex flex-row items-end gap-x-2 z-10 absolute right-0 bottom-0 group-hover:bg-surface transition-colors',
+					collapsed ? 'hidden' : '',
+					subtleControls && !controlsPinned
+						? 'opacity-0 group-hover:opacity-100 group-focus-within:opacity-100 transition-opacity'
+						: ''
+				)}
 			>
 				{#if aiGen}
 					{@render aiGen()}
-				{:else if enableAi}
+				{:else if enableAi && !noJavascript}
 					<StepInputGen
 						bind:this={stepInputGen}
 						{focused}
@@ -639,7 +688,7 @@
 					/>
 				{/if}
 
-				{#if propPickerWrapperContext}
+				{#if propPickerWrapperContext && !noConnect}
 					<FlowPlugConnect
 						wrapperClasses={twMerge(
 							'group-hover:opacity-100 transition-opacity',
@@ -704,6 +753,11 @@
 										if (arg) {
 											arg.value = codeToStaticTemplate(arg.expr)
 											arg.expr = undefined
+											// Stated here, as the other branches state it. `setPropertyType`
+											// only writes a type when the text is an interpolation, so leaving
+											// it to that call means a field switched off `ai` keeps carrying
+											// `ai` and reads straight back as it on the next render.
+											arg.type = 'static'
 										}
 										setPropertyType(arg?.value)
 									} else if (inputCat == 'list' || inputCat == 'object') {
@@ -727,22 +781,33 @@
 											arg.expr = undefined
 										}
 									}
+									// On a field the agent can fill, "static with no value" is itself the
+									// AI state (see `getPropertyType`), so leaving the value unset reads
+									// this choice straight back as AI and the field can never be typed
+									// into. An empty value of the field's own kind is what makes "I will
+									// supply this one" representable.
+									if (fieldAllowsAi && arg && arg.value === undefined) {
+										arg.value = isStaticTemplate(inputCat) ? '' : null
+									}
 									propertyType = 'static'
 								}
 							}}
 						>
 							{#snippet children({ item })}
 								{#if fieldAllowsAi}
+									<!-- `h-full`, as its siblings have: the group is a row shorter than a `sm`
+									     button, and without it this one stands proud of the others. -->
 									<ToggleButton
-										small
+										size="sm"
 										label="AI"
 										value="ai"
 										tooltip="Let the AI agent fill this field dynamically"
 										{item}
+										class="h-full text-xs"
 									/>
 								{/if}
 
-								{#if isStaticTemplate(inputCat)}
+								{#if staticTemplateOffered}
 									<ToggleButton
 										size="sm"
 										tooltip={`Write text or surround javascript with \`\$\{\` and \`\}\`. Use \`results\` to connect to another node\'s output.`}
@@ -761,7 +826,9 @@
 									/>
 								{/if}
 
-								{#if codeInjectionDetected && propertyType == 'static'}
+								{#if noJavascript && propertyType !== 'javascript'}
+									<!-- nothing: the expression option is not offered here -->
+								{:else if codeInjectionDetected && propertyType == 'static'}
 									<Button
 										size="xs2"
 										color="light"
@@ -847,19 +914,19 @@
 										This field will be filled by the AI agent dynamically
 									</span>
 								</div>
-								{#if argName && schema?.properties?.[argName]?.description}
+								{#if fieldDescription}
 									<div class="text-xs italic py-1 text-hint">
 										<pre class="font-main whitespace-normal">
-										{schema.properties[argName].description}
+										{fieldDescription}
 									</pre>
 									</div>
 								{/if}
-							{:else if isStaticTemplate(inputCat) && propertyType == 'static' && !noDynamicToggle}
+							{:else if staticTemplateOffered && propertyType == 'static' && !noDynamicToggle}
 								<div class="flex flex-col gap-1">
-									{#if argName && schema?.properties?.[argName]?.description}
+									{#if fieldDescription}
 										<div class="text-xs text-secondary">
 											<pre class="font-main whitespace-normal">
-										{schema.properties[argName].description}
+										{fieldDescription}
 										</pre>
 										</div>
 									{/if}
@@ -868,6 +935,8 @@
 										<TemplateEditor
 											bind:this={monacoTemplate}
 											{extraLib}
+											minRows={schema?.properties?.[argName]?.minRows}
+											placeholder={schema?.properties?.[argName]?.placeholder}
 											on:focus={onFocus}
 											on:blur={() => {
 												focused = false
@@ -898,7 +967,13 @@
 									}}
 									label={argName}
 									bind:editor={monaco}
-									bind:description={schema.properties[argName].description}
+									bind:description={
+										() => fieldDescription,
+										(v) => {
+											const property = schema.properties?.[argName]
+											if (!hideDescription && property) property.description = v
+										}
+									}
 									bind:value={arg.value}
 									type={schema.properties[argName].type}
 									oneOf={schema.properties[argName].oneOf}
@@ -995,11 +1070,9 @@
 									/>
 								{/if}
 
-								{#if argName && schema?.properties?.[argName]?.description}
+								{#if fieldDescription}
 									<div class="text-xs italic py-1 text-secondary">
-										<pre class="font-main whitespace-normal"
-											>{schema.properties[argName].description}</pre
-										>
+										<pre class="font-main whitespace-normal">{fieldDescription}</pre>
 									</div>
 								{/if}
 
diff --git a/frontend/src/lib/components/InputTransformPickers.svelte b/frontend/src/lib/components/InputTransformPickers.svelte
new file mode 100644
index 0000000000..199039fb67
--- /dev/null
+++ b/frontend/src/lib/components/InputTransformPickers.svelte
@@ -0,0 +1,68 @@
+<script lang="ts">
+	import { VariableService } from '$lib/gen'
+	import { workspaceStore } from '$lib/stores'
+	import { watch } from 'runed'
+	import { Plus } from 'lucide-svelte'
+	import { Button } from './common'
+	import ItemPicker from './ItemPicker.svelte'
+	import VariableEditor from './VariableEditor.svelte'
+
+	interface Props {
+		/** The transforms being edited. A picked variable is written into `pickForField`'s. */
+		args?: Record<string, any>
+		/** Which field the open picker is picking for, set by whichever row opened it. */
+		pickForField?: string | undefined
+		workspace?: string | undefined
+		/** Handed back so every field's form can open them. */
+		itemPicker?: ItemPicker | undefined
+		variableEditor?: VariableEditor | undefined
+	}
+
+	let {
+		args = {},
+		pickForField = undefined,
+		workspace = undefined,
+		itemPicker = $bindable(),
+		variableEditor = $bindable()
+	}: Props = $props()
+
+	let ws = $derived(workspace ?? $workspaceStore)
+
+	watch(
+		() => ws,
+		() => itemPicker?.reloadItems()
+	)
+</script>
+
+<ItemPicker
+	bind:this={itemPicker}
+	pickCallback={(path, _) => {
+		if (pickForField) {
+			args[pickForField].value = '$var:' + path
+		}
+	}}
+	itemName="Variable"
+	extraField="path"
+	loadItems={async () =>
+		(await VariableService.listVariable({ workspace: ws ?? '' })).map((x) => ({
+			name: x.path,
+			...x
+		}))}
+>
+	{#snippet submission()}
+		<div class="flex flex-row-reverse w-full border-t border-gray-200 rounded-bl-lg rounded-br-lg">
+			<Button
+				variant="accent"
+				unifiedSize="sm"
+				startIcon={{ icon: Plus }}
+				on:click={() => {
+					variableEditor?.initNew?.()
+				}}
+			>
+				New variable
+			</Button>
+		</div>
+	{/snippet}
+</ItemPicker>
+
+<VariableEditor bind:this={variableEditor} workspace={ws} />
diff --git a/frontend/src/lib/components/InputTransformSchemaForm.svelte b/frontend/src/lib/components/InputTransformSchemaForm.svelte
index d0d29b3111..465e173f1f 100644
--- a/frontend/src/lib/components/InputTransformSchemaForm.svelte
+++ b/frontend/src/lib/components/InputTransformSchemaForm.svelte
@@ -1,17 +1,16 @@
 <script lang="ts">
 	import type { Schema } from '$lib/common'
-	import { CancelError, VariableService, WorkspaceService, type InputTransform } from '$lib/gen'
+	import { type InputTransform } from '$lib/gen'
 	import { workspaceStore } from '$lib/stores'
 	import { allTrue, type DynamicInput as DynamicInputTypes } from '$lib/utils'
 	import { untrack } from 'svelte'
-	import { resource, watch } from 'runed'
-	import { Button } from './common'
 	import StepInputsGen from './copilot/StepInputsGen.svelte'
 	import type { PickableProperties } from './flows/previousResults'
 	import InputTransformForm from './InputTransformForm.svelte'
-	import ItemPicker from './ItemPicker.svelte'
-	import VariableEditor from './VariableEditor.svelte'
-	import { Plus } from 'lucide-svelte'
+	import InputTransformPickers from './InputTransformPickers.svelte'
+	import { useS3StorageConfigured } from './inputTransformEnv.svelte'
+	import type ItemPicker from './ItemPicker.svelte'
+	import type VariableEditor from './VariableEditor.svelte'
 	import ResizeTransitionWrapper from './common/ResizeTransitionWrapper.svelte'
 
 	interface Props {
@@ -22,6 +21,9 @@
 		previousModuleId?: string | undefined
 		filter?: string[] | undefined
 		noDynamicToggle?: boolean
+		/** Passed to every field. See `InputTransformForm` for what each one drops. */
+		noConnect?: boolean
+		noJavascript?: boolean
 		pickableProperties?: PickableProperties | undefined
 		enableAi?: boolean
 		class?: string
@@ -40,6 +42,8 @@
 		previousModuleId = undefined,
 		filter = undefined,
 		noDynamicToggle = false,
+		noConnect = false,
+		noJavascript = false,
 		pickableProperties = undefined,
 		enableAi = false,
 		class: clazz = '',
@@ -82,37 +86,7 @@
 	let itemPicker: ItemPicker | undefined = $state(undefined)
 	let variableEditor: VariableEditor | undefined = $state(undefined)
 
-	const settings = resource(
-		() => ws,
-		async (ws, _previousWs, { onCleanup }) => {
-			if (!ws) return undefined
-			const req = WorkspaceService.getPublicSettings({ workspace: ws })
-			// `resource` keeps whatever lands last: cancel a superseded request so a slow
-			// reply for a workspace we have left cannot overwrite the current one.
-			onCleanup(() => req.cancel())
-			try {
-				return { ws, settings: await req }
-			} catch (err) {
-				if (!(err instanceof CancelError)) {
-					console.error('Failed to fetch workspace settings:', err)
-				}
-				return undefined
-			}
-		}
-	)
-	// Assume configured until this workspace's own answer lands: the warning must not
-	// linger from the previous workspace, nor appear merely because the fetch failed.
-	let s3StorageConfigured = $derived.by(() => {
-		const loaded = settings.current
-		return loaded && loaded.ws === ws
-			? loaded.settings.large_file_storage?.s3_resource_path !== undefined
-			: true
-	})
-
-	watch(
-		() => ws,
-		() => itemPicker?.reloadItems()
-	)
+	const s3Storage = useS3StorageConfigured(() => ws)
 
 	let keys: string[] = $state([])
 	$effect(() => {
@@ -125,7 +99,10 @@
 </script>
 
 <div class="w-full mb-6 {clazz}">
-	{#if enableAi}
+	<!-- Not offered on a tool: the fields it fills are exactly the ones left empty for the agent
+	     to fill at run time, and filling one rewrites it into an expression, which takes it out of
+	     the schema the model is given. -->
+	{#if enableAi && !isAgentTool}
 		<div class="pt-2">
 			<StepInputsGen
 				{pickableProperties}
@@ -160,12 +137,14 @@
 						{itemPicker}
 						bind:pickForField
 						{noDynamicToggle}
+						{noConnect}
+						{noJavascript}
 						{pickableProperties}
 						{enableAi}
 						{helperScript}
 						{isAgentTool}
 						{allowedAiTransforms}
-						{s3StorageConfigured}
+						s3StorageConfigured={s3Storage.current}
 						{chatInputEnabled}
 						{workspace}
 						otherArgs={Object.fromEntries(
@@ -180,35 +159,4 @@
 	{/if}
 </div>
 
-<ItemPicker
-	bind:this={itemPicker}
-	pickCallback={(path, _) => {
-		if (pickForField) {
-			args[pickForField].value = '$var:' + path
-		}
-	}}
-	itemName="Variable"
-	extraField="path"
-	loadItems={async () =>
-		(await VariableService.listVariable({ workspace: ws ?? '' })).map((x) => ({
-			name: x.path,
-			...x
-		}))}
->
-	{#snippet submission()}
-		<div class="flex flex-row-reverse w-full border-t border-gray-200 rounded-bl-lg rounded-br-lg">
-			<Button
-				variant="accent"
-				size="sm"
-				startIcon={{ icon: Plus }}
-				on:click={() => {
-					variableEditor?.initNew?.()
-				}}
-			>
-				New variable
-			</Button>
-		</div>
-	{/snippet}
-</ItemPicker>
-
-<VariableEditor bind:this={variableEditor} workspace={ws} />
+<InputTransformPickers {args} {pickForField} {workspace} bind:itemPicker bind:variableEditor />
diff --git a/frontend/src/lib/components/InstanceSetting.svelte b/frontend/src/lib/components/InstanceSetting.svelte
index a85ea0a575..19b5ddb533 100644
--- a/frontend/src/lib/components/InstanceSetting.svelte
+++ b/frontend/src/lib/components/InstanceSetting.svelte
@@ -846,9 +846,7 @@
 				{:else if setting.fieldType == 'seconds'}
 					<div>
 						<SecondsInput
-							max={setting.ee_only != undefined && !$enterpriseLicense
-								? 60 * 60 * 24 * 30
-								: undefined}
+							max={!$enterpriseLicense ? setting.ceMaxSeconds : undefined}
 							bind:seconds={$values[setting.key]}
 							clearable
 						/>
diff --git a/frontend/src/lib/components/InstanceSettings.svelte b/frontend/src/lib/components/InstanceSettings.svelte
index ce5323fe2b..b321e76693 100644
--- a/frontend/src/lib/components/InstanceSettings.svelte
+++ b/frontend/src/lib/components/InstanceSettings.svelte
@@ -1071,8 +1071,9 @@
 							>feature usage (counts of which product features are used, including AI provider and
 							model identifiers, the names of public hub scripts used, the languages debug sessions
 							are started for, whether AI chat skills are turned on or off and how often one is
-							loaded, and the plan tier and quota shown when the execution meter is opened, last 30
-							days)</li
+							loaded, whether SSO logins evaluate an IdP groups claim (SAML or OIDC) and change a
+							membership, and the plan tier and quota shown when the execution meter is opened, last
+							30 days)</li
 						>
 						<li
 							>feature adoption (counts of which flow, script, trigger and worker features your
@@ -1125,8 +1126,9 @@
 							>feature usage (counts of which product features are used, including AI provider and
 							model identifiers, the names of public hub scripts used, the languages debug sessions
 							are started for, whether AI chat skills are turned on or off and how often one is
-							loaded, and the plan tier and quota shown when the execution meter is opened, last 30
-							days)</li
+							loaded, whether SSO logins evaluate an IdP groups claim (SAML or OIDC) and change a
+							membership, and the plan tier and quota shown when the execution meter is opened, last
+							30 days)</li
 						>
 						<li
 							>feature adoption (counts of which flow, script, trigger and worker features your
diff --git a/frontend/src/lib/components/LabelsInput.svelte b/frontend/src/lib/components/LabelsInput.svelte
index 933fe38ea1..c7eda30d66 100644
--- a/frontend/src/lib/components/LabelsInput.svelte
+++ b/frontend/src/lib/components/LabelsInput.svelte
@@ -8,9 +8,22 @@
 		labels: string[] | undefined
 		onchange?: () => void
 		class?: string
+		/** Suggest the labels of this workspace rather than the active one, for an editor
+		 * aimed elsewhere (the folder drawer opened from a cross-workspace picker). */
+		workspace?: string
+		/** Text typed into the input but not yet added to `labels`. An editor with a Save
+		 * button needs it: without it that text is invisible to the editor's dirty state,
+		 * so it is silently dropped on close and cannot even enable Save on its own. */
+		onPendingChange?: (pending: string) => void
 	}
 
-	let { labels = $bindable(), onchange, class: clazz = '' }: Props = $props()
+	let {
+		labels = $bindable(),
+		onchange,
+		class: clazz = '',
+		workspace,
+		onPendingChange
+	}: Props = $props()
 
 	let adding = $state(false)
 	let inputValue = $state('')
@@ -34,9 +47,13 @@
 			!(labels ?? []).includes(trimmedInput)
 	)
 
+	$effect(() => {
+		onPendingChange?.(adding ? trimmedInput : '')
+	})
+
 	async function loadExistingLabels() {
 		try {
-			const resp = await fetch(`/api/w/${$workspaceStore}/labels/list`)
+			const resp = await fetch(`/api/w/${workspace ?? $workspaceStore}/labels/list`)
 			if (resp.ok) existingLabels = await resp.json()
 		} catch {}
 	}
@@ -82,8 +99,15 @@
 				addLabel() // either "Create new" selected or free text
 			}
 		} else if (e.key === 'Escape') {
+			// Escape cancels the label, and nothing else. Left to bubble it also reaches
+			// whatever encloses us — a drawer or dialog closes on it, and one guarding on
+			// unsaved changes reads `pending` before this clears it, so it prompts to
+			// discard work this key just discarded.
+			e.preventDefault()
+			e.stopPropagation()
 			inputValue = ''
 			adding = false
+			onPendingChange?.('')
 		} else if (e.key === 'ArrowDown') {
 			e.preventDefault()
 			const maxIdx = suggestions.length + (showCreateNew ? 1 : 0) - 1
@@ -100,6 +124,14 @@
 			if (adding) addLabel()
 		}, 150)
 	}
+
+	/** Add whatever is typed but not yet committed, right now. Blur commits on a 150ms
+	 *  grace period, so a caller that reads `labels` in the same tick as the blur — a Save
+	 *  button, which blurs this input by being clicked — would miss the last label.
+	 *  `adding` is cleared here, so the pending timer then finds nothing to do. */
+	export function flushPendingLabel(): void {
+		if (adding) addLabel()
+	}
 </script>
 
 <div class="inline-flex items-center gap-1 ml-0.5 h-5 {clazz}">
diff --git a/frontend/src/lib/components/ModulePreviewForm.svelte b/frontend/src/lib/components/ModulePreviewForm.svelte
index 88b99a05c5..72bb9fe36b 100644
--- a/frontend/src/lib/components/ModulePreviewForm.svelte
+++ b/frontend/src/lib/components/ModulePreviewForm.svelte
@@ -14,6 +14,7 @@
 	import { getResourceTypes } from './resourceTypesStore'
 	import { twMerge } from 'tailwind-merge'
 	import { workspaceStore } from '$lib/stores'
+	import { AGENT_FIELDS, initialVisibleAgentFields } from './flows/agentFormFields'
 
 	interface Props {
 		schema: Schema | { properties?: Record<string, any>; required?: string[] }
@@ -43,15 +44,45 @@
 		isValid = allTrue(inputCheck) ?? false
 	})
 
+	/** An agent asks for the same fields here that its own form shows: a setting the step leaves
+	 *  unset is not something a run needs told, and listing all eleven buries the message under the
+	 *  configuration. What the step configures stays, as it does on any other step. A schema key the
+	 *  field registry doesn't know is kept, so a new one is never silently dropped. A run input is
+	 *  kept whatever the step holds: this form has no add-field control, so hiding one would leave
+	 *  no way at all to supply it. */
+	let schemaKeys = $derived(Object.keys(schema?.properties ?? {}))
+
+	let visibleKeys = $derived.by(() => {
+		const all = schemaKeys
+		if ((mod.value as { type?: string })?.type !== 'aiagent') return all
+		const transforms = (mod.value as { input_transforms?: Record<string, unknown> })
+			?.input_transforms
+		const visible = initialVisibleAgentFields(transforms, schema?.properties)
+		const known = new Set(AGENT_FIELDS.filter((f) => !f.runInput).map((f) => f.key))
+		return all.filter((key) => !known.has(key) || visible.has(key))
+	})
+
 	let keys: string[] = $state([])
 	$effect(() => {
-		let lkeys = Object.keys(schema?.properties ?? {})
+		let lkeys = visibleKeys
 		if (schema?.properties && JSON.stringify(lkeys) != JSON.stringify(keys)) {
 			keys = lkeys
-			untrack(() => stepsInputArgs?.removeExtraKey(mod.id, keys))
+			// Pruned against the schema rather than against what is shown. What a run was given for a
+			// field lives only here, so dropping it when the field merely stops being displayed would
+			// discard it: an agent hides the settings its step leaves unset, and clearing one in the
+			// Inputs tab hides it.
+			untrack(() => stepsInputArgs?.removeExtraKey(mod.id, schemaKeys))
 		}
 	})
 
+	/** Whether re-evaluating has anything to restore. A field the step configures nothing for
+	 *  evaluates to blank, so the control would only clear what was typed to run with. */
+	function hasConfiguredInput(argName: string): boolean {
+		const transform = (mod.value as any)?.input_transforms?.[argName]
+		if (!transform) return false
+		return transform.type === 'javascript' ? !!transform.expr : transform.value !== undefined
+	}
+
 	function plugIt(argName: string) {
 		stepsInputArgs?.setEvaluatedStepArg(
 			mod.id,
@@ -158,7 +189,7 @@
 								workspace={opWs}
 							>
 								{#snippet fieldHeaderActions()}
-									{#if stepsInputArgs?.isArgManuallySet(mod.id, argName)}
+									{#if stepsInputArgs?.isArgManuallySet(mod.id, argName) && hasConfiguredInput(argName)}
 										<Button
 											on:click={() => {
 												plugIt(argName)
diff --git a/frontend/src/lib/components/ModuleTest.svelte b/frontend/src/lib/components/ModuleTest.svelte
index 50e915a4cb..b4e82ced2f 100644
--- a/frontend/src/lib/components/ModuleTest.svelte
+++ b/frontend/src/lib/components/ModuleTest.svelte
@@ -3,6 +3,7 @@
 		ScriptService,
 		type AiAgent,
 		type FlowModule,
+		type InputTransform,
 		type JavascriptTransform,
 		type Job
 	} from '$lib/gen'
@@ -43,6 +44,8 @@
 		opWorkspace
 	} = getContext<FlowEditorContext>('FlowEditorContext')
 
+	let previewBase = $derived($pathStore ?? '')
+
 	// Acting workspace when the flow editor runs in an AI session; else the nav workspace.
 	let opWs = $derived(opWorkspace?.() ?? $workspaceStore)
 
@@ -96,7 +99,10 @@
 		}
 		if (val.type == 'rawscript') {
 			await jobLoader?.runPreview(
-				val.path ?? ($pathStore ?? '') + '/' + mod.id,
+				// An empty base stays empty: `'' + '/' + id` is an absolute path, which
+				// `require_path_read_access_for_preview` rejects outright. A flow with no path yet
+				// previews unnamed instead.
+				val.path ?? (previewBase ? previewBase + '/' + mod.id : ''),
 				val.content,
 				val.language,
 				mod.id === 'preprocessor' ? { _ENTRYPOINT_OVERRIDE: 'preprocessor', ...args } : args,
@@ -104,7 +110,7 @@
 				undefined,
 				undefined,
 				callbacks,
-				$pathStore,
+				previewBase,
 				undefined,
 				devTempScriptRefs?.(),
 				timeout
@@ -122,7 +128,7 @@
 				script.lock,
 				val.hash ?? script.hash,
 				callbacks,
-				$pathStore,
+				previewBase,
 				undefined,
 				undefined,
 				timeout
@@ -132,18 +138,28 @@
 		} else if (val.type == 'aiagent') {
 			const { schema } = await loadSchemaFromModule(mod, opWs)
 
-			const inputTransforms: { [key: string]: JavascriptTransform } = Object.fromEntries(
-				Object.keys(args).map((key) => [
-					key,
-					{
-						expr: `flow_input.${key}`,
-						type: 'javascript'
-					}
-				])
-			)
-
 			const agentVal = val
 
+			// The test form only covers the schema it was given, and for a standalone agent that may be
+			// the flow-local one (the agent editor shows the brain in its own form, not here). Take the
+			// brain from the module as authored and let the form's own keys win over it, so an edit made
+			// in the form after the test panel mounted is what runs. A linked agent needs none of this:
+			// the server reads its brain from the resource.
+			const inputTransforms: { [key: string]: JavascriptTransform | InputTransform } = {
+				...(agentVal.agent
+					? {}
+					: ((agentVal.input_transforms ?? {}) as Record<string, InputTransform>)),
+				...Object.fromEntries(
+					Object.keys(args).map((key) => [
+						key,
+						{
+							expr: `flow_input.${key}`,
+							type: 'javascript'
+						}
+					])
+				)
+			}
+
 			await jobLoader?.runFlowPreview(
 				args,
 				{
@@ -168,7 +184,7 @@
 					schema
 				},
 				callbacks,
-				$pathStore
+				previewBase
 			)
 		} else {
 			throw Error('Not supported module type')
diff --git a/frontend/src/lib/components/OauthScopes.svelte b/frontend/src/lib/components/OauthScopes.svelte
index 4ec17c6e2a..b9018bfe3b 100644
--- a/frontend/src/lib/components/OauthScopes.svelte
+++ b/frontend/src/lib/components/OauthScopes.svelte
@@ -1,51 +1,114 @@
 <script lang="ts">
 	import { Button } from './common'
+	import TextInput from './text_input/TextInput.svelte'
+	import Checkbox from './common/checkbox/Checkbox.svelte'
 	import { Minus, Plus } from 'lucide-svelte'
 
 	interface Props {
 		scopes?: string[]
+		/** Scopes the provider is known to accept, offered as checkboxes. Anything
+		 * not in this list stays editable as free text below them. */
+		options?: string[]
 	}
 
-	let { scopes = $bindable() }: Props = $props()
+	let { scopes = $bindable(), options = [] }: Props = $props()
+
+	// Ticked options and free-text rows are kept apart from `scopes` (the only
+	// value the parent binds) so a row can pass through an option's exact value
+	// while typing (`…/calendar` on the way to `…/calendar.acls`) without ticking
+	// or unticking anything. `lastWritten` tells a parent-side reset apart from
+	// the echo of our own write.
+	let ticked: string[] = $state([])
+	let custom: string[] = $state([])
+	let lastWritten: string | undefined = undefined
 
 	$effect.pre(() => {
 		if (!scopes) {
 			scopes = []
 		}
+		const json = JSON.stringify([scopes, options])
+		if (json != lastWritten) {
+			lastWritten = json
+			ticked = scopes.filter((v) => options.includes(v))
+			custom = scopes.filter((v) => !options.includes(v))
+		}
 	})
+
+	function write(nextTicked: string[], rows: string[]) {
+		ticked = nextTicked
+		custom = rows
+		scopes = [...nextTicked.filter((o) => !rows.includes(o)), ...rows]
+		lastWritten = JSON.stringify([scopes, options])
+	}
+
+	// Ticking an option absorbs a free-text row holding the same value. The
+	// target state comes from `ticked`, not the DOM: `Checkbox` re-asserts its
+	// `checked` prop on every click, so the input already reads the old value
+	// again by the time `change` fires.
+	function toggle(option: string, on: boolean) {
+		const rest = ticked.filter((o) => o != option)
+		write(on ? [...rest, option] : rest, on ? custom.filter((r) => r != option) : custom)
+	}
+
+	function setRow(i: number, value: string) {
+		const rows = [...custom]
+		rows[i] = value
+		write(ticked, rows)
+	}
 </script>
 
-{#if scopes && Array.isArray(scopes)}
-	{#each scopes as v, i}
-		<div class="flex flex-row max-w-md mb-2">
-			<input type="text" bind:value={scopes[i]} />
-			<Button
-				variant="default"
-				size="xs"
-				btnClasses="mx-6"
-				on:click={() => {
-					scopes = scopes?.filter((el) => el != v)
-				}}
-				startIcon={{ icon: Minus }}
-				iconOnly
-			/>
-		</div>
-	{/each}
+{#if options.length > 0}
+	<div class="flex flex-col gap-1 mb-2">
+		{#each options as option (option)}
+			<label class="flex items-center gap-2 text-xs">
+				<Checkbox
+					checked={ticked.includes(option)}
+					onChange={() => toggle(option, !ticked.includes(option))}
+				/>
+				<span class="font-mono break-all">{option}</span>
+			</label>
+		{/each}
+	</div>
+	<span class="text-xs text-secondary">Custom scopes</span>
 {/if}
 
+{#each custom as v, i (i)}
+	<div class="flex flex-row max-w-md mb-2">
+		<TextInput
+			value={v}
+			size="sm"
+			inputProps={{ oninput: (e) => setRow(i, e.currentTarget.value) }}
+		/>
+		<Button
+			variant="default"
+			unifiedSize="sm"
+			btnClasses="mx-6"
+			onclick={() => {
+				write(
+					ticked,
+					custom.filter((_, j) => j != i)
+				)
+			}}
+			startIcon={{ icon: Minus }}
+			iconOnly
+		/>
+	</div>
+{/each}
+
 <div class="flex items-center mt-1">
 	<Button
 		variant="default"
-		hover="yo"
-		size="xs"
+		unifiedSize="sm"
 		startIcon={{ icon: Plus }}
-		on:click={() => {
-			scopes = (scopes ?? []).concat('')
+		onclick={() => {
+			write(ticked, [...custom, ''])
 		}}
 	>
 		Add item
 	</Button>
-	<span class="ml-2 text-xs text-primary font-normal">
-		({(scopes ?? []).length} item{(scopes ?? []).length > 1 ? 's' : ''})
-	</span>
+	{#if custom.length > 0}
+		<span class="ml-2 text-xs text-primary font-normal">
+			({custom.length} item{custom.length > 1 ? 's' : ''})
+		</span>
+	{/if}
 </div>
diff --git a/frontend/src/lib/components/ObjectStoreConfigSettings.svelte b/frontend/src/lib/components/ObjectStoreConfigSettings.svelte
index c7f7065565..14658a4228 100644
--- a/frontend/src/lib/components/ObjectStoreConfigSettings.svelte
+++ b/frontend/src/lib/components/ObjectStoreConfigSettings.svelte
@@ -305,6 +305,7 @@
 				resourceType="s3_bucket"
 				workspaceOverride="admins"
 				buttonTextOverride="Test from a worker"
+				viaWorker
 			/>
 		</div>
 
diff --git a/frontend/src/lib/components/ResourceEditor.svelte b/frontend/src/lib/components/ResourceEditor.svelte
index 367888655f..89acac79de 100644
--- a/frontend/src/lib/components/ResourceEditor.svelte
+++ b/frontend/src/lib/components/ResourceEditor.svelte
@@ -24,6 +24,9 @@
 		defaultValues?: Record<string, any> | undefined
 		workspace?: string | undefined
 		selected?: string | undefined
+		/** Show the value as JSON rather than as the resource type's form. Bindable so a caller can
+		 *  choose the view a given resource opens on, and the in-form toggle still works. */
+		viewJsonSchema?: boolean
 		/** Notifies the parent drawer whether a local draft for the selected
 		 * workspace diverges from the deployed baseline, so it can show the
 		 * "unsaved changes" banner below its header. */
@@ -43,6 +46,7 @@
 		defaultValues = undefined,
 		workspace = undefined,
 		selected: selectedProp = $bindable(),
+		viewJsonSchema = $bindable(),
 		onDraftStateChange,
 		onCanWriteChange
 	}: Props = $props()
@@ -106,7 +110,6 @@
 
 	let isValid = $state(true)
 	let jsonError = $state('')
-	let viewJsonSchema = $state(false)
 	let perWsValid: Record<string, boolean> = $state({})
 
 	const deployToResource = resource(
@@ -320,7 +323,9 @@
 		current.path = npath
 	}
 
-	export async function save(): Promise<void> {
+	/** Whether the write landed. It toasts its own failure, so most callers ignore this;
+	 * one that follows the save with bookkeeping of its own has to know not to. */
+	export async function save(): Promise<boolean> {
 		const dirty = dirtyWorkspaces
 		try {
 			for (const ws of dirty) {
@@ -368,8 +373,10 @@
 				dirty.length > 1 ? `Saved resource in ${dirty.length} workspaces` : `Saved resource`
 			)
 			dispatch('refresh', current?.path ?? path)
+			return true
 		} catch (err) {
 			sendUserToast(`Could not save resource: ${err.body ?? err.message}`, true)
+			return false
 		}
 	}
 </script>
@@ -391,7 +398,7 @@
 					bind:args={current.args}
 					bind:wsSpecific={current.wsSpecific}
 					bind:isValid
-					bind:viewJsonSchema
+					bind:viewJsonSchema={() => viewJsonSchema ?? false, (v) => (viewJsonSchema = v)}
 					bind:jsonError
 					{initialPath}
 					{hidePath}
diff --git a/frontend/src/lib/components/ResourceEditorDrawer.svelte b/frontend/src/lib/components/ResourceEditorDrawer.svelte
index 296ab693a8..6b54642379 100644
--- a/frontend/src/lib/components/ResourceEditorDrawer.svelte
+++ b/frontend/src/lib/components/ResourceEditorDrawer.svelte
@@ -52,6 +52,7 @@
 
 	let path: string | undefined = $state(undefined)
 	let selected: string | undefined = $state(undefined)
+	let viewJsonSchema = $state(false)
 
 	let effectiveWorkspace = $derived(workspace ?? $workspaceStore!)
 	// The editor renders whichever workspace-specific variant `selected` points at, so history has
@@ -65,10 +66,29 @@
 		historyWorkspace === $workspaceStore && isOwner(path ?? '', $userStore, $workspaceStore)
 	)
 
-	export async function initEdit(p: string): Promise<void> {
+	// A close reaches `on:close` on a later flush, by which point a caller that closed this drawer to
+	// open another editor has already anchored the new one. Clearing then would strip that anchor.
+	let keepAnchorOnClose = false
+
+	/** Shut this drawer without going through its own close button, for a caller opening the other
+	 *  editor over the same list. `keepAnchor` when that caller anchors what it opens instead. */
+	export function close(opts?: { keepAnchor?: boolean }): void {
+		keepAnchorOnClose = opts?.keepAnchor ?? false
+		drawer?.closeDrawer?.()
+	}
+
+	/** `json` opens on the JSON editor instead of the resource type's form. For a type with a
+	 *  dedicated editor elsewhere: the generic form would render its configuration field by field,
+	 *  and materialize a default into every one the value leaves out. */
+	export async function initEdit(p: string, opts?: { json?: boolean }): Promise<void> {
+		// A `close({ keepAnchor })` on an already-closed drawer emits no close event, so the flag
+		// would still be standing when the next drawer session ends and would swallow that one's
+		// anchor clear. Every session starts having to clear its own.
+		keepAnchorOnClose = false
 		resource_type = undefined
 		path = p
 		selected = effectiveWorkspace
+		viewJsonSchema = opts?.json ?? false
 		drawer?.openDrawer?.()
 		setPageDrawerAnchor(RESOURCES_PATH, p)
 	}
@@ -77,10 +97,15 @@
 		resourceType: string,
 		nDefaultValues?: Record<string, any>
 	): Promise<void> {
+		keepAnchorOnClose = false
 		path = undefined
 		resource_type = resourceType
 		defaultValues = nDefaultValues
 		selected = effectiveWorkspace
+		// This drawer outlives what it opens on, so the view has to be set by every entry point
+		// rather than left where the last one put it: a new resource is a typed form, whoever was
+		// looking at JSON before.
+		viewJsonSchema = false
 		drawer?.openDrawer?.()
 	}
 
@@ -97,7 +122,13 @@
 	bind:this={drawer}
 	size="50rem"
 	{disableChatOffset}
-	on:close={() => clearPageDrawerAnchor(RESOURCES_PATH)}
+	on:close={() => {
+		if (keepAnchorOnClose) {
+			keepAnchorOnClose = false
+			return
+		}
+		clearPageDrawerAnchor(RESOURCES_PATH)
+	}}
 >
 	<DrawerContent
 		title={mode == 'edit' ? 'Edit ' + path : addResourceTitle(resource_type)}
@@ -121,6 +152,7 @@
 				bind:this={resourceEditor}
 				bind:canSave
 				bind:selected
+				bind:viewJsonSchema
 				onDraftStateChange={(v) => (hasLocalDraft = v)}
 				onCanWriteChange={(v) => (canWriteSelected = v)}
 			/>
diff --git a/frontend/src/lib/components/ResourcePicker.svelte b/frontend/src/lib/components/ResourcePicker.svelte
index 8342bbecf6..06023b1bb4 100644
--- a/frontend/src/lib/components/ResourcePicker.svelte
+++ b/frontend/src/lib/components/ResourcePicker.svelte
@@ -33,6 +33,10 @@
 		datatableAsPgResource?: boolean
 		workspace?: string | undefined
 		disableChatOffset?: boolean
+		/** Fires when this picker sets a resource, with the type it carries, and with `undefined` on
+		 *  clear. Unlike an effect on `valueType` it never fires for the value the picker was opened
+		 *  on, but `selectFirst` choosing the only candidate during a load does count as setting one. */
+		onValueChange?: (path: string | undefined, type: string | undefined) => void
 	}
 
 	let {
@@ -54,7 +58,8 @@
 		excludedValues = undefined,
 		datatableAsPgResource = false,
 		workspace = undefined,
-		disableChatOffset = false
+		disableChatOffset = false,
+		onValueChange = undefined
 	}: Props = $props()
 
 	let effectiveWorkspace = $derived(workspace ?? $workspaceStore!)
@@ -155,6 +160,7 @@
 			if (collection.length == 1 && selectFirst && (value == undefined || value == '')) {
 				value = collection[0].value
 				valueType = collection[0].type
+				onValueChange?.(value, valueType)
 			}
 		} catch (e) {
 			sendUserToast('Failed to load resource types', true)
@@ -196,6 +202,7 @@
 		await loadResources(resourceType)
 		value = e.detail
 		valueType = collection.find((x) => x?.value == value)?.type
+		onValueChange?.(value, valueType)
 	}}
 	bind:this={appConnect}
 	{expressOAuthSetup}
@@ -211,6 +218,7 @@
 		if (e.detail) {
 			value = e.detail
 			valueType = collection.find((x) => x?.value == value)?.type
+			onValueChange?.(value, valueType)
 			// valueSelect = { value: e.detail, label: e.detail, type: valueType ?? '' }
 		}
 	}}
@@ -237,12 +245,14 @@
 				(v) => {
 					value = v
 					valueType = collection.find((x) => x?.value == v)?.type
+					onValueChange?.(value, valueType)
 				}
 			}
 			onClear={() => {
 				initialValue = undefined
 				value = undefined
 				valueType = undefined
+				onValueChange?.(undefined, undefined)
 				onClear?.()
 			}}
 			items={collection}
@@ -281,6 +291,7 @@
 				<div class="flex bg-surface border-t divide-x">
 					{#if resourceType?.includes(',')}
 						<DropdownV2
+							class="flex-1 justify-stretch"
 							enableFlyTransition
 							items={resourceType?.split(',').map((rt) => ({
 								displayName: `${rt} resource`,
@@ -294,7 +305,7 @@
 									color="light"
 									variant="contained"
 									wrapperClasses="flex-1"
-									btnClasses="rounded-none mt-0.5"
+									btnClasses="rounded-none"
 									size="sm"
 									startIcon={{ icon: Plus }}
 								>
diff --git a/frontend/src/lib/components/Section.svelte b/frontend/src/lib/components/Section.svelte
index f1425c51b7..badc7c9531 100644
--- a/frontend/src/lib/components/Section.svelte
+++ b/frontend/src/lib/components/Section.svelte
@@ -102,7 +102,7 @@
 			transition:slide={animate || collapsable ? { duration: 200 } : { duration: 0 }}
 		>
 			{#if description}
-				<div class="text-xs text-primary mt-1 mb-2">{@html description}</div>
+				<div class="text-xs text-secondary mt-1 mb-2">{@html description}</div>
 			{/if}
 			<div class={twMerge('flex flex-col gap-6 grow min-h-0', headless ? '' : 'mt-4')}>
 				<div class={twMerge('grow min-h-0', clazz)}>
diff --git a/frontend/src/lib/components/ShareModal.svelte b/frontend/src/lib/components/ShareModal.svelte
index 29da96cf98..471ed74099 100644
--- a/frontend/src/lib/components/ShareModal.svelte
+++ b/frontend/src/lib/components/ShareModal.svelte
@@ -252,7 +252,7 @@
 			{/if}
 			<div class="flex flex-col gap-2">
 				<span class="text-sm font-semibold text-emphasis"
-					>Extra permissions ({acls?.length ?? 0})</span
+					>Extra members ({acls?.length ?? 0})</span
 				>
 				{#if linkedVarPaths.length > 0}
 					<div class="flex flex-col gap-1.5 p-3 border rounded bg-surface-secondary text-xs">
@@ -299,7 +299,7 @@
 								size="lg"
 								variant="accent"
 								disabled={!newOwner}
-								on:click={() => addAcl(newOwner, write)}>Add permission</Button
+								on:click={() => addAcl(newOwner, write)}>Add member</Button
 							>
 						</div>
 					{/if}
@@ -307,7 +307,7 @@
 						<TableCustom>
 							{#snippet headerRow()}
 								<tr>
-									<th>owner</th>
+									<th>member</th>
 									<th></th>
 									<th></th>
 								</tr>
diff --git a/frontend/src/lib/components/SimpleEditor.svelte b/frontend/src/lib/components/SimpleEditor.svelte
index 65713e19f7..8133494f18 100644
--- a/frontend/src/lib/components/SimpleEditor.svelte
+++ b/frontend/src/lib/components/SimpleEditor.svelte
@@ -63,6 +63,10 @@
 	/** Trailing debounce window (ms) on Monaco's onDidChangeModelContent. */
 	const CHANGE_TIMEOUT = 200
 
+	/** Gap between the line numbers and the first character. Zero puts them flush,
+	 * so a two-digit line reads as one token with the code. */
+	const LINE_DECORATIONS_WIDTH = 6
+
 	let changeTimeoutId: number | undefined = undefined
 	// Monaco fires onDidChangeModelContent synchronously from within `setValue`, so without
 	// this an authoritative overwrite reads as a user edit on the `input` event.
@@ -112,7 +116,8 @@
 		minHeight = 1000,
 		renderLineHighlight = 'none',
 		suggestion,
-		leadingChangeSync = false
+		leadingChangeSync = false,
+		lineNumbersMinChars = 3
 	}: {
 		lang: string
 		code?: string
@@ -149,6 +154,9 @@
 		 * `code`; leave it off where each extra sync costs work downstream (an app
 		 * code input feeding an autoRefresh runnable re-runs a job per sync). */
 		leadingChangeSync?: boolean
+		/** Width of the line-number gutter, in characters. Same name, and same
+		 * default, as `Editor`, so the two render line numbers alike. */
+		lineNumbersMinChars?: number
 	} = $props()
 
 	let yPadding = MONACO_Y_PADDING
@@ -312,10 +320,12 @@
 			if (model.getLanguageId() !== lang) {
 				const currentCode = model.getValue()
 				const uri = `file:///${hash}.${langToExt(lang)}`
-				const oldModel = model
-				const newModel = meditor.createModel(currentCode, lang, mUri.parse(uri))
-				editor?.setModel(newModel)
-				oldModel.dispose()
+				// The old model goes first: `langToExt` maps anything it does not know to
+				// `unknown`, so the new uri is usually the one this model already holds,
+				// and creating over an occupied uri throws ("model already exists").
+				editor?.setModel(null)
+				model.dispose()
+				editor?.setModel(meditor.createModel(currentCode, lang, mUri.parse(uri)))
 			}
 
 			// Update editor options for suggestions, validation decorations, and line numbers
@@ -334,8 +344,8 @@
 					snippetsPreventQuickSuggestions: disableSuggestions
 				},
 				lineNumbers: hideLineNumbers ? 'off' : 'on',
-				lineDecorationsWidth: hideLineNumbers ? 0 : 6,
-				lineNumbersMinChars: hideLineNumbers ? 0 : 2,
+				lineDecorationsWidth: hideLineNumbers ? 0 : LINE_DECORATIONS_WIDTH,
+				lineNumbersMinChars: hideLineNumbers ? 0 : lineNumbersMinChars,
 				// Hide validation squiggles and decorations
 				renderValidationDecorations: disableLinting ? 'off' : 'on',
 				// Hide the validation margin indicators
@@ -397,8 +407,11 @@
 				...(yPadding !== undefined ? { padding: { bottom: yPadding, top: yPadding } } : {}),
 				readOnly,
 				renderLineHighlight,
-				lineDecorationsWidth: 0,
-				lineNumbersMinChars: 2,
+				// Same conditional as `updateModelAndOptions`: created correct rather than
+				// created wide and narrowed a tick later, which a caller hiding the gutter
+				// would see as a flash of indent.
+				lineDecorationsWidth: hideLineNumbers ? 0 : LINE_DECORATIONS_WIDTH,
+				lineNumbersMinChars: hideLineNumbers ? 0 : lineNumbersMinChars,
 				fontSize: fontSize,
 				quickSuggestions: disableSuggestions
 					? { other: false, comments: false, strings: false }
diff --git a/frontend/src/lib/components/TemplateEditor.svelte b/frontend/src/lib/components/TemplateEditor.svelte
index ea4407aecc..8fe119ce27 100644
--- a/frontend/src/lib/components/TemplateEditor.svelte
+++ b/frontend/src/lib/components/TemplateEditor.svelte
@@ -392,6 +392,10 @@
 		fontSize?: number
 		loadAsync?: boolean
 		class?: string | undefined
+		/** Height the editor opens at, in lines, for a field that expects more than a phrase. */
+		minRows?: number
+		/** Shown over the empty editor. Monaco has no placeholder of its own. */
+		placeholder?: string
 	}
 
 	let {
@@ -403,13 +407,25 @@
 		fixedOverflowWidgets = true,
 		fontSize,
 		loadAsync = false,
-		class: clazz = ''
+		class: clazz = '',
+		minRows = undefined,
+		placeholder = undefined
 	}: Props = $props()
 
 	let effectiveFontSize = $derived(fontSize ?? editorFontSize.regular)
 
 	let yPadding = MONACO_Y_PADDING
 
+	// Monaco derives an unset line height as 1.5x the font size, rounded. Reproducing it here lets
+	// the box stand at its final height before the editor exists, so opening a field does not jump.
+	let minHeightPx = $derived(
+		minRows ? minRows * Math.round(1.5 * effectiveFontSize) + yPadding * 2 : 0
+	)
+
+	/** Whether the live model is empty, for the placeholder. Tracked apart from `code`, which the
+	 *  editor only writes back on a debounce. */
+	let editorEmpty = $state(true)
+
 	if (typeof code != 'string') {
 		code = ''
 	}
@@ -526,6 +542,9 @@
 		}
 
 		editor.onDidChangeModelContent((event) => {
+			// Undebounced, unlike `code`: the placeholder sits over the editor, so waiting would leave
+			// it covering the first characters typed into an empty field.
+			editorEmpty = (editor?.getModel()?.getValue() ?? '') === ''
 			timeoutModel && clearTimeout(timeoutModel)
 			timeoutModel = setTimeout(() => {
 				updateCode()
@@ -538,7 +557,7 @@
 			const updateHeight = () => {
 				const contentHeight = Math.min(1000, editor?.getContentHeight() ?? 0)
 				if (divEl) {
-					divEl.style.height = `${contentHeight}px`
+					divEl.style.height = `${Math.max(contentHeight, minHeightPx)}px`
 				}
 			}
 			editor.onDidContentSizeChange(updateHeight)
@@ -709,16 +728,31 @@
 <EditorTheme />
 
 <div
-	class={twMerge(inputBorderClass({ forceFocus: isFocus }), 'rounded-md overflow-auto pl-2', clazz)}
+	class={twMerge(
+		inputBorderClass({ forceFocus: isFocus }),
+		'relative rounded-md overflow-auto pl-2',
+		clazz
+	)}
+	style={minHeightPx ? `min-height: ${minHeightPx}px` : undefined}
 >
 	{#if !editor}
 		<FakeMonacoPlaceHolder autoheight showNumbers={false} {code} fontSize={effectiveFontSize} />
 	{/if}
 	<div
 		bind:this={divEl}
-		style="height: 18px;"
+		style="height: {Math.max(18, minHeightPx)}px;"
 		class="template nonmain-editor rounded-md overflow-clip {!editor ? 'hidden' : ''}"
 	></div>
+	{#if placeholder && !code && (!editor || editorEmpty)}
+		<div
+			class="absolute inset-0 px-2 pointer-events-none whitespace-pre-wrap text-hint font-mono"
+			style="font-size: {effectiveFontSize}px; line-height: {Math.round(
+				1.5 * effectiveFontSize
+			)}px; padding-top: {yPadding}px;"
+		>
+			{placeholder}
+		</div>
+	{/if}
 </div>
 
 <style>
diff --git a/frontend/src/lib/components/TestConnection.svelte b/frontend/src/lib/components/TestConnection.svelte
index 37e3e152db..6a58af8031 100644
--- a/frontend/src/lib/components/TestConnection.svelte
+++ b/frontend/src/lib/components/TestConnection.svelte
@@ -1,5 +1,13 @@
 <script lang="ts">
-	import { type CompletedJob, JobService, type Preview } from '$lib/gen'
+	import {
+		type CompletedJob,
+		JobService,
+		type Preview,
+		ResourceService,
+		SettingService,
+		UserService,
+		VariableService
+	} from '$lib/gen'
 
 	import { Database, Loader2 } from 'lucide-svelte'
 	import Button from './common/button/Button.svelte'
@@ -13,15 +21,57 @@
 		resourceType: string | undefined
 		args?: Record<string, any> | any
 		buttonTextOverride?: string | undefined
+		// Object-storage types only: probe from a preview job (proves a worker reaches the API)
+		// instead of the browser. The job gets a short-lived token minted for the caller, since a
+		// job token is never a super admin, and that token is readable in the job's stored args
+		// until revoked: only use it where the workspace's job readers may hold the caller's rights.
+		viaWorker?: boolean
 	}
 
 	let {
 		workspaceOverride = undefined,
 		resourceType,
 		args = {},
-		buttonTextOverride = undefined
+		buttonTextOverride = undefined,
+		viaWorker = false
 	}: Props = $props()
 
+	// Object-storage resource types share one probe, the API's own connectivity test, which runs
+	// on the API server with the caller's privileges. Each type maps its resource to the
+	// ObjectSettings body that route expects.
+	const objectStorageBody: { [key: string]: (args: any) => Record<string, any> } = {
+		s3: (s3) => ({
+			type: 'S3',
+			region: s3.region,
+			bucket: s3.bucket,
+			endpoint: s3.endPoint,
+			port: s3.port,
+			allow_http: !s3.useSSL,
+			access_key: s3.accessKey,
+			secret_key: s3.secretKey,
+			path_style: s3.pathStyle
+		}),
+		azure_blob: (s3) => ({ type: 'Azure', ...s3 }),
+		s3_bucket: (bucket) => bucket
+	}
+
+	const OBJECT_STORAGE_TEST_SCRIPT = `
+export async function main(bucket: any, api_token: string) {
+	const res = await fetch(process.env.BASE_URL + '/api/settings/test_object_storage_config', {
+		method: 'POST',
+		headers: {
+			'Content-Type': 'application/json',
+			Authorization: 'Bearer ' + api_token,
+		},
+		body: JSON.stringify(bucket),
+	})
+	if (!res.ok) {
+		throw new Error(await res.text())
+	}
+	return await res.text()
+}
+`
+
 	const scripts: {
 		[key: string]: {
 			code: string
@@ -68,71 +118,18 @@
 			argName: 'database'
 		},
 		s3: {
-			code: `
-import * as wmill from "windmill-client"
-
-type S3 = object
-
-export async function main(s3: S3) {
-	return fetch(process.env["BASE_URL"] + '/api/settings/test_object_storage_config', {
-		method: 'POST',
-		headers: {
-			'Content-Type': 'application/json',
-			Authorization: 'Bearer ' + process.env["WM_TOKEN"],
-		},
-		body: JSON.stringify({
-			type: "S3",
-			region: s3.region,
-			bucket: s3.bucket,
-			endpoint: s3.endPoint,
-			port: s3.port,
-			allow_http: !s3.useSSL,
-			access_key: s3.accessKey,
-			secret_key: s3.secretKey,
-			path_style: s3.pathStyle,
-		}),
-	}).then(async (res) => {
-		if (!res.ok) {
-			throw new Error(await res.text())
-		}
-		return res.text()
-	})
-}
-`,
+			code: OBJECT_STORAGE_TEST_SCRIPT,
 			lang: 'bun',
-			argName: 's3',
+			argName: 'bucket',
 			tooltip:
-				'The storage operations of this test run on the Windmill server (the API process), not on the worker. If no access key/secret key is set, the ambient AWS credentials of the server (environment variables, instance role) are used — scripts using this resource directly through an S3 SDK resolve credentials on the worker instead, so results may differ.'
+				'The storage operations of this test run on the Windmill server (the API process) with your permissions, not on the worker. Non-super-admins can only test public endpoints with an explicit access key and secret key; super admins can also test private endpoints and rely on the ambient AWS credentials of the server (environment variables, instance role). Scripts using this resource directly through an S3 SDK resolve credentials on the worker instead, so results may differ.'
 		},
 		azure_blob: {
-			code: `
-import * as wmill from "windmill-client"
-
-type S3 = object
-
-export async function main(s3: S3) {
-	return fetch(process.env["BASE_URL"] + '/api/settings/test_object_storage_config', {
-		method: 'POST',
-		headers: {
-			'Content-Type': 'application/json',
-			Authorization: 'Bearer ' + process.env["WM_TOKEN"],
-		},
-		body: JSON.stringify({
-			type: "Azure",
-			...s3
-		}),
-	}).then(async (res) => {
-		if (!res.ok) {
-			throw new Error(await res.text())
-		}
-		return res.text()
-	})
-}
-`,
+			code: OBJECT_STORAGE_TEST_SCRIPT,
 			lang: 'bun',
-			argName: 's3',
+			argName: 'bucket',
 			tooltip:
-				'The storage operations of this test run on the Windmill server (the API process), not on the worker.'
+				'The storage operations of this test run on the Windmill server (the API process) with your permissions, not on the worker. Non-super-admins can only test public endpoints with an explicit access key.'
 		},
 		graphql: {
 			code: '{ __typename }',
@@ -158,61 +155,163 @@ export async function main(s3: S3) {
 			}
 		},
 		s3_bucket: {
-			code: `
-
-const process = require('process');
-
-export async function main(bucket: any) {
-	const req = await fetch(process.env.BASE_URL + '/api/settings/test_object_storage_config', {
-		method: 'POST',
-		headers: {
-			'Content-Type': 'application/json',
-			Authorization: 'Bearer ' + process.env.WM_TOKEN,
-		},
-		body: JSON.stringify(bucket),
-	});
-	if (!req.ok) {
-		throw new Error(await req.text());
-	}
-	return await req.text();
-}
-`,
+			code: OBJECT_STORAGE_TEST_SCRIPT,
 			lang: 'bun',
 			argName: 'bucket',
 			tooltip:
-				"The storage operations of this test run on the Windmill server (the API process). If no credentials are configured, the server's ambient credentials for the configured provider (environment variables, instance role) are used."
+				"The storage operations of this test run on the Windmill server (the API process) with your permissions. Non-super-admins can only test public endpoints with explicit credentials; super admins can also test private endpoints and rely on the server's ambient credentials for the configured provider (environment variables, instance role)."
 		}
 	}
 
 	let loading = $state(false)
+
+	// The token is revoked as soon as the job settles; the expiry only covers a browser that
+	// goes away mid-test. It is readable in the job's stored args until then, hence the short life.
+	const API_TOKEN_TTL_MS = 60_000
+	// Tokens are addressed by their first 10 characters (TOKEN_PREFIX_LEN on the backend).
+	const API_TOKEN_PREFIX_LEN = 10
+
+	async function mintApiToken(): Promise<string> {
+		return await UserService.createToken({
+			requestBody: {
+				label: `test connection: ${resourceType}`,
+				expiration: new Date(Date.now() + API_TOKEN_TTL_MS).toISOString(),
+				scopes: ['settings:write']
+			}
+		})
+	}
+
+	async function revokeApiToken(token: string | undefined) {
+		if (!token) return
+		try {
+			await UserService.deleteToken({ tokenPrefix: token.slice(0, API_TOKEN_PREFIX_LEN) })
+		} catch (err) {
+			console.error(err)
+		}
+	}
+
+	// A preview job gets its arguments interpolated on the worker: `$var:`, `$jsonvar:` and
+	// `$res:` references are replaced with the job's privileges before the script runs. The
+	// browser path has to do the same with the caller's session, or a secret stored as a linked
+	// variable (what the "Add resource" drawer saves) is sent verbatim as the credential.
+	async function resolveReferences(value: any, workspace: string): Promise<any> {
+		if (typeof value === 'string') {
+			if (value.startsWith('$var:')) {
+				return await VariableService.getVariableValue({
+					workspace,
+					path: value.slice('$var:'.length)
+				})
+			}
+			if (value.startsWith('$jsonvar:')) {
+				return JSON.parse(
+					await VariableService.getVariableValue({
+						workspace,
+						path: value.slice('$jsonvar:'.length)
+					})
+				)
+			}
+			if (value.startsWith('$res:')) {
+				return await ResourceService.getResourceValueInterpolated({
+					workspace,
+					path: value.slice('$res:'.length)
+				})
+			}
+			return value
+		}
+		if (Array.isArray(value)) {
+			return await Promise.all(value.map((v) => resolveReferences(v, workspace)))
+		}
+		if (value && typeof value === 'object') {
+			const resolved: Record<string, any> = {}
+			for (const [key, v] of Object.entries(value)) {
+				resolved[key] = await resolveReferences(v, workspace)
+			}
+			return resolved
+		}
+		return value
+	}
+
+	// The route bounds the probe only for non-super-admins; a super admin's probe against an
+	// endpoint that accepts the connection and never answers would otherwise spin here forever.
+	const BROWSER_TEST_TIMEOUT_MS = 15_000
+
+	async function testObjectStorageFromBrowser(body: Record<string, any>, workspace: string) {
+		let timer: ReturnType<typeof setTimeout> | undefined = undefined
+		try {
+			const request = SettingService.testObjectStorageConfig({
+				requestBody: await resolveReferences(body, workspace)
+			})
+			await Promise.race([
+				request,
+				new Promise<never>((_, reject) => {
+					timer = setTimeout(() => {
+						request.cancel()
+						reject(
+							new Error(
+								`no answer from the storage endpoint after ${BROWSER_TEST_TIMEOUT_MS / 1000}s`
+							)
+						)
+					}, BROWSER_TEST_TIMEOUT_MS)
+				})
+			])
+			sendUserToast('Connection successful', false)
+		} catch (err: any) {
+			sendUserToast('Connection error: ' + (err?.body ?? err?.message ?? err), true)
+		} finally {
+			clearTimeout(timer)
+			loading = false
+		}
+	}
+
 	async function testConnection() {
 		if (!resourceType) return
 		loading = true
 
 		const resourceScript = scripts[resourceType]
+		const workspace = workspaceOverride ?? $workspaceStore!
+		const objectStorageArgs: Record<string, any> | undefined =
+			resourceType in objectStorageBody ? objectStorageBody[resourceType](args) : undefined
 
-		const job = await JobService.runScriptPreview({
-			workspace: workspaceOverride ?? $workspaceStore!,
-			requestBody: {
-				path: `testConnection: ${resourceType}`,
-				language: resourceScript.lang as Preview['language'],
-				content: resourceScript.code,
-				args: {
-					[resourceScript.argName]: args
-				}
+		if (objectStorageArgs && !viaWorker) {
+			await testObjectStorageFromBrowser(objectStorageArgs, workspace)
+			return
+		}
+
+		let apiToken: string | undefined = undefined
+		let job: string
+		try {
+			if (objectStorageArgs) {
+				apiToken = await mintApiToken()
 			}
-		})
+			job = await JobService.runScriptPreview({
+				workspace,
+				requestBody: {
+					path: `testConnection: ${resourceType}`,
+					language: resourceScript.lang as Preview['language'],
+					content: resourceScript.code,
+					args: objectStorageArgs
+						? { bucket: objectStorageArgs, api_token: apiToken }
+						: { [resourceScript.argName]: args }
+				}
+			})
+		} catch (err: any) {
+			loading = false
+			await revokeApiToken(apiToken)
+			sendUserToast('Connection error: ' + (err?.body ?? err?.message ?? err), true)
+			return
+		}
 
 		tryEvery({
 			tryCode: async () => {
 				let testResult = await JobService.getCompletedJob({
-					workspace: workspaceOverride ?? $workspaceStore!,
+					workspace,
 					id: job
 				})
 				if (resourceScript.additionalCheck) {
 					testResult = resourceScript.additionalCheck(testResult)
 				}
 				loading = false
+				revokeApiToken(apiToken)
 				sendUserToast(
 					testResult.success
 						? 'Connection successful'
@@ -222,13 +321,14 @@ export async function main(bucket: any) {
 			},
 			timeoutCode: async () => {
 				loading = false
+				revokeApiToken(apiToken)
 				sendUserToast(
 					'Connection did not resolve after 5s or job did not start. Do you have native workers or a worker group listening to the proper tag available?',
 					true
 				)
 				try {
 					await JobService.cancelQueuedJob({
-						workspace: workspaceOverride ?? $workspaceStore!,
+						workspace,
 						id: job,
 						requestBody: {
 							reason:
diff --git a/frontend/src/lib/components/aiEvals/AgentEvalModal.svelte b/frontend/src/lib/components/aiEvals/AgentEvalModal.svelte
deleted file mode 100644
index 61d88819e7..0000000000
--- a/frontend/src/lib/components/aiEvals/AgentEvalModal.svelte
+++ /dev/null
@@ -1,64 +0,0 @@
-<script lang="ts">
-	import Modal from '$lib/components/common/modal/Modal.svelte'
-	import Badge from '$lib/components/common/badge/Badge.svelte'
-	import type { AgentDraft } from '$lib/gen'
-	import type { EvalsLocation } from './evalUtils'
-	import EvalsPane from './EvalsPane.svelte'
-
-	let {
-		agentPath = undefined,
-		open = $bindable(),
-		opWorkspace = undefined,
-		editedConfig = undefined
-	}: {
-		/** The agent under test. A dataset and its runs belong to a saved agent. */
-		agentPath?: string
-		open: boolean
-		/** The workspace the opening editor operates on, which differs from the nav workspace in
-		 * fork and session editors. Every read and write targets it. */
-		opWorkspace?: string
-		/** Opened from an agent being edited: the edits, as the step holds them, are what a run is
-		 * offered on. Everywhere else the agent is what is deployed. */
-		editedConfig?: () => AgentDraft
-	} = $props()
-
-	const TITLE = 'Evals'
-	let location = $state<EvalsLocation | undefined>(undefined)
-	let trail = $derived(
-		location ? [{ label: TITLE, onclick: location.back }, { label: location.label }] : undefined
-	)
-</script>
-
-<!-- The `sm:` widths are what actually win: the dialog's own are breakpoint-prefixed. -->
-<Modal
-	title={TITLE}
-	{trail}
-	paginated
-	enterConfirms={false}
-	bind:open
-	kind="X"
-	class="w-[90vw] sm:w-[90vw] max-w-[1400px] sm:max-w-[1400px] h-[85vh]"
-	fillHeight
->
-	{#snippet titleBadge()}
-		<Badge color="blue" small class="shrink-0 !py-0 leading-4">Beta</Badge>
-	{/snippet}
-	<div class="h-full min-h-0">
-		{#if agentPath}
-			<!-- Keyed: the resources page keeps one dialog for every row, so a different agent must
-			     start from nothing rather than inherit the runs and the open run of the last one. -->
-			{#key `${opWorkspace ?? ''}:${agentPath}`}
-				<EvalsPane {agentPath} {opWorkspace} {editedConfig} bind:location />
-			{/key}
-		{:else}
-			<div class="h-full flex flex-col items-center justify-center gap-2 p-6 text-center">
-				<span class="text-sm text-emphasis">Evals run against a saved agent</span>
-				<span class="text-xs text-secondary max-w-md">
-					This agent is written into the flow step rather than saved as its own agent, so there is
-					nothing for a dataset and its runs to belong to. Save it as a reusable agent from the
-					step, and its evals start there.
-				</span>
-			</div>
-		{/if}
-	</div>
-</Modal>
diff --git a/frontend/src/lib/components/aiEvals/EvalsPane.svelte b/frontend/src/lib/components/aiEvals/EvalsPane.svelte
index 55792ba8e2..568d4302cd 100644
--- a/frontend/src/lib/components/aiEvals/EvalsPane.svelte
+++ b/frontend/src/lib/components/aiEvals/EvalsPane.svelte
@@ -64,7 +64,8 @@
 		agentPath,
 		opWorkspace = undefined,
 		editedConfig = undefined,
-		location = $bindable()
+		location = $bindable(),
+		active = true
 	}: {
 		/** The agent under test. A dataset and its runs belong to an agent. */
 		agentPath: string
@@ -77,6 +78,10 @@
 		/** The level the pane is on and the way out of it, reported up so the surface holding it
 		 * can put both in its header. Undefined at the root, which that surface already names. */
 		location?: EvalsLocation
+		/** False while the pane is parked off screen by a surface that keeps it mounted. Its own
+		 * pages answer the arrow keys at `window`, which a parked instance would take from
+		 * whatever is actually on screen. */
+		active?: boolean
 	} = $props()
 
 	let ws = $derived(opWorkspace ?? $workspaceStore)
@@ -666,19 +671,21 @@
 			warm
 			class="grow min-h-0"
 			current={!viewingRun || !loaded ? 'list' : 'run'}
-			onNavigate={(key) => {
-				// Right opens the run under the highlight, falling back to whichever was open before;
-				// left is the way back, the same as the breadcrumb.
-				if (key === 'run') {
-					// Both branches go through `openRun`: it is what brings the run's own dataset back,
-					// and the fallback run may be of a dataset the list has since moved off.
-					const id = highlightedRunId ?? experimentId
-					if (id) openRun(id)
-				} else if (key === 'list') {
-					viewingRun = false
-					selectedCaseId = undefined
-				}
-			}}
+			onNavigate={!active
+				? undefined
+				: (key) => {
+						// Right opens the run under the highlight, falling back to whichever was open before;
+						// left is the way back, the same as the breadcrumb.
+						if (key === 'run') {
+							// Both branches go through `openRun`: it is what brings the run's own dataset back,
+							// and the fallback run may be of a dataset the list has since moved off.
+							const id = highlightedRunId ?? experimentId
+							if (id) openRun(id)
+						} else if (key === 'list') {
+							viewingRun = false
+							selectedCaseId = undefined
+						}
+					}}
 			pages={[
 				{ key: 'list', content: listPage },
 				{ key: 'run', content: runPage }
@@ -727,7 +734,7 @@
 			{datasets}
 			{caseProgress}
 			{loaded}
-			active={!viewingRun}
+			active={active && !viewingRun}
 			{deployedHash}
 			{currentVersion}
 			onOpen={(e) => openRun(e.id)}
diff --git a/frontend/src/lib/components/assets/AssetGraph/PipelineInsertMenu.svelte b/frontend/src/lib/components/assets/AssetGraph/PipelineInsertMenu.svelte
index e3c6c04378..e341707250 100644
--- a/frontend/src/lib/components/assets/AssetGraph/PipelineInsertMenu.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/PipelineInsertMenu.svelte
@@ -28,6 +28,7 @@
 <script lang="ts">
 	import Popover from '$lib/components/meltComponents/Popover.svelte'
 	import Button from '$lib/components/common/button/Button.svelte'
+	import { copilotInfo } from '$lib/aiStore'
 	import LanguageIcon from '$lib/components/common/languageIcons/LanguageIcon.svelte'
 	import { twMerge } from 'tailwind-merge'
 	import {
@@ -79,9 +80,11 @@
 	// focus off to the first tabbable in the next column.
 	let languageEl: HTMLElement | undefined
 	let outputEl: HTMLElement | undefined
-	// Refs into the bottom panel for the Output → Path → AI Prompt → Save chain.
+	// Refs into the bottom panel for the Output → Path → AI Prompt → Save chain. The AI
+	// prompt is absent where the workspace hid the assistant, so Path advances to Save.
 	let pathEl: HTMLElement | undefined
 	let aiPromptEl: HTMLElement | undefined
+	let saveEl: HTMLElement | undefined
 
 	let compatibleKinds = $derived.by<PipelineOutputKind[]>(() => {
 		if (!selected.language) return []
@@ -261,7 +264,7 @@
 {#snippet bottomSection(close: () => void)}
 	<Label label="Path">
 		<!-- svelte-ignore a11y_no_static_element_interactions -->
-		<div bind:this={pathEl} class="flex" onkeydown={selectAndAdvanceTo(() => aiPromptEl)}>
+		<div bind:this={pathEl} class="flex" onkeydown={selectAndAdvanceTo(() => aiPromptEl ?? saveEl)}>
 			<div
 				class="border rounded-md rounded-r-none border-r-0 text-xs w-fit shrink-0 whitespace-nowrap flex items-center px-2 text-secondary bg-surface-input"
 			>
@@ -270,25 +273,27 @@
 			<TextInput bind:value={selected.scriptPath} class="rounded-l-none" />
 		</div>
 	</Label>
-	<Label label="AI Prompt (optional)">
-		<!-- svelte-ignore a11y_no_static_element_interactions -->
-		<div
-			bind:this={aiPromptEl}
-			onkeydown={(e) =>
-				(e.metaKey || e.ctrlKey) && e.key === 'Enter' && (confirm(close), e.stopPropagation())}
-		>
-			<TextInput
-				class="resize-none h-12 !max-h-12"
-				underlyingInputEl="textarea"
-				inputProps={{
-					placeholder: 'Describe what the script should do — leave empty to use a template'
-				}}
-				bind:value={selected.aiPrompt}
-			/>
-		</div>
-	</Label>
+	{#if !$copilotInfo.workspaceDisabled}
+		<Label label="AI Prompt (optional)">
+			<!-- svelte-ignore a11y_no_static_element_interactions -->
+			<div
+				bind:this={aiPromptEl}
+				onkeydown={(e) =>
+					(e.metaKey || e.ctrlKey) && e.key === 'Enter' && (confirm(close), e.stopPropagation())}
+			>
+				<TextInput
+					class="resize-none h-12 !max-h-12"
+					underlyingInputEl="textarea"
+					inputProps={{
+						placeholder: 'Describe what the script should do — leave empty to use a template'
+					}}
+					bind:value={selected.aiPrompt}
+				/>
+			</div>
+		</Label>
+	{/if}
 	{@const hasAiPrompt = !!selected.aiPrompt?.trim()}
-	<div class="ml-auto">
+	<div class="ml-auto" bind:this={saveEl}>
 		<Button
 			variant="accent"
 			btnClasses="w-fit"
diff --git a/frontend/src/lib/components/auditLogs/AuditLogsFilters.svelte b/frontend/src/lib/components/auditLogs/AuditLogsFilters.svelte
index 213beda001..96d341dc72 100644
--- a/frontend/src/lib/components/auditLogs/AuditLogsFilters.svelte
+++ b/frontend/src/lib/components/auditLogs/AuditLogsFilters.svelte
@@ -216,6 +216,8 @@
 		INSTANCE_GROUPS_SCIM_CREATE: 'instance_groups.scim_create',
 		INSTANCE_GROUPS_SCIM_DELETE: 'instance_groups.scim_delete',
 		INSTANCE_GROUPS_SCIM_UPDATE: 'instance_groups.scim_update',
+		INSTANCE_GROUPS_JIT_ADDUSER: 'instance_groups.jit_adduser',
+		INSTANCE_GROUPS_JIT_REMOVEUSER: 'instance_groups.jit_removeuser',
 		VARIABLES_DECRYPT_SECRET: 'variables.decrypt_secret',
 		WORKSPACES_READ_ENCRYPTION_KEY: 'workspaces.read_encryption_key',
 		WORKSPACES_EDIT_COMMAND_SCRIPT: 'workspaces.edit_command_script',
diff --git a/frontend/src/lib/components/common/CloseButton.svelte b/frontend/src/lib/components/common/CloseButton.svelte
index d7d0a58a7b..264e478721 100644
--- a/frontend/src/lib/components/common/CloseButton.svelte
+++ b/frontend/src/lib/components/common/CloseButton.svelte
@@ -10,10 +10,12 @@
 		Icon?: any | undefined
 		class?: string
 		id?: string | undefined
+		/** Names the button: it has no text, so without this it reads as "button" to a screen reader. */
+		title?: string | undefined
 		onClick?: () => void | undefined | any
 	}
 
-	let { noBg = false, small = false, Icon, class: className, id, onClick }: Props = $props()
+	let { noBg = false, small = false, Icon, class: className, id, title, onClick }: Props = $props()
 
 	const dispatch = createEventDispatcher()
 </script>
@@ -22,6 +24,7 @@
 	on:click={() => (dispatch('close'), onClick?.())}
 	on:pointerdown={(e) => e.stopPropagation()}
 	{id}
+	{title}
 	startIcon={{ icon: Icon ?? X }}
 	iconOnly
 	unifiedSize="sm"
diff --git a/frontend/src/lib/components/common/confirmationModal/ConfirmationModal.svelte b/frontend/src/lib/components/common/confirmationModal/ConfirmationModal.svelte
index 56244632ef..c858f9f08f 100644
--- a/frontend/src/lib/components/common/confirmationModal/ConfirmationModal.svelte
+++ b/frontend/src/lib/components/common/confirmationModal/ConfirmationModal.svelte
@@ -23,6 +23,12 @@
 		/** Tailwind z-index class for the modal root. Override to stack this modal
 		 * above another modal that's already open (both default to `z-[9999]`). */
 		zIndexClass?: string
+		/** Render into `body` instead of where this component sits. Needed when an ancestor
+		 * creates a stacking context the dialog has to escape — a drawer paints over the page
+		 * whatever the dialog's z-index, and a `transform`, `filter` or `overflow` on the way
+		 * up confines it. Off by default: it moves the dialog out of its DOM position, so opt
+		 * in per call site rather than assuming every caller wants it. */
+		alwaysPortal?: boolean
 		children?: Snippet
 		onConfirmed?: () => void | Promise<void>
 		onCanceled?: () => void
@@ -40,6 +46,7 @@
 		id,
 		trashbin = false,
 		zIndexClass = 'z-[9999]',
+		alwaysPortal = false,
 		children,
 		onConfirmed,
 		onCanceled
@@ -141,7 +148,11 @@
 
 <svelte:window onkeydowncapture={onKeyDown} />
 
-<ConditionalPortal condition={!!hostEl} target={hostEl} class="contents">
+<ConditionalPortal
+	condition={alwaysPortal || !!hostEl}
+	target={hostEl}
+	class={hostEl ? 'contents' : undefined}
+>
 	{#if open}
 		<div
 			transition:fadeFast|local
diff --git a/frontend/src/lib/components/common/fileInput/FileInput.svelte b/frontend/src/lib/components/common/fileInput/FileInput.svelte
index 11f7a0caa9..bde73b8b69 100644
--- a/frontend/src/lib/components/common/fileInput/FileInput.svelte
+++ b/frontend/src/lib/components/common/fileInput/FileInput.svelte
@@ -201,6 +201,13 @@
 		}
 	}
 
+	/** Open the file chooser without the dropzone being clicked, for a caller whose
+	 * affordance is a button elsewhere. The component is still what reads and filters
+	 * the files, so the two paths cannot drift. */
+	export function openPicker() {
+		input?.click()
+	}
+
 	export function clearFiles() {
 		files = undefined
 		dispatchChange()
diff --git a/frontend/src/lib/components/common/index.ts b/frontend/src/lib/components/common/index.ts
index 531036c3de..bb0268b39b 100644
--- a/frontend/src/lib/components/common/index.ts
+++ b/frontend/src/lib/components/common/index.ts
@@ -20,6 +20,7 @@ export { default as TabFade } from './tabs/TabFade.svelte'
 export { default as Tabs } from './tabs/Tabs.svelte'
 export { default as Breadcrumb } from './breadcrumb/Breadcrumb.svelte'
 export { default as FileInput } from './fileInput/FileInput.svelte'
+export { default as ListRow } from './listRow/ListRow.svelte'
 export { default as RadioCard } from './radioCard/RadioCard.svelte'
 export { default as Section } from '../Section.svelte'
 export { default as Url } from './Url.svelte'
diff --git a/frontend/src/lib/components/common/listRow/ListRow.svelte b/frontend/src/lib/components/common/listRow/ListRow.svelte
new file mode 100644
index 0000000000..dfa56d5af3
--- /dev/null
+++ b/frontend/src/lib/components/common/listRow/ListRow.svelte
@@ -0,0 +1,142 @@
+<!--
+@component
+One row of a selectable list: an optional leading icon, a label line, one line of
+secondary text under it, and optionally controls at the end that act on their own.
+
+Borderless — rows sit in a `flex flex-col gap-1` and light up on hover rather than
+living in a bordered card, which reads as heavy once a list runs to dozens of rows.
+-->
+<script lang="ts">
+	import type { Snippet } from 'svelte'
+	import { twMerge } from 'tailwind-merge'
+	import Button from '$lib/components/common/button/Button.svelte'
+
+	let {
+		title,
+		subtitle,
+		icon,
+		trailing,
+		onClick,
+		onMouseEnter,
+		highlighted,
+		id,
+		aiId,
+		aiDescription,
+		class: clazz = ''
+	}: {
+		/** The label line. A snippet so a caller can highlight a search match, or set a
+		 * second identifier beside the name. */
+		title: Snippet
+		/** One line under the title, truncated. */
+		subtitle?: Snippet
+		icon?: Snippet
+		/** Controls at the end of the row that act on their own — a switch, a menu. A row
+		 * that has them is a div with the label as an inner button, since a button cannot
+		 * nest inside a button and a click would otherwise fire both. */
+		trailing?: Snippet
+		onClick?: () => void
+		onMouseEnter?: () => void
+		/** Given, the caller owns which row is lit — it moves the highlight with the
+		 * keyboard — and the row's own hover is off: two lit rows at once are ambiguous. */
+		highlighted?: boolean
+		id?: string
+		aiId?: string
+		aiDescription?: string
+		class?: string
+	} = $props()
+
+	let ownHover = $derived(highlighted === undefined)
+
+	// Set at hover time rather than up front, so only the rows that actually cut their
+	// text off carry a tooltip.
+	function titleIfTruncated(e: MouseEvent & { currentTarget: HTMLElement }) {
+		const el = e.currentTarget
+		el.title = el.scrollWidth > el.clientWidth ? (el.textContent?.trim() ?? '') : ''
+	}
+</script>
+
+{#snippet body()}
+	<div class="flex flex-row items-center gap-4 w-full min-w-0 text-left">
+		{#if icon}
+			<div class="shrink-0">{@render icon()}</div>
+		{/if}
+		<div class="flex flex-col gap-0.5 min-w-0 grow">
+			<div class="flex flex-row items-baseline gap-2 min-w-0">
+				{@render title()}
+			</div>
+			{#if subtitle}
+				<!-- svelte-ignore a11y_no_static_element_interactions -->
+				<span
+					class="truncate text-xs font-normal leading-4 text-secondary"
+					onmouseenter={titleIfTruncated}
+				>
+					{@render subtitle()}
+				</span>
+			{/if}
+		</div>
+	</div>
+{/snippet}
+
+{#if trailing}
+	<!-- svelte-ignore a11y_no_static_element_interactions -->
+	<div
+		{id}
+		class={twMerge(
+			'flex items-center gap-4 rounded-md px-3 py-3 scroll-my-2 transition-colors text-xs font-medium',
+			// Only a row that opens something lights up: a hover on a row whose label does
+			// nothing reads as an affordance that isn't there.
+			onClick ? (ownHover ? 'hover:bg-surface-hover' : highlighted ? 'bg-surface-hover' : '') : '',
+			clazz
+		)}
+		onmouseenter={onMouseEnter}
+	>
+		{#if onClick}
+			<!-- Its own padding and hover are off: both belong to the row around it, which
+			     is what lights up and what the trailing controls sit inside. -->
+			<Button
+				type="button"
+				{aiId}
+				{aiDescription}
+				variant="subtle"
+				unifiedSize="md"
+				wrapperClasses="grow shrink min-w-0"
+				btnClasses="w-full min-w-0 justify-start p-0 h-auto bg-transparent hover:bg-transparent"
+				{onClick}
+			>
+				{@render body()}
+			</Button>
+		{:else}
+			<!-- No `onClick`: a button here would be a tab stop that does nothing. -->
+			<div class="flex grow min-w-0 text-left">{@render body()}</div>
+		{/if}
+		{@render trailing()}
+	</div>
+{:else if !onClick}
+	<!-- Nothing to click and nothing trailing: a row that only reports. A `Button` here
+	     would be a tab stop that lights up on hover and does nothing. -->
+	<!-- svelte-ignore a11y_no_static_element_interactions -->
+	<div {id} class={twMerge('px-3 py-3 text-xs font-medium', clazz)} onmouseenter={onMouseEnter}>
+		{@render body()}
+	</div>
+{:else}
+	<Button
+		type="button"
+		{id}
+		{aiId}
+		{aiDescription}
+		variant="subtle"
+		unifiedSize="md"
+		btnClasses={twMerge(
+			'justify-start px-3 h-auto py-3 scroll-my-2',
+			ownHover ? '' : 'hover:bg-transparent',
+			// `!` so the highlight also wins on the row the pointer is over, whose own
+			// hover was turned off just above.
+			highlighted ? '!bg-surface-hover' : '',
+			clazz
+		)}
+		on:mouseenter={() => onMouseEnter?.()}
+		{onClick}
+	>
+		{@render body()}
+	</Button>
+{/if}
diff --git a/frontend/src/lib/components/common/listRow/listHighlight.svelte.ts b/frontend/src/lib/components/common/listRow/listHighlight.svelte.ts
new file mode 100644
index 0000000000..4da6f18f32
--- /dev/null
+++ b/frontend/src/lib/components/common/listRow/listHighlight.svelte.ts
@@ -0,0 +1,84 @@
+import { untrack } from 'svelte'
+
+/**
+ * The highlighted row of a searchable list: the one the arrow keys move and Enter
+ * activates, rendered by passing `highlighted` to `ListRow`.
+ *
+ * Pairs with a search field above the list — the arrows and Enter are answered while
+ * focus stays in it, so a query and a choice are one uninterrupted sequence.
+ */
+export function useListHighlight(opts: {
+	/** How many rows the list holds right now. */
+	count: () => number
+	/** The DOM id of the row at this index — the same `id` given to its `ListRow`. */
+	rowId: (index: number) => string
+	/** Where the highlight belongs when the list changes underneath it: the top hit while
+	 * a search is on, and typically -1 (nothing lit) when it is not. */
+	restingIndex: () => number
+	/** Open the row at this index. */
+	onActivate: (index: number) => void
+	/** Ids of the elements whose Enter also activates the highlighted row — the search
+	 * field. A focused row activates itself, so it is not one of these. */
+	activateEnterFrom?: string[]
+}) {
+	let index = $state(-1)
+	// Scrolling rows under a resting pointer makes the browser fire `mouseenter` on each
+	// one, which would drag the highlight back under the cursor as the arrow keys move it.
+	// Only a real pointer move hands the highlight back to the mouse.
+	let pointerOwns = $state(true)
+
+	// Filtering reshuffles the rows under the highlight, so it goes back where the caller
+	// says it belongs rather than staying on a position that now means another row.
+	$effect(() => {
+		opts.count()
+		const resting = opts.restingIndex()
+		untrack(() => (index = resting))
+	})
+
+	function move(delta: number) {
+		const count = opts.count()
+		if (count === 0) return
+		pointerOwns = false
+		// Rows are tabbable, so focus can sit on one. Enter then activates whatever is
+		// focused, which has to stay the highlighted row — so any row counts, not just
+		// the lit one. Tab from the search field lands on the first row while the
+		// highlight rests on the best match, and testing only the lit row would leave
+		// focus behind and activate the wrong one.
+		const focusedId = document.activeElement?.id
+		const rowWasFocused =
+			!!focusedId && Array.from({ length: count }, (_, i) => opts.rowId(i)).includes(focusedId)
+		index = index < 0 ? (delta > 0 ? 0 : count - 1) : (index + delta + count) % count
+		const row = document.getElementById(opts.rowId(index))
+		row?.scrollIntoView({ block: 'nearest' })
+		if (rowWasFocused) row?.focus()
+	}
+
+	return {
+		get index() {
+			return index
+		},
+		/** Wire to each row's `onMouseEnter`. */
+		hovered(i: number) {
+			if (pointerOwns) index = i
+		},
+		/** Wire to the list container's `onpointermove`. */
+		pointerMoved() {
+			pointerOwns = true
+		},
+		/** Wire to the container that holds the search field and the rows, so the keys are
+		 * answered whichever of the two has focus. */
+		onKeydown(e: KeyboardEvent) {
+			if (e.key === 'ArrowDown' || e.key === 'ArrowUp') {
+				e.preventDefault()
+				move(e.key === 'ArrowDown' ? 1 : -1)
+			} else if (
+				e.key === 'Enter' &&
+				opts.activateEnterFrom?.includes((e.target as HTMLElement)?.id) &&
+				index >= 0
+			) {
+				e.preventDefault()
+				opts.onActivate(index)
+			}
+		}
+	}
+}
diff --git a/frontend/src/lib/components/common/modal/Modal.svelte b/frontend/src/lib/components/common/modal/Modal.svelte
index 6755dfb3fc..bcc4f33607 100644
--- a/frontend/src/lib/components/common/modal/Modal.svelte
+++ b/frontend/src/lib/components/common/modal/Modal.svelte
@@ -35,9 +35,11 @@
 		style?: string
 		cancelText?: string | undefined
 		kind?: 'button' | 'X'
-		/** Where you are inside the dialog, as a breadcrumb replacing the title: the whole path,
-		 * the dialog's own root first. A dialog at its root passes nothing (or one level) and keeps
-		 * its plain title; ancestors with an `onclick` are the way back, which Escape also takes. */
+		/** Where you are inside the dialog: the whole path, the dialog's own root first. Below the
+		 * root the last level becomes the heading and the ones above it the line under it, with a
+		 * back control for the nearest. A dialog at its root passes nothing (or one level) and
+		 * keeps its plain title; ancestors with an `onclick` are the way back, which Escape also
+		 * takes. */
 		trail?: ModalTrailSegment[]
 		/** A line under the title saying what the dialog is for; in the header so it does not
 		 * scroll away with the body. */
@@ -63,9 +65,12 @@
 		 * side panel when it is open. Pass an explicit value to stack above other
 		 * surfaces (e.g. a modal opened over the /sessions preview-pane editor). */
 		minZIndex?: number
-		/** Rendered against the dialog's own name, before any level below it: what it marks is the
-		 * dialog rather than wherever in it you have navigated to. */
+		/** Rendered against the dialog's own name, wherever that name is: the heading at the root,
+		 * the first level of the way back below it. */
 		titleBadge?: import('svelte').Snippet
+		/** Rendered against the level you are on, which below the root is the heading. Nothing at
+		 * the root, where that level is the dialog and `titleBadge` already names it. */
+		levelBadge?: import('svelte').Snippet
 		settings?: import('svelte').Snippet
 		children?: import('svelte').Snippet
 		actions?: import('svelte').Snippet
@@ -85,6 +90,7 @@
 		enterConfirms = true,
 		minZIndex: minZIndexProp = undefined,
 		titleBadge,
+		levelBadge,
 		settings,
 		children: children_render,
 		actions
@@ -101,7 +107,9 @@
 
 	// A trail of one level is the dialog at its root, which the plain title already shows.
 	const crumbs = $derived(trail && trail.length > 1 ? trail : undefined)
-	// The level under the one you are on: what Escape and the back chevron return to.
+	// The level you are on, which is the heading below the root.
+	const current = $derived(crumbs?.[crumbs.length - 1])
+	// The level under it: what Escape and the back control return to.
 	const back = $derived(crumbs?.[crumbs.length - 2])
 
 	const dispatch = createEventDispatcher()
@@ -164,22 +172,19 @@
 
 <svelte:window onkeydowncapture={onKeyDown} />
 
-<!-- The level you would return to wears the back chevron; there is no separate back control. -->
-{#snippet crumb(segment: ModalTrailSegment, isBack: boolean)}
-	<Button
-		variant="subtle"
-		unifiedSize="sm"
-		title={isBack ? `Back to ${segment.label}` : undefined}
-		onClick={segment.onclick}
-		wrapperClasses="min-w-0 shrink"
-		btnClasses="group !px-0 !font-normal text-secondary hover:text-emphasis hover:!bg-transparent gap-0.5 min-w-0"
+<!-- The heading names the level you are on; where it sits within the dialog goes under it. -->
+<!-- `oneLine` for a level of the trail, which shares its row with the way back and the actions.
+     The dialog's own title wraps instead, as it did before there was a trail: it is the whole row,
+     and titles carrying a path or a sentence are long by nature. -->
+{#snippet heading(label: string, badge: import('svelte').Snippet | undefined, oneLine: boolean)}
+	<h3
+		class="text-emphasis text-lg font-semibold leading-7 flex items-center gap-1 {oneLine
+			? 'min-w-0'
+			: ''}"
 	>
-		{#if isBack}
-			<!-- Pulled left so the label stays about where the title sits at the root. -->
-			<ChevronLeft size={18} class="shrink-0 -ml-1" />
-		{/if}
-		<span class="truncate group-hover:underline">{segment.label}</span>
-	</Button>
+		<span class={oneLine ? 'truncate' : ''}>{label}</span>
+		{@render badge?.()}
+	</h3>
 {/snippet}
 
 <Disposable bind:open bind:this={disposable} preventEscape {minZIndex}>
@@ -234,72 +239,69 @@
 									<!-- min-w-0: without it this flex item takes its content's min-content width and
 									     stretches the modal past its max-width instead of letting content shrink. -->
 									<div class="text-left flex-1 min-w-0 {fillHeight ? 'flex flex-col min-h-0' : ''}">
-										{#if crumbs}
-											<!-- pr-8 under `kind="X"`: the close button is absolutely positioned, so a
-											     long trail would otherwise run under it. -->
-											<div
-												class="flex flex-row items-center justify-between gap-2 min-w-0 {kind ===
-												'X'
-													? 'pr-8'
-													: ''}"
-											>
-												<!-- leading-7 on the row and the heading alike, so the header is the same
-												     height at the root as one level in. -->
-												<nav
-													aria-label="Breadcrumb"
-													class="flex flex-row items-center gap-1 min-w-0 text-lg font-semibold leading-7"
-												>
-													{#each crumbs as segment, i (i)}
-														{#if i === 1}
-															{@render titleBadge?.()}
-														{/if}
-														{#if i > 0}
-															<span class="flex shrink-0" in:fade={{ duration: 150 }}>
-																<ChevronRight size={18} class="text-tertiary shrink-0" />
-															</span>
-														{/if}
-														{#if i === 0}
-															<!-- flex: an inline child holding an icon sits on the baseline and adds
-														     descender room, which would make the row taller than at the root. -->
-															<h3
-																class="shrink-0 leading-7 flex items-center {segment.onclick
-																	? ''
-																	: 'text-emphasis'}"
-															>
-																{#if segment.onclick}
-																	{@render crumb(segment, i === crumbs.length - 2)}
-																{:else}
-																	{segment.label}
+										<!-- pr-8 under `kind="X"`: the close button is absolutely positioned, so a long
+										     heading or the header actions would otherwise run under it. -->
+										<div
+											class="flex flex-row items-start justify-between gap-2 min-w-0 {kind === 'X'
+												? 'pr-8'
+												: ''}"
+										>
+											{#if crumbs && current}
+												<div class="flex flex-row items-start gap-1 min-w-0">
+													{#if back?.onclick}
+														<!-- Pulled left so the heading lands about where the title sits at the
+														     root, and up so it reads against that heading rather than against
+														     the two lines together. -->
+														<Button
+															variant="subtle"
+															unifiedSize="sm"
+															iconOnly
+															startIcon={{ icon: ChevronLeft }}
+															title="Back to {back.label}"
+															onClick={back.onclick}
+															wrapperClasses="shrink-0 -ml-1 -mt-0.5"
+														/>
+													{/if}
+													<div class="flex flex-col min-w-0">
+														{@render heading(current.label, levelBadge, true)}
+														<!-- The way back in full: the control above carries one level of it. -->
+														<nav
+															aria-label="Breadcrumb"
+															class="flex flex-row items-center gap-0.5 min-w-0 text-xs text-secondary"
+														>
+															{#each crumbs.slice(0, -1) as segment, i (i)}
+																{#if i > 0}
+																	<span class="flex shrink-0" in:fade={{ duration: 150 }}>
+																		<ChevronRight size={12} class="text-tertiary shrink-0" />
+																	</span>
 																{/if}
-															</h3>
-														{:else if segment.onclick}
-															{@render crumb(segment, i === crumbs.length - 2)}
-														{:else}
-															<span
-																class="text-emphasis truncate"
-																aria-current="page"
-																in:fade={{ duration: 150 }}
-															>
-																{segment.label}
-															</span>
-														{/if}
-													{/each}
-												</nav>
-												{@render settings?.()}
-											</div>
-										{:else}
-											<div class="flex flex-row items-center justify-between">
-												<h3
-													class="text-emphasis text-lg font-semibold {titleBadge
-														? 'flex items-center gap-1'
-														: ''}"
-												>
-													{title}
-													{@render titleBadge?.()}
-												</h3>
-												{@render settings?.()}
-											</div>
-										{/if}
+																{#if segment.onclick}
+																	<Button
+																		variant="subtle"
+																		unifiedSize="2xs"
+																		onClick={segment.onclick}
+																		wrapperClasses="min-w-0 shrink"
+																		btnClasses="!px-0 !font-normal !text-xs text-secondary hover:text-emphasis hover:underline hover:!bg-transparent min-w-0"
+																	>
+																		<span class="truncate">{segment.label}</span>
+																	</Button>
+																{:else}
+																	<span class="truncate" in:fade={{ duration: 150 }}
+																		>{segment.label}</span
+																	>
+																{/if}
+																{#if i === 0}
+																	{@render titleBadge?.()}
+																{/if}
+															{/each}
+														</nav>
+													</div>
+												</div>
+											{:else}
+												{@render heading(title, titleBadge, false)}
+											{/if}
+											{@render settings?.()}
+										</div>
 
 										{#if description}
 											<p class="mt-1 text-xs text-secondary">{description}</p>
diff --git a/frontend/src/lib/components/common/modal/Modal2.svelte b/frontend/src/lib/components/common/modal/Modal2.svelte
index f33b1dec04..b9e57740b9 100644
--- a/frontend/src/lib/components/common/modal/Modal2.svelte
+++ b/frontend/src/lib/components/common/modal/Modal2.svelte
@@ -26,6 +26,10 @@
 		 * and clicks "outside" the child would otherwise propagate
 		 * here and close the underlying modal. */
 		closeOnOutsideClick?: boolean
+		/** Close on Escape. Default true. Every open modal listens on the
+		 * window, so a stacked pair would both close on one press; set it
+		 * false on the underlying modal while its child is up. */
+		closeOnEscape?: boolean
 		/** Wider side padding and a lighter title, for a dialog whose body is a form rather
 		 *  than a list. Opt-in: every other Modal2 keeps the padding and heading it had. */
 		formStyling?: boolean
@@ -46,6 +50,7 @@
 		fixedHeight = 'md',
 		contentClasses = '',
 		closeOnOutsideClick = true,
+		closeOnEscape = true,
 		formStyling = false,
 		headerLeft,
 		headerRight,
@@ -80,7 +85,7 @@
 	}
 
 	function handleKeyDown(event: KeyboardEvent) {
-		if (!isOpen) return
+		if (!isOpen || !closeOnEscape) return
 		if (event.key === 'Escape') {
 			event.preventDefault()
 			event.stopPropagation()
diff --git a/frontend/src/lib/components/common/modal/PagedContent.svelte b/frontend/src/lib/components/common/modal/PagedContent.svelte
index 430a53e66f..674c147c52 100644
--- a/frontend/src/lib/components/common/modal/PagedContent.svelte
+++ b/frontend/src/lib/components/common/modal/PagedContent.svelte
@@ -26,6 +26,9 @@
 		 * around this owns it, and a page component that swallowed it would stop the dialog from
 		 * closing. Without this prop the pages are still navigable, just not from the keyboard —
 		 * the caller owns `current` either way.
+		 *
+		 * A host that stays mounted while hidden must withhold it while hidden: the arrows are
+		 * answered at `window`, so a parked instance would take the key off the visible one.
 		 */
 		onNavigate?: (key: string) => void
 		/**
@@ -80,6 +83,9 @@
 
 	function onKeydown(event: KeyboardEvent) {
 		if (!onNavigate || !listening() || event.metaKey || event.ctrlKey || event.altKey) return
+		// A control on the page that already answered the key keeps it: the arrows move focus
+		// inside a toggle group, a menu, a slider, and those handlers run before this one.
+		if (event.defaultPrevented) return
 		if (!ownsKeyboard(event.target)) return
 		const step = event.key === 'ArrowRight' ? 1 : event.key === 'ArrowLeft' ? -1 : 0
 		if (step === 0) return
diff --git a/frontend/src/lib/components/common/overlayHost.svelte.ts b/frontend/src/lib/components/common/overlayHost.svelte.ts
index 7c4374115b..e556b51e67 100644
--- a/frontend/src/lib/components/common/overlayHost.svelte.ts
+++ b/frontend/src/lib/components/common/overlayHost.svelte.ts
@@ -55,12 +55,13 @@ export function overlayStack(): OverlayStack {
  * Reads context, so call it during component initialisation; call the returned getter
  * where the target is used, to stay reactive as the host element mounts.
  */
-export function overlayPortalTarget(fallback: string): () => HTMLElement | string {
+export function overlayPortalTarget(fallback: string | (() => string)): () => HTMLElement | string {
 	const host = getOverlayHost()
 	return () => {
+		const selector = typeof fallback === 'function' ? fallback() : fallback
 		const el = host?.el()
-		if (!el) return fallback
-		return el.querySelector<HTMLElement>(fallback) ?? el
+		if (!el) return selector
+		return el.querySelector<HTMLElement>(selector) ?? el
 	}
 }
 
diff --git a/frontend/src/lib/components/common/sidebar/SidebarNavigation.svelte b/frontend/src/lib/components/common/sidebar/SidebarNavigation.svelte
index 260e368e2e..d18df4c655 100644
--- a/frontend/src/lib/components/common/sidebar/SidebarNavigation.svelte
+++ b/frontend/src/lib/components/common/sidebar/SidebarNavigation.svelte
@@ -2,6 +2,7 @@
 	import type { ComponentType } from 'svelte'
 	import { twMerge } from 'tailwind-merge'
 	import Button from '$lib/components/common/button/Button.svelte'
+	import { arrowTabNav } from '$lib/attachments/arrowTabNav'
 	import EEOnly from '$lib/components/EEOnly.svelte'
 	import { enterpriseLicense } from '$lib/stores'
 
@@ -32,7 +33,10 @@
 	let { groups, selectedId, onNavigate, class: className = '' }: Props = $props()
 </script>
 
-<div class={twMerge('flex flex-col gap-6', className)}>
+<!-- Up/Down walks the items, wrapping at the ends. On the wrapper rather than on each
+     `<nav>` so the arrows cross group boundaries the way reading down the list does; the
+     Y axis also leaves Left/Right to the paginated dialogs this can sit inside. -->
+<div class={twMerge('flex flex-col gap-6', className)} {@attach arrowTabNav()}>
 	{#each groups as group (group.title)}
 		<div class="flex flex-col gap-1">
 			{#if group.title}
diff --git a/frontend/src/lib/components/copilot/AIFormAssistant.svelte b/frontend/src/lib/components/copilot/AIFormAssistant.svelte
index db6a341c58..9c7b3cb411 100644
--- a/frontend/src/lib/components/copilot/AIFormAssistant.svelte
+++ b/frontend/src/lib/components/copilot/AIFormAssistant.svelte
@@ -5,6 +5,7 @@
 	import OpenInSessionButton from '$lib/components/sessions/OpenInSessionButton.svelte'
 	import { AIBtnClasses } from './chat/AIButtonStyle'
 	import { workspaceStore } from '$lib/stores'
+	import { copilotInfo } from '$lib/aiStore'
 	import { logFeatureUsage } from '$lib/utils/featureUsage'
 
 	interface Props {
@@ -49,45 +50,47 @@
 	)
 </script>
 
-<div class="my-3 p-3 bg-surface-secondary rounded-md relative flex flex-col gap-3">
-	<div class="flex flex-row gap-2 justify-between items-center">
-		<!-- Heading stays neutral because the two branches do different things: the
+{#if !$copilotInfo.workspaceDisabled}
+	<div class="my-3 p-3 bg-surface-secondary rounded-md relative flex flex-col gap-3">
+		<div class="flex flex-row gap-2 justify-between items-center">
+			<!-- Heading stays neutral because the two branches do different things: the
 		     hand-off runs the item, the legacy path fills the form. Each button
 		     names its own action. A plain Button rather than AskAiButton, whose own
 		     session branch would fire here too and open an empty session. -->
-		<h3 class="text-sm font-medium">AI can help with these inputs</h3>
-		<OpenInSessionButton
-			source={sessionSource}
-			label="Run in AI session"
-			tooltip="Open an AI session that picks inputs and runs this"
-			btnProps={{ iconOnly: false, startIcon: { icon: WandSparkles } }}
-		>
-			{#snippet fallback()}
-				<Button
-					unifiedSize="md"
-					startIcon={{ icon: WandSparkles }}
-					btnClasses={AIBtnClasses('default')}
-					on:click={fillFormWithAI}
-				>
-					Fill with AI
-				</Button>
-			{/snippet}
-		</OpenInSessionButton>
+			<h3 class="text-sm font-medium">AI can help with these inputs</h3>
+			<OpenInSessionButton
+				source={sessionSource}
+				label="Run in AI session"
+				tooltip="Open an AI session that picks inputs and runs this"
+				btnProps={{ iconOnly: false, startIcon: { icon: WandSparkles } }}
+			>
+				{#snippet fallback()}
+					<Button
+						unifiedSize="md"
+						startIcon={{ icon: WandSparkles }}
+						btnClasses={AIBtnClasses('default')}
+						on:click={fillFormWithAI}
+					>
+						Fill with AI
+					</Button>
+				{/snippet}
+			</OpenInSessionButton>
+		</div>
+		<div class="flex flex-row gap-2 items-center">
+			<p class="text-sm text-primary">
+				{instructions
+					? 'Instructions: ' + instructions
+					: 'No AI instructions provided. Click edit to add guidance for AI form filling.'}
+			</p>
+			<Button
+				color="light"
+				size="xs2"
+				startIcon={{
+					icon: Pencil
+				}}
+				iconOnly
+				on:click={onEditInstructions}
+			/>
+		</div>
 	</div>
-	<div class="flex flex-row gap-2 items-center">
-		<p class="text-sm text-primary">
-			{instructions
-				? 'Instructions: ' + instructions
-				: 'No AI instructions provided. Click edit to add guidance for AI form filling.'}
-		</p>
-		<Button
-			color="light"
-			size="xs2"
-			startIcon={{
-				icon: Pencil
-			}}
-			iconOnly
-			on:click={onEditInstructions}
-		/>
-	</div>
-</div>
+{/if}
diff --git a/frontend/src/lib/components/copilot/AIFormSettings.svelte b/frontend/src/lib/components/copilot/AIFormSettings.svelte
index 44151a01b3..ef627ace4b 100644
--- a/frontend/src/lib/components/copilot/AIFormSettings.svelte
+++ b/frontend/src/lib/components/copilot/AIFormSettings.svelte
@@ -3,6 +3,7 @@
 	import Label from '../Label.svelte'
 	import Toggle from '../Toggle.svelte'
 	import Tooltip from '../Tooltip.svelte'
+	import { copilotInfo } from '$lib/aiStore'
 
 	interface Props {
 		prompt?: string | undefined
@@ -12,35 +13,37 @@
 	let { prompt = $bindable(undefined), type = 'script' }: Props = $props()
 </script>
 
-<div>
-	<Toggle
-		textClass="font-medium"
-		size="xs"
-		checked={prompt !== undefined}
-		on:change={() => {
-			if (prompt !== undefined) {
-				prompt = undefined
-			} else {
-				prompt = ''
-			}
-		}}
-		options={{ right: `Enable filling ${type} inputs with AI` }}
-	/>
-	{#if prompt !== undefined}
-		<div transition:slide={{ duration: 120 }} class="mt-6">
-			<Label label="Additional prompt for AI">
-				{#snippet header()}
-					<Tooltip>
-						AI will use script description and each field description to fill the inputs form. In
-						addition, any prompt passed here will be used by AI to guide it. You can mention
-						specific fields and interaction between fields here.
-					</Tooltip>
-				{/snippet}
-				<textarea
-					bind:value={prompt}
-					placeholder="Instructions for the AI about how to fill the form"
-				></textarea>
-			</Label>
-		</div>
-	{/if}
-</div>
+{#if !$copilotInfo.workspaceDisabled}
+	<div>
+		<Toggle
+			textClass="font-medium"
+			size="xs"
+			checked={prompt !== undefined}
+			on:change={() => {
+				if (prompt !== undefined) {
+					prompt = undefined
+				} else {
+					prompt = ''
+				}
+			}}
+			options={{ right: `Enable filling ${type} inputs with AI` }}
+		/>
+		{#if prompt !== undefined}
+			<div transition:slide={{ duration: 120 }} class="mt-6">
+				<Label label="Additional prompt for AI">
+					{#snippet header()}
+						<Tooltip>
+							AI will use script description and each field description to fill the inputs form. In
+							addition, any prompt passed here will be used by AI to guide it. You can mention
+							specific fields and interaction between fields here.
+						</Tooltip>
+					{/snippet}
+					<textarea
+						bind:value={prompt}
+						placeholder="Instructions for the AI about how to fill the form"
+					></textarea>
+				</Label>
+			</div>
+		{/if}
+	</div>
+{/if}
diff --git a/frontend/src/lib/components/copilot/CronGen.svelte b/frontend/src/lib/components/copilot/CronGen.svelte
index 6a8dc6892e..94715a0f18 100644
--- a/frontend/src/lib/components/copilot/CronGen.svelte
+++ b/frontend/src/lib/components/copilot/CronGen.svelte
@@ -79,66 +79,68 @@
 	})
 </script>
 
-<Popover floatingConfig={{ strategy: 'absolute', placement: 'bottom-end' }}>
-	{#snippet trigger()}
-		<Button
-			color={genLoading ? 'red' : 'light'}
-			size="xs"
-			nonCaptureEvent={!genLoading}
-			startIcon={{ icon: Wand2 }}
-			iconOnly
-			title="AI Assistant"
-			btnClasses="text-ai bg-violet-100 dark:bg-gray-700"
-			loading={genLoading}
-			clickableWhileLoading
-			on:click={genLoading ? () => abortController?.abort() : () => {}}
-		/>
-	{/snippet}
-	{#snippet content({ close })}
-		<div class="border rounded-lg shadow-lg p-4 bg-surface">
-			{#if $copilotInfo.enabled}
-				<div class="flex w-96">
-					<input
-						bind:this={instructionsField}
-						type="text"
-						placeholder="CRON schedule description"
-						bind:value={instructions}
-						onkeypress={({ key }) => {
-							if (key === 'Enter' && instructions.length > 0) {
+{#if !$copilotInfo.workspaceDisabled}
+	<Popover floatingConfig={{ strategy: 'absolute', placement: 'bottom-end' }}>
+		{#snippet trigger()}
+			<Button
+				color={genLoading ? 'red' : 'light'}
+				size="xs"
+				nonCaptureEvent={!genLoading}
+				startIcon={{ icon: Wand2 }}
+				iconOnly
+				title="AI Assistant"
+				btnClasses="text-ai bg-violet-100 dark:bg-gray-700"
+				loading={genLoading}
+				clickableWhileLoading
+				on:click={genLoading ? () => abortController?.abort() : () => {}}
+			/>
+		{/snippet}
+		{#snippet content({ close })}
+			<div class="border rounded-lg shadow-lg p-4 bg-surface">
+				{#if $copilotInfo.enabled}
+					<div class="flex w-96">
+						<input
+							bind:this={instructionsField}
+							type="text"
+							placeholder="CRON schedule description"
+							bind:value={instructions}
+							onkeypress={({ key }) => {
+								if (key === 'Enter' && instructions.length > 0) {
+									close()
+									generateCron()
+								}
+							}}
+						/>
+						<Button
+							size="xs"
+							color="light"
+							variant="contained"
+							buttonType="button"
+							btnClasses="!ml-2 text-ai bg-violet-100 dark:bg-gray-700"
+							title="Generate CRON schedule from prompt"
+							aria-label="Generate"
+							iconOnly
+							on:click={() => {
 								close()
 								generateCron()
-							}
-						}}
-					/>
-					<Button
-						size="xs"
-						color="light"
-						variant="contained"
-						buttonType="button"
-						btnClasses="!ml-2 text-ai bg-violet-100 dark:bg-gray-700"
-						title="Generate CRON schedule from prompt"
-						aria-label="Generate"
-						iconOnly
-						on:click={() => {
-							close()
-							generateCron()
-						}}
-						disabled={instructions.length == 0}
-						startIcon={{ icon: Wand2 }}
-					/>
-				</div>
-			{:else}
-				<div class="block text-primary">
-					<p class="text-sm"
-						>Enable Windmill AI in the <a
-							href="{base}/workspace_settings?tab=ai"
-							target="_blank"
-							class="inline-flex flex-row items-center gap-1"
-							>workspace settings <ExternalLink size={16} /></a
-						></p
-					>
-				</div>
-			{/if}
-		</div>
-	{/snippet}
-</Popover>
+							}}
+							disabled={instructions.length == 0}
+							startIcon={{ icon: Wand2 }}
+						/>
+					</div>
+				{:else}
+					<div class="block text-primary">
+						<p class="text-sm"
+							>Enable Windmill AI in the <a
+								href="{base}/workspace_settings?tab=ai"
+								target="_blank"
+								class="inline-flex flex-row items-center gap-1"
+								>workspace settings <ExternalLink size={16} /></a
+							></p
+						>
+					</div>
+				{/if}
+			</div>
+		{/snippet}
+	</Popover>
+{/if}
diff --git a/frontend/src/lib/components/copilot/RegexGen.svelte b/frontend/src/lib/components/copilot/RegexGen.svelte
index e61ab5cbf2..f399726988 100644
--- a/frontend/src/lib/components/copilot/RegexGen.svelte
+++ b/frontend/src/lib/components/copilot/RegexGen.svelte
@@ -1,5 +1,5 @@
 <script lang="ts">
-	import { run } from 'svelte/legacy';
+	import { run } from 'svelte/legacy'
 
 	import { base } from '$lib/base'
 	import { Button } from '../common'
@@ -55,7 +55,7 @@
 
 	run(() => {
 		input && setTimeout(() => input?.focus(), 100)
-	});
+	})
 
 	let promptHistory: string[] = $state(JSON.parse(getPromptsRegex() || '[]'))
 
@@ -93,17 +93,17 @@
 	}
 </script>
 
-<Popover
-	floatingConfig={{
-		middleware: [
-			autoPlacement({
-				allowedPlacements: ['bottom-start', 'bottom-end', 'top-start', 'top-end', 'top', 'bottom']
-			})
-		]
-	}}
->
-	{#snippet trigger()}
-	
+{#if !$copilotInfo.workspaceDisabled}
+	<Popover
+		floatingConfig={{
+			middleware: [
+				autoPlacement({
+					allowedPlacements: ['bottom-start', 'bottom-end', 'top-start', 'top-end', 'top', 'bottom']
+				})
+			]
+		}}
+	>
+		{#snippet trigger()}
 			<Button
 				title="Generate regexes from prompt"
 				btnClasses="text-ai bg-violet-100 dark:bg-gray-700"
@@ -116,10 +116,8 @@
 				clickableWhileLoading
 				on:click={genLoading ? () => abortController?.abort() : () => {}}
 			/>
-		
-	{/snippet}
-	{#snippet content({ close })}
-	
+		{/snippet}
+		{#snippet content({ close })}
 			<div class="block text-primary p-4">
 				{#if $copilotInfo.enabled}
 					<div class="flex flex-col gap-4">
@@ -129,11 +127,11 @@
 								bind:this={input}
 								bind:value={funcDesc}
 								onkeypress={({ key }) => {
-								if (key === 'Enter' && funcDesc?.length > 0) {
-									close()
-									onGenerate()
-								}
-							}}
+									if (key === 'Enter' && funcDesc?.length > 0) {
+										close()
+										onGenerate()
+									}
+								}}
 								placeholder="Describe what the regex should do"
 							/>
 							<Button
@@ -183,6 +181,6 @@
 					</p>
 				{/if}
 			</div>
-		
-	{/snippet}
-</Popover>
+		{/snippet}
+	</Popover>
+{/if}
diff --git a/frontend/src/lib/components/copilot/ResourceGen.svelte b/frontend/src/lib/components/copilot/ResourceGen.svelte
index 34534285b4..2fc3cfa646 100644
--- a/frontend/src/lib/components/copilot/ResourceGen.svelte
+++ b/frontend/src/lib/components/copilot/ResourceGen.svelte
@@ -119,69 +119,71 @@
 	})
 </script>
 
-<Popover floatingConfig={{ strategy: 'absolute', placement: 'bottom-end' }}>
-	{#snippet trigger()}
-		<Button
-			color={genLoading ? 'red' : 'light'}
-			size="xs"
-			unifiedSize="md"
-			nonCaptureEvent={!genLoading}
-			startIcon={{ icon: Wand2 }}
-			iconOnly
-			title="AI Assistant"
-			btnClasses="text-ai bg-violet-100 dark:bg-gray-700"
-			loading={genLoading}
-			clickableWhileLoading
-			on:click={genLoading ? () => abortController?.abort() : () => {}}
-		/>
-	{/snippet}
-	{#snippet content({ close })}
-		<div class="border rounded-lg shadow-lg p-4 bg-surface">
-			{#if $copilotInfo.enabled}
-				<div class="flex flex-col w-80 gap-2">
-					<textarea
-						bind:this={instructionsField}
-						placeholder="Describe the resource values to generate..."
-						bind:value={instructions}
-						rows={3}
-						class="text-xs"
-						onkeydown={(e) => {
-							if (e.key === 'Enter' && !e.shiftKey && instructions.length > 0) {
-								e.preventDefault()
+{#if !$copilotInfo.workspaceDisabled}
+	<Popover floatingConfig={{ strategy: 'absolute', placement: 'bottom-end' }}>
+		{#snippet trigger()}
+			<Button
+				color={genLoading ? 'red' : 'light'}
+				size="xs"
+				unifiedSize="md"
+				nonCaptureEvent={!genLoading}
+				startIcon={{ icon: Wand2 }}
+				iconOnly
+				title="AI Assistant"
+				btnClasses="text-ai bg-violet-100 dark:bg-gray-700"
+				loading={genLoading}
+				clickableWhileLoading
+				on:click={genLoading ? () => abortController?.abort() : () => {}}
+			/>
+		{/snippet}
+		{#snippet content({ close })}
+			<div class="border rounded-lg shadow-lg p-4 bg-surface">
+				{#if $copilotInfo.enabled}
+					<div class="flex flex-col w-80 gap-2">
+						<textarea
+							bind:this={instructionsField}
+							placeholder="Describe the resource values to generate..."
+							bind:value={instructions}
+							rows={3}
+							class="text-xs"
+							onkeydown={(e) => {
+								if (e.key === 'Enter' && !e.shiftKey && instructions.length > 0) {
+									e.preventDefault()
+									close()
+									generateResource()
+								}
+							}}
+						></textarea>
+						<Button
+							size="xs"
+							color="light"
+							variant="contained"
+							buttonType="button"
+							btnClasses="text-ai bg-violet-100 dark:bg-gray-700"
+							title="Generate resource from prompt"
+							on:click={() => {
 								close()
 								generateResource()
-							}
-						}}
-					></textarea>
-					<Button
-						size="xs"
-						color="light"
-						variant="contained"
-						buttonType="button"
-						btnClasses="text-ai bg-violet-100 dark:bg-gray-700"
-						title="Generate resource from prompt"
-						on:click={() => {
-							close()
-							generateResource()
-						}}
-						disabled={instructions.length == 0}
-						startIcon={{ icon: Wand2 }}
-					>
-						Generate
-					</Button>
-				</div>
-			{:else}
-				<div class="block text-primary">
-					<p class="text-sm"
-						>Enable Windmill AI in the <a
-							href="{base}/workspace_settings?tab=ai"
-							target="_blank"
-							class="inline-flex flex-row items-center gap-1"
-							>workspace settings <ExternalLink size={16} /></a
-						></p
-					>
-				</div>
-			{/if}
-		</div>
-	{/snippet}
-</Popover>
+							}}
+							disabled={instructions.length == 0}
+							startIcon={{ icon: Wand2 }}
+						>
+							Generate
+						</Button>
+					</div>
+				{:else}
+					<div class="block text-primary">
+						<p class="text-sm"
+							>Enable Windmill AI in the <a
+								href="{base}/workspace_settings?tab=ai"
+								target="_blank"
+								class="inline-flex flex-row items-center gap-1"
+								>workspace settings <ExternalLink size={16} /></a
+							></p
+						>
+					</div>
+				{/if}
+			</div>
+		{/snippet}
+	</Popover>
+{/if}
diff --git a/frontend/src/lib/components/copilot/ScriptFix.svelte b/frontend/src/lib/components/copilot/ScriptFix.svelte
index d6ccb26ab8..f586ad1aaf 100644
--- a/frontend/src/lib/components/copilot/ScriptFix.svelte
+++ b/frontend/src/lib/components/copilot/ScriptFix.svelte
@@ -77,7 +77,7 @@
 	const sessionScopedManager = getContext<AIChatManager | undefined>('aiChatManager')
 </script>
 
-{#if SUPPORTED_LANGUAGES.has(lang)}
+{#if SUPPORTED_LANGUAGES.has(lang) && !$copilotInfo.workspaceDisabled}
 	{#if sessionScopedManager}
 		<Button
 			title="Fix the failing run in this chat"
diff --git a/frontend/src/lib/components/copilot/ScriptGen.svelte b/frontend/src/lib/components/copilot/ScriptGen.svelte
index 0c7156002d..fea738b8f1 100644
--- a/frontend/src/lib/components/copilot/ScriptGen.svelte
+++ b/frontend/src/lib/components/copilot/ScriptGen.svelte
@@ -355,7 +355,7 @@
 		</div>
 	{/if}
 {/if}
-{#if ($generatedCode.length === 0 || genLoading) && SUPPORTED_LANGUAGES.has(lang ?? '')}
+{#if ($generatedCode.length === 0 || genLoading) && SUPPORTED_LANGUAGES.has(lang ?? '') && !$copilotInfo.workspaceDisabled}
 	<Popover
 		floatingConfig={{
 			middleware: [
diff --git a/frontend/src/lib/components/copilot/StepGenQuick.svelte b/frontend/src/lib/components/copilot/StepGenQuick.svelte
index d09e554240..0be2fecb4c 100644
--- a/frontend/src/lib/components/copilot/StepGenQuick.svelte
+++ b/frontend/src/lib/components/copilot/StepGenQuick.svelte
@@ -1,5 +1,6 @@
 <script lang="ts">
 	import { workspaceStore } from '$lib/stores'
+	import { copilotInfo } from '$lib/aiStore'
 	import { ScriptService, type Script } from '$lib/gen'
 
 	import { Wand2, Loader2 } from 'lucide-svelte'
@@ -27,6 +28,7 @@
 		filteredItems = $bindable([])
 	}: Props = $props()
 	let prefilteredItems = $derived(scripts ?? [])
+	let aiHidden = $derived(disableAi || $copilotInfo.workspaceDisabled)
 
 	const dispatch = createEventDispatcher()
 
@@ -46,6 +48,10 @@
 
 	let input: TextInput | undefined = $state()
 
+	export function focus() {
+		input?.focus()
+	}
+
 	$effect(() => {
 		preFilter &&
 			setTimeout(() => {
@@ -76,7 +82,7 @@
 				onkeydown: (e) => {
 					if (e.key === 'Escape') dispatch('escape')
 				},
-				placeholder: `Search ${trigger ? 'triggers' : 'scripts'} ${disableAi ? '' : 'or AI gen'}`
+				placeholder: `Search ${trigger ? 'triggers' : 'scripts'} ${aiHidden ? '' : 'or AI gen'}`
 			}}
 			size="sm"
 		/>
@@ -85,7 +91,7 @@
 		{#if loading}
 			<Loader2 size={12} class="animate-spin text-gray-400" />
 		{/if}
-		{#if funcDesc?.length === 0 && !loading && !disableAi}
+		{#if funcDesc?.length === 0 && !loading && !aiHidden}
 			<Wand2 size={12} class="fill-current opacity-70 text-ai" />
 		{/if}
 	</div>
diff --git a/frontend/src/lib/components/copilot/StepInputsGen.svelte b/frontend/src/lib/components/copilot/StepInputsGen.svelte
index 5b1ddb741b..c9ef616aa5 100644
--- a/frontend/src/lib/components/copilot/StepInputsGen.svelte
+++ b/frontend/src/lib/components/copilot/StepInputsGen.svelte
@@ -226,7 +226,7 @@ input_name2: expression2
 				Fill inputs
 			{/if}
 		</Button>
-	{:else}
+	{:else if !$copilotInfo.workspaceDisabled}
 		<Popover
 			floatingConfig={{
 				placement: 'top-end'
diff --git a/frontend/src/lib/components/copilot/chat/AIButton.svelte b/frontend/src/lib/components/copilot/chat/AIButton.svelte
index ade1bd2d86..7420e8d6b7 100644
--- a/frontend/src/lib/components/copilot/chat/AIButton.svelte
+++ b/frontend/src/lib/components/copilot/chat/AIButton.svelte
@@ -38,7 +38,7 @@
 		{/snippet}
 		{@render button({ onPress: () => togglePanel() })}
 	</DarkPopover>
-{:else}
+{:else if !$copilotInfo.workspaceDisabled}
 	<Popover placement="bottom" class="h-full">
 		{#snippet trigger()}
 			{@render button({ onPress: () => togglePanel() })}
diff --git a/frontend/src/lib/components/copilot/chat/AIChat.svelte b/frontend/src/lib/components/copilot/chat/AIChat.svelte
index e4dba770eb..fd95613f2e 100644
--- a/frontend/src/lib/components/copilot/chat/AIChat.svelte
+++ b/frontend/src/lib/components/copilot/chat/AIChat.svelte
@@ -44,8 +44,12 @@
 
 	const isAdmin = $derived($userStore?.is_admin || $userStore?.is_super_admin)
 	const hasCopilot = $derived($copilotInfo.enabled)
+	// Another tab is running a turn on this session: transcript stays readable,
+	// composer locks, and the chat re-reads the shared record when the turn ends.
+	const runHeldElsewhere = $derived(aiChatManager.runHeldElsewhere)
 	const disabled = $derived(
 		forceDisabled ||
+			runHeldElsewhere ||
 			!hasCopilot ||
 			(aiChatManager.mode === AIMode.SCRIPT &&
 				aiChatManager.scriptEditorOptions?.lang &&
@@ -58,19 +62,25 @@
 	const disabledMessage = $derived(
 		forceDisabled
 			? forceDisabledMessage
-			: freeTierExhausted
-				? ''
-				: !hasCopilot
-					? $aiUserDisabled
-						? 'Windmill AI is disabled in your account settings'
-						: isAdmin
-							? `Enable Windmill AI in your [workspace settings](${base}/workspace_settings?tab=ai) to use this chat`
-							: 'Ask an admin to enable Windmill AI in this workspace to use this chat'
-					: aiChatManager.mode === AIMode.SCRIPT &&
-						  aiChatManager.scriptEditorOptions?.lang &&
-						  !SUPPORTED_CHAT_SCRIPT_LANGUAGES.includes(aiChatManager.scriptEditorOptions.lang)
-						? `Windmill AI does not support the ${aiChatManager.scriptEditorOptions.lang} language yet.`
-						: ''
+			: runHeldElsewhere
+				? // The typing indicator and the composer placeholder already carry
+					// this state; a footer note would say it a third time.
+					''
+				: freeTierExhausted
+					? ''
+					: !hasCopilot
+						? $copilotInfo.workspaceDisabled
+							? 'Windmill AI is hidden in this workspace'
+							: $aiUserDisabled
+								? 'Windmill AI is disabled in your account settings'
+								: isAdmin
+									? `Enable Windmill AI in your [workspace settings](${base}/workspace_settings?tab=ai) to use this chat`
+									: 'Ask an admin to enable Windmill AI in this workspace to use this chat'
+						: aiChatManager.mode === AIMode.SCRIPT &&
+							  aiChatManager.scriptEditorOptions?.lang &&
+							  !SUPPORTED_CHAT_SCRIPT_LANGUAGES.includes(aiChatManager.scriptEditorOptions.lang)
+							? `Windmill AI does not support the ${aiChatManager.scriptEditorOptions.lang} language yet.`
+							: ''
 	)
 
 	const suggestions = [
diff --git a/frontend/src/lib/components/copilot/chat/AIChatDisplay.svelte b/frontend/src/lib/components/copilot/chat/AIChatDisplay.svelte
index e485a208ea..699098c116 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatDisplay.svelte
+++ b/frontend/src/lib/components/copilot/chat/AIChatDisplay.svelte
@@ -35,8 +35,9 @@
 	import ChatQuickActions from './ChatQuickActions.svelte'
 	import ContextUsageIndicator from './ContextUsageIndicator.svelte'
 	import AIChatModelSettings from './AIChatModelSettings.svelte'
-	import McpConnections from './McpConnections.svelte'
-	import SkillsPicker from './SkillsPicker.svelte'
+	import AssistantSettingsModal from './AssistantSettingsModal.svelte'
+	import { SkillsMenu } from './skills/skillsMenu.svelte'
+	import { McpMenu } from '$lib/components/mcp/mcpMenu.svelte'
 	import ChatMode from './ChatMode.svelte'
 	import DatatableCreationPolicy from './DatatableCreationPolicy.svelte'
 	import Tooltip from '$lib/components/meltComponents/Tooltip.svelte'
@@ -207,8 +208,11 @@
 	} = $props()
 
 	let aiChatInput: AIChatInput | undefined = $state()
-	let mcpConnections: McpConnections | undefined = $state()
-	let skillsPicker: SkillsPicker | undefined = $state()
+	let assistantSettings: AssistantSettingsModal | undefined = $state()
+	// The "+" menu's skill and MCP rows: enough state to check and flip one, with
+	// everything else about them behind the assistant settings modal.
+	const skillsMenu = new SkillsMenu(aiChatManager, () => assistantSettings?.open('skills'))
+	const mcpMenu = new McpMenu(aiChatManager, () => assistantSettings?.open('mcp'))
 	let plusMenuOpen = $state(false)
 	let editingMessageIndex = $state<number | null>(null)
 
@@ -315,7 +319,10 @@
 		}
 	})
 
-	const showTypingIndicator = $derived(aiChatManager.loading)
+	// Also shown for a run held by another tab, labeled with where it is: the
+	// dots say a turn is in flight even before the reader reaches the footer
+	// note. Remote runs pause nothing and offer no Stop — this tab can't cancel.
+	const showTypingIndicator = $derived(aiChatManager.loading || aiChatManager.runHeldElsewhere)
 
 	// The manual `@` context-picker button. Shown in SCRIPT/FLOW (workspace items +
 	// code blocks) and APP (datatables, frontend files). Hidden in GLOBAL — there
@@ -571,8 +578,14 @@
 		(aiChatManager.flowAiChatHelpers?.hasPendingChanges() ?? false) &&
 			!aiChatManager.autoAcceptEditsActive
 	)
+	// A disabled state with no message (a remote hold, a spent free grant) keeps
+	// the footer toolbar in place — swapping it for an empty strip would make
+	// the model/mode row flash out and back on every remote turn. A state with
+	// a real message (archived, AI off) still shows it, hold or not, matching
+	// the precedence disabledMessage itself encodes.
+	const footerMessageShown = $derived(disabled && disabledMessage !== '')
 	const showFooterLeftControls = $derived(
-		!disabled &&
+		!footerMessageShown &&
 			(showContextPicker ||
 				showAutonomyModeSelector ||
 				(aiChatManager.mode === AIMode.SCRIPT && hasDiff))
@@ -673,10 +686,14 @@ the panel, or the Escape-to-stop focus check would wrongly reject them. -->
 									{#each pastChats as chat (chat.id)}
 										<button
 											class="text-left flex flex-row items-center gap-2 justify-between hover:bg-gray-100 dark:hover:bg-gray-700 rounded-md p-1 disabled:opacity-50 disabled:cursor-not-allowed disabled:hover:bg-transparent dark:disabled:hover:bg-transparent"
-											disabled={aiChatManager.loading || aiChatManager.sendInFlight}
-											title={aiChatManager.loading || aiChatManager.sendInFlight
-												? 'Stop the current answer to switch conversation'
-												: undefined}
+											disabled={aiChatManager.loading ||
+												aiChatManager.sendInFlight ||
+												aiChatManager.runHeldElsewhere}
+											title={aiChatManager.runHeldElsewhere
+												? 'Wait for the turn in the other tab to switch conversation'
+												: aiChatManager.loading || aiChatManager.sendInFlight
+													? 'Stop the current answer to switch conversation'
+													: undefined}
 											onclick={() => {
 												loadPastChat(chat.id)
 												close()
@@ -706,7 +723,10 @@ the panel, or the Escape-to-stop focus check would wrongly reject them. -->
 					{/snippet}
 				</Popover>
 				<Button
-					title="New chat"
+					title={aiChatManager.runHeldElsewhere
+						? 'Wait for the turn in the other tab to start a new chat'
+						: 'New chat'}
+					disabled={aiChatManager.runHeldElsewhere}
 					on:click={() => {
 						saveAndClear()
 					}}
@@ -770,17 +790,19 @@ the panel, or the Escape-to-stop focus check would wrongly reject them. -->
 							)}
 						>
 							<ChatTypingIndicator
-								loading={aiChatManager.loading}
+								loading={showTypingIndicator}
 								paused={waitingForUserAction}
-								label={aiChatManager.loadingLabel
-									? aiChatManager.loadingLabel
-									: aiChatManager.compacting
-										? 'Compacting conversation'
-										: aiChatManager.currentReasoningActive &&
-											  !aiChatManager.currentReply &&
-											  !aiChatManager.currentReasoning
-											? (aiChatManager.reasoningHiddenIndicatorLabel ?? 'Thinking')
-											: undefined}
+								label={aiChatManager.runHeldElsewhere
+									? 'Running in another tab'
+									: aiChatManager.loadingLabel
+										? aiChatManager.loadingLabel
+										: aiChatManager.compacting
+											? 'Compacting conversation'
+											: aiChatManager.currentReasoningActive &&
+												  !aiChatManager.currentReply &&
+												  !aiChatManager.currentReasoning
+												? (aiChatManager.reasoningHiddenIndicatorLabel ?? 'Thinking')
+												: undefined}
 							/>
 						</div>
 					{/if}
@@ -941,8 +963,8 @@ the panel, or the Escape-to-stop focus check would wrongly reject them. -->
 									const closeMenu = () => (plusMenuOpen = false)
 									const inGlobal = aiChatManager.mode === AIMode.GLOBAL
 									const [skillItems, mcpItems] = await Promise.all([
-										inGlobal ? skillsPicker?.menuItems(closeMenu) : undefined,
-										inGlobal ? mcpConnections?.menuItems(closeMenu) : undefined
+										inGlobal ? skillsMenu.items(closeMenu) : undefined,
+										inGlobal ? mcpMenu.items(closeMenu) : undefined
 									])
 									return [
 										{
@@ -1104,12 +1126,12 @@ the panel, or the Escape-to-stop focus check would wrongly reject them. -->
 								{/snippet}
 							</Tooltip>
 						{/if}
-						{#if aiChatManager.mode === AIMode.SCRIPT && hasDiff}
+						{#if aiChatManager.mode === AIMode.SCRIPT && hasDiff && !disabled}
 							<ChatQuickActions {askAi} {diffMode} />
 						{/if}
 					</div>
 				{/if}
-				{#if disabled}
+				{#if footerMessageShown}
 					<div class="text-primary text-xs my-2 px-2">
 						<Markdown md={disabledMessage} />
 					</div>
@@ -1125,10 +1147,12 @@ the panel, or the Escape-to-stop focus check would wrongly reject them. -->
 							<DatatableCreationPolicy />
 						{/if}
 						<ContextUsageIndicator />
-						<AIChatModelSettings />
+						<!-- Unconditional: this composer mounts only via `AIChat` ← `SessionWrapper`,
+						     and `sessionRuntime` locks a session to GLOBAL, where the settings
+						     modal's Instructions section owns the prompt entries. -->
+						<AIChatModelSettings promptSettings={false} />
 						{#if aiChatManager.mode === AIMode.GLOBAL}
-							<SkillsPicker bind:this={skillsPicker} />
-							<McpConnections bind:this={mcpConnections} />
+							<AssistantSettingsModal bind:this={assistantSettings} />
 						{/if}
 
 						{#if aiChatManager.mode === AIMode.APP && appContext && (appContext.inspectorElement || appContext.codeSelection)}
diff --git a/frontend/src/lib/components/copilot/chat/AIChatInput.svelte b/frontend/src/lib/components/copilot/chat/AIChatInput.svelte
index e87c2afa57..7f4514cd41 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatInput.svelte
+++ b/frontend/src/lib/components/copilot/chat/AIChatInput.svelte
@@ -129,6 +129,12 @@
 
 	// Generate mode-specific placeholder
 	const modePlaceholder = $derived.by(() => {
+		// The composer unlocks by itself when the other tab's turn ends, so the
+		// placeholder names what it is waiting on (the typing indicator says
+		// where the run is).
+		if (aiChatManager.runHeldElsewhere) {
+			return 'Waiting for the turn in the other tab to finish'
+		}
 		if (pendingQuestionToolCallId !== undefined) {
 			return 'Answer the question above'
 		}
diff --git a/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts b/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
index 3c0b1fb79b..43df13f78c 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
+++ b/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
@@ -501,7 +501,24 @@ export class AIChatManager {
 	openRunInPreview?: (a: { jobId: string; workspace: string; label: string }) => void
 	openArtifact?: (artifactId: string, name: string, version?: ArtifactVersionTarget) => void
 	closeArtifact?: (artifactId: string) => void
-	loading = $state<boolean>(false)
+	#loading = $state<boolean>(false)
+	get loading(): boolean {
+		return this.#loading
+	}
+	// An accessor so every run bracket — the send turn, manual compaction, a
+	// rollback — reports its transitions through one place, synchronously: the
+	// rising edge posts the cross-tab "running here" signal the moment the
+	// bracket opens (after the send's preflight awaits; the post-preflight
+	// guard covers that gap), and `loading` falls only after the turn's last
+	// saveChat, making the falling edge the "safe to re-read the record" signal.
+	set loading(v: boolean) {
+		if (v === this.#loading) return
+		this.#loading = v
+		this.onRunningChanged?.(v)
+	}
+	/** Sessions wiring (see sessionRuntime); undefined for the global
+	 *  side-panel chat, whose transcript no other tab renders. */
+	onRunningChanged: ((running: boolean) => void) | undefined = undefined
 	currentReply = $state<string>('')
 	currentReasoning = $state<string>('')
 	currentReasoningActive = $state<boolean>(false)
@@ -677,6 +694,14 @@ export class AIChatManager {
 	// sessions modules — and re-read on every system-message rebuild; the send
 	// path rebuilds after beforeSend, so a fork committed there is picked up.
 	sessionContextResolver: (() => SessionPromptContext | undefined) | undefined = undefined
+	// Whether another tab is running a turn on this session right now (sessions
+	// wiring, same seam as above). The composer locks on it, and sendRequest
+	// refuses on it — the refusal covers the send already in flight when the
+	// other tab's run signal arrives, which no disabled input can stop.
+	runHeldElsewhereResolver: (() => boolean) | undefined = undefined
+	get runHeldElsewhere(): boolean {
+		return this.runHeldElsewhereResolver?.() ?? false
+	}
 	// The page the side panel shows, stamped on each user message. Same seam as above:
 	// a page tab is an iframe in its own realm, so the tab model is the only place the
 	// chat can learn it. Undefined for a live editor — ACTIVE EDITOR covers those.
@@ -688,8 +713,8 @@ export class AIChatManager {
 	workspaceResolver: (() => string | undefined) | undefined = undefined
 
 	// The workspace every workspace-scoped chat action targets — skills, tool
-	// loop, logging, user-message context, and commit. Session-resolved when a
-	// resolver is set, else the globally-active workspace.
+	// loop, logging, user-message context, message rendering, and commit.
+	// Session-resolved when a resolver is set, else the globally-active workspace.
 	get operatingWorkspace(): string | undefined {
 		return this.workspaceResolver?.() ?? get(workspaceStore)
 	}
@@ -1056,6 +1081,16 @@ export class AIChatManager {
 	 * doesn't spawn a new job leaves nothing to re-trigger on. A turn that DOES
 	 * spawn another job resumes again when that one finishes, which is the point.
 	 */
+	#autoResumeRetry: ReturnType<typeof setTimeout> | undefined
+
+	#scheduleAutoResumeRetry() {
+		clearTimeout(this.#autoResumeRetry)
+		this.#autoResumeRetry = setTimeout(() => {
+			this.#autoResumeRetry = undefined
+			void this.#maybeAutoResumeFromJobs()
+		}, 5_000)
+	}
+
 	async #maybeAutoResumeFromJobs() {
 		if (this.#autoResuming) return
 		// Global/sessions chat only (the only mode with a jobs tray + preamble).
@@ -1066,6 +1101,17 @@ export class AIChatManager {
 		// Nothing to continue (empty chat), or the user is mid-compose — don't
 		// clobber their draft or auto-send it. Their eventual send carries the notes.
 		if (this.messages.length === 0 || this.instructions.trim()) return
+		// Another tab is driving: the synthetic send would only be refused, and
+		// the instructions staged below would then block every later auto-resume
+		// in this tab. The notes stay pending; re-checked shortly, because the
+		// hold can clear silently (staleness after a driver crash) with nothing
+		// else to fire this. When the driver instead ends its turn normally, its
+		// own resume carries the notes and this tab's catch-up clears the local
+		// copy — the re-check then finds nothing and stands down.
+		if (this.runHeldElsewhere) {
+			this.#scheduleAutoResumeRetry()
+			return
+		}
 		this.#autoResuming = true
 		try {
 			const count = this.pendingJobNotes.length
@@ -1104,6 +1150,8 @@ export class AIChatManager {
 		// Invalidate any in-flight poll so its post-await continuation can't write
 		// into the conversation we're switching to.
 		this.#jobPollGeneration++
+		clearTimeout(this.#autoResumeRetry)
+		this.#autoResumeRetry = undefined
 		this.backgroundJobs = []
 		this.pendingJobNotes = []
 	}
@@ -2075,7 +2123,10 @@ export class AIChatManager {
 	// pipeline surface when a /pipeline editor has registered helpers. Centralized
 	// so changeMode, refreshGlobalSkills, and setPipelineHelpers stay consistent —
 	// each rebuild would otherwise drop the pipeline augmentation the others added.
-	private configureGlobalMode = () => {
+	//
+	// Public because it is purely local, unlike `changeMode(GLOBAL)`, which also
+	// fires the three network refreshes.
+	configureGlobalMode = () => {
 		const systemMessage = prepareGlobalSystemMessage(getCustomPromptParts(AIMode.GLOBAL), {
 			previewTools: this.isSessionChat,
 			user: this.globalIdentity,
@@ -2302,6 +2353,10 @@ export class AIChatManager {
 	}
 
 	openChat = () => {
+		// Nothing may open the docked pane in a workspace that hid the assistant.
+		if (get(copilotInfo).workspaceDisabled) {
+			return
+		}
 		chatState.size = this.savedSize > 0 ? this.savedSize : DEFAULT_SIZE
 		localStorage.setItem('ai-chat-open', 'true')
 	}
@@ -2313,6 +2368,9 @@ export class AIChatManager {
 	}
 
 	toggleOpen = () => {
+		if (chatState.size === 0 && get(copilotInfo).workspaceDisabled) {
+			return
+		}
 		if (chatState.size > 0) {
 			this.savedSize = chatState.size
 		}
@@ -2832,6 +2890,41 @@ export class AIChatManager {
 			sendUserToast('This action needs the AI chat. Start an AI session to continue.', true)
 			return
 		}
+		// The workspace hid the assistant: every entry point is gone from the UI, so a turn
+		// reaching here comes from a path that missed the gate and would stream unseen.
+		if (!this.isSessionChat && get(copilotInfo).workspaceDisabled) {
+			sendUserToast('Windmill AI is hidden in this workspace.', true)
+			return
+		}
+		// Refused before anything mutates, so there is nothing to unwind: the
+		// draft (already taken by the composer) goes back where the user can see
+		// it, and the turn never starts. Only the message's own send restores it
+		// — a refused queued flush is re-queued by its caller (`accepted ===
+		// false`), and a copy here would double it. Paste tokens are expanded
+		// into the text, as the queue does, because the restore lanes carry no
+		// pastes.
+		if (this.runHeldElsewhere) {
+			if (options.synthetic) {
+				// Client-authored prompt (a job auto-resume), not user input: nothing
+				// to hand back and no toast. Releasing the staged text un-blocks the
+				// next auto-resume attempt, scheduled for when the hold clears.
+				this.instructions = ''
+				this.#scheduleAutoResumeRetry()
+			} else {
+				if (!options.queued) {
+					// Programmatic prompts (askAi, fix) stage their text in
+					// `this.instructions` and pass no option — fall back to it so
+					// they are handed back too.
+					this.restoreToInput(
+						expanded(chatDraft(options.instructions ?? this.instructions, options.pastes ?? [])),
+						options.images,
+						options.files
+					)
+				}
+				sendUserToast('This session is running in another tab. Your message was kept.', true)
+			}
+			return false
+		}
 		this.#sendsInFlight++
 		try {
 			return await this.sendRequestImpl(options)
@@ -3051,6 +3144,28 @@ export class AIChatManager {
 			)
 		}
 		const images = modelIsBlind ? [] : requestedImages
+		// Re-checks the wrapper's remote-run guard: a run announced by another tab
+		// during the upkeep awaits above would otherwise interleave two turns into
+		// one chat id. Resends are exempt — restartGeneration already truncated
+		// the transcript, so they run as the documented advisory race instead.
+		if (this.runHeldElsewhere && !options.resendReservationKey) {
+			this.#releaseOutgoingReservation(reservationKey)
+			if (options.synthetic) {
+				// Same as the wrapper guard: an internal prompt is released, not
+				// restored as a draft the user never wrote.
+				this.instructions = ''
+				this.#scheduleAutoResumeRetry()
+			} else {
+				// restoreToInput, not restoreInstructions: a draft typed during the
+				// awaits above occupies the composer, and this restore must merge
+				// into it (or queue), never be refused by it.
+				if (!options.queued) {
+					this.restoreToInput(expanded(chatDraft(this.instructions, pastes)), images, files)
+				}
+				sendUserToast('This session is running in another tab. Your message was kept.', true)
+			}
+			return false
+		}
 		const optimisticIndex = this.displayMessages.length
 		this.loading = true
 		// Create the abort controller before the (possibly slow) beforeSend pre-flight,
@@ -3892,6 +4007,29 @@ export class AIChatManager {
 			throw new Error('No user message found at the specified index')
 		}
 
+		// Refused before anything mutates: past this point the transcript is
+		// sliced and resend bytes are reserved, and the sendRequest guard could
+		// only refuse AFTER that damage — restoring nothing, since this path
+		// carries its text in `this.instructions`, not the options. The retry and
+		// edit controls check only local `loading`, so a remote run reaches here.
+		// An edit (newContent defined, even '': attachment-only edits exist) is
+		// restored with its pastes expanded into the text; a bare retry mutates
+		// nothing yet, so there is nothing to restore. Un-submitted context-chip
+		// edits are the one loss — the chips re-seed from the untouched message
+		// on the next edit.
+		if (this.runHeldElsewhere) {
+			if (newContent !== undefined) {
+				this.restoreToInput(
+					expanded(chatDraft(newContent, pastes ?? [])),
+					images ?? [],
+					files ?? []
+				)
+			}
+			// "Text", not "message": chip edits are the part that does not survive.
+			sendUserToast('This session is running in another tab. Your text was kept.', true)
+			return
+		}
+
 		// Resolve the API restart point BEFORE reserving bytes or truncating: a
 		// stale index must fail while nothing has been mutated, or the transcript
 		// would be left truncated with the reservation leaked. A negative index
@@ -4015,7 +4153,7 @@ export class AIChatManager {
 		this.onChatRotated?.(this.historyManager.getCurrentChatId())
 	}
 
-	loadPastChat = async (id: string) => {
+	loadPastChat = async (id: string, { preserveQueue = false } = {}) => {
 		// A turn commits into whatever transcript it finds when it ends, so swapping
 		// one in underneath it misfiles the turn — or duplicates it, when the loaded
 		// chat already carries the turn's own checkpoint. Gated on `sendInFlight`
@@ -4025,7 +4163,10 @@ export class AIChatManager {
 		if (chat) {
 			// Drop any message queued in the current conversation so it doesn't
 			// auto-send into the loaded one or linger as a card across the switch.
-			this.#clearQueue()
+			// `preserveQueue` is for reloads that are NOT a switch — a cross-tab
+			// catch-up re-reading the conversation on screen — where the queued
+			// draft is unsent user input the reload must not destroy.
+			if (!preserveQueue) this.#clearQueue()
 			// Stop the poller for the conversation being left before swapping in the
 			// loaded chat's jobs below.
 			this.clearBackgroundJobs()
diff --git a/frontend/src/lib/components/copilot/chat/AIChatManager.test.ts b/frontend/src/lib/components/copilot/chat/AIChatManager.test.ts
index 1292022d25..084dc2c040 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatManager.test.ts
+++ b/frontend/src/lib/components/copilot/chat/AIChatManager.test.ts
@@ -7,6 +7,7 @@ import type { ChatCompletionMessageParam } from 'openai/resources/chat/completio
 import type { DisplayMessage } from './shared'
 import type { AttachedImage } from './imageUtils'
 import { AIChatManager, AIMode, AIAutonomyMode } from './AIChatManager.svelte'
+import { makePasteToken } from './pasteTokens'
 import { chatState } from './sharedChatState.svelte'
 import { PLAN_MODE_MESSAGES } from './planModeMessages'
 import { runChatLoop } from './chatLoop'
@@ -3997,3 +3998,135 @@ describe('AIChatManager reasoning duration', () => {
 		expect(assistantDurations(manager)).toEqual([3_000, 7_000])
 	})
 })
+
+describe('AIChatManager cross-tab run seams', () => {
+	// The whole cross-tab feature hangs off these two seams: `loading`'s edges
+	// are the "running here" / "safe to re-read" signals, and the resolver is
+	// the advisory lock. Reverting `loading` to a plain $state field would
+	// silently disconnect every tab.
+	it('reports loading transitions, and only transitions, through onRunningChanged', () => {
+		const manager = new AIChatManager()
+		const seen: boolean[] = []
+		manager.onRunningChanged = (running) => seen.push(running)
+		manager.loading = true
+		manager.loading = true
+		manager.loading = false
+		manager.loading = false
+		expect(seen).toEqual([true, false])
+	})
+
+	it('refuses a send while another tab holds the run, keeping the draft', async () => {
+		const manager = new AIChatManager()
+		manager.isSessionChat = true
+		manager.runHeldElsewhereResolver = () => true
+
+		const accepted = await manager.sendRequest({ instructions: 'race loser' })
+
+		expect(accepted).toBe(false)
+		expect(mocks.runChatLoop).not.toHaveBeenCalled()
+		expect(manager.loading).toBe(false)
+		// restoreToInput falls back to the queued draft when no composer is
+		// mounted, so the refused text must surface there rather than vanish.
+		expect(manager.queuedMessage).toBe('race loser')
+	})
+
+	// A synthetic (auto-resume) prompt is client-authored: a refusal must
+	// release it rather than hand it back as a draft the user never wrote —
+	// staged instructions would otherwise block every later auto-resume.
+	it('releases a refused synthetic send instead of restoring it as a draft', async () => {
+		const manager = new AIChatManager()
+		manager.isSessionChat = true
+		manager.runHeldElsewhereResolver = () => true
+		manager.instructions = 'A background job just finished.'
+
+		const accepted = await manager.sendRequest({ synthetic: true })
+
+		expect(accepted).toBe(false)
+		expect(manager.instructions).toBe('')
+		expect(manager.queuedMessage).toBe('')
+	})
+
+	// The restore lanes carry no pastes, so a refusal must expand the tokens
+	// into the text — dangling markers with the content gone otherwise.
+	it('expands paste tokens into the text a refusal hands back', async () => {
+		const manager = new AIChatManager()
+		manager.isSessionChat = true
+		manager.runHeldElsewhereResolver = () => true
+		const paste = { id: 1, lines: 1, content: 'the pasted block' }
+
+		await manager.sendRequest({
+			instructions: `see ${makePasteToken(paste)}`,
+			pastes: [paste]
+		})
+
+		expect(manager.queuedMessage).toBe('see the pasted block')
+	})
+
+	// The wrapper's check runs before the attachment upkeep awaits; a run
+	// announced by another tab during that upkeep must still be refused before
+	// the turn takes visible effect.
+	it('refuses a run announced by another tab during the preflight awaits', async () => {
+		const manager = new AIChatManager()
+		manager.isSessionChat = true
+		let held = false
+		manager.runHeldElsewhereResolver = () => held
+		let releaseUpkeep: (() => void) | undefined
+		vi.spyOn(manager.attachedFiles, 'refreshFolders').mockImplementation(
+			() => new Promise<void>((resolve) => (releaseUpkeep = resolve))
+		)
+
+		const sending = manager.sendRequest({ instructions: 'racing turn' })
+		await vi.waitFor(() => expect(manager.sendInFlight).toBe(true))
+		held = true
+		releaseUpkeep?.()
+
+		expect(await sending).toBe(false)
+		expect(mocks.runChatLoop).not.toHaveBeenCalled()
+		expect(manager.loading).toBe(false)
+	})
+
+	it('refuses a retry/edit while another tab holds the run, before mutating the transcript', async () => {
+		const manager = new AIChatManager()
+		manager.isSessionChat = true
+		manager.displayMessages = [
+			{ role: 'user', content: 'original prompt', index: 0 },
+			{ role: 'assistant', content: 'original reply' }
+		] as DisplayMessage[]
+		manager.messages = [
+			{ role: 'user', content: 'original prompt' }
+		] as ChatCompletionMessageParam[]
+		manager.runHeldElsewhereResolver = () => true
+
+		await manager.restartGeneration(0, 'edited prompt')
+
+		expect(mocks.runChatLoop).not.toHaveBeenCalled()
+		expect(manager.displayMessages).toHaveLength(2)
+		expect(manager.messages).toHaveLength(1)
+		// The edited text survives the refusal via restoreToInput's queued-draft
+		// fallback.
+		expect(manager.queuedMessage).toBe('edited prompt')
+	})
+
+	// A cross-tab catch-up re-reads the conversation on screen; the queued
+	// draft is unsent user input (possibly the refusal's kept message) that
+	// this non-switch reload must not destroy — while a real conversation
+	// switch still drops it.
+	it('keeps the queued draft when a catch-up reload preserves it', async () => {
+		const manager = new AIChatManager()
+		manager.isSessionChat = true
+		vi.spyOn(manager.historyManager, 'loadPastChat').mockResolvedValue({
+			id: 'c1',
+			actualMessages: [],
+			displayMessages: [],
+			title: '',
+			lastModified: 1
+		} as never)
+
+		manager.queueMessage('kept across catch-up')
+		await manager.loadPastChat('c1', { preserveQueue: true })
+		expect(manager.queuedMessage).toBe('kept across catch-up')
+
+		await manager.loadPastChat('c1')
+		expect(manager.queuedMessage).toBe('')
+	})
+})
diff --git a/frontend/src/lib/components/copilot/chat/AIChatMessage.svelte b/frontend/src/lib/components/copilot/chat/AIChatMessage.svelte
index 61d9a47966..12553be961 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatMessage.svelte
+++ b/frontend/src/lib/components/copilot/chat/AIChatMessage.svelte
@@ -13,9 +13,21 @@
 	import { messageDraft, segments } from './chatDraft'
 	import { lineCountLabel } from './pasteTokens'
 	import ExpandableImage from '$lib/components/common/image/ExpandableImage.svelte'
+	import { workspaceStore } from '$lib/stores'
 
 	const aiChatManager = getAiChatManager()
 
+	// Paths in a message name items the chat's tools reach, so they resolve against the
+	// operating workspace, never `workspaceStore`: a fork session leaves the store on the
+	// navigated workspace, where a fork-only item resolves to nothing and the rest resolve
+	// to a different copy.
+	const messageWorkspace = $derived.by(() => {
+		// Registers the dependency that `operatingWorkspace`'s own untracked
+		// `get(workspaceStore)` cannot.
+		void $workspaceStore
+		return aiChatManager.operatingWorkspace
+	})
+
 	// Per-message expand/collapse state for paste chips shown in the bubble.
 	let expandedPastes = $state<Set<number>>(new Set())
 
@@ -119,7 +131,7 @@
 		{:else}
 			<div class={twMerge('text-sm py-1 px-2', message.role === 'tool' && 'text-primary py-0')}>
 				{#if message.role === 'assistant'}
-					<div class="px-[1px]"><AssistantMessage {message} /></div>
+					<div class="px-[1px]"><AssistantMessage {message} workspace={messageWorkspace} /></div>
 				{:else if message.role === 'tool'}
 					<div class="px-[1px]"
 						><ToolExecutionDisplay message={message as ToolDisplayMessage} /></div
diff --git a/frontend/src/lib/components/copilot/chat/AIChatModelSettings.svelte b/frontend/src/lib/components/copilot/chat/AIChatModelSettings.svelte
index 123768d3f3..9dd94fa4ea 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatModelSettings.svelte
+++ b/frontend/src/lib/components/copilot/chat/AIChatModelSettings.svelte
@@ -33,6 +33,13 @@
 		type ReasoningProviderModel
 	} from '../reasoningRegistry'
 
+	let {
+		/** Whether this dropdown carries the custom-prompt entries. Off where the surface
+		 * has an assistant settings modal — its Instructions section owns them there, and
+		 * two ways in would drift. The home composer has no such modal, so it keeps them. */
+		promptSettings = true
+	}: { promptSettings?: boolean } = $props()
+
 	const aiChatManager = getAiChatManager()
 	const AI_SETTINGS_HREF = `${base}/workspace_settings?tab=ai`
 
@@ -335,7 +342,9 @@
 			class="bg-surface-tertiary dark:border w-64 origin-top-right rounded-lg shadow-lg focus:outline-none py-1 text-xs"
 		>
 			<!-- Melt submenu: hover-opens and is floating-positioned (flips on screen edges). -->
-			<DropdownSubmenuItem item={paramItems(close)} {builders} meltItem={item} />
+			{#if promptSettings}
+				<DropdownSubmenuItem item={paramItems(close)} {builders} meltItem={item} />
+			{/if}
 
 			<div class="my-1 border-t border-border-light"></div>
 			<div class="px-3 pt-1.5 pb-1 text-2xs uppercase tracking-wide text-secondary">Model</div>
@@ -409,21 +418,24 @@
 	{/snippet}
 </DropdownV2>
 
-<AIPromptsModal
-	bind:open={modalOpen}
-	bind:customPrompts
-	scope={modalScope}
-	modes={[activeMode]}
-	readOnly={modalReadOnly}
-	{readOnlyReason}
-	onSave={modalReadOnly ? undefined : save}
-	onReset={reset}
-	{hasChanges}
-	title={modalScope === 'user' ? 'User AI prompt' : 'Workspace AI prompt'}
-	target="body"
-	fixedHeight="sm"
-	settingsHref={isAdmin ? AI_SETTINGS_HREF : undefined}
-/>
+<!-- Only where the entries that open it are rendered. -->
+{#if promptSettings}
+	<AIPromptsModal
+		bind:open={modalOpen}
+		bind:customPrompts
+		scope={modalScope}
+		modes={[activeMode]}
+		readOnly={modalReadOnly}
+		{readOnlyReason}
+		onSave={modalReadOnly ? undefined : save}
+		onReset={reset}
+		{hasChanges}
+		title={modalScope === 'user' ? 'User AI prompt' : 'Workspace AI prompt'}
+		target="body"
+		fixedHeight="sm"
+		settingsHref={isAdmin ? AI_SETTINGS_HREF : undefined}
+	/>
+{/if}
 
 <style>
 	/* Lean reasoning slider: a thin track and a small, borderless accent thumb. Native range
diff --git a/frontend/src/lib/components/copilot/chat/AiChatLayout.svelte b/frontend/src/lib/components/copilot/chat/AiChatLayout.svelte
index 1a9df4816c..4f3ef368ad 100644
--- a/frontend/src/lib/components/copilot/chat/AiChatLayout.svelte
+++ b/frontend/src/lib/components/copilot/chat/AiChatLayout.svelte
@@ -7,6 +7,7 @@
 	import { userStore, workspaceStore } from '$lib/stores'
 	import { chatState } from './sharedChatState.svelte'
 	import { loadCopilot } from '$lib/components/copilot/loadCopilot'
+	import { copilotInfo } from '$lib/aiStore'
 	import { aiChatManager } from './AIChatManager.svelte'
 	import { onDestroy } from 'svelte'
 	import Button from '$lib/components/common/button/Button.svelte'
@@ -66,6 +67,14 @@
 		}
 	})
 
+	// The pane restores its last open state from localStorage before the config can say
+	// the workspace hid the assistant; close it as soon as that is known.
+	$effect(() => {
+		if ($copilotInfo.workspaceDisabled && chatState.size > 0) {
+			aiChatManager.closeChat()
+		}
+	})
+
 	const historyManager = aiChatManager.historyManager
 	historyManager.init()
 
diff --git a/frontend/src/lib/components/copilot/chat/AssistantFilesSection.svelte b/frontend/src/lib/components/copilot/chat/AssistantFilesSection.svelte
new file mode 100644
index 0000000000..bae2f7bf32
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/AssistantFilesSection.svelte
@@ -0,0 +1,158 @@
+<!--
+@component
+The Files & folders section of the assistant settings modal: everything linked to this
+chat, whether it is readable, and the way to unlink it.
+
+Attaching happens in the composer — this is where what is already attached is accounted
+for, which is the one place the difference between "attached" and "readable" is visible.
+-->
+<script lang="ts">
+	import { Button, ListRow, Section } from '$lib/components/common'
+	import EmptyState from '$lib/components/common/emptyState/EmptyState.svelte'
+	import ConfirmationModal from '$lib/components/common/confirmationModal/ConfirmationModal.svelte'
+	import { FileText, Folder, Paperclip, Unlink } from 'lucide-svelte'
+	import { getAiChatManager } from './aiChatManagerContext'
+	import { attachmentStatusLabel, countReadyAttachments } from './agentContext'
+
+	let {
+		count = $bindable(),
+		blocksClose = $bindable()
+	}: {
+		/** Attachments the assistant can actually read, for the sidebar badge. */
+		count: number
+		/** True while the confirmation is up, so the modal leaves the keys to it. */
+		blocksClose: boolean
+	} = $props()
+
+	const aiChatManager = getAiChatManager()
+
+	let folders = $derived(aiChatManager.attachedFiles.folders)
+	// Files dropped on a past message are listed alongside the session's own: the
+	// composer's bar hides them because their chip lives on that message, but the
+	// assistant reads them like any other row.
+	let files = $derived([
+		...aiChatManager.attachedFiles.standalone,
+		...aiChatManager.attachedFiles.messageAttached
+	])
+	let messageScoped = $derived(
+		new Set(aiChatManager.attachedFiles.messageAttached.map((f) => f.id))
+	)
+	let total = $derived(folders.length + files.length)
+	let ready = $derived(countReadyAttachments(folders, files))
+
+	let pendingDetach = $state<{ kind: 'file' | 'folder'; name: string } | undefined>(undefined)
+
+	$effect(() => {
+		count = ready
+	})
+	$effect(() => {
+		blocksClose = pendingDetach !== undefined
+	})
+
+	function detach(target: { kind: 'file' | 'folder'; name: string }) {
+		if (target.kind === 'folder') aiChatManager.attachedFiles.removeFolder(target.name)
+		else aiChatManager.attachedFiles.removeFile(target.name)
+		pendingDetach = undefined
+	}
+</script>
+
+<Section
+	label="Files & folders"
+	description="Files and folders linked to this chat, which the assistant can open and search."
+	class="flex flex-col gap-4"
+>
+	{#snippet action()}
+		{#if total > 0}
+			<!-- Both numbers when they differ: one count under a heading about what the
+			     assistant can use would hide the rows it cannot open. -->
+			<span class="shrink-0 text-2xs text-secondary tabular-nums">
+				{ready === total ? `${total} usable` : `${ready} of ${total} usable`}
+			</span>
+		{/if}
+	{/snippet}
+
+	{#if total === 0}
+		<EmptyState
+			icon={Paperclip}
+			title="Nothing attached"
+			description="Drop a file or a folder on the chat, or use the paperclip in the composer, and the assistant can open and search it."
+		/>
+	{:else}
+		<div class="flex flex-col gap-0.5">
+			{#each folders as folder (folder.name)}
+				{#snippet icon()}
+					<Folder size={16} class="text-tertiary" />
+				{/snippet}
+				{#snippet title()}
+					<span class="truncate leading-5">{folder.name}</span>
+					{@const label = attachmentStatusLabel(folder.status)}
+					{#if label}
+						<span class="shrink-0 text-2xs font-normal text-hint">{label}</span>
+					{/if}
+				{/snippet}
+				{#snippet subtitle()}
+					{folder.files.length}
+					{folder.files.length === 1 ? 'file' : 'files'}
+				{/snippet}
+				{#snippet trailing()}
+					<Button
+						unifiedSize="sm"
+						variant="subtle"
+						startIcon={{ icon: Unlink }}
+						iconOnly
+						title="Unlink folder"
+						onClick={() => (pendingDetach = { kind: 'folder', name: folder.name })}
+					/>
+				{/snippet}
+				<ListRow {icon} {title} {subtitle} {trailing} />
+			{/each}
+			{#each files as file (file.id ?? file.name)}
+				{#snippet icon()}
+					<FileText size={16} class="text-tertiary" />
+				{/snippet}
+				{#snippet title()}
+					<span class="truncate leading-5">{file.name}</span>
+					{@const label = attachmentStatusLabel(file.status)}
+					{#if label}
+						<span class="shrink-0 text-2xs font-normal text-hint">{label}</span>
+					{/if}
+				{/snippet}
+				{#snippet subtitle()}
+					Attached to a message
+				{/snippet}
+				{#snippet trailing()}
+					<Button
+						unifiedSize="sm"
+						variant="subtle"
+						startIcon={{ icon: Unlink }}
+						iconOnly
+						title="Unlink file"
+						onClick={() => (pendingDetach = { kind: 'file', name: file.name })}
+					/>
+				{/snippet}
+				<!-- A message-scoped row has no unlink here: those are rebuilt from the
+				     transcript on every load, so `removeFile` refuses them and the chip on the
+				     message is what actually drops one. -->
+				<ListRow
+					{icon}
+					{title}
+					subtitle={messageScoped.has(file.id) ? subtitle : undefined}
+					trailing={messageScoped.has(file.id) ? undefined : trailing}
+				/>
+			{/each}
+		</div>
+	{/if}
+</Section>
+
+<ConfirmationModal
+	open={pendingDetach !== undefined}
+	title={pendingDetach?.kind === 'folder' ? 'Unlink folder' : 'Unlink file'}
+	confirmationText="Unlink"
+	onConfirmed={() => pendingDetach && detach(pendingDetach)}
+	onCanceled={() => (pendingDetach = undefined)}
+>
+	<span class="text-xs text-primary">
+		The assistant loses access to <span class="font-semibold">{pendingDetach?.name}</span>. Nothing
+		is deleted from your disk, and you can attach it again from the composer.
+	</span>
+</ConfirmationModal>
diff --git a/frontend/src/lib/components/copilot/chat/AssistantInstructionsSection.svelte b/frontend/src/lib/components/copilot/chat/AssistantInstructionsSection.svelte
new file mode 100644
index 0000000000..47f25b6c09
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/AssistantInstructionsSection.svelte
@@ -0,0 +1,354 @@
+<!--
+@component
+The Instructions section of the assistant settings modal: the two blocks of custom
+instructions the system prompt carries — the workspace one an admin sets for everyone,
+and the user one stored in this browser — a tab each, both editable in place. One Save
+writes whichever of the two changed, including the tab that is not on screen.
+-->
+<script lang="ts">
+	import { Button, Section, Tab, TabContent, Tabs } from '$lib/components/common'
+	import Description from '$lib/components/Description.svelte'
+	import TextInput from '$lib/components/text_input/TextInput.svelte'
+	import Alert from '$lib/components/common/alert/Alert.svelte'
+	import {
+		copilotInfo,
+		getUserCustomPrompts,
+		setCopilotInfo,
+		setUserCustomPrompts
+	} from '$lib/aiStore'
+	import { WorkspaceService } from '$lib/gen'
+	import { userStore, type UserExt } from '$lib/stores'
+	import { getUserExt } from '$lib/user'
+	import { sendUserToast } from '$lib/toast'
+	import { base } from '$lib/base'
+	import { Building2, ExternalLink, User } from 'lucide-svelte'
+	import { untrack } from 'svelte'
+	import { getAiChatManager } from './aiChatManagerContext'
+
+	let {
+		ws,
+		active,
+		blocksClose = $bindable()
+	}: {
+		/** The workspace the chat operates on, which is not always the one on screen. */
+		ws: string
+		/** Whether this is the panel on screen. The workspace half costs a settings read,
+		 * so it is fetched when someone looks at instructions rather than on every open
+		 * of the modal. */
+		active: boolean
+		/** True while this section is in the middle of something the modal must not
+		 * close under — here, instructions typed and not yet saved. */
+		blocksClose: boolean
+	} = $props()
+
+	const MAX_PROMPT_LENGTH = 5000
+
+	const aiChatManager = getAiChatManager()
+	// The section acts on `ws`, which in a session is not the nav workspace, so the link
+	// has to name it or it opens settings the user may not administer.
+	let aiSettingsHref = $derived(`${base}/workspace_settings?workspace=${ws}&tab=ai`)
+
+	let mode = $derived(aiChatManager.mode)
+	let tab = $state<'workspace' | 'user'>('workspace')
+	let note = $derived(
+		tab === 'workspace'
+			? `Applies to everyone in ${ws}.`
+			: 'Stored in this browser and sent in every workspace, so they follow you rather than the workspace.'
+	)
+	// `$userStore.is_admin` is the role in the nav workspace, not necessarily in `ws`, so
+	// the resolved role is keyed to the workspace it was read for, and an unresolved one
+	// reads as no admin: offering the field and taking it away on resolve would discard
+	// whatever was typed in between. Superadmin holds everywhere.
+	let targetRole = $state<{ workspace: string; user: UserExt | undefined } | undefined>(undefined)
+	let roleRead = $derived(targetRole?.workspace === ws ? targetRole : undefined)
+	let navIsTarget = $derived($userStore?.workspace_id === ws)
+	let roleForTarget = $derived(roleRead?.user)
+	let roleResolved = $derived(roleRead !== undefined || navIsTarget)
+	// A read that came back with no user: read-only like a non-admin, but said differently,
+	// since a failed lookup is not evidence of the role it failed to read.
+	let roleUnknown = $derived(roleRead !== undefined && !roleRead.user && !navIsTarget)
+	let isAdmin = $derived(
+		Boolean(
+			$userStore?.is_super_admin ||
+				(roleForTarget ? roleForTarget.is_admin : navIsTarget && $userStore?.is_admin)
+		)
+	)
+
+	// A session whose fork is still staged has no workspace of its own yet, so `ws`
+	// resolves to the PARENT. Saving here would edit the live parent's shared AI config,
+	// which every chat still in it would then be given.
+	function pendingForkParent(): string | undefined {
+		return aiChatManager.sessionContextResolver?.()?.pendingForkOf
+	}
+	let forkPending = $derived(pendingForkParent() !== undefined)
+
+	// What is on screen, against what was loaded. Two pairs rather than one: the halves
+	// are stored in different places and save through different calls, and only the one
+	// that changed should be written.
+	let workspaceDraft = $state('')
+	let workspaceSaved = $state('')
+	let userDraft = $state('')
+	let userSaved = $state('')
+	let loading = $state(false)
+	let saving = $state(false)
+
+	// True when the workspace has no AI providers of its own (it uses instance defaults).
+	// In that case the backend never makes workspace custom_prompts effective, so a saved
+	// workspace prompt would be dead config — mirror the settings page and show it read-only.
+	let workspaceMissingProviders = $state(false)
+	let workspaceReadOnly = $derived(!isAdmin || workspaceMissingProviders || forkPending)
+	let readOnlyReason = $derived(
+		forkPending
+			? `This session has not created its workspace yet, so these would be saved to "${pendingForkParent()}" and given to every chat already in it. Send a message first.`
+			: !roleResolved
+				? `Checking your access to ${ws}.`
+				: roleUnknown
+					? `Could not read your access to ${ws}. Reopen this section to try again.`
+					: !isAdmin
+						? 'Only workspace admins can edit the workspace instructions.'
+						: 'This workspace uses instance AI defaults, so a workspace prompt would have no effect. Configure workspace AI providers in AI settings first.'
+	)
+
+	let workspaceChanged = $derived(!workspaceReadOnly && workspaceDraft !== workspaceSaved)
+	let userChanged = $derived(userDraft !== userSaved)
+	let dirty = $derived(workspaceChanged || userChanged)
+
+	$effect(() => {
+		blocksClose = dirty
+	})
+
+	// Loaded on the first look and again on a workspace switch: B's instructions must not
+	// be saved over A's. A reload drops a draft, so it waits until one is saved or
+	// reverted — hence `dirty` tracked, and `loadedWorkspace` to pick the wait up against
+	// whatever `ws` is by then (a staged fork commits into a workspace of its own).
+	let loadSeq = 0
+	let loadedWorkspace: string | undefined = undefined
+	$effect(() => {
+		const target = ws
+		const shown = active
+		const clean = !dirty
+		untrack(() => {
+			// Parked: read again on the next visit, since the workspace half is editable
+			// from the settings page too.
+			if (!shown) {
+				loadedWorkspace = undefined
+				return
+			}
+			if (!target || !clean || target === loadedWorkspace) return
+			loadedWorkspace = target
+			void load(target)
+		})
+	})
+
+	async function load(target: string) {
+		const seq = ++loadSeq
+		loading = true
+		try {
+			const resolved = await getUserExt(target).catch(() => undefined)
+			if (seq !== loadSeq) return
+			targetRole = { workspace: target, user: resolved }
+			const user = getUserCustomPrompts()[mode] ?? ''
+			// Seeded from the same source `saveWorkspace` writes to (the raw workspace
+			// ai_config), which also says whether the workspace has providers of its own.
+			// Non-admins cannot read raw settings, so they get the effective prompt.
+			let workspace = $copilotInfo.customPrompts?.[mode] ?? ''
+			let missingProviders = false
+			if (isAdmin) {
+				try {
+					const settings = await WorkspaceService.getSettings({ workspace: target })
+					missingProviders = Object.keys(settings?.ai_config?.providers ?? {}).length === 0
+					workspace = settings?.ai_config?.custom_prompts?.[mode] ?? ''
+				} catch (err) {
+					sendUserToast(`Failed to load workspace AI prompt: ${err}`, true)
+				}
+			}
+			if (seq !== loadSeq) return
+			workspaceMissingProviders = missingProviders
+			// Read before the assignments below move the baseline they compare against.
+			// Each half is then seeded only while it still holds what it was loaded with:
+			// the effect that starts this checks `dirty` before the request, not after it,
+			// so an admin who opens the tab and types straight away would otherwise have
+			// the settings response land on top of the text they are in the middle of.
+			const keepWorkspaceDraft = workspaceChanged
+			const keepUserDraft = userChanged
+			workspaceSaved = workspace
+			if (!keepWorkspaceDraft) workspaceDraft = workspace
+			userSaved = user
+			if (!keepUserDraft) userDraft = user
+		} finally {
+			if (seq === loadSeq) loading = false
+		}
+	}
+
+	/** Escape puts the fields back rather than closing the modal: `blocksClose` holds the
+	 * modal shut while there is unsaved text, so this is the way out of a draft, and a
+	 * second press then closes. */
+	function onKeydown(event: KeyboardEvent) {
+		// Only while this is the section on screen: every section stays mounted, so an
+		// Escape meant for another one would revert these drafts with nothing visible
+		// to say that it had.
+		if (!active || event.key !== 'Escape' || !dirty) return
+		event.preventDefault()
+		event.stopPropagation()
+		workspaceDraft = workspaceSaved
+		userDraft = userSaved
+	}
+
+	async function save() {
+		saving = true
+		try {
+			if (userChanged) saveUser(userDraft.trim())
+			if (workspaceChanged) await saveWorkspace(workspaceDraft.trim())
+		} finally {
+			saving = false
+		}
+	}
+
+	function saveUser(value: string) {
+		const prompts = getUserCustomPrompts()
+		if (value) {
+			prompts[mode] = value
+		} else {
+			delete prompts[mode]
+		}
+		setUserCustomPrompts(prompts)
+		// These live in localStorage, which nothing observes, so the chat is told rather
+		// than left to pick them up on its next send. `update_user_instructions` already
+		// rebuilds this way when the assistant edits the same block.
+		aiChatManager.rebuildGlobalSystemMessage()
+		userSaved = value
+		userDraft = value
+		sendUserToast('User instructions were saved')
+	}
+
+	async function saveWorkspace(value: string) {
+		const parent = pendingForkParent()
+		if (parent !== undefined) {
+			sendUserToast(
+				`This session has not created its workspace yet, so the instructions would be saved to "${parent}". Send a message first.`,
+				true
+			)
+			return
+		}
+		// Pinned across both awaits: the read and the write have to land on one workspace.
+		const target = ws
+		try {
+			// Saving prompts requires a full ai_config round-trip; fetch the current config
+			// so we don't clobber providers/models/etc.
+			const settings = await WorkspaceService.getSettings({ workspace: target })
+			const config = settings.ai_config ?? {}
+			const custom_prompts = { ...(config.custom_prompts ?? {}) }
+			if (value) {
+				custom_prompts[mode] = value
+			} else {
+				delete custom_prompts[mode]
+			}
+			const response = await WorkspaceService.editCopilotConfig({
+				workspace: target,
+				requestBody: { ...config, custom_prompts }
+			})
+			setCopilotInfo(response.effective_ai_config)
+			workspaceSaved = value
+			workspaceDraft = value
+			sendUserToast('Workspace instructions were saved')
+		} catch (err) {
+			// The field keeps what was typed, so the save can be retried.
+			sendUserToast(`Failed to save workspace AI prompt: ${err}`, true)
+		}
+	}
+</script>
+
+<svelte:window onkeydown={onKeydown} />
+
+{#snippet field(p: { value: string; readOnly: boolean; onInput: (v: string) => void })}
+	<div class="flex flex-col gap-1">
+		<TextInput
+			value={p.value}
+			underlyingInputEl="textarea"
+			size="sm"
+			class="min-h-24 resize-y"
+			inputProps={{
+				placeholder: p.readOnly ? '' : 'Anything the assistant should always keep in mind',
+				rows: 4,
+				maxlength: MAX_PROMPT_LENGTH,
+				// Also while saving: the write spans two requests and its success path puts the
+				// submitted value back, so text typed in between would be swallowed. `load`
+				// keeps a newer draft instead, because it starts on its own and must not block
+				// someone who opened the tab to type.
+				readonly: p.readOnly || saving,
+				oninput: (e) => p.onInput(e.currentTarget.value)
+			}}
+		/>
+		{#if !p.readOnly}
+			<span class="self-end text-2xs text-hint">
+				{p.value.length}/{MAX_PROMPT_LENGTH} characters
+			</span>
+		{/if}
+	</div>
+{/snippet}
+
+<Section
+	label="Instructions"
+	description="Text added to every system prompt in this workspace, on top of the assistant's own. Both blocks are sent, the workspace one first."
+	class="flex flex-col gap-4"
+>
+	{#snippet action()}
+		<div class="flex items-center gap-2 shrink-0">
+			{#if isAdmin}
+				<Button
+					href={aiSettingsHref}
+					target="_blank"
+					variant="subtle"
+					unifiedSize="sm"
+					endIcon={{ icon: ExternalLink }}
+				>
+					AI settings
+				</Button>
+			{/if}
+			<Button
+				variant="accent"
+				unifiedSize="sm"
+				disabled={!dirty || saving || loading}
+				onClick={save}
+			>
+				Save
+			</Button>
+		</div>
+	{/snippet}
+
+	<Tabs values={['workspace', 'user']} bind:selected={tab}>
+		<Tab value="workspace" label="Workspace" icon={Building2} />
+		<Tab value="user" label="User (you)" icon={User} />
+		{#snippet content()}
+			<!-- The note belongs to the panel rather than to either tab: one element that
+			     follows the selection, so switching tabs does not rebuild it and the space
+			     under the tab row is the same on both. The wrapper carries no padding of its
+			     own — `Tabs` renders the row and this content as two roots, so the Section's
+			     `gap-4` is already the space between them. -->
+			<div class="flex flex-col gap-2">
+				<Description>{note}</Description>
+				{#if workspaceReadOnly && tab === 'workspace'}
+					<Alert type="info" title="These are read-only for you" size="xs">
+						{readOnlyReason}
+					</Alert>
+				{/if}
+				<!-- `alwaysMounted`: Save writes whichever half changed, including the tab that
+				     is not on screen, so a field left with unsaved text has to go on holding it. -->
+				<TabContent value="workspace" alwaysMounted>
+					{@render field({
+						value: workspaceDraft,
+						readOnly: workspaceReadOnly,
+						onInput: (v) => (workspaceDraft = v)
+					})}
+				</TabContent>
+				<TabContent value="user" alwaysMounted>
+					{@render field({
+						value: userDraft,
+						readOnly: false,
+						onInput: (v) => (userDraft = v)
+					})}
+				</TabContent>
+			</div>
+		{/snippet}
+	</Tabs>
+</Section>
diff --git a/frontend/src/lib/components/copilot/chat/AssistantMcpSection.svelte b/frontend/src/lib/components/copilot/chat/AssistantMcpSection.svelte
new file mode 100644
index 0000000000..9440aa8f58
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/AssistantMcpSection.svelte
@@ -0,0 +1,632 @@
+<!--
+@component
+The MCP connections section of the assistant settings modal: the form that connects
+an external MCP server to this chat, and the servers already connected, each with the
+switch that decides whether this chat carries its tools.
+-->
+<script lang="ts">
+	import { Button, ListRow, Section } from '$lib/components/common'
+	import EmptyState from '$lib/components/common/emptyState/EmptyState.svelte'
+	import Alert from '$lib/components/common/alert/Alert.svelte'
+	import PagedContent from '$lib/components/common/modal/PagedContent.svelte'
+	import McpConnect from '$lib/components/mcp/McpConnect.svelte'
+	import ResourceEditor from '$lib/components/ResourceEditor.svelte'
+	import DropdownV2 from '$lib/components/DropdownV2.svelte'
+	import Toggle from '$lib/components/Toggle.svelte'
+	import { isMcpEnabled, setMcpEnabled } from '$lib/components/mcp/enabledServers'
+	import { loadProviderIcon } from '$lib/components/mcp/providerIcon'
+	import {
+		cachedProviderKey,
+		forgetProviderKey,
+		rememberProviderKey
+	} from '$lib/components/mcp/iconCache'
+	import ConfirmationModal from '$lib/components/common/confirmationModal/ConfirmationModal.svelte'
+	import type { Component } from 'svelte'
+	import { ResourceService } from '$lib/gen'
+	import { sendUserToast } from '$lib/toast'
+	import { ArrowLeft, Loader2, Pencil, Plug, Plus, Trash2 } from 'lucide-svelte'
+	import { draftValuesEqual } from '$lib/userDraft.svelte'
+	import { untrack } from 'svelte'
+	import { getAiChatManager } from './aiChatManagerContext'
+	import { clearMcpToolsCache } from './global/mcpTools'
+
+	let {
+		ws,
+		active,
+		count = $bindable(),
+		blocksClose = $bindable()
+	}: {
+		/** The workspace the chat operates on, which is not always the one on screen. */
+		ws: string
+		/** Whether this is the panel on screen. Gates the connect page's build, which
+		 * costs a read of the instance OAuth connects — not worth paying for on a modal
+		 * opened for one of the other three sections. */
+		active: boolean
+		/** Number of connected servers, for the sidebar badge. */
+		count: number
+		/** True while this section is in the middle of something the modal must not
+		 * close under: its confirmation, or the connect form holding a half-filled
+		 * connection. */
+		blocksClose: boolean
+	} = $props()
+
+	const aiChatManager = getAiChatManager()
+
+	// A session whose fork is still staged has no workspace of its own yet, so `ws`
+	// resolves to the PARENT. Connecting or editing here would write the resource and
+	// its token into the live parent, and a switch would be stored under it and quietly
+	// stop applying the moment the first send commits the fork. Read at use, not once:
+	// the fork commits mid-session.
+	function pendingForkParent(): string | undefined {
+		return aiChatManager.sessionContextResolver?.()?.pendingForkOf
+	}
+	let forkPending = $state(false)
+	function refreshForkPending() {
+		forkPending = pendingForkParent() !== undefined
+	}
+	/** Guards every mutating action. Returns true when the caller must not proceed. */
+	function blockedByPendingFork(): boolean {
+		const parent = pendingForkParent()
+		if (parent === undefined) return false
+		refreshForkPending()
+		sendUserToast(
+			`This session has not created its workspace yet, so the connection would be written to "${parent}" instead. Send a message first.`,
+			true
+		)
+		return true
+	}
+
+	let servers = $state<
+		{
+			path: string
+			description?: string
+			editedAt?: string
+			enabled: boolean
+			icon?: Component<any>
+		}[]
+	>([])
+	let loading = $state(false)
+	let loadError = $state<string | undefined>(undefined)
+	let pendingDelete = $state<string | undefined>(undefined)
+	// A row's overflow menu is portaled out of the modal, so a click on one of its items
+	// is a click outside the modal. Tracking it here keeps the modal from closing under
+	// the action the item is about to run.
+	let rowMenuOpen = $state<Record<string, boolean>>({})
+	// The connect form is the second page of this panel, not a surface over it.
+	let connectOpen = $state(false)
+	// Bumped as the connect page is left, which is what clears the form for the next
+	// connection: the page stays mounted once built, so nothing else would. Bumped on
+	// the way out rather than on the way in so the rebuild happens while the page is
+	// parked and invisible, leaving every visit an already-built form.
+	let connectSeq = $state(0)
+
+	// The row being edited, on the third page. `ResourceEditor` is the same editor the
+	// resource drawer opens, so a connection is edited here the way it is edited
+	// anywhere else — url, token, description, path.
+	// Kept when the detail page is left so the Right arrow steps back into it.
+	let editing = $state<{ path: string; enabled: boolean } | undefined>(undefined)
+	let detailOpen = $state(false)
+	// The path the editor holds, which is not `editing.path` once someone renames it.
+	let editingPath = $state('')
+	let canSaveEditing = $state(false)
+	let resourceEditor: ResourceEditor | undefined = $state(undefined)
+
+	// What the form holds, which is what Save is measured against — not the stored value
+	// the editor loaded. The schema form fills in a value for every property the resource
+	// type declares, so an `mcp` resource saved without `headers` is holding
+	// `headers: null` by the time it is on screen, and measuring against the stored value
+	// would call that an edit the moment a connection is opened. The trigger editors take
+	// their baseline from their own form for the same reason.
+	//
+	// It follows the form until the form is first focused, rather than being taken at a
+	// moment judged to be after the fields have filled themselves in: those writes land
+	// over several flushes and a snapshot timed against them is a guess, while nothing
+	// here can be edited without focus reaching the form first.
+	let editingBaseline = $state<unknown>(undefined)
+	let editingTouched = $state(false)
+	$effect(() => {
+		const editor: ResourceEditor | undefined = resourceEditor
+		// Snapshotting is also the deep read that makes this run again on every field.
+		const settled = editor === undefined ? undefined : $state.snapshot(editor.localDraftCurrent())
+		untrack(() => {
+			if (editingTouched || settled === undefined) return
+			editingBaseline = settled
+		})
+	})
+	let editingChanged = $derived.by(() => {
+		const editor: ResourceEditor | undefined = resourceEditor
+		return !draftValuesEqual(editor?.localDraftCurrent(), editingBaseline)
+	})
+	// Bumped per visit: `ResourceEditor` reads its path once, on mount, and this page
+	// stays mounted, so without a remount the second server opened would be the first.
+	let detailSeq = $state(0)
+
+	let page = $derived(connectOpen ? 'connect' : detailOpen ? 'detail' : 'list')
+
+	$effect(() => {
+		count = servers.length
+	})
+	$effect(() => {
+		blocksClose =
+			pendingDelete !== undefined ||
+			connectOpen ||
+			detailOpen ||
+			Object.values(rowMenuOpen).some(Boolean)
+	})
+
+	// Parked with the section: a page left open behind another section would go on
+	// reporting `blocksClose`, and the modal would refuse to close with nothing on
+	// screen explaining why. Set directly rather than through `closeConnect`, whose
+	// rebuild would throw away a half-filled connect form.
+	$effect(() => {
+		if (!active) {
+			detailOpen = false
+			connectOpen = false
+		}
+	})
+
+	/** Escape steps back to the list rather than closing the whole modal: `blocksClose`
+	 * stops the modal's own handler, so this is the only thing left to answer the key. */
+	function onKeydown(event: KeyboardEvent) {
+		// Every section stays mounted while the modal is open, and `stopPropagation`
+		// does nothing between listeners on `window`: without this, a key aimed at the
+		// section on screen is answered by the four behind it too.
+		if (!active || event.key !== 'Escape' || page === 'list' || pendingDelete !== undefined) return
+		event.preventDefault()
+		event.stopPropagation()
+		if (connectOpen) closeConnect()
+		else closeDetail()
+	}
+
+	function openConnect() {
+		if (blockedByPendingFork()) return
+		connectOpen = true
+	}
+
+	function closeConnect() {
+		connectOpen = false
+		connectSeq++
+	}
+
+	function openServer(server: { path: string; enabled: boolean }) {
+		editing = { path: server.path, enabled: server.enabled }
+		editingPath = server.path
+		// Dropped with the editor it was taken from: the next one settles on its own
+		// connection, and comparing against the previous one's would call every field
+		// an edit.
+		editingBaseline = undefined
+		editingTouched = false
+		detailSeq++
+		detailOpen = true
+	}
+
+	function closeDetail() {
+		detailOpen = false
+	}
+
+	/** Left and Right step between the pages, which is `PagedContent` answering the
+	 * arrows once it is given this. Each forward step only goes somewhere it has
+	 * something to show: the detail page holds a connection only once one was opened.
+	 *
+	 * The three pages are a strip and the arrows walk it by position, so stepping back
+	 * from the connect form asks for the detail page. Both of those are levels below the
+	 * list rather than a sequence, so backwards out of either lands on the list. */
+	function navigate(key: string) {
+		if (key === 'list' || connectOpen) {
+			connectOpen = false
+			detailOpen = false
+		} else if (key === 'connect') {
+			openConnect()
+		} else if (editing) {
+			detailOpen = true
+		}
+	}
+
+	async function saveEditing() {
+		if (blockedByPendingFork()) return
+		const server = editing
+		if (!server) return
+		// Pinned alongside the row, like `toggle` and `deleteConnection`: the enablement
+		// writes below run after the save returns, and must land under the workspace the
+		// connection was edited in rather than whichever one is current by then.
+		const target = ws
+		// A failed save leaves the connection exactly as it was, so none of the
+		// bookkeeping below may run: moving the enablement then would turn a server
+		// that still exists off, and turn on a path that was never created.
+		if (!(await resourceEditor?.save())) return
+		// Enablement is keyed by path, so a rename would leave the switch on the path
+		// that no longer exists and the server itself off.
+		if (editingPath && editingPath !== server.path) {
+			setMcpEnabled(target, server.path, false)
+			forgetProviderKey(target, server.path)
+			setMcpEnabled(target, editingPath, server.enabled)
+		}
+		closeDetail()
+		await refresh(target)
+	}
+
+	// Rows describe one workspace. A switch while the section is open must not leave
+	// A's rows on screen while the actions below target B: same path, different
+	// server, and a delete would remove the wrong one.
+	let loadSeq = 0
+	$effect(() => {
+		const target = ws
+		untrack(() => {
+			servers = []
+			pendingDelete = undefined
+			// Back to the list too: the editor holds one workspace's resource, and the
+			// path it is on names a different server in the workspace switched to.
+			editing = undefined
+			detailOpen = false
+			connectOpen = false
+			void loadServers(target)
+		})
+	})
+
+	async function loadServers(target = ws) {
+		refreshForkPending()
+		// Checked before the sequence is taken, not only after the await: a stale
+		// action calling refresh(A) would otherwise claim the newest sequence and make
+		// the legitimate load for B discard its own result.
+		if (!target || target !== ws) return
+		const seq = ++loadSeq
+		loading = true
+		loadError = undefined
+		try {
+			const resources = await ResourceService.listResource({
+				workspace: target,
+				resourceType: 'mcp',
+				perPage: 100
+			})
+			if (seq !== loadSeq) return
+			servers = resources.map((r) => ({
+				path: r.path,
+				description: r.description,
+				editedAt: r.edited_at,
+				enabled: isMcpEnabled(target, r.path)
+			}))
+			// Seeded rather than filled by the bindings: an unset entry would hand
+			// DropdownV2 an `undefined` open state instead of a closed one.
+			rowMenuOpen = Object.fromEntries(resources.map((r) => [r.path, false]))
+			void loadIcons(target, seq)
+		} catch (e) {
+			if (seq !== loadSeq) return
+			// Without this the section would render the empty state, which reads as
+			// "you have no connections" rather than "we could not load them".
+			loadError = e.body ?? e.message
+		} finally {
+			if (seq === loadSeq) loading = false
+		}
+	}
+
+	async function toggle(path: string, enabled: boolean) {
+		if (blockedByPendingFork()) return
+		// Pinned for the whole call: the selection is stored per workspace, and the
+		// refresh below must not hand these servers to a chat that has since moved on.
+		const target = ws
+		// Local preference only: nothing to re-read from the API, and the cached
+		// tool lists stay valid because the servers are unchanged. Checked, like the
+		// skills switch: a refused write leaves the chat carrying a different set than
+		// the switch shows, and nothing else would ever say so.
+		if (!setMcpEnabled(target, path, enabled)) {
+			sendUserToast('Could not save the selection for this account.', true)
+			return
+		}
+		const server = servers.find((s) => s.path === path)
+		if (server) server.enabled = enabled
+		if (target !== ws) return
+		await aiChatManager.refreshMcpServers(target)
+	}
+
+	// Deleting a resource also deletes every variable its value references, and an
+	// mcp resource's token is usually the credential of the resource it was created
+	// from (the github one). Drop the reference first so deleting the connection can
+	// never destroy a credential something else still uses; the variable is left for
+	// the user to remove from the Variables page.
+	async function deleteConnection(path: string) {
+		if (blockedByPendingFork()) return
+		// Pinned for the whole sequence: a switch midway would strip and delete the
+		// resource that happens to share this path in the workspace switched to.
+		const target = ws
+		try {
+			const resource = await ResourceService.getResource({
+				workspace: target,
+				path
+			})
+			const { token: _token, ...withoutToken } = (resource.value ?? {}) as Record<string, unknown>
+			await ResourceService.updateResource({
+				workspace: target,
+				path,
+				requestBody: { value: withoutToken }
+			})
+			await ResourceService.deleteResource({ workspace: target, path })
+			// A later resource at this path is a different server; it must be turned
+			// on deliberately rather than inherit this one's enablement.
+			setMcpEnabled(target, path, false)
+			forgetProviderKey(target, path)
+			sendUserToast(`Deleted ${path}. Its token variable was kept.`)
+			await refresh(target)
+		} catch (e) {
+			sendUserToast(`Failed to delete ${path}: ${e.body ?? e.message}`, true)
+		} finally {
+			pendingDelete = undefined
+		}
+	}
+
+	// A row whose provider is already cached paints from the cache; the rest cost
+	// one read each, and a long list stops asking rather than firing a request
+	// storm at a screen nobody is reading that far down.
+	const MAX_ICON_LOOKUPS = 20
+	async function loadIcons(target: string, seq: number) {
+		let lookups = 0
+		await Promise.all(
+			servers.map(async (server) => {
+				let key = cachedProviderKey(target, server.path, server.editedAt)
+				if (key === undefined) {
+					if (lookups >= MAX_ICON_LOOKUPS) return
+					lookups++
+					try {
+						const resource = await ResourceService.getResource({
+							workspace: target,
+							path: server.path
+						})
+						key = rememberProviderKey(
+							target,
+							server.path,
+							(resource.value as { url?: unknown } | undefined)?.url,
+							server.editedAt
+						)
+					} catch {
+						return
+					}
+				}
+				const icon = await loadProviderIcon(key)
+				if (seq !== loadSeq) return
+				server.icon = icon
+			})
+		)
+	}
+
+	async function refresh(target = ws) {
+		// A path can be reconnected to a different server, so the cached tool list
+		// (and the readOnlyHint the confirmation gate reads) must not survive.
+		clearMcpToolsCache()
+		await loadServers(target)
+		// `refreshMcpServers` blanks the list when the workspace it is handed is not
+		// the one the chat is on, so a refresh landing after a switch would take B's
+		// servers out of the prompt entirely.
+		if (target !== ws) return
+		// Re-register the chat's MCP tools so a connection made here is usable in
+		// the next message without a reload.
+		await aiChatManager.refreshMcpServers(target)
+	}
+</script>
+
+<svelte:window onkeydown={onKeydown} />
+
+<!-- The list, a connection and the connect form are levels of one panel, so moving
+     between them slides rather than cuts — the same shape the Skills panel uses for
+     its editor. Warmed once this panel is on screen so the connect form is built
+     before the click rather than inside the transition; the detail page holds a
+     `ResourceEditor` for one path and only builds once a row is opened. -->
+<PagedContent
+	warm={active}
+	class="grow min-h-0"
+	current={page}
+	onNavigate={active ? navigate : undefined}
+	pages={[
+		{ key: 'list', content: listPage },
+		{ key: 'detail', content: detailPage },
+		{ key: 'connect', content: connectPage }
+	]}
+/>
+
+{#snippet listPage()}
+	<div class="grow min-h-0 overflow-y-auto pr-2">
+		<Section
+			label="MCP connections"
+			description="External MCP servers this chat can call. Their tools run with your own credentials, so the chat can only reach what you can."
+			class="flex flex-col gap-4"
+		>
+			{#snippet action()}
+				<Button
+					unifiedSize="sm"
+					variant="accent"
+					startIcon={{ icon: Plus }}
+					disabled={forkPending}
+					onClick={openConnect}
+				>
+					Connect a server
+				</Button>
+			{/snippet}
+
+			{#if forkPending}
+				<Alert type="info" title="This session has no workspace yet" size="xs" class="mb-4">
+					Connections are read-only until the first message creates this session's fork. Connecting
+					or selecting one now would apply to the parent workspace and stop applying once the fork
+					is created.
+				</Alert>
+			{/if}
+			{#if loading}
+				<div class="flex justify-center p-4"><Loader2 class="animate-spin" /></div>
+			{:else if loadError}
+				<div class="text-xs text-red-600 dark:text-red-400">
+					Failed to load MCP connections: {loadError}
+				</div>
+			{:else if servers.length === 0}
+				<EmptyState
+					icon={Plug}
+					title="No MCP server connected"
+					description="Connect an external MCP server and the chat can call its tools with your own credentials."
+					action={{
+						label: 'Connect a server',
+						icon: Plus,
+						onClick: openConnect,
+						disabled: forkPending
+					}}
+				/>
+			{:else}
+				<div class="flex flex-col gap-0.5">
+					{#each servers as server (server.path)}
+						{#snippet icon()}
+							{#if server.icon}
+								{@const Icon = server.icon}
+								<Icon width="16px" height="16px" />
+							{:else}
+								<Plug size={16} class="text-tertiary" />
+							{/if}
+						{/snippet}
+						{#snippet title()}
+							<span class="truncate leading-5">{server.path}</span>
+						{/snippet}
+						{#snippet subtitle()}{server.description}{/snippet}
+						{#snippet trailing()}
+							<Toggle
+								size="sm"
+								disabled={forkPending}
+								checked={server.enabled}
+								on:change={async (e) => await toggle(server.path, e.detail)}
+							/>
+							<DropdownV2
+								size="sm"
+								bind:open={rowMenuOpen[server.path]}
+								items={[
+									{
+										displayName: 'Manage connection',
+										icon: Pencil,
+										action: () => openServer(server)
+									},
+									{
+										displayName: 'Delete',
+										icon: Trash2,
+										type: 'delete',
+										disabled: forkPending,
+										action: () => (pendingDelete = server.path)
+									}
+								]}
+							/>
+						{/snippet}
+						<ListRow
+							{icon}
+							{title}
+							{trailing}
+							subtitle={server.description ? subtitle : undefined}
+							onClick={() => openServer(server)}
+						/>
+					{/each}
+				</div>
+			{/if}
+		</Section>
+	</div>
+{/snippet}
+
+{#snippet detailPage()}
+	<div class="grow min-h-0 overflow-y-auto pr-2">
+		<!-- Sticky so the way back is always one click away, however far the page scrolls. -->
+		<div class="flex sticky top-0 z-10 bg-surface pb-1">
+			<Button
+				variant="subtle"
+				unifiedSize="xs"
+				startIcon={{ icon: ArrowLeft }}
+				btnClasses="text-secondary"
+				onClick={closeDetail}
+			>
+				MCP connections
+			</Button>
+		</div>
+		<!-- `headerClass` keeps a long path on one line: the Save button shares the header
+		     row and would otherwise wrap the title under itself. -->
+		<!-- Titled by the path the editor holds rather than the row's, so a rename is
+		     visible as it is typed and the header does not empty out while the page
+		     slides away. -->
+		<Section label={editingPath} wrapperClass="mt-1" headerClass="min-w-0 truncate pr-2 font-mono">
+			{#snippet action()}
+				<div class="flex justify-end shrink-0">
+					<Button
+						variant="accent"
+						unifiedSize="sm"
+						disabled={!canSaveEditing || !editingChanged}
+						onClick={saveEditing}
+					>
+						Save
+					</Button>
+				</div>
+			{/snippet}
+			<!-- Freezes the baseline above: from the first focus on, what the form holds is
+			     the user's doing rather than its own. -->
+			<!-- svelte-ignore a11y_no_static_element_interactions -->
+			<div onfocusin={() => (editingTouched = true)}>
+				{#key detailSeq}
+					{#if detailSeq > 0}
+						<!-- `editingPath` is seeded with the row's path before this remounts, which
+					     is how the editor is told which resource to load: it reads its path once,
+					     on mount, and reports a rename back through the same binding. -->
+						<ResourceEditor
+							bind:this={resourceEditor}
+							bind:canSave={canSaveEditing}
+							bind:path={editingPath}
+							workspace={ws}
+							resource_type="mcp"
+						/>
+					{/if}
+				{/key}
+			</div>
+		</Section>
+	</div>
+{/snippet}
+
+{#snippet connectPage()}
+	<!-- The form takes the panel over rather than opening on top of it: a form stacked
+	     on the settings modal leaves two surfaces arguing over which one a click or an
+	     Escape belongs to. `McpConnect` carries its own heading, so there is no Section
+	     around it. -->
+	<div class="grow min-h-0 overflow-y-auto pr-2">
+		<!-- Sticky so the way back is always one click away, however far the page scrolls. -->
+		<div class="flex sticky top-0 z-10 bg-surface pb-1">
+			<Button
+				variant="subtle"
+				unifiedSize="xs"
+				startIcon={{ icon: ArrowLeft }}
+				btnClasses="text-secondary"
+				onClick={closeConnect}
+			>
+				MCP connections
+			</Button>
+		</div>
+		<div class="mt-1">
+			{#key connectSeq}
+				<McpConnect
+					bordered={false}
+					workspace={ws}
+					onConnected={async (connectedWs, path) => {
+						// Connecting one is the act of choosing it, and it is keyed on where
+						// it was created rather than on what is on screen now: a switch
+						// during the popup would otherwise enable the path in a workspace
+						// that has no such connection.
+						if (!setMcpEnabled(connectedWs, path, true)) {
+							sendUserToast(`Connected ${path}, but could not turn it on. Toggle it here.`, true)
+						}
+						closeConnect()
+						await refresh()
+					}}
+				/>
+			{/key}
+		</div>
+	</div>
+{/snippet}
+
+<ConfirmationModal
+	open={pendingDelete !== undefined}
+	title="Delete MCP connection"
+	confirmationText="Delete"
+	onConfirmed={() => {
+		if (pendingDelete) void deleteConnection(pendingDelete)
+	}}
+	onCanceled={() => (pendingDelete = undefined)}
+>
+	<span class="text-xs text-primary">
+		This deletes the resource at <span class="font-semibold">{pendingDelete}</span>, so the chat and
+		any flow pointing at it lose the server. Its token variable is kept. To stop this chat from
+		using the server without deleting it, turn its switch off instead.
+	</span>
+</ConfirmationModal>
diff --git a/frontend/src/lib/components/copilot/chat/AssistantMessage.svelte b/frontend/src/lib/components/copilot/chat/AssistantMessage.svelte
index 787d9ef4fc..f06941c2a4 100644
--- a/frontend/src/lib/components/copilot/chat/AssistantMessage.svelte
+++ b/frontend/src/lib/components/copilot/chat/AssistantMessage.svelte
@@ -6,7 +6,6 @@
 	import { thinkingPreferences } from './thinkingPreferences.svelte'
 	import CodeDisplay from './script/CodeDisplay.svelte'
 	import LinkRenderer from './LinkRenderer.svelte'
-	import { workspaceStore } from '$lib/stores'
 	import {
 		extractCandidatePaths,
 		remarkWindmillPaths,
@@ -16,9 +15,12 @@
 
 	interface Props {
 		message: DisplayMessage
+		// Workspace the message's paths are resolved against: the one the chat
+		// operates on, which is not always the one being navigated.
+		workspace: string | undefined
 	}
 
-	let { message }: Props = $props()
+	let { message, workspace }: Props = $props()
 
 	const reasoning = $derived(
 		message.role === 'assistant' ? message.reasoning?.trim() || undefined : undefined
@@ -69,12 +71,11 @@
 	// Only populate the registry for messages that contain path-shaped tokens. The
 	// registry still dedups concurrent calls across messages and workspaces.
 	$effect(() => {
-		const ws = $workspaceStore
-		if (ws && candidatePaths.length > 0) workspaceItemRegistry.ensureLoaded(ws)
+		if (workspace && candidatePaths.length > 0) workspaceItemRegistry.ensureLoaded(workspace)
 	})
 
 	const plugins = $derived.by(() => {
-		const ws = $workspaceStore ?? ''
+		const ws = workspace ?? ''
 		if (!ws || candidatePaths.length === 0) {
 			return [gfmPlugin(), rendererPlugin]
 		}
diff --git a/frontend/src/lib/components/copilot/chat/AssistantSettingsModal.svelte b/frontend/src/lib/components/copilot/chat/AssistantSettingsModal.svelte
new file mode 100644
index 0000000000..7694be3827
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/AssistantSettingsModal.svelte
@@ -0,0 +1,238 @@
+<!--
+@component
+Everything the chat carries into a turn beyond the conversation itself: its tools, the
+skills and MCP servers turned on for it, and the custom instructions in force. Each of
+those outlives the moment it was set — a skill turned on last week and an instruction
+written once both go on steering every answer — so this is the one place they are all
+accounted for and changed.
+
+The trigger sits in the composer next to the model pill; `open(section)` is for the
+callers that already know which section they mean, such as the "+" menu's Manage entries.
+-->
+<script lang="ts" module>
+	export type AssistantSettingsSection = 'tools' | 'skills' | 'instructions' | 'mcp' | 'files'
+</script>
+
+<script lang="ts">
+	import { BookOpen, Boxes, Paperclip, Plug, ScrollText, SlidersHorizontal } from 'lucide-svelte'
+	import Button from '$lib/components/common/button/Button.svelte'
+	import Modal2 from '$lib/components/common/modal/Modal2.svelte'
+	import SidebarNavigation from '$lib/components/common/sidebar/SidebarNavigation.svelte'
+	import Tooltip from '$lib/components/meltComponents/Tooltip.svelte'
+	import { workspaceStore } from '$lib/stores'
+	import { logFeatureUsage } from '$lib/utils/featureUsage'
+	import { getAiChatManager } from './aiChatManagerContext'
+	import { summarizeTools } from './agentContext'
+	import AssistantToolsSection from './AssistantToolsSection.svelte'
+	import AssistantSkillsSection from './AssistantSkillsSection.svelte'
+	import AssistantInstructionsSection from './AssistantInstructionsSection.svelte'
+	import AssistantMcpSection from './AssistantMcpSection.svelte'
+	import AssistantFilesSection from './AssistantFilesSection.svelte'
+
+	const aiChatManager = getAiChatManager()
+
+	let isOpen = $state(false)
+	let section = $state<AssistantSettingsSection>('tools')
+	let skillCount = $state(0)
+	let mcpCount = $state(0)
+	let fileCount = $state(0)
+	// A section is mid-something the modal must not close under: a confirmation or a
+	// popover portaled to the body (where a click inside reads as a click outside this
+	// modal), or an editor holding text nobody has saved yet. While one is up, Escape
+	// and an outside click belong to the section, which answers them itself.
+	let toolsBusy = $state(false)
+	let skillsBusy = $state(false)
+	let instructionsBusy = $state(false)
+	let mcpBusy = $state(false)
+	let filesBusy = $state(false)
+	let blocksClose = $derived(toolsBusy || skillsBusy || instructionsBusy || mcpBusy || filesBusy)
+	// Which section is holding the modal open. The section on screen wins whenever it is
+	// itself blocking: it is the one that will answer the key, and preferring any other
+	// would take Escape away from the surface the user is looking at. Otherwise it is
+	// whichever section blocks from behind — in practice Instructions holding unsaved
+	// text, since the page-based sections park themselves when navigated away from.
+	let busyBySection = $derived<Record<AssistantSettingsSection, boolean>>({
+		tools: toolsBusy,
+		skills: skillsBusy,
+		instructions: instructionsBusy,
+		mcp: mcpBusy,
+		files: filesBusy
+	})
+	let blockingSection = $derived<AssistantSettingsSection | undefined>(
+		busyBySection[section]
+			? section
+			: (Object.keys(busyBySection) as AssistantSettingsSection[]).find((k) => busyBySection[k])
+	)
+
+	/** Escape with something blocking behind another section would look like a dead key:
+	 * `Modal2` ignores it, and the section that answers it is not on screen. Show that
+	 * section instead, so the reason the modal will not close is in front of the user.
+	 *
+	 * `stopImmediatePropagation` because this listener is the parent's and runs before
+	 * the sections': showing a section makes it `active` within this same dispatch, and
+	 * it would then answer the key it was revealed by — reverting the very draft the
+	 * user was brought here to see. */
+	function onKeydown(event: KeyboardEvent) {
+		if (!isOpen || event.key !== 'Escape') return
+		const blocker = blockingSection
+		if (!blocker || blocker === section) return
+		event.preventDefault()
+		event.stopImmediatePropagation()
+		select(blocker)
+	}
+
+	// A session chat operates on its own (possibly forked) workspace without switching
+	// `workspaceStore`, and that is the workspace every list here is read under.
+	//
+	// `operatingWorkspace` is a plain getter over untracked state, so the store is read
+	// unconditionally rather than behind `??`: short-circuiting it would leave this
+	// derived with no dependency at all, frozen on the workspace it first saw.
+	let ws = $derived.by(() => {
+		const active = $workspaceStore
+		return aiChatManager.operatingWorkspace ?? active ?? ''
+	})
+
+	// Exactly what the chat loop sends — plan mode's transition tool is registered
+	// alongside `tools` there, so listing only `tools` would under-report.
+	let tools = $derived(summarizeTools([...aiChatManager.tools, ...aiChatManager.planMode.tools]))
+
+	// `SidebarNavigation`'s item shape, which is what the instance and workspace settings
+	// navs are built from too.
+	let sections = $derived([
+		{ id: 'tools', label: 'Tools', icon: Boxes, count: tools.length },
+		{ id: 'skills', label: 'Skills', icon: BookOpen, count: skillCount },
+		{ id: 'instructions', label: 'Instructions', icon: ScrollText },
+		{ id: 'mcp', label: 'MCP connections', icon: Plug, count: mcpCount },
+		// The count is what is readable rather than what is attached: a locked folder under
+		// a heading about what the assistant can use would say the opposite of the truth.
+		{ id: 'files', label: 'Files & folders', icon: Paperclip, count: fileCount }
+	])
+
+	/** Opens on `target`, or back on whichever section was last read. */
+	export function open(target: AssistantSettingsSection = section) {
+		section = target
+		isOpen = true
+		refresh()
+		record('open')
+		record(target)
+	}
+
+	// `context_panel` is the kind registered in `feature_usage_ee.rs`; an unregistered
+	// pair is dropped silently, so the name is fixed there rather than here.
+	//
+	// The key vocabulary is the closed set in this signature and nothing else — a
+	// skill path or server path here would be workspace-authored text.
+	function record(key: 'open' | AssistantSettingsSection) {
+		logFeatureUsage('ai_session', 'context_panel', { key, workspace: ws })
+	}
+
+	function select(target: AssistantSettingsSection) {
+		if (target === section) return
+		section = target
+		record(target)
+	}
+
+	function refresh() {
+		// `globalSkills` and `mcpServers` are per-manager snapshots, and the enabled
+		// sets they derive from are shared: toggling a skill in one session leaves
+		// every other warm session's copy behind until its next send refreshes it.
+		// Opening this modal is the one moment the tool list has to be true, so it
+		// refreshes the same way the send path does — the active chat only.
+		//
+		// Never while a turn is in flight, though. These refreshes carry generation
+		// counters, so starting one invalidates the send's own: its `Promise.all`
+		// would return without applying results, and this one would then rewrite the
+		// tools and system prompt underneath a running turn. Mid-turn it shows the
+		// values the turn was actually given, which is the honest answer anyway.
+		if (!aiChatManager.loading && !aiChatManager.sendInFlight) {
+			void aiChatManager.refreshGlobalSkills()
+			void aiChatManager.refreshMcpServers()
+		}
+	}
+</script>
+
+<svelte:window onkeydown={onKeydown} />
+
+<Tooltip small placement="top">
+	<Button
+		unifiedSize="2xs"
+		variant="subtle"
+		iconOnly
+		startIcon={{ icon: SlidersHorizontal }}
+		aria-label="Assistant settings"
+		onClick={() => open()}
+	/>
+	{#snippet text()}
+		<div class="max-w-64 text-xs">
+			<p class="font-semibold">Assistant settings</p>
+			<p class="mt-1">The tools, skills, instructions and MCP servers this chat can use.</p>
+		</div>
+	{/snippet}
+</Tooltip>
+
+<Modal2
+	bind:isOpen
+	title="Assistant settings"
+	fixedWidth="md"
+	fixedHeight="lg"
+	closeOnOutsideClick={!blocksClose}
+	closeOnEscape={!blocksClose}
+>
+	{#snippet headerLeft()}
+		<p class="pl-3 pt-1 text-xs text-secondary truncate">
+			What the assistant can see and use in this session.
+		</p>
+	{/snippet}
+
+	<div class="w-full flex min-h-0 gap-4">
+		<div class="w-52 shrink-0 flex flex-col border-r border-border-light pr-3">
+			<SidebarNavigation
+				groups={[{ items: sections }]}
+				selectedId={section}
+				onNavigate={(id) => select(id as AssistantSettingsSection)}
+			/>
+		</div>
+
+		<div class="grow min-w-0 flex flex-col min-h-0">
+			<!-- Every section stays mounted while the modal is open: the sidebar badges
+			     count what each one loaded, so hiding is display-only. Tools, Skills and MCP
+			     own their own scrolling — each is a list and a detail page laid over each
+			     other — so only Instructions scrolls here. -->
+			<div class="{section === 'tools' ? 'flex' : 'hidden'} grow min-h-0 flex-col overflow-hidden">
+				<AssistantToolsSection {tools} active={section === 'tools'} bind:blocksClose={toolsBusy} />
+			</div>
+			<!-- Skills owns its own scrolling: its list and its editor are PagedContent pages
+			     laid over each other, and each keeps a scroll position of its own. -->
+			<div class="{section === 'skills' ? 'flex' : 'hidden'} grow min-h-0 flex-col overflow-hidden">
+				<AssistantSkillsSection
+					{ws}
+					active={section === 'skills'}
+					bind:count={skillCount}
+					bind:blocksClose={skillsBusy}
+				/>
+			</div>
+			<div
+				class="{section === 'instructions' ? 'block' : 'hidden'} grow min-h-0 overflow-y-auto pr-2"
+			>
+				<AssistantInstructionsSection
+					{ws}
+					active={section === 'instructions'}
+					bind:blocksClose={instructionsBusy}
+				/>
+			</div>
+			<!-- Like Skills, MCP owns its own scrolling: its list and its connect form are
+			     PagedContent pages laid over each other. -->
+			<div class="{section === 'mcp' ? 'flex' : 'hidden'} grow min-h-0 flex-col overflow-hidden">
+				<AssistantMcpSection
+					{ws}
+					active={section === 'mcp'}
+					bind:count={mcpCount}
+					bind:blocksClose={mcpBusy}
+				/>
+			</div>
+			<div class="{section === 'files' ? 'block' : 'hidden'} grow min-h-0 overflow-y-auto pr-2">
+				<AssistantFilesSection bind:count={fileCount} bind:blocksClose={filesBusy} />
+			</div>
+		</div>
+	</div>
+</Modal2>
diff --git a/frontend/src/lib/components/copilot/chat/SkillsPicker.svelte b/frontend/src/lib/components/copilot/chat/AssistantSkillsSection.svelte
similarity index 50%
rename from frontend/src/lib/components/copilot/chat/SkillsPicker.svelte
rename to frontend/src/lib/components/copilot/chat/AssistantSkillsSection.svelte
index b1cf8e4850..b545eaea18 100644
--- a/frontend/src/lib/components/copilot/chat/SkillsPicker.svelte
+++ b/frontend/src/lib/components/copilot/chat/AssistantSkillsSection.svelte
@@ -1,28 +1,35 @@
+<!--
+@component
+The Skills section of the assistant settings modal: every ai_skill resource in the
+operating workspace, each with the switch that decides whether this chat carries it,
+and the actions that create, edit, import and delete them.
+-->
 <script lang="ts">
-	import { Alert, Button, Drawer } from '$lib/components/common'
-	import DrawerContent from '$lib/components/common/drawer/DrawerContent.svelte'
+	import { Button, ListRow, Section } from '$lib/components/common'
+	import EmptyState from '$lib/components/common/emptyState/EmptyState.svelte'
+	import FileInput from '$lib/components/common/fileInput/FileInput.svelte'
+	import Alert from '$lib/components/common/alert/Alert.svelte'
 	import ConfirmationModal from '$lib/components/common/confirmationModal/ConfirmationModal.svelte'
-	import Modal2 from '$lib/components/common/modal/Modal2.svelte'
+	import PagedContent from '$lib/components/common/modal/PagedContent.svelte'
 	import Toggle from '$lib/components/Toggle.svelte'
 	import DropdownV2 from '$lib/components/DropdownV2.svelte'
 	import ToggleButton from '$lib/components/common/toggleButton-v2/ToggleButton.svelte'
 	import ToggleButtonGroup from '$lib/components/common/toggleButton-v2/ToggleButtonGroup.svelte'
+	import Label from '$lib/components/Label.svelte'
 	import Path from '$lib/components/Path.svelte'
-	import FileInput from '$lib/components/common/fileInput/FileInput.svelte'
 	import SimpleEditor from '$lib/components/SimpleEditor.svelte'
 	import Markdown from 'svelte-exmarkdown'
 	import { gfmPlugin } from 'svelte-exmarkdown/gfm'
 	import { markdownProse } from '$lib/components/markdownProse'
-	import { workspaceStore, userStore } from '$lib/stores'
+	import { userStore } from '$lib/stores'
 	import { sendUserToast } from '$lib/toast'
 	import { logFeatureUsage } from '$lib/utils/featureUsage'
-	import type { Item } from '$lib/utils'
 	import { untrack } from 'svelte'
 	import {
+		ArrowLeft,
 		BookOpen,
-		ClipboardPaste,
 		Eye,
-		List,
+		FolderUp,
 		Pencil,
 		Plus,
 		RotateCcw,
@@ -46,26 +53,31 @@
 		type SkillUpload
 	} from './skills/skillMd'
 
+	let {
+		ws,
+		active,
+		count = $bindable(),
+		blocksClose = $bindable()
+	}: {
+		/** The workspace the chat operates on, which is not always the one on screen. */
+		ws: string
+		/** Whether this is the panel on screen. Gates the editor page's build: it is
+		 * worth paying for once someone is looking at skills, not on every open of a
+		 * modal whose other three sections have nothing to do with them. */
+		active: boolean
+		/** Number of skills in the workspace, for the sidebar badge. */
+		count: number
+		/** True while this section is in the middle of something the modal must not
+		 * close under: a dialog of its own, or the editor holding unsaved text. */
+		blocksClose: boolean
+	} = $props()
+
 	const aiChatManager = getAiChatManager()
 
-	// A session chat operates on its own (possibly forked) workspace without
-	// switching `workspaceStore`, and that is the workspace the chat reads the
-	// enabled set under. Key everything here the same way or a toggle lands under
-	// a key nothing reads.
-	//
-	// `operatingWorkspace` is a plain getter over untracked state, so the store is
-	// read unconditionally rather than behind `??`: short-circuiting it would leave
-	// this derived with no dependency at all, frozen on the workspace it first saw.
-	let ws = $derived.by(() => {
-		const active = $workspaceStore
-		return aiChatManager.operatingWorkspace ?? active!
-	})
-
 	// A session whose fork is still staged has no workspace of its own yet, so `ws`
-	// resolves to the PARENT. Authoring through the picker would then edit the live
-	// parent, and a toggle would be stored under it and quietly stop applying the
-	// moment the first send commits the fork. Read at use, not once: the fork
-	// commits mid-session.
+	// resolves to the PARENT. Authoring here would then edit the live parent, and a
+	// toggle would be stored under it and quietly stop applying the moment the first
+	// send commits the fork. Read at use, not once: the fork commits mid-session.
 	function pendingForkParent(): string | undefined {
 		return aiChatManager.sessionContextResolver?.()?.pendingForkOf
 	}
@@ -113,14 +125,15 @@ What the assistant should do when this skill applies.
 
 	type Row = SkillResource & { enabled: boolean }
 
-	let drawer: Drawer | undefined = $state(undefined)
 	let skills = $state<Row[]>([])
 	let loading = $state(false)
 	let loadError = $state<string | undefined>(undefined)
 	let listNotice = $state<string | undefined>(undefined)
 	let saving = $state(false)
 	let toDelete: Row | undefined = $state(undefined)
+	let folderInput: FileInput | undefined = $state(undefined)
 	let importFiles = $state<File[] | undefined>(undefined)
+	let bodyEditor: SimpleEditor | undefined = $state(undefined)
 
 	// Paste/edit modal. `editing` is the row being edited (undefined while
 	// creating), held so a path change can be applied as a move.
@@ -133,7 +146,15 @@ What the assistant should do when this skill applies.
 	// Set by Path once the user edits the path themselves, which is what stops the
 	// frontmatter from overwriting their choice below.
 	let pathDirty = $state(false)
-	let detailMode: 'view' | 'edit' = $state('view')
+	// Bumped for each visit to the editor. The editor page stays mounted once opened,
+	// and Path settles its owner and name segments on mount alone: without a remount,
+	// the second skill opened would keep the first one's fields, and a new skill would
+	// sit on the empty path `openCreate` leaves behind.
+	let editorSeq = $state(0)
+	// 'edit' as the default is what the warm build of the editor page renders, and the
+	// editor is the half worth building ahead of the click. Both entry points set this
+	// before opening, so the default is never what a visit actually lands on.
+	let detailMode: 'view' | 'edit' = $state('edit')
 
 	// Staged folder import, confirmed before anything is written.
 	let pendingImport: SkillUpload[] | undefined = $state(undefined)
@@ -174,12 +195,59 @@ What the assistant should do when this skill applies.
 		importTargets.filter((t) => !existingPaths.has(t.path)).map((t) => t.skill)
 	)
 
-	// Rows describe one workspace. A switch while the drawer is open must not leave
+	$effect(() => {
+		count = skills.length
+	})
+	// A row's overflow menu is portaled out of the modal, so a click on one of its
+	// items is a click outside the modal. Tracking it here keeps the modal from
+	// closing under the action the item is about to run.
+	let rowMenuOpen = $state<Record<string, boolean>>({})
+	$effect(() => {
+		blocksClose =
+			editorOpen ||
+			toDelete !== undefined ||
+			pendingImport !== undefined ||
+			Object.values(rowMenuOpen).some(Boolean)
+	})
+
+	// Parked with the section, but only once there is nothing to lose: an editor left
+	// open behind another section would go on reporting `blocksClose` and the modal
+	// would refuse to close with nothing on screen explaining why. An editor holding
+	// unsaved text is the opposite case — it stays open so it keeps blocking, and the
+	// modal's Escape brings the user back to it rather than discarding the body.
+	$effect(() => {
+		if (!active && !contentChanged && !pathChanged) editorOpen = false
+	})
+
+	/** Escape leaves the editor rather than the whole modal: `blocksClose` stops the
+	 * modal's own handler, so this is the only thing left to answer the key. */
+	function onKeydown(event: KeyboardEvent) {
+		// Every section stays mounted while the modal is open, and `stopPropagation`
+		// does nothing between listeners on `window`: without this, a key aimed at the
+		// section on screen is answered by the four behind it too.
+		if (!active || event.key !== 'Escape' || !editorOpen) return
+		if (toDelete !== undefined || pendingImport !== undefined) return
+		event.preventDefault()
+		event.stopPropagation()
+		closeEditor()
+	}
+
+	function closeEditor() {
+		editorOpen = false
+	}
+
+	/** Left and Right step between the two pages, which is `PagedContent` answering the
+	 * arrows once it is given this. Forward only goes somewhere once the editor has been
+	 * opened: before that it holds no skill. `editing` is deliberately not cleared on the
+	 * way out — both entry points set it, so it stays the skill the parked page shows. */
+	function navigate(key: string) {
+		if (key === 'list') closeEditor()
+		else if (editorSeq > 0) editorOpen = true
+	}
+
+	// Rows describe one workspace. A switch while the section is open must not leave
 	// A's rows on screen while the actions below target B: same path, different
-	// skill, and delete would remove the wrong one. Dropping them is all this does:
-	// this component mounts with the chat toolbar, so loading here would list
-	// resources for every user who never opens the menu. The two entry points load
-	// what they need.
+	// skill, and delete would remove the wrong one.
 	let loadSeq = 0
 	$effect(() => {
 		const target = ws
@@ -192,23 +260,21 @@ What the assistant should do when this skill applies.
 			// The editor holds one workspace's skill but saves to whatever `ws` is by
 			// then, so a switch mid-edit would write A's body into B at the same path.
 			// Closing it is the honest outcome: there is no version of that save the
-			// user asked for.
+			// user asked for. This one closes even on unsaved text, unlike parking the
+			// section, because the text can no longer be saved where it came from.
 			editorOpen = false
 			editing = undefined
-			// A drawer already on screen is neither entry point, and would sit there
-			// reporting that the new workspace has no skills.
-			if (drawer?.isOpen()) void loadSkills(target)
+			void loadSkills(target)
 		})
 	})
 
 	async function loadSkills(target = ws) {
-		// Checked before the sequence is taken, not only after the await: a stale
-		// action calling refresh(A) would otherwise claim the newest sequence and
-		// make the legitimate load for B discard its own result, leaving the drawer
-		// blank for the workspace actually on screen.
-		if (!target || target !== ws) return
 		refreshForkPending()
-		listNotice = undefined
+		// Checked before the sequence is taken, not only after the await: a stale
+		// action calling refresh(A) would otherwise claim the newest sequence and make
+		// the legitimate load for B discard its own result, leaving the section on an
+		// empty state for a workspace that has skills.
+		if (!target || target !== ws) return
 		const seq = ++loadSeq
 		loading = true
 		loadError = undefined
@@ -225,9 +291,12 @@ What the assistant should do when this skill applies.
 			listNotice = truncated
 				? `Showing the first ${found.length} skills; this workspace has more. Delete unused ones so the rest can be selected.`
 				: undefined
+			// Seeded rather than filled by the bindings: an unset entry would hand
+			// DropdownV2 an `undefined` open state instead of a closed one.
+			rowMenuOpen = Object.fromEntries(found.map((s) => [s.path, false]))
 		} catch (e) {
 			if (seq !== loadSeq || target !== ws) return
-			// Without this the drawer would render the empty state, which reads as
+			// Without this the section would render the empty state, which reads as
 			// "this workspace has no skills" rather than "we could not load them".
 			loadError = e.body ?? e.message
 		} finally {
@@ -235,80 +304,9 @@ What the assistant should do when this skill applies.
 		}
 	}
 
-	export async function open() {
-		drawer?.openDrawer()
-		await loadSkills()
-	}
-
-	// A menu is a shortcut, not a directory: past this many the list stops being
-	// scannable, so the rest are reached through the drawer rather than dropped.
-	const MAX_MENU_SKILLS = 8
-
-	/** Rows for the chat's "+" menu: one per skill, checked when it is on, then
-	 * the way to manage them. Loaded on open so the checks are current. */
-	export async function menuItems(closeMenu?: () => void): Promise<Item[]> {
-		// The menu opens on what is already known and refreshes behind it: waiting on
-		// a round trip would stall the whole `+` menu, attachments included.
-		if (skills.length === 0) {
-			await loadSkills()
-		} else {
-			void loadSkills()
-		}
-		// Enabled first: those are the ones a quick visit is most likely about.
-		const ordered = [...skills].sort(
-			(a, b) => Number(b.enabled) - Number(a.enabled) || a.path.localeCompare(b.path)
-		)
-		const shown = ordered.slice(0, MAX_MENU_SKILLS)
-		return [
-			...shown.map(({ path: p, name }) => ({
-				// Ambiguous names are shown by path — two rows reading `deploy` would
-				// leave the choice between them to chance.
-				displayName: ambiguous.has(name) ? p : name,
-				icon: BookOpen,
-				// Getters, not snapshots: the menu stays open across a click, and it has
-				// to read through the live list rather than the row captured here, since
-				// a reload replaces every row object and a getter bound to the old one
-				// would go on reporting the state it was built with.
-				get toggle() {
-					return row(p)?.enabled ?? false
-				},
-				action: () => toggle(p, !row(p)?.enabled)
-			})),
-			...(ordered.length > shown.length
-				? [
-						{
-							displayName: `Show all ${ordered.length}`,
-							icon: List,
-							action: () => {
-								closeMenu?.()
-								void open()
-							}
-						}
-					]
-				: []),
-			{
-				displayName: skills.length > 0 ? 'Manage skills' : 'Add a skill',
-				icon: Plus,
-				separatorTop: skills.length > 0,
-				action: () => {
-					closeMenu?.()
-					void open()
-				}
-			}
-		]
-	}
-
-	function row(p: string) {
-		return skills.find((s) => s.path === p)
-	}
-
 	async function toggle(p: string, enabled: boolean) {
 		if (blockedByPendingFork()) return
-		// Pinned for the whole call, like the other actions: the selection is stored
-		// per workspace, and the refresh below must not hand these skills to a chat
-		// that has since moved on.
-		const target = ws
-		if (!setSkillEnabled(target, p, enabled)) {
+		if (!setSkillEnabled(ws, p, enabled)) {
 			sendUserToast('Could not save the selection for this account.', true)
 			return
 		}
@@ -316,14 +314,10 @@ What the assistant should do when this skill applies.
 		if (skill) skill.enabled = enabled
 		// Whether people select skills at all. Never the skill itself: a path is
 		// workspace-authored text.
-		logFeatureUsage('ai_session', 'skill_toggle', {
-			key: enabled ? 'on' : 'off',
-			workspace: target
-		})
+		logFeatureUsage('ai_session', 'skill_toggle', { key: enabled ? 'on' : 'off', workspace: ws })
 		// The prompt lists exactly the enabled skills, so it has to be rebuilt
-		// before the next message rather than on the next mode change. A workspace
-		// switch during that rebuild is discarded inside refreshGlobalSkills.
-		await aiChatManager.refreshGlobalSkills(target)
+		// before the next message rather than on the next mode change.
+		await aiChatManager.refreshGlobalSkills(ws)
 	}
 
 	/** Personal folder the folder import writes into. The username is not always a
@@ -340,10 +334,20 @@ What the assistant should do when this skill applies.
 		return `u/${narrowed || 'user'}`
 	}
 
+	/** Both the state the form reads and what Monaco shows. `SimpleEditor` takes `code`
+	 * when it builds its model and never again — and this one outlives a visit, since
+	 * the editor page stays mounted — so an assignment alone would leave the body on
+	 * screen from the last skill opened. */
+	function setContent(next: string) {
+		content = next
+		bodyEditor?.setCode(next)
+	}
+
 	function openCreate() {
 		if (blockedByPendingFork()) return
+		editorSeq++
 		editing = undefined
-		content = SKILL_TEMPLATE
+		setContent(SKILL_TEMPLATE)
 		originalContent = SKILL_TEMPLATE
 		path = ''
 		pathDirty = false
@@ -351,30 +355,35 @@ What the assistant should do when this skill applies.
 		editorOpen = true
 	}
 
-	/** Back to what the modal opened with: the sample for a new skill, the saved
+	/** Back to what the editor opened with: the sample for a new skill, the saved
 	 * body for one being edited. */
 	function resetContent() {
-		content = originalContent
+		setContent(originalContent)
 	}
 
-	async function openSkill(skill: Row, mode: 'view' | 'edit') {
-		// Pinned across the await: the workspace can change while the body loads, and
-		// closing the editor then would not stop this from reopening it with the old
-		// workspace's content — which submitEditor would save into the new one.
+	/** Always lands on the rendered skill: reading one is the common reason to open it,
+	 * and the header's View/Edit switch is one click from the other half. */
+	async function openSkill(skill: Row) {
+		// Pinned across the await, and re-checked after it: closing the editor on a
+		// workspace switch would not stop this from reopening it with the old
+		// workspace's content, which `submitEditor` would then save into the new one.
 		const source = ws
 		try {
 			const instructions = await readSkillBody(source, skill.path)
 			if (source !== ws) return
-			content = buildSkillMd({
-				name: skill.name,
-				description: skill.description,
-				instructions
-			})
+			setContent(
+				buildSkillMd({
+					name: skill.name,
+					description: skill.description,
+					instructions
+				})
+			)
 			originalContent = content
+			editorSeq++
 			editing = skill
 			path = skill.path
 			pathDirty = false
-			detailMode = mode
+			detailMode = 'view'
 			editorOpen = true
 		} catch (e) {
 			sendUserToast(`Failed to load skill: ${e.body ?? e.message}`, true)
@@ -403,8 +412,8 @@ What the assistant should do when this skill applies.
 	})
 
 	async function submitEditor() {
-		if (!('skill' in validated) || !path || pathError) return
 		if (blockedByPendingFork()) return
+		if (!('skill' in validated) || !path || pathError) return
 		const target = ws
 		saving = true
 		try {
@@ -459,14 +468,14 @@ What the assistant should do when this skill applies.
 
 	async function refresh(target = ws) {
 		await loadSkills(target)
-		// Same reason: refreshing the chat with a workspace it has since left would
-		// advertise A's skills to a session now acting on B.
+		// `refreshGlobalSkills` blanks `globalSkills` when the workspace it is handed is
+		// not the one the chat is on, so a refresh landing after a switch would take B's
+		// skills out of the system prompt entirely.
 		if (target !== ws) return
 		await aiChatManager.refreshGlobalSkills(target)
 	}
 
-	/** Where the file sat in the chosen folder. Clicking through sets
-	 * `webkitRelativePath`; dropping sets `path`, which the picker's tree walk fills. */
+	/** Where the file sat in the chosen folder, as the directory picker reports it. */
 	function relativePathOf(f: File & { path?: string }): string {
 		return f.webkitRelativePath || f.path || f.name
 	}
@@ -597,261 +606,347 @@ What the assistant should do when this skill applies.
 	}
 </script>
 
-<Drawer bind:this={drawer} size="700px">
-	<DrawerContent
-		title="Skills"
-		on:close={() => drawer?.closeDrawer()}
-		tooltip="Reusable instruction sets for this chat, stored as ai_skill resources. Turning one on is personal to you and to this workspace — the assistant only sees the ones you selected."
-	>
-		{#snippet actions()}
-			<Button
-				variant="accent"
-				unifiedSize="sm"
-				startIcon={{ icon: ClipboardPaste }}
-				disabled={saving || forkPending}
-				onclick={openCreate}
-			>
-				New skill
-			</Button>
-		{/snippet}
+<svelte:window onkeydown={onKeydown} />
 
-		{#if listNotice}
-			<Alert type="warning" title="Not all skills are shown" size="xs" class="mb-4">
-				{listNotice}
-			</Alert>
-		{/if}
+<!-- The list and the editor are levels of one panel, so moving between them slides
+     rather than cuts. Warmed once this panel is the one on screen: the editor page
+     carries a Monaco instance, and building it on the first click lands that work
+     inside the transition, which reads as the animation being broken rather than as a
+     cost. Warmed here rather than at mount so a modal opened for its other sections
+     never pays for it. -->
+<PagedContent
+	warm={active}
+	class="grow min-h-0"
+	current={editorOpen ? 'editor' : 'list'}
+	onNavigate={active ? navigate : undefined}
+	pages={[
+		{ key: 'list', content: listPage },
+		{ key: 'editor', content: editorPage }
+	]}
+/>
 
-		{#if forkPending}
-			<Alert type="info" title="This session has no workspace yet" size="xs" class="mb-4">
-				Skills are read-only until the first message creates this session's fork. Editing or
-				selecting one now would apply to the parent workspace and stop applying once the fork is
-				created.
-			</Alert>
-		{/if}
-
-		<FileInput
-			disabled={forkPending}
-			folderOnly
-			bind:files={importFiles}
-			on:change={onDirSelected}
-			class="mb-4 !py-5"
-			iconSize={20}
+{#snippet listPage()}
+	<div class="grow min-h-0 overflow-y-auto pr-2">
+		<Section
+			label="Skills"
+			description="Reusable instruction sets the assistant loads when they apply. Turning one on is personal to you and to this workspace."
 		>
-			<span class="text-xs text-secondary">
-				Drop a folder of <span class="font-mono">SKILL.md</span> files to import, or click to choose
-				one
-			</span>
-		</FileInput>
-
-		{#if loading}
-			<div class="text-xs text-secondary p-4 text-center">Loading skills…</div>
-		{:else if loadError}
-			<div class="text-xs text-red-600 dark:text-red-400">
-				Failed to load skills: {loadError}
-			</div>
-		{:else if skills.length === 0}
-			<div class="rounded-md border border-dashed px-3 py-6 text-center text-xs text-secondary">
-				No skills in this workspace yet. Paste a SKILL.md or import a folder of them.
-			</div>
-		{:else}
-			<div class="flex flex-col divide-y border rounded-md bg-surface-tertiary">
-				{#each skills as skill (skill.path)}
-					<div class="flex items-center gap-3 px-4 py-3">
-						<BookOpen size={16} class="shrink-0 text-tertiary" />
-						<div class="min-w-0 grow">
-							<div class="text-xs font-semibold text-emphasis truncate">
-								{ambiguous.has(skill.name) ? skill.path : skill.name}
-							</div>
-							{#if skill.description}
-								<div class="text-xs text-secondary truncate">{skill.description}</div>
-							{/if}
-						</div>
-						<Toggle
-							size="xs"
-							disabled={forkPending}
-							checked={skill.enabled}
-							on:change={async (e) => await toggle(skill.path, e.detail)}
-						/>
-						<DropdownV2
-							size="sm"
-							items={[
-								{
-									displayName: skill.canWrite ? 'Edit' : 'View',
-									icon: skill.canWrite ? Pencil : Eye,
-									action: () => openSkill(skill, skill.canWrite ? 'edit' : 'view')
-								},
-								{
-									displayName: 'Delete',
-									icon: Trash2,
-									type: 'delete',
-									disabled: !skill.canWrite || forkPending,
-									action: () => (toDelete = skill)
-								}
-							]}
-						/>
-					</div>
-				{/each}
-			</div>
-		{/if}
-
-		<ConfirmationModal
-			open={toDelete !== undefined}
-			title="Delete skill"
-			confirmationText="Delete"
-			onConfirmed={async () => {
-				const skill = toDelete
-				toDelete = undefined
-				if (skill) await remove(skill)
-			}}
-			onCanceled={() => (toDelete = undefined)}
-		>
-			<span class="text-xs text-primary">
-				This deletes the resource at <span class="font-semibold">{toDelete?.path}</span>, so
-				everyone who selected it loses the skill.
-			</span>
-		</ConfirmationModal>
-
-		<ConfirmationModal
-			open={pendingImport !== undefined}
-			title="Import skills"
-			type="info"
-			confirmationText="Import"
-			onConfirmed={async () => {
-				const toImport = [
-					...pendingNew.map((skill) => ({ skill, overwrite: false })),
-					...pendingConflicts
-						.filter((s) => overwriteChoices[s.name])
-						.map((skill) => ({ skill, overwrite: true }))
-				]
-				const skipped = pendingSkipped
-				pendingImport = undefined
-				pendingSkipped = []
-				overwriteChoices = {}
-				if (toImport.length) await importSkills(toImport, skipped)
-				else sendUserToast('No skills imported.')
-			}}
-			onCanceled={() => {
-				pendingImport = undefined
-				pendingSkipped = []
-				overwriteChoices = {}
-			}}
-		>
-			<div class="flex flex-col gap-3 text-xs">
-				<span class="text-secondary">
-					Skills are added under <span class="font-mono">{defaultOwner()}</span>. Move one to a
-					shared folder from the resources page to share it.
-				</span>
-				{#if pendingNew.length}
-					<div>
-						<span class="font-medium text-primary">Add {pendingNew.length} new skill(s):</span>
-						<span class="font-mono text-secondary">{pendingNew.map((s) => s.name).join(', ')}</span>
-					</div>
-				{/if}
-				{#if pendingConflicts.length}
-					<div class="flex flex-col gap-1.5">
-						<span class="font-medium text-primary">
-							{pendingConflicts.length} skill(s) already exist — choose which to overwrite:
-						</span>
-						<div class="rounded-md border divide-y">
-							{#each pendingConflicts as conflict (conflict.name)}
-								<div class="flex items-center justify-between gap-4 px-3 py-2">
-									<span class="font-mono truncate">{conflict.name}</span>
-									<Toggle
-										bind:checked={overwriteChoices[conflict.name]}
-										size="xs"
-										options={{ right: 'Overwrite' }}
-									/>
-								</div>
-							{/each}
-						</div>
-					</div>
-				{/if}
-				{#if pendingSkipped.length}
-					<span class="text-secondary">{pendingSkipped.length} file(s) will be skipped.</span>
-				{/if}
-			</div>
-		</ConfirmationModal>
-	</DrawerContent>
-</Drawer>
-
-<Modal2
-	title={editing ? editing.name : 'New skill'}
-	bind:isOpen={editorOpen}
-	fixedWidth="md"
-	fixedHeight="adaptive"
->
-	{#snippet headerRight()}
-		{#if editing}
-			<ToggleButtonGroup bind:selected={detailMode}>
-				{#snippet children({ item })}
-					<ToggleButton value="view" label="View" icon={Eye} {item} small />
-					<ToggleButton
-						value="edit"
-						label="Edit"
-						icon={Pencil}
-						{item}
-						small
-						disabled={!editing?.canWrite}
-					/>
-				{/snippet}
-			</ToggleButtonGroup>
-		{/if}
-	{/snippet}
-	<div class="w-full flex flex-col gap-3">
-		{#if detailMode === 'view'}
-			{#if parsed.description}
-				<p class="text-xs text-secondary">{parsed.description}</p>
-			{/if}
-			<div class="border rounded-md p-3 overflow-auto max-h-[60vh] space-y-2 {markdownProse.sm}">
-				<Markdown md={parsed.instructions} plugins={[gfmPlugin()]} />
-			</div>
-		{:else}
-			<Path
-				bind:path
-				bind:error={pathError}
-				bind:dirty={pathDirty}
-				initialPath={editing?.path ?? ''}
-				namePlaceholder="skill"
-				kind="resource"
-				workspaceOverride={ws}
-				autofocus={false}
-			/>
-			<!-- The same editor `/resources` gives these resources, so a skill reads the
-			     same in both places. `fixedOverflowWidgets` off keeps its autocomplete
-			     inside the modal instead of clipped behind it. -->
-			<div class="border border-border-light rounded-md overflow-hidden">
-				<SimpleEditor
-					autoHeight
-					lang="md"
-					bind:code={content}
-					fixedOverflowWidgets={false}
-					class="min-h-24"
-				/>
-			</div>
-			<div class="flex items-center justify-between gap-2">
-				<span class="text-2xs text-red-500 min-w-0">{contentError ?? ''}</span>
-				<div class="flex items-center gap-2">
+			{#snippet action()}
+				<div class="flex items-center gap-2 shrink-0">
 					<Button
-						onclick={resetContent}
-						variant="subtle"
+						variant="default"
 						unifiedSize="sm"
-						startIcon={{ icon: RotateCcw }}
-						disabled={saving || !contentChanged}
-						title={editing ? 'Discard unsaved changes to this skill' : 'Restore the sample skill'}
+						startIcon={{ icon: FolderUp }}
+						disabled={saving || forkPending}
+						onClick={() => folderInput?.openPicker()}
 					>
-						Reset
+						Import a folder
 					</Button>
 					<Button
-						onclick={submitEditor}
 						variant="accent"
 						unifiedSize="sm"
-						startIcon={{ icon: editing ? Pencil : Plus }}
-						disabled={!canSave}
+						startIcon={{ icon: Plus }}
+						disabled={saving || forkPending}
+						onClick={openCreate}
 					>
-						{editing ? 'Save skill' : 'Add skill'}
+						New skill
 					</Button>
 				</div>
+			{/snippet}
+
+			<!-- The picker itself. Hidden because the affordance is the button above, but
+			     still `FileInput`: it owns reading and filtering the folder, and a raw input
+			     here would be a second implementation of that to keep in step. -->
+			<div class="hidden">
+				<FileInput
+					bind:this={folderInput}
+					folderOnly
+					bind:files={importFiles}
+					on:change={onDirSelected}
+				/>
+			</div>
+
+			{#if forkPending}
+				<Alert type="info" title="This session has no workspace yet" size="xs" class="mb-4">
+					Skills are read-only until the first message creates this session's fork. Editing or
+					selecting one now would apply to the parent workspace and stop applying once the fork is
+					created.
+				</Alert>
+			{/if}
+			{#if listNotice}
+				<Alert type="warning" title="Not all skills are shown" size="xs" class="mb-4">
+					{listNotice}
+				</Alert>
+			{/if}
+			{#if loading}
+				<div class="text-xs text-secondary p-4 text-center">Loading skills…</div>
+			{:else if loadError}
+				<div class="text-xs text-red-600 dark:text-red-400">
+					Failed to load skills: {loadError}
+				</div>
+			{:else if skills.length === 0}
+				<EmptyState
+					icon={BookOpen}
+					title="No skills yet"
+					description="A skill is a SKILL.md the assistant reads when it applies. Write one here, or import a folder of them."
+					action={{
+						label: 'New skill',
+						icon: Plus,
+						onClick: openCreate,
+						disabled: saving || forkPending
+					}}
+				/>
+			{:else}
+				<div class="flex flex-col gap-0.5">
+					{#each skills as skill (skill.path)}
+						{#snippet icon()}
+							<BookOpen size={16} class="text-tertiary" />
+						{/snippet}
+						{#snippet title()}
+							<span class="truncate leading-5">
+								{ambiguous.has(skill.name) ? skill.path : skill.name}
+							</span>
+						{/snippet}
+						{#snippet subtitle()}{skill.description}{/snippet}
+						{#snippet trailing()}
+							<Toggle
+								size="sm"
+								disabled={forkPending}
+								checked={skill.enabled}
+								on:change={async (e) => await toggle(skill.path, e.detail)}
+							/>
+							<DropdownV2
+								size="sm"
+								bind:open={rowMenuOpen[skill.path]}
+								items={[
+									{
+										// One entry for both halves of the detail: it opens on the rendered
+										// skill, and editing is the switch in its header.
+										displayName: 'Manage skill',
+										icon: skill.canWrite ? Pencil : Eye,
+										action: () => openSkill(skill)
+									},
+									{
+										displayName: 'Delete',
+										icon: Trash2,
+										type: 'delete',
+										disabled: !skill.canWrite || forkPending,
+										action: () => (toDelete = skill)
+									}
+								]}
+							/>
+						{/snippet}
+						<ListRow
+							{icon}
+							{title}
+							{trailing}
+							subtitle={skill.description ? subtitle : undefined}
+							onClick={() => openSkill(skill)}
+						/>
+					{/each}
+				</div>
+			{/if}
+		</Section>
+	</div>
+{/snippet}
+
+{#snippet editorPage()}
+	<!-- The editor takes the panel over rather than opening on top of it: a form
+	     stacked on the settings modal leaves two surfaces arguing over which one a
+	     click or an Escape belongs to. -->
+	<div class="grow min-h-0 overflow-y-auto pr-2">
+		<!-- Sticky so the way back is always one click away, however far the page scrolls. -->
+		<div class="flex sticky top-0 z-10 bg-surface pb-1">
+			<Button
+				variant="subtle"
+				unifiedSize="xs"
+				startIcon={{ icon: ArrowLeft }}
+				btnClasses="text-secondary"
+				onClick={closeEditor}
+			>
+				Skills
+			</Button>
+		</div>
+		<!-- `headerClass` keeps a long skill name on one line: the View/Edit group shares
+	     the header row and would otherwise wrap the title under itself. -->
+		<Section
+			label={editing ? editing.name : 'New skill'}
+			wrapperClass="mt-1"
+			headerClass="min-w-0 truncate pr-2"
+		>
+			{#snippet action()}
+				{#if editing}
+					<!-- The group sizes itself to the header row otherwise, leaving the title
+				     no room; this keeps it to its content and hard against the right. -->
+					<div class="flex justify-end shrink-0">
+						<ToggleButtonGroup bind:selected={detailMode}>
+							{#snippet children({ item })}
+								<ToggleButton value="view" label="View" icon={Eye} {item} small />
+								<ToggleButton
+									value="edit"
+									label="Edit"
+									icon={Pencil}
+									{item}
+									small
+									disabled={!editing?.canWrite}
+								/>
+							{/snippet}
+						</ToggleButtonGroup>
+					</div>
+				{/if}
+			{/snippet}
+			<div class="w-full flex flex-col gap-3">
+				<!-- Both halves stay mounted and only their display swaps: an `{#if}` here would
+				     dispose Monaco every time a reader glanced at the rendered skill and rebuild
+				     it on the way back — the work `warm` exists to have done already. -->
+				<div class="{detailMode === 'view' ? 'flex' : 'hidden'} flex-col gap-3">
+					{#if parsed.description}
+						<p class="text-xs text-secondary">{parsed.description}</p>
+					{/if}
+					<div class="border rounded-md p-3 overflow-auto space-y-2 {markdownProse.sm}">
+						<Markdown md={parsed.instructions} plugins={[gfmPlugin()]} />
+					</div>
+				</div>
+				<div class="{detailMode === 'edit' ? 'flex' : 'hidden'} flex-col gap-3">
+					<Label label="Path">
+						<span class="text-xs font-normal text-secondary">
+							The path decides who can use this skill. Under <span class="font-mono"
+								>u/{$userStore?.username ?? 'you'}</span
+							> it is yours alone; in a folder, everyone who can read that folder can turn it on for
+							their own chats.
+						</span>
+						{#key editorSeq}
+							<Path
+								bind:path
+								bind:error={pathError}
+								bind:dirty={pathDirty}
+								initialPath={editing?.path ?? ''}
+								namePlaceholder="skill"
+								kind="resource"
+								workspaceOverride={ws}
+								autofocus={false}
+							/>
+						{/key}
+					</Label>
+					<!-- The same editor `/resources` gives these resources, so a skill reads the
+				     same in both places. `fixedOverflowWidgets` off keeps its autocomplete
+				     inside the panel instead of clipped behind it. -->
+					<div class="border border-border-light rounded-md overflow-hidden">
+						<SimpleEditor
+							bind:this={bodyEditor}
+							autoHeight
+							lang="markdown"
+							bind:code={content}
+							fixedOverflowWidgets={false}
+							class="min-h-24"
+						/>
+					</div>
+					<div class="flex items-center justify-between gap-2">
+						<span class="text-2xs text-red-500 min-w-0">{contentError ?? ''}</span>
+						<div class="flex items-center gap-2">
+							<Button
+								onClick={resetContent}
+								variant="subtle"
+								unifiedSize="sm"
+								startIcon={{ icon: RotateCcw }}
+								disabled={saving || !contentChanged}
+								title={editing
+									? 'Discard unsaved changes to this skill'
+									: 'Restore the sample skill'}
+							>
+								Reset
+							</Button>
+							<Button
+								onClick={submitEditor}
+								variant="accent"
+								unifiedSize="sm"
+								startIcon={{ icon: editing ? Pencil : Plus }}
+								disabled={!canSave}
+							>
+								{editing ? 'Save skill' : 'Add skill'}
+							</Button>
+						</div>
+					</div>
+				</div>
+			</div>
+		</Section>
+	</div>
+{/snippet}
+
+<ConfirmationModal
+	open={toDelete !== undefined}
+	title="Delete skill"
+	confirmationText="Delete"
+	onConfirmed={async () => {
+		const skill = toDelete
+		toDelete = undefined
+		if (skill) await remove(skill)
+	}}
+	onCanceled={() => (toDelete = undefined)}
+>
+	<span class="text-xs text-primary">
+		This deletes the resource at <span class="font-semibold">{toDelete?.path}</span>, so everyone
+		who selected it loses the skill.
+	</span>
+</ConfirmationModal>
+
+<ConfirmationModal
+	open={pendingImport !== undefined}
+	title="Import skills"
+	type="info"
+	confirmationText="Import"
+	onConfirmed={async () => {
+		const toImport = [
+			...pendingNew.map((skill) => ({ skill, overwrite: false })),
+			...pendingConflicts
+				.filter((s) => overwriteChoices[s.name])
+				.map((skill) => ({ skill, overwrite: true }))
+		]
+		const skipped = pendingSkipped
+		pendingImport = undefined
+		pendingSkipped = []
+		overwriteChoices = {}
+		if (toImport.length) await importSkills(toImport, skipped)
+		else sendUserToast('No skills imported.')
+	}}
+	onCanceled={() => {
+		pendingImport = undefined
+		pendingSkipped = []
+		overwriteChoices = {}
+	}}
+>
+	<div class="flex flex-col gap-3 text-xs">
+		<span class="text-secondary">
+			Skills are added under <span class="font-mono">{defaultOwner()}</span>. Move one to a shared
+			folder from the resources page to share it.
+		</span>
+		{#if pendingNew.length}
+			<div>
+				<span class="font-medium text-primary">Add {pendingNew.length} new skill(s):</span>
+				<span class="font-mono text-secondary">{pendingNew.map((s) => s.name).join(', ')}</span>
+			</div>
+		{/if}
+		{#if pendingConflicts.length}
+			<div class="flex flex-col gap-1.5">
+				<span class="font-medium text-primary">
+					{pendingConflicts.length} skill(s) already exist — choose which to overwrite:
+				</span>
+				<div class="rounded-md border divide-y">
+					{#each pendingConflicts as conflict (conflict.name)}
+						<div class="flex items-center justify-between gap-4 px-3 py-2">
+							<span class="font-mono truncate">{conflict.name}</span>
+							<Toggle
+								bind:checked={overwriteChoices[conflict.name]}
+								size="xs"
+								options={{ right: 'Overwrite' }}
+							/>
+						</div>
+					{/each}
+				</div>
 			</div>
 		{/if}
+		{#if pendingSkipped.length}
+			<span class="text-secondary">{pendingSkipped.length} file(s) will be skipped.</span>
+		{/if}
 	</div>
-</Modal2>
+</ConfirmationModal>
diff --git a/frontend/src/lib/components/copilot/chat/AssistantToolsSection.svelte b/frontend/src/lib/components/copilot/chat/AssistantToolsSection.svelte
new file mode 100644
index 0000000000..99d2d3d286
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/AssistantToolsSection.svelte
@@ -0,0 +1,212 @@
+<!--
+@component
+The Tools section of the assistant settings modal: every tool definition this chat
+sends with each turn. The list carries the model-facing name and description; opening
+one shows the description in full and the arguments it takes. Read-only — tools are not
+individually switchable, they follow the mode and the connected servers.
+-->
+<script lang="ts">
+	import { Button, ListRow, Section } from '$lib/components/common'
+	import { useListHighlight } from '$lib/components/common/listRow/listHighlight.svelte'
+	import PagedContent from '$lib/components/common/modal/PagedContent.svelte'
+	import SchemaViewer from '$lib/components/SchemaViewer.svelte'
+	import SearchItems from '$lib/components/SearchItems.svelte'
+	import TextInput from '$lib/components/text_input/TextInput.svelte'
+	import { ArrowLeft } from 'lucide-svelte'
+	import type { ToolSummary } from './agentContext'
+
+	let {
+		tools,
+		active,
+		blocksClose = $bindable()
+	}: {
+		tools: ToolSummary[]
+		/** Whether this is the panel on screen. Gates the detail page's build, which pulls
+		 * in the schema table and its syntax highlighter. */
+		active: boolean
+		/** True while the detail page is open, so the modal leaves Escape to this section. */
+		blocksClose: boolean
+	} = $props()
+
+	type Marked = ToolSummary & { marked?: string }
+
+	let filter = $state('')
+	// The same fuzzy search the home list and the pickers use, run twice: `marked` covers
+	// whatever the haystack was, and the name and the description are two fields on the
+	// row rather than one string, so each needs a pass of its own to be highlighted.
+	let nameHits = $state<Marked[] | undefined>(undefined)
+	let descriptionHits = $state<Marked[] | undefined>(undefined)
+	// The tool the detail page shows, kept when the page is left so the Right arrow
+	// steps back into it.
+	let selected = $state<ToolSummary | undefined>(undefined)
+	let detailOpen = $state(false)
+
+	const SEARCH_INPUT_ID = 'assistant-tools-search'
+	const rowDomId = (index: number) => `assistant-tool-row-${index}`
+
+	let searching = $derived(filter.trim().length > 0)
+	// Name matches first, then the tools that only matched on what they do. Within each
+	// half the order is the one uFuzzy ranked.
+	let rows: { tool: ToolSummary; name?: string; description?: string }[] = $derived.by(() => {
+		if (!searching) return tools.map((tool) => ({ tool }))
+		const byName = nameHits ?? []
+		const named = new Set(byName.map((t) => t.name))
+		return [
+			...byName.map((t) => ({ tool: t, name: t.marked })),
+			...(descriptionHits ?? [])
+				.filter((t) => !named.has(t.name))
+				.map((t) => ({ tool: t, description: t.marked }))
+		]
+	})
+
+	// The arrows and Enter are answered while focus stays in the search field, the way the
+	// resource-type picker does it: type a few letters, step down the hits, open one.
+	const highlight = useListHighlight({
+		count: () => rows.length,
+		rowId: rowDomId,
+		// The top hit while searching — uFuzzy already ranked it there — and nothing lit
+		// once the field is cleared, when every tool is on screen and none is the answer.
+		restingIndex: () => (searching && rows.length > 0 ? 0 : -1),
+		onActivate: (index) => open(rows[index]?.tool),
+		activateEnterFrom: [SEARCH_INPUT_ID]
+	})
+
+	function open(tool: ToolSummary | undefined) {
+		if (!tool) return
+		selected = tool
+		detailOpen = true
+	}
+
+	$effect(() => {
+		blocksClose = detailOpen
+	})
+	// Parked with the section: a detail page left open behind another section would go
+	// on reporting `blocksClose`, and the modal would refuse to close with nothing on
+	// screen explaining why.
+	$effect(() => {
+		if (!active) detailOpen = false
+	})
+
+	/** Escape steps back to the list rather than closing the whole modal: `blocksClose`
+	 * stops the modal's own handler, so this is the only thing left to answer the key. */
+	function onKeydown(event: KeyboardEvent) {
+		// Every section stays mounted while the modal is open, and `stopPropagation`
+		// does nothing between listeners on `window`: without this, a key aimed at the
+		// section on screen is answered by the four behind it too.
+		if (!active || event.key !== 'Escape' || !detailOpen) return
+		event.preventDefault()
+		event.stopPropagation()
+		detailOpen = false
+	}
+
+	/** Left and Right step between the two pages, which is `PagedContent` answering the
+	 * arrows once it is given this. Forward only goes somewhere once a tool has been
+	 * opened: the detail page has nothing to show before that. */
+	function navigate(key: string) {
+		if (key === 'list') detailOpen = false
+		else if (selected) detailOpen = true
+	}
+</script>
+
+<svelte:window onkeydown={onKeydown} />
+
+<SearchItems {filter} items={tools} bind:filteredItems={nameHits} f={(t) => t.name} />
+<SearchItems {filter} items={tools} bind:filteredItems={descriptionHits} f={(t) => t.description} />
+
+<!-- The list and one tool are levels of one panel, the same shape the Skills and MCP
+     panels use. Warmed once this panel is on screen so the schema table and its
+     highlighter are built before the click rather than inside the transition. -->
+<PagedContent
+	warm={active}
+	class="grow min-h-0"
+	current={detailOpen ? 'detail' : 'list'}
+	onNavigate={active ? navigate : undefined}
+	pages={[
+		{ key: 'list', content: listPage },
+		{ key: 'detail', content: detailPage }
+	]}
+/>
+
+{#snippet listPage()}
+	<!-- svelte-ignore a11y_no_static_element_interactions -->
+	<!-- Arrow keys and Enter are caught here so they work whether the search field or a row
+	     holds focus. -->
+	<div
+		class="grow min-h-0 overflow-y-auto pr-2"
+		onkeydown={highlight.onKeydown}
+		onpointermove={highlight.pointerMoved}
+	>
+		<Section
+			label="Tools"
+			description="What the assistant can call in this session: the built-in tools, plus whatever the connected MCP servers expose."
+		>
+			<!-- Sticks to the top of the scrolling panel so a 70-row list stays searchable. -->
+			<div class="sticky top-0 z-10 bg-surface pb-2">
+				<TextInput
+					bind:value={filter}
+					size="sm"
+					inputProps={{ placeholder: 'Search tools', id: SEARCH_INPUT_ID }}
+				/>
+			</div>
+			{#if rows.length === 0}
+				<div class="py-2 text-xs text-hint">
+					{tools.length === 0 ? 'This chat carries no tools.' : 'No tool matches this search.'}
+				</div>
+			{:else}
+				<!-- Borderless rows on their own hover, the shape the resource-type picker uses:
+				     a card and dividers around 70 rows read as heavier than the list is. -->
+				<div class="flex flex-col gap-0.5">
+					{#each rows as row, index (row.tool.name)}
+						{#snippet title()}
+							<span class="truncate font-mono leading-5">
+								{#if row.name}{@html row.name}{:else}{row.tool.name}{/if}
+							</span>
+						{/snippet}
+						{#snippet subtitle()}
+							{#if row.description}{@html row.description}{:else}{row.tool.description}{/if}
+						{/snippet}
+						<ListRow
+							id={rowDomId(index)}
+							{title}
+							subtitle={row.tool.description ? subtitle : undefined}
+							highlighted={index === highlight.index}
+							onMouseEnter={() => highlight.hovered(index)}
+							onClick={() => open(row.tool)}
+						/>
+					{/each}
+				</div>
+			{/if}
+		</Section>
+	</div>
+{/snippet}
+
+{#snippet detailPage()}
+	<div class="grow min-h-0 overflow-y-auto pr-2">
+		<!-- Sticky so the way back is always one click away, however far down the arguments go. -->
+		<div class="flex sticky top-0 z-10 bg-surface pb-1">
+			<Button
+				variant="subtle"
+				unifiedSize="xs"
+				startIcon={{ icon: ArrowLeft }}
+				btnClasses="text-secondary"
+				onClick={() => (detailOpen = false)}
+			>
+				Tools
+			</Button>
+		</div>
+		<!-- `headerClass` keeps a long tool name on one line. -->
+		<Section
+			label={selected?.name ?? ''}
+			wrapperClass="mt-1"
+			headerClass="min-w-0 truncate pr-2 font-mono"
+			class="flex flex-col gap-4"
+		>
+			{#if selected?.description}
+				<!-- In full, unlike the row, which truncates to one line: most of these run to
+				     several sentences, and this page is where the rest of one lives. -->
+				<div class="text-xs text-secondary whitespace-pre-line">{selected.description}</div>
+			{/if}
+			<SchemaViewer schema={selected?.parameters} />
+		</Section>
+	</div>
+{/snippet}
diff --git a/frontend/src/lib/components/copilot/chat/ChatCollapsibleCard.svelte b/frontend/src/lib/components/copilot/chat/ChatCollapsibleCard.svelte
index f92e347da9..f985e23596 100644
--- a/frontend/src/lib/components/copilot/chat/ChatCollapsibleCard.svelte
+++ b/frontend/src/lib/components/copilot/chat/ChatCollapsibleCard.svelte
@@ -61,6 +61,7 @@
 			)}
 			onclick={onToggle}
 			disabled={!toggleable}
+			aria-expanded={toggleable ? expanded : undefined}
 		>
 			{#if shimmer}
 				<span class="shimmer inline-flex items-center min-w-0">
diff --git a/frontend/src/lib/components/copilot/chat/ContextTextarea.svelte b/frontend/src/lib/components/copilot/chat/ContextTextarea.svelte
index 65cef3f5d6..8ae3b51b56 100644
--- a/frontend/src/lib/components/copilot/chat/ContextTextarea.svelte
+++ b/frontend/src/lib/components/copilot/chat/ContextTextarea.svelte
@@ -770,8 +770,17 @@
 <!-- The composer box: border + rounded live HERE (on the wrapper), not on the
      textarea, so context chips can sit INSIDE the box, above the text. The
      textarea's own @tailwindcss/forms border/ring is neutralized below. -->
+<!-- The disabled treatment lives on the wrapper for the same reason the box
+     does: `disabled` on the textarea alone leaves the field looking exactly
+     like a usable one, so the only cue that typing is refused is placeholder
+     text the eye reads as an invitation. -->
 <div
-	class="w-full scroll-pb-2 bg-surface-input rounded-md border border-border-light focus-within:border-border-selected transition-colors"
+	class={twMerge(
+		'w-full scroll-pb-2 rounded-md border border-border-light transition-colors',
+		disabled
+			? 'bg-surface-disabled cursor-not-allowed'
+			: 'bg-surface-input focus-within:border-border-selected'
+	)}
 >
 	<!-- Context chips live inside the input box, above the textarea. The snippet
 	     self-guards (renders nothing when empty) so no blank row appears. -->
@@ -825,6 +834,7 @@
 				// @tailwindcss/forms border, focus ring, and background so only the
 				// wrapper reads as the field.
 				'!border-transparent !bg-transparent !shadow-none focus:!border-transparent focus:!ring-0',
+				'disabled:cursor-not-allowed disabled:placeholder:text-disabled',
 				CHAT_INPUT_PADDING,
 				className
 			)}
diff --git a/frontend/src/lib/components/copilot/chat/HistoryManager.svelte.ts b/frontend/src/lib/components/copilot/chat/HistoryManager.svelte.ts
index 24d7284b95..592b6217c8 100644
--- a/frontend/src/lib/components/copilot/chat/HistoryManager.svelte.ts
+++ b/frontend/src/lib/components/copilot/chat/HistoryManager.svelte.ts
@@ -599,6 +599,35 @@ export default class HistoryManager {
 		}).catch((err) => console.error('Could not delete chat', err))
 	}
 
+	/** Re-read one chat from the store into the in-memory mirror, for a record
+	 *  another tab wrote after this manager last read it. `init()` is the wrong
+	 *  tool: it re-reads the user's entire history to pick up a single chat.
+	 *
+	 *  'missing' is a fact about the conversation (the store holds nothing under
+	 *  this id); 'unavailable' is a fact about this browser. Callers act on the
+	 *  first and must not act on the second — treating a closed database as an
+	 *  empty chat would throw away a transcript that is merely unreadable. */
+	async reloadChat(id: string): Promise<'loaded' | 'missing' | 'unavailable'> {
+		const db = await this.dbh.whenReady()
+		if (!db) return 'unavailable'
+		try {
+			const chat = await db.get('chats', id)
+			if (!chat) {
+				// Drop the mirror too. `loadPastChat` reads from it and never from the
+				// store, so a copy left behind here is a deleted chat that comes back
+				// on the next rotation onto this id.
+				const { [id]: _gone, ...rest } = this.savedChats
+				this.savedChats = rest
+				return 'missing'
+			}
+			this.savedChats = { ...this.savedChats, [id]: chat }
+			return 'loaded'
+		} catch (err) {
+			console.error('Could not reload chat', err)
+			return 'unavailable'
+		}
+	}
+
 	async loadPastChat(id: string) {
 		const chat = this.savedChats[id]
 		if (!chat) return
diff --git a/frontend/src/lib/components/copilot/chat/HistoryManager.test.ts b/frontend/src/lib/components/copilot/chat/HistoryManager.test.ts
index ffcc065157..cdbf6f2020 100644
--- a/frontend/src/lib/components/copilot/chat/HistoryManager.test.ts
+++ b/frontend/src/lib/components/copilot/chat/HistoryManager.test.ts
@@ -757,3 +757,62 @@ describe('HistoryManager modified-items mask persistence', () => {
 		expect(hm.getModifiedItems(id)).toBeUndefined()
 	})
 })
+
+describe('HistoryManager.reloadChat', () => {
+	it('picks up another tab’s write, and tells an empty chat from an unreadable store', async () => {
+		const hm = new HistoryManager()
+		await hm.init()
+		const chatId = hm.getCurrentChatId()
+		await hm.saveChat(
+			[{ role: 'user', content: 'before the other tab ran' }] as DisplayMessage[],
+			[] as ChatCompletionMessageParam[]
+		)
+
+		// The other tab's turn, written straight to the store this one shares.
+		const db = await openDB('copilot-chat-history::admin@test')
+		const row = (await db.get('chats' as never, chatId)) as any
+		row.displayMessages = [{ role: 'user', content: 'written by the driving tab' }]
+		await db.put('chats' as never, row)
+		db.close()
+
+		expect(await hm.reloadChat(chatId)).toBe('loaded')
+		const chat = await hm.loadPastChat(chatId)
+		expect((chat?.displayMessages[0] as any).content).toBe('written by the driving tab')
+
+		// A chat the store does not hold — distinct from 'unavailable' below:
+		// 'missing' evicts the in-memory mirror, so conflating the two would let
+		// a store that merely failed to open erase transcripts this tab holds.
+		expect(await hm.reloadChat('no-such-chat')).toBe('missing')
+	})
+
+	it('evicts the mirrored copy of a chat the driver deleted', async () => {
+		const hm = new HistoryManager()
+		await hm.init()
+		const chatId = hm.getCurrentChatId()
+		await hm.saveChat(
+			[{ role: 'user', content: 'deleted by the driving tab' }] as DisplayMessage[],
+			[] as ChatCompletionMessageParam[]
+		)
+
+		const db = await openDB('copilot-chat-history::admin@test')
+		await db.delete('chats' as never, chatId)
+		db.close()
+
+		expect(await hm.reloadChat(chatId)).toBe('missing')
+		// loadPastChat serves the mirror, so a copy left behind would resurrect the
+		// deleted transcript the next time this id came round again.
+		expect(await hm.loadPastChat(chatId)).toBeUndefined()
+	})
+
+	it('reports a store it cannot open as unavailable, never as missing', async () => {
+		;(globalThis as any).indexedDB = {
+			open: () => {
+				throw new Error('blocked')
+			}
+		}
+		const hm = new HistoryManager()
+		await hm.init()
+
+		expect(await hm.reloadChat(hm.getCurrentChatId())).toBe('unavailable')
+	})
+})
diff --git a/frontend/src/lib/components/copilot/chat/LinkRenderer.svelte b/frontend/src/lib/components/copilot/chat/LinkRenderer.svelte
index 5d79251fd2..1e885fa304 100644
--- a/frontend/src/lib/components/copilot/chat/LinkRenderer.svelte
+++ b/frontend/src/lib/components/copilot/chat/LinkRenderer.svelte
@@ -3,7 +3,10 @@
 	import { ExternalLink, PanelRight } from 'lucide-svelte'
 	import { Button } from '$lib/components/common'
 	import RowIcon from '$lib/components/common/table/RowIcon.svelte'
-	import { runToolDisplayAction } from './createdResourceActions.svelte'
+	import {
+		hasToolDisplayActionHandler,
+		runToolDisplayAction
+	} from './createdResourceActions.svelte'
 	import {
 		workspaceItemAction,
 		type WindmillItemKind,
@@ -16,6 +19,7 @@
 		'data-wm-kind'?: WindmillItemKind
 		'data-wm-path'?: string
 		'data-wm-target-kind'?: WorkspaceItemTargetKind
+		'data-wm-raw-app'?: string
 		title?: string
 	}
 	let {
@@ -24,10 +28,25 @@
 		'data-wm-kind': wmKind,
 		'data-wm-path': wmPath,
 		'data-wm-target-kind': wmTargetKind,
+		'data-wm-raw-app': wmRawApp,
 		title
 	}: Props = $props()
 
-	const drawerAction = $derived(workspaceItemAction(wmKind, wmPath, wmTargetKind))
+	// The drawers ride with the docked chat, so a surface can render this pill with nothing
+	// able to open one.
+	const available = $derived.by(() => {
+		const action = workspaceItemAction(wmKind, wmPath, wmTargetKind, wmRawApp === 'true')
+		return action && hasToolDisplayActionHandler(action.type) ? action : undefined
+	})
+	// Only the preview panel takes the plain click. A drawer keeps its own button beside an
+	// outbound link: the docked chat mounts drawer handlers on nearly every page, so claiming
+	// that click would redirect these pills far outside the sessions page.
+	const previewAction = $derived(available?.type === 'open_item_preview' ? available : undefined)
+	const drawerAction = $derived(available?.type === 'open_created_resource' ? available : undefined)
+
+	const hint = $derived(
+		previewAction ? `Open ${wmPath} in the preview panel` : `Open ${wmPath} in a new tab`
+	)
 
 	async function openDrawer(event?: Event) {
 		event?.preventDefault()
@@ -36,6 +55,14 @@
 			await runToolDisplayAction(drawerAction)
 		}
 	}
+
+	async function onclick(event: MouseEvent) {
+		// Modifier clicks are the only remaining route to the tab once the plain click is
+		// spoken for, so leave them to the browser.
+		if (!previewAction || event.metaKey || event.ctrlKey || event.shiftKey || event.altKey) return
+		event.preventDefault()
+		await runToolDisplayAction(previewAction)
+	}
 </script>
 
 {#if href}
@@ -43,20 +70,29 @@
 		<span class="group inline-flex items-baseline">
 			<a
 				{href}
-				target="_blank"
-				rel="noopener noreferrer"
-				title={title || wmPath || href}
+				target={previewAction ? undefined : '_blank'}
+				rel={previewAction ? undefined : 'noopener noreferrer'}
+				title={title || hint}
+				{onclick}
 				class="inline-flex items-baseline gap-1 px-1 rounded hover:bg-surface-hover text-primary no-underline font-mono text-[0.9em] align-baseline"
 			>
-				<span class="inline-flex self-center shrink-0">
-					<RowIcon kind={wmKind} size={12} />
+				<!-- Kind icon and action icon share one fixed 12px box, so the pill is the same
+				     width at rest and on hover and the surrounding sentence never reflows. -->
+				<span class="relative inline-flex self-center shrink-0 w-3 h-3">
+					<span class="absolute inset-0 transition-opacity group-hover:opacity-0">
+						<RowIcon kind={wmKind} size={12} />
+					</span>
+					<span
+						class="absolute inset-0 flex items-center justify-center text-tertiary opacity-0 transition-opacity group-hover:opacity-100"
+					>
+						{#if previewAction}
+							<PanelRight size={12} />
+						{:else}
+							<ExternalLink size={11} />
+						{/if}
+					</span>
 				</span>
 				{@render children?.()}
-				<span
-					class="inline-flex self-center shrink-0 text-tertiary opacity-0 group-hover:opacity-100 transition-opacity"
-				>
-					<ExternalLink size={10} />
-				</span>
 			</a>
 			{#if drawerAction}
 				<Button
diff --git a/frontend/src/lib/components/copilot/chat/McpConnections.svelte b/frontend/src/lib/components/copilot/chat/McpConnections.svelte
deleted file mode 100644
index 8c1de65290..0000000000
--- a/frontend/src/lib/components/copilot/chat/McpConnections.svelte
+++ /dev/null
@@ -1,347 +0,0 @@
-<script lang="ts">
-	import { Button, Drawer } from '$lib/components/common'
-	import DrawerContent from '$lib/components/common/drawer/DrawerContent.svelte'
-	import McpConnect from '$lib/components/mcp/McpConnect.svelte'
-	import Toggle from '$lib/components/Toggle.svelte'
-	import { isMcpEnabled, setMcpEnabled } from '$lib/components/mcp/enabledServers'
-	import { loadProviderIcon } from '$lib/components/mcp/providerIcon'
-	import {
-		cachedProviderKey,
-		forgetProviderKey,
-		rememberProviderKey
-	} from '$lib/components/mcp/iconCache'
-	import ConfirmationModal from '$lib/components/common/confirmationModal/ConfirmationModal.svelte'
-	import type { Component } from 'svelte'
-	import { ResourceService } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
-	import { sendUserToast } from '$lib/toast'
-	import { List, Loader2, Plug, Plus, Trash2 } from 'lucide-svelte'
-	import type { Item } from '$lib/utils'
-	import { untrack } from 'svelte'
-	import { getAiChatManager } from './aiChatManagerContext'
-	import { clearMcpToolsCache } from './global/mcpTools'
-
-	const aiChatManager = getAiChatManager()
-	// A session chat operates on its own (possibly forked) workspace without
-	// switching `workspaceStore`, and that is the workspace the chat reads the
-	// enabled set under. Key everything here the same way or a toggle lands under
-	// a key nothing reads.
-	//
-	// `operatingWorkspace` is a plain getter over untracked state, so the store is
-	// read unconditionally rather than behind `??`: short-circuiting it would leave
-	// this derived with no dependency at all, frozen on the workspace it first saw.
-	let ws = $derived.by(() => {
-		const active = $workspaceStore
-		return aiChatManager.operatingWorkspace ?? active!
-	})
-
-	let drawer: Drawer | undefined = $state(undefined)
-	// Connecting is what the drawer is for, so the card is always up; remounting it
-	// after a connection is what clears the fields for the next one.
-	let connectSeq = $state(0)
-	let servers = $state<
-		{
-			path: string
-			description?: string
-			editedAt?: string
-			enabled: boolean
-			icon?: Component<any>
-		}[]
-	>([])
-	let loading = $state(false)
-	let loadError = $state<string | undefined>(undefined)
-	let pendingDisconnect = $state<string | undefined>(undefined)
-
-	// Rows describe one workspace. A switch while the drawer is open must not leave
-	// A's rows on screen while the actions below target B: same path, different
-	// server, and disconnect would delete the wrong one. Dropping them (and the
-	// confirmation standing over one of them) is all this does: this component
-	// mounts with the chat toolbar, so loading here would list resources for every
-	// user who never opens the menu. The two entry points load what they need.
-	let loadSeq = 0
-	$effect(() => {
-		const target = ws
-		untrack(() => {
-			loadSeq++
-			servers = []
-			pendingDisconnect = undefined
-			// A drawer already on screen is neither entry point, and would sit there
-			// reporting that the new workspace has no connections.
-			if (drawer?.isOpen()) void loadServers(target)
-		})
-	})
-
-	async function loadServers(target = ws) {
-		if (!target) return
-		const seq = ++loadSeq
-		loading = true
-		loadError = undefined
-		try {
-			const resources = await ResourceService.listResource({
-				workspace: target,
-				resourceType: 'mcp',
-				perPage: 100
-			})
-			if (seq !== loadSeq) return
-			servers = resources.map((r) => ({
-				path: r.path,
-				description: r.description,
-				editedAt: r.edited_at,
-				enabled: isMcpEnabled(target, r.path)
-			}))
-			void loadIcons(target, seq)
-		} catch (e) {
-			if (seq !== loadSeq) return
-			// Without this the drawer would render the empty state, which reads as
-			// "you have no connections" rather than "we could not load them".
-			loadError = e.body ?? e.message
-		} finally {
-			if (seq === loadSeq) loading = false
-		}
-	}
-
-	export async function open() {
-		drawer?.openDrawer()
-		await loadServers()
-	}
-
-	// A menu is a shortcut, not a directory: past this many the list stops being
-	// scannable, so the rest are reached through the drawer rather than dropped.
-	const MAX_MENU_SERVERS = 8
-
-	/** Rows for the chat's "+" menu: one per connected server, checked when it is
-	 * on, then the way to add another. Loaded on open so the checks are current. */
-	export async function menuItems(closeMenu?: () => void): Promise<Item[]> {
-		// The menu opens on what is already known and refreshes behind it: waiting on
-		// a round trip would stall the whole `+` menu, attachments included.
-		if (servers.length === 0) {
-			await loadServers()
-		} else {
-			void loadServers()
-		}
-		// Enabled first: those are the ones a quick visit is most likely about.
-		const ordered = [...servers].sort(
-			(a, b) => Number(b.enabled) - Number(a.enabled) || a.path.localeCompare(b.path)
-		)
-		const shown = ordered.slice(0, MAX_MENU_SERVERS)
-		return [
-			...shown.map(({ path }) => ({
-				displayName: path,
-				// Getters, not snapshots: the menu stays open across a click, and it has
-				// to read through the live list rather than the row captured here, since
-				// a reload replaces every row object and a getter bound to the old one
-				// would go on reporting the state it was built with.
-				get icon() {
-					// Plug where the provider is unknown, so one nameless server does not
-					// pull its label out of line with the rest.
-					return row(path)?.icon ?? Plug
-				},
-				// Provider icons take css lengths and ignore lucide's `size`, so without
-				// this one of them renders at its 24px default among 14px menu icons.
-				get iconProps() {
-					return row(path)?.icon ? { width: '14px', height: '14px' } : undefined
-				},
-				get toggle() {
-					return row(path)?.enabled ?? false
-				},
-				action: () => toggle(path, !row(path)?.enabled)
-			})),
-			...(ordered.length > shown.length
-				? [
-						{
-							displayName: `Show all ${ordered.length}`,
-							icon: List,
-							action: () => {
-								closeMenu?.()
-								void open()
-							}
-						}
-					]
-				: []),
-			{
-				displayName: 'Connect a server',
-				icon: Plus,
-				separatorTop: servers.length > 0,
-				action: () => {
-					closeMenu?.()
-					void open()
-				}
-			}
-		]
-	}
-
-	function row(path: string) {
-		return servers.find((s) => s.path === path)
-	}
-
-	async function toggle(path: string, enabled: boolean) {
-		// Local preference only: nothing to re-read from the API, and the cached
-		// tool lists stay valid because the servers are unchanged.
-		setMcpEnabled(ws, path, enabled)
-		const server = servers.find((s) => s.path === path)
-		if (server) server.enabled = enabled
-		await aiChatManager.refreshMcpServers()
-	}
-
-	// Deleting a resource also deletes every variable its value references, and an
-	// mcp resource's token is usually the credential of the resource it was created
-	// from (the github one). Drop the reference before deleting so disconnecting
-	// here can never destroy a credential something else still uses; the variable
-	// is left for the user to remove from the Variables page.
-	async function disconnect(path: string) {
-		// Pinned for the whole sequence: a switch midway would strip and delete the
-		// resource that happens to share this path in the workspace switched to.
-		const target = ws
-		try {
-			const resource = await ResourceService.getResource({
-				workspace: target,
-				path
-			})
-			const { token: _token, ...withoutToken } = (resource.value ?? {}) as Record<string, unknown>
-			await ResourceService.updateResource({
-				workspace: target,
-				path,
-				requestBody: { value: withoutToken }
-			})
-			await ResourceService.deleteResource({ workspace: target, path })
-			// A later resource at this path is a different server; it must be turned
-			// on deliberately rather than inherit this one's enablement.
-			setMcpEnabled(target, path, false)
-			forgetProviderKey(target, path)
-			sendUserToast(`Disconnected ${path}. Its token variable was kept.`)
-			await refresh()
-		} catch (e) {
-			sendUserToast(`Failed to disconnect ${path}: ${e.body ?? e.message}`, true)
-		} finally {
-			pendingDisconnect = undefined
-		}
-	}
-
-	// A row whose provider is already cached paints from the cache; the rest cost
-	// one read each, and a long list stops asking rather than firing a request
-	// storm at a screen nobody is reading that far down.
-	const MAX_ICON_LOOKUPS = 20
-	async function loadIcons(target: string, seq: number) {
-		let lookups = 0
-		await Promise.all(
-			servers.map(async (server) => {
-				let key = cachedProviderKey(target, server.path, server.editedAt)
-				if (key === undefined) {
-					if (lookups >= MAX_ICON_LOOKUPS) return
-					lookups++
-					try {
-						const resource = await ResourceService.getResource({
-							workspace: target,
-							path: server.path
-						})
-						key = rememberProviderKey(
-							target,
-							server.path,
-							(resource.value as { url?: unknown } | undefined)?.url,
-							server.editedAt
-						)
-					} catch {
-						return
-					}
-				}
-				const icon = await loadProviderIcon(key)
-				if (seq !== loadSeq) return
-				server.icon = icon
-			})
-		)
-	}
-
-	async function refresh() {
-		// A path can be reconnected to a different server, so the cached tool list
-		// (and the readOnlyHint the confirmation gate reads) must not survive.
-		clearMcpToolsCache()
-		await loadServers()
-		// Re-register the chat's MCP tools so a connection made here is usable in
-		// the next message without a reload.
-		await aiChatManager.refreshMcpServers()
-	}
-</script>
-
-<Drawer bind:this={drawer} size="700px">
-	<DrawerContent
-		title="MCP connections"
-		on:close={() => drawer?.closeDrawer()}
-		tooltip="Connect an external MCP server to this chat. The chat calls its tools with your own credentials, so it can only reach what you can."
-	>
-		<div class="flex flex-col gap-4">
-			{#key connectSeq}
-				<McpConnect
-					workspace={ws}
-					onConnected={async (connectedWs, path) => {
-						// Connecting one is the act of choosing it, and it is keyed on where
-						// it was created rather than on what is on screen now: a switch
-						// during the popup would otherwise enable the path in a workspace
-						// that has no such connection.
-						if (!setMcpEnabled(connectedWs, path, true)) {
-							sendUserToast(`Connected ${path}, but could not turn it on. Toggle it here.`, true)
-						}
-						connectSeq++
-						await refresh()
-					}}
-				/>
-			{/key}
-
-			{#if loading}
-				<div class="flex justify-center p-4"><Loader2 class="animate-spin" /></div>
-			{:else if loadError}
-				<div class="text-xs text-red-600 dark:text-red-400">
-					Failed to load MCP connections: {loadError}
-				</div>
-			{:else if servers.length === 0}
-				<div class="text-xs text-secondary">No MCP server connected yet.</div>
-			{:else}
-				<div class="flex flex-col divide-y border rounded-md bg-surface-tertiary">
-					{#each servers as server (server.path)}
-						<div class="flex items-center gap-3 px-4 py-3">
-							{#if server.icon}
-								{@const Icon = server.icon}
-								<Icon width="16px" height="16px" class="shrink-0" />
-							{:else}
-								<Plug size={16} class="shrink-0 text-tertiary" />
-							{/if}
-							<div class="min-w-0 grow">
-								<div class="text-xs font-semibold text-emphasis truncate">{server.path}</div>
-								{#if server.description}
-									<div class="text-xs text-secondary truncate">{server.description}</div>
-								{/if}
-							</div>
-							<Toggle
-								size="xs"
-								checked={server.enabled}
-								on:change={async (e) => await toggle(server.path, e.detail)}
-							/>
-							<Button
-								unifiedSize="2xs"
-								variant="subtle"
-								startIcon={{ icon: Trash2 }}
-								iconOnly
-								title="Disconnect"
-								onClick={() => (pendingDisconnect = server.path)}
-							/>
-						</div>
-					{/each}
-				</div>
-			{/if}
-		</div>
-
-		<ConfirmationModal
-			open={pendingDisconnect !== undefined}
-			title="Disconnect MCP server"
-			confirmationText="Disconnect"
-			onConfirmed={() => {
-				if (pendingDisconnect) void disconnect(pendingDisconnect)
-			}}
-			onCanceled={() => (pendingDisconnect = undefined)}
-		>
-			<span class="text-xs text-primary">
-				This deletes the resource at <span class="font-semibold">{pendingDisconnect}</span>, so the chat
-				and any flow pointing at it lose the server. Its token variable is kept.
-			</span>
-		</ConfirmationModal>
-	</DrawerContent>
-</Drawer>
diff --git a/frontend/src/lib/components/copilot/chat/ToolMessageActions.svelte b/frontend/src/lib/components/copilot/chat/ToolMessageActions.svelte
index 02612492a5..db2a0e22c4 100644
--- a/frontend/src/lib/components/copilot/chat/ToolMessageActions.svelte
+++ b/frontend/src/lib/components/copilot/chat/ToolMessageActions.svelte
@@ -28,7 +28,10 @@
 	import MqttIcon from '$lib/components/icons/MqttIcon.svelte'
 	import AmqpIcon from '$lib/components/icons/AmqpIcon.svelte'
 	import NatsIcon from '$lib/components/icons/NatsIcon.svelte'
-	import { runToolDisplayAction } from './createdResourceActions.svelte'
+	import {
+		hasToolDisplayActionHandler,
+		runToolDisplayAction
+	} from './createdResourceActions.svelte'
 	import type { CreatedResourceTriggerKind, ToolDisplayAction } from './shared'
 
 	interface Props {
@@ -122,17 +125,21 @@
 					<div class="truncate text-xs font-semibold text-primary">{card.title}</div>
 					<div class="truncate text-2xs text-secondary">{card.subtitle}</div>
 				</div>
-				<Button
-					size="xs"
-					variant="default"
-					title={action.label}
-					loading={runningActionId === action.id}
-					disabled={runningActionId !== undefined && runningActionId !== action.id}
-					startIcon={{ icon: card.buttonIcon }}
-					onClick={() => handleAction(action)}
-				>
-					Open
-				</Button>
+				<!-- open_created_resource is serviced solely by the docked chat's drawers, so
+				     elsewhere the card stands alone as a record of what the tool created. -->
+				{#if hasToolDisplayActionHandler(action.type)}
+					<Button
+						unifiedSize="sm"
+						variant="default"
+						title={action.label}
+						loading={runningActionId === action.id}
+						disabled={runningActionId !== undefined && runningActionId !== action.id}
+						startIcon={{ icon: card.buttonIcon }}
+						onClick={() => handleAction(action)}
+					>
+						Open
+					</Button>
+				{/if}
 			</div>
 		{/each}
 	</div>
diff --git a/frontend/src/lib/components/copilot/chat/agentContext.test.ts b/frontend/src/lib/components/copilot/chat/agentContext.test.ts
new file mode 100644
index 0000000000..53b64813b0
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/agentContext.test.ts
@@ -0,0 +1,65 @@
+import { describe, expect, it } from 'vitest'
+import { attachmentStatusLabel, countReadyAttachments, summarizeTools } from './agentContext'
+import type { Tool } from './shared'
+
+const tool = (name: string, description?: string, parameters?: Record<string, any>) =>
+	({ def: { type: 'function', function: { name, description, parameters } } }) as unknown as Tool<{}>
+
+describe('summarizeTools', () => {
+	// The modal re-derives this on every turn, so an unsorted list would reshuffle
+	// under the reader as tools come and go.
+	it('sorts by name and tolerates a tool with no description', () => {
+		expect(summarizeTools([tool('run_script', 'Run it.'), tool('deploy')])).toEqual([
+			{ name: 'deploy', description: '', parameters: { required: [] } },
+			{ name: 'run_script', description: 'Run it.', parameters: { required: [] } }
+		])
+	})
+
+	// `SchemaViewer` renders no argument table at all without `required`, and a tool
+	// whose arguments are all optional legitimately ships without it.
+	it('defaults required without dropping the declared schema', () => {
+		const [summary] = summarizeTools([
+			tool('open_page', 'Open it.', { type: 'object', properties: { page: { type: 'string' } } })
+		])
+		expect(summary.parameters).toEqual({
+			required: [],
+			type: 'object',
+			properties: { page: { type: 'string' } }
+		})
+	})
+})
+
+describe('countReadyAttachments', () => {
+	// A folder's own status is an aggregate, and `readyFiles()` filters out the
+	// placeholder row an empty or all-binary folder keeps — so counting on the folder
+	// would claim files the assistant cannot open, under a heading about what it can.
+	it('counts a folder by its readable children, not its own status', () => {
+		const folders = [
+			{ files: [{ status: 'indexing' as const }, { status: 'ready' as const }] },
+			{ files: [] },
+			{ files: [{ status: 'locked' as const }] }
+		]
+		expect(countReadyAttachments(folders, [])).toBe(1)
+	})
+
+	it('counts loose files on their own status', () => {
+		const files = [
+			{ status: 'ready' as const },
+			{ status: 'error' as const },
+			{ status: 'ready' as const }
+		]
+		expect(countReadyAttachments([], files)).toBe(2)
+	})
+})
+
+describe('attachmentStatusLabel', () => {
+	// Every unreadable status has to say why: the file tools operate on `readyFiles()`,
+	// so a row that reads like the usable ones is the one place the panel could claim
+	// something the assistant cannot open.
+	it('labels every status the file tools cannot read, and only those', () => {
+		expect(attachmentStatusLabel('ready')).toBeUndefined()
+		for (const status of ['locked', 'unavailable', 'indexing', 'error'] as const) {
+			expect(attachmentStatusLabel(status)).toBeTruthy()
+		}
+	})
+})
diff --git a/frontend/src/lib/components/copilot/chat/agentContext.ts b/frontend/src/lib/components/copilot/chat/agentContext.ts
new file mode 100644
index 0000000000..99b334bcd5
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/agentContext.ts
@@ -0,0 +1,58 @@
+import type { Tool } from './shared'
+import type { AttachedFileStatus } from './files/attachedFiles.svelte'
+
+/** One tool as the settings modal lists it — the model-facing name, description and
+ * argument schema, which is exactly what the tool definition sends. */
+export type ToolSummary = {
+	name: string
+	description: string
+	/** The JSON Schema of the tool's arguments. `required` is defaulted because
+	 * `SchemaViewer` reads it to mark the rows and renders nothing without it, and a
+	 * tool whose arguments are all optional legitimately omits it. */
+	parameters: Record<string, any>
+}
+
+/** Tool definitions as the modal lists them: name-sorted, so a list of dozens is
+ * scannable and stays put as the set changes between turns. */
+export function summarizeTools(tools: readonly Tool<any>[]): ToolSummary[] {
+	return tools
+		.map((t) => ({
+			name: t.def.function.name,
+			description: t.def.function.description ?? '',
+			parameters: { required: [], ...(t.def.function.parameters ?? {}) }
+		}))
+		.sort((a, b) => a.name.localeCompare(b.name))
+}
+
+/** Why an attachment is not reachable, or undefined when it is. The file tools operate
+ * on `readyFiles()`, so every other status is attached-but-unreadable and has to say so
+ * — a row that looks like the readable ones is the one place this could claim something
+ * the assistant cannot actually open. */
+export function attachmentStatusLabel(status: AttachedFileStatus): string | undefined {
+	switch (status) {
+		case 'ready':
+			return undefined
+		case 'locked':
+			return 'needs access'
+		case 'unavailable':
+			return 'unavailable'
+		case 'indexing':
+			return 'indexing…'
+		case 'error':
+			return 'failed'
+	}
+}
+
+/** How many attachments the assistant can actually read, mirroring `readyFiles()`.
+ *
+ * A folder is counted on its children, never on its own status: that status is an
+ * aggregate, so one indexing child would hide the readable rest, while an empty or
+ * all-binary folder keeps a `ready` placeholder that `readyFiles()` filters out and
+ * reads as usable while exposing nothing. */
+export function countReadyAttachments(
+	folders: readonly { files: readonly { status: AttachedFileStatus }[] }[],
+	files: readonly { status: AttachedFileStatus }[]
+): number {
+	const isReady = (f: { status: AttachedFileStatus }) => f.status === 'ready'
+	return folders.filter((d) => d.files.some(isReady)).length + files.filter(isReady).length
+}
diff --git a/frontend/src/lib/components/copilot/chat/artifacts/artifactsState.svelte.ts b/frontend/src/lib/components/copilot/chat/artifacts/artifactsState.svelte.ts
index b8e543a720..2455948e22 100644
--- a/frontend/src/lib/components/copilot/chat/artifacts/artifactsState.svelte.ts
+++ b/frontend/src/lib/components/copilot/chat/artifacts/artifactsState.svelte.ts
@@ -90,6 +90,15 @@ export class SessionArtifactsStore {
 		await this.#load()
 	}
 
+	/** Re-read the loaded session's artifacts from the store, for records another
+	 *  tab wrote after this one loaded. Forces the read setSession skips: that
+	 *  skip protects local edits whose best-effort persist failed, while a tab
+	 *  catching up on another tab's finished turn wants the store's truth. */
+	async resyncFromStore(): Promise<void> {
+		if (this.#sessionId === undefined) return
+		await this.#load()
+	}
+
 	async #load(): Promise<void> {
 		const token = ++this.#seq
 		const id = this.#sessionId
diff --git a/frontend/src/lib/components/copilot/chat/createdResourceActions.svelte.ts b/frontend/src/lib/components/copilot/chat/createdResourceActions.svelte.ts
index 725385d3ee..bd0f3b3d0e 100644
--- a/frontend/src/lib/components/copilot/chat/createdResourceActions.svelte.ts
+++ b/frontend/src/lib/components/copilot/chat/createdResourceActions.svelte.ts
@@ -25,6 +25,15 @@ export function registerToolDisplayActionHandler(
 	}
 }
 
+/**
+ * Reactive: reads the `$state` registry, so a component re-renders when a page mounts or
+ * unmounts its handler. Offering an action without checking this yields an affordance whose
+ * only outcome is the unavailable-action toast.
+ */
+export function hasToolDisplayActionHandler(type: ToolDisplayAction['type']): boolean {
+	return toolDisplayActionHandlers[type] !== undefined
+}
+
 export async function runToolDisplayAction(action: ToolDisplayAction): Promise<void> {
 	const handler = toolDisplayActionHandlers[action.type]
 	if (!handler) {
diff --git a/frontend/src/lib/components/copilot/chat/global/core.ts b/frontend/src/lib/components/copilot/chat/global/core.ts
index 4e08dcebe9..e919769e7a 100644
--- a/frontend/src/lib/components/copilot/chat/global/core.ts
+++ b/frontend/src/lib/components/copilot/chat/global/core.ts
@@ -645,7 +645,7 @@ const writeVariableSchema = variableRequestSchema.extend({
 		.string()
 		.optional()
 		.describe(
-			'The value of the variable. Omit it to leave the value alone — required only when creating a new variable, or when changing a secret variable into a non-secret one. Never invent or guess the value of an existing variable: you cannot read it, and a "$var:..." reference is NOT a valid value (that syntax only references a variable from inside a resource). Omitting it keeps whatever the draft already holds, so a value you set earlier in this conversation stays set; discard_local_draft abandons it.'
+			'The value of the variable. Omit it to leave the value alone — required only when creating a new variable, or when changing a secret variable into a non-secret one. Never invent or guess the value of an existing variable: you cannot read it, and a "$var:..." reference is NOT a valid value (a variable cannot reference itself). Omitting it keeps whatever the draft already holds, so a value you set earlier in this conversation stays set; discard_local_draft abandons it.'
 		),
 	is_secret: z
 		.boolean()
@@ -854,7 +854,9 @@ const testRunArgsSchema = z
 	.record(z.string(), z.any())
 	.nullable()
 	.optional()
-	.describe('Arguments to pass to the runnable. Omit or pass null when no arguments are needed.')
+	.describe(
+		'Arguments to pass to the runnable. Omit or pass null when no arguments are needed. An argument typed as a resource (format "resource-<type>" in the input schema) takes the bare string "$res:<path>" as its whole value — never an object wrapper like {"$res": "<path>"}, and never a plain path, both of which reach the runnable unresolved. Same for a variable, with "$var:<path>". The prefixed string can also sit in a nested field, e.g. {"gh_auth": {"token": "$var:g/all/gh_token"}}.'
+	)
 
 const backgroundArgSchema = z
 	.boolean()
@@ -2214,7 +2216,7 @@ function getResourceInstructions(): string {
 - Reading a variable returns \`{ type: 'variable', path, summary?, isSecret, isDraft }\` — never its value, secret or not. \`isSecret\` tells you whether the value is encrypted.
 - \`write_variable\` takes \`{ path, value?, is_secret?, description?, account?, is_oauth?, expires_at?, labels? }\`. Creating a variable needs \`value\` and \`is_secret\`; editing one needs only the fields you are changing. Omitting \`value\` keeps the stored value, which is the only way to edit a secret variable — you cannot read its value, so passing any \`value\` you did not get from the user destroys it.
 - For secret fields in a resource value, do NOT inline the raw secret. Create a Variable first with \`is_secret: true\`, then in the resource value reference it as \`"$var:path/to/variable"\`.
-- Reference formats inside resource values: \`$var:g/all/name\` (global), \`$var:u/user/name\` (user), \`$var:f/folder/name\` (folder). Reference another resource with \`$res:path/to/resource\`. These are references FROM a resource value; never store a \`$var:\` string as a variable's own value.
+- Reference formats inside resource values: \`$var:g/all/name\` (global), \`$var:u/user/name\` (user), \`$var:f/folder/name\` (folder). Reference another resource with \`$res:path/to/resource\`. The same strings are also how a resource or variable is passed as a run argument (see the run-argument rule in the resource reference below); what they are never valid as is a variable's own value.
 - When deploying drafts that depend on each other (e.g., a resource and the variables it references), deploy the variables first.
 - Use \`search_resource_types\` to discover valid \`resource_type\` names and their JSON Schemas. Match the resource value to that schema.
 - For OAuth resources, the \`is_oauth: true\` flag is managed by Windmill's OAuth flow; global mode generally creates manual resources, not OAuth ones.
@@ -5105,7 +5107,7 @@ function writeVariableDraft(args: WriteVariableArgs, ctx: WriteDraftCtx): Promis
 	// is always the model echoing the reference syntax back instead of a real value.
 	if (args.value === `$var:${args.path}`) {
 		throw new Error(
-			`"${args.value}" is not a valid value for variable "${args.path}" — it is a self-reference. The "$var:" syntax only references a variable from inside a resource value. Omit value to keep the current one.`
+			`"${args.value}" is not a valid value for variable "${args.path}" — it is a self-reference. Omit value to keep the current one.`
 		)
 	}
 	return writeDraft(VARIABLE_SPEC, 'variable', args.path, args, ctx, { override: args.override })
diff --git a/frontend/src/lib/components/copilot/chat/itemPreview.ts b/frontend/src/lib/components/copilot/chat/itemPreview.ts
new file mode 100644
index 0000000000..ef9f14ddc9
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/itemPreview.ts
@@ -0,0 +1,30 @@
+// The session preview panel's action, kept out of `shared.ts` so the chat message render
+// path can import it at runtime without pulling in that module's graph and risking the
+// chunk cycles docs/frontend-import-cycles.md exists to prevent. Keep this file import-free.
+
+/** Item kinds a session preview can host: the three live editors, which are also the
+ * subset a write tool can land. */
+export type PreviewCardKind = 'script' | 'flow' | 'raw_app'
+
+// Dispatched by a preview card on a tool call that created or updated a workspace item,
+// and by a path link in a chat message. Opens the item's live editor in the session side
+// panel — or focuses the tab if it is already open. The handler is registered by the
+// sessions page (the only surface with a preview panel).
+export type OpenItemPreviewAction = {
+	id: string
+	type: 'open_item_preview'
+	label: string
+	previewKind: PreviewCardKind
+	path: string
+}
+
+/** Build the action a preview card or path link dispatches from its (kind, path). */
+export function openItemPreviewAction(kind: PreviewCardKind, path: string): OpenItemPreviewAction {
+	return {
+		id: `open-item-preview:${kind}:${path}`,
+		type: 'open_item_preview',
+		label: `Open ${kind === 'raw_app' ? 'app' : kind} preview`,
+		previewKind: kind,
+		path
+	}
+}
diff --git a/frontend/src/lib/components/copilot/chat/script/MermaidDisplay.svelte b/frontend/src/lib/components/copilot/chat/script/MermaidDisplay.svelte
index 60687efcce..e17cdbcb36 100644
--- a/frontend/src/lib/components/copilot/chat/script/MermaidDisplay.svelte
+++ b/frontend/src/lib/components/copilot/chat/script/MermaidDisplay.svelte
@@ -165,7 +165,7 @@
 
 	<Modal bind:open={expanded} title="Diagram" kind="X" fillHeight class="sm:max-w-none w-[92vw]">
 		{#snippet settings()}
-			<div class="flex flex-row gap-1 mr-8">
+			<div class="flex flex-row gap-1">
 				<Button
 					onclick={() => zoomBy(1 / 1.3)}
 					color="light"
diff --git a/frontend/src/lib/components/copilot/chat/shared.ts b/frontend/src/lib/components/copilot/chat/shared.ts
index b485be51b3..6d6794b56c 100644
--- a/frontend/src/lib/components/copilot/chat/shared.ts
+++ b/frontend/src/lib/components/copilot/chat/shared.ts
@@ -7,6 +7,12 @@ import type { UserDraftItemKind } from '$lib/gen'
 // The gate's two refusals, from a module that holds prose and one size limit: under the
 // shallow-import rule below, the rest of plan mode is not reachable from here.
 import { PLAN_MODE_MESSAGES } from './planModeMessages'
+// Import-free leaf, so it satisfies the shallow-import rule below.
+import {
+	openItemPreviewAction,
+	type OpenItemPreviewAction,
+	type PreviewCardKind
+} from './itemPreview'
 
 // The tool modules that import this one (workspaceTools, flow/core, global/core, ...)
 // call createToolDef and read SPECIAL_MODULE_IDS at *module scope*, so if a chunk cycle
@@ -526,35 +532,11 @@ export type NavigateAction = {
 	page: string
 }
 
-/** Kinds of previewable item a write tool can land — the subset of draft item
- * kinds a session preview can host. */
-export type PreviewCardKind = 'script' | 'flow' | 'raw_app'
-
-// A discrete card shown on a tool call that created or updated a workspace item.
-// Clicking it opens the item's live preview in the session side panel — or focuses
-// the tab if it is already open. The handler is registered by the sessions page
-// (the only surface with a preview panel).
-export type OpenItemPreviewAction = {
-	id: string
-	type: 'open_item_preview'
-	label: string
-	previewKind: PreviewCardKind
-	path: string
-}
+// Re-exported: most consumers reach these through this module.
+export { openItemPreviewAction, type PreviewCardKind, type OpenItemPreviewAction }
 
 export type ToolDisplayAction = CreatedResourceAction | NavigateAction | OpenItemPreviewAction
 
-/** Build the action a preview card dispatches from its (kind, path). */
-export function openItemPreviewAction(kind: PreviewCardKind, path: string): OpenItemPreviewAction {
-	return {
-		id: `open-item-preview:${kind}:${path}`,
-		type: 'open_item_preview',
-		label: `Open ${kind === 'raw_app' ? 'app' : kind} preview`,
-		previewKind: kind,
-		path
-	}
-}
-
 export type UserQuestionDisplay = {
 	question: string
 	choices: string[]
diff --git a/frontend/src/lib/components/copilot/chat/skills/skillsMenu.svelte.ts b/frontend/src/lib/components/copilot/chat/skills/skillsMenu.svelte.ts
new file mode 100644
index 0000000000..15f6f2839d
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/skills/skillsMenu.svelte.ts
@@ -0,0 +1,144 @@
+import { BookOpen, List, Plus } from 'lucide-svelte'
+import { get } from 'svelte/store'
+import { userStore, workspaceStore } from '$lib/stores'
+import { sendUserToast } from '$lib/toast'
+import { logFeatureUsage } from '$lib/utils/featureUsage'
+import type { Item } from '$lib/utils'
+import type { AIChatManager } from '../AIChatManager.svelte'
+import { isSkillEnabled, setSkillEnabled } from './enabledSkills'
+import { ambiguousSkillNames, listSkillResources, type SkillResource } from './skillResources'
+
+type Row = SkillResource & { enabled: boolean }
+
+// A menu is a shortcut, not a directory: past this many the list stops being
+// scannable, so the rest are reached through the settings modal rather than dropped.
+const MAX_MENU_SKILLS = 8
+
+/**
+ * The chat "+" menu's Skills submenu: one row per skill, checked when it is on,
+ * then the way to manage them. Everything a skill is beyond turning it on and off
+ * lives in the assistant settings modal, which `onManage` opens.
+ */
+export class SkillsMenu {
+	#manager: AIChatManager
+	#onManage: () => void
+	#seq = 0
+	/** Rows for the workspace named by `#rowsWorkspace`, and meaningless for any other. */
+	#rows = $state<Row[]>([])
+	#rowsWorkspace: string | undefined = undefined
+
+	constructor(manager: AIChatManager, onManage: () => void) {
+		this.#manager = manager
+		this.#onManage = onManage
+	}
+
+	// A session chat operates on its own (possibly forked) workspace without
+	// switching `workspaceStore`, and that is the workspace the chat reads the
+	// enabled set under. Key everything here the same way or a toggle lands under
+	// a key nothing reads. Read per call rather than derived: the menu is built
+	// on open, so there is no stale snapshot to keep current between opens.
+	get #ws(): string | undefined {
+		return this.#manager.operatingWorkspace ?? get(workspaceStore) ?? undefined
+	}
+
+	async #load(ws: string) {
+		const seq = ++this.#seq
+		try {
+			// The truncation flag is for the settings modal, which is where a partial
+			// read is explained; the menu shows what it got.
+			const { skills: found } = await listSkillResources(ws, get(userStore) ?? undefined)
+			if (seq !== this.#seq) return
+			this.#rows = found.map((s) => ({ ...s, enabled: isSkillEnabled(ws, s.path) }))
+			this.#rowsWorkspace = ws
+		} catch {
+			// The menu's other entries still work; a skills submenu that failed to load
+			// is better empty than blocking the whole "+" menu behind an error.
+			if (seq !== this.#seq) return
+			this.#rows = []
+			this.#rowsWorkspace = ws
+		}
+	}
+
+	#row(path: string) {
+		return this.#rows.find((s) => s.path === path)
+	}
+
+	async #toggle(ws: string, path: string, enabled: boolean) {
+		// A session whose fork is still staged has no workspace of its own yet, so `ws`
+		// is the PARENT: the selection would be stored under it and quietly stop
+		// applying the moment the first send commits the fork.
+		const pendingForkOf = this.#manager.sessionContextResolver?.()?.pendingForkOf
+		if (pendingForkOf !== undefined) {
+			sendUserToast(
+				`This session has not created its workspace yet, so the selection would be stored under "${pendingForkOf}". Send a message first.`,
+				true
+			)
+			return
+		}
+		if (!setSkillEnabled(ws, path, enabled)) {
+			sendUserToast('Could not save the selection for this account.', true)
+			return
+		}
+		const row = this.#row(path)
+		if (row) row.enabled = enabled
+		// Whether people select skills at all. Never the skill itself: a path is
+		// workspace-authored text.
+		logFeatureUsage('ai_session', 'skill_toggle', { key: enabled ? 'on' : 'off', workspace: ws })
+		// The prompt lists exactly the enabled skills, so it has to be rebuilt
+		// before the next message rather than on the next mode change.
+		await this.#manager.refreshGlobalSkills(ws)
+	}
+
+	/** Loaded on open so the checks are current. */
+	async items(closeMenu?: () => void): Promise<Item[]> {
+		const ws = this.#ws
+		if (!ws) return []
+		// The menu opens on what is already known and refreshes behind it: awaited
+		// inline it would stall the whole "+" menu, attachments included. Rows for
+		// another workspace are not "already known" — same path, different skill.
+		if (this.#rowsWorkspace !== ws) {
+			this.#rows = []
+			await this.#load(ws)
+		} else {
+			void this.#load(ws)
+		}
+		const ambiguous = ambiguousSkillNames(this.#rows)
+		// Enabled first: those are the ones a quick visit is most likely about.
+		const ordered = [...this.#rows].sort(
+			(a, b) => Number(b.enabled) - Number(a.enabled) || a.path.localeCompare(b.path)
+		)
+		const shown = ordered.slice(0, MAX_MENU_SKILLS)
+		const manage = () => {
+			closeMenu?.()
+			this.#onManage()
+		}
+		// Bound out here because the getters below sit on plain object literals,
+		// where `this` is the item rather than this menu.
+		const row = (path: string) => this.#row(path)
+		return [
+			...shown.map(({ path, name }) => ({
+				// Ambiguous names are shown by path — two rows reading `deploy` would
+				// leave the choice between them to chance.
+				displayName: ambiguous.has(name) ? path : name,
+				icon: BookOpen,
+				// Getters, not snapshots: the menu stays open across a click, and it has
+				// to read through the live list rather than the row captured here, since
+				// a reload replaces every row object and a getter bound to the old one
+				// would go on reporting the state it was built with.
+				get toggle() {
+					return row(path)?.enabled ?? false
+				},
+				action: () => this.#toggle(ws, path, !row(path)?.enabled)
+			})),
+			...(ordered.length > shown.length
+				? [{ displayName: `Show all ${ordered.length}`, icon: List, action: manage }]
+				: []),
+			{
+				displayName: this.#rows.length > 0 ? 'Manage skills' : 'Add a skill',
+				icon: Plus,
+				separatorTop: this.#rows.length > 0,
+				action: manage
+			}
+		]
+	}
+}
diff --git a/frontend/src/lib/components/copilot/chat/workspaceItems.svelte.ts b/frontend/src/lib/components/copilot/chat/workspaceItems.svelte.ts
index b1a6f695d3..1e02573a32 100644
--- a/frontend/src/lib/components/copilot/chat/workspaceItems.svelte.ts
+++ b/frontend/src/lib/components/copilot/chat/workspaceItems.svelte.ts
@@ -22,6 +22,8 @@ import { findAndReplace } from 'mdast-util-find-and-replace'
 import { visit } from 'unist-util-visit'
 import type { Root, InlineCode, Link } from 'mdast'
 import type { CreatedResourceAction, ToolDisplayAction } from './shared'
+// Leaf module, deliberately not './shared' — see the header of itemPreview.ts.
+import { openItemPreviewAction } from './itemPreview'
 
 export type WindmillItemKind =
 	| 'script'
@@ -46,6 +48,9 @@ export interface WorkspaceItemEntry {
 	kind: WindmillItemKind
 	path: string
 	targetKind?: WorkspaceItemTargetKind
+	/** Apps only. Both kinds share the `app` kind and the same `/apps/get/<path>` route,
+	 * so this flag is all that tells them apart downstream. */
+	rawApp?: boolean
 }
 
 export type WorkspaceItemTargetKind = 'script' | 'flow'
@@ -96,6 +101,7 @@ export function itemHref(entry: WorkspaceItemEntry, workspace?: string): string
 type WorkspaceItemListResult = Array<{
 	path: string
 	is_flow?: boolean | null
+	raw_app?: boolean | null
 }>
 
 const workspaceItemLoaders: Array<{
@@ -165,7 +171,8 @@ class WorkspaceItemRegistry {
 						kind,
 						path: it.path,
 						targetKind:
-							typeof it.is_flow === 'boolean' ? (it.is_flow ? 'flow' : 'script') : undefined
+							typeof it.is_flow === 'boolean' ? (it.is_flow ? 'flow' : 'script') : undefined,
+						rawApp: kind === 'app' ? it.raw_app === true : undefined
 					})
 				}
 			}
@@ -213,13 +220,30 @@ export function extractCandidatePaths(text: string | undefined | null): string[]
 	return [...seen]
 }
 
+/**
+ * The in-app action a resolved path link runs instead of opening a new tab, or undefined
+ * when the kind has none (its link then stays outbound). Returning an action does not mean
+ * it can run on this surface — only the sessions page hosts a preview panel, so callers
+ * gate on `hasToolDisplayActionHandler(action.type)`.
+ */
 export function workspaceItemAction(
 	kind: WindmillItemKind | undefined,
 	path: string | undefined,
-	targetKind?: WorkspaceItemTargetKind
+	targetKind?: WorkspaceItemTargetKind,
+	rawApp?: boolean
 ): ToolDisplayAction | undefined {
 	if (!kind || !path) return undefined
 
+	if (kind === 'script' || kind === 'flow') {
+		return openItemPreviewAction(kind, path)
+	}
+
+	// Raw apps only. A legacy drag-and-drop app has no editor the panel can host, and
+	// legacy items are not extended onto new surfaces — its link stays outbound.
+	if (kind === 'app') {
+		return rawApp ? openItemPreviewAction('raw_app', path) : undefined
+	}
+
 	const base = {
 		id: `open_workspace_item:${kind}:${path}`,
 		type: 'open_created_resource' as const,
@@ -253,6 +277,9 @@ function buildPathLinkNode(
 	if (entry.targetKind) {
 		hProperties['data-wm-target-kind'] = entry.targetKind
 	}
+	if (entry.rawApp) {
+		hProperties['data-wm-raw-app'] = 'true'
+	}
 
 	return {
 		type: 'link',
diff --git a/frontend/src/lib/components/copilot/chat/workspaceItems.test.ts b/frontend/src/lib/components/copilot/chat/workspaceItems.test.ts
index 9bb477fa83..70810dad9a 100644
--- a/frontend/src/lib/components/copilot/chat/workspaceItems.test.ts
+++ b/frontend/src/lib/components/copilot/chat/workspaceItems.test.ts
@@ -153,10 +153,27 @@ describe('workspaceItemAction', () => {
 		})
 	})
 
-	it('skips non-drawerable items and trigger items without target kind', () => {
-		expect(workspaceItemAction('script', 'f/a/b')).toBeUndefined()
-		expect(workspaceItemAction('flow', 'f/a/b')).toBeUndefined()
+	it('creates preview actions for scripts, flows and raw apps', () => {
+		expect(workspaceItemAction('script', 'f/a/b')).toMatchObject({
+			type: 'open_item_preview',
+			previewKind: 'script',
+			path: 'f/a/b'
+		})
+		expect(workspaceItemAction('flow', 'f/a/b')).toMatchObject({
+			type: 'open_item_preview',
+			previewKind: 'flow'
+		})
+		expect(workspaceItemAction('app', 'f/a/b', undefined, true)).toMatchObject({
+			previewKind: 'raw_app'
+		})
+	})
+
+	it('leaves legacy apps as plain links', () => {
+		expect(workspaceItemAction('app', 'f/a/b', undefined, false)).toBeUndefined()
 		expect(workspaceItemAction('app', 'f/a/b')).toBeUndefined()
+	})
+
+	it('skips trigger items without target kind', () => {
 		expect(workspaceItemAction('schedule', 'f/a/b')).toBeUndefined()
 		expect(workspaceItemAction('http_trigger', 'f/a/b')).toBeUndefined()
 	})
@@ -172,6 +189,7 @@ const SAMPLE_ENTRIES: Record<string, WorkspaceItemEntry> = {
 		path: 'u/admin/cleanup_old_jobs'
 	},
 	'f/ops/dashboard': { kind: 'app', path: 'f/ops/dashboard' },
+	'f/ops/live_board': { kind: 'app', path: 'f/ops/live_board', rawApp: true },
 	'f/etl/daily': {
 		kind: 'schedule',
 		path: 'f/etl/daily',
@@ -249,6 +267,23 @@ describe('remarkWindmillPaths (mdast)', () => {
 		expect(props['data-wm-target-kind']).toBe('flow')
 	})
 
+	// Both app kinds reach the renderer as the same `app` kind and route, so this flag is
+	// the only thing that keeps a legacy app off the preview panel.
+	it('marks raw apps so the renderer can tell them from legacy apps', () => {
+		const processor = buildProcessor('admins')
+		const tree = processor.runSync(
+			processor.parse('Open f/ops/live_board and f/ops/dashboard.')
+		) as MdastRoot
+		const byPath = Object.fromEntries(
+			findLinks(tree).map((l) => [
+				(l.data?.hProperties as Record<string, string>)['data-wm-path'],
+				l.data?.hProperties as Record<string, string>
+			])
+		)
+		expect(byPath['f/ops/live_board']['data-wm-raw-app']).toBe('true')
+		expect(byPath['f/ops/dashboard']['data-wm-raw-app']).toBeUndefined()
+	})
+
 	it('leaves unknown paths as plain text', () => {
 		const processor = buildProcessor()
 		const tree = processor.runSync(
diff --git a/frontend/src/lib/components/copilot/lib.toolCalls.test.ts b/frontend/src/lib/components/copilot/lib.toolCalls.test.ts
index ef2708e570..c665cc964e 100644
--- a/frontend/src/lib/components/copilot/lib.toolCalls.test.ts
+++ b/frontend/src/lib/components/copilot/lib.toolCalls.test.ts
@@ -134,6 +134,37 @@ describe('parseOpenAICompletion tool call arguments', () => {
 		expect(addedMessages).toEqual(messages)
 	})
 
+	it('keeps braces inside string arguments out of the object-depth count', async () => {
+		const { parseOpenAICompletion } = await import('./lib')
+		const fn = vi.fn().mockResolvedValue('tool ok')
+		const messages: ChatCompletionMessageParam[] = []
+
+		await parseOpenAICompletion(
+			streamOf([
+				toolCallChunk({
+					id: 'call_1',
+					function: { name: 'patch_app_file', arguments: '{"new_string": ' }
+				}),
+				toolCallChunk({ function: { arguments: '"hello } goodbye \\" } "}' } })
+			]),
+			createCallbacks(),
+			messages,
+			[],
+			[createTool(fn)] as any,
+			{},
+			undefined,
+			{ workspace: 'test' }
+		)
+
+		expect(fn).toHaveBeenCalledWith(
+			expect.objectContaining({ args: { new_string: 'hello } goodbye " } ' } })
+		)
+		const assistant = messages.find((m) => m.role === 'assistant') as any
+		expect(assistant.tool_calls[0].function.arguments).toBe(
+			'{"new_string": "hello } goodbye \\" } "}'
+		)
+	})
+
 	it('marks only the executing tool call as loading when one message has several', async () => {
 		const { parseOpenAICompletion } = await import('./lib')
 		const statuses: Record<string, any> = {}
diff --git a/frontend/src/lib/components/copilot/lib.ts b/frontend/src/lib/components/copilot/lib.ts
index fc8a00727f..19f350a665 100644
--- a/frontend/src/lib/components/copilot/lib.ts
+++ b/frontend/src/lib/components/copilot/lib.ts
@@ -1177,9 +1177,21 @@ export async function getCompletion(
 function extractFirstJSON(str: string) {
 	let depth = 0,
 		i = 0
+	// Braces inside string values are not depth changes, so the scan tracks
+	// quoting and escaping: otherwise an argument such as {"a": "} "} is cut short.
+	let inString = false,
+		escaped = false
 	for (; i < str.length; i++) {
-		if (str[i] === '{') depth++
-		else if (str[i] === '}' && --depth === 0) break
+		const ch = str[i]
+		if (inString) {
+			if (escaped) escaped = false
+			else if (ch === '\\') escaped = true
+			else if (ch === '"') inString = false
+			continue
+		}
+		if (ch === '"') inString = true
+		else if (ch === '{') depth++
+		else if (ch === '}' && --depth === 0) break
 	}
 	return str.slice(0, i + 1)
 }
diff --git a/frontend/src/lib/components/flows/FlowEditor.svelte b/frontend/src/lib/components/flows/FlowEditor.svelte
index eeb4101f92..812e971da9 100644
--- a/frontend/src/lib/components/flows/FlowEditor.svelte
+++ b/frontend/src/lib/components/flows/FlowEditor.svelte
@@ -2,6 +2,8 @@
 	import { Pane, Splitpanes } from 'svelte-splitpanes'
 	import Disposable from '$lib/components/common/drawer/Disposable.svelte'
 	import FlowEditorPanel from './content/FlowEditorPanel.svelte'
+	import { agentEditorTarget, type AgentEditorTarget } from './agentEditorStore.svelte'
+	import AgentEditorModal from './content/AgentEditorModal.svelte'
 	import FlowModuleSchemaMap from './map/FlowModuleSchemaMap.svelte'
 	import type { OpenInSessionSource } from '$lib/components/sessions/OpenInSessionButton.svelte'
 	import WindmillIcon from '../icons/WindmillIcon.svelte'
@@ -14,7 +16,7 @@
 	import { useFlowPanelMode } from './flowPanelMode.svelte'
 	import { useFlowPanelPlacementTelemetry } from './flowEditorTelemetry'
 
-	import { writable } from 'svelte/store'
+	import { get, writable } from 'svelte/store'
 	import type { PropPickerContext, FlowPropPickerConfig } from '$lib/components/prop_picker'
 	import type { PickableProperties } from '$lib/components/flows/previousResults'
 	import type { Flow, Job } from '$lib/gen'
@@ -37,8 +39,16 @@
 	import FlowPanelPlacementPicker from './common/FlowPanelPlacementPicker.svelte'
 	import { prefersSessionHandoff } from '../copilot/chat/global/gate'
 	import { openSourceInSession } from '$lib/components/sessions/sessionSwitch.svelte'
-	import { userStore } from '$lib/stores'
-	const { flowStore, selectionManager } = getContext<FlowEditorContext>('FlowEditorContext')
+	import { userStore, workspaceStore } from '$lib/stores'
+	const { flowStore, selectionManager, pathStore, opWorkspace } =
+		getContext<FlowEditorContext>('FlowEditorContext')
+	// Flow paths repeat across workspaces, and a session keeps every tab it has visited alive, so two
+	// editors can hold the same path at once. Both halves are needed to tell them apart.
+	let editorWorkspace = $derived(opWorkspace?.() ?? $workspaceStore)
+	function targetWorkspace(t: AgentEditorTarget): string | undefined {
+		return t.workspace ?? $workspaceStore
+	}
+
 	const sessionScopedManager = getContext<AIChatManager>('aiChatManager')
 	const aiChatManager = sessionScopedManager ?? singletonAiChatManager
 
@@ -231,7 +241,19 @@
 	setContext<PropPickerContext>('PropPickerContext', {
 		flowPropPickerConfig,
 		pickablePropertiesFiltered: writable<PickableProperties | undefined>(undefined),
-		inModalPanel: () => panelMode === 'modal'
+		// The agent editor is a dialog over the same graph, so a connect started inside it has the
+		// same closure hazard as one started from the modal panel. Only this flow's own, on the same
+		// rule the mount below claims one by: a session keeps every visited tab alive, and a target
+		// belonging to another of them is not a dialog over this graph.
+		inModalPanel: () => {
+			if (panelMode === 'modal') return true
+			const t = agentEditorTarget()
+			return (
+				t !== undefined &&
+				t.host?.flowPath === get(pathStore) &&
+				targetWorkspace(t) === editorWorkspace
+			)
+		}
 	})
 
 	// Read by graph step items (VirtualItem) to show a per-step "explore" hint on hover,
@@ -524,3 +546,12 @@
 		{/if}
 	{/snippet}
 </Disposable>
+
+<!-- Mounted here rather than in the panel, which is keyed on the selection and would take the
+     dialog down with it the moment the graph selection moved. Claims only agents opened from this
+     flow: a session keeps every visited tab alive, and each would otherwise build its own editor
+     over the same draft. -->
+<AgentEditorModal
+	enableAi={!disableAi}
+	owns={(t) => t.host?.flowPath === $pathStore && targetWorkspace(t) === editorWorkspace}
+/>
diff --git a/frontend/src/lib/components/flows/agentDraft.svelte.ts b/frontend/src/lib/components/flows/agentDraft.svelte.ts
new file mode 100644
index 0000000000..5a6a67ccb8
--- /dev/null
+++ b/frontend/src/lib/components/flows/agentDraft.svelte.ts
@@ -0,0 +1,363 @@
+import { untrack } from 'svelte'
+import { get } from 'svelte/store'
+import { deepEqual } from 'fast-equals'
+import { ResourceService } from '$lib/gen'
+import { sendUserToast } from '$lib/toast'
+import { canWrite } from '$lib/utils'
+import { userStore } from '$lib/stores'
+import { getUserExt } from '$lib/user'
+import { useTriggerDraftSync, type TriggerDraftSync } from '../triggers/useTriggerDraftSync.svelte'
+import { logReusableAgentUsage } from './agentTelemetry'
+import {
+	AGENT_BRAIN_LABELS,
+	agentEditorRefusal,
+	transformValuedBrainKeys,
+	type AIAgentConfig
+} from './agentResourceUtils'
+// Lives here rather than beside the other config helpers: `agentResourceUtils` is a leaf, and
+// importing tool-name validation into it would cycle back through `flowInfers` and pull the whole
+// editor into every module that reads a brain key.
+import { getToolNameError } from './agentToolUtils'
+
+/**
+ * Why a run of this config would fail before it started, if it would. Only the conditions the
+ * worker itself rejects: a provider it cannot call, or a tool name it cannot put in the schema it
+ * gives the model. Everything else an agent may legitimately leave unset.
+ */
+function agentConfigRunError(args: Record<string, any> | undefined): string | undefined {
+	const provider = args?.provider
+	if (!provider?.resource || !provider?.model) {
+		return 'Select a provider resource and model before deploying.'
+	}
+	// `kind` is what the worker deserializes the provider as, and a config written through the JSON
+	// editor can leave it out entirely. Presence only: the list of kinds lives behind the provider
+	// SDKs, and an unrecognised one already fails the same way at the worker.
+	if (typeof provider.kind !== 'string' || provider.kind === '') {
+		return 'The provider is missing its kind. Pick the resource again to set it.'
+	}
+	// Reported rather than iterated: the editor renders a JSON-authored non-list as an empty
+	// roster, so this is the only place left that would meet the raw value, and a bare `.filter`
+	// on it throws past the caller. `null` is how the API spells "unset".
+	if (args?.tools != null && !Array.isArray(args.tools)) {
+		return 'Tools must be a list. Fix it in the resource editor before deploying.'
+	}
+	// Only a flowmodule tool's summary is a callable name: the worker never reads an mcp or
+	// websearch summary, so a blank one there is not an error and must not count as a sibling.
+	// Same filter as `collectInvalidAgentToolNames`, which is the rule the graph enforces.
+	const tools = (args?.tools ?? []) as Record<string, any>[]
+	const named = tools.filter(
+		(t) => t?.value?.tool_type !== 'mcp' && t?.value?.tool_type !== 'websearch'
+	)
+	const siblingNames = named.map((t) => t?.summary ?? '')
+	for (const tool of named) {
+		const err = getToolNameError(tool?.summary ?? '', tool?.value?.tool_type, siblingNames)
+		if (err) return `${err}. Name every tool before deploying.`
+	}
+	// An MCP tool is named by its server rather than by a summary, and it starts with none. The
+	// worker loads every MCP config before the model runs, so one unresolved path fails every run
+	// of the agent rather than just the call that needed it.
+	if (tools.some((t) => t?.value?.tool_type === 'mcp' && !t?.value?.resource_path)) {
+		return 'Pick a server for every MCP tool before deploying.'
+	}
+	return undefined
+}
+
+/**
+ * The draft shape every resource editor writes, and the only one the review/deploy page knows how
+ * to canonicalize and deploy (`utils_draft_deploy.ts`, `canonicalizeDraftDiffValue` /
+ * `deployDraft`). The agent editor is a different *form* over this same row, never a parallel
+ * draft: writing anything else here would take agent drafts off the deploy page and out of the
+ * generic editor.
+ *
+ * `args` is the resource value. `description`, `labels` and `wsSpecific` are round-tripped
+ * untouched — the agent form has no place for them, and dropping them would rewrite the resource
+ * on deploy.
+ */
+export interface AgentResourceState {
+	path: string
+	description: string
+	args: AIAgentConfig
+	/** Present only for a path with no deployed row, whose type the draft is the sole record of.
+	 *  Elsewhere it is left out to match the generic resource editor, which has no field for it. */
+	resource_type?: string
+	labels?: string[]
+	wsSpecific: boolean
+}
+
+export interface AgentDraftOptions {
+	/** The `ai_agent` resource being edited. */
+	path: () => string | undefined
+	workspace: () => string | undefined
+}
+
+export interface AgentDraftHandle {
+	/** The form's live state, draft included. Bind the editor to `state.args`. */
+	readonly state: AgentResourceState | undefined
+	/** The deployed baseline, for the banner's diff. */
+	readonly deployed: AgentResourceState | undefined
+	readonly loading: boolean
+	/** No deployed row at this path, so a deploy has to create rather than update. */
+	readonly noDeployed: boolean
+	/** Whether this user may write the resource. False makes the editor a read-only view. */
+	readonly canWrite: boolean
+	/** Why this path cannot be edited here, if it cannot. Render it instead of the form. */
+	readonly refusal: string | undefined
+	readonly sync: TriggerDraftSync
+	/** Write the current state to the resource and drop the draft. */
+	deploy: () => Promise<boolean>
+}
+
+/**
+ * Local-autosave wiring for an `ai_agent` resource, over the shared drawer-kind draft sync. Holding
+ * a live handle is what makes a write from elsewhere — another tab, the generic resource editor on
+ * the same path — land in the open agent editor.
+ */
+export function useAgentDraft(opts: AgentDraftOptions): AgentDraftHandle {
+	let state = $state<AgentResourceState | undefined>(undefined)
+	let deployed = $state<AgentResourceState | undefined>(undefined)
+	let loading = $state(true)
+	let noDeployed = $state(false)
+	let canWriteResource = $state(true)
+	/** Guards the load against a path that changed under a slow response. */
+	let loadedFor = $state<string | undefined>(undefined)
+	/** Why the loaded path cannot be edited here, if it cannot. Gates the sync for as long as that
+	 *  path stays, so a resource this editor refuses can neither restore its draft into the form nor
+	 *  have one autosaved from it. Set it through `refuse`, which also clears what was loaded. */
+	let refusal = $state<string | undefined>(undefined)
+
+	const sync = useTriggerDraftSync({
+		itemKind: 'resource',
+		path: () => opts.path() ?? '',
+		workspace: () => opts.workspace(),
+		drawerLoading: () => loading || refusal != null,
+		// `$state.snapshot` deep-reads, so the sync effects re-run when a nested field of `args`
+		// changes. Returning the object itself only subscribes to the reference, and every edit the
+		// form makes is a nested one.
+		getCfg: () => (state ? ($state.snapshot(state) as Record<string, any>) : undefined),
+		applyCfg: (cfg) => {
+			state = cfg as AgentResourceState
+		},
+		deployed: () => deployed as Record<string, any> | undefined
+	})
+
+	function refuse(reason: string) {
+		loading = false
+		refusal = reason
+		state = undefined
+		deployed = undefined
+		noDeployed = false
+		canWriteResource = false
+		sendUserToast(reason, true)
+	}
+
+	$effect(() => {
+		const path = opts.path()
+		const ws = opts.workspace()
+		untrack(() => {
+			if (!path || !ws) {
+				state = undefined
+				deployed = undefined
+				loadedFor = undefined
+				refusal = undefined
+				return
+			}
+			const key = `${ws}:${path}`
+			if (loadedFor === key) return
+			loadedFor = key
+			loading = true
+			refusal = undefined
+			// The user alongside the resource, as the generic resource editor loads it: a session or
+			// fork editor operates on a workspace that is not the one being navigated, and groups,
+			// folders and the admin flag are all per workspace, so the nav user would answer for the
+			// wrong membership in both directions.
+			Promise.all([
+				ResourceService.getResource({ workspace: ws, path, getDraft: true }),
+				getUserExt(ws).catch(() => undefined)
+			])
+				// The rejection handler is `then`'s second argument rather than a trailing `catch`, so
+				// it answers for the fetch alone: a throw in the body below leaves a loaded editor
+				// standing instead of tearing it down as an unreadable resource.
+				.then(
+					async ([r, user]) => {
+						// A slower response for a path we have left must not overwrite the current one.
+						if (loadedFor !== key) return
+						// A step's `agent` is caller-authored, so it can name a resource of any type, and a
+						// deploy from here would replace that resource's whole value while keeping its type.
+						const refused = agentEditorRefusal(path, r.resource_type)
+						if (refused) {
+							refuse(refused)
+							return
+						}
+						noDeployed = Boolean((r as any).no_deployed)
+						const deployedState: AgentResourceState = {
+							path: r.path,
+							description: r.description ?? '',
+							args: (r.value ?? {}) as AIAgentConfig,
+							// Only where nothing else answers for the type: with a deployed row both the
+							// create below and the review page's `deployDraft` read it from there, and
+							// carrying it would make every draft the generic resource editor writes — which
+							// has no field for it — differ from this baseline on that key alone.
+							...(noDeployed ? { resource_type: r.resource_type } : {}),
+							labels: r.labels ?? undefined,
+							wsSpecific: r.ws_specific ?? false
+						}
+						// Same rule the generic resource editor applies. The backend refuses the write
+						// either way, but without this the editor would invite edits it cannot save and
+						// autosave a draft on every keystroke against a resource the reader cannot deploy.
+						canWriteResource = canWrite(
+							r.path,
+							r.extra_perms ?? {},
+							user ?? get(userStore) ?? undefined
+						)
+						// An agent that exists only as a draft has no deployed value to compare against or
+						// fall back to, and the response's is a synthetic echo of the draft. Leaving the
+						// baseline unset is what suppresses the unsaved-changes banner for it, exactly as
+						// `useTriggerDraftSync` intends: its Discard would otherwise reset to that synthetic
+						// value and delete the one row the agent lives in.
+						deployed = noDeployed ? undefined : deployedState
+						// Open on the draft when there is one, so the editor never flashes the deployed
+						// config before the autosave lands.
+						state =
+							((r as any).draft as AgentResourceState | undefined) ?? structuredClone(deployedState)
+						loading = false
+						await sync.maybeRestore()
+					},
+					(err) => {
+						// A failed load knows neither the resource's type nor its value, so it refuses:
+						// clearing `loading` alone would let the sync restore a persisted draft into a form
+						// that would then deploy over a resource nobody read.
+						if (loadedFor !== key) return
+						refuse(`Could not load agent ${path}: ${err}`)
+					}
+				)
+		})
+	})
+
+	async function deploy(): Promise<boolean> {
+		const ws = opts.workspace()
+		const s = state
+		if (!ws || !s) return false
+		// The editor offers only values, but a transform can arrive from a step that was forked
+		// before this existed, or from the generic resource editor: say so rather than writing it.
+		const transformValued = transformValuedBrainKeys(s.args)
+		if (transformValued.length > 0) {
+			const fields = transformValued.map((key) => AGENT_BRAIN_LABELS[key] ?? key)
+			const many = fields.length > 1
+			sendUserToast(
+				`${fields.join(', ')} ${many ? 'are' : 'is'} set to an expression or an AI-filled value, which a saved agent cannot store. Replace ${many ? 'them' : 'it'} with a plain value before deploying.`,
+				true
+			)
+			return false
+		}
+		// The resource endpoint takes any JSON, so nothing downstream stops an agent that cannot run:
+		// the worker needs a provider to call and rejects a tool whose name it cannot pass to the
+		// model. Deploying one would break every flow linking it, so it is refused here.
+		const blocked = agentConfigRunError(s.args)
+		if (blocked) {
+			sendUserToast(blocked, true)
+			return false
+		}
+		// Renaming is not this editor's to do: moving the resource leaves every step that links to it
+		// naming a path that no longer exists, and reconciling those is a feature of its own. A
+		// renamed path can still reach here, the generic editor writing the same draft row and
+		// offering a path field, so refuse it rather than performing half of a rename.
+		const currentPath = opts.path()
+		if (currentPath && s.path !== currentPath) {
+			sendUserToast(
+				`This draft renames the agent to ${s.path}. Deploy it from the resource editor instead.`,
+				true
+			)
+			return false
+		}
+		// Only a draft naming another type: the load refuses a resource that is not an agent, while a
+		// draft the generic resource editor wrote names no type at all and inherits the loaded one.
+		if (s.resource_type && s.resource_type !== 'ai_agent') {
+			sendUserToast(`This draft is a ${s.resource_type} resource, not an agent.`, true)
+			return false
+		}
+		// The form stays editable while the request is in flight, so everything below works from a
+		// snapshot taken now. Adopting the live state as `deployed` afterwards would count an edit
+		// made during the request as saved, and the banner would clear on a value the server never
+		// received; against the snapshot it stays a draft, which is what it is.
+		const submitted = structuredClone($state.snapshot(s)) as AgentResourceState
+		const body = {
+			path: submitted.path,
+			value: submitted.args,
+			description: submitted.description,
+			labels: submitted.labels,
+			ws_specific: submitted.wsSpecific
+		}
+		try {
+			if (noDeployed) {
+				await ResourceService.createResource({
+					workspace: ws,
+					// A create needs a type, and the load proved this path is an agent before opening.
+					requestBody: { ...body, resource_type: submitted.resource_type ?? 'ai_agent' }
+				})
+			} else {
+				// The type this editor proved is as old as the load, and an update carries no type of
+				// its own: were the path deleted and recreated as something else meanwhile, this write
+				// would put an agent config inside that resource. Reading it again narrows the window
+				// to the request rather than to however long the editor stayed open.
+				const current = await ResourceService.getResource({ workspace: ws, path: submitted.path })
+				const refused = agentEditorRefusal(submitted.path, current.resource_type)
+				if (refused) {
+					refuse(refused)
+					return false
+				}
+				await ResourceService.updateResource({
+					workspace: ws,
+					path: submitted.path,
+					requestBody: body
+				})
+			}
+		} catch (err) {
+			sendUserToast(`Could not save agent: ${err}`, true)
+			return false
+		}
+		// The counter the step card's write-back used to report, from the surface that now owns the
+		// write: a deploy here reaches every flow linking this agent.
+		logReusableAgentUsage(noDeployed ? 'saved' : 'updated')
+		deployed = submitted
+		noDeployed = false
+		// Only when the form still holds exactly what was sent. `discard` resets the handle's cell to
+		// what it is given, and the apply-effect copies that back over the form: against an edit made
+		// while the request was in flight that would erase it, draft and all. Such an edit is a real
+		// unsaved change over the version just deployed, so it keeps its draft and its banner.
+		if (!deepEqual($state.snapshot(state), submitted)) {
+			sendUserToast(`Saved agent ${submitted.path}. Later edits are still unsaved`)
+			loadedFor = `${ws}:${submitted.path}`
+			return true
+		}
+		// `discard`, not `remove`: it resets the handle's cell to what was just saved, so the
+		// apply-effect cannot bounce the form back to the now-stale draft.
+		sync.discard(opts.path()!, submitted)
+		// A rename moves the row, so the next load must not reuse the old key.
+		loadedFor = `${ws}:${submitted.path}`
+		sendUserToast(`Saved agent ${submitted.path}`)
+		return true
+	}
+
+	return {
+		get state() {
+			return state
+		},
+		get deployed() {
+			return deployed
+		},
+		get loading() {
+			return loading
+		},
+		get noDeployed() {
+			return noDeployed
+		},
+		get canWrite() {
+			return canWriteResource
+		},
+		get refusal() {
+			return refusal
+		},
+		sync,
+		deploy
+	}
+}
diff --git a/frontend/src/lib/components/flows/agentEditStore.svelte.ts b/frontend/src/lib/components/flows/agentEditStore.svelte.ts
deleted file mode 100644
index a44cda0792..0000000000
--- a/frontend/src/lib/components/flows/agentEditStore.svelte.ts
+++ /dev/null
@@ -1,103 +0,0 @@
-// The agent an AI agent step is being edited-in-place against (set by "Edit" on a linked agent),
-// with what the editor needs to judge the edits. Lives outside AgentResourceBar so the "Editing
-// <path>" mode survives that component unmounting — another node selected, or the step's own tab
-// switched — while the session goes on.
-//
-// Entries are looked up by the forked step's `tools` array identity, not by any location key:
-// Edit assigns a fresh array (unique per fork, including nested editors reusing a module id),
-// in-place edits keep it, and wholesale state replacement (undo, session drafts) yields new
-// objects that simply never match — a stale entry can't resurface as a phantom Editing banner.
-import type { FlowModule } from '$lib/gen'
-
-export type AgentEdit = {
-	/** The agent the fork is an edit of, which "Save changes" writes back to. */
-	path: string
-	/** The agent as deployed, in the form the editor compares edits in. Kept here rather than in
-	 *  the editor, which can unmount mid-session and would otherwise lose the baseline that tells
-	 *  an edit from the deployed value. */
-	deployedConfig?: string
-}
-
-type Entry = AgentEdit & { marker: object }
-
-// Capped: abandoned forks (editor closed without Save/Cancel) leave dead entries behind.
-const MAX_ENTRIES = 20
-
-let entries = $state<Entry[]>([])
-
-export function getAgentEdit(marker: object | undefined): AgentEdit | undefined {
-	const entry = marker ? entries.find((e) => e.marker === marker) : undefined
-	if (!entry) return undefined
-	// Without the marker: a caller that hands the edit back to `setAgentEditingPath` for another
-	// marker must not smuggle the old one along.
-	return { path: entry.path, deployedConfig: entry.deployedConfig }
-}
-
-export function getAgentEditingPath(marker: object | undefined): string | undefined {
-	return getAgentEdit(marker)?.path
-}
-
-export function setAgentEditingPath(
-	marker: object | undefined,
-	path: string | undefined,
-	details: Omit<AgentEdit, 'path'> = {}
-) {
-	if (!marker) return
-	const rest = entries.filter((e) => e.marker !== marker)
-	entries = path ? [...rest.slice(-(MAX_ENTRIES - 1)), { marker, path, ...details }] : rest
-}
-
-// Carry edit state across a wholesale clone of the flow: the clone replaces every `tools` array
-// (breaking marker identity) while preserving content verbatim, so re-keying entries to the
-// cloned arrays by module id is safe there — unlike undo or session restores, which change
-// content and must keep invalidating.
-export function reanchorAgentEditsAcross(
-	getModules: () => FlowModule[] | undefined,
-	refresh: () => void
-) {
-	const anchors: { key: string; edit: AgentEdit; marker: object }[] = []
-	forEachAgentFork(getModules(), (key, tools) => {
-		const edit = getAgentEdit(tools)
-		if (edit) anchors.push({ key, edit, marker: tools })
-	})
-	refresh()
-	if (anchors.length === 0) return
-	const byKey = new Map<string, object>()
-	forEachAgentFork(getModules(), (key, tools) => byKey.set(key, tools))
-	for (const a of anchors) {
-		setAgentEditingPath(a.marker, undefined)
-		const tools = byKey.get(a.key)
-		if (tools) {
-			const { path, ...details } = a.edit
-			setAgentEditingPath(tools, path, details)
-		}
-	}
-}
-
-// Visit every standalone (unlinked) agent's tools array, including nested agent tools. Keys are
-// ancestry-qualified (`hostId/toolId`): resource-imported tool ids are not flow-global, so a
-// nested agent may share a bare id with a flow module and must not alias it.
-function forEachAgentFork(
-	modules: FlowModule[] | undefined,
-	visit: (key: string, tools: object) => void,
-	prefix: string = ''
-) {
-	for (const mod of modules ?? []) {
-		const v = mod.value as FlowModule['value'] | undefined
-		if (!v) continue
-		if (v.type === 'forloopflow' || v.type === 'whileloopflow') {
-			forEachAgentFork(v.modules, visit, prefix)
-		} else if (v.type === 'branchone') {
-			forEachAgentFork(v.default, visit, prefix)
-			for (const b of v.branches ?? []) forEachAgentFork(b.modules, visit, prefix)
-		} else if (v.type === 'branchall') {
-			for (const b of v.branches ?? []) forEachAgentFork(b.modules, visit, prefix)
-		} else if (v.type === 'aiagent') {
-			const key = `${prefix}${mod.id}`
-			if (!v.agent && v.tools) {
-				visit(key, v.tools)
-			}
-			forEachAgentFork(v.tools as FlowModule[] | undefined, visit, `${key}/`)
-		}
-	}
-}
diff --git a/frontend/src/lib/components/flows/agentEditStore.test.ts b/frontend/src/lib/components/flows/agentEditStore.test.ts
deleted file mode 100644
index 7dc5c86203..0000000000
--- a/frontend/src/lib/components/flows/agentEditStore.test.ts
+++ /dev/null
@@ -1,93 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import type { FlowModule } from '$lib/gen'
-import {
-	getAgentEdit,
-	getAgentEditingPath,
-	setAgentEditingPath,
-	reanchorAgentEditsAcross
-} from './agentEditStore.svelte'
-
-function tool(id: string): object {
-	return { id, value: { type: 'rawscript', tool_type: 'flowmodule', input_transforms: {} } }
-}
-
-function agentFork(id: string, tools: object[]): FlowModule {
-	return { id, value: { type: 'aiagent', tools, input_transforms: {} } } as unknown as FlowModule
-}
-
-describe('reanchorAgentEditsAcross', () => {
-	it('re-keys edit entries to the cloned tools arrays by module id', () => {
-		const toolsA: object[] = [tool('t1')]
-		const toolsB: object[] = [tool('t2')]
-		let modules = [agentFork('a', toolsA), agentFork('b', toolsB)]
-		setAgentEditingPath(toolsA, 'f/agents/one')
-		setAgentEditingPath(toolsB, 'f/agents/two')
-
-		reanchorAgentEditsAcross(
-			() => modules,
-			() => {
-				// stand-in for refreshStateStore's $state.snapshot deep clone
-				modules = JSON.parse(JSON.stringify(modules))
-			}
-		)
-
-		expect(getAgentEditingPath(toolsA)).toBeUndefined()
-		expect(getAgentEditingPath((modules[0].value as any).tools)).toBe('f/agents/one')
-		expect(getAgentEditingPath((modules[1].value as any).tools)).toBe('f/agents/two')
-	})
-
-	it('keeps host and nested-agent entries distinct when a nested tool reuses the host id', () => {
-		// Resource tool ids are not flow-global: a nested agent tool may share the host step's id.
-		const nestedTools: object[] = [tool('t2')]
-		const nested = agentFork('a', nestedTools)
-		const hostTools: object[] = [tool('t1'), nested]
-		let modules = [agentFork('a', hostTools)]
-		setAgentEditingPath(hostTools, 'f/agents/parent')
-		setAgentEditingPath(nestedTools, 'f/agents/nested')
-
-		reanchorAgentEditsAcross(
-			() => modules,
-			() => {
-				modules = JSON.parse(JSON.stringify(modules))
-			}
-		)
-
-		const newHost = (modules[0].value as any).tools
-		const newNested = newHost[1].value.tools
-		expect(getAgentEditingPath(newHost)).toBe('f/agents/parent')
-		expect(getAgentEditingPath(newNested)).toBe('f/agents/nested')
-	})
-
-	it('carries the deployed baseline with the path', () => {
-		const tools: object[] = [tool('t1')]
-		let modules = [agentFork('a', tools)]
-		setAgentEditingPath(tools, 'f/agents/one', { deployedConfig: '{"d":1}' })
-
-		reanchorAgentEditsAcross(
-			() => modules,
-			() => {
-				modules = JSON.parse(JSON.stringify(modules))
-			}
-		)
-
-		expect(getAgentEdit((modules[0].value as any).tools)).toEqual({
-			path: 'f/agents/one',
-			deployedConfig: '{"d":1}'
-		})
-	})
-
-	it('drops the entry when the module is gone after the refresh', () => {
-		const tools: object[] = [tool('t1')]
-		let modules = [agentFork('a', tools)]
-		setAgentEditingPath(tools, 'f/agents/one')
-
-		reanchorAgentEditsAcross(
-			() => modules,
-			() => {
-				modules = []
-			}
-		)
-
-		expect(getAgentEditingPath(tools)).toBeUndefined()
-	})
-})
diff --git a/frontend/src/lib/components/flows/agentEditorStore.svelte.ts b/frontend/src/lib/components/flows/agentEditorStore.svelte.ts
new file mode 100644
index 0000000000..83660212b3
--- /dev/null
+++ b/frontend/src/lib/components/flows/agentEditorStore.svelte.ts
@@ -0,0 +1,63 @@
+/**
+ * Which saved agent the agent editor is showing, and which of its tools.
+ *
+ * The editor edits the `ai_agent` resource through its own draft, so this holds a resource path
+ * rather than a flow node: the same agent opens the same editor from a flow step and from the
+ * resources page. Module-level rather than a context value because what opens it — a step's card,
+ * a list row — unmounts the moment the selection moves.
+ */
+export interface AgentEditorTarget {
+	path: string
+	/** The workspace the opener operates on; the nav workspace when absent. */
+	workspace?: string
+	toolId?: string
+	/** A level of the editor that is not the form. Mutually exclusive with `toolId`. */
+	view?: 'evals'
+	/** Where to re-resolve a graph's tool nodes after a deploy, when opened from a flow step. Only a
+	 *  real flow sets it: the agent editor offers no way to open a second editor from inside itself. */
+	host?: { flowPath: string; moduleId: string }
+}
+
+let target = $state<AgentEditorTarget | undefined>(undefined)
+
+export function openAgentEditor(open: Omit<AgentEditorTarget, 'toolId' | 'view'>) {
+	target = { ...open }
+}
+
+export function closeAgentEditor() {
+	target = undefined
+}
+
+/** Navigate between the agent and one of its tools. Passing undefined returns to the agent. */
+export function showAgentEditorTool(toolId: string | undefined) {
+	if (!target) return
+	target = { ...target, toolId, view: undefined }
+}
+
+/** Navigate between the agent and one of its own levels. Passing undefined returns to the agent. */
+export function showAgentEditorView(view: AgentEditorTarget['view']) {
+	if (!target) return
+	target = { ...target, view, toolId: undefined }
+}
+
+export function agentEditorTarget(): AgentEditorTarget | undefined {
+	return target
+}
+
+/** How many times each agent has been written, so a surface that reads the resource can refetch it.
+ *  The editor and the step card that opens it are separate components over one resource, neither
+ *  owning the other, and a deploy that leaves the path alone changes nothing they otherwise key on. */
+let agentWrites = $state<Record<string, number>>({})
+
+function writeKey(workspace: string | undefined, path: string | undefined): string {
+	return `${workspace ?? ''}:${path ?? ''}`
+}
+
+export function markAgentWritten(workspace: string | undefined, path: string) {
+	const key = writeKey(workspace, path)
+	agentWrites[key] = (agentWrites[key] ?? 0) + 1
+}
+
+export function agentWriteCount(workspace: string | undefined, path: string | undefined): number {
+	return agentWrites[writeKey(workspace, path)] ?? 0
+}
diff --git a/frontend/src/lib/components/flows/agentFormFields.test.ts b/frontend/src/lib/components/flows/agentFormFields.test.ts
new file mode 100644
index 0000000000..3a9a88663e
--- /dev/null
+++ b/frontend/src/lib/components/flows/agentFormFields.test.ts
@@ -0,0 +1,126 @@
+import { describe, expect, it } from 'vitest'
+import { AI_AGENT_SCHEMA } from './flowInfers'
+import {
+	AGENT_FIELD_BY_KEY,
+	AGENT_FIELDS,
+	agentFieldIsSet,
+	agentStreamingEnabled,
+	initialVisibleAgentFields
+} from './agentFormFields'
+
+const schemaProperties = AI_AGENT_SCHEMA.properties ?? {}
+
+function set(key: string, transform: unknown): boolean {
+	return agentFieldIsSet(AGENT_FIELD_BY_KEY[key], transform)
+}
+
+describe('agentFieldIsSet', () => {
+	it('reads the seeded placeholder as unset', () => {
+		expect(set('temperature', { type: 'static', value: undefined })).toBe(false)
+		expect(set('temperature', undefined)).toBe(false)
+		// The same placeholder after a round trip through the API.
+		expect(set('temperature', { type: 'static', value: null })).toBe(false)
+	})
+
+	it('treats a value the runtime cannot tell from absence as unset', () => {
+		expect(set('output_type', { type: 'static', value: 'text' })).toBe(false)
+		expect(set('max_iterations', { type: 'static', value: 10 })).toBe(false)
+		expect(set('memory', { type: 'static', value: { kind: 'off' } })).toBe(false)
+		expect(set('user_attachments', { type: 'static', value: [] })).toBe(false)
+	})
+
+	it('reads streaming as unset while it is on, which is what an absent key does', () => {
+		expect(schemaProperties.streaming?.default).toBe(true)
+		expect(set('streaming', { type: 'static', value: true })).toBe(false)
+		expect(set('streaming', { type: 'static', value: false })).toBe(true)
+	})
+
+	it('reads anything the user authored as set', () => {
+		expect(set('temperature', { type: 'static', value: 0 })).toBe(true)
+		expect(set('output_type', { type: 'static', value: 'image' })).toBe(true)
+		expect(set('memory', { type: 'static', value: { kind: 'auto', context_length: 5 } })).toBe(true)
+		expect(set('max_iterations', { type: 'javascript', expr: 'flow_input.loops' })).toBe(true)
+		expect(set('max_iterations', { type: 'javascript', expr: '' })).toBe(false)
+	})
+})
+
+describe('initialVisibleAgentFields', () => {
+	it('shows only the core fields for a step that materialized every default', () => {
+		// What the pre-redesign form wrote on first render of a blank agent step.
+		const legacy = {
+			provider: { type: 'static', value: { kind: 'openai', resource: '$res:u/admin/openai' } },
+			output_type: { type: 'static', value: 'text' },
+			user_message: { type: 'static', value: undefined },
+			system_prompt: { type: 'static', value: undefined },
+			streaming: { type: 'static', value: true },
+			memory: { type: 'static', value: { kind: 'off' } },
+			output_schema: { type: 'static', value: null },
+			user_attachments: { type: 'static', value: [] },
+			max_completion_tokens: { type: 'static', value: null },
+			temperature: { type: 'static', value: null },
+			max_iterations: { type: 'static', value: 10 }
+		}
+		expect([...initialVisibleAgentFields(legacy, schemaProperties)].sort()).toEqual([
+			'provider',
+			'system_prompt',
+			'tools',
+			'user_message'
+		])
+	})
+
+	it('collapses a linked step to its flow-local inputs', () => {
+		const linkedSchema = {
+			user_message: schemaProperties.user_message,
+			user_attachments: schemaProperties.user_attachments
+		}
+		expect([...initialVisibleAgentFields({}, linkedSchema)]).toEqual(['user_message'])
+	})
+
+	it('covers every schema key, so no field can only be reached through the raw doc', () => {
+		const registered = new Set(AGENT_FIELDS.map((f) => f.key))
+		expect(Object.keys(schemaProperties).filter((k) => !registered.has(k))).toEqual([])
+	})
+})
+
+// Three chat surfaces decide whether to consume a stream from this, and the worker decides whether
+// to send one from `streaming.unwrap_or(true)`. They agree only while absent means on here.
+describe('agentStreamingEnabled', () => {
+	const step = (input_transforms: Record<string, any>, rest: Record<string, any> = {}) => ({
+		type: 'aiagent',
+		input_transforms,
+		...rest
+	})
+
+	it('reads an unwritten field as streaming', () => {
+		expect(agentStreamingEnabled(step({}))).toBe(true)
+		// What the API returns for the `{"type":"static"}` placeholder the schema backfill seeds.
+		expect(agentStreamingEnabled(step({ streaming: { type: 'static', value: null } }))).toBe(true)
+		expect(agentStreamingEnabled(step({ streaming: { type: 'static', value: true } }))).toBe(true)
+	})
+
+	it('only an explicit false holds the answer back', () => {
+		expect(agentStreamingEnabled(step({ streaming: { type: 'static', value: false } }))).toBe(false)
+	})
+
+	it('reads off what the step cannot answer for', () => {
+		// An image answer never streams, whatever `streaming` says.
+		expect(
+			agentStreamingEnabled(
+				step({
+					streaming: { type: 'static', value: true },
+					output_type: { type: 'static', value: 'image' }
+				})
+			)
+		).toBe(false)
+		// A linked step carries no brain: the agent's own `streaming: false` is invisible here.
+		expect(agentStreamingEnabled(step({}, { agent: 'u/admin/a' }))).toBe(false)
+		// An expression has no value until the run it would decide is already under way, on either
+		// of the two fields the answer depends on.
+		expect(
+			agentStreamingEnabled(step({ streaming: { type: 'javascript', expr: 'flow_input.s' } }))
+		).toBe(false)
+		expect(
+			agentStreamingEnabled(step({ output_type: { type: 'javascript', expr: 'flow_input.o' } }))
+		).toBe(false)
+	})
+})
diff --git a/frontend/src/lib/components/flows/agentFormFields.ts b/frontend/src/lib/components/flows/agentFormFields.ts
new file mode 100644
index 0000000000..820dbfd949
--- /dev/null
+++ b/frontend/src/lib/components/flows/agentFormFields.ts
@@ -0,0 +1,232 @@
+import { deepEqual } from 'fast-equals'
+import type { InputTransform } from '$lib/gen'
+
+/**
+ * How the AI agent form presents `AI_AGENT_SCHEMA`: which group a field belongs to, what it is
+ * called, and what leaving it unset actually does at runtime.
+ *
+ * Kept apart from the schema because none of it is JSON Schema: the schema stays the contract with
+ * the backend, this is the contract with the reader. It imports nothing from `flowInfers.ts`, so
+ * the two cannot cycle.
+ */
+
+export type AgentFieldGroup = 'model' | 'messages' | 'tools' | 'output'
+
+/** Groups in the order a run assembles the request: pick a model, build the messages, let it call
+ *  tools, shape what comes back. */
+export const AGENT_FIELD_GROUPS: { id: AgentFieldGroup; label: string }[] = [
+	{ id: 'model', label: 'Model' },
+	{ id: 'messages', label: 'Messages' },
+	{ id: 'tools', label: 'Tools' },
+	{ id: 'output', label: 'Output' }
+]
+
+/** The tool roster, which reads `flowModule.value.tools` rather than an `input_transforms` key.
+ *  It lives in the registry so the groups keep a single ordering. */
+export const AGENT_TOOLS_ROW = 'tools'
+
+export interface AgentFieldSpec {
+	key: string
+	group: AgentFieldGroup
+	/** Names the field wherever it appears: its row, the add menu, a linked agent's summary. */
+	label: string
+	tooltip?: string
+	/** Always rendered, and not removable. */
+	core?: boolean
+	/** Rendered by the form itself rather than as an `input_transforms` row. */
+	virtual?: boolean
+	/** The value a run cannot tell apart from an absent key, which is what makes holding it mean
+	 *  "unset". Read off the backend rather than `schema.default`, which the two have disagreed on
+	 *  before. Also what the add menu seeds the field with, so a new row opens showing what it
+	 *  overrides. */
+	implicit?: unknown
+	/** The same value written for a reader, shown under the field's name in the add menu. */
+	defaultHint?: string
+	/** Ignored for image output, so the field hides while `output_type` is `'image'`. */
+	textOnly?: boolean
+	/** Filled in per run rather than configured on the step, so a form that is collecting a run's
+	 *  inputs shows it whether or not the step wrote anything for it. The step's own form still
+	 *  treats it as optional: there it is one of the fields the add menu offers. */
+	runInput?: boolean
+}
+
+export const AGENT_FIELDS: AgentFieldSpec[] = [
+	{
+		key: 'provider',
+		group: 'model',
+		label: 'Provider',
+		core: true
+	},
+	// Not text-only, unlike the fields around it: image output runs through an ordinary chat model
+	// (OpenAI's `image_generation` tool, OpenRouter's `modalities`) that samples at this
+	// temperature, so hiding it would hide a setting the run still uses.
+	{
+		key: 'temperature',
+		group: 'model',
+		label: 'Temperature',
+		tooltip: 'How random the generation is, from 0 for deterministic up to 2.',
+		defaultHint: 'Default: the provider decides'
+	},
+	{
+		key: 'max_completion_tokens',
+		group: 'model',
+		label: 'Max output tokens',
+		tooltip: 'The most tokens the model may produce in its answer.',
+		defaultHint: 'Default: the provider decides'
+	},
+	{
+		key: 'system_prompt',
+		group: 'messages',
+		label: 'System message',
+		tooltip: 'Sets how the agent should behave. Sent ahead of everything else.',
+		core: true
+	},
+	{
+		key: 'memory',
+		group: 'messages',
+		label: 'Memory',
+		tooltip:
+			'History sent between the system message and the user message. Windmill can keep it for you, or you can supply the messages yourself.',
+		implicit: { kind: 'off' },
+		defaultHint: 'Default: off',
+		textOnly: true
+	},
+	{
+		key: 'user_message',
+		group: 'messages',
+		label: 'User message',
+		tooltip:
+			"The user turn, sent after the system message and any history. Turn on chat input on the flow's input interface to feed it from the chat.",
+		core: true
+	},
+	{
+		key: 'user_attachments',
+		group: 'messages',
+		label: 'Attachments',
+		tooltip: 'Images or PDFs sent along with the user message. Needs S3 storage on the workspace.',
+		implicit: [],
+		defaultHint: 'Default: none',
+		runInput: true
+	},
+	{
+		key: AGENT_TOOLS_ROW,
+		group: 'tools',
+		label: 'Tools',
+		core: true,
+		virtual: true
+	},
+	{
+		key: 'max_iterations',
+		group: 'tools',
+		label: 'Max iterations',
+		tooltip:
+			'How many times the agent may go round the loop of calling the model and running the tools it asks for. One iteration can run several tools. If it is still calling tools at the last one, the step fails and returns the messages so far. Between 1 and 1000.',
+		implicit: 10,
+		defaultHint: 'Default: 10'
+	},
+	{
+		key: 'output_type',
+		group: 'output',
+		label: 'Output type',
+		tooltip:
+			'Image output needs S3 storage on the workspace, ignores tools, and works with OpenAI, Google AI and the OpenRouter gemini-image-preview model.',
+		implicit: 'text',
+		defaultHint: 'Default: text'
+	},
+	{
+		key: 'output_schema',
+		group: 'output',
+		label: 'Output schema',
+		tooltip: 'A JSON schema the answer has to follow.',
+		defaultHint: 'Default: none',
+		textOnly: true
+	},
+	{
+		key: 'streaming',
+		group: 'output',
+		label: 'Stream the response',
+		tooltip: 'Send the answer back as it is generated, rather than once it is complete.',
+		implicit: true,
+		defaultHint: 'Default: on',
+		textOnly: true
+	}
+]
+
+export const AGENT_FIELD_BY_KEY: Record<string, AgentFieldSpec> = Object.fromEntries(
+	AGENT_FIELDS.map((f) => [f.key, f])
+)
+
+/**
+ * Whether a transform holds something a run would do differently from an absent key. Core fields
+ * are always set: they are what an agent is.
+ */
+export function agentFieldIsSet(
+	spec: AgentFieldSpec,
+	transform: InputTransform | any | undefined
+): boolean {
+	if (spec.core) return true
+	if (!transform || typeof transform !== 'object') return false
+	if (transform.type === 'javascript') return Boolean(transform.expr)
+	// An AI-filled field is the agent tool case: the value arrives at runtime, so it is set.
+	if (transform.type === 'ai') return true
+	const value = transform.value
+	// `null` as well as `undefined`: a placeholder transform serializes as `{"type":"static"}` and
+	// comes back from the API with an explicit `"value": null`, so the two shapes are the same field.
+	if (value === undefined || value === null) return false
+	if (spec.implicit !== undefined && deepEqual(value, spec.implicit)) return false
+	return true
+}
+
+/**
+ * Whether a run of this step would stream its answer, mirroring the worker's
+ * `has_stream = user_wants_streaming && is_text_output`. Absence means on
+ * (`args.streaming.unwrap_or(true)`), so an unwritten field streams.
+ *
+ * A caller that reads this wrong does not merely mislabel the run: a chat surface that opens a
+ * stream for an answer the worker sends in one piece re-runs the flow when its connection times
+ * out. So the rule is that anything this cannot settle from the step alone reads as off, the cost
+ * of being wrong that way being a live answer arriving at the end instead of as it is written.
+ * Unsettled means either of the two fields holding an expression, whose value exists only once the
+ * run it decides is already under way, or a linked agent, whose brain lives in the resource where
+ * this has no sight of it at all.
+ */
+export function agentStreamingEnabled(value: Record<string, any> | undefined): boolean {
+	if (value?.agent) return false
+	const transforms = value?.input_transforms as Record<string, InputTransform | any> | undefined
+	const settled = (t: InputTransform | any | undefined) => t == undefined || t.type === 'static'
+	const outputType = transforms?.output_type
+	const streaming = transforms?.streaming
+	if (!settled(outputType) || !settled(streaming)) return false
+	// An image answer never streams, whatever `streaming` says.
+	if (outputType?.value === 'image') return false
+	return streaming?.value !== false
+}
+
+/**
+ * Whether the current schema carries this field at all. A linked step's schema is reduced to the
+ * flow-local inputs, which is what collapses its form to the Messages group on its own.
+ */
+export function agentFieldAppliesTo(
+	spec: AgentFieldSpec,
+	schemaProperties: Record<string, any> | undefined
+): boolean {
+	// A virtual row has no schema key to look for, so it keys off the brain being editable here.
+	if (spec.virtual) return Boolean(schemaProperties && 'provider' in schemaProperties)
+	return Boolean(schemaProperties && spec.key in schemaProperties)
+}
+
+/**
+ * The fields to render when a step is first opened. Visibility is sticky from here on: the form
+ * only ever adds to this set, so emptying a textbox never makes its row vanish under the cursor.
+ */
+export function initialVisibleAgentFields(
+	args: Record<string, InputTransform | any> | undefined,
+	schemaProperties: Record<string, any> | undefined
+): Set<string> {
+	const visible = new Set<string>()
+	for (const spec of AGENT_FIELDS) {
+		if (!agentFieldAppliesTo(spec, schemaProperties)) continue
+		if (agentFieldIsSet(spec, args?.[spec.key])) visible.add(spec.key)
+	}
+	return visible
+}
diff --git a/frontend/src/lib/components/flows/agentResourceUtils.test.ts b/frontend/src/lib/components/flows/agentResourceUtils.test.ts
index 75d4f9e0ff..3c55ec128c 100644
--- a/frontend/src/lib/components/flows/agentResourceUtils.test.ts
+++ b/frontend/src/lib/components/flows/agentResourceUtils.test.ts
@@ -1,15 +1,52 @@
 import { describe, expect, it } from 'vitest'
 
 import {
-	agentConfigAsEdited,
 	agentConfigToInputTransforms,
+	agentEditorRefusal,
 	flowLocalInputs,
 	inputTransformsToAgentConfig,
 	nonStaticBrainKeys,
 	summarizeAgentBrain,
-	toolInputOverrides
+	toolInputOverrides,
+	transformValuedBrainKeys
 } from './agentResourceUtils'
 
+describe('transformValuedBrainKeys', () => {
+	// The tag is the whole test: `{type:'ai'}` carries no payload key to look for.
+	it('flags every transform variant, whatever it carries', () => {
+		expect(
+			transformValuedBrainKeys({
+				system_prompt: { type: 'ai' },
+				temperature: { type: 'javascript', expr: 'flow_input.t' },
+				max_iterations: { type: 'static', value: 3 }
+			})
+		).toEqual(['system_prompt', 'temperature', 'max_iterations'])
+	})
+
+	it('leaves the brain values that are legitimately objects', () => {
+		expect(
+			transformValuedBrainKeys({
+				output_schema: { type: 'object', properties: {} },
+				memory: { kind: 'auto', context_length: 20 },
+				provider: { kind: 'openai', model: 'gpt-4o' },
+				system_prompt: 'hi'
+			})
+		).toEqual([])
+	})
+})
+
+describe('agentEditorRefusal', () => {
+	it('opens an agent', () => {
+		expect(agentEditorRefusal('u/admin/agent', 'ai_agent')).toBeUndefined()
+	})
+
+	// A path with no deployed row answers with its own draft, and the generic resource editor writes
+	// no type: assuming `ai_agent` there would create that path as an agent on deploy.
+	it('refuses an unknown type rather than assuming one', () => {
+		expect(agentEditorRefusal('u/admin/db', undefined)).toContain('no deployed agent')
+	})
+})
+
 describe('summarizeAgentBrain', () => {
 	it('returns only set fields, in brain-key order, formatted', () => {
 		const rows = summarizeAgentBrain({
@@ -20,9 +57,9 @@ describe('summarizeAgentBrain', () => {
 			max_iterations: 10
 		})
 		expect(rows).toEqual([
-			{ label: 'Model', value: 'openai · gpt-4o' },
-			{ label: 'System prompt', value: 'You are helpful' },
-			{ label: 'Streaming', value: 'on' },
+			{ label: 'Provider', value: 'openai · gpt-4o' },
+			{ label: 'System message', value: 'You are helpful' },
+			{ label: 'Stream the response', value: 'on' },
 			{ label: 'Temperature', value: '0.7' },
 			{ label: 'Max iterations', value: '10' }
 		])
@@ -70,24 +107,6 @@ describe('inputTransformsToAgentConfig', () => {
 	})
 })
 
-describe('agentConfigAsEdited', () => {
-	it('keeps an expression as itself, where the saved config would drop it', () => {
-		const transforms = {
-			system_prompt: { type: 'static', value: 'hi' },
-			temperature: { type: 'javascript', expr: 'flow_input.t' },
-			max_iterations: { type: 'static', value: undefined },
-			user_message: { type: 'static', value: 'hello' }
-		} as any
-		expect(agentConfigAsEdited(transforms, [])).toEqual({
-			tools: [],
-			system_prompt: 'hi',
-			temperature: { type: 'javascript', expr: 'flow_input.t' }
-		})
-		// The saved shape is blind to the expression: that is the difference this exists for.
-		expect(inputTransformsToAgentConfig(transforms, [])).toEqual({ tools: [], system_prompt: 'hi' })
-	})
-})
-
 describe('agentConfigToInputTransforms', () => {
 	it('wraps brain values as static transforms and round-trips through the config', () => {
 		const config = { provider: { kind: 'openai' }, system_prompt: 'hi', tools: [{ id: 't1' }] }
diff --git a/frontend/src/lib/components/flows/agentResourceUtils.ts b/frontend/src/lib/components/flows/agentResourceUtils.ts
index eeba76d271..a5f4d84add 100644
--- a/frontend/src/lib/components/flows/agentResourceUtils.ts
+++ b/frontend/src/lib/components/flows/agentResourceUtils.ts
@@ -1,5 +1,6 @@
 import { deepEqual } from 'fast-equals'
 import type { InputTransform } from '$lib/gen'
+import { AGENT_FIELDS } from './agentFormFields'
 
 // The brain fields stored flat in an `ai_agent` resource value. The flow-local inputs
 // (user_message/user_attachments) are intentionally excluded — they are supplied per-flow.
@@ -19,6 +20,21 @@ export const AGENT_FLOW_LOCAL_KEYS = ['user_message', 'user_attachments'] as con
 
 export type AgentTool = Record<string, any>
 
+/**
+ * Why this resource cannot be edited as an agent, if it cannot. A path with no deployed row answers
+ * with its own draft, whose type the generic resource editor never writes, so an unknown type is
+ * refused rather than assumed: deploying it would create that path as an agent.
+ */
+export function agentEditorRefusal(
+	path: string,
+	resourceType: string | undefined
+): string | undefined {
+	if (resourceType === 'ai_agent') return undefined
+	return resourceType
+		? `${path} is a ${resourceType} resource, not an agent.`
+		: `${path} has no deployed agent to edit.`
+}
+
 /** Brain keys whose step transform is non-static and would be dropped by a save-as-agent snapshot. */
 export function nonStaticBrainKeys(
 	inputTransforms: Record<string, InputTransform> | undefined
@@ -87,35 +103,17 @@ export function inputTransformsToAgentConfig(
 	const config: AIAgentConfig = { tools: tools ?? [] }
 	for (const key of AGENT_BRAIN_KEYS) {
 		const t = inputTransforms?.[key] as any
-		if (t && t.type === 'static' && t.value !== undefined) {
+		// `null` as well as `undefined`: a placeholder transform is `{"type":"static"}`, and it comes
+		// back from the API — and from a schema backfill — with an explicit null. Writing it through
+		// would put `memory: null` in the saved agent and show as a change against a config that
+		// simply omits the key.
+		if (t && t.type === 'static' && t.value !== undefined && t.value !== null) {
 			;(config as any)[key] = t.value
 		}
 	}
 	return config
 }
 
-/**
- * The configuration as the step holds it, in the shape of the saved config: a static transform as
- * its value, any other transform as itself. The saved config keeps static values only, so a
- * comparison in that shape is blind to an expression — which the step runs, and linking strips.
- */
-export function agentConfigAsEdited(
-	inputTransforms: Record<string, InputTransform> | undefined,
-	tools: AgentTool[] | undefined
-): Record<string, unknown> {
-	const config: Record<string, unknown> = { tools: tools ?? [] }
-	for (const key of AGENT_BRAIN_KEYS) {
-		const t = inputTransforms?.[key] as any
-		if (!t) continue
-		if (t.type === 'static') {
-			if (t.value !== undefined) config[key] = t.value
-		} else {
-			config[key] = t
-		}
-	}
-	return config
-}
-
 /**
  * Reduce the AI agent schema to only the flow-local inputs. Used when a step is linked to a saved
  * agent: the brain fields come from the resource, so only user_message/user_attachments stay editable.
@@ -138,16 +136,26 @@ export function flowLocalAgentSchema(schema: any): any {
 	}
 }
 
-const AGENT_BRAIN_LABELS: Record<string, string> = {
-	provider: 'Model',
-	output_type: 'Output type',
-	system_prompt: 'System prompt',
-	streaming: 'Streaming',
-	memory: 'Memory',
-	output_schema: 'Output schema',
-	max_completion_tokens: 'Max tokens',
-	temperature: 'Temperature',
-	max_iterations: 'Max iterations'
+/** Read off the form's own registry, so a linked agent's summary cannot name a field differently
+ *  from the form that edits it. */
+export const AGENT_BRAIN_LABELS: Record<string, string> = Object.fromEntries(
+	AGENT_FIELDS.map((f) => [f.key, f.label])
+)
+
+/**
+ * Brain keys set to an input transform rather than to a value, which a saved agent's plain JSON
+ * cannot hold. Matched on the tag so the whole `InputTransform` union is covered: a payload-key
+ * test would miss `{"type":"ai"}`, which carries none.
+ */
+export function transformValuedBrainKeys(args: Record<string, any> | undefined): string[] {
+	return AGENT_BRAIN_KEYS.filter((key) => {
+		const v = args?.[key]
+		return (
+			v !== null &&
+			typeof v === 'object' &&
+			(v.type === 'javascript' || v.type === 'ai' || v.type === 'static')
+		)
+	})
 }
 
 /** Flatten a saved agent's brain config into human-readable label/value rows for a read-only
diff --git a/frontend/src/lib/components/flows/agentToolUtils.ts b/frontend/src/lib/components/flows/agentToolUtils.ts
index f8f8d41413..c46868c46e 100644
--- a/frontend/src/lib/components/flows/agentToolUtils.ts
+++ b/frontend/src/lib/components/flows/agentToolUtils.ts
@@ -21,6 +21,11 @@ export function getToolNameError(
 	if (kind === 'mcp') {
 		return name.length > 0 ? undefined : 'Tool name must not be empty'
 	}
+	// Ahead of the pattern, which an empty name also fails: "must only contain letters" reads as a
+	// complaint about characters that are not there.
+	if (name.length === 0) {
+		return 'Tool name must not be empty'
+	}
 	if (!/^[a-zA-Z0-9_]+$/.test(name)) {
 		return 'Tool name must only contain letters, numbers and underscores'
 	}
@@ -60,6 +65,9 @@ export type WebsearchTool = AgentTool & {
  * Type guard to check if a tool is a FlowModule tool
  */
 export function isFlowModuleTool(tool: AgentTool): tool is FlowModuleTool {
+	// `value` must be there, not merely lack a `tool_type`: the tool list is JSON-authored, and an
+	// entry without one is not a flowmodule tool for the callers that go on to read its script.
+	if (tool?.value == undefined) return false
 	return tool.value.tool_type === undefined || tool.value.tool_type === 'flowmodule'
 }
 
@@ -67,14 +75,28 @@ export function isFlowModuleTool(tool: AgentTool): tool is FlowModuleTool {
  * Type guard to check if a tool is an MCP tool
  */
 export function isMcpTool(tool: AgentTool): tool is McpTool {
-	return tool.value.tool_type === 'mcp'
+	return tool?.value?.tool_type === 'mcp'
 }
 
 /**
  * Type guard to check if a tool is a Websearch tool
  */
 export function isWebsearchTool(tool: AgentTool): tool is WebsearchTool {
-	return tool.value.tool_type === 'websearch'
+	return tool?.value?.tool_type === 'websearch'
+}
+
+/** The only input a nested agent used as a tool has the calling agent fill: the rest is its own
+ *  configuration, not something to generate. Mirrors the server, which offers such a tool a schema
+ *  of `{user_message}` and nothing else (`AI_AGENT_TOOL_SCHEMA` in `ai_executor.rs`); anything else
+ *  left AI-filled here is dropped from that schema and never reaches the model. */
+export const AI_AGENT_TOOL_AI_KEYS = ['user_message']
+
+/** What a tool is called wherever it is named: its own name, else what it points at. Never its id,
+ *  which is internal. Undefined when it has nothing to be called yet — an MCP tool with no server
+ *  picked is unnamed rather than misnamed, so each surface words that for itself. */
+export function toolDisplayName(tool: AgentTool): string | undefined {
+	const value = tool?.value as Record<string, any>
+	return tool?.summary || value?.path || value?.resource_path || undefined
 }
 
 /**
diff --git a/frontend/src/lib/components/flows/content/AgentEditorHost.svelte b/frontend/src/lib/components/flows/content/AgentEditorHost.svelte
new file mode 100644
index 0000000000..79db0cedb3
--- /dev/null
+++ b/frontend/src/lib/components/flows/content/AgentEditorHost.svelte
@@ -0,0 +1,457 @@
+<script lang="ts">
+	import { getContext, setContext, untrack } from 'svelte'
+	import { writable } from 'svelte/store'
+	import { Alert } from '$lib/components/common'
+	import { deepEqual } from 'fast-equals'
+	import type { Flow, FlowModule, InputTransform, Job, OpenFlow } from '$lib/gen'
+	import { emptySchema, type StateStore } from '$lib/utils'
+	import type { FlowInput } from '$lib/components/flows/types'
+	import type { FlowEditorContext, FlowInputEditorState, FlowPanelDetachContext } from '../types'
+	import type { PropPickerContext, FlowPropPickerConfig } from '$lib/components/prop_picker'
+	import type { FlowCopilotContext } from '$lib/components/copilot/flow'
+	import { initFlowState, type FlowState } from '../flowState'
+	import { insertAgentTool } from '../flowStateUtils.svelte'
+	import { initHistory } from '$lib/history.svelte'
+	import { StepsInputArgs } from '../stepsInputArgs.svelte'
+	import { SelectionManager } from '$lib/components/graph/selectionUtils.svelte'
+	import { ModulesTestStates } from '$lib/components/modulesTest.svelte'
+	import { Splitpanes, Pane } from 'svelte-splitpanes'
+	import { Drawer, DrawerContent } from '$lib/components/common'
+	import PropPickerWrapper from '../propPicker/PropPickerWrapper.svelte'
+	import ModulePreview from '$lib/components/ModulePreview.svelte'
+	import ModulePreviewResultViewer from '$lib/components/ModulePreviewResultViewer.svelte'
+	import AiAgentStepInputs from './AiAgentStepInputs.svelte'
+	import AgentToolWrapper from './AgentToolWrapper.svelte'
+	import { getStepPropPicker } from '../previousResults'
+	import {
+		AGENT_BRAIN_KEYS,
+		flowLocalAgentSchema,
+		inputTransformsToAgentConfig,
+		type AIAgentConfig
+	} from '../agentResourceUtils'
+	import { AGENT_TOOLS_ROW } from '../agentFormFields'
+	import { toolDisplayName, type AgentTool } from '../agentToolUtils'
+	import { useAgentDraft } from '../agentDraft.svelte'
+
+	interface Props {
+		/** The `ai_agent` resource being edited. */
+		path: string
+		workspace: string | undefined
+		enableAi?: boolean
+		/** The tool drilled into, if any. Owned by the caller so it can drive the breadcrumb. */
+		toolId?: string | undefined
+		onSelectTool?: (toolId: string | undefined) => void
+		/** Ran after a successful deploy, with the path actually written, which a rename can move. */
+		onSaved?: (path: string) => void | Promise<void>
+	}
+
+	let {
+		path,
+		workspace,
+		enableAi = false,
+		toolId = undefined,
+		onSelectTool = undefined,
+		onSaved = undefined
+	}: Props = $props()
+
+	/** The one module the editor edits. Standalone (no `agent` key) so `initFlowState` loads a
+	 *  schema per tool — the linked branch deliberately loads none. Reserved in `forbiddenIds`:
+	 *  the root shares a flow-state map with the tools, so a tool of this id would lose its
+	 *  schema to the root's. */
+	const AGENT_ID = '__wm_agent_root'
+
+	const draft = useAgentDraft({ path: () => path, workspace: () => workspace })
+
+	/** Read access only. Everything that could write is blocked, down to the draft itself: an
+	 *  autosave the server rejects would look like a save and lose the edit. Running the agent,
+	 *  its history and its evals stay open, none of them being a write to the resource. */
+	let readOnly = $derived(!draft.canWrite)
+
+	const flowStore = $state({
+		val: {
+			summary: '',
+			value: { modules: [] },
+			extra_perms: {},
+			schema: emptySchema()
+		} as OpenFlow
+	}) as StateStore<OpenFlow>
+	const flowStateStore = $state({ val: {} }) as StateStore<FlowState>
+	const previewArgs = $state({ val: {} })
+	const stepsInputArgs = new StepsInputArgs()
+	const modulesTestStates = new ModulesTestStates(() => {})
+	const selectionManager = new SelectionManager()
+	selectionManager.selectId(AGENT_ID)
+	const history = initHistory(flowStore.val)
+	// The agent's own path, naming a flow that exists only here. It must be a real workspace path:
+	// `require_path_read_access_for_preview` rejects a first segment other than `u`/`f`/`hub` for
+	// anyone who is not an admin. It is therefore not unique to this editor — a flow may carry the
+	// same string — so telling the two apart reads `agentEditorHost` below, never the path.
+	const pathStore = writable('')
+	$effect(() => {
+		pathStore.set(path)
+	})
+
+	// Drilling into a tool is navigation in this editor, not a graph selection.
+	selectionManager.setOnSelectIntent?.((id: string) => {
+		if (id === AGENT_ID) {
+			onSelectTool?.(undefined)
+			return true
+		}
+		if (tools.some((t) => t?.id === id)) {
+			onSelectTool?.(id)
+			return true
+		}
+		return false
+	})
+
+	// The panel-placement control belongs to a step panel, not to this editor: left alone the card
+	// header would draw a placement picker and an X that closes the panel behind us.
+	setContext<FlowPanelDetachContext>('flowPanelDetach', {
+		claim: () => () => {},
+		modalOpen: () => false,
+		close: () => {},
+		enabled: () => false,
+		preference: () => 'auto',
+		setPreference: () => {}
+	})
+
+	// Inherit the host's context where there is one (keeps "Edit the script's code" and the AI
+	// chat's editor handle working), then override everything that must be private or the editor
+	// would write into the host flow. Built once and mutated: Svelte snapshots the parent context
+	// map per component on first access, so a later `setContext` is invisible to descendants.
+	const outer = getContext<FlowEditorContext | undefined>('FlowEditorContext')
+	setContext<FlowEditorContext>('FlowEditorContext', {
+		scriptEditorDrawer: writable(undefined),
+		workspaceScriptSettingsDrawer: writable(undefined),
+		flowEditorDrawer: writable(undefined),
+		initialPathStore: writable(''),
+		fakeInitialPath: '',
+		flowInputsStore: writable<FlowInput>({}),
+		customUi: {},
+		insertButtonOpen: writable(false),
+		executionCount: writable(0),
+		flowInputEditorState: writable<FlowInputEditorState>({
+			selectedTab: undefined,
+			editPanelSize: undefined,
+			payloadData: undefined
+		}),
+		currentEditor: writable(undefined),
+		outputPickerOpenFns: {},
+		preserveOnBehalfOf: writable(false),
+		savedOnBehalfOfEmail: writable<string | undefined>(undefined),
+		savedOnBehalfOfPermissionedAs: writable<string | undefined>(undefined),
+		...(outer ?? {}),
+		flowStore,
+		flowStateStore,
+		previewArgs,
+		stepsInputArgs,
+		modulesTestStates,
+		selectionManager,
+		history,
+		pathStore,
+		opWorkspace: () => workspace,
+		agentEditorHost: () => path,
+		saveDraft: () => {}
+	} as FlowEditorContext)
+
+	// PropPickerWrapper destructures this without a guard, so it throws without it.
+	setContext<PropPickerContext>('PropPickerContext', {
+		flowPropPickerConfig: writable<FlowPropPickerConfig | undefined>(undefined),
+		pickablePropertiesFiltered: writable(undefined),
+		inModalPanel: () => true
+	})
+
+	// Its own, empty, rather than the flow's: the copilot addresses fields by name alone, and this
+	// editor is a descendant of the flow it was opened from, so a step input it fills would also
+	// land in a field of the agent that happens to share the name.
+	setContext<FlowCopilotContext>('FlowCopilotContext', {
+		shouldUpdatePropertyType: writable({}),
+		stepInputsLoading: writable(false),
+		generatedExprs: writable({}),
+		exprsToSet: writable({})
+	})
+
+	let agentModule = $derived(flowStore.val.value.modules?.[0])
+	let agentValue = $derived(
+		agentModule?.value.type === 'aiagent' ? (agentModule.value as any) : undefined
+	)
+	// The resource's own array, never a copy: the tool drawer writes replacements back through
+	// `tools[toolIndex]`, and a copy would take them instead of the value being edited. Only the
+	// container is shape-checked — `tools` is JSON-authored, and a `.filter` on another shape
+	// throws; entries are read with `?.` wherever they are dereferenced.
+	let tools = $derived(Array.isArray(agentValue?.tools) ? (agentValue.tools as AgentTool[]) : [])
+	let toolIndex = $derived(toolId ? tools.findIndex((t) => t?.id === toolId) : -1)
+	let tool = $derived(toolIndex >= 0 ? tools[toolIndex] : undefined)
+
+	// The caller owns which tool is open, so the drawer follows it rather than holding that state
+	// itself; closing it (Escape, the X, the overlay) reports back through `on:close`.
+	let toolDrawer: Drawer | undefined = $state(undefined)
+	$effect(() => {
+		const open = tool !== undefined
+		untrack(() => (open ? toolDrawer?.openDrawer() : toolDrawer?.closeDrawer()))
+	})
+
+	// The config the synthetic module last carried, so the two directions below can tell an edit
+	// apart from the echo of their own write.
+	let lastArgs = $state<string | undefined>(undefined)
+
+	// draft.args -> module. Only when the draft moved on its own (a load, an external write, a
+	// discard); an edit made in the form arrives here as its own echo and is skipped.
+	$effect(() => {
+		const args = draft.state?.args
+		if (draft.loading || !args) return
+		const serialized = JSON.stringify(args)
+		untrack(() => {
+			if (serialized === lastArgs) return
+			lastArgs = serialized
+			const built: FlowModule = {
+				id: AGENT_ID,
+				value: {
+					type: 'aiagent',
+					tools: (args.tools ?? []) as any,
+					input_transforms: agentArgsToTransforms(args) as any
+				} as any
+			}
+			flowStore.val.value.modules = [built]
+			// Caught rather than left to float: a tool whose shape the schema loader cannot read
+			// would otherwise reject into the global unhandled-rejection handler, which reports the
+			// bare message and no stack — saying nothing about which agent or tool caused it. The
+			// form still renders; only the inferred tool schemas are missing.
+			initFlowState(flowStore.val as Flow, flowStateStore, workspace, path).catch((err) =>
+				console.error('agent editor: could not infer tool schemas for', path, err)
+			)
+		})
+	})
+
+	/** Every argument the resource carries, as a static transform. `tools` is the roster rather than
+	 *  a field, so it rides on the module's own key instead. Not only the keys the form renders: a
+	 *  run reads them all, and an agent holding its own `user_message` answers with it when nothing
+	 *  overrides it, so a test here has to run the configuration a linked step would. */
+	function agentArgsToTransforms(args: AIAgentConfig): Record<string, InputTransform> {
+		const it: Record<string, InputTransform> = {}
+		for (const [key, value] of Object.entries(args ?? {})) {
+			if (key === 'tools' || value === undefined) continue
+			it[key] = { type: 'static', value } as InputTransform
+		}
+		return it
+	}
+
+	/** Everything the form does not model. `inputTransformsToAgentConfig` rebuilds the value from
+	 *  `AGENT_BRAIN_KEYS` alone, so a key this editor never renders — one a newer backend added, or
+	 *  the `user_message` default a resource may carry, which the runtime does read when the step
+	 *  supplies none — would be dropped into the draft merely by opening the agent. */
+	const MODELLED_AGENT_KEYS = new Set<string>([...AGENT_BRAIN_KEYS, 'tools'])
+	function unmodelledArgs(args: AIAgentConfig | undefined): Record<string, unknown> {
+		return Object.fromEntries(
+			Object.entries(args ?? {}).filter(([key]) => !MODELLED_AGENT_KEYS.has(key))
+		)
+	}
+
+	// module -> draft.args. `inputTransformsToAgentConfig` drops the `{static, undefined}`
+	// placeholders `loadFlowModuleState` backfills, so the round trip is idempotent.
+	$effect(() => {
+		const v = agentValue
+		if (draft.loading || readOnly || !v || !draft.state) return
+		const next = {
+			...unmodelledArgs(draft.state.args),
+			...(inputTransformsToAgentConfig(
+				v.input_transforms as Record<string, InputTransform>,
+				(v.tools ?? []) as AgentTool[]
+			) as AIAgentConfig)
+		} as AIAgentConfig
+		// A config written before this editor spells "unset" its own way: an explicit `null` on a
+		// field, or no `tools` key at all. `inputTransformsToAgentConfig` writes neither, and that
+		// difference alone would read as an edit and autosave a draft for an agent nobody touched.
+		// Only where the two spellings mean the same thing — a value the user actually cleared is
+		// absent from `next` with something else in the draft, and stays cleared.
+		for (const [key, value] of Object.entries(draft.state.args ?? {})) {
+			if (value === null && !(key in next)) {
+				;(next as Record<string, unknown>)[key] = null
+			}
+		}
+		if (next.tools?.length === 0 && draft.state.args?.tools === undefined) {
+			delete next.tools
+		}
+		const serialized = JSON.stringify(next)
+		untrack(() => {
+			if (serialized === lastArgs) return
+			if (draft.state && !deepEqual(draft.state.args, next)) {
+				lastArgs = serialized
+				draft.state.args = next
+			}
+		})
+	})
+
+	let schema = $derived(flowStateStore.val[AGENT_ID]?.schema ?? {})
+	const brainFilter = [...AGENT_BRAIN_KEYS, AGENT_TOOLS_ROW]
+
+	let stepPropPicker = $derived(
+		agentModule
+			? getStepPropPicker(
+					flowStateStore.val,
+					undefined,
+					undefined,
+					AGENT_ID,
+					flowStore.val,
+					previewArgs.val,
+					false
+				)
+			: undefined
+	)
+
+	let testJob: Job | undefined = $state(undefined)
+	let testIsLoading = $state(false)
+	let scriptProgress = $state(undefined)
+
+	// Adding a tool goes straight into it: the editor has no graph to show the new node on, so the
+	// tool it just created is the only place the click can land.
+	async function addTool(detail: { kind: string; script?: any; flow?: any; inlineScript?: any }) {
+		if (!agentValue) return
+		// Adding a tool is the explicit action that replaces a JSON-authored non-list; without this
+		// the insert goes into a value that cannot hold it.
+		if (!Array.isArray(agentValue.tools)) agentValue.tools = []
+		const id = await insertAgentTool(
+			flowStore,
+			flowStateStore,
+			agentValue,
+			detail,
+			workspace,
+			!enableAi
+		)
+		if (id) onSelectTool?.(id)
+	}
+
+	/** The mirror of `addTool`. These tools live in the resource rather than in a flow's module
+	 *  list, so the graph's delete has nothing here to act on. */
+	function deleteTool(id: string) {
+		if (!agentValue) return
+		const remaining = tools.filter((t) => t?.id !== id)
+		if (remaining.length === tools.length) return
+		agentValue.tools = remaining
+		delete flowStateStore.val[id]
+		if (toolId === id) onSelectTool?.(undefined)
+	}
+
+	export function deploy(): Promise<boolean> {
+		return draft.deploy().then(async (ok) => {
+			// The path this editor opened, not the draft's live one: `deploy` refuses a renaming draft,
+			// so the write always lands here, while the shared draft can be repointed by another tab
+			// mid-request and would send the reconciliation after a resource nobody wrote.
+			if (ok) await onSaved?.(path)
+			return ok
+		})
+	}
+	export function draftHandle() {
+		return draft
+	}
+</script>
+
+{#if draft.refusal}
+	<div class="h-full flex items-center justify-center px-8">
+		<Alert type="error" size="sm" title={draft.refusal} class="max-w-lg">
+			Open it from the resources page to see what it holds. Any unsaved edits are kept as a draft
+			there.
+		</Alert>
+	</div>
+{:else if draft.loading}
+	<div class="h-full flex items-center justify-center text-xs text-tertiary">Loading agent...</div>
+{:else if agentModule && agentValue}
+	<!-- Named and positioned so the tool picker's popover can portal here: the `#flow-editor` it
+	     otherwise targets is behind this dialog, and does not exist at all on the resources page. -->
+	<div id="agent-editor" class="relative h-full min-h-0">
+		<!-- Resizable as the step panel's config and test are: a long system prompt and a long
+		     answer want opposite splits, and only the reader knows which they are on. -->
+		<Splitpanes class="h-full">
+			<Pane size={66} minSize={30}>
+				<div class="h-full min-h-0 overflow-auto">
+					<PropPickerWrapper
+						pickableProperties={stepPropPicker?.pickableProperties}
+						noPadding
+						sidePane
+					>
+						<AiAgentStepInputs
+							class="px-4 pb-8"
+							{schema}
+							filter={brainFilter}
+							previousModuleId={undefined}
+							pickableProperties={stepPropPicker?.pickableProperties}
+							extraLib={stepPropPicker?.extraLib ?? 'missing extraLib'}
+							{enableAi}
+							{workspace}
+							staticOnly
+							visibilityKey={`agent:${path}`}
+							{tools}
+							{readOnly}
+							onSelectTool={(id) => onSelectTool?.(id)}
+							onAddTool={readOnly ? undefined : addTool}
+							onDeleteTool={readOnly ? undefined : deleteTool}
+							toolPickerPortal="#agent-editor"
+							bind:args={
+								() => (agentValue?.input_transforms ?? {}) as Record<string, InputTransform>,
+								(v) => agentValue && (agentValue.input_transforms = v)
+							}
+						/>
+					</PropPickerWrapper>
+				</div>
+			</Pane>
+			<!-- Laid out as the script editor's preview column is: what a run takes above what it
+			     produced, both alongside what is being edited. -->
+			<Pane size={34} minSize={20}>
+				<Splitpanes horizontal class="h-full">
+					<Pane size={40} minSize={15}>
+						<div class="h-full overflow-auto">
+							<ModulePreview
+								mod={agentModule as FlowModule}
+								schema={flowLocalAgentSchema(schema)}
+								pickableProperties={stepPropPicker?.pickableProperties}
+								bind:testJob
+								bind:testIsLoading
+								bind:scriptProgress
+							/>
+						</div>
+					</Pane>
+					<Pane size={60} minSize={20}>
+						<ModulePreviewResultViewer
+							lang="deno"
+							editor={undefined}
+							diffEditor={undefined}
+							mod={agentModule as FlowModule}
+							{testJob}
+							{testIsLoading}
+							{scriptProgress}
+							disableMock
+							disableHistory
+						/>
+					</Pane>
+				</Splitpanes>
+			</Pane>
+		</Splitpanes>
+	</div>
+
+	<!-- A tool is a whole step editor, so it gets a surface of its own rather than a level of the
+	     dialog: the agent stays visible behind it, along with the banner and Deploy that its edits
+	     feed. -->
+	<Drawer bind:this={toolDrawer} size="1200px" on:close={() => onSelectTool?.(undefined)}>
+		<DrawerContent
+			title={(tool ? toolDisplayName(tool) : undefined) ?? 'Edit tool'}
+			on:close={() => toolDrawer?.closeDrawer()}
+			noPadding
+		>
+			{#if tool}
+				<!-- Inert to a read-only viewer for the same reason the form above is, and opened on its
+				     configuration rather than on a test it cannot fill in. -->
+				<div class="h-full min-h-0 flex flex-col {readOnly ? 'opacity-60' : ''}" inert={readOnly}>
+					<AgentToolWrapper
+						bind:tool={() => tools[toolIndex], (v) => (tools[toolIndex] = v)}
+						parentModule={agentModule as FlowModule}
+						{enableAi}
+						staticOnly
+						noToolNavigation
+						forceTestTab={readOnly ? undefined : { [tool.id]: true }}
+						siblingToolNames={tools.filter((t) => t?.id !== tool?.id).map((t) => t?.summary ?? '')}
+					/>
+				</div>
+			{/if}
+		</DrawerContent>
+	</Drawer>
+{/if}
diff --git a/frontend/src/lib/components/flows/content/AgentEditorModal.svelte b/frontend/src/lib/components/flows/content/AgentEditorModal.svelte
new file mode 100644
index 0000000000..3ded2deb9f
--- /dev/null
+++ b/frontend/src/lib/components/flows/content/AgentEditorModal.svelte
@@ -0,0 +1,368 @@
+<script lang="ts">
+	import { FlaskConical, History, Save } from 'lucide-svelte'
+	import { onDestroy, untrack } from 'svelte'
+	import { resource } from 'runed'
+	import Modal, { type ModalTrailSegment } from '$lib/components/common/modal/Modal.svelte'
+	import PagedContent from '$lib/components/common/modal/PagedContent.svelte'
+	import { Badge, Button, Drawer, DrawerContent } from '$lib/components/common'
+	import LocalDraftBanner from '$lib/components/LocalDraftBanner.svelte'
+	import ResourceVersionHistory from '$lib/components/ResourceVersionHistory.svelte'
+	import { clearPageDrawerAnchor } from '$lib/components/sessions/pageDrawerSession'
+	import { RESOURCES_PATH } from '$lib/components/sessions/previewPaths'
+	import EvalsPane from '$lib/components/aiEvals/EvalsPane.svelte'
+	import type { EvalsLocation } from '$lib/components/aiEvals/evalUtils'
+	import { ResourceService, type AgentDraft } from '$lib/gen'
+	import { workspaceStore } from '$lib/stores'
+	import {
+		agentEditorTarget,
+		agentWriteCount,
+		type AgentEditorTarget,
+		closeAgentEditor,
+		markAgentWritten,
+		showAgentEditorTool,
+		showAgentEditorView
+	} from '../agentEditorStore.svelte'
+	import { agentConfigToInputTransforms } from '../agentResourceUtils'
+	import { publishLinkedAgentTools } from '../flowState'
+	import { linkedModulesForAgent, linkedToolsScope } from '../linkedAgentToolsStore.svelte'
+	import AgentEditorHost from './AgentEditorHost.svelte'
+
+	interface Props {
+		enableAi?: boolean
+		/** Which targets this mount is responsible for. The target is module-global while several
+		 *  flow editors can be alive at once (a session retains every tab it has visited), so without
+		 *  this each of them would build a whole editor — fetching, inferring tool schemas, and
+		 *  running its own two-way sync against the one draft row. Required rather than defaulted: a
+		 *  mount that guesses wrong renders nothing, and silence is a poor way to find that out. */
+		owns: (target: AgentEditorTarget) => boolean
+	}
+
+	let { enableAi = false, owns }: Props = $props()
+
+	// Every target names the surface that opened it, and only a flow step or a resource row can:
+	// an agent used as a tool of the agent being edited stays part of it, with no way in this editor
+	// to link it to a saved agent of its own. So `owns` decides alone — nothing here has to adopt a
+	// target opened from inside another editor.
+	let target = $derived.by(() => {
+		const t = agentEditorTarget()
+		return t && owns(t) ? t : undefined
+	})
+	// The last agent this dialog showed. The version pane keeps working after `onRestore` returns —
+	// it reloads its list keyed on the path it was given — while the restore handler has already
+	// closed the dialog and dropped the target. Reading the live one there throws, and the throw
+	// lands in the global unhandled-rejection handler as a bare toast with no stack.
+	let lastShownAgent = $state<string | undefined>(undefined)
+	$effect(() => {
+		const p = target?.path
+		if (p) untrack(() => (lastShownAgent = p))
+	})
+
+	let ws = $derived(target?.workspace ?? $workspaceStore)
+	let host = $state<ReturnType<typeof AgentEditorHost> | undefined>(undefined)
+	let versionDrawer: Drawer | undefined = $state(undefined)
+	let saving = $state(false)
+
+	// Counted per agent, so a deploy that leaves the editor on the same agent still refetches the
+	// version it just minted. Shared, so the step card behind the dialog refetches on the same signal.
+	let writes = $derived(agentWriteCount(ws, target?.path))
+	let versionResource = resource(
+		() => ({ ws, path: target?.path, writes }),
+		async ({ ws, path, writes }) => {
+			if (!ws || !path) return { ws, path, writes }
+			const history = await ResourceService.getResourceHistory({ workspace: ws, path })
+			return { ws, path, writes, version: history.versions?.[0]?.version }
+		}
+	)
+	// `writes` as well as the identity: runed neither aborts nor tags a superseded request, so a
+	// response from before a deploy can land after the one for it and relabel the badge with the
+	// version that deploy replaced.
+	let version = $derived.by(() => {
+		const loaded = versionResource.current
+		return loaded !== undefined &&
+			loaded.ws === ws &&
+			loaded.path === target?.path &&
+			loaded.writes === writes
+			? loaded.version
+			: undefined
+	})
+
+	let draft = $derived(host?.draftHandle())
+	// The load refused this path, so there is no agent to deploy, evaluate or show a history of:
+	// the dialog carries only the refusal the host renders.
+	let refused = $derived(draft?.refusal != null)
+	let inEvals = $derived(target?.view === 'evals' && !refused)
+	let readOnly = $derived(draft ? !draft.canWrite : false)
+	let draftOnly = $derived(draft?.noDeployed ?? false)
+
+	// Where the evals pane is within itself, so its levels extend this dialog's trail rather than
+	// opening a dialog of their own. Cleared on the way in: the pane reports a level once it is on
+	// one, and never that it is back at its root.
+	let evalsLocation = $state<EvalsLocation | undefined>(undefined)
+	let evalsKey = $derived(`${ws}:${target?.path}:${target?.view}`)
+	$effect(() => {
+		evalsKey
+		untrack(() => (evalsLocation = undefined))
+	})
+
+	const AGENT_DESCRIPTION = 'Changes here update the saved agent, and every flow that links to it.'
+
+	let root = $derived<ModalTrailSegment>({
+		label: target?.path ?? 'Agent',
+		onclick: inEvals ? () => showAgentEditorView(undefined) : undefined
+	})
+	let trail = $derived<ModalTrailSegment[]>(
+		inEvals
+			? [
+					root,
+					{ label: 'Evals', onclick: evalsLocation ? evalsLocation.back : undefined },
+					...(evalsLocation ? [{ label: evalsLocation.label }] : [])
+				]
+			: [root]
+	)
+	// The root's alone: below it the header's second line is the way back, and what a level is for
+	// belongs to that level rather than to the dialog's own name.
+	let description = $derived(inEvals || refused ? undefined : AGENT_DESCRIPTION)
+
+	/** The unsaved edits, in the shape the server builds from a deployed config
+	 *  (`ai_evals/run.rs` `config_to_draft`), so a draft run's hash can be recognised as equal to
+	 *  the version it is later deployed as. */
+	function editedConfig(): AgentDraft {
+		const args = draft?.state?.args
+		return {
+			input_transforms: agentConfigToInputTransforms(args ?? {}) as Record<string, unknown>,
+			tools: (args?.tools ?? []) as unknown[] as Record<string, unknown>[]
+		}
+	}
+
+	/** A resources-page row anchors itself in the hash on the way in, so closing has to clear it or
+	 *  the URL keeps claiming the agent is open and a refresh reopens it. Anchored to that page, so
+	 *  this is a no-op when the editor was opened from a flow. */
+	function close() {
+		closeAgentEditor()
+		void clearPageDrawerAnchor(RESOURCES_PATH)
+	}
+
+	// The target is module-global and outlives this component: navigating away takes the mount that
+	// owns it without passing through `close()`, and what it leaves behind reopens the dialog on the
+	// way back and tells the flow editor a dialog is over its graph. Only its own, so a mount going
+	// down never drops a target another one is showing.
+	onDestroy(() => {
+		const t = agentEditorTarget()
+		if (t && owns(t)) closeAgentEditor()
+	})
+
+	/** What the flow behind a write has to be told about it, captured before the request rather than
+	 *  read after: the dialog stays closable while one is in flight and can be pointed at another
+	 *  agent by the time it lands, and the reactive `ws`/`target` would then name that one. */
+	type WriteTarget = { ws: string | undefined; path: string; host: AgentEditorTarget['host'] }
+	function currentWriteTarget(): WriteTarget | undefined {
+		const t = target
+		return t ? { ws, path: t.path, host: t.host } : undefined
+	}
+	/** Reconciling is best-effort: it refreshes what a write changed, and the write itself has
+	 *  already landed. A rejection here must not surface as an unhandled one — the global handler
+	 *  turns those into a bare toast with no stack, which says nothing about where it came from. */
+	function reconcileQuietly(at: WriteTarget | undefined, path: string) {
+		try {
+			void Promise.resolve(reconcile(at, path)).catch((err) => {
+				console.error('agent editor: could not refresh what links to', path, err)
+			})
+		} catch (err) {
+			console.error('agent editor: could not refresh what links to', path, err)
+		}
+	}
+
+	function reconcile(at: WriteTarget | undefined, path: string) {
+		if (!at?.ws) return
+		markAgentWritten(at.ws, path)
+		if (!at.host) return
+		// The host graph resolves a linked agent's tool nodes from the resource, so it has to re-read
+		// what the write just changed. Every step of that flow linking this agent, not only the one
+		// the editor was opened from: they all show tools the write may have moved.
+		const scope = linkedToolsScope(at.ws, at.host.flowPath)
+		const moduleIds = new Set(linkedModulesForAgent(scope, path))
+		moduleIds.add(at.host.moduleId)
+		return Promise.all(
+			[...moduleIds].map((moduleId) => publishLinkedAgentTools(path, at.ws, scope, moduleId))
+		)
+	}
+
+	let deployingFor = $state<WriteTarget | undefined>(undefined)
+
+	async function onDeploy() {
+		saving = true
+		deployingFor = currentWriteTarget()
+		try {
+			await host?.deploy()
+		} finally {
+			saving = false
+			deployingFor = undefined
+		}
+	}
+
+	/** What a successful deploy has to reconcile. The path is the one it wrote, which `deploy` holds
+	 *  to the one the editor opened: this editor does not rename. */
+	async function onSaved(savedPath: string) {
+		await reconcile(deployingFor ?? currentWriteTarget(), savedPath)
+	}
+</script>
+
+{#if target}
+	{#key `${ws}:${target.path}`}
+		<!-- Bound rather than held open: the store is what decides whether this is mounted, so every
+		     way out has to reach it. The close button and the backdrop only set `open`, and a
+		     dialog left closed over a target still set could never be opened again.
+
+		     `paginated` throughout: the body is one strip of pages (the agent form, then evals), so
+		     the header keeps its height and only the pages move. -->
+		<Modal
+			bind:open={() => true, (open) => !open && close()}
+			kind="X"
+			fillHeight
+			enterConfirms={false}
+			paginated
+			title={target.path}
+			{trail}
+			{description}
+			class="w-[92vw] sm:w-[92vw] max-w-[1500px] sm:max-w-[1500px] h-[88vh]"
+		>
+			{#snippet titleBadge()}
+				<!-- Against the agent's own name wherever it appears, as the linked-agent card in the
+				     step panel has it. -->
+				{#if version != undefined && !refused}
+					<Badge color="gray" class="shrink-0" title="The version runs are recorded against">
+						v{version}
+					</Badge>
+				{/if}
+			{/snippet}
+			{#snippet levelBadge()}
+				<!-- Marks evals, not the agent, so it sits against that level's own name. Dropped a
+				     level deeper, where it would read as marking the run rather than the feature it
+				     belongs to. -->
+				{#if inEvals && !evalsLocation}
+					<Badge color="blue" small class="shrink-0 !py-0 leading-4">Beta</Badge>
+				{/if}
+			{/snippet}
+			<!-- Evals carries none of the editor's actions: nothing there edits the agent, and the run
+			     dialog states for itself whether a run is against the deployed version or the edits. -->
+			{#snippet settings()}
+				<div class="flex flex-row items-center gap-2 shrink-0">
+					{#if !inEvals && !refused}
+						{#if readOnly}
+							<Badge
+								color="gray"
+								class="shrink-0"
+								title="You do not have write access to this agent"
+							>
+								Read only
+							</Badge>
+						{/if}
+						<!-- Evals run against the deployed agent, and a draft-only one has none: the
+						     backend's `require_agent` would reject every run. -->
+						{#if !draftOnly}
+							<Button
+								unifiedSize="sm"
+								variant="default"
+								startIcon={{ icon: FlaskConical }}
+								title="Run this agent against a dataset of cases"
+								on:click={() => showAgentEditorView('evals')}
+							>
+								Evals
+							</Button>
+						{/if}
+						<Button
+							unifiedSize="sm"
+							variant="default"
+							startIcon={{ icon: History }}
+							iconOnly
+							title="Version history"
+							on:click={() => versionDrawer?.openDrawer()}
+						/>
+						<Button
+							unifiedSize="sm"
+							variant="accent"
+							startIcon={{ icon: Save }}
+							loading={saving}
+							disabled={readOnly}
+							title={readOnly ? 'You do not have write access to this agent' : undefined}
+							on:click={onDeploy}
+						>
+							Deploy
+						</Button>
+					{/if}
+				</div>
+			{/snippet}
+			<div class="h-full min-h-0 flex flex-col">
+				<!-- Full-bleed, as a banner is everywhere else: the dialog's own horizontal padding is
+				     cancelled so it spans the body. -->
+				<div class="-mx-4 sm:-mx-6 shrink-0 {inEvals ? 'hidden' : ''}">
+					<LocalDraftBanner
+						show={draft?.sync.hasDraft ?? false}
+						reserveSpace={draft?.sync.hasBaseline ?? false}
+						getDeployed={() => draft?.deployed}
+						getCurrent={() => draft?.state}
+						onDiscard={() => draft?.sync.resetToDeployed(target?.path ?? '')}
+						title="Deployed <> Unsaved agent changes"
+					/>
+				</div>
+				<!-- Two pages of one strip, so opening evals slides in from the right the way its own
+				     levels do. No `onNavigate`: the arrow keys belong to whichever pane is on screen,
+				     and evals answers them for its own levels. -->
+				<PagedContent
+					class="flex-1 min-h-0"
+					current={inEvals ? 'evals' : 'agent'}
+					pages={[
+						{ key: 'agent', content: agentPage },
+						{ key: 'evals', content: evalsPage }
+					]}
+				/>
+			</div>
+		</Modal>
+	{/key}
+
+	<!-- Mounted under the evals level too: it holds the draft the header's banner and Deploy act on,
+	     and the config a draft run is offered on. -->
+	{#snippet agentPage()}
+		<AgentEditorHost
+			bind:this={host}
+			path={target.path}
+			workspace={ws}
+			{enableAi}
+			toolId={target.toolId}
+			onSelectTool={(id) => showAgentEditorTool(id)}
+			{onSaved}
+		/>
+	{/snippet}
+
+	{#snippet evalsPage()}
+		<EvalsPane
+			agentPath={target.path}
+			opWorkspace={ws}
+			editedConfig={draft?.sync.hasDraft ? editedConfig : undefined}
+			bind:location={evalsLocation}
+			active={inEvals}
+		/>
+	{/snippet}
+
+	<Drawer bind:this={versionDrawer} size="1200px">
+		<DrawerContent title="Version history" on:close={() => versionDrawer?.closeDrawer()} noPadding>
+			<ResourceVersionHistory
+				path={target?.path ?? lastShownAgent ?? ''}
+				workspace={ws}
+				canRestore={!readOnly}
+				onRestore={() => {
+					versionDrawer?.closeDrawer()
+					// A restore writes the resource as a deploy does, so the flow behind has to be told
+					// the same way. Captured before closing, which drops the target this reads.
+					const at = currentWriteTarget()
+					// Close the editor too, as the generic resource editor does on a restore: it holds
+					// a baseline captured before the restore, and any local draft on top of it, so
+					// deploying from it afterwards would write the pre-restore value straight back over
+					// the version just restored.
+					close()
+					if (at) reconcileQuietly(at, at.path)
+				}}
+			/>
+		</DrawerContent>
+	</Drawer>
+{/if}
diff --git a/frontend/src/lib/components/flows/content/AgentResourceBar.svelte b/frontend/src/lib/components/flows/content/AgentResourceBar.svelte
index f5d5ec19a1..3a870f911d 100644
--- a/frontend/src/lib/components/flows/content/AgentResourceBar.svelte
+++ b/frontend/src/lib/components/flows/content/AgentResourceBar.svelte
@@ -2,21 +2,15 @@
 	import { Button, Drawer, DrawerContent } from '$lib/components/common'
 	import Alert from '$lib/components/common/alert/Alert.svelte'
 	import Badge from '$lib/components/common/badge/Badge.svelte'
-	import Tooltip from '$lib/components/meltComponents/Tooltip.svelte'
 	import Path from '$lib/components/Path.svelte'
 	import TextInput from '$lib/components/text_input/TextInput.svelte'
-	import { ResourceService, type AgentDraft, type InputTransform } from '$lib/gen'
+	import { ResourceService, type InputTransform } from '$lib/gen'
 	import { workspaceStore } from '$lib/stores'
 	import { sendUserToast } from '$lib/toast'
-	import { Bot, ChevronDown, ChevronUp, FlaskConical, Save, Unlink, Pencil } from 'lucide-svelte'
-	import AgentEvalModal from '$lib/components/aiEvals/AgentEvalModal.svelte'
-	import DiffDrawer from '$lib/components/DiffDrawer.svelte'
-	import type { Value } from '$lib/utils'
-	import ConfirmationModal from '$lib/components/common/confirmationModal/ConfirmationModal.svelte'
+	import { Bot, ChevronDown, ChevronUp, Save, Unlink, Pencil } from 'lucide-svelte'
 	import {
 		AGENT_BRAIN_KEYS,
 		AGENT_FLOW_LOCAL_KEYS,
-		agentConfigAsEdited,
 		agentConfigToInputTransforms,
 		flowLocalInputs,
 		inputTransformsToAgentConfig,
@@ -25,12 +19,12 @@
 		type AIAgentConfig,
 		type AgentTool
 	} from '../agentResourceUtils'
+	import { agentWriteCount, markAgentWritten, openAgentEditor } from '../agentEditorStore.svelte'
 	import {
 		setLinkedAgentTools,
 		clearLinkedAgentTools,
 		linkedToolsScope
 	} from '../linkedAgentToolsStore.svelte'
-	import { getAgentEdit, getAgentEditingPath, setAgentEditingPath } from '../agentEditStore.svelte'
 	import { logReusableAgentUsage } from '../agentTelemetry'
 	import { claimLinkedToolsFetch } from '../flowState'
 	import type { AgentTool as AgentToolStrict } from '../agentToolUtils'
@@ -44,7 +38,8 @@
 		toolInputs = $bindable(),
 		moduleId,
 		opWorkspace = undefined,
-		flowPath = ''
+		flowPath = '',
+		fromAgentEditor = false
 	}: {
 		agent: string | undefined
 		inputTransforms: Record<string, InputTransform>
@@ -56,28 +51,36 @@
 		opWorkspace?: string
 		// Scope for the linked-agent tools store (the flow path); must match what the graph reads.
 		flowPath?: string
+		// Inside the agent editor, where an agent used as a tool stays part of the agent being
+		// edited: it cannot be saved as a reusable agent of its own, and one already linked cannot be
+		// opened here. Linking a saved agent to another agent is out of scope for this editor — the
+		// backend supports it, but only a flow can author it, and a second editor over a second draft
+		// is the wrong way in.
+		fromAgentEditor?: boolean
 	} = $props()
 
 	let ws = $derived(opWorkspace ?? $workspaceStore)
 
+	// How many times the linked agent has been written, from anywhere: this card's own save, or a
+	// deploy from the agent editor mounted alongside it. Both reads below key on it, so neither
+	// keeps naming the config and version a write has just replaced.
+	let writes = $derived(agentWriteCount(ws, agent))
+
 	let saveDrawer: Drawer | undefined = $state()
 	let newPath = $state('')
 	let pathError = $state('')
 	let description = $state('')
 	let saving = $state(false)
-	// The edit session of a step forked from a saved agent: the path "Save changes" upserts back
-	// to, and the baselines the edits are judged against. Lives in an external store so it
-	// survives this component unmounting — another node selected, the step's tab switched — keyed
-	// by the forked `tools` identity so a stale entry can't resurface (see agentEditStore).
-	let editing = $derived(getAgentEdit(tools))
-	let editingPath = $derived(editing?.path)
 
 	type LinkedInfo = {
 		// What this result was fetched for. runed's resource neither aborts nor tags a superseded
-		// request, so a slow fetch for a previous link can land after a newer one: every consumer
-		// gates on these matching the current (ws, agent).
+		// request, so a slow fetch can land after a newer one: every consumer gates on these matching
+		// the current (ws, agent, writes). `writes` is what covers a refetch of the *same* link after
+		// a deploy — without it a pre-deploy response is indistinguishable from the current one, and
+		// accepting it republishes the tools the deploy just replaced.
 		ws?: string
 		path?: string
+		writes: number
 		config: AIAgentConfig
 		tools: AgentTool[]
 		providerPath?: string
@@ -88,10 +91,10 @@
 	// load them here for display, and probe the provider resource so we can warn when it isn't
 	// accessible in this workspace (the user then needs to unlink/fork or gain access).
 	let linkedResource = resource(
-		() => ({ ws, path: agent }),
-		async ({ ws, path }): Promise<LinkedInfo> => {
+		() => ({ ws, path: agent, writes }),
+		async ({ ws, path, writes }): Promise<LinkedInfo> => {
 			if (!ws || !path) {
-				return { ws, path, config: {}, tools: [], providerOk: true }
+				return { ws, path, writes, config: {}, tools: [], providerOk: true }
 			}
 			const res = await ResourceService.getResource({ workspace: ws, path })
 			const cfg = (res.value ?? {}) as AIAgentConfig & { provider?: { resource?: string } }
@@ -112,6 +115,7 @@
 			return {
 				ws,
 				path,
+				writes,
 				config: cfg,
 				tools,
 				providerPath,
@@ -125,7 +129,7 @@
 	let loadedInfo = $state<LinkedInfo | undefined>(undefined)
 	$effect(() => {
 		const current = linkedResource.current
-		if (current && current.ws === ws && current.path === agent) {
+		if (current && current.ws === ws && current.path === agent && current.writes === writes) {
 			loadedInfo = current
 		}
 	})
@@ -137,27 +141,31 @@
 	let providerPath = $derived(linkedInfo?.providerPath)
 	let providerOk = $derived(linkedInfo?.providerOk ?? true)
 	/** The agent the card is about: the one this step links to, or the one being edited. */
-	let cardPath = $derived(agent ?? editingPath)
-	let evalsOpen = $state(false)
-	// Bumped on every write to the resource, so a save that leaves the card on the same agent still
-	// refetches the version it just minted.
-	let writes = $state(0)
+	let cardPath = $derived(agent)
 	// The version eval runs are recorded against. The resource does not hold it; its newest history
 	// entry does, since recording is a database trigger on every write.
 	let versionResource = resource(
 		() => ({ ws, path: cardPath, writes }),
-		async ({ ws, path }): Promise<{ ws?: string; path?: string; version?: number }> => {
+		async ({
+			ws,
+			path,
+			writes
+		}): Promise<{ ws?: string; path?: string; writes: number; version?: number }> => {
 			if (!ws || !path) {
-				return { ws, path }
+				return { ws, path, writes }
 			}
 			const history = await ResourceService.getResourceHistory({ workspace: ws, path })
-			return { ws, path, version: history.versions?.[0]?.version }
+			return { ws, path, writes, version: history.versions?.[0]?.version }
 		}
 	)
-	// Guarded like the link above: a response for a previous agent must not label this one.
+	// Guarded like the link above, `writes` included: a response for a previous agent must not label
+	// this one, and one from before a deploy must not relabel it with the version it replaced.
 	let version = $derived.by(() => {
 		const loaded = versionResource.current
-		return loaded !== undefined && loaded.ws === ws && loaded.path === cardPath
+		return loaded !== undefined &&
+			loaded.ws === ws &&
+			loaded.path === cardPath &&
+			loaded.writes === writes
 			? loaded.version
 			: undefined
 	})
@@ -184,7 +192,7 @@
 		if (loaded) {
 			claimLinkedToolsFetch(toolScope, moduleId)
 			// linkedResource types tools loosely; they are the same resource tools the store holds.
-			setLinkedAgentTools(toolScope, moduleId, loaded.tools as AgentToolStrict[])
+			setLinkedAgentTools(toolScope, moduleId, loaded.tools as AgentToolStrict[], agent)
 			publishedFor = agent
 		} else if (publishedFor !== undefined && publishedFor !== agent) {
 			// The link moved and the new agent hasn't resolved, so the stored tools are the old one's.
@@ -203,7 +211,7 @@
 	let showDetail = $state(false)
 
 	function openSave() {
-		newPath = editingPath ?? ''
+		newPath = ''
 		pathError = ''
 		description = ''
 		saveDrawer?.openDrawer()
@@ -260,12 +268,12 @@
 		// every brain transform and the tools. Comparing the saved config instead would miss a
 		// non-static brain edit, which the resource cannot hold yet linking still strips.
 		const savedSnapshot = discardedOnLinkSnapshot()
-		// If the edit session ends or changes while the requests below are in flight (Cancel, undo,
-		// session-draft sync, a different agent opened for editing), the resource is still written but
-		// the step must not be relinked/cleared. Pinning the path — not merely "some edit is active" —
-		// is what distinguishes this session from a replacement one.
+		// If the step is replaced while the requests below are in flight (undo, a session-draft sync),
+		// the resource is still written but the step must not be relinked and emptied. The tools array
+		// this save started from is what identifies it, and its link answers for the case where a
+		// step keeps that array yet is pointed at an agent of its own meanwhile.
 		const forkMarker = tools
-		const savingEditPath = getAgentEditingPath(forkMarker)
+		const startedUnlinkedFrom = agent
 		const exists = await ResourceService.existsResource({ workspace: ws!, path })
 		if (exists) {
 			// The drawer's path check is debounced, so a fast save can reach here with an unrelated
@@ -294,15 +302,8 @@
 		}
 		// The write minted a version, and nothing else the fetch keys on has to change for it to be
 		// the one the card should now be naming.
-		writes++
-		// Editing: a content-preserving refresh may have re-anchored the marker onto a clone of
-		// `tools`, which is still this session; a cleared or different path is not. Saving a
-		// standalone step has no marker to track, so only the fork's own array identifies it.
-		const sameSession =
-			savingEditPath === undefined
-				? tools === forkMarker
-				: getAgentEditingPath(tools) === savingEditPath
-		if (!sameSession) {
+		markAgentWritten(ws, path)
+		if (tools !== forkMarker || agent !== startedUnlinkedFrom) {
 			// The resource is written either way; say so, or the drawer just closes with no outcome.
 			sendUserToast(
 				`Saved ${path}, but the step changed while saving, so it was not linked to the agent`,
@@ -320,9 +321,6 @@
 			return false
 		}
 		agent = path
-		// Clear the edit entry while `tools` is still the fork's marker, before it's reassigned.
-		setAgentEditingPath(tools, undefined)
-		setAgentEditingPath(forkMarker, undefined)
 		// The brain + tools now live in the resource; a linked step keeps only the flow-local inputs.
 		tools = []
 		inputTransforms = flowLocalInputs(inputTransforms)
@@ -335,12 +333,11 @@
 		}
 		saving = true
 		try {
-			const updating = newPath === editingPath
 			const linked = await persist(newPath, description)
 			saveDrawer?.closeDrawer()
 			if (linked) {
-				logReusableAgentUsage(updating ? 'updated' : 'saved')
-				sendUserToast(updating ? `Updated agent ${newPath}` : `Saved reusable agent ${newPath}`)
+				logReusableAgentUsage('saved')
+				sendUserToast(`Saved reusable agent ${newPath}`)
 			}
 		} catch (e) {
 			sendUserToast(`Failed to save agent: ${e}`, true)
@@ -349,34 +346,13 @@
 		}
 	}
 
-	// Save the forked-for-edit step back to the agent it came from, updating it in place.
-	async function saveChanges() {
-		if (!ws || !editingPath) {
-			return
-		}
-		saving = true
-		const path = editingPath
-		try {
-			if (await persist(path)) {
-				logReusableAgentUsage('updated')
-				sendUserToast(`Updated agent ${path}`)
-			}
-		} catch (e) {
-			sendUserToast(`Failed to update agent: ${e}`, true)
-		} finally {
-			saving = false
-		}
-	}
-
-	// Copy the resource's brain + tools into the step, for Unlink (diverge here) and Edit (change the
-	// saved agent). Unlink folds this flow's tool_inputs into the tools and clears them, so the
-	// standalone step keeps its bindings; Edit must not fold, or those overrides would be promoted
-	// into the shared agent instead of surviving the re-link.
-	async function forkFromResource(
-		foldOverrides: boolean
-	): Promise<{ path: string; deployedConfig: string } | undefined> {
+	// Copy the resource's brain + tools into the step, so it can diverge from the agent it was
+	// linked to. This flow's tool_inputs are folded into the tools and then cleared, so the
+	// standalone step keeps the bindings it was running with.
+	// Returns false when the step changed under the fetch, so the caller can say nothing happened.
+	async function forkFromResource(): Promise<boolean> {
 		if (!ws || !agent) {
-			return undefined
+			return false
 		}
 		const path = agent
 		// `tools` is one array per module value, so it identifies the step itself — the path alone
@@ -384,9 +360,9 @@
 		const stepMarker = tools
 		const res = await ResourceService.getResource({ workspace: ws, path })
 		// The module may have been replaced while the fetch was in flight (undo, session drafts);
-		// applying a stale fork would overwrite the restored state and recreate the Editing target.
+		// applying a stale fork would overwrite the restored state.
 		if (agent !== path || tools !== stepMarker) {
-			return undefined
+			return false
 		}
 		const cfg = (res.value ?? {}) as AIAgentConfig
 		// Preserve the flow-local inputs already wired in the step.
@@ -398,30 +374,24 @@
 		}
 		const forkedInputs = { ...agentConfigToInputTransforms(cfg), ...local }
 		const forkedTools = cfg.tools ?? []
-		// The baseline edits are judged against, in the form `currentConfig` takes: comparing
-		// against the resource's own JSON would count key order as an edit.
-		const deployedConfig = JSON.stringify(agentConfigAsEdited(forkedInputs, forkedTools))
 		inputTransforms = forkedInputs
-		if (foldOverrides) {
-			for (const tool of forkedTools) {
-				const overrides = toolInputs?.[tool.id]
-				if (overrides && tool.value?.input_transforms) {
-					tool.value.input_transforms = { ...tool.value.input_transforms, ...overrides }
-				}
+		for (const tool of forkedTools) {
+			const overrides = toolInputs?.[tool.id]
+			if (overrides && tool.value?.input_transforms) {
+				tool.value.input_transforms = { ...tool.value.input_transforms, ...overrides }
 			}
-			toolInputs = {}
 		}
+		toolInputs = {}
 		tools = forkedTools
 		agent = undefined
-		return { path, deployedConfig }
+		return true
 	}
 
 	// Unlink forks the agent into this step so it can diverge here. It does not write back.
 	async function unlink() {
 		try {
-			const fork = await forkFromResource(true)
-			if (fork) {
-				setAgentEditingPath(tools, undefined)
+			const forked = await forkFromResource()
+			if (forked) {
 				logReusableAgentUsage('unlinked')
 				sendUserToast('Forked agent. Its configuration was copied into this step')
 			} else {
@@ -432,93 +402,18 @@
 		}
 	}
 
-	// Edit the saved agent itself: fork it into the step for editing, remembering the path so
-	// "Save changes" writes back to it (updating every flow that links to it).
-	async function editAgent() {
-		try {
-			const fork = await forkFromResource(false)
-			if (fork) {
-				const { path, ...baselines } = fork
-				setAgentEditingPath(tools, path, baselines)
-				sendUserToast(`Editing ${path}. Make changes, then Save changes to update it`)
-			} else {
-				sendUserToast('The step changed while loading the agent. Try Edit again', true)
-			}
-		} catch (e) {
-			sendUserToast(`Failed to edit agent: ${e}`, true)
-		}
-	}
-
-	/** The edits as a run of them executes them: the step's brain transforms as authored
-	 *  (expressions included) and its tools. Flow-local inputs are left out: a case supplies them,
-	 *  and that is what lets the server recognise a run of later-deployed edits as that version. */
-	function editedConfig(): AgentDraft {
-		const brain: Record<string, InputTransform> = {}
-		for (const [key, transform] of Object.entries(inputTransforms ?? {})) {
-			if (!(AGENT_FLOW_LOCAL_KEYS as readonly string[]).includes(key)) {
-				brain[key] = transform
-			}
-		}
-		return {
-			input_transforms: $state.snapshot(brain) as Record<string, unknown>,
-			tools: $state.snapshot(tools) as Record<string, unknown>[]
-		}
-	}
-
-	/** The configuration the step holds now, in the form it is compared with the deployed agent in.
-	 *  Expressions count: the saved config cannot hold one, but a run of the edits executes it and
-	 *  Cancel drops it. */
-	let currentConfig = $derived(JSON.stringify(agentConfigAsEdited(inputTransforms, tools)))
-	/** The agent as deployed, in the same form; kept on the edit session so an editor mounted
-	 *  part-way through still has it. */
-	let deployedConfig = $derived(editing?.deployedConfig)
-	let edited = $derived(deployedConfig !== undefined && currentConfig !== deployedConfig)
-
-	let diffDrawer: DiffDrawer | undefined = $state()
-	// Both sides snapshotted at click time: the drawer would otherwise keep re-reading the live
-	// step while the user types behind it.
-	function showDiff() {
-		if (!deployedConfig) return
-		diffDrawer?.openDrawer()
-		diffDrawer?.setDiff({
-			mode: 'simple',
-			original: JSON.parse(deployedConfig) as Value,
-			current: $state.snapshot(agentConfigAsEdited(inputTransforms, tools)) as Value,
-			title: 'Deployed <> Unsaved agent changes',
-			button: {
-				text: 'Discard changes',
-				onClick: () => {
-					// Asked for by name, from a drawer showing exactly what goes: no second question.
-					const path = editingPath
-					if (path) relink(path)
-					diffDrawer?.closeDrawer()
-				}
-			}
+	// Edit the saved agent itself. The step stays linked throughout: the edits live in the agent's
+	// own resource draft, not in this step, so they survive leaving the flow and are the same edits
+	// whichever flow — or the resources page — opened them.
+	function editAgent() {
+		if (!agent) return
+		openAgentEditor({
+			path: agent,
+			workspace: ws,
+			// Where to re-resolve this graph's tool nodes once the agent is deployed.
+			host: { flowPath, moduleId }
 		})
 	}
-
-	let confirmCancel = $state(false)
-	// Cancel drops the edits and re-links the step without saving anything, so it asks first when
-	// there are edits to drop.
-	function cancelEdit() {
-		const path = editingPath
-		if (!path) return
-		if (edited) {
-			confirmCancel = true
-			return
-		}
-		relink(path)
-	}
-
-	// Put the step back on the agent. Edit kept this flow's `tool_inputs` off the forked tools
-	// rather than folding them in, so they survive the round trip as overrides.
-	function relink(path: string) {
-		// Clear the entry while `tools` is still the fork's array, which is what keys it.
-		setAgentEditingPath(tools, undefined)
-		agent = path
-		tools = []
-		inputTransforms = flowLocalInputs(inputTransforms)
-	}
 </script>
 
 <div class="px-2 xl:px-4 py-1.5 border-b border-light">
@@ -564,29 +459,19 @@
 							{/if}
 						</span>
 					{/if}
-					<Button
-						unifiedSize="sm"
-						variant="default"
-						startIcon={{ icon: FlaskConical }}
-						title="Run this agent against a dataset of cases"
-						onclick={(e) => {
-							e.stopPropagation()
-							evalsOpen = true
-						}}
-					>
-						Evals
-					</Button>
-					<Button
-						unifiedSize="sm"
-						variant="default"
-						startIcon={{ icon: Pencil }}
-						iconOnly
-						title="Edit the saved agent (updates it everywhere it's used)"
-						onclick={(e) => {
-							e.stopPropagation()
-							editAgent()
-						}}
-					/>
+					{#if !fromAgentEditor}
+						<Button
+							unifiedSize="sm"
+							variant="default"
+							startIcon={{ icon: Pencil }}
+							iconOnly
+							title="Edit the saved agent (updates it everywhere it's used)"
+							onclick={(e) => {
+								e.stopPropagation()
+								editAgent()
+							}}
+						/>
+					{/if}
 					<Button
 						unifiedSize="sm"
 						variant="default"
@@ -630,73 +515,7 @@
 				</Alert>
 			</div>
 		{/if}
-	{:else if editingPath}
-		<div
-			class="rounded-md border border-light bg-surface-tertiary px-3 py-1.5 flex flex-col gap-1.5"
-		>
-			<div class="flex items-center gap-2">
-				<Pencil size={16} class="text-primary shrink-0" />
-				<div class="min-w-0 flex-1 flex flex-col">
-					<div class="flex items-center gap-2 min-w-0">
-						<span class="truncate text-xs font-medium" title={editingPath}>{editingPath}</span>
-						{#if version != undefined}
-							<Badge color="gray" class="shrink-0" title="The version these edits sit on">
-								v{version}
-							</Badge>
-						{/if}
-						{#if edited}
-							<Badge
-								color="yellow"
-								class="shrink-0"
-								clickable
-								title="Show what differs from the deployed agent"
-								onclick={showDiff}
-							>
-								unsaved changes
-							</Badge>
-						{/if}
-					</div>
-					<div class="text-2xs text-secondary flex items-center gap-0.5">
-						saving updates every flow using it<Tooltip small>
-							{#snippet text()}
-								The edits live in this step until you decide: Evals runs them as they are here, Save
-								changes writes them to the agent, Cancel drops them and re-links the step.
-							{/snippet}
-						</Tooltip>
-					</div>
-				</div>
-				<Button
-					unifiedSize="sm"
-					variant="default"
-					startIcon={{ icon: FlaskConical }}
-					title="Run these edits against a dataset of cases"
-					disabled={saving}
-					onclick={() => (evalsOpen = true)}
-				>
-					Evals
-				</Button>
-			</div>
-			<div class="flex items-center justify-end gap-1">
-				<Button unifiedSize="sm" variant="default" disabled={saving} onclick={cancelEdit}>
-					Cancel
-				</Button>
-				<Button
-					unifiedSize="sm"
-					variant="accent"
-					startIcon={{ icon: Save }}
-					disabled={saving || !!providerSaveError}
-					onclick={saveChanges}
-				>
-					Save changes
-				</Button>
-			</div>
-		</div>
-		{#if providerSaveError}
-			<p class="text-2xs text-red-500 mt-1">
-				{providerSaveError}
-			</p>
-		{/if}
-	{:else}
+	{:else if !fromAgentEditor}
 		<Button
 			unifiedSize="sm"
 			variant="default"
@@ -752,31 +571,3 @@
 		{/snippet}
 	</DrawerContent>
 </Drawer>
-
-<!-- Opened from the editing card, the edits are what is under test, read from the step when Run is
-     pressed; from the linked card, the deployed agent is. -->
-<AgentEvalModal
-	agentPath={cardPath}
-	{opWorkspace}
-	editedConfig={editingPath ? editedConfig : undefined}
-	bind:open={evalsOpen}
-/>
-
-<DiffDrawer bind:this={diffDrawer} />
-
-<ConfirmationModal
-	open={confirmCancel}
-	title="Drop these edits?"
-	confirmationText="Drop edits"
-	onConfirmed={() => {
-		confirmCancel = false
-		const path = editingPath
-		if (path) relink(path)
-	}}
-	onCanceled={() => (confirmCancel = false)}
->
-	<span class="text-sm">
-		The step goes back to {editingPath} as it is deployed, and the edits are not kept anywhere. Save
-		changes writes them to the agent instead.
-	</span>
-</ConfirmationModal>
diff --git a/frontend/src/lib/components/flows/content/AgentToolBindings.svelte b/frontend/src/lib/components/flows/content/AgentToolBindings.svelte
index e1c54f6901..dc3fad1ea7 100644
--- a/frontend/src/lib/components/flows/content/AgentToolBindings.svelte
+++ b/frontend/src/lib/components/flows/content/AgentToolBindings.svelte
@@ -4,11 +4,13 @@
 	import type { InputTransform, ScriptLang } from '$lib/gen'
 	import InputTransformSchemaForm from '$lib/components/InputTransformSchemaForm.svelte'
 	import HighlightCode from '$lib/components/HighlightCode.svelte'
-	import { Wrench } from 'lucide-svelte'
+	import { Button } from '$lib/components/common'
+	import { ChevronDown, ChevronRight, Wrench } from 'lucide-svelte'
 	import type { PickableProperties } from '../previousResults'
 	import {
 		agentToolToFlowModule,
 		isFlowModuleTool,
+		AI_AGENT_TOOL_AI_KEYS,
 		type AgentTool,
 		type FlowModuleTool
 	} from '../agentToolUtils'
@@ -129,14 +131,44 @@
 		const v = tool.value as { type?: string; language?: ScriptLang; content?: string }
 		return v.type === 'rawscript' && v.content ? v : undefined
 	}
+
+	/** How many of this tool's inputs this flow binds. `toolInputs` holds the diff from the
+	 *  resource, so its size is the count. */
+	function overrideCount(tool: FlowModuleTool): number {
+		return Object.keys(toolInputs?.[tool.id] ?? {}).length
+	}
+
+	// Which sections the reader opened or closed. Absent means the default below, so a tool that
+	// gains an override while untouched still opens on its own.
+	let toggled = $state<Record<string, boolean>>({})
+	/** Open where there is something to see: a tool this flow binds. The rest are the agent's own
+	 *  business, and a linked agent's roster is mostly that. */
+	function isOpen(tool: FlowModuleTool): boolean {
+		return toggled[tool.id] ?? overrideCount(tool) > 0
+	}
 </script>
 
 {#if flowTools.length > 0}
 	<div class="flex flex-col gap-2 px-2 pb-8 xl:px-4">
 		{#each flowTools as tool (tool.id)}
 			{@const code = toolCode(tool)}
+			{@const open = isOpen(tool)}
 			<div class="rounded-md border border-light">
-				<div class="flex items-center gap-1.5 border-b border-light px-3 py-1.5 text-xs">
+				<Button
+					variant="subtle"
+					unifiedSize="sm"
+					aria-expanded={open}
+					onClick={() => (toggled[tool.id] = !open)}
+					wrapperClasses="w-full"
+					btnClasses="w-full !justify-start !text-left !px-3 !font-normal !text-xs !gap-1.5 !rounded-b-none {open
+						? 'border-b border-light'
+						: ''}"
+				>
+					{#if open}
+						<ChevronDown size={14} class="shrink-0 text-tertiary" />
+					{:else}
+						<ChevronRight size={14} class="shrink-0 text-tertiary" />
+					{/if}
 					<Wrench size={14} class="shrink-0 text-tertiary" />
 					<span class="font-medium">{tool.summary || tool.id}</span>
 					{#if tool.description}
@@ -144,8 +176,10 @@
 							>{tool.description}</span
 						>
 					{/if}
-				</div>
-				{#if schemas[tool.id] !== undefined && localArgs[tool.id] !== undefined}
+				</Button>
+				{#if !open}
+					<!-- collapsed: the agent's own inputs, nothing this flow has changed -->
+				{:else if schemas[tool.id] !== undefined && localArgs[tool.id] !== undefined}
 					<InputTransformSchemaForm
 						class="px-3 pt-1"
 						schema={schemas[tool.id]}
@@ -153,6 +187,9 @@
 						{extraLib}
 						{workspace}
 						isAgentTool
+						allowedAiTransforms={(tool.value as { type?: string }).type === 'aiagent'
+							? AI_AGENT_TOOL_AI_KEYS
+							: undefined}
 						bind:args={
 							() => localArgs[tool.id],
 							(v) => {
@@ -163,7 +200,7 @@
 				{:else}
 					<div class="px-3 py-2 text-2xs text-tertiary">Loading inputs...</div>
 				{/if}
-				{#if code}
+				{#if open && code}
 					<details class="border-t border-light">
 						<summary class="cursor-pointer px-3 py-1.5 text-2xs font-medium text-tertiary">
 							Tool code (read-only)
diff --git a/frontend/src/lib/components/flows/content/AgentToolRoster.svelte b/frontend/src/lib/components/flows/content/AgentToolRoster.svelte
new file mode 100644
index 0000000000..33abff2ba8
--- /dev/null
+++ b/frontend/src/lib/components/flows/content/AgentToolRoster.svelte
@@ -0,0 +1,172 @@
+<script lang="ts">
+	import { ChevronRight, Plus, Wrench, X } from 'lucide-svelte'
+	import { twMerge } from 'tailwind-merge'
+	import { getToolNameError, toolDisplayName } from '../agentToolUtils'
+	import type { AgentTool } from '../agentToolUtils'
+	import { Button } from '$lib/components/common'
+	import Popover from '$lib/components/meltComponents/Popover.svelte'
+	import InsertModuleInner from '../map/InsertModuleInner.svelte'
+	import { overlayPortalTarget } from '$lib/components/common/overlayHost.svelte'
+
+	interface Props {
+		tools?: AgentTool[]
+		/** Where clicking a tool goes. Without it the roster is a read-only list. */
+		onSelectTool?: (toolId: string) => void
+		/** Adds a tool. Without it the empty state only says where to add one. */
+		onAddTool?: (detail: { kind: string; script?: any; flow?: any; inlineScript?: any }) => void
+		/** Removes a tool. Without it the rows carry no delete, as they must not for a linked
+		 *  agent's tools, which belong to the agent rather than to the step showing them. */
+		onDeleteTool?: (toolId: string) => void
+		emptyMessage?: string
+		/** Where the picker's popover belongs, when the roster is not inside the flow editor. */
+		pickerPortal?: string
+	}
+
+	let {
+		tools = [],
+		onSelectTool = undefined,
+		onAddTool = undefined,
+		onDeleteTool = undefined,
+		emptyMessage = 'No tools yet. Add one from the agent on the flow graph.',
+		pickerPortal = '#flow-editor'
+	}: Props = $props()
+
+	let funcDesc = $state('')
+	const portalTarget = overlayPortalTarget(() => pickerPortal)
+
+	function toolKind(tool: AgentTool): string | undefined {
+		const value = tool?.value as Record<string, any>
+		if (value?.type === 'aiagent') return 'agent'
+		if (value?.tool_type === 'mcp') return 'MCP'
+		if (value?.tool_type === 'websearch') return 'web search'
+		return undefined
+	}
+
+	/** Only a flow module tool's summary is the name the model is given; an mcp or websearch
+	 *  summary is never sent, so a blank one there is not an error. Same rule as `agentToolTree`. */
+	function isNamed(tool: AgentTool): boolean {
+		return tool?.value?.tool_type !== 'mcp' && tool?.value?.tool_type !== 'websearch'
+	}
+
+	let siblingNames = $derived(tools.filter(isNamed).map((tool) => tool?.summary ?? ''))
+
+	function nameError(tool: AgentTool): string | undefined {
+		if (!isNamed(tool)) return undefined
+		return getToolNameError(tool?.summary ?? '', tool?.value?.tool_type, siblingNames)
+	}
+
+	/** What to call a tool that has nothing to be called yet. A kind that carries no name says what
+	 *  it is still missing instead; the rest are named by their problem, since the run cannot start
+	 *  without one. There is room here for the full wording the graph node has to abbreviate. */
+	function unnamedLabel(tool: AgentTool): string {
+		if (tool?.value?.tool_type === 'mcp') return 'No MCP server selected'
+		return 'Missing tool name'
+	}
+</script>
+
+{#snippet addToolButton()}
+	<Popover
+		portal={portalTarget()}
+		contentClasses="p-2 max-w-full h-[400px] bg-surface"
+		class="inline-block"
+		usePointerDownOutside
+		floatingConfig={{ placement: 'bottom-start', strategy: 'absolute', gutter: 8, flip: true }}
+	>
+		{#snippet trigger()}
+			<Button variant="default" unifiedSize="sm" startIcon={{ icon: Plus }}>Tool</Button>
+		{/snippet}
+		{#snippet content({ close })}
+			<!-- The same picker the graph's `+ Tool` opens, so both routes offer the same kinds and
+			     hand the same detail to the same insert. -->
+			<InsertModuleInner
+				bind:funcDesc
+				toolMode
+				on:close={close}
+				on:new={(e) => (onAddTool?.(e.detail), close())}
+				on:insert={(e) => (onAddTool?.(e.detail), close())}
+				on:pickScript={(e) => (
+					onAddTool?.({
+						kind: e.detail.kind,
+						script: {
+							...e.detail,
+							summary: e.detail.summary
+								? e.detail.summary.replace(/\s/, '_').replace(/[^a-zA-Z0-9_]/g, '')
+								: e.detail.path.split('/').pop()
+						}
+					}),
+					close()
+				)}
+				on:pickMcpTool={() => (onAddTool?.({ kind: 'mcpTool' }), close())}
+				on:pickWebsearchTool={() => (onAddTool?.({ kind: 'websearchTool' }), close())}
+				on:pickAiAgentTool={() => (onAddTool?.({ kind: 'aiAgentTool' }), close())}
+			/>
+		{/snippet}
+	</Popover>
+{/snippet}
+
+{#if tools.length === 0}
+	<div class="flex flex-col items-start gap-2">
+		<div class="text-xs text-tertiary">
+			{onAddTool ? 'No tools yet.' : emptyMessage}
+		</div>
+		{#if onAddTool}
+			{@render addToolButton()}
+		{/if}
+	</div>
+{:else}
+	<div class="flex flex-col border rounded-md divide-y overflow-hidden">
+		<!-- Keyed by position, not id: the list is JSON-authored, so two entries can carry the same
+		     id or none, and a duplicate key throws during render. The rows hold no state of their
+		     own, so position is identity enough here. -->
+		{#each tools as tool, i (i)}
+			{@const kind = toolKind(tool)}
+			{@const error = nameError(tool)}
+			<!-- The delete sits beside the row rather than inside it: the row is itself a button, and
+			     a button cannot hold another. -->
+			<div class="flex flex-row items-stretch">
+				<Button
+					variant="subtle"
+					unifiedSize="sm"
+					disabled={!onSelectTool}
+					onClick={() => onSelectTool?.(tool?.id)}
+					wrapperClasses="grow min-w-0"
+					btnClasses="w-full min-w-0 !justify-start !text-left !px-2 !font-normal !text-xs text-primary"
+				>
+					<Wrench size={13} class="shrink-0 text-tertiary" />
+					<!-- A tool the worker will reject is named by its problem, not by an id no one
+					     chose: the id would read as a name and hide that the run cannot start. -->
+					<span class={twMerge('truncate shrink min-w-0', error && 'text-red-400')}>
+						{error
+							? tool?.summary || unnamedLabel(tool)
+							: (toolDisplayName(tool) ?? unnamedLabel(tool))}
+					</span>
+					{#if error && tool?.summary}
+						<span class="truncate grow min-w-0 text-2xs text-red-400">{error}</span>
+					{:else}
+						<span class="grow"></span>
+					{/if}
+					{#if kind}
+						<span class="text-2xs text-tertiary shrink-0">{kind}</span>
+					{/if}
+					{#if onSelectTool}
+						<ChevronRight size={13} class="shrink-0 text-tertiary" />
+					{/if}
+				</Button>
+				{#if onDeleteTool}
+					<Button
+						unifiedSize="2xs"
+						variant="subtle"
+						iconOnly
+						startIcon={{ icon: X }}
+						title="Delete {toolDisplayName(tool) ?? 'this tool'}"
+						wrapperClasses="shrink-0 self-center pr-1"
+						onclick={() => onDeleteTool?.(tool?.id)}
+					/>
+				{/if}
+			</div>
+		{/each}
+	</div>
+	{#if onAddTool}
+		<div class="mt-2">{@render addToolButton()}</div>
+	{/if}
+{/if}
diff --git a/frontend/src/lib/components/flows/content/AgentToolWrapper.svelte b/frontend/src/lib/components/flows/content/AgentToolWrapper.svelte
index 194d19c6dc..6ccadc2ee5 100644
--- a/frontend/src/lib/components/flows/content/AgentToolWrapper.svelte
+++ b/frontend/src/lib/components/flows/content/AgentToolWrapper.svelte
@@ -15,6 +15,11 @@
 		forceTestTab?: Record<string, boolean>
 		highlightArg?: Record<string, string | undefined>
 		siblingToolNames?: string[]
+		/** See `FlowModuleComponent`: set when the tool belongs to a saved agent rather than to a
+		 *  step of this flow. */
+		staticOnly?: boolean
+		/** See `FlowModuleComponent`: set where there is no graph to select a nested tool on. */
+		noToolNavigation?: boolean
 	}
 
 	let {
@@ -25,15 +30,28 @@
 		previousModule = undefined,
 		forceTestTab,
 		highlightArg,
-		siblingToolNames = undefined
+		siblingToolNames = undefined,
+		staticOnly = false,
+		noToolNavigation = false
 	}: Props = $props()
 </script>
 
 {#if isFlowModuleTool(tool)}
 	<!-- FlowModule tool - use existing FlowModuleComponent -->
+	<!-- "Save to workspace" and "Fork" replace the module wholesale, so the binding must be
+	     two-way or the deploy writes the pre-replacement tool. Merged rather than assigned: they
+	     build a plain step, which carries none of the fields only a tool has. -->
 	<FlowModuleComponent
 		{noEditor}
-		flowModule={tool as FlowModule}
+		bind:flowModule={
+			() => tool as FlowModule,
+			(v) =>
+				(tool = {
+					...tool,
+					...v,
+					value: { tool_type: tool.value?.tool_type, ...v.value }
+				} as unknown as AgentTool)
+		}
 		{parentModule}
 		{previousModule}
 		failureModule={false}
@@ -45,6 +63,8 @@
 		forceTestTab={forceTestTab?.[tool.id]}
 		highlightArg={highlightArg?.[tool.id]}
 		isAgentTool={true}
+		{staticOnly}
+		{noToolNavigation}
 		bind:toolDescription={tool.description}
 		{siblingToolNames}
 	/>
diff --git a/frontend/src/lib/components/flows/content/AiAgentStepInputs.svelte b/frontend/src/lib/components/flows/content/AiAgentStepInputs.svelte
new file mode 100644
index 0000000000..feffb327c4
--- /dev/null
+++ b/frontend/src/lib/components/flows/content/AiAgentStepInputs.svelte
@@ -0,0 +1,394 @@
+<script module lang="ts">
+	// A field added but not yet filled looks exactly like an unset one, so leaving the step and
+	// coming back would drop the row. Remembering which fields are open per step keeps it. Bounded,
+	// or a long-lived tab keeps one entry for every agent step it ever opened.
+	const openFieldsByStep = new Map<string, string[]>()
+	const MAX_REMEMBERED_STEPS = 50
+
+	function rememberOpenFields(key: string | undefined, keys: string[]) {
+		if (!key) return
+		openFieldsByStep.delete(key)
+		openFieldsByStep.set(key, keys)
+		while (openFieldsByStep.size > MAX_REMEMBERED_STEPS) {
+			const oldest = openFieldsByStep.keys().next().value
+			if (oldest === undefined) break
+			openFieldsByStep.delete(oldest)
+		}
+	}
+</script>
+
+<script lang="ts">
+	import type { Schema } from '$lib/common'
+	import { type InputTransform } from '$lib/gen'
+	import { workspaceStore } from '$lib/stores'
+	import { allTrue, type DynamicInput as DynamicInputTypes } from '$lib/utils'
+	import { getContext, untrack } from 'svelte'
+	import { SvelteSet } from 'svelte/reactivity'
+	import { Button } from '$lib/components/common'
+	import StepInputsGen from '$lib/components/copilot/StepInputsGen.svelte'
+	import InputTransformForm from '$lib/components/InputTransformForm.svelte'
+	import InputTransformPickers from '$lib/components/InputTransformPickers.svelte'
+	import { useS3StorageConfigured } from '$lib/components/inputTransformEnv.svelte'
+	import type ItemPicker from '$lib/components/ItemPicker.svelte'
+	import type VariableEditor from '$lib/components/VariableEditor.svelte'
+	import DropdownV2 from '$lib/components/DropdownV2.svelte'
+	import ResizeTransitionWrapper from '$lib/components/common/ResizeTransitionWrapper.svelte'
+	import { Plus, X } from 'lucide-svelte'
+	import type { PickableProperties } from '../previousResults'
+	import type { FlowCopilotContext } from '$lib/components/copilot/flow'
+	import type { AgentTool } from '../agentToolUtils'
+	import {
+		AGENT_FIELDS,
+		AGENT_FIELD_GROUPS,
+		agentFieldAppliesTo,
+		initialVisibleAgentFields,
+		type AgentFieldGroup,
+		type AgentFieldSpec
+	} from '../agentFormFields'
+	import AgentToolRoster from './AgentToolRoster.svelte'
+
+	interface Props {
+		schema: Schema | { properties?: Record<string, any> }
+		/** Required: every row below indexes it directly, and a first render against an unset one
+		 *  would throw before the effect that normalises it could run. */
+		args: Record<string, InputTransform | any>
+		isValid?: boolean
+		extraLib?: string
+		previousModuleId?: string | undefined
+		/** Restrict the form to these keys, for a surface that edits only part of an agent. */
+		filter?: string[] | undefined
+		pickableProperties?: PickableProperties | undefined
+		enableAi?: boolean
+		class?: string
+		helperScript?: DynamicInputTypes.HelperScript
+		isAgentTool?: boolean
+		allowedAiTransforms?: string[] | undefined
+		chatInputEnabled?: boolean
+		workspace?: string | undefined
+		/** Identifies the step, so the fields it has open survive leaving and coming back. */
+		visibilityKey?: string
+		tools?: AgentTool[]
+		/** Offer only static values, for a surface whose store cannot hold anything else — a saved
+		 *  agent's config is plain JSON, so an expression on a brain field would be dropped on save.
+		 *  A step's own agent has no such limit: its transforms are evaluated per run. */
+		staticOnly?: boolean
+		/** Show the agent without letting anything about it be changed, for a viewer who has read
+		 *  access only. The fields are made inert rather than merely losing their buttons: a field
+		 *  left editable would look saved while every write behind it is rejected. */
+		readOnly?: boolean
+		/** Passed to every field, for a nested agent used as a tool: its brain has to stand on its
+		 *  own as `staticOnly` does, but its `user_message` is still the agent's to fill. */
+		noConnect?: boolean
+		noJavascript?: boolean
+		onSelectTool?: (toolId: string) => void
+		/** Adds a tool to this agent. Without it the roster is read-only, as it is for a linked
+		 *  agent, whose tools belong to the agent rather than to the step. */
+		onAddTool?: (detail: { kind: string; script?: any; flow?: any; inlineScript?: any }) => void
+		/** Removes a tool from this agent. Same rule as `onAddTool`: absent where the tools are not
+		 *  the step's to change. */
+		onDeleteTool?: (toolId: string) => void
+		/** Where the tool picker's popover belongs, for a surface that is not the flow editor. */
+		toolPickerPortal?: string
+	}
+
+	let {
+		schema = $bindable(),
+		args = $bindable(),
+		isValid = $bindable(),
+		extraLib = $bindable(),
+		previousModuleId = undefined,
+		filter = undefined,
+		pickableProperties = undefined,
+		enableAi = false,
+		class: clazz = '',
+		helperScript = undefined,
+		isAgentTool = false,
+		// Reproduces InputTransformSchemaForm's own default rather than the call site's value:
+		// `undefined` lets any field become an AI transform, and InputTransformForm rewrites
+		// `arg.type` to 'ai' on mount for every static-undefined field when it does.
+		allowedAiTransforms = isAgentTool ? undefined : [],
+		chatInputEnabled = false,
+		workspace,
+		visibilityKey = undefined,
+		tools = [],
+		staticOnly = false,
+		readOnly = false,
+		noConnect = false,
+		noJavascript = false,
+		onSelectTool = undefined,
+		onAddTool = undefined,
+		onDeleteTool = undefined,
+		toolPickerPortal = undefined
+	}: Props = $props()
+
+	let ws = $derived(workspace ?? $workspaceStore)
+
+	let inputCheck: { [id: string]: boolean } = $state({})
+
+	$effect(() => {
+		isValid = allTrue(inputCheck) ?? false
+	})
+
+	$effect(() => {
+		if (args == undefined || typeof args !== 'object') {
+			args = {}
+		}
+	})
+
+	export function setArgs(nargs: Record<string, InputTransform | any>) {
+		args = nargs
+	}
+
+	let pickForField: string | undefined = $state()
+	let itemPicker: ItemPicker | undefined = $state(undefined)
+	let variableEditor: VariableEditor | undefined = $state(undefined)
+
+	const s3Storage = useS3StorageConfigured(() => ws)
+
+	// The per-field copilot only ever writes a JavaScript transform, so it belongs only where one can
+	// be stored. On a static-only field the write lands in a key the config drops on deploy, which
+	// reports success over a visible edit, or persists an expression into a saved agent that every
+	// flow linking it would then have to satisfy.
+	let fieldAiEnabled = $derived(enableAi && !staticOnly && !noJavascript)
+
+	let schemaProperties = $derived((schema?.properties ?? {}) as Record<string, any>)
+
+	let scopedFields = $derived(
+		AGENT_FIELDS.filter(
+			(spec) =>
+				agentFieldAppliesTo(spec, schemaProperties) && (!filter || filter.includes(spec.key))
+		)
+	)
+
+	let outputType = $derived.by(() => {
+		const transform = args?.['output_type']
+		return transform && transform.type === 'static' ? transform.value : undefined
+	})
+	let imageOutput = $derived(outputType === 'image')
+
+	// Which fields have a row. Never derived from `args`, or emptying a textbox would make its row
+	// vanish under the cursor: this only ever grows, and the x is the one thing that shrinks it.
+	// Read once, on purpose: the set is seeded here and grows from there, so re-reading the key would
+	// be a rebuild that throws away everything the user has opened.
+	let visible = $state(
+		new SvelteSet<string>(openFieldsByStep.get(untrack(() => visibilityKey) ?? '') ?? [])
+	)
+
+	// A field set from anywhere else — an undo, a schema that arrived late — brings its row back on
+	// its own.
+	$effect(() => {
+		const set = initialVisibleAgentFields(args, schemaProperties)
+		untrack(() => {
+			for (const key of set) visible.add(key)
+		})
+	})
+
+	// The copilot hands its expressions to whichever row is mounted for the argument, so a field it
+	// targets needs one before it can take the value. Watched here rather than left to the union
+	// above, which only sees a field once something has already written to it.
+	const { exprsToSet } = getContext<FlowCopilotContext | undefined>('FlowCopilotContext') ?? {}
+	let pendingExprKeys = $derived(
+		exprsToSet ? Object.keys($exprsToSet ?? {}).filter((key) => $exprsToSet?.[key]) : []
+	)
+	$effect(() => {
+		const keys = pendingExprKeys
+		untrack(() => {
+			for (const key of keys) {
+				if (key in schemaProperties) visible.add(key)
+			}
+		})
+	})
+
+	$effect(() => {
+		const keys = [...visible]
+		untrack(() => rememberOpenFields(visibilityKey, keys))
+	})
+
+	function rowsIn(group: AgentFieldGroup): AgentFieldSpec[] {
+		return scopedFields.filter(
+			(spec) => spec.group === group && visible.has(spec.key) && !(imageOutput && spec.textOnly)
+		)
+	}
+
+	function addableIn(): AgentFieldSpec[] {
+		return scopedFields.filter(
+			(spec) =>
+				!spec.core && !spec.virtual && !visible.has(spec.key) && !(imageOutput && spec.textOnly)
+		)
+	}
+
+	function addField(spec: AgentFieldSpec) {
+		// `flowInfers` re-seeds every key on load, so adding cannot mean creating the key: it means
+		// showing the row, seeded at what a run does today so the field opens on what it overrides.
+		if (args) {
+			args[spec.key] = { type: 'static', value: structuredClone(spec.implicit) }
+		}
+		visible.add(spec.key)
+	}
+
+	function removeField(spec: AgentFieldSpec) {
+		visible.delete(spec.key)
+		if (args) {
+			// Back to exactly what `flowInfers` seeds, so removing a field leaves no diff behind.
+			// Never `delete args[key]`: the key returns on the next load, and the CLI linter requires
+			// `user_message` to be present.
+			args[spec.key] = { type: 'static', value: undefined }
+		}
+		// InputTransformSchemaForm leaks these on unmount, which would pin `isValid` false forever
+		// once hiding a row is routine.
+		delete inputCheck[spec.key]
+	}
+
+	let emptyArgNames = $derived(
+		[...visible].filter((key) => {
+			if (!(key in schemaProperties)) return false
+			const transform = args?.[key]
+			if (!transform) return false
+			return (
+				(transform.type === 'static' && !transform.value) ||
+				(transform.type === 'javascript' && !transform.expr)
+			)
+		})
+	)
+</script>
+
+{#snippet addFieldMenu()}
+	{@const candidates = addableIn()}
+	{#if candidates.length > 0}
+		<DropdownV2 placement="bottom-start" customMenu class="justify-start">
+			{#snippet buttonReplacement()}
+				<Button variant="default" unifiedSize="md" startIcon={{ icon: Plus }}>Add a field</Button>
+			{/snippet}
+			{#snippet menu({ close })}
+				<!-- Laid out as SelectDropdown lays out a resource list, so the two menus in this form
+				     behave the same: full-width rows, and a bordered heading per group. -->
+				<div
+					class="flex flex-col w-80 rounded-md bg-surface-input drop-shadow-base overflow-y-auto max-h-[50vh]"
+				>
+					{#each AGENT_FIELD_GROUPS as menuGroup (menuGroup.id)}
+						{@const groupCandidates = candidates.filter((spec) => spec.group === menuGroup.id)}
+						{#if groupCandidates.length > 0}
+							<div class="px-4 pt-3 pb-1 text-2xs font-normal uppercase text-secondary">
+								{menuGroup.label}
+							</div>
+							{#each groupCandidates as spec (spec.key)}
+								<Button
+									variant="subtle"
+									unifiedSize="md"
+									onClick={() => {
+										addField(spec)
+										close()
+									}}
+									wrapperClasses="w-full"
+									btnClasses="w-full !h-auto !justify-start !text-left !py-2 !px-4 !font-normal !text-xs text-primary !rounded-none"
+								>
+									<div class="w-full">
+										{spec.label}
+										{#if spec.defaultHint}
+											<div class="text-2xs text-secondary">{spec.defaultHint}</div>
+										{/if}
+									</div>
+								</Button>
+							{/each}
+						{/if}
+					{/each}
+				</div>
+			{/snippet}
+		</DropdownV2>
+	{/if}
+{/snippet}
+
+<div class="w-full mb-6 {clazz}">
+	<!-- Not offered on a static-only surface, where what it fills a field with is a JavaScript
+	     expression such a store cannot hold; nor on a tool, whose empty fields are the ones the
+	     agent above fills at run time. -->
+	{#if enableAi && !staticOnly && !isAgentTool && !readOnly}
+		<div class="pt-2">
+			<StepInputsGen {pickableProperties} argNames={emptyArgNames} {schema} />
+		</div>
+	{/if}
+
+	<div class="flex flex-col gap-8 pt-4">
+		{#each AGENT_FIELD_GROUPS as group (group.id)}
+			{@const rows = rowsIn(group.id)}
+			{#if rows.length > 0}
+				<div class="w-full flex flex-col">
+					<h2 class="mb-1 text-2xs font-normal uppercase text-secondary">{group.label}</h2>
+					<div class="flex flex-col gap-6">
+						{#each rows as spec (spec.key)}
+							<ResizeTransitionWrapper innerClass="w-full" vertical>
+								{#if spec.virtual}
+									<AgentToolRoster
+										{tools}
+										{onSelectTool}
+										{onAddTool}
+										{onDeleteTool}
+										pickerPortal={toolPickerPortal}
+									/>
+								{:else}
+									<!-- Inert rather than merely button-less: every control below writes into
+									     `args`, and a read-only viewer's edit is rejected by the server. Dimmed
+									     with it, so a field that ignores a click looks like it meant to. -->
+									<div class="w-full {readOnly ? 'opacity-60' : ''}" inert={readOnly}>
+										<InputTransformForm
+											{previousModuleId}
+											bind:arg={args[spec.key]}
+											bind:schema
+											argName={spec.key}
+											label={spec.label}
+											headerTooltip={spec.tooltip}
+											hideDescription
+											subtleControls
+											argExtra={schemaProperties[spec.key] ?? {}}
+											bind:inputCheck={
+												() => inputCheck[spec.key] ?? false,
+												(value) => (inputCheck[spec.key] = value)
+											}
+											bind:extraLib={() => extraLib ?? 'missing extraLib', (v) => (extraLib = v)}
+											{variableEditor}
+											{itemPicker}
+											bind:pickForField
+											{pickableProperties}
+											enableAi={fieldAiEnabled}
+											{helperScript}
+											{isAgentTool}
+											{allowedAiTransforms}
+											noDynamicToggle={staticOnly}
+											noConnect={staticOnly || noConnect}
+											noJavascript={staticOnly || noJavascript}
+											s3StorageConfigured={s3Storage.current}
+											{chatInputEnabled}
+											{workspace}
+											otherArgs={Object.fromEntries(
+												Object.entries(args ?? {}).filter(([key]) => key !== spec.key)
+											)}
+										>
+											{#snippet labelExtra()}
+												{#if !spec.core && !readOnly}
+													<Button
+														variant="subtle"
+														unifiedSize="2xs"
+														iconOnly
+														startIcon={{ icon: X }}
+														wrapperClasses="ml-1"
+														title="Unset {spec.label}"
+														on:click={() => removeField(spec)}
+													/>
+												{/if}
+											{/snippet}
+										</InputTransformForm>
+									</div>
+								{/if}
+							</ResizeTransitionWrapper>
+						{/each}
+					</div>
+				</div>
+			{/if}
+		{/each}
+		{#if !readOnly}
+			{@render addFieldMenu()}
+		{/if}
+	</div>
+</div>
+
+<InputTransformPickers {args} {pickForField} {workspace} bind:itemPicker bind:variableEditor />
diff --git a/frontend/src/lib/components/flows/content/FlowBranchesAllWrapper.svelte b/frontend/src/lib/components/flows/content/FlowBranchesAllWrapper.svelte
index 8374962083..22ce7150d6 100644
--- a/frontend/src/lib/components/flows/content/FlowBranchesAllWrapper.svelte
+++ b/frontend/src/lib/components/flows/content/FlowBranchesAllWrapper.svelte
@@ -1,5 +1,6 @@
 <script lang="ts">
 	import { Badge, Tab, Tabs } from '$lib/components/common'
+	import { refreshStateStore } from '$lib/svelte5Utils.svelte'
 	import { GripVertical, Plus, Trash2 } from 'lucide-svelte'
 	import { getContext } from 'svelte'
 	import type { FlowEditorContext } from '../types'
@@ -9,7 +10,6 @@
 		reorderBranches as reorderBranchesOp,
 		graphBranchIndex
 	} from '../branchOps'
-	import { refreshFlowStateStore } from '../flowStoreRefresh.svelte'
 	import Button from '$lib/components/common/button/Button.svelte'
 	import TextInput from '$lib/components/text_input/TextInput.svelte'
 	import { dragHandle, dragHandleZone } from '@windmill-labs/svelte-dnd-action'
@@ -83,7 +83,7 @@
 
 	function addBranch() {
 		addBranchOp(flowModule.id, { flowStore, history })
-		refreshFlowStateStore(flowStore)
+		refreshStateStore(flowStore)
 	}
 	function removeBranch(arrayIndex: number) {
 		// The shared op counts branches the way the graph does; see graphBranchIndex.
@@ -92,7 +92,7 @@
 			flowStateStore,
 			history
 		})
-		refreshFlowStateStore(flowStore)
+		refreshStateStore(flowStore)
 	}
 
 	let runSettings: FlowRunSettings | undefined = $state(undefined)
diff --git a/frontend/src/lib/components/flows/content/FlowBranchesOneWrapper.svelte b/frontend/src/lib/components/flows/content/FlowBranchesOneWrapper.svelte
index 25b843268a..753ac20166 100644
--- a/frontend/src/lib/components/flows/content/FlowBranchesOneWrapper.svelte
+++ b/frontend/src/lib/components/flows/content/FlowBranchesOneWrapper.svelte
@@ -1,5 +1,6 @@
 <script lang="ts">
 	import { Badge, Tab, Tabs } from '$lib/components/common'
+	import { refreshStateStore } from '$lib/svelte5Utils.svelte'
 	import { GripVertical, Plus, Trash2 } from 'lucide-svelte'
 	import { getContext } from 'svelte'
 	import type { FlowEditorContext } from '../types'
@@ -9,7 +10,6 @@
 		reorderBranches as reorderBranchesOp,
 		graphBranchIndex
 	} from '../branchOps'
-	import { refreshFlowStateStore } from '../flowStoreRefresh.svelte'
 	import Button from '$lib/components/common/button/Button.svelte'
 	import TextInput from '$lib/components/text_input/TextInput.svelte'
 	import { dragHandle, dragHandleZone } from '@windmill-labs/svelte-dnd-action'
@@ -90,7 +90,7 @@
 
 	function addBranch() {
 		addBranchOp(flowModule.id, { flowStore, history })
-		refreshFlowStateStore(flowStore)
+		refreshStateStore(flowStore)
 	}
 	function removeBranch(arrayIndex: number) {
 		// The shared op counts branches the way the graph does; see graphBranchIndex.
@@ -99,7 +99,7 @@
 			flowStateStore,
 			history
 		})
-		refreshFlowStateStore(flowStore)
+		refreshStateStore(flowStore)
 	}
 
 	let runSettings: FlowRunSettings | undefined = $state(undefined)
diff --git a/frontend/src/lib/components/flows/content/FlowEditorPanel.svelte b/frontend/src/lib/components/flows/content/FlowEditorPanel.svelte
index 81600e2dcc..404999dfbc 100644
--- a/frontend/src/lib/components/flows/content/FlowEditorPanel.svelte
+++ b/frontend/src/lib/components/flows/content/FlowEditorPanel.svelte
@@ -198,6 +198,7 @@
 					savedModule={savedModuleById(savedFlow?.value.modules, flowModule.id)}
 					{forceTestTab}
 					{highlightArg}
+					{flowModuleSchemaMap}
 				/>
 			{/each}
 		{/key}
diff --git a/frontend/src/lib/components/flows/content/FlowInput.svelte b/frontend/src/lib/components/flows/content/FlowInput.svelte
index d780dede0a..374bcf488a 100644
--- a/frontend/src/lib/components/flows/content/FlowInput.svelte
+++ b/frontend/src/lib/components/flows/content/FlowInput.svelte
@@ -1,5 +1,6 @@
 <script lang="ts">
 	import { Button } from '$lib/components/common'
+	import { refreshStateStore } from '$lib/svelte5Utils.svelte'
 	import { ButtonType } from '$lib/components/common/button/model'
 	import { getContext, tick, untrack } from 'svelte'
 	import FlowCard from '../common/FlowCard.svelte'
@@ -43,11 +44,11 @@
 	import SideBarTab from '$lib/components/meltComponents/SideBarTab.svelte'
 	import CaptureTable from '$lib/components/triggers/CaptureTable.svelte'
 	import { isObjectTooBig, readFieldsRecursively } from '$lib/utils'
-	import { refreshFlowStateStore } from '$lib/components/flows/flowStoreRefresh.svelte'
 	import type { AiAgent, InputTransform, ScriptLang } from '$lib/gen'
 	import { deepEqual } from 'fast-equals'
 	import Toggle from '$lib/components/Toggle.svelte'
 	import { AI_AGENT_SCHEMA } from '../flowInfers'
+	import { agentStreamingEnabled } from '../agentFormFields'
 	import { nextId } from '../flowModuleNextId'
 	import ConfirmationModal from '$lib/components/common/confirmationModal/ConfirmationModal.svelte'
 	import FlowChat from '../conversations/FlowChat.svelte'
@@ -99,11 +100,8 @@
 	let shouldUseStreaming = $derived.by(() => {
 		const modules = flowStore.val.value?.modules
 		const lastModule = modules && modules.length > 0 ? modules[modules.length - 1] : undefined
-		return (
-			lastModule?.value?.type === 'aiagent' &&
-			lastModule?.value?.input_transforms?.streaming?.type === 'static' &&
-			lastModule?.value?.input_transforms?.streaming?.value === true
-		)
+		if (lastModule?.value?.type !== 'aiagent') return false
+		return agentStreamingEnabled(lastModule.value)
 	})
 	let showChatModeWarning = $state(false)
 	let showAdditionalInputs = $state(false)
@@ -890,7 +888,7 @@
 									onAddNew={(argName) => {
 										handleEditSchema('inputEditor')
 										editableSchemaForm?.openField(argName)
-										refreshFlowStateStore(flowStore)
+										refreshStateStore(flowStore)
 									}}
 								>
 									{#snippet trigger()}
diff --git a/frontend/src/lib/components/flows/content/FlowInputsQuick.svelte b/frontend/src/lib/components/flows/content/FlowInputsQuick.svelte
index cf9d008a27..eb875973dc 100644
--- a/frontend/src/lib/components/flows/content/FlowInputsQuick.svelte
+++ b/frontend/src/lib/components/flows/content/FlowInputsQuick.svelte
@@ -15,12 +15,11 @@
 		workspaceStore
 	} from '$lib/stores'
 	import type { SupportedLanguage } from '$lib/common'
-	import { createEventDispatcher, getContext, onDestroy, onMount, untrack } from 'svelte'
+	import { createEventDispatcher, getContext, untrack } from 'svelte'
 	import type { FlowBuilderWhitelabelCustomUi } from '$lib/components/custom_ui'
 	import { type Script, type ScriptLang, type HubScriptKind } from '$lib/gen'
 	import ListFiltersQuick from '$lib/components/home/ListFiltersQuick.svelte'
 	import { ExternalLink, Folder, User, X } from 'lucide-svelte'
-	import type { FlowEditorContext } from '../../flows/types'
 	import { fade } from 'svelte/transition'
 	import { flip } from 'svelte/animate'
 	import { Button } from '$lib/components/common'
@@ -87,8 +86,6 @@
 
 	let hubCompletions: HubCompletion[] = $state([])
 
-	const { insertButtonOpen } = getContext<FlowEditorContext>('FlowEditorContext')
-
 	let selected: { kind: 'owner' | 'integrations'; name: string | undefined } | undefined =
 		$state(undefined)
 
@@ -221,13 +218,6 @@
 		selectedByKeyboard = index
 	}
 
-	onMount(() => {
-		$insertButtonOpen = true
-	})
-
-	onDestroy(() => {
-		$insertButtonOpen = false
-	})
 	let langs = $derived(
 		processInlineLangs(undefined, $defaultScripts?.order ?? Object.keys(defaultScriptLanguages))
 			.map((l) => [defaultScriptLanguages[l], l])
@@ -255,6 +245,7 @@
 	// on indices that render nothing.
 	let showAiRows = $derived(
 		!disableAi &&
+			!$copilotInfo.workspaceDisabled &&
 			funcDesc?.length > 0 &&
 			kind != 'failure' &&
 			kind != 'preprocessor' &&
diff --git a/frontend/src/lib/components/flows/content/FlowModuleComponent.svelte b/frontend/src/lib/components/flows/content/FlowModuleComponent.svelte
index 28082864aa..f73a6f38c4 100644
--- a/frontend/src/lib/components/flows/content/FlowModuleComponent.svelte
+++ b/frontend/src/lib/components/flows/content/FlowModuleComponent.svelte
@@ -1,5 +1,6 @@
 <script lang="ts">
 	import { Pane, Splitpanes } from 'svelte-splitpanes'
+	import { refreshStateStore } from '$lib/svelte5Utils.svelte'
 	import Tab from '$lib/components/common/tabs/Tab.svelte'
 	import Tabs from '$lib/components/common/tabs/Tabs.svelte'
 	import StepSettingsBadges from './StepSettingsBadges.svelte'
@@ -29,9 +30,11 @@
 	import FlowPathViewer from './FlowPathViewer.svelte'
 	import InputTransformSchemaForm from '$lib/components/InputTransformSchemaForm.svelte'
 	import AgentResourceBar from './AgentResourceBar.svelte'
+	import AiAgentStepInputs from './AiAgentStepInputs.svelte'
 	import AgentToolBindings from './AgentToolBindings.svelte'
 	import { getLinkedAgentTools, linkedToolsScope } from '../linkedAgentToolsStore.svelte'
 	import { flowLocalAgentSchema } from '../agentResourceUtils'
+	import { AI_AGENT_TOOL_AI_KEYS } from '../agentToolUtils'
 	import DiffEditor from '$lib/components/DiffEditor.svelte'
 	import type { ButtonProp } from '$lib/components/diffEditorTypes'
 	import { loadSchemaFromModule } from '../flowInfers'
@@ -44,7 +47,6 @@
 	import ModulePreviewResultViewer from '$lib/components/ModulePreviewResultViewer.svelte'
 	import LogViewer from '$lib/components/LogViewer.svelte'
 	import DisplayResult from '$lib/components/DisplayResult.svelte'
-	import { refreshFlowStateStore } from '$lib/components/flows/flowStoreRefresh.svelte'
 	import { getStepHistoryLoaderContext } from '$lib/components/stepHistoryLoader.svelte'
 	import AssetsDropdownButton from '$lib/components/assets/AssetsDropdownButton.svelte'
 	import { useUiIntent } from '$lib/components/copilot/chat/flow/useUiIntent'
@@ -82,10 +84,10 @@
 		customUi,
 		executionCount,
 		opWorkspace,
+		agentEditorHost,
 		workspaceScriptSettingsDrawer
 	} = getContext<FlowEditorContext>('FlowEditorContext')
 
-	const selectedId = $derived(selectionManager.getSelectedId())
 	// The agent editor's save guard uses the `tools` array identity to tell "same step" from "step
 	// replaced mid-save", so a module carrying no `tools` must read as one stable array — but a
 	// distinct one per module value, or a wholesale edit that keeps the module id would look
@@ -117,6 +119,17 @@
 		forceTestTab?: boolean
 		highlightArg?: string
 		isAgentTool?: boolean
+		/** Offer only values that stand on their own: no connect button, no expression option, no
+		 *  prop picker column. For a tool of a saved agent, whose inputs are stored on the resource
+		 *  and so cannot name any one flow's `flow_input` or `results`. A flow binds those on the
+		 *  step instead, through `tool_inputs`. */
+		staticOnly?: boolean
+		/** Lets the agent's Tools section add a tool through the graph's own insert path. */
+		flowModuleSchemaMap?: import('../map/FlowModuleSchemaMap.svelte').default
+		/** Drop the tool roster's drill-in. Selecting a tool means selecting its graph node, so a
+		 *  surface without a graph — the agent editor, which addresses one tool at a time — would
+		 *  offer a row whose click lands nowhere. */
+		noToolNavigation?: boolean
 		toolDescription?: string | undefined
 		siblingToolNames?: string[]
 	}
@@ -135,6 +148,9 @@
 		forceTestTab = false,
 		highlightArg = undefined,
 		isAgentTool = false,
+		staticOnly = false,
+		flowModuleSchemaMap = undefined,
+		noToolNavigation = false,
 		toolDescription = $bindable(undefined),
 		siblingToolNames = undefined
 	}: Props = $props()
@@ -270,7 +286,8 @@
 			modulePreview?.runTestWithStepArgs()
 		}
 	}
-	let inputTransformSchemaForm: InputTransformSchemaForm | undefined = $state(undefined)
+	let inputTransformSchemaForm: { setArgs: (nargs: Record<string, any>) => void } | undefined =
+		$state(undefined)
 
 	let reloadError: string | undefined = $state(undefined)
 	async function reload(flowModule: FlowModule) {
@@ -338,7 +355,7 @@
 	let stepHistoryLoader = getStepHistoryLoaderContext()
 
 	function onSelectedIdChange() {
-		if (!flowStateStore?.val?.[selectedId]?.schema && flowModule) {
+		if (!flowStateStore?.val?.[flowModule.id]?.schema && flowModule) {
 			reload(flowModule)
 		}
 	}
@@ -395,7 +412,7 @@
 	)
 
 	$effect.pre(() => {
-		selectedId && untrack(() => onSelectedIdChange())
+		flowModule.id && untrack(() => onSelectedIdChange())
 	})
 	let parentLoop = $derived(
 		flowStore.val && flowModule ? checkIfParentLoop(flowStore.val, flowModule.id) : undefined
@@ -487,7 +504,7 @@
 	}
 
 	let preparedSqlQueries = usePreparedAssetSqlQueries(
-		() => flowGraphAssetsCtx?.val.sqlQueries[selectedId],
+		() => flowGraphAssetsCtx?.val.sqlQueries[flowModule.id],
 		() => opWs
 	)
 
@@ -843,7 +860,7 @@
 					on:createScriptFromInlineScript={async () => {
 						const [module, state] = await createScriptFromInlineScript(
 							flowModule,
-							selectedId,
+							flowModule.id,
 							flowStateStore.val[flowModule.id]?.schema,
 							$pathStore,
 							opWs
@@ -937,13 +954,11 @@
 														automaticLayout={true}
 														cmdEnterAction={async () => {
 															selected = 'test'
-															if (selectedId == flowModule.id) {
-																if (flowModule.value.type === 'rawscript' && editor) {
-																	flowModule.value.content = editor.getCode()
-																}
-																await reload(flowModule)
-																modulePreview?.runTestWithStepArgs()
+															if (flowModule.value.type === 'rawscript' && editor) {
+																flowModule.value.content = editor.getCode()
 															}
+															await reload(flowModule)
+															modulePreview?.runTestWithStepArgs()
 														}}
 														on:change={async (event) => {
 															const content = event.detail
@@ -1000,13 +1015,11 @@
 												automaticLayout={true}
 												cmdEnterAction={async () => {
 													selected = 'test'
-													if (selectedId == flowModule.id) {
-														if (flowModule.value.type === 'rawscript' && editor) {
-															flowModule.value.content = editor.getCode()
-														}
-														await reload(flowModule)
-														modulePreview?.runTestWithStepArgs()
+													if (flowModule.value.type === 'rawscript' && editor) {
+														flowModule.value.content = editor.getCode()
 													}
+													await reload(flowModule)
+													modulePreview?.runTestWithStepArgs()
 												}}
 												on:change={async (event) => {
 													const content = event.detail
@@ -1093,10 +1106,12 @@
 										}}
 										wrapperClass="shrink-0"
 									>
+										<!-- A tool's inputs are arguments of the tool, not of a step in the flow;
+										     `tool_inputs` is what the rest of the codebase calls them. -->
 										{#if !preprocessorModule}
-											<Tab value="inputs" label="Step Input" />
+											<Tab value="inputs" label={isAgentTool ? 'Tool input' : 'Step Input'} />
 										{/if}
-										<Tab value="test" label="Test this step" />
+										<Tab value="test" label={isAgentTool ? 'Test this tool' : 'Test this step'} />
 										{#if canShowChatTab && flowModule.value.type === 'aiagent'}
 											<Tab
 												value="chat"
@@ -1114,10 +1129,13 @@
 									</Tabs>
 									{#if visibleSelected === 'inputs' && (flowModule.value.type == 'rawscript' || flowModule.value.type == 'script' || flowModule.value.type == 'flow' || flowModule.value.type == 'aiagent')}
 										<div class="flex-1 overflow-auto" id="flow-editor-step-input">
+											<!-- `sidePane` under `staticOnly`: that column only opens on a connect,
+											     and there is no connect button to open it. -->
 											<PropPickerWrapper
 												pickableProperties={stepPropPicker.pickableProperties}
 												error={failureModule}
 												noPadding
+												sidePane={staticOnly}
 											>
 												{#if reloadError}
 													<div
@@ -1132,6 +1150,7 @@
 														moduleId={linkedToolsModuleId}
 														opWorkspace={opWs}
 														flowPath={$pathStore}
+														fromAgentEditor={agentEditorHost?.() != undefined}
 														bind:agent={
 															() =>
 																flowModule.value.type === 'aiagent'
@@ -1177,39 +1196,84 @@
 														}
 													/>
 												{/if}
-												<InputTransformSchemaForm
-													class="px-2 xl:px-4 pb-8"
-													bind:this={inputTransformSchemaForm}
-													pickableProperties={stepPropPicker.pickableProperties}
-													schema={agentLinked
-														? flowLocalAgentSchema(flowStateStore.val[selectedId]?.schema ?? {})
-														: (flowStateStore.val[selectedId]?.schema ?? {})}
-													previousModuleId={previousModule?.id}
-													bind:args={
-														() => {
-															// @ts-ignore
-															return flowModule?.value?.input_transforms
-														},
-														(v) => {
-															if (
-																typeof flowModule?.value === 'object' &&
-																flowModule?.value !== null
-															) {
+												{#if flowModule.value.type === 'aiagent'}
+													<AiAgentStepInputs
+														class="px-2 xl:px-4 pb-8"
+														bind:this={inputTransformSchemaForm}
+														pickableProperties={stepPropPicker.pickableProperties}
+														schema={agentLinked
+															? flowLocalAgentSchema(
+																	flowStateStore.val[flowModule.id]?.schema ?? {}
+																)
+															: (flowStateStore.val[flowModule.id]?.schema ?? {})}
+														previousModuleId={previousModule?.id}
+														bind:args={
+															() => {
 																// @ts-ignore
-																flowModule.value.input_transforms = v
+																return flowModule?.value?.input_transforms
+															},
+															(v) => {
+																if (
+																	typeof flowModule?.value === 'object' &&
+																	flowModule?.value !== null
+																) {
+																	// @ts-ignore
+																	flowModule.value.input_transforms = v
+																}
 															}
 														}
-													}
-													extraLib={stepPropPicker.extraLib}
-													{enableAi}
-													{isAgentTool}
-													allowedAiTransforms={isAgentTool && flowModule.value.type === 'aiagent'
-														? ['user_message']
-														: undefined}
-													helperScript={retrieveDynCodeAndLang(flowModule.value)}
-													chatInputEnabled={flowStore.val.value?.chat_input_enabled ?? false}
-													workspace={opWs}
-												/>
+														extraLib={stepPropPicker.extraLib}
+														{enableAi}
+														{isAgentTool}
+														noConnect={staticOnly}
+														noJavascript={staticOnly}
+														allowedAiTransforms={isAgentTool ? AI_AGENT_TOOL_AI_KEYS : undefined}
+														helperScript={retrieveDynCodeAndLang(flowModule.value)}
+														chatInputEnabled={flowStore.val.value?.chat_input_enabled ?? false}
+														workspace={opWs}
+														visibilityKey={`${$pathStore}:${linkedToolsModuleId}`}
+														tools={flowModule.value.tools ?? []}
+														onSelectTool={noToolNavigation
+															? undefined
+															: (toolId) => selectionManager.selectId(toolId, { openPanel: true })}
+														onAddTool={flowModuleSchemaMap
+															? (detail) =>
+																	flowModuleSchemaMap?.addToolToAgent(flowModule.id, detail)
+															: undefined}
+													/>
+												{:else}
+													<InputTransformSchemaForm
+														class="px-2 xl:px-4 pb-8"
+														bind:this={inputTransformSchemaForm}
+														pickableProperties={stepPropPicker.pickableProperties}
+														schema={flowStateStore.val[flowModule.id]?.schema ?? {}}
+														previousModuleId={previousModule?.id}
+														bind:args={
+															() => {
+																// @ts-ignore
+																return flowModule?.value?.input_transforms
+															},
+															(v) => {
+																if (
+																	typeof flowModule?.value === 'object' &&
+																	flowModule?.value !== null
+																) {
+																	// @ts-ignore
+																	flowModule.value.input_transforms = v
+																}
+															}
+														}
+														extraLib={stepPropPicker.extraLib}
+														{enableAi}
+														{isAgentTool}
+														noConnect={staticOnly}
+														noJavascript={staticOnly}
+														allowedAiTransforms={undefined}
+														helperScript={retrieveDynCodeAndLang(flowModule.value)}
+														chatInputEnabled={flowStore.val.value?.chat_input_enabled ?? false}
+														workspace={opWs}
+													/>
+												{/if}
 												{#if agentLinked}
 													<!-- Linked agent: the resource's tools with their inputs rebindable to this
 													flow; overrides persist on the step as tool_inputs (diff from the resource). -->
@@ -1264,8 +1328,8 @@
 											mod={flowModule}
 											{noEditor}
 											schema={agentLinked
-												? flowLocalAgentSchema(flowStateStore.val[selectedId]?.schema ?? {})
-												: (flowStateStore.val[selectedId]?.schema ?? {})}
+												? flowLocalAgentSchema(flowStateStore.val[flowModule.id]?.schema ?? {})
+												: (flowStateStore.val[flowModule.id]?.schema ?? {})}
 											bind:testJob
 											bind:testIsLoading
 											bind:scriptProgress
@@ -1298,7 +1362,7 @@
 											{isAgentTool}
 											{parentModule}
 											{previousModule}
-											{selectedId}
+											selectedId={flowModule.id}
 											{referencedConcurrentLimit}
 											referencedConcurrencyTimeWindowS={referencedScriptSettings.settings
 												?.concurrency_time_window_s}
@@ -1391,7 +1455,7 @@
 											onUpdateMock={(detail) => {
 												flowModule.mock = detail
 												flowModule = flowModule
-												refreshFlowStateStore(flowStore)
+												refreshStateStore(flowStore)
 											}}
 											{testJob}
 											{scriptProgress}
diff --git a/frontend/src/lib/components/flows/content/FlowModuleWrapper.svelte b/frontend/src/lib/components/flows/content/FlowModuleWrapper.svelte
index c5ae6901ac..febbe5681c 100644
--- a/frontend/src/lib/components/flows/content/FlowModuleWrapper.svelte
+++ b/frontend/src/lib/components/flows/content/FlowModuleWrapper.svelte
@@ -49,6 +49,8 @@
 		forceTestTab?: Record<string, boolean>
 		highlightArg?: Record<string, string | undefined>
 		isAgentTool?: boolean
+		/** Lets an agent step add a tool through the same path as the graph's `+ Tool`. */
+		flowModuleSchemaMap?: import('../map/FlowModuleSchemaMap.svelte').default
 	}
 
 	let {
@@ -60,7 +62,8 @@
 		previousModule = undefined,
 		forceTestTab,
 		highlightArg,
-		isAgentTool = false
+		isAgentTool = false,
+		flowModuleSchemaMap = undefined
 	}: Props = $props()
 
 	function initializePrimaryScheduleForTriggerScript(module: FlowModule) {
@@ -222,6 +225,7 @@
 			forceTestTab={forceTestTab?.[flowModule.id]}
 			highlightArg={highlightArg?.[flowModule.id]}
 			{isAgentTool}
+			{flowModuleSchemaMap}
 		/>
 	{/if}
 {:else if flowModule.value.type === 'forloopflow' || flowModule.value.type == 'whileloopflow'}
@@ -232,6 +236,7 @@
 			child
 		)}
 		<FlowModuleWrapper
+			{flowModuleSchemaMap}
 			{noEditor}
 			bind:flowModule={slot.get, slot.set}
 			bind:parentModule={flowModule}
@@ -261,6 +266,7 @@
 				child
 			)}
 			<FlowModuleWrapper
+				{flowModuleSchemaMap}
 				{noEditor}
 				bind:flowModule={slot.get, slot.set}
 				bind:parentModule={flowModule}
@@ -285,6 +291,7 @@
 			{#each branch.modules as child, index (child.id ?? index)}
 				{@const slot = moduleSlot(() => branch.modules, child.id, child)}
 				<FlowModuleWrapper
+					{flowModuleSchemaMap}
 					{noEditor}
 					bind:flowModule={slot.get, slot.set}
 					bind:parentModule={flowModule}
@@ -305,6 +312,7 @@
 			{#each branch.modules as child, index (child.id ?? index)}
 				{@const slot = moduleSlot(() => branch.modules, child.id, child)}
 				<FlowModuleWrapper
+					{flowModuleSchemaMap}
 					{noEditor}
 					bind:flowModule={slot.get, slot.set}
 					bind:parentModule={flowModule}
diff --git a/frontend/src/lib/components/flows/flowDeleteController.ts b/frontend/src/lib/components/flows/flowDeleteController.ts
index a1933ba080..d7d98fadda 100644
--- a/frontend/src/lib/components/flows/flowDeleteController.ts
+++ b/frontend/src/lib/components/flows/flowDeleteController.ts
@@ -1,4 +1,5 @@
 import type { GroupDisplayState } from '$lib/components/graph/groupEditor.svelte'
+import { refreshStateStore } from '$lib/svelte5Utils.svelte'
 import type { GroupedModulesProxy } from '$lib/components/graph/groupedModulesProxy.svelte'
 import type { SelectionManager } from '$lib/components/graph/selectionUtils.svelte'
 import type { FlowStructureNode } from '$lib/components/graph/flowStructure'
@@ -8,7 +9,6 @@ import type { StateStore } from '$lib/utils'
 import { createDeletePlan, removeDeletePlanTools, type DeletePlan } from './flowDeleteUtils'
 import type { FlowState } from './flowState'
 import { deleteFlowStateById } from './flowStateUtils.svelte'
-import { refreshFlowStateStore } from './flowStoreRefresh.svelte'
 
 export type PreparedDeleteRequest = {
 	plan: DeletePlan
@@ -74,7 +74,7 @@ export function executeDeletePlan(
 		deleteFlowStateById(id, args.flowStateStore)
 	}
 
-	refreshFlowStateStore(args.flowStore)
+	refreshStateStore(args.flowStore)
 
 	if (plan.inputIds.length === 1) {
 		args.onDelete?.(plan.targets[0].id)
diff --git a/frontend/src/lib/components/flows/flowInfers.ts b/frontend/src/lib/components/flows/flowInfers.ts
index 4d6cad4df5..958f6903bd 100644
--- a/frontend/src/lib/components/flows/flowInfers.ts
+++ b/frontend/src/lib/components/flows/flowInfers.ts
@@ -15,29 +15,31 @@ export const AI_AGENT_SCHEMA: Schema = {
 		output_type: {
 			type: 'string',
 			description:
-				'The type of output the AI agent will generate (text or image). Image output requires a configured workspace S3 storage, will ignore tools, and only works with OpenAI, Google AI and OpenRouter gemini-image-preview model.',
+				'Whether the answer is text or an image. An image needs S3 storage on the workspace, and ignores tools.',
 			enum: ['text', 'image'],
 			default: 'text'
 		},
 		user_message: {
 			type: 'string',
-			description:
-				'The message to give as input to the AI agent. Optional when messages array is provided. You can turn on chat input mode on the input interface to link this field to the message sent by the user.'
+			description: 'The message sent to the agent as the user turn.'
 		},
 		system_prompt: {
 			type: 'string',
-			description: 'The system prompt to give as input to the AI agent.'
+			description: 'Sets how the agent behaves. Sent ahead of everything else.',
+			// The one field people write paragraphs into, so it opens as a text area.
+			minRows: 5,
+			placeholder:
+				"You are a support agent.\nLook up an answer with your tools before replying.\nCite what you used, and say you don't know rather than guessing."
 		},
 		streaming: {
 			type: 'boolean',
-			description: 'Whether to stream the output of the AI agent.',
+			description: 'Stream the answer as it is produced.',
 			default: true,
-			showExpr: "fields.output_type === 'text'"
+			showExpr: "fields.output_type !== 'image'"
 		},
 		memory: {
 			type: 'object',
-			description:
-				'Configure how conversation memory is managed. Choose "auto" to let Windmill automatically store and load messages (up to N last messages), or "manual" to provide an explicit array of conversation messages. The system_prompt and user_message are added to the messages if provided.',
+			description: 'History sent between the system message and the user message.',
 			oneOf: [
 				{
 					type: 'object',
@@ -133,18 +135,17 @@ export const AI_AGENT_SCHEMA: Schema = {
 					required: ['kind', 'messages']
 				}
 			],
-			showExpr: "fields.output_type === 'text'"
+			showExpr: "fields.output_type !== 'image'"
 		},
 		output_schema: {
 			type: 'object',
-			description: 'JSON schema that the AI agent will follow for its response format.',
+			description: 'A JSON schema the answer has to follow.',
 			format: 'json-schema',
-			showExpr: "fields.output_type === 'text'"
+			showExpr: "fields.output_type !== 'image'"
 		},
 		user_attachments: {
 			type: 'array',
-			description:
-				'Array of files (images or PDFs) to give as input to the AI agent. Requires a configured workspace S3 storage.',
+			description: 'Images or PDFs sent with the message. Needs S3 storage on the workspace.',
 			items: {
 				type: 'object',
 				resourceType: 's3object'
@@ -152,22 +153,21 @@ export const AI_AGENT_SCHEMA: Schema = {
 		},
 		max_completion_tokens: {
 			type: 'number',
-			description: 'The maximum number of output tokens.'
+			description: 'The most tokens the answer may use.'
 		},
 		temperature: {
 			type: 'number',
-			description:
-				'Controls randomness in text generation. Range: 0.0 (deterministic) to 2.0 (random).',
-			showExpr: "fields.output_type === 'text'"
+			description: 'How random the generation is, from 0 for deterministic up to 2.'
 		},
 		max_iterations: {
 			type: 'number',
-			description:
-				'Limits how many times the agent can loop through reasoning and tool use. Range: 1-1000.',
+			description: 'How many times the agent may loop over calling the model and running tools.',
 			default: 10
 		}
 	},
-	required: ['provider', 'output_type'],
+	// `output_type` defaults to text on the backend, so leaving it unset is valid: the form drops
+	// the row rather than showing a field whose value a run would ignore.
+	required: ['provider'],
 	type: 'object',
 	order: [
 		'provider',
diff --git a/frontend/src/lib/components/flows/flowState.ts b/frontend/src/lib/components/flows/flowState.ts
index d70ee38f55..3123396a9d 100644
--- a/frontend/src/lib/components/flows/flowState.ts
+++ b/frontend/src/lib/components/flows/flowState.ts
@@ -92,8 +92,11 @@ async function mapFlowModule(
 			// resource tool ids are not flow-unique and must not key into the flow state.
 			await publishLinkedAgentTools(agentRef, workspace, scope, flowModule.id)
 		} else {
+			// Shape-checked because `tools` is JSON-authored: throwing here would skip the agent's
+			// own state below, leaving it with no schema rather than with no tool schemas.
+			const tools = Array.isArray(value.tools) ? value.tools : []
 			await Promise.all(
-				(value.tools ?? []).filter(isFlowModuleTool).map(async (tool) => {
+				tools.filter(isFlowModuleTool).map(async (tool) => {
 					modulesState[tool.id] = await loadFlowModuleState(agentToolToFlowModule(tool), workspace)
 				})
 			)
@@ -122,7 +125,7 @@ export async function publishLinkedAgentTools(
 	const gen = claimLinkedToolsFetch(scope, moduleId)
 	const tools = await resolveLinkedAgentTools(agentRef, workspace)
 	if (linkedToolFetchGen.get(genKey) === gen) {
-		setLinkedAgentTools(scope, moduleId, tools)
+		setLinkedAgentTools(scope, moduleId, tools, agentRef)
 	}
 }
 
diff --git a/frontend/src/lib/components/flows/flowStateUtils.svelte.ts b/frontend/src/lib/components/flows/flowStateUtils.svelte.ts
index 242455f557..09ea3d7bd8 100644
--- a/frontend/src/lib/components/flows/flowStateUtils.svelte.ts
+++ b/frontend/src/lib/components/flows/flowStateUtils.svelte.ts
@@ -22,6 +22,19 @@ import { findNextAvailablePath } from '$lib/path'
 import type { ExtendedOpenFlow } from './types'
 import { emptySchema, type StateStore } from '$lib/utils'
 import { loadStoredConfig } from '../aiProviderStorage'
+import { copilotInfo } from '$lib/aiStore'
+import { stepSettingDefaults } from './flowStepSettings'
+import type { InlineScript, InsertKind } from '$lib/components/graph/graphBuilder.svelte'
+import {
+	agentToolToFlowModule,
+	createAiAgentTool,
+	createMcpTool,
+	createWebsearchTool,
+	newFlowModuleAgentTool,
+	SPECIAL_TOOL_KINDS,
+	type AgentTool,
+	type SpecialToolKind
+} from './agentToolUtils'
 
 export async function loadFlowModuleState(
 	flowModule: FlowModule,
@@ -190,7 +203,7 @@ export async function createAiAgent(
 	const providerValue = storedConfig ?? { kind: 'openai', resource: '', model: '' }
 
 	// A step linked to a saved agent reads its brain and tools from the resource, so it carries only
-	// the flow-local inputs: seeding `provider`/`output_type` would leave transforms it never reads.
+	// the flow-local inputs: seeding `provider` would leave a transform it never reads.
 	const aiAgentFlowModules: FlowModule = {
 		id,
 		value: {
@@ -201,8 +214,7 @@ export async function createAiAgent(
 				...(agentPath
 					? {}
 					: {
-							provider: { type: 'static', value: providerValue },
-							output_type: { type: 'static', value: 'text' }
+							provider: { type: 'static', value: providerValue }
 						}),
 				user_message: { type: 'static', value: undefined }
 			}
@@ -442,3 +454,157 @@ export async function insertNewFailureModule(
 
 	flowStateStore.val[module.id] = state
 }
+
+/** Create a new FlowModule without inserting it into any array. */
+export async function createNewModule(
+	flowStore: StateStore<OpenFlow>,
+	flowStateStore: StateStore<FlowState>,
+	kind: InsertKind,
+	wsScript?: { path: string; summary: string; hash: string | undefined },
+	wsFlow?: { path: string; summary: string },
+	inlineScript?: InlineScript,
+	agentPath?: string,
+	// The acting workspace when the flow editor runs in an AI session; else the nav workspace.
+	workspace?: string,
+	disableAi?: boolean
+): Promise<FlowModule> {
+	let module = emptyModule(flowStateStore.val, flowStore.val, kind == 'flow')
+	let state = emptyFlowModuleState()
+	flowStateStore.val[module.id] = state
+	if (wsFlow) {
+		;[module, state] = await pickFlow(wsFlow.path, wsFlow.summary, module.id, workspace)
+	} else if (wsScript) {
+		;[module, state] = await pickScript(
+			wsScript.path,
+			wsScript.summary,
+			module.id,
+			wsScript.hash,
+			kind,
+			workspace
+		)
+	} else if (kind == 'forloop') {
+		;[module, state] = await createLoop(module.id, !disableAi && get(copilotInfo).enabled)
+	} else if (kind == 'whileloop') {
+		;[module, state] = await createWhileLoop(module.id)
+	} else if (kind == 'branchone') {
+		;[module, state] = await createBranches(module.id)
+	} else if (kind == 'branchall') {
+		;[module, state] = await createBranchAll(module.id)
+	} else if (kind == 'aiagent') {
+		;[module, state] = await createAiAgent(module.id, agentPath)
+	} else if (inlineScript) {
+		const { language, kind, subkind, summary } = inlineScript
+		;[module, state] = await createInlineScriptModule(language, kind, subkind, module.id, summary)
+		flowStateStore.val[module.id] = state
+		if (kind == 'trigger') {
+			module.summary = 'Trigger'
+		} else if (kind == 'approval') {
+			module.summary = 'Approval'
+		}
+	}
+	flowStateStore.val[module.id] = state
+
+	if (kind == 'approval') {
+		module.suspend = stepSettingDefaults('suspend')
+	} else if (kind == 'trigger') {
+		module.stop_after_if = stepSettingDefaults('early-stop', 'trigger')
+	} else if (kind == 'end') {
+		module.summary = 'Terminate flow'
+		module.stop_after_if = stepSettingDefaults('early-stop', 'end')
+	}
+
+	return module
+}
+
+/** Create a module and splice it into `modules`, as a step or as one of an agent's tools. */
+export async function insertNewModuleAtIndex(
+	flowStore: StateStore<OpenFlow>,
+	flowStateStore: StateStore<FlowState>,
+	modules: FlowModule[] | AgentTool[],
+	index: number,
+	kind: InsertKind,
+	wsScript?: { path: string; summary: string; hash: string | undefined },
+	wsFlow?: { path: string; summary: string },
+	inlineScript?: InlineScript,
+	toolKind?: SpecialToolKind | 'flowmoduleTool',
+	// The acting workspace when the flow editor runs in an AI session; else the nav workspace.
+	workspace?: string,
+	disableAi?: boolean
+): Promise<FlowModule[] | AgentTool[]> {
+	const module = await createNewModule(
+		flowStore,
+		flowStateStore,
+		kind,
+		wsScript,
+		wsFlow,
+		inlineScript,
+		undefined,
+		workspace,
+		disableAi
+	)
+
+	if (!modules) return [module]
+
+	if (toolKind === 'mcpTool') {
+		// Create MCP AgentTool
+		const mcpTool = createMcpTool(module.id)
+		;(modules as AgentTool[]).splice(index, 0, mcpTool)
+		return modules as AgentTool[]
+	} else if (toolKind === 'websearchTool') {
+		// Create Websearch AgentTool
+		const websearchTool = createWebsearchTool(module.id)
+		;(modules as AgentTool[]).splice(index, 0, websearchTool)
+		return modules as AgentTool[]
+	} else if (toolKind === 'aiAgentTool') {
+		// Create AI Agent tool (nested agent)
+		const aiAgentTool = createAiAgentTool(module.id)
+		flowStateStore.val[module.id] = await loadFlowModuleState(
+			agentToolToFlowModule(aiAgentTool),
+			workspace
+		)
+		;(modules as AgentTool[]).splice(index, 0, aiAgentTool)
+		return modules as AgentTool[]
+	} else if (toolKind === 'flowmoduleTool') {
+		const agentTool = newFlowModuleAgentTool(module)
+		;(modules as AgentTool[]).splice(index, 0, agentTool)
+		return modules as AgentTool[]
+	} else {
+		// Standard FlowModule insertion
+		modules.splice(index, 0, module)
+		return modules
+	}
+}
+
+/**
+ * Add one tool to an agent's `tools`, from the picker's detail, and return its id. Shared by the
+ * flow graph and the agent editor, which hold the same tools in different stores.
+ */
+export async function insertAgentTool(
+	flowStore: StateStore<OpenFlow>,
+	flowStateStore: StateStore<FlowState>,
+	agentValue: { tools?: AgentTool[] },
+	detail: { kind: string; script?: any; flow?: any; inlineScript?: any },
+	workspace?: string,
+	disableAi?: boolean
+): Promise<string | undefined> {
+	// `tools` is optional, so a module authored without it starts undefined here and would
+	// silently swallow its first tool.
+	agentValue.tools ??= []
+	const tools = agentValue.tools
+	await insertNewModuleAtIndex(
+		flowStore,
+		flowStateStore,
+		tools,
+		tools.length,
+		detail.kind as InsertKind,
+		detail.script,
+		detail.flow ? { path: detail.flow.path, summary: detail.flow.summary } : undefined,
+		detail.inlineScript,
+		(SPECIAL_TOOL_KINDS as readonly string[]).includes(detail.kind)
+			? (detail.kind as SpecialToolKind)
+			: 'flowmoduleTool',
+		workspace,
+		disableAi
+	)
+	return tools[tools.length - 1]?.id
+}
diff --git a/frontend/src/lib/components/flows/flowStoreRefresh.svelte.ts b/frontend/src/lib/components/flows/flowStoreRefresh.svelte.ts
deleted file mode 100644
index 2aa19f251a..0000000000
--- a/frontend/src/lib/components/flows/flowStoreRefresh.svelte.ts
+++ /dev/null
@@ -1,15 +0,0 @@
-import type { OpenFlow } from '$lib/gen'
-import { refreshStateStore } from '$lib/svelte5Utils.svelte'
-import type { StateStore } from '$lib/utils'
-import { reanchorAgentEditsAcross } from './agentEditStore.svelte'
-
-// Use at content-preserving refresh sites (structural edits, schema/failure/mock changes): a bare
-// refreshStateStore clone would break the agent edit marker's array identity. Content-changing
-// replacements (undo, YAML/diff/AI apply, session restores) must stay bare so stale edit state
-// keeps invalidating.
-export function refreshFlowStateStore(flowStore: StateStore<OpenFlow>) {
-	reanchorAgentEditsAcross(
-		() => flowStore.val.value?.modules,
-		() => refreshStateStore(flowStore)
-	)
-}
diff --git a/frontend/src/lib/components/flows/idUtils.ts b/frontend/src/lib/components/flows/idUtils.ts
index db3e496c54..7aaecdd212 100644
--- a/frontend/src/lib/components/flows/idUtils.ts
+++ b/frontend/src/lib/components/flows/idUtils.ts
@@ -14,6 +14,9 @@ export const forbiddenIds: string[] = [
 	'in',
 	'failure',
 	'preprocessor',
+	// The agent editor's synthetic root module. It shares one flow-state map with the agent's
+	// tools, so a tool of this id would take the root's slot and show the agent's own schema.
+	'__wm_agent_root',
 	'as',
 	'Input',
 	'Result',
diff --git a/frontend/src/lib/components/flows/linkedAgentToolsStore.svelte.ts b/frontend/src/lib/components/flows/linkedAgentToolsStore.svelte.ts
index 503f30a38d..de879cc9c6 100644
--- a/frontend/src/lib/components/flows/linkedAgentToolsStore.svelte.ts
+++ b/frontend/src/lib/components/flows/linkedAgentToolsStore.svelte.ts
@@ -6,6 +6,28 @@ import type { AgentTool } from './agentToolUtils'
 // keeps flows shown at the same time (an editor and an embedded preview) from aliasing each other.
 let byScope = $state<Record<string, Record<string, AgentTool[]>>>({})
 
+// Which agent each entry resolved from, so a write to one agent can be reflected on every step that
+// links it rather than only the one that triggered the write. Plain, not reactive: it is read
+// imperatively when reconciling a deploy, never rendered.
+const agentRefByEntry = new Map<string, string>()
+
+/** A step may name its agent bare or as `$res:<path>`; both are the same agent, and the index has
+ *  to answer for a lookup written either way. */
+function normalizeAgentRef(agentRef: string): string {
+	return agentRef.replace(/^\$res:/, '').replace(/^res:\/\//, '')
+}
+
+function entryKey(scope: string, moduleId: string): string {
+	return `${scope}\u0000${moduleId}`
+}
+
+function forgetScopeRefs(scope: string) {
+	const prefix = `${scope}\u0000`
+	for (const key of agentRefByEntry.keys()) {
+		if (key.startsWith(prefix)) agentRefByEntry.delete(key)
+	}
+}
+
 // A long-lived tab would otherwise keep every flow it ever visited (raw tool script contents
 // included). Past this cap the least recently used scope is evicted, skipping any a mounted view
 // still holds.
@@ -61,6 +83,7 @@ function evictOverCap(protect?: string) {
 		}
 		scopeOrder = scopeOrder.filter((s) => s !== victim)
 		delete byScope[victim]
+		forgetScopeRefs(victim)
 	}
 }
 
@@ -85,7 +108,16 @@ export function linkedToolsScope(
 // track this to re-run when a link resolves after the initial render, e.g. right after linking.
 let version = $state(0)
 
-export function setLinkedAgentTools(scope: string, moduleId: string, tools: AgentTool[]) {
+export function setLinkedAgentTools(
+	scope: string,
+	moduleId: string,
+	tools: AgentTool[],
+	/** The agent these tools came from. Taken here rather than recorded separately so the index and
+	 *  the tools cannot drift: every writer has the ref in hand, and one that forgot to file it left
+	 *  a step invisible to `linkedModulesForAgent`. */
+	agentRef: string
+) {
+	agentRefByEntry.set(entryKey(scope, moduleId), normalizeAgentRef(agentRef))
 	// Publishers re-run and hand us a fresh-but-equal array each time; only mutate on a real change,
 	// else the version bump would retrigger the graph recompute in a loop.
 	if (deepEqual(byScope[scope]?.[moduleId], tools)) return
@@ -94,12 +126,29 @@ export function setLinkedAgentTools(scope: string, moduleId: string, tools: Agen
 	version++
 }
 
+/** Every module in this scope resolved from `agentRef`. A saved agent can be linked by more than
+ *  one step, and all of them show tools that a write to it has just changed. */
+export function linkedModulesForAgent(scope: string, agentRef: string): string[] {
+	const prefix = `${scope}\u0000`
+	const wanted = normalizeAgentRef(agentRef)
+	const out: string[] = []
+	for (const [key, ref] of agentRefByEntry) {
+		if (key.startsWith(prefix) && ref === wanted) out.push(key.slice(prefix.length))
+	}
+	return out
+}
+
 /** Move one scope's resolutions into another: used when a rename moves readers to a new scope,
  * and to sweep republished data (keyed by the flow doc's path) into the live-edited scope. The
  * source bucket carries the newer resolution in both cases, so it wins the merge. */
 export function migrateLinkedAgentToolsScope(oldScope: string, newScope: string) {
 	if (oldScope === newScope || byScope[oldScope] === undefined) return
 	byScope[newScope] = { ...(byScope[newScope] ?? {}), ...(byScope[oldScope] ?? {}) }
+	for (const moduleId of Object.keys(byScope[oldScope] ?? {})) {
+		const ref = agentRefByEntry.get(entryKey(oldScope, moduleId))
+		if (ref !== undefined) agentRefByEntry.set(entryKey(newScope, moduleId), ref)
+	}
+	forgetScopeRefs(oldScope)
 	delete byScope[oldScope]
 	pendingMigration = newScope
 	// Mark the new key most-recently-used but don't evict here: the next publish or release enforces
@@ -109,6 +158,7 @@ export function migrateLinkedAgentToolsScope(oldScope: string, newScope: string)
 }
 
 export function clearLinkedAgentTools(scope: string, moduleId: string) {
+	agentRefByEntry.delete(entryKey(scope, moduleId))
 	if (byScope[scope]?.[moduleId] === undefined) return
 	const rest = { ...byScope[scope] }
 	delete rest[moduleId]
diff --git a/frontend/src/lib/components/flows/linkedAgentToolsStore.test.ts b/frontend/src/lib/components/flows/linkedAgentToolsStore.test.ts
index c8b96e8a7b..c310c80c24 100644
--- a/frontend/src/lib/components/flows/linkedAgentToolsStore.test.ts
+++ b/frontend/src/lib/components/flows/linkedAgentToolsStore.test.ts
@@ -2,6 +2,7 @@ import { describe, expect, it } from 'vitest'
 import {
 	clearLinkedAgentTools,
 	getLinkedAgentTools,
+	linkedModulesForAgent,
 	linkedToolsScope,
 	migrateLinkedAgentToolsScope,
 	releaseLinkedToolsScope,
@@ -26,7 +27,7 @@ function freshScope(name = 'flow') {
 function fillPastCap(exclude: string) {
 	for (let i = 0; i <= MAX_SCOPES; i++) {
 		const filler = linkedToolsScope('filler', `${exclude}-${seq}-${i}`)
-		setLinkedAgentTools(filler, 'm', [tool(`f${i}`)])
+		setLinkedAgentTools(filler, 'm', [tool(`f${i}`)], 'u/admin/a')
 	}
 }
 
@@ -34,15 +35,15 @@ describe('linkedAgentToolsStore', () => {
 	it('keeps each scope module map separate', () => {
 		const a = freshScope()
 		const b = freshScope()
-		setLinkedAgentTools(a, 'step', [tool('x')])
-		setLinkedAgentTools(b, 'step', [tool('y')])
+		setLinkedAgentTools(a, 'step', [tool('x')], 'u/admin/a')
+		setLinkedAgentTools(b, 'step', [tool('y')], 'u/admin/a')
 		expect(getLinkedAgentTools(a, 'step').map((t) => t.id)).toEqual(['x'])
 		expect(getLinkedAgentTools(b, 'step').map((t) => t.id)).toEqual(['y'])
 	})
 
 	it('evicts an unretained scope once past the cap', () => {
 		const victim = freshScope()
-		setLinkedAgentTools(victim, 'step', [tool('x')])
+		setLinkedAgentTools(victim, 'step', [tool('x')], 'u/admin/a')
 		fillPastCap(victim)
 		expect(getLinkedAgentTools(victim, 'step')).toEqual([])
 	})
@@ -50,7 +51,7 @@ describe('linkedAgentToolsStore', () => {
 	// A run viewer holds one scope per mounted nested job; those must not evict what is on screen.
 	it('never evicts a retained scope', () => {
 		const held = freshScope()
-		setLinkedAgentTools(held, 'step', [tool('x')])
+		setLinkedAgentTools(held, 'step', [tool('x')], 'u/admin/a')
 		retainLinkedToolsScope(held)
 		fillPastCap(held)
 		expect(getLinkedAgentTools(held, 'step').map((t) => t.id)).toEqual(['x'])
@@ -63,7 +64,7 @@ describe('linkedAgentToolsStore', () => {
 		const held: string[] = []
 		for (let i = 0; i <= MAX_SCOPES; i++) {
 			const scope = linkedToolsScope('retained', `${seq}-${i}`)
-			setLinkedAgentTools(scope, 'step', [tool(`t${i}`)])
+			setLinkedAgentTools(scope, 'step', [tool(`t${i}`)], 'u/admin/a')
 			retainLinkedToolsScope(scope)
 			held.push(scope)
 		}
@@ -84,7 +85,7 @@ describe('linkedAgentToolsStore', () => {
 	it('carries tools across a rename without evicting the new scope', () => {
 		const from = freshScope('old')
 		const to = freshScope('new')
-		setLinkedAgentTools(from, 'step', [tool('x')])
+		setLinkedAgentTools(from, 'step', [tool('x')], 'u/admin/a')
 		retainLinkedToolsScope(from)
 		migrateLinkedAgentToolsScope(from, to)
 		expect(getLinkedAgentTools(to, 'step').map((t) => t.id)).toEqual(['x'])
@@ -98,13 +99,13 @@ describe('linkedAgentToolsStore', () => {
 		const held: string[] = []
 		for (let i = 0; i < MAX_SCOPES; i++) {
 			const scope = linkedToolsScope('rename-fill', `${seq}-${i}`)
-			setLinkedAgentTools(scope, 'step', [tool(`t${i}`)])
+			setLinkedAgentTools(scope, 'step', [tool(`t${i}`)], 'u/admin/a')
 			retainLinkedToolsScope(scope)
 			held.push(scope)
 		}
 		const from = freshScope('before')
 		const to = freshScope('after')
-		setLinkedAgentTools(from, 'step', [tool('x')])
+		setLinkedAgentTools(from, 'step', [tool('x')], 'u/admin/a')
 		retainLinkedToolsScope(from)
 
 		migrateLinkedAgentToolsScope(from, to)
@@ -121,10 +122,39 @@ describe('linkedAgentToolsStore', () => {
 
 	it('clears one module without disturbing its siblings', () => {
 		const scope = freshScope()
-		setLinkedAgentTools(scope, 'a', [tool('x')])
-		setLinkedAgentTools(scope, 'b', [tool('y')])
+		setLinkedAgentTools(scope, 'a', [tool('x')], 'u/admin/a')
+		setLinkedAgentTools(scope, 'b', [tool('y')], 'u/admin/a')
 		clearLinkedAgentTools(scope, 'a')
 		expect(getLinkedAgentTools(scope, 'a')).toEqual([])
 		expect(getLinkedAgentTools(scope, 'b').map((t) => t.id)).toEqual(['y'])
 	})
+
+	// A deploy has to refresh every step showing the agent it wrote, so this index is what makes the
+	// difference between one step's nodes updating and all of them.
+	describe('linkedModulesForAgent', () => {
+		it('finds every module linked to one agent, and no others', () => {
+			const scope = freshScope()
+			setLinkedAgentTools(scope, 'a', [tool('x')], 'u/admin/one')
+			setLinkedAgentTools(scope, 'b', [tool('y')], 'u/admin/one')
+			setLinkedAgentTools(scope, 'c', [tool('z')], 'u/admin/other')
+			expect(linkedModulesForAgent(scope, 'u/admin/one').sort()).toEqual(['a', 'b'])
+			expect(linkedModulesForAgent(scope, 'u/admin/other')).toEqual(['c'])
+		})
+
+		it('reads a $res-prefixed link and a bare path as the same agent', () => {
+			const scope = freshScope()
+			setLinkedAgentTools(scope, 'a', [tool('x')], '$res:u/admin/one')
+			expect(linkedModulesForAgent(scope, 'u/admin/one')).toEqual(['a'])
+		})
+
+		it('drops a module that was cleared, and stays scoped', () => {
+			const scope = freshScope()
+			const other = freshScope()
+			setLinkedAgentTools(scope, 'a', [tool('x')], 'u/admin/one')
+			setLinkedAgentTools(other, 'a', [tool('x')], 'u/admin/one')
+			clearLinkedAgentTools(scope, 'a')
+			expect(linkedModulesForAgent(scope, 'u/admin/one')).toEqual([])
+			expect(linkedModulesForAgent(other, 'u/admin/one')).toEqual(['a'])
+		})
+	})
 })
diff --git a/frontend/src/lib/components/flows/linkedToolsFetchGuard.test.ts b/frontend/src/lib/components/flows/linkedToolsFetchGuard.test.ts
index e85055df5b..ea1674e0b6 100644
--- a/frontend/src/lib/components/flows/linkedToolsFetchGuard.test.ts
+++ b/frontend/src/lib/components/flows/linkedToolsFetchGuard.test.ts
@@ -57,7 +57,7 @@ describe('linked tools fetch guard', () => {
 		)
 
 		const inFlight = publishLinkedAgentTools('f/a/old', 'ws', scope, 'step')
-		setLinkedAgentTools(scope, 'step', [tool('kept')])
+		setLinkedAgentTools(scope, 'step', [tool('kept')], 'u/admin/a')
 
 		invalidateLinkedToolsFetches(scope)
 		release?.({ value: { tools: [tool('stale')] } })
@@ -75,7 +75,7 @@ describe('linked tools fetch guard', () => {
 
 		const inFlight = publishLinkedAgentTools('f/a/old', 'ws', scope, 'step')
 		claimLinkedToolsFetch(scope, 'step')
-		setLinkedAgentTools(scope, 'step', [tool('direct')])
+		setLinkedAgentTools(scope, 'step', [tool('direct')], 'u/admin/a')
 		release?.({ value: { tools: [tool('stale')] } })
 		await inFlight
 
diff --git a/frontend/src/lib/components/flows/map/FlowErrorHandlerItem.svelte b/frontend/src/lib/components/flows/map/FlowErrorHandlerItem.svelte
index 9e6a18d82c..08399dfdda 100644
--- a/frontend/src/lib/components/flows/map/FlowErrorHandlerItem.svelte
+++ b/frontend/src/lib/components/flows/map/FlowErrorHandlerItem.svelte
@@ -1,5 +1,6 @@
 <script lang="ts">
 	import type { FlowEditorContext } from '../types'
+	import { refreshStateStore } from '$lib/svelte5Utils.svelte'
 	import type { FlowDiffManager } from '../flowDiffManager.svelte'
 	import { createEventDispatcher, getContext } from 'svelte'
 	import { Bug, X } from 'lucide-svelte'
@@ -7,7 +8,6 @@
 	import { insertNewFailureModule } from '$lib/components/flows/flowStateUtils.svelte'
 	import type { RawScript, ScriptLang } from '$lib/gen'
 	import { twMerge } from 'tailwind-merge'
-	import { refreshFlowStateStore } from '$lib/components/flows/flowStoreRefresh.svelte'
 	import Button from '$lib/components/common/button/Button.svelte'
 	import DiffActionBar from './DiffActionBar.svelte'
 	import { getNodeColorClasses, aiActionToNodeState } from '$lib/components/graph'
@@ -58,7 +58,7 @@
 		}
 
 		selectionManager.selectId('failure')
-		refreshFlowStateStore(flowStore)
+		refreshStateStore(flowStore)
 	}
 
 	function deleteFailureModule() {
diff --git a/frontend/src/lib/components/flows/map/FlowModuleSchemaMap.svelte b/frontend/src/lib/components/flows/map/FlowModuleSchemaMap.svelte
index ef2dd38c39..36b44cf667 100644
--- a/frontend/src/lib/components/flows/map/FlowModuleSchemaMap.svelte
+++ b/frontend/src/lib/components/flows/map/FlowModuleSchemaMap.svelte
@@ -1,22 +1,16 @@
 <script lang="ts">
 	import type { FlowEditorContext } from '../types'
+	import { refreshStateStore } from '$lib/svelte5Utils.svelte'
 	import type { OpenInSessionSource } from '$lib/components/sessions/OpenInSessionButton.svelte'
 	import { createEventDispatcher, getContext, tick } from 'svelte'
 	import {
-		createInlineScriptModule,
-		createBranchAll,
-		createBranches,
-		createLoop,
-		createWhileLoop,
-		emptyModule,
-		pickScript,
-		pickFlow,
 		insertNewPreprocessorModule,
-		createAiAgent
+		createNewModule as createNewModuleIn,
+		insertNewModuleAtIndex as insertNewModuleAt,
+		insertAgentTool
 	} from '$lib/components/flows/flowStateUtils.svelte'
 	import type { FlowModule, Job, ScriptLang } from '$lib/gen'
 	import { emptyFlowModuleState } from '../utils.svelte'
-	import { stepSettingDefaults } from '../flowStepSettings'
 
 	import { dfs } from '../dfs'
 	import { nextId, copyId } from '../flowModuleNextId'
@@ -27,7 +21,6 @@
 
 	import { locateModules, groupByParent } from '../multiSelectUtils'
 	import { workspaceStore } from '$lib/stores'
-	import { copilotInfo } from '$lib/aiStore'
 	import FlowTutorials from '$lib/components/FlowTutorials.svelte'
 	import FlowGraphV2 from '$lib/components/graph/FlowGraphV2.svelte'
 	import { replaceId } from '../flowStore.svelte'
@@ -38,23 +31,12 @@
 	import { addBranch as addBranchOp, removeBranch as removeBranchOp } from '../branchOps'
 	import type { InlineScript, InsertKind } from '$lib/components/graph/graphBuilder.svelte'
 	import { MoveManager } from '$lib/components/graph/moveManager.svelte'
-	import { refreshFlowStateStore } from '../flowStoreRefresh.svelte'
 	import type { GraphModuleState } from '$lib/components/graph'
 	import FlowStickyNode from './FlowStickyNode.svelte'
 	import { getStepHistoryLoaderContext } from '$lib/components/stepHistoryLoader.svelte'
 	import { ModulesTestStates } from '$lib/components/modulesTest.svelte'
 	import type { StateStore } from '$lib/utils'
-	import {
-		type AgentTool,
-		type SpecialToolKind,
-		newFlowModuleAgentTool,
-		createMcpTool,
-		createWebsearchTool,
-		createAiAgentTool,
-		SPECIAL_TOOL_KINDS,
-		agentToolToFlowModule
-	} from '../agentToolUtils'
-	import { loadFlowModuleState } from '../flowStateUtils.svelte'
+	import { type AgentTool, type SpecialToolKind } from '../agentToolUtils'
 	import type { DeletePlan } from '../flowDeleteUtils'
 	import { executeDeletePlan, prepareDeleteRequest } from '../flowDeleteController'
 	import { getNoteEditorContext } from '$lib/components/graph/noteEditor.svelte'
@@ -161,62 +143,56 @@
 	})
 
 	/** Create a new FlowModule without inserting it into any array */
-	async function createNewModule(
+	function createNewModule(
 		kind: InsertKind,
 		wsScript?: { path: string; summary: string; hash: string | undefined },
 		wsFlow?: { path: string; summary: string },
 		inlineScript?: InlineScript,
 		agentPath?: string
 	): Promise<FlowModule> {
-		let module = emptyModule(flowStateStore.val, flowStore.val, kind == 'flow')
-		let state = emptyFlowModuleState()
-		flowStateStore.val[module.id] = state
-		if (wsFlow) {
-			;[module, state] = await pickFlow(wsFlow.path, wsFlow.summary, module.id, opWs)
-		} else if (wsScript) {
-			;[module, state] = await pickScript(
-				wsScript.path,
-				wsScript.summary,
-				module.id,
-				wsScript.hash,
-				kind,
-				opWs
-			)
-		} else if (kind == 'forloop') {
-			;[module, state] = await createLoop(module.id, !disableAi && $copilotInfo.enabled)
-		} else if (kind == 'whileloop') {
-			;[module, state] = await createWhileLoop(module.id)
-		} else if (kind == 'branchone') {
-			;[module, state] = await createBranches(module.id)
-		} else if (kind == 'branchall') {
-			;[module, state] = await createBranchAll(module.id)
-		} else if (kind == 'aiagent') {
-			;[module, state] = await createAiAgent(module.id, agentPath)
-		} else if (inlineScript) {
-			const { language, kind, subkind, summary } = inlineScript
-			;[module, state] = await createInlineScriptModule(language, kind, subkind, module.id, summary)
-			flowStateStore.val[module.id] = state
-			if (kind == 'trigger') {
-				module.summary = 'Trigger'
-			} else if (kind == 'approval') {
-				module.summary = 'Approval'
-			}
-		}
-		flowStateStore.val[module.id] = state
-
-		if (kind == 'approval') {
-			module.suspend = stepSettingDefaults('suspend')
-		} else if (kind == 'trigger') {
-			module.stop_after_if = stepSettingDefaults('early-stop', 'trigger')
-		} else if (kind == 'end') {
-			module.summary = 'Terminate flow'
-			module.stop_after_if = stepSettingDefaults('early-stop', 'end')
-		}
-
-		return module
+		return createNewModuleIn(
+			flowStore,
+			flowStateStore,
+			kind,
+			wsScript,
+			wsFlow,
+			inlineScript,
+			agentPath,
+			opWs,
+			disableAi
+		)
 	}
 
-	export async function insertNewModuleAtIndex(
+	/**
+	 * Add a tool to an agent, from the graph's own `+ Tool` or from a surface that has no graph
+	 * node to click — the agent step's Tools section. Kept here because it needs the map's history,
+	 * id allocation and `flowStateStore` seeding.
+	 */
+	export async function addToolToAgent(
+		agentId: string,
+		detail: { kind: string; script?: any; flow?: any; inlineScript?: any }
+	) {
+		push(history, flowStore.val)
+		const agentMod = findModuleInFlow(flowStore.val.value, agentId)
+		const agentValue = agentMod?.value as { tools?: AgentTool[] } | undefined
+		if (agentValue) {
+			const id = await insertAgentTool(
+				flowStore,
+				flowStateStore,
+				agentValue,
+				detail,
+				opWs,
+				disableAi
+			)
+			// Reveal the new tool's config right away — in modal (unanchored) panel mode its editor
+			// is otherwise hidden behind the graph.
+			if (id) selectionManager.selectId(id, { openPanel: true })
+		}
+		refreshStateStore(flowStore)
+		dispatch('change')
+	}
+
+	export function insertNewModuleAtIndex(
 		modules: FlowModule[] | AgentTool[],
 		index: number,
 		kind: InsertKind,
@@ -226,38 +202,19 @@
 		toolKind?: SpecialToolKind | 'flowmoduleTool'
 	): Promise<FlowModule[] | AgentTool[]> {
 		push(history, flowStore.val)
-		const module = await createNewModule(kind, wsScript, wsFlow, inlineScript)
-
-		if (!modules) return [module]
-
-		if (toolKind === 'mcpTool') {
-			// Create MCP AgentTool
-			const mcpTool = createMcpTool(module.id)
-			;(modules as AgentTool[]).splice(index, 0, mcpTool)
-			return modules as AgentTool[]
-		} else if (toolKind === 'websearchTool') {
-			// Create Websearch AgentTool
-			const websearchTool = createWebsearchTool(module.id)
-			;(modules as AgentTool[]).splice(index, 0, websearchTool)
-			return modules as AgentTool[]
-		} else if (toolKind === 'aiAgentTool') {
-			// Create AI Agent tool (nested agent)
-			const aiAgentTool = createAiAgentTool(module.id)
-			flowStateStore.val[module.id] = await loadFlowModuleState(
-				agentToolToFlowModule(aiAgentTool),
-				opWs
-			)
-			;(modules as AgentTool[]).splice(index, 0, aiAgentTool)
-			return modules as AgentTool[]
-		} else if (toolKind === 'flowmoduleTool') {
-			const agentTool = newFlowModuleAgentTool(module)
-			;(modules as AgentTool[]).splice(index, 0, agentTool)
-			return modules as AgentTool[]
-		} else {
-			// Standard FlowModule insertion
-			modules.splice(index, 0, module)
-			return modules
-		}
+		return insertNewModuleAt(
+			flowStore,
+			flowStateStore,
+			modules,
+			index,
+			kind,
+			wsScript,
+			wsFlow,
+			inlineScript,
+			toolKind,
+			opWs,
+			disableAi
+		)
 	}
 
 	let sidebarMode: 'list' | 'graph' = 'graph'
@@ -409,7 +366,7 @@
 			parentArr.splice(lastIndex + 1, 0, ...clones)
 		}
 
-		refreshFlowStateStore(flowStore)
+		refreshStateStore(flowStore)
 		selectionManager.selectByIds(allCloneIds)
 	}
 
@@ -669,7 +626,7 @@
 							selectionManager.selectId(movingId)
 						}
 						moveManager.clearMoving()
-						refreshFlowStateStore(flowStore)
+						refreshStateStore(flowStore)
 						dispatch('change')
 					}
 
@@ -705,48 +662,19 @@
 							instructions: detail.inlineScript?.instructions
 						})
 					}
-					refreshFlowStateStore(flowStore)
+					refreshStateStore(flowStore)
 					dispatch('change')
 					return
 				}
 
+				// Agent tool inserts operate on the FlowModule's tools array directly
+				if (detail.agentId) {
+					await addToolToAgent(detail.agentId, detail)
+					return
+				}
+
 				push(history, flowStore.val)
 
-				const isAgentInsert = !!detail.agentId
-				const toolKind: SpecialToolKind | 'flowmoduleTool' | undefined = isAgentInsert
-					? (SPECIAL_TOOL_KINDS as readonly string[]).includes(detail.kind)
-						? (detail.kind as SpecialToolKind)
-						: 'flowmoduleTool'
-					: undefined
-
-				// Agent tool inserts operate on the FlowModule's tools array directly
-				if (isAgentInsert) {
-					const agentMod = findModuleInFlow(flowStore.val.value, detail.agentId!)
-					const agentValue = agentMod?.value as { tools?: AgentTool[] } | undefined
-					if (agentValue) {
-						// `tools` is optional, so a module authored without it starts undefined here and
-						// would silently swallow its first tool.
-						agentValue.tools ??= []
-						const tools = agentValue.tools
-						await insertNewModuleAtIndex(
-							tools,
-							tools.length,
-							detail.kind as InsertKind,
-							detail.script,
-							detail.flow ? { path: detail.flow.path, summary: detail.flow.summary } : undefined,
-							detail.inlineScript,
-							toolKind
-						)
-						const id = tools[tools.length - 1].id
-						// Reveal the new tool's config right away — in modal (unanchored)
-						// panel mode its editor is otherwise hidden behind the graph.
-						selectionManager.selectId(id, { openPanel: true })
-					}
-					refreshFlowStateStore(flowStore)
-					dispatch('change')
-					return
-				}
-
 				// Regular module insert: create the module, then insert a leaf node via tree mutation
 				const module = await createNewModule(
 					detail.kind as InsertKind,
@@ -823,13 +751,13 @@
 				if (['branchone', 'branchall'].includes(detail.kind)) {
 					await addBranch(module.id)
 				}
-				refreshFlowStateStore(flowStore)
+				refreshStateStore(flowStore)
 				dispatch('change')
 			}}
 			onNewBranch={async (id) => {
 				if (id) {
 					await addBranch(id)
-					refreshFlowStateStore(flowStore)
+					refreshStateStore(flowStore)
 				}
 			}}
 			onSelect={(id) => {
@@ -883,13 +811,13 @@
 				}
 				flowStateStore.val[newId] = flowStateStore.val[id]
 				delete flowStateStore.val[id]
-				refreshFlowStateStore(flowStore)
+				refreshStateStore(flowStore)
 				selectionManager.selectId(newId)
 			}}
 			onDeleteBranch={async ({ id, index }) => {
 				if (id) {
 					await removeBranch(id, index)
-					refreshFlowStateStore(flowStore)
+					refreshStateStore(flowStore)
 					selectionManager.selectId(id)
 				}
 			}}
@@ -928,7 +856,7 @@
 				})
 
 				targetModules.splice(targetIndex + 1, 0, clone)
-				refreshFlowStateStore(flowStore)
+				refreshStateStore(flowStore)
 				selectionManager.selectId(clone.id, { openPanel: true })
 			}}
 			onUpdateMock={(detail) => {
@@ -937,7 +865,7 @@
 					throw new Error(`Node ${detail.id} not found`)
 				}
 				module.mock = $state.snapshot(detail.mock)
-				refreshFlowStateStore(flowStore)
+				refreshStateStore(flowStore)
 			}}
 			{onTestFlow}
 			{isRunning}
diff --git a/frontend/src/lib/components/flows/map/InsertModuleInner.svelte b/frontend/src/lib/components/flows/map/InsertModuleInner.svelte
index d1e65de1ea..7c75d97fab 100644
--- a/frontend/src/lib/components/flows/map/InsertModuleInner.svelte
+++ b/frontend/src/lib/components/flows/map/InsertModuleInner.svelte
@@ -3,7 +3,7 @@
 </script>
 
 <script lang="ts">
-	import { createEventDispatcher, getContext, untrack } from 'svelte'
+	import { createEventDispatcher, getContext, onDestroy, onMount, untrack } from 'svelte'
 	import StepGenQuick from '$lib/components/copilot/StepGenQuick.svelte'
 	import FlowInputsQuick from '../content/FlowInputsQuick.svelte'
 	import type { FlowBuilderWhitelabelCustomUi } from '$lib/components/custom_ui'
@@ -58,6 +58,15 @@
 	const flowEditorContext = getContext<FlowEditorContext | undefined>('FlowEditorContext')
 	let ws = $derived(flowEditorContext?.opWorkspace?.() ?? $workspaceStore)
 
+	// Flagged for the whole menu, whichever pane is showing: the flow builder walks node
+	// selection on ArrowUp/ArrowDown while it is unset, which tears the popover down.
+	onMount(() => {
+		flowEditorContext?.insertButtonOpen.set(true)
+	})
+	onDestroy(() => {
+		flowEditorContext?.insertButtonOpen.set(false)
+	})
+
 	let savedAgents = $state<{ path: string; description?: string }[]>([])
 	let savedAgentsLoading = $state(false)
 	let savedAgentsWs: string | undefined = undefined
@@ -86,6 +95,72 @@
 			: savedAgents
 	)
 
+	function newBlankAgent() {
+		dispatch('close')
+		dispatch('new', { kind: 'aiagent' })
+	}
+	function newLinkedAgent(agentPath: string) {
+		dispatch('close')
+		logReusableAgentUsage('linked')
+		dispatch('new', { kind: 'aiagent', agentPath })
+	}
+	function newClaudeSandbox() {
+		dispatch('close')
+		dispatch('new', {
+			kind: 'script',
+			inlineScript: {
+				language: 'bun',
+				kind: 'script',
+				subkind: 'claudesandbox'
+			}
+		})
+	}
+
+	// Rows of the AI panes in render order. FlowInputsQuick owns the keyboard index for the other
+	// panes and is unmounted while these render, so the two never fight over Enter or the arrows.
+	let aiRows = $derived.by((): (() => void)[] => {
+		if (selectedKind === 'aiagent') {
+			const saved = savedAgentsLoading ? [] : filteredAgents
+			return [newBlankAgent, ...saved.map((a) => () => newLinkedAgent(a.path))]
+		}
+		if (selectedKind === 'aisandbox') {
+			return [newClaudeSandbox]
+		}
+		return []
+	})
+	let selectedByKeyboard = $state(0)
+	// Clamped rather than reset when the search filter shrinks the list, so the index never
+	// points past the last rendered row.
+	let aiSelected = $derived(Math.min(selectedByKeyboard, Math.max(aiRows.length - 1, 0)))
+	let aiScrollable: HTMLElement | undefined = $state()
+	let stepGen: StepGenQuick | undefined = $state()
+	function onAiKeyDown(e: KeyboardEvent) {
+		if (aiRows.length === 0) {
+			return
+		}
+		// Enter activates the highlighted row only from the search box (or nothing focused); a
+		// focused button, link or field keeps its own native activation.
+		if (
+			e.key === 'Enter' &&
+			e.target instanceof HTMLElement &&
+			e.target.closest('button, a, select, textarea')
+		) {
+			return
+		}
+		if (e.key === 'ArrowDown') {
+			selectedByKeyboard = (aiSelected + 1) % aiRows.length
+			aiScrollable?.scrollTo({ top: selectedByKeyboard * 32, behavior: 'smooth' })
+			e.preventDefault()
+		} else if (e.key === 'ArrowUp') {
+			selectedByKeyboard = (aiSelected - 1 + aiRows.length) % aiRows.length
+			aiScrollable?.scrollTo({ top: selectedByKeyboard * 32, behavior: 'smooth' })
+			e.preventDefault()
+		} else if (e.key === 'Enter') {
+			e.preventDefault()
+			aiRows[aiSelected]()
+		}
+	}
+
 	let height = $state(0)
 	let owners = $state([])
 	// Only the content-sized host (TriggersWrapper) grows past this. The fixed-height hosts top out
@@ -94,6 +169,7 @@
 	let displayPath = $derived(height > 480)
 </script>
 
+<svelte:window onkeydown={onAiKeyDown} />
 <div
 	id="flow-editor-insert-module"
 	class="flex flex-col h-full gap-2 max-w-full {small ? 'w-[450px]' : 'w-[650px]'}"
@@ -105,6 +181,7 @@
 >
 	<div class="flex flex-row items-center gap-2">
 		<StepGenQuick
+			bind:this={stepGen}
 			on:escape={() => dispatch('close')}
 			{disableAi}
 			on:insert
@@ -230,7 +307,10 @@
 							selected={selectedKind === 'aiagent'}
 							onSelect={() => {
 								selectedKind = 'aiagent'
+								selectedByKeyboard = 0
 								loadSavedAgents()
+								// Clicking leaves focus on this button, where Enter would only re-select it.
+								stepGen?.focus()
 							}}
 						/>
 					{/if}
@@ -240,6 +320,8 @@
 							selected={selectedKind === 'aisandbox'}
 							onSelect={() => {
 								selectedKind = 'aisandbox'
+								selectedByKeyboard = 0
+								stepGen?.focus()
 							}}
 						/>
 					{/if}
@@ -248,19 +330,25 @@
 		{/if}
 
 		{#if selectedKind === 'aiagent'}
-			<div class="h-full overflow-auto grow min-w-0 p-2 gap-1 flex flex-col">
+			<div
+				bind:this={aiScrollable}
+				class="h-full overflow-auto grow min-w-0 p-2 gap-1 flex flex-col"
+			>
 				<Button
-					onClick={() => {
-						dispatch('close')
-						dispatch('new', { kind: 'aiagent' })
-					}}
+					onClick={newBlankAgent}
+					onmousemove={() => (selectedByKeyboard = 0)}
 					role="menuitem"
 					variant="subtle"
 					unifiedSize="sm"
-					btnClasses="justify-start"
+					btnClasses="justify-start {aiSelected === 0
+						? 'bg-surface-hover'
+						: 'hover:bg-transparent'}"
 				>
 					<Plus size={13} class="shrink-0" />
 					<span class="grow truncate text-left">Blank AI agent</span>
+					{#if aiSelected === 0}
+						<kbd class="!text-xs">&crarr;</kbd>
+					{/if}
 				</Button>
 				{#if savedAgentsLoading}
 					<div class="flex items-center gap-2 p-2 text-xs text-tertiary">
@@ -268,21 +356,23 @@
 					</div>
 				{:else if filteredAgents.length > 0}
 					<div class="pt-2 pb-0 text-2xs font-normal text-secondary ml-2">Saved agents</div>
-					{#each filteredAgents as agent (agent.path)}
+					{#each filteredAgents as agent, i (agent.path)}
 						<Button
-							onClick={() => {
-								dispatch('close')
-								logReusableAgentUsage('linked')
-								dispatch('new', { kind: 'aiagent', agentPath: agent.path })
-							}}
+							onClick={() => newLinkedAgent(agent.path)}
+							onmousemove={() => (selectedByKeyboard = i + 1)}
 							role="menuitem"
 							variant="subtle"
 							unifiedSize="sm"
-							btnClasses="justify-start"
+							btnClasses="justify-start {aiSelected === i + 1
+								? 'bg-surface-hover'
+								: 'hover:bg-transparent'}"
 							title={agent.description || agent.path}
 						>
 							<BotIcon size={13} class="shrink-0 text-ai" />
 							<span class="grow truncate text-left">{agent.path}</span>
+							{#if aiSelected === i + 1}
+								<kbd class="!text-xs">&crarr;</kbd>
+							{/if}
 						</Button>
 					{/each}
 				{:else}
@@ -297,17 +387,11 @@
 			<div class="h-full overflow-auto grow min-w-0 p-2 gap-1 flex flex-col">
 				<TopLevelNode
 					label="Claude Code"
-					onSelect={() => {
-						dispatch('close')
-						dispatch('new', {
-							kind: 'script',
-							inlineScript: {
-								language: 'bun',
-								kind: 'script',
-								subkind: 'claudesandbox'
-							}
-						})
-					}}
+					neutral
+					returnIcon
+					selected={aiSelected === 0}
+					onSelect={newClaudeSandbox}
+					onHover={() => (selectedByKeyboard = 0)}
 				/>
 			</div>
 		{:else}
diff --git a/frontend/src/lib/components/flows/propPicker/OutputPickerInner.svelte b/frontend/src/lib/components/flows/propPicker/OutputPickerInner.svelte
index d8d0b63b43..aa9b14b762 100644
--- a/frontend/src/lib/components/flows/propPicker/OutputPickerInner.svelte
+++ b/frontend/src/lib/components/flows/propPicker/OutputPickerInner.svelte
@@ -31,6 +31,7 @@
 	import { base } from '$lib/base'
 	import { fade } from 'svelte/transition'
 	import type { FlowEditorContext, OutputViewerJob } from '../types'
+	import { NEVER_TESTED_THIS_FAR } from '../models'
 	import { logFeatureUsage } from '$lib/utils/featureUsage'
 
 	interface Props {
@@ -192,7 +193,7 @@
 		} else if (selectedJob && 'result' in selectedJob) {
 			// Pin the job
 			let mockValue: any = structuredClone($state.snapshot(selectedJob.result))
-			if (selectedJob.result === 'never tested this far') {
+			if (selectedJob.result === NEVER_TESTED_THIS_FAR) {
 				mockValue = { example: 'value' }
 			}
 			const newMock = {
@@ -222,21 +223,23 @@
 		if (testJob && (testJob.result_stream || testJob.type === 'QueuedJob' || !moduleId)) {
 			return testJob
 		}
-		if (
-			!flowStateStore ||
-			!moduleId ||
-			flowStateStore.val[moduleId]?.previewResult === 'never tested this far'
-		) {
+		// A module with no state yet has no result either. Building the job below from a missing
+		// entry mints a completed-and-failed job with no id, which shows as a red badge on a step
+		// that never ran; and `selectJob` only ever moves off a job it has selected, so it stays
+		// once the state arrives.
+		const moduleState = moduleId ? flowStateStore?.val[moduleId] : undefined
+		if (!moduleState || moduleState.previewResult === NEVER_TESTED_THIS_FAR) {
 			return
 		}
+		const { previewJobId, previewResult, previewSuccess, previewLogs } = moduleState
 		// Use flowStateStore as source of truth — it's updated by both individual step tests
 		// (ModuleTest.jobDone) and flow tests (FlowStatusViewerInner.onJobsLoadedInner)
 		return {
-			id: flowStateStore.val[moduleId]?.previewJobId ?? '',
-			result: flowStateStore.val[moduleId]?.previewResult,
+			id: previewJobId ?? '',
+			result: previewResult,
 			type: 'CompletedJob' as const,
-			success: flowStateStore.val[moduleId]?.previewSuccess ?? undefined,
-			logs: flowStateStore.val[moduleId]?.previewLogs
+			success: previewSuccess ?? undefined,
+			logs: previewLogs
 		} as Job & { result_stream?: string } & { preview?: boolean }
 	}
 
diff --git a/frontend/src/lib/components/flows/types.ts b/frontend/src/lib/components/flows/types.ts
index eeeb6e10b5..40e9ddc952 100644
--- a/frontend/src/lib/components/flows/types.ts
+++ b/frontend/src/lib/components/flows/types.ts
@@ -107,6 +107,10 @@ export type FlowEditorContext = {
 	// $workspaceStore inside a fork-scoped session; worker-tag pickers read it so
 	// their tag list and availability match the deploy target. Getter for reactivity.
 	opWorkspace?: () => string | undefined
+	// The agent whose editor hosts this flow, when one does. An agent editor hosts its flow under
+	// that agent's own path, so `pathStore` alone cannot say whether a step belongs to a flow or to
+	// an agent being edited — a flow and a resource may share a path string.
+	agentEditorHost?: () => string | undefined
 }
 
 export type FlowGraphAssetContext = StateStore<{
diff --git a/frontend/src/lib/components/home/HomeAIChat.svelte b/frontend/src/lib/components/home/HomeAIChat.svelte
index d0e75538ca..441489db65 100644
--- a/frontend/src/lib/components/home/HomeAIChat.svelte
+++ b/frontend/src/lib/components/home/HomeAIChat.svelte
@@ -1,6 +1,6 @@
 <script lang="ts" module>
 	/** Example prompts: the short `label` is shown as a clickable tag under the chat,
-	 * the `prompt` is what gets typed out as the placeholder / dropped into the input. */
+	 * the `prompt` is what rotates through the placeholder / gets dropped into the input. */
 	export const homeAIExamples: { label: string; prompt: string }[] = [
 		{
 			label: 'Sync Salesforce',
@@ -20,24 +20,48 @@
 
 <script lang="ts">
 	import TextInput from '$lib/components/text_input/TextInput.svelte'
-	import { ArrowUp, ExternalLink, Globe2, KeyRound, PlugZap, Settings } from 'lucide-svelte'
+	import {
+		ArrowUp,
+		ExternalLink,
+		Globe2,
+		KeyRound,
+		PlugZap,
+		Settings,
+		WandSparkles
+	} from 'lucide-svelte'
 	import Button from '../common/button/Button.svelte'
 	import { Badge } from '../common'
+	import CloseButton from '../common/CloseButton.svelte'
 	import { startSessionWithPrompt } from '../sessions/sessionSwitch.svelte'
 	import { copilotInfo, copilotWorkspace } from '$lib/aiStore'
 	import { loadCopilot } from '$lib/components/copilot/loadCopilot'
 	import { aiUserDisabled, hubBaseUrlStore, userStore, workspaceStore } from '$lib/stores'
 	import { HOME_SHOW_HUB } from '$lib/consts'
 	import { base } from '$lib/base'
+	import { getLocalSetting, storeLocalSetting } from '$lib/utils'
+	import { isRuleActive } from '$lib/workspaceProtectionRules.svelte'
+	import { useReducedMotion } from '$lib/svelte5Utils.svelte'
+	import { BROWSER } from 'esm-env'
 	import AIChatModelSettings from '../copilot/chat/AIChatModelSettings.svelte'
 	import HomeConnectDrawer from './HomeConnectDrawer.svelte'
 	import { USER_SETTINGS_HASH } from '../sidebar/settings'
 	import { prefersSessionHandoff } from '../copilot/chat/global/gate'
 
+	const COLLAPSED_SETTING = 'home-ai-composer-collapsed'
+
 	let value = $state('')
-	let placeholder = $state('')
+	let placeholder = $state(homeAIExamples[0].prompt)
+	let placeholderVisible = $state(true)
 	let homeConnectDrawer: HomeConnectDrawer | undefined = $state(undefined)
 
+	// How much of the home page this reader wants the composer to take, so it lives per browser
+	// rather than per workspace or account.
+	let collapsed = $state(BROWSER && getLocalSetting(COLLAPSED_SETTING) === 'true')
+	function setCollapsed(next: boolean) {
+		collapsed = next
+		storeLocalSetting(COLLAPSED_SETTING, next ? 'true' : undefined)
+	}
+
 	// In global-AI mode the layout's chat panel is disabled and never loads the copilot
 	// config, so the home chat loads it for the current workspace itself.
 	$effect(() => {
@@ -48,10 +72,9 @@
 
 	// Whether the copilot config has actually loaded for the current workspace.
 	let configLoaded = $derived($copilotWorkspace === $workspaceStore)
-	// No usable model (no provider configured, or AI disabled): the composer is blurred and an
-	// overlay explains why and links to the fix. Static, not hover-gated, so keyboard and touch
-	// users see it too. Gate on `configLoaded` so the initial (unloaded) state doesn't flash the
-	// overlay while a provider is in fact configured.
+	// No usable model (no provider configured, or AI disabled): the input is blurred and an overlay
+	// explains why and links to the fix. Gate on `configLoaded` so the initial (unloaded) state
+	// doesn't flash the overlay while a provider is in fact configured.
 	let disabled = $derived(configLoaded && !$copilotInfo.enabled)
 	// Submission is stricter than the overlay: block it until the config is loaded AND
 	// enabled. Submitting during the unknown-config window hands the prompt to a session
@@ -59,17 +82,34 @@
 	// workspace that never happens and the prompt is silently lost.
 	let canSend = $derived(configLoaded && $copilotInfo.enabled)
 
-	// Applied to the AI-specific parts only (title, input, example tags) when disabled. The
-	// CLI/MCP and Hub buttons are unrelated to AI and stay sharp and clickable.
+	// The input alone: what the overlay covers and the one part a missing provider makes unusable.
 	let blurClass = $derived(disabled ? 'blur-sm pointer-events-none select-none' : '')
 
 	// Disabled because the user spent their free Windmill AI grant, not because AI was never
 	// set up — the two look identical otherwise, and the "configure AI" copy would be a lie.
 	let freeTierExhausted = $derived($copilotInfo.freeTier?.exhausted === true)
 
+	// A workspace locked against direct deployment is run, not authored in, so its home page drops
+	// the composer and the button to reopen it. This is about the workspace, not the caller:
+	// `createSession` would steer a prompt into the paired dev workspace and an admin bypasses the
+	// lock outright, yet neither makes prod the place to start one. Unresolved rules read as
+	// unlocked, so the far commoner unlocked workspace never pops the composer in mid-load.
+	let runOnlyWorkspace = $derived(isRuleActive('DisableDirectDeployment'))
+
 	// The composer hands off to /sessions, which refuses operators — so hide it from them (the
 	// prompt would be silently dropped) while the AI-independent CLI/MCP row below stays.
-	let showComposer = $derived(prefersSessionHandoff($userStore?.operator))
+	let showComposer = $derived(
+		prefersSessionHandoff($userStore?.operator) &&
+			!runOnlyWorkspace &&
+			!$copilotInfo.workspaceDisabled
+	)
+
+	// The hero's margins and centered column are for the full block. The lone button row left
+	// by a collapsed, operator, run-only or hidden-assistant view is a hint line and should
+	// cost the page almost nothing: no top margin, and the content column's full width so it
+	// hugs the right edge instead of floating centered in empty space.
+	let hero = $derived(showComposer && !collapsed)
+	let outerSpacing = $derived(hero ? 'mt-20 mb-16' : 'mt-0 mb-1')
 
 	let starting = $state(false)
 	async function start() {
@@ -92,66 +132,84 @@
 
 	const prompts = homeAIExamples.map((e) => e.prompt)
 
-	const TYPE_MS = 45
-	const DELETE_MS = 25
-	const HOLD_MS = 1800
-	const PAUSE_MS = 400
+	const CYCLE_MS = 7_000
+	// Must match the `duration-*` class on the placeholder overlay: the swap happens once the
+	// fade-out has finished, and Tailwind only emits classes it finds written out in full.
+	const FADE_MS = 600
 
-	// Typewriter effect: type a prompt out, hold, delete, then advance to the next. Only while the
-	// composer is shown — otherwise (operators) it would loop forever driving an unrendered input.
+	// Rotate the example prompt every CYCLE_MS: fade the placeholder out, swap it, fade it back in.
+	// Only while the composer is shown — otherwise (operators) it would loop forever driving an
+	// unrendered input — and not under reduced motion, where the first prompt simply stays put.
+	// The index lives outside the effect so re-showing the composer resumes the rotation from the
+	// prompt currently displayed rather than restarting it.
+	const reducedMotion = useReducedMotion()
+	let promptIndex = 0
 	$effect(() => {
-		if (!showComposer) return
-		let promptIndex = 0
-		let charIndex = 0
-		let deleting = false
+		if (!showComposer || collapsed || reducedMotion.val) return
 		let timer: ReturnType<typeof setTimeout>
 
-		function tick() {
-			const current = prompts[promptIndex]
-			if (!deleting) {
-				charIndex++
-				placeholder = current.slice(0, charIndex)
-				if (charIndex >= current.length) {
-					deleting = true
-					timer = setTimeout(tick, HOLD_MS)
-					return
-				}
-				timer = setTimeout(tick, TYPE_MS)
-			} else {
-				charIndex--
-				placeholder = current.slice(0, charIndex)
-				if (charIndex <= 0) {
-					deleting = false
-					promptIndex = (promptIndex + 1) % prompts.length
-					timer = setTimeout(tick, PAUSE_MS)
-					return
-				}
-				timer = setTimeout(tick, DELETE_MS)
-			}
+		function next() {
+			placeholderVisible = false
+			timer = setTimeout(() => {
+				promptIndex = (promptIndex + 1) % prompts.length
+				placeholder = prompts[promptIndex]
+				placeholderVisible = true
+				timer = setTimeout(next, CYCLE_MS)
+			}, FADE_MS)
 		}
 
-		timer = setTimeout(tick, TYPE_MS)
-		return () => clearTimeout(timer)
+		timer = setTimeout(next, CYCLE_MS)
+		return () => {
+			clearTimeout(timer)
+			// Torn down mid-fade, the input would otherwise remount with an invisible placeholder.
+			placeholderVisible = true
+		}
 	})
 </script>
 
-<div class="w-full flex justify-center">
-	<div class="max-w-[40rem] grow relative group">
-		{#if showComposer}
-			<div class={blurClass} inert={disabled}>
-				<div class="flex items-center justify-center gap-2 mb-4">
-					<p class="text-center font-regular text-3xl">Build with AI</p>
-					<Badge color="blue" small>Beta</Badge>
+<div class="w-full flex justify-center {outerSpacing}">
+	<div class="{hero ? 'max-w-[40rem]' : ''} grow relative group">
+		{#if showComposer && !collapsed}
+			{#if !disabled}
+				<!-- The one dismiss control while the composer is usable; the overlay below carries its
+				     own once it takes over, so the two never show at the same time. -->
+				<div class="absolute right-0 top-0 z-20">
+					<CloseButton small noBg title="Hide Build with AI" onClick={() => setCollapsed(true)} />
 				</div>
-				<!-- anchors the send button / model settings to the input, not to the whole
-				     block — the row below would otherwise push them down -->
-				<div class="relative">
+			{/if}
+			<div class="flex items-center justify-center gap-2 mb-4">
+				<p class="text-center font-regular text-3xl">Build with AI</p>
+				<Badge color="blue" small>Beta</Badge>
+			</div>
+			<!-- Anchors the send button / model settings to the input, not to the whole block — the row
+			     below would otherwise push them down. The inner wrapper stays `relative` in both
+			     states: `blur-sm` is a filter, which makes an element the containing block for its
+			     absolutely positioned children, so those two would shift when the blur turns on. -->
+			<div class="relative">
+				<div class="relative {blurClass}" inert={disabled}>
 					<TextInput
 						bind:value
 						class="resize-none px-4 py-3 pb-9 shadow-sm border-accent"
 						underlyingInputEl="textarea"
-						inputProps={{ rows: 4, placeholder, onkeydown: onKeydown }}
+						inputProps={{
+							rows: 4,
+							'aria-label': 'Describe what you want to build',
+							onkeydown: onKeydown
+						}}
 					/>
+					{#if !value}
+						<!-- Drawn over the textarea instead of set as its `placeholder`: WebKit and Gecko do
+						     not run transitions on `::placeholder`, so the fade would be a hard cut there.
+						     The 1px margin is the textarea's border, so the text sits where typing starts. -->
+						<span
+							aria-hidden="true"
+							class="pointer-events-none absolute inset-x-4 top-3 m-px text-xs text-hint transition-opacity duration-[600ms] ease-in-out {placeholderVisible
+								? 'opacity-100'
+								: 'opacity-0'}"
+						>
+							{placeholder}
+						</span>
+					{/if}
 					<Button
 						endIcon={starting ? {} : { icon: ArrowUp }}
 						wrapperClasses="absolute right-2 bottom-3.5"
@@ -165,12 +223,56 @@
 						<AIChatModelSettings />
 					</div>
 				</div>
+				{#if disabled}
+					<!-- Covers the input alone: the title, the example prompts and the CLI/MCP row are all
+					     still legible and usable without a provider. Static, not hover-gated, so keyboard
+					     and touch users see it too. -->
+					<div
+						class="absolute inset-0 z-10 flex flex-col items-center justify-center gap-2 rounded-md bg-surface/70"
+					>
+						<p class="text-sm text-secondary">
+							{#if $aiUserDisabled}
+								Windmill AI is disabled in your account settings
+							{:else if freeTierExhausted}
+								You have used all of your free Windmill AI tokens
+							{:else}
+								No AI provider is configured
+							{/if}
+						</p>
+						<div class="flex items-center gap-2">
+							{#if $aiUserDisabled}
+								<!-- The fix lives in account settings (a hash-opened drawer, not a route), so link
+								     the hash the sidebar's Account menu uses rather than the workspace AI settings. -->
+								<Button
+									unifiedSize="sm"
+									variant="accent"
+									startIcon={{ icon: Settings }}
+									href={USER_SETTINGS_HASH}
+								>
+									Open account settings
+								</Button>
+							{:else}
+								<Button
+									unifiedSize="sm"
+									variant="accent"
+									startIcon={{ icon: freeTierExhausted ? KeyRound : Settings }}
+									href="{base}/workspace_settings?tab=ai"
+								>
+									{freeTierExhausted ? 'Add your own API key' : 'Configure AI'}
+								</Button>
+							{/if}
+							<Button unifiedSize="sm" variant="default" onClick={() => setCollapsed(true)}>
+								Hide
+							</Button>
+						</div>
+					</div>
+				{/if}
 			</div>
 		{/if}
 
-		<div class="flex items-center justify-between gap-2">
-			{#if showComposer}
-				<div class="flex flex-row flex-wrap items-center gap-1.5 {blurClass}" inert={disabled}>
+		<div class="flex items-center justify-between gap-2 pt-2">
+			{#if showComposer && !collapsed}
+				<div class="flex flex-row flex-wrap items-center gap-1.5">
 					{#each homeAIExamples as example (example.label)}
 						<Button
 							variant="default"
@@ -182,13 +284,24 @@
 						</Button>
 					{/each}
 				</div>
+			{:else if showComposer}
+				<!-- All that is left of the composer once dismissed: sits with the CLI/MCP row so the
+				     collapsed home page is one quiet line. -->
+				<Button
+					variant="subtle"
+					unifiedSize="xs"
+					btnClasses="!text-2xs !text-hint"
+					startIcon={{ icon: WandSparkles }}
+					onClick={() => setCollapsed(false)}
+				>
+					Build with AI
+				</Button>
 			{:else}
 				<div></div>
 			{/if}
 
-			<!-- Not AI-related, so shown even to operators / when the composer is hidden: kept out of
-			     the blurred subtree and above the disabled overlay so it stays sharp and clickable. -->
-			<div class="relative z-20 flex flex-row items-center gap-1">
+			<!-- Not AI-related, so shown even to operators / when the composer is hidden. -->
+			<div class="flex flex-row items-center gap-1">
 				<Button
 					variant="subtle"
 					unifiedSize="xs"
@@ -213,42 +326,6 @@
 				{/if}
 			</div>
 		</div>
-		{#if showComposer && disabled}
-			<div
-				class="absolute inset-0 z-10 flex flex-col items-center justify-center gap-2 rounded-md bg-surface/70"
-			>
-				<p class="text-sm text-secondary">
-					{#if $aiUserDisabled}
-						Windmill AI is disabled in your account settings
-					{:else if freeTierExhausted}
-						You have used all of your free Windmill AI tokens
-					{:else}
-						No AI provider is configured
-					{/if}
-				</p>
-				{#if $aiUserDisabled}
-					<!-- The fix lives in account settings (a hash-opened drawer, not a route), so link
-					     the hash the sidebar's Account menu uses rather than the workspace AI settings. -->
-					<Button
-						unifiedSize="sm"
-						variant="accent"
-						startIcon={{ icon: Settings }}
-						href={USER_SETTINGS_HASH}
-					>
-						Open account settings
-					</Button>
-				{:else}
-					<Button
-						unifiedSize="sm"
-						variant="accent"
-						startIcon={{ icon: freeTierExhausted ? KeyRound : Settings }}
-						href="{base}/workspace_settings?tab=ai"
-					>
-						{freeTierExhausted ? 'Add your own API key' : 'Configure AI'}
-					</Button>
-				{/if}
-			</div>
-		{/if}
 	</div>
 </div>
 
diff --git a/frontend/src/lib/components/home/ItemsList.svelte b/frontend/src/lib/components/home/ItemsList.svelte
index 0f0cb6a6c0..84432112a3 100644
--- a/frontend/src/lib/components/home/ItemsList.svelte
+++ b/frontend/src/lib/components/home/ItemsList.svelte
@@ -24,7 +24,8 @@
 		ChevronsDownUp,
 		ChevronsUpDown,
 		Code2,
-		LayoutDashboard
+		LayoutDashboard,
+		Tag
 	} from 'lucide-svelte'
 	import DropdownV2 from '$lib/components/DropdownV2.svelte'
 	import CreateActionsMenu from './CreateActionsMenu.svelte'
@@ -39,6 +40,7 @@
 		type FilterSchemaRec
 	} from '$lib/components/FilterSearchbar.svelte'
 	import NoItemFound from './NoItemFound.svelte'
+	import ListFilters from './ListFilters.svelte'
 	import ToggleButtonGroup from '../common/toggleButton-v2/ToggleButtonGroup.svelte'
 	import ToggleButton from '../common/toggleButton-v2/ToggleButton.svelte'
 	import FlowIcon from './FlowIcon.svelte'
@@ -74,10 +76,10 @@
 	)
 
 	// FilterSearchbar schema — `_default_` is the free-text search; the rest mirror the
-	// boolean/kind list filters. Owner and label scoping are offered as searchbar presets
-	// (searchPresets) and resolve server-side (path_start / label) rather than filtering
-	// client-side. `content` is a distinct mode: it swaps the list for the client-side
-	// content-match view below (usable on any instance, not EE-gated).
+	// boolean/kind list filters. Owner and label are also reachable as searchbar presets
+	// (searchPresets) and as on-page chip rows (the ListFilters markup below). `content` is
+	// a distinct mode: it swaps the list for the client-side content-match view below
+	// (usable on any instance, not EE-gated).
 	let searchFilterSchema = $derived({
 		_default_: { type: 'string' as const, hidden: true },
 		content: {
@@ -86,8 +88,8 @@
 			description: 'Search across item contents'
 		},
 		// Owner (u/<user> or f/<folder>) and label are offered as presets built from what the
-		// list actually holds (see searchPresets); they drive the same server path-scope / label
-		// filter the old on-page chips did.
+		// list actually holds (see searchPresets); owner is a server path-scope, label a
+		// client-side filter over the loaded rows.
 		owner: { type: 'string' as const, label: 'Owner' },
 		label: { type: 'string' as const, label: 'Label' },
 		kind: {
@@ -717,11 +719,20 @@
 		return true // should not happen
 	}
 
-	// Owner/label scope now live on the URL-synced searchbar filters (set via the presets),
-	// not standalone chip state — the whole data layer below still reads these two, so keep
-	// them as the single derived source. Empty string reads as "no filter".
+	// The whole data layer below reads these two derived views of the searchbar filters, so
+	// keep them the single source. Empty string reads as "no filter".
 	let ownerFilter = $derived((filterValues.val.owner || undefined) as string | undefined)
 	let labelFilter = $derived((filterValues.val.label || undefined) as string | undefined)
+	// Chip-row setters. Clearing deletes the key rather than writing null, which the
+	// searchbar would otherwise render as a `key: null` tag.
+	function setOwnerFilter(o: string | undefined) {
+		if (o == undefined) delete filterValues.val.owner
+		else filterValues.val.owner = o
+	}
+	function setLabelFilter(l: string | undefined) {
+		if (l == undefined) delete filterValues.val.label
+		else filterValues.val.label = l
+	}
 
 	const cmp = new Intl.Collator('en').compare
 
@@ -1155,11 +1166,26 @@
 	function itemLabels(x: { labels?: string[]; inherited_labels?: string[] }): string[] {
 		return [...(x.labels ?? []), ...(x.inherited_labels ?? [])]
 	}
-	let allLabels = $derived(
-		Array.from(new Set(combinedItems?.flatMap((x) => itemLabels(x)) ?? [])).sort()
+	// Labels ranked by how many loaded rows carry them (ties alphabetical). Unlike the owner
+	// chips there is no workspace-wide count endpoint, so the order is window-local and can
+	// shift as later pages load. A row carrying a label both directly and by inheritance
+	// counts once.
+	let allLabels = $derived.by(() => {
+		const counts = new Map<string, number>()
+		for (const x of combinedItems ?? [])
+			for (const l of new Set(itemLabels(x))) counts.set(l, (counts.get(l) ?? 0) + 1)
+		return [...counts.keys()].sort(
+			(a, b) => (counts.get(b) ?? 0) - (counts.get(a) ?? 0) || cmp(a, b)
+		)
+	})
+	let hasChips = $derived(
+		owners.length > 0 ||
+			allLabels.length > 0 ||
+			ownerFilter != undefined ||
+			labelFilter != undefined
 	)
 	// FilterSearchbar presets: the owner prefixes and labels the list actually holds, so
-	// scoping to one is a click in the searchbar dropdown instead of a wall of on-page chips.
+	// scoping to one is a click in the searchbar dropdown.
 	// Owner sets the `owner` filter (server path-scope), label sets `label` (client filter).
 	// The `:\ ` separator and escaped spaces match the canonical `key:\ value` form parseToText
 	// emits, so the "already applied" check finds them after a reparse and won't re-offer a
@@ -1743,6 +1769,30 @@
 			{/if}
 		</div>
 	</div>
+	{#if !contentActive && hasChips}
+		<!-- Owner and label chips on one line. Each function binding routes the chip's
+		     selection into the searchbar key of the same name, and `queryName` points
+		     ListFilters' own mount-time URL read at the param the filter instance syncs, so
+		     the two writers agree. No `syncQuery`: the filter instance owns the URL. -->
+		<div class="gap-2 w-full flex flex-wrap mt-3">
+			<ListFilters
+				inline
+				bind:selectedFilter={() => ownerFilter, setOwnerFilter}
+				filters={owners}
+				queryName="owner"
+				maxDisplayed={10}
+			/>
+			<ListFilters
+				inline
+				bind:selectedFilter={() => labelFilter, setLabelFilter}
+				filters={allLabels}
+				queryName="label"
+				maxDisplayed={10}
+				color="blue"
+				icon={Tag}
+			/>
+		</div>
+	{/if}
 	{#if filteredItems?.length == 0}
 		<div class="mt-10"></div>
 	{/if}
diff --git a/frontend/src/lib/components/home/ListFilters.svelte b/frontend/src/lib/components/home/ListFilters.svelte
index 38921a5ec3..ecddfec11a 100644
--- a/frontend/src/lib/components/home/ListFilters.svelte
+++ b/frontend/src/lib/components/home/ListFilters.svelte
@@ -1,6 +1,7 @@
 <script lang="ts">
 	import { Folder, User } from 'lucide-svelte'
 	import { Badge } from '../common'
+	import type { BadgeColor, BadgeIconProps } from '../common/badge/model'
 	import { appIconComponent } from '../icons'
 	import { onDestroy, onMount } from 'svelte'
 
@@ -14,6 +15,14 @@
 		// Keep only the first N filters visible, the rest behind a "…" toggle. Unset
 		// shows every one.
 		maxDisplayed?: number
+		// Chip look. `icon` is drawn before every chip; unset, the icon follows the value
+		// (user/folder prefix, or the app icon under `resourceType`).
+		color?: BadgeColor
+		icon?: BadgeIconProps['icon']
+		// Emit the chips as flex items of the parent instead of a row of their own, so several
+		// ListFilters can share one line. The parent owns layout and spacing, so
+		// `bottomMargin` does not apply.
+		inline?: boolean
 	}
 
 	let {
@@ -23,7 +32,10 @@
 		queryName = 'filter',
 		syncQuery = false,
 		bottomMargin = true,
-		maxDisplayed
+		maxDisplayed,
+		color = 'transparent',
+		icon,
+		inline = false
 	}: Props = $props()
 
 	const queryChange: (value: URL) => void = (url: URL) => {
@@ -87,7 +99,9 @@
 </script>
 
 {#if Array.isArray(filtersAndSelected) && filtersAndSelected.length > 0}
-	<div class={`gap-2 w-full flex flex-wrap ${bottomMargin ? 'my-4' : 'mt-4'}`}>
+	<div
+		class={inline ? 'contents' : `gap-2 w-full flex flex-wrap ${bottomMargin ? 'my-4' : 'mt-4'}`}
+	>
 		{#each displayedFilters as filter (filter)}
 			<div>
 				<Badge
@@ -100,12 +114,15 @@
 							setQuery(new URL(window.location.href), queryName, undefined)
 						}
 					}}
-					color={'transparent'}
+					{color}
 					clickable
 					selected={filter === selectedFilter}
 				>
 					<span style="height: 12px" class="-mt-0.5">
-						{#if resourceType}
+						{#if icon}
+							{@const Icon = icon}
+							<Icon class="mr-0.5" size={12} />
+						{:else if resourceType}
 							{@const SvelteComponent = appIconComponent(filter)}
 							<SvelteComponent height="14px" width="14px" />
 						{:else if filter.startsWith('u/')}
@@ -123,7 +140,7 @@
 			<div>
 				<Badge
 					class="inline-flex items-center gap-1 align-middle"
-					color={'transparent'}
+					{color}
 					clickable
 					title={expanded ? 'Show fewer' : `Show ${hiddenCount} more`}
 					onclick={() => (expanded = !expanded)}
diff --git a/frontend/src/lib/components/home/NoItemFound.svelte b/frontend/src/lib/components/home/NoItemFound.svelte
index ea90c8dd0d..94d6dfa1b8 100644
--- a/frontend/src/lib/components/home/NoItemFound.svelte
+++ b/frontend/src/lib/components/home/NoItemFound.svelte
@@ -30,7 +30,7 @@
 {:else}
 	<div class="flex justify-center items-center h-48">
 		<div class="text-primary text-center">
-			<div class="text-xs font-normal text-hint">
+			<div class="text-lg font-normal text-hint">
 				Get started by creating your first script, flow, or app
 			</div>
 		</div>
diff --git a/frontend/src/lib/components/home/TutorialBanner.svelte b/frontend/src/lib/components/home/TutorialBanner.svelte
index 14d8b750c1..ef7b30c27e 100644
--- a/frontend/src/lib/components/home/TutorialBanner.svelte
+++ b/frontend/src/lib/components/home/TutorialBanner.svelte
@@ -1,6 +1,7 @@
 <script lang="ts">
 	import { Button } from '$lib/components/common'
-	import { GraduationCap, X } from 'lucide-svelte'
+	import CloseButton from '$lib/components/common/CloseButton.svelte'
+	import { GraduationCap } from 'lucide-svelte'
 	import { base } from '$lib/base'
 	import { goto } from '$app/navigation'
 	import { sendUserToast, type ToastAction } from '$lib/toast'
@@ -153,44 +154,25 @@
 </script>
 
 {#if !isDismissed}
-	<div
-		class="flex items-center justify-between gap-4 px-4 py-3 rounded-lg border border-light bg-surface-tertiary mb-4"
-	>
-		<div class="flex items-center gap-3 flex-1 min-w-0">
-			<GraduationCap size={20} class="text-accent-primary flex-shrink-0" />
-			<div class="flex-1 min-w-0">
-				<div class="text-emphasis flex-wrap text-left text-xs font-semibold">
-					{#if hasCompletedAny}
-						New tutorial available!
-					{:else}
-						Learn with interactive tutorials
-					{/if}
-				</div>
-				<div class="text-hint text-3xs truncate text-left font-normal">
-					{#if hasCompletedAny}
-						Continue your learning journey and master new Windmill skills.
-					{:else}
-						Get started quickly with step-by-step guides on building flows, scripts, and more.
-					{/if}
-				</div>
-			</div>
-		</div>
-		<div class="flex items-center gap-2 flex-shrink-0">
-			<Button
-				size="xs"
-				variant="accent"
-				onclick={goToTutorials}
-				startIcon={{ icon: GraduationCap }}
-			>
-				View tutorials
-			</Button>
-			<button
-				onclick={dismissBanner}
-				class="p-1.5 rounded hover:bg-surface-hover text-secondary hover:text-primary transition-colors"
-				aria-label="Dismiss tutorial banner"
-			>
-				<X size={16} />
-			</button>
-		</div>
+	<!-- A standing invitation, not an announcement: it sits inline at the start of the row rather
+	     than filling the page, so it reads as one more control and not as a card the user has to
+	     dispatch before getting to their work. -->
+	<div class="flex items-center gap-2 mt-4 mb-4">
+		<span class="text-hint text-xs truncate min-w-0">
+			{#if hasCompletedAny}
+				New tutorial available!
+			{:else}
+				First time?
+			{/if}
+		</span>
+		<Button
+			unifiedSize="sm"
+			variant="default"
+			onclick={goToTutorials}
+			startIcon={{ icon: GraduationCap }}
+		>
+			Tutorials
+		</Button>
+		<CloseButton small noBg title="Dismiss tutorial banner" onClick={dismissBanner} />
 	</div>
 {/if}
diff --git a/frontend/src/lib/components/inputTransformEnv.svelte.ts b/frontend/src/lib/components/inputTransformEnv.svelte.ts
new file mode 100644
index 0000000000..50df45a15a
--- /dev/null
+++ b/frontend/src/lib/components/inputTransformEnv.svelte.ts
@@ -0,0 +1,41 @@
+import { CancelError, WorkspaceService } from '$lib/gen'
+import { resource } from 'runed'
+
+/**
+ * Whether the workspace has S3 storage configured, for the fields that warn without it. Call during
+ * component initialisation and read `.current` where the answer is used.
+ */
+export function useS3StorageConfigured(ws: () => string | undefined): {
+	readonly current: boolean
+} {
+	const settings = resource(ws, async (ws, _previousWs, { onCleanup }) => {
+		if (!ws) return undefined
+		const req = WorkspaceService.getPublicSettings({ workspace: ws })
+		// `resource` keeps whatever lands last: cancel a superseded request so a slow
+		// reply for a workspace we have left cannot overwrite the current one.
+		onCleanup(() => req.cancel())
+		try {
+			return { ws, settings: await req }
+		} catch (err) {
+			if (!(err instanceof CancelError)) {
+				console.error('Failed to fetch workspace settings:', err)
+			}
+			return undefined
+		}
+	})
+
+	// Assume configured until this workspace's own answer lands: the warning must not
+	// linger from the previous workspace, nor appear merely because the fetch failed.
+	const configured = $derived.by(() => {
+		const loaded = settings.current
+		return loaded && loaded.ws === ws()
+			? loaded.settings.large_file_storage?.s3_resource_path !== undefined
+			: true
+	})
+
+	return {
+		get current() {
+			return configured
+		}
+	}
+}
diff --git a/frontend/src/lib/components/instanceSettings.ts b/frontend/src/lib/components/instanceSettings.ts
index 24e7ac6438..8bbca5b4be 100644
--- a/frontend/src/lib/components/instanceSettings.ts
+++ b/frontend/src/lib/components/instanceSettings.ts
@@ -30,6 +30,10 @@ export interface Setting {
 	placeholder?: string
 	cloudonly?: boolean
 	ee_only?: string
+	/** Ceiling a `seconds` field enforces on a build without a license, when CE genuinely caps
+	 * the value. Not implied by `ee_only`: a setting can be EE-badged because the feature it
+	 * configures is EE while the value itself has the same range on either edition. */
+	ceMaxSeconds?: number
 	tooltip?: string
 	key: string
 	// If value is not specified for first element, it will automatcally use undefined
@@ -283,6 +287,8 @@ export const settings: Record<string, Setting[]> = {
 			placeholder: '30',
 			storage: 'setting',
 			ee_only: 'You can only adjust this setting to above 30 days in the EE version',
+			// Mirrors CE_MAX_RETENTION_PERIOD_SECS, which the backend clamps to on write.
+			ceMaxSeconds: 60 * 60 * 24 * 30,
 			cloudonly: false
 		},
 		{
@@ -656,6 +662,16 @@ export const settings: Record<string, Setting[]> = {
 			fieldType: 'text',
 			placeholder: 'okta',
 			storage: 'setting'
+		},
+		{
+			label: 'SSO groups claim',
+			description:
+				'Name of the SAML attribute or OIDC userinfo claim carrying the user\'s IdP groups ("http://schemas.microsoft.com/ws/2008/06/identity/claims/groups" on Entra SAML, "groups" for most OIDC providers). Its values must be the same group ids that SCIM stored as the instance groups\' external id (Entra emits object ids in both), since matching is by external id only. When set, every SSO login reconciles the user\'s membership in those SCIM-provisioned instance groups against the claim, so IdP group changes take effect at the next login instead of waiting for the SCIM push. Instance groups without an external id are never touched, and a login whose claim is absent or empty changes nothing. Leave empty to disable.',
+			key: 'sso_groups_claim',
+			fieldType: 'text',
+			placeholder: 'groups',
+			storage: 'setting',
+			ee_only: ''
 		}
 	],
 	'DB Health': [],
@@ -971,6 +987,24 @@ export const settings: Record<string, Setting[]> = {
 			triggersRestart: true,
 			defaultValue: () => ({ enabled: false, enabled_languages: [...OTEL_TRACING_PROXY_LANGUAGES] })
 		},
+		{
+			label: 'HTTP Request Tracing retention in secs',
+			key: 'otel_traces_retention_secs',
+			description:
+				'How long a captured HTTP request span is kept in the database, and therefore how far back the job details view can show a job its requests. Independent of the job retention period, so a span may outlive its job or be swept while the job remains. Defaults to 7 days. Leave it empty for the default.',
+			fieldType: 'seconds',
+			storage: 'setting',
+			cloudonly: false,
+			// Badged EE because only the EE proxy captures spans, but deliberately no
+			// `ceMaxSeconds`: a CE build still sweeps rows an EE-era instance left behind, and
+			// the backend accepts the same range on either edition.
+			ee_only: 'HTTP Request Tracing is an EE feature',
+			error:
+				'HTTP Request Tracing retention must be between 1 second and 100 years, leave it empty for the default',
+			isValid: (value: any) =>
+				value == undefined ||
+				(typeof value === 'number' && value > 0 && value <= 60 * 60 * 24 * 365 * 100)
+		},
 		{
 			label: 'Prometheus',
 			description:
diff --git a/frontend/src/lib/components/instanceSettings/GhesAppSettings.svelte b/frontend/src/lib/components/instanceSettings/GhesAppSettings.svelte
index da63e8d64a..acd18130da 100644
--- a/frontend/src/lib/components/instanceSettings/GhesAppSettings.svelte
+++ b/frontend/src/lib/components/instanceSettings/GhesAppSettings.svelte
@@ -283,7 +283,17 @@
 					placeholder: '12345',
 					disabled: fieldsDisabled
 				}}
-				bind:value={$values['github_enterprise_app'].app_id}
+				bind:value={
+					() => $values['github_enterprise_app'].app_id,
+					(v) => {
+						// The backend expects app_id as a positive integer (i64). Reject
+						// fractional/out-of-range values instead of truncating them, and store
+						// undefined (never a string or 0) so the config omits the key when unset.
+						const n = typeof v === 'string' ? Number(v.trim() || NaN) : (v ?? NaN)
+						$values['github_enterprise_app'].app_id =
+							Number.isSafeInteger(n) && n > 0 ? n : undefined
+					}
+				}
 			/>
 		</div>
 		<div class="flex flex-col gap-1">
diff --git a/frontend/src/lib/components/mcp/McpConnect.svelte b/frontend/src/lib/components/mcp/McpConnect.svelte
index 19b4d32209..1fe1a2fed9 100644
--- a/frontend/src/lib/components/mcp/McpConnect.svelte
+++ b/frontend/src/lib/components/mcp/McpConnect.svelte
@@ -27,9 +27,12 @@
 		/** Required: a caller that forgot it would create the connection in whichever
 		 * workspace the ui happens to be showing, not the one it operates on. */
 		workspace: string
+		/** Off where the surface around it already draws a card — a popover panel —
+		 * so the two do not stack a border and a background on each other. */
+		bordered?: boolean
 	}
 
-	let { onConnected, onCancel, workspace }: Props = $props()
+	let { onConnected, onCancel, workspace, bordered = true }: Props = $props()
 
 	let ws = $derived(workspace)
 	// Any URL is connectable; a suggestion is a shortcut that also pins how the
@@ -130,13 +133,6 @@
 	let canSignIn = $derived(
 		oauthAppReady || (canDiscover && !!$enterpriseLicense && discoveryFoundOAuth !== false)
 	)
-	// The action button names the credential, not the outcome, so the path field
-	// says what clicking it will leave behind.
-	let pathNote = $derived(
-		canSignIn && !showToken
-			? 'Signing in saves the connection at this path, as an'
-			: 'The connection is saved at this path, as an'
-	)
 	// Why the token field is the only way in, said where the token is asked for.
 	let tokenNote = $derived(
 		needsOauthApp && entry
@@ -338,7 +334,11 @@
 	}
 </script>
 
-<div class="border rounded p-4 bg-surface-tertiary flex flex-col gap-4">
+<div
+	class={bordered
+		? 'border rounded p-4 bg-surface-tertiary flex flex-col gap-4'
+		: 'flex flex-col gap-4'}
+>
 	<div class="flex justify-between items-center">
 		<span class="text-sm font-semibold text-emphasis">Connect an MCP server</span>
 		{#if onCancel}
@@ -442,8 +442,12 @@
 		{/if}
 
 		<Label label="Save MCP connection to">
+			<!-- The path decides who gets the connection, and its token with it: the backend
+			     reads both off the path (`u/<name>` is that user's, `f/<folder>` is everyone
+			     with read on the folder), so this is the one place to say so. -->
 			<span class="text-xs text-secondary">
-				{pathNote}
+				Under <span class="font-mono">u/{$userStore?.username ?? 'you'}</span> it is yours alone; in
+				a folder, everyone in it can use the connection and its token. Saved as an
 				<a
 					href="{base}/resources?workspace={ws}"
 					target="_blank"
diff --git a/frontend/src/lib/components/mcp/mcpMenu.svelte.ts b/frontend/src/lib/components/mcp/mcpMenu.svelte.ts
new file mode 100644
index 0000000000..847c03e61a
--- /dev/null
+++ b/frontend/src/lib/components/mcp/mcpMenu.svelte.ts
@@ -0,0 +1,197 @@
+import { List, Plug, Plus } from 'lucide-svelte'
+import type { Component } from 'svelte'
+import { get } from 'svelte/store'
+import { ResourceService } from '$lib/gen'
+import { workspaceStore } from '$lib/stores'
+import { sendUserToast } from '$lib/toast'
+import type { Item } from '$lib/utils'
+import type { AIChatManager } from '../copilot/chat/AIChatManager.svelte'
+import { isMcpEnabled, setMcpEnabled } from './enabledServers'
+import { cachedProviderKey, rememberProviderKey } from './iconCache'
+import { loadProviderIcon } from './providerIcon'
+
+type Row = {
+	path: string
+	editedAt?: string
+	enabled: boolean
+	icon?: Component<any>
+}
+
+// A menu is a shortcut, not a directory: past this many the list stops being
+// scannable, so the rest are reached through the settings modal rather than dropped.
+const MAX_MENU_SERVERS = 8
+// A row whose provider is already cached paints from the cache; the rest cost one
+// read each, and a long list stops asking rather than firing a request storm at a
+// menu nobody is reading that far down.
+const MAX_ICON_LOOKUPS = 20
+
+/**
+ * The chat "+" menu's MCP submenu: one row per connected server, checked when it
+ * is on, then the way to manage them. Connecting and deleting live in the
+ * assistant settings modal, which `onManage` opens.
+ */
+export class McpMenu {
+	#manager: AIChatManager
+	#onManage: () => void
+	#seq = 0
+	/** Rows for the workspace named by `#rowsWorkspace`, and meaningless for any other. */
+	#rows = $state<Row[]>([])
+	#rowsWorkspace: string | undefined = undefined
+
+	constructor(manager: AIChatManager, onManage: () => void) {
+		this.#manager = manager
+		this.#onManage = onManage
+	}
+
+	// A session chat operates on its own (possibly forked) workspace without
+	// switching `workspaceStore`, and that is the workspace the chat reads the
+	// enabled set under. Key everything here the same way or a toggle lands under
+	// a key nothing reads. Read per call rather than derived: the menu is built
+	// on open, so there is no stale snapshot to keep current between opens.
+	get #ws(): string | undefined {
+		return this.#manager.operatingWorkspace ?? get(workspaceStore) ?? undefined
+	}
+
+	async #load(ws: string) {
+		const seq = ++this.#seq
+		try {
+			const resources = await ResourceService.listResource({
+				workspace: ws,
+				resourceType: 'mcp',
+				perPage: 100
+			})
+			if (seq !== this.#seq) return
+			this.#rows = resources.map((r) => ({
+				path: r.path,
+				editedAt: r.edited_at,
+				enabled: isMcpEnabled(ws, r.path)
+			}))
+			this.#rowsWorkspace = ws
+			void this.#loadIcons(ws, seq)
+		} catch {
+			// The menu's other entries still work; an MCP submenu that failed to load
+			// is better empty than blocking the whole "+" menu behind an error.
+			if (seq !== this.#seq) return
+			this.#rows = []
+			this.#rowsWorkspace = ws
+		}
+	}
+
+	async #loadIcons(ws: string, seq: number) {
+		let lookups = 0
+		await Promise.all(
+			this.#rows.map(async (server) => {
+				let key = cachedProviderKey(ws, server.path, server.editedAt)
+				if (key === undefined) {
+					if (lookups >= MAX_ICON_LOOKUPS) return
+					lookups++
+					try {
+						const resource = await ResourceService.getResource({
+							workspace: ws,
+							path: server.path
+						})
+						key = rememberProviderKey(
+							ws,
+							server.path,
+							(resource.value as { url?: unknown } | undefined)?.url,
+							server.editedAt
+						)
+					} catch {
+						return
+					}
+				}
+				const icon = await loadProviderIcon(key)
+				if (seq !== this.#seq) return
+				server.icon = icon
+			})
+		)
+	}
+
+	#row(path: string) {
+		return this.#rows.find((s) => s.path === path)
+	}
+
+	async #toggle(ws: string, path: string, enabled: boolean) {
+		// A session whose fork is still staged has no workspace of its own yet, so `ws`
+		// is the PARENT: the selection would be stored under it and quietly stop
+		// applying the moment the first send commits the fork.
+		const pendingForkOf = this.#manager.sessionContextResolver?.()?.pendingForkOf
+		if (pendingForkOf !== undefined) {
+			sendUserToast(
+				`This session has not created its workspace yet, so the selection would be stored under "${pendingForkOf}". Send a message first.`,
+				true
+			)
+			return
+		}
+		// Local preference only: nothing to re-read from the API, and the cached
+		// tool lists stay valid because the servers are unchanged. Checked, like the
+		// skills submenu: a refused write leaves the chat carrying a different set than
+		// the check mark shows.
+		if (!setMcpEnabled(ws, path, enabled)) {
+			sendUserToast('Could not save the selection for this account.', true)
+			return
+		}
+		const row = this.#row(path)
+		if (row) row.enabled = enabled
+		await this.#manager.refreshMcpServers(ws)
+	}
+
+	/** Loaded on open so the checks are current. */
+	async items(closeMenu?: () => void): Promise<Item[]> {
+		const ws = this.#ws
+		if (!ws) return []
+		// The menu opens on what is already known and refreshes behind it: awaited
+		// inline it would stall the whole "+" menu, attachments included. Rows for
+		// another workspace are not "already known" — same path, different server.
+		if (this.#rowsWorkspace !== ws) {
+			this.#rows = []
+			await this.#load(ws)
+		} else {
+			void this.#load(ws)
+		}
+		// Enabled first: those are the ones a quick visit is most likely about.
+		const ordered = [...this.#rows].sort(
+			(a, b) => Number(b.enabled) - Number(a.enabled) || a.path.localeCompare(b.path)
+		)
+		const shown = ordered.slice(0, MAX_MENU_SERVERS)
+		const manage = () => {
+			closeMenu?.()
+			this.#onManage()
+		}
+		// Bound out here because the getters below sit on plain object literals,
+		// where `this` is the item rather than this menu.
+		const row = (path: string) => this.#row(path)
+		return [
+			...shown.map(({ path }) => ({
+				displayName: path,
+				// Getters, not snapshots: the menu stays open across a click, and it has
+				// to read through the live list rather than the row captured here, since
+				// a reload replaces every row object and a getter bound to the old one
+				// would go on reporting the state it was built with.
+				get icon() {
+					// Plug where the provider is unknown, so one nameless server does not
+					// pull its label out of line with the rest.
+					return row(path)?.icon ?? Plug
+				},
+				// Provider icons take css lengths and ignore lucide's `size`, so without
+				// this one of them renders at its 24px default among 14px menu icons.
+				get iconProps() {
+					return row(path)?.icon ? { width: '14px', height: '14px' } : undefined
+				},
+				get toggle() {
+					return row(path)?.enabled ?? false
+				},
+				action: () => this.#toggle(ws, path, !row(path)?.enabled)
+			})),
+			...(ordered.length > shown.length
+				? [{ displayName: `Show all ${ordered.length}`, icon: List, action: manage }]
+				: []),
+			{
+				displayName: 'Connect a server',
+				icon: Plus,
+				separatorTop: this.#rows.length > 0,
+				action: manage
+			}
+		]
+	}
+}
diff --git a/frontend/src/lib/components/mcp/secretVariable.ts b/frontend/src/lib/components/mcp/secretVariable.ts
index aadd9ac0a8..e84a5ac641 100644
--- a/frontend/src/lib/components/mcp/secretVariable.ts
+++ b/frontend/src/lib/components/mcp/secretVariable.ts
@@ -12,7 +12,7 @@ function mcpTokenDescription(resourcePath: string): string {
 /**
  * Store a connection's token at `path`.
  *
- * Disconnecting an MCP server deletes the resource but deliberately keeps its
+ * Deleting an MCP connection deletes the resource but deliberately keeps its
  * token variable, because `delete_resource` cascade-deletes every variable the
  * value references and that credential may still belong to another resource. So
  * reconnecting the same server lands on an existing path, which is the only case
diff --git a/frontend/src/lib/components/raw_apps/RawAppTemplatePicker.svelte b/frontend/src/lib/components/raw_apps/RawAppTemplatePicker.svelte
index fc8abd5d5c..7ead1f6fb0 100644
--- a/frontend/src/lib/components/raw_apps/RawAppTemplatePicker.svelte
+++ b/frontend/src/lib/components/raw_apps/RawAppTemplatePicker.svelte
@@ -345,70 +345,73 @@
 				{/if}
 			</div>
 
-			<div class="pt-6">
-				<h2 class="text-xs font-semibold text-emphasis mb-1 flex items-center gap-2">
-					<Sparkles size={16} class="text-ai" />
-					Start with AI
-					<span class="text-xs font-normal text-tertiary">(optional)</span>
-				</h2>
+			{#if !$copilotInfo.workspaceDisabled}
+				<div class="pt-6">
+					<h2 class="text-xs font-semibold text-emphasis mb-1 flex items-center gap-2">
+						<Sparkles size={16} class="text-ai" />
+						Start with AI
+						<span class="text-xs font-normal text-tertiary">(optional)</span>
+					</h2>
 
-				{#if !aiConfigLoaded}
-					<div class="flex items-center gap-2 text-xs text-tertiary">
-						<Loader2 size={14} class="animate-spin" />
-						Loading AI settings...
-					</div>
-				{:else if !isAiEnabled}
-					<Alert type="info" title="AI is not configured.">
-						You can still create an app manually but using AI is highly recommended.
-						<br />
-						{#if $userStore?.is_admin}
-							Configure AI in
-							<a
-								href="{base}/workspace_settings?tab=ai"
-								target="_blank"
-								class="inline-flex items-center gap-1 font-semibold"
-								>workspace settings <ExternalLinkIcon size={16} />
-							</a>
-							{#if $superadmin}
-								or
+					{#if !aiConfigLoaded}
+						<div class="flex items-center gap-2 text-xs text-tertiary">
+							<Loader2 size={14} class="animate-spin" />
+							Loading AI settings...
+						</div>
+					{:else if !isAiEnabled}
+						<Alert type="info" title="AI is not configured.">
+							You can still create an app manually but using AI is highly recommended.
+							<br />
+							{#if $userStore?.is_admin}
+								Configure AI in
+								<a
+									href="{base}/workspace_settings?tab=ai"
+									target="_blank"
+									class="inline-flex items-center gap-1 font-semibold"
+									>workspace settings <ExternalLinkIcon size={16} />
+								</a>
+								{#if $superadmin}
+									or
+									<a
+										href="{base}/?workspace=admins#superadmin-settings"
+										target="_blank"
+										class="inline-flex items-center gap-1 font-semibold"
+										>instance settings <ExternalLinkIcon size={16} />
+									</a>
+								{/if} to enable this feature.
+							{:else if $superadmin}
+								Configure AI in
 								<a
 									href="{base}/?workspace=admins#superadmin-settings"
 									target="_blank"
 									class="inline-flex items-center gap-1 font-semibold"
 									>instance settings <ExternalLinkIcon size={16} />
-								</a>
-							{/if} to enable this feature.
-						{:else if $superadmin}
-							Configure AI in
-							<a
-								href="{base}/?workspace=admins#superadmin-settings"
-								target="_blank"
-								class="inline-flex items-center gap-1 font-semibold"
-								>instance settings <ExternalLinkIcon size={16} />
-							</a> to enable this feature.
-						{:else}
-							Ask your workspace admin to configure AI in workspace settings to enable this feature.
-						{/if}
-					</Alert>
-				{:else}
-					<div class="flex flex-col gap-2">
-						<TextInput
-							underlyingInputEl="textarea"
-							bind:value={initialPrompt}
-							inputProps={{
-								rows: 3,
-								placeholder:
-									"Describe what you want to build... (e.g., 'Create a todo list app with user authentication')"
-							}}
-						/>
-						<p class="text-xs text-tertiary">
-							{handsOffToSession
-								? 'Leave empty to start with a blank template, or describe your app to open an AI session that builds it.'
-								: 'Leave empty to start with a blank template, or describe your app to get AI assistance right away.'}
-						</p>
-					</div>
-				{/if}
-			</div>
+								</a> to enable this feature.
+							{:else}
+								Ask your workspace admin to configure AI in workspace settings to enable this
+								feature.
+							{/if}
+						</Alert>
+					{:else}
+						<div class="flex flex-col gap-2">
+							<TextInput
+								underlyingInputEl="textarea"
+								bind:value={initialPrompt}
+								inputProps={{
+									rows: 3,
+									placeholder:
+										"Describe what you want to build... (e.g., 'Create a todo list app with user authentication')"
+								}}
+							/>
+							<p class="text-xs text-tertiary">
+								{handsOffToSession
+									? 'Leave empty to start with a blank template, or describe your app to open an AI session that builds it.'
+									: 'Leave empty to start with a blank template, or describe your app to get AI assistance right away.'}
+							</p>
+						</div>
+					{/if}
+				</div>
+			{/if}
 
 			<div class="pt-6 flex justify-end gap-3">
 				<Button
@@ -417,7 +420,7 @@
 					on:click={() => start(false)}
 					disabled={!templates[selectedTemplateIndex] || newSchemaAlreadyExists}
 				>
-					Start without AI
+					{$copilotInfo.workspaceDisabled ? 'Start' : 'Start without AI'}
 				</Button>
 				{#if isAiEnabled}
 					<Button
diff --git a/frontend/src/lib/components/search/GlobalSearchModal.svelte b/frontend/src/lib/components/search/GlobalSearchModal.svelte
index 3df633d167..a117d2769c 100644
--- a/frontend/src/lib/components/search/GlobalSearchModal.svelte
+++ b/frontend/src/lib/components/search/GlobalSearchModal.svelte
@@ -49,6 +49,7 @@
 	import NatsIcon from '../icons/NatsIcon.svelte'
 	import RunsSearch from './RunsSearch.svelte'
 	import AskAiButton from '../copilot/AskAiButton.svelte'
+	import { copilotInfo } from '$lib/aiStore'
 
 	let open: boolean = $state(false)
 
@@ -648,7 +649,7 @@
 							{placeholderFromPrefix(searchTerm)}
 						</label>
 					</div>
-					{#if (itemMap[tab] ?? []).length === 0 && searchTerm.length > 0}
+					{#if (itemMap[tab] ?? []).length === 0 && searchTerm.length > 0 && !$copilotInfo.workspaceDisabled}
 						<AskAiButton
 							bind:this={askAiButton}
 							label="Ask AI"
@@ -724,16 +725,18 @@
 
 						{#if (itemMap[tab] ?? []).length === 0}
 							<div class="p-2">
-								<QuickMenuItem
-									onselect={() => {
-										askAiButton?.onClick()
-									}}
-									id={'ai:no-results-ask-ai'}
-									hovered={true}
-									label={`Try asking \`${searchTerm}\` to AI`}
-									icon={WandSparkles}
-									bind:mouseMoved
-								/>
+								{#if !$copilotInfo.workspaceDisabled}
+									<QuickMenuItem
+										onselect={() => {
+											askAiButton?.onClick()
+										}}
+										id={'ai:no-results-ask-ai'}
+										hovered={true}
+										label={`Try asking \`${searchTerm}\` to AI`}
+										icon={WandSparkles}
+										bind:mouseMoved
+									/>
+								{/if}
 								<div class="flex w-full justify-center items-center">
 									<div class="text-primary text-center">
 										<div class="pt-1 text-sm">Tip: press `esc` to quickly clear the search bar</div>
diff --git a/frontend/src/lib/components/sessions/OpenInSessionButton.svelte b/frontend/src/lib/components/sessions/OpenInSessionButton.svelte
index 00bf1c829e..03ce21589e 100644
--- a/frontend/src/lib/components/sessions/OpenInSessionButton.svelte
+++ b/frontend/src/lib/components/sessions/OpenInSessionButton.svelte
@@ -40,6 +40,7 @@
 	import AIButton from '$lib/components/copilot/chat/AIButton.svelte'
 	import { AIBtnClasses } from '$lib/components/copilot/chat/AIButtonStyle'
 	import { prefersSessionHandoff } from '$lib/components/copilot/chat/global/gate'
+	import { copilotInfo } from '$lib/aiStore'
 	import { userStore } from '$lib/stores'
 	import { sendUserToast } from '$lib/toast'
 	import { openSourceInSession } from './sessionSwitch.svelte'
@@ -80,7 +81,9 @@
 	// them, so an entry point on a page they can reach (Runs, the trigger lists)
 	// would only route them into that refusal.
 	const show = $derived(
-		!inSessionPanel && !!(source?.target || source?.page) && prefersSessionHandoff($userStore?.operator)
+		!inSessionPanel &&
+			!!(source?.target || source?.page) &&
+			prefersSessionHandoff($userStore?.operator)
 	)
 
 	// Not $state: only read inside open() as a re-entrancy latch, never rendered.
@@ -102,7 +105,10 @@
 	}
 </script>
 
-{#if show}
+{#if $copilotInfo.workspaceDisabled}
+	<!-- The workspace hid the assistant: neither the hand-off nor the docked-chat
+	     fallback has anywhere to lead, so no host renders an AI button at all. -->
+{:else if show}
 	<AIButton
 		togglePanel={open}
 		btnClasses={btnClasses ?? AIBtnClasses('default')}
diff --git a/frontend/src/lib/components/sessions/SessionModeSwitch.svelte b/frontend/src/lib/components/sessions/SessionModeSwitch.svelte
index d721b6f16f..9a7fb20bd6 100644
--- a/frontend/src/lib/components/sessions/SessionModeSwitch.svelte
+++ b/frontend/src/lib/components/sessions/SessionModeSwitch.svelte
@@ -2,8 +2,9 @@
 	import { Building, MessagesSquare } from 'lucide-svelte'
 	import ToggleButtonGroup from '$lib/components/common/toggleButton-v2/ToggleButtonGroup.svelte'
 	import ToggleButton from '$lib/components/common/toggleButton-v2/ToggleButton.svelte'
-	import { enterSessionMode, exitSessionMode } from './sessionSwitch.svelte'
+	import { enterSessionModeFromNav, exitSessionMode } from './sessionSwitch.svelte'
 	import { goto } from '$lib/navigation'
+	import { sendUserToast } from '$lib/toast'
 	import { page } from '$app/state'
 	import { base } from '$lib/base'
 
@@ -17,11 +18,25 @@
 		onToggle
 	}: { mode: 'nav' | 'session'; isCollapsed?: boolean; onToggle?: () => void } = $props()
 
+	// The group's highlighted side. Melt moves it on click, before the navigation
+	// that would change `mode`, so it is derived from the route (which wins once
+	// a switch navigates) and pushed back when one does not, or the rail would
+	// read "AI Sessions" on an editor page with the clicked side inert until
+	// "Workspace" was pressed first.
+	let selected: string | string[] | null | undefined = $derived(mode)
+
 	function onSelected(next: 'nav' | 'session') {
 		if (next === mode) return
 		onToggle?.()
-		if (next === 'session') void enterSessionMode()
-		else void exitSessionMode()
+		if (next === 'session') {
+			// An editor whose draft could not be persisted keeps the user on the
+			// page, as its own "Open in AI session" button does, rather than open a
+			// session on an older draft than the one on screen.
+			void enterSessionModeFromNav().catch((e) => {
+				selected = mode
+				sendUserToast(e instanceof Error ? e.message : String(e), true)
+			})
+		} else void exitSessionMode()
 	}
 
 	// Pressing the already-active "Workspace" side goes home, so the toggle doubles
@@ -41,7 +56,7 @@
      child of the group's track — so the buttons fill the rail width only if those
      wrappers grow. `[&>*]:flex-1` makes every direct child split the track evenly. -->
 <ToggleButtonGroup
-	selected={mode}
+	bind:selected
 	{onSelected}
 	tabListClass={isCollapsed ? 'flex-col w-full [&>*]:w-full' : 'w-full [&>*]:flex-1'}
 >
diff --git a/frontend/src/lib/components/sessions/SessionPicker.svelte b/frontend/src/lib/components/sessions/SessionPicker.svelte
index 87462e301b..e5b62da0eb 100644
--- a/frontend/src/lib/components/sessions/SessionPicker.svelte
+++ b/frontend/src/lib/components/sessions/SessionPicker.svelte
@@ -1,5 +1,6 @@
 <script lang="ts">
 	import ConfirmationModal from '$lib/components/common/confirmationModal/ConfirmationModal.svelte'
+	import Modal from '$lib/components/common/modal/Modal.svelte'
 	import Checkbox from '$lib/components/common/checkbox/Checkbox.svelte'
 	import { Badge, Button } from '$lib/components/common'
 	import {
@@ -22,6 +23,7 @@
 	import { twMerge } from 'tailwind-merge'
 	import TextInput from '$lib/components/text_input/TextInput.svelte'
 	import { goto } from '$lib/navigation'
+	import { takeNewSessionSeed, type NewSessionSeed } from './sessionSwitch.svelte'
 	import { useLocalStorageValue } from '$lib/svelte5Utils.svelte'
 	import { slide } from 'svelte/transition'
 	import {
@@ -414,17 +416,52 @@
 	}
 
 	async function createAndOpen() {
-		const fresh = createSession()
 		// A new session opened from a Windmill page adopts that page as its first
-		// preview tab. Skip when already on the sessions page (nothing meaningful to
-		// capture) so the preview starts empty until the chat opens something.
+		// preview tab.
 		if (!onSessionsPage) {
-			const url = page.url.pathname + page.url.search
-			resetSessionPreviewTabs(fresh.id, url)
+			await createAndOpenWith(page.url.pathname + page.url.search)
+			return
 		}
+		// On the sessions page there is nothing meaningful on screen to capture,
+		// except the item the user just left to get here: that one is offered (once)
+		// before the session is created, and answerSeedOffer picks up from there.
+		const seed = takeNewSessionSeed()
+		if (seed) {
+			seedOffer = seed
+			seedOfferOpen = true
+			return
+		}
+		await createAndOpenWith(undefined)
+	}
+
+	// `previewUrl` undefined leaves the preview empty until the chat opens something.
+	async function createAndOpenWith(previewUrl: string | undefined) {
+		const fresh = createSession()
+		if (previewUrl) resetSessionPreviewTabs(fresh.id, previewUrl)
 		await activate(fresh)
 	}
 
+	// The item createAndOpen is asking about. Closing the dialog any other way than
+	// answering (Escape, the corner X, the backdrop) creates nothing: the click was
+	// met with a question, not a session. Kept after the dialog closes, since the
+	// title reads it through the close fade; `seedOfferOpen` alone gates rendering.
+	let seedOffer = $state<NewSessionSeed | undefined>(undefined)
+	let seedOfferOpen = $state(false)
+	// Focus moves onto the primary answer as the dialog opens. Enter is left to
+	// the focused button (the dialog does not bind it), and the "New session"
+	// button that opened the dialog would otherwise keep focus and answer Enter
+	// with a second, unasked session underneath.
+	let keepButton: Button | undefined = $state(undefined)
+	$effect(() => {
+		if (seedOfferOpen) keepButton?.focus()
+	})
+	async function answerSeedOffer(keep: boolean) {
+		const offer = seedOffer
+		seedOfferOpen = false
+		if (!offer) return
+		await createAndOpenWith(keep ? offer.url : undefined)
+	}
+
 	// The `+` on a workspace group header: a new session parked on that group's
 	// workspace rather than the one currently open.
 	async function createAndOpenIn(workspaceId: string) {
@@ -1300,3 +1337,30 @@
 		{/if}
 	</div>
 </ConfirmationModal>
+
+<!-- Two answers of equal standing, so Enter is left to whichever button has
+     focus rather than bound to one of them by the dialog. -->
+<Modal
+	bind:open={seedOfferOpen}
+	kind="X"
+	enterConfirms={false}
+	title="Keep this {seedOffer?.route.kind ?? 'item'} in the new session?"
+	description="You came here from {seedOffer?.route.itemPath ?? ''}."
+>
+	<p class="text-sm text-secondary">
+		Keeping it opens it in the preview, so the chat starts with it as context.
+	</p>
+	<div class="flex justify-end gap-2 mt-4">
+		<Button variant="default" unifiedSize="sm" onClick={() => answerSeedOffer(false)}>
+			Start empty
+		</Button>
+		<Button
+			bind:this={keepButton}
+			variant="accent"
+			unifiedSize="sm"
+			onClick={() => answerSeedOffer(true)}
+		>
+			Keep in preview
+		</Button>
+	</div>
+</Modal>
diff --git a/frontend/src/lib/components/sessions/openInSessionContext.ts b/frontend/src/lib/components/sessions/openInSessionContext.ts
index 27284802cc..ddecb01b4f 100644
--- a/frontend/src/lib/components/sessions/openInSessionContext.ts
+++ b/frontend/src/lib/components/sessions/openInSessionContext.ts
@@ -1,5 +1,6 @@
-import { getContext, setContext } from 'svelte'
+import { getContext, onDestroy, setContext } from 'svelte'
 import type { OpenInSessionSource } from './OpenInSessionButton.svelte'
+import type { PreviewItemRoute } from './previewPaths'
 
 // The "Open in AI session" hand-off, published by the component that owns the
 // item being edited (FlowBuilder, RawAppEditor) for AI entry points too deep in
@@ -14,10 +15,43 @@ export type OpenInSessionHandoff = {
 	source: (opts?: { moduleId?: string }) => OpenInSessionSource | undefined
 }
 
+// The hand-offs of every editor currently mounted. The navigation rail's "AI
+// Sessions" switch sits above every page, out of reach of the context, and
+// looks the editor of the item it is leaving up here instead.
+const mounted = new Set<OpenInSessionHandoff>()
+
 export function setOpenInSessionHandoff(handoff: OpenInSessionHandoff): void {
 	setContext(KEY, handoff)
+	onDestroy(registerMountedOpenInSessionHandoff(handoff))
+}
+
+/** Count `handoff` as mounted until the returned unregister runs. Split from
+ * setOpenInSessionHandoff so the registry can be driven outside a component. */
+export function registerMountedOpenInSessionHandoff(handoff: OpenInSessionHandoff): () => void {
+	mounted.add(handoff)
+	return () => {
+		mounted.delete(handoff)
+	}
 }
 
 export function getOpenInSessionHandoff(): OpenInSessionHandoff | undefined {
 	return getContext<OpenInSessionHandoff | undefined>(KEY)
 }
+
+/** The mounted editor's hand-off for the item `route` names, or undefined when
+ * no editor on screen publishes one for it (a legacy app, a detail page).
+ * Matched on the item rather than taken as "the latest registered": a script
+ * editor mounted in a flow's drawer registers too, and the rail wants the
+ * page's own item. */
+export function findMountedOpenInSessionSource(
+	route: PreviewItemRoute
+): OpenInSessionSource | undefined {
+	const kind = route.kind === 'app' ? (route.raw_app ? 'raw_app' : undefined) : route.kind
+	if (!kind) return undefined
+	for (const handoff of mounted) {
+		const source = handoff.source()
+		const target = source?.target
+		if (target && target.kind === kind && target.path === route.itemPath) return source
+	}
+	return undefined
+}
diff --git a/frontend/src/lib/components/sessions/sessionRuntime.svelte.ts b/frontend/src/lib/components/sessions/sessionRuntime.svelte.ts
index fc0d291190..c49a464962 100644
--- a/frontend/src/lib/components/sessions/sessionRuntime.svelte.ts
+++ b/frontend/src/lib/components/sessions/sessionRuntime.svelte.ts
@@ -29,6 +29,12 @@ import { userWorkspaces, workspaceStore } from '$lib/stores'
 import { copilotWorkspace } from '$lib/aiStore'
 import { loadCopilot } from '$lib/components/copilot/loadCopilot'
 import { emptySchema, type StateStore } from '$lib/utils'
+import {
+	localRunEnded,
+	localRunStarted,
+	onRemoteTurnEnd,
+	runHeldElsewhere
+} from './sessionSync.svelte'
 import {
 	commitSessionWorkspace,
 	deleteSession as deleteSessionState,
@@ -338,6 +344,15 @@ function createRuntime(session: Session): SessionRuntime {
 	// Carried into the tool helpers so this session's preview/deploy tool calls
 	// dispatch to THIS session even when another session is the UI-active one.
 	manager.sessionId = session.id
+	// Cross-tab awareness: heartbeat while this tab runs a turn, composer lock
+	// (and send refusal) while another tab does. The chat id is read at turn
+	// end, not captured at start — the turn may have rotated it, and the other
+	// tabs re-read whichever record it ended on.
+	manager.runHeldElsewhereResolver = () => runHeldElsewhere(session.id)
+	manager.onRunningChanged = (running) => {
+		if (running) localRunStarted(session.id, manager.historyManager.getCurrentChatId())
+		else localRunEnded(session.id, manager.historyManager.getCurrentChatId())
+	}
 	// The chat targets the session's OWN (possibly forked) workspace without
 	// switching the global workspaceStore. Resolved live from the session record
 	// so it tracks the pending → committed (and staged-fork) transitions.
@@ -504,6 +519,12 @@ function createRuntime(session: Session): SessionRuntime {
 	// Key the store before any configureGlobalMode runs, so a new session's first create shows at once.
 	void manager.artifacts.setSession(session.id)
 
+	// Assigning `manager.mode` above only records the mode; this builds the tool set
+	// and system prompt from it. Keep it here, after the resolvers and the artifact
+	// store it reads, and not on `changeMode`: a runtime exists per session the
+	// picker lists, so changeMode's network refreshes would fire once per listing.
+	manager.configureGlobalMode()
+
 	// Pipeline target state lives on the runtime (not the PipelineEditorView
 	// component) so the in-session drafts survive hide/show of the editor pane —
 	// the pane unmounts on hide, and a component-local store would be discarded.
@@ -958,6 +979,65 @@ export function getRuntime(sessionId: string): SessionRuntime | undefined {
 	return runtimes.get(sessionId)
 }
 
+// ---------------------------------------------------------------------------
+// Cross-tab catch-up
+// ---------------------------------------------------------------------------
+
+// Chained per session so two turn-ends close together (a turn plus its queued
+// follow-up) re-read sequentially: the later read starts after the earlier
+// one's loadPastChat, so the newest record is what ends up on screen.
+const catchUps = new Map<string, Promise<void>>()
+
+onRemoteTurnEnd((sessionId, chatId) => {
+	const next = (catchUps.get(sessionId) ?? Promise.resolve())
+		.then(() => applyRemoteTurnEnd(sessionId, chatId))
+		.catch((e) => console.error('Failed to catch up on a turn from another tab', e))
+	catchUps.set(sessionId, next)
+	void next.finally(() => {
+		if (catchUps.get(sessionId) === next) catchUps.delete(sessionId)
+	})
+	// Awaited by the caller: the composer unlock rides on this settling.
+	return next
+})
+
+async function applyRemoteTurnEnd(sessionId: string, chatId: string): Promise<void> {
+	const runtime = runtimes.get(sessionId)
+	if (!runtime) return
+	const m = runtime.manager
+	// Two transient states get a short retry rather than a skip, because the
+	// composer unlocks when this promise settles and a skip would unlock it on
+	// stale history: a send of this tab's own still in preflight (it may yet be
+	// refused, leaving no turn to converge on), and a store that failed to
+	// open. A turn actually running here owns the transcript instead — its own
+	// end converges — and the pruner caps the whole hold at STALE_MS anyway.
+	for (let attempt = 0; ; attempt++) {
+		if (m.loading) return
+		if (!m.sendInFlight) {
+			const res = await m.historyManager.reloadChat(chatId)
+			if (res === 'missing') return
+			if (res === 'loaded') break
+		}
+		if (attempt >= 7) return
+		await new Promise((r) => setTimeout(r, 500))
+		if (runtimes.get(sessionId) !== runtime) return
+	}
+	// Disposed (session deleted, teardown) while the read was in flight.
+	if (runtimes.get(sessionId) !== runtime) return
+	// Adopts the driver's chat unconditionally, current view included: watching
+	// a session means following where its activity is, and it is also how tabs
+	// converge after an unsynced /clear rotation. A watcher browsing an older
+	// conversation is pulled along — deliberate, and the price of not syncing
+	// rotation as its own message.
+	//
+	// preserveQueue: this reload is a catch-up, not a conversation switch — a
+	// draft queued here (a refused send's kept message, a failed turn's card)
+	// is unsent user input the re-read must not destroy.
+	await m.loadPastChat(chatId, { preserveQueue: true })
+	// loadPastChat's own artifact sync no-ops for an unchanged session id, so
+	// artifacts the driver wrote during the turn need this forced re-read.
+	await m.artifacts.resyncFromStore()
+}
+
 // Point a session's preview at a single seed tab. For re-pointing an existing
 // draft session at a new destination ("Open in AI session" / new-session-from-
 // page on a reused transient): its previous tabs — persisted with the draft
diff --git a/frontend/src/lib/components/sessions/sessionState.svelte.ts b/frontend/src/lib/components/sessions/sessionState.svelte.ts
index 505af7a43a..0f22a23974 100644
--- a/frontend/src/lib/components/sessions/sessionState.svelte.ts
+++ b/frontend/src/lib/components/sessions/sessionState.svelte.ts
@@ -405,8 +405,9 @@ export function takeSessionAutoSend(sessionId: string): boolean {
 
 // Persist a session on a genuine user edit, promoting an in-memory-only
 // (transient) pending session to a durable IndexedDB record on first touch.
-// Non-touch writers (runtime chatId seeding, unread watermark) call putSession
-// directly, so an untouched draft stays in memory and vanishes on reload.
+// Non-touch writers (runtime chatId seeding via patchStoredSessionChatId, the
+// unread watermark via putSession) persist directly, so an untouched draft
+// stays in memory and vanishes on reload.
 function persistTouched(s: Session): void {
 	if (s.transient) delete s.transient
 	s.lastActivityAt = Date.now()
@@ -437,10 +438,10 @@ async function deleteSessionRow(db: IDBPDatabase<SessionSchema>, id: string): Pr
 	await db.delete('sessions', id)
 }
 
-// The one way to write a session's record, and the other half of the invariant above:
-// every caller reaches its write across an await — putSession on the DB handle, the
-// reconcile and hydrate passes on a getAll() snapshot that an interleaved delete
-// invalidates — so the tombstone has to be consulted here, not only at the entry points.
+// The way a session record is written (patchStoredSessionChatId is the one
+// exception: it re-checks the tombstone inline to stay inside its own
+// transaction). Every caller reaches its write across an await, so the
+// tombstone has to be consulted here, not only at the entry points.
 async function putSessionRow(db: IDBPDatabase<SessionSchema>, s: Session): Promise<void> {
 	if (deletedSessionIds.has(s.id)) return
 	await db.put('sessions', s)
@@ -1151,7 +1152,36 @@ export function setSessionChatId(sessionId: string, chatId: string) {
 	const s = sessionState.sessions.find((x) => x.id === sessionId)
 	if (s && s.chatId !== chatId) {
 		s.chatId = chatId
-		void putSession(s)
+		void patchStoredSessionChatId(s, chatId)
+	}
+}
+
+// Persists the pointer through the STORED row, not this tab's copy: another
+// tab may have written newer fields (summary, tabs, archive state) since this
+// tab last read the record, and a whole-object put would roll them back — a
+// watcher adopting the driver's rotation reaches here with exactly that copy.
+async function patchStoredSessionChatId(s: Session, chatId: string): Promise<void> {
+	if (!BROWSER || s.transient || deletedSessionIds.has(s.id)) return
+	const db = await sessionsDb.whenReady()
+	if (!db) return
+	try {
+		const tx = db.transaction('sessions', 'readwrite')
+		const stored = await tx.store.get(s.id)
+		// Inline tombstone re-check in place of putSessionRow's: routing through
+		// it would put outside this transaction and lose the read's atomicity.
+		if (stored && !deletedSessionIds.has(s.id)) {
+			stored.chatId = chatId
+			await tx.store.put(stored)
+			await tx.done
+			return
+		}
+		await tx.done
+		// No stored row: either the record is not yet persisted — its own
+		// materialization writes it later with the chatId already set in memory —
+		// or another tab deleted it, and an upsert here would resurrect it. No
+		// write either way.
+	} catch (e) {
+		console.error('Failed to persist session chat id', e)
 	}
 }
 
diff --git a/frontend/src/lib/components/sessions/sessionStateIndexedDb.test.ts b/frontend/src/lib/components/sessions/sessionStateIndexedDb.test.ts
index 6a88fd53fe..d0063f0a97 100644
--- a/frontend/src/lib/components/sessions/sessionStateIndexedDb.test.ts
+++ b/frontend/src/lib/components/sessions/sessionStateIndexedDb.test.ts
@@ -50,6 +50,7 @@ import {
 	getSessionDraftPrompt,
 	setSessionDraftPrompt,
 	setSessionTabs,
+	setSessionChatId,
 	reconcileSessionsLifecycle,
 	__resetDeletedSessionIdsForTesting,
 	setSessionArchived,
@@ -117,6 +118,30 @@ describe('sessionState IndexedDB persistence', () => {
 		await vi.waitFor(() => expect(sessionState.sessions.map((s) => s.id)).toEqual(['s2', 's1']))
 	})
 
+	// A watcher adopting the driver's chat rotation holds a stale in-memory
+	// record; persisting the pointer must not roll back fields another tab
+	// wrote to the store since.
+	it('setSessionChatId patches the stored row instead of writing back a stale copy', async () => {
+		const user = freshUser()
+		await login(user)
+
+		const stale = session({ id: 's1', createdAt: 100, summary: 'old summary' })
+		await putSession(stale)
+		// A newer write from another tab, landing directly in the store.
+		await putSession(session({ id: 's1', createdAt: 100, summary: 'newer summary' }))
+
+		sessionState.sessions = [stale]
+		setSessionChatId('s1', 'chat-2')
+		await flush()
+
+		await rehydrate(user)
+		await vi.waitFor(() => {
+			const s = sessionState.sessions.find((x) => x.id === 's1')
+			expect(s?.chatId).toBe('chat-2')
+			expect(s?.summary).toBe('newer summary')
+		})
+	})
+
 	it('does not persist a transient (untouched) session — it is in-memory only', async () => {
 		const user = freshUser()
 		await login(user)
diff --git a/frontend/src/lib/components/sessions/sessionSwitch.svelte.ts b/frontend/src/lib/components/sessions/sessionSwitch.svelte.ts
index aded390394..a7a492b874 100644
--- a/frontend/src/lib/components/sessions/sessionSwitch.svelte.ts
+++ b/frontend/src/lib/components/sessions/sessionSwitch.svelte.ts
@@ -5,13 +5,17 @@ import {
 	createSession,
 	selectSession,
 	sessionInCurrentFamily,
+	sessionLastActivityAt,
 	sessionState,
 	setSessionAutoSend,
 	setSessionDraftPrompt,
 	setSessionPendingWorkspace,
+	type Session,
 	type SessionTarget
 } from './sessionState.svelte'
 import { sessionTargetHref, withPreviewParams } from './sessionMode.svelte'
+import { parsePreviewItemRoute, type PreviewItemRoute } from './previewPaths'
+import { findMountedOpenInSessionSource } from './openInSessionContext'
 // Type-only: erased at compile time, so the component graph stays out of this
 // navigation seam (see the dynamic import in openEditorInSession).
 import type { OpenInSessionSource } from './OpenInSessionButton.svelte'
@@ -27,33 +31,100 @@ import type { OpenInSessionSource } from './OpenInSessionButton.svelte'
 // is safe. Plain module state: it is read only inside click handlers, never
 // rendered, so it needs no reactivity.
 let lastNavRoute = '/'
+// Whether `lastNavRoute` has been offered as a new session's starting point since
+// it was remembered (see takeNewSessionSeed).
+let navRouteOffered = false
 
 export function rememberNavRoute(pathnameWithSearch: string): void {
 	lastNavRoute = pathnameWithSearch
+	navRouteOffered = false
 }
 
-// Enter session mode: open the active session if one is selected, else the most
-// recent non-archived session, else spin up a fresh one — then route to it.
-// Restore candidates are scoped to the active workspace family: reviving a
-// session from another family would pull that family's scope (sidebar list,
-// "Acting on" workspace) into the one the user is actually in.
+/** An item editor the user reached session mode from, as the in-app href a new
+ * session's preview can open, plus the item it edits (for naming it). */
+export type NewSessionSeed = { url: string; route: PreviewItemRoute }
+
+// The item (flow, script, app) the user came to session mode from, or undefined
+// when they came from anywhere else. A "New session" asked for after arriving
+// from an item is usually a session about that item, but the arrival route
+// (`enterSessionMode`) resumes whatever session was open, so the picker offers
+// the item back. Offered once per remembered route: the first "New session" of
+// a visit gets the question, however long the visit has run and whatever was
+// done in between; later ones start empty without asking, and a dismissed offer
+// is not repeated until the user leaves for another page and comes back.
+export function takeNewSessionSeed(): NewSessionSeed | undefined {
+	if (navRouteOffered) return undefined
+	navRouteOffered = true
+	const route = parsePreviewItemRoute(lastNavRoute)
+	return route ? { url: lastNavRoute, route } : undefined
+}
+
+// The session entering session mode resumes: the active one if selected, else
+// the most recent non-archived one. Scoped to the active workspace family:
+// reviving a session from another family would pull that family's scope
+// (sidebar list, "Acting on" workspace) into the one the user is actually in.
+function resumableSession(): Session | undefined {
+	const current = sessionState.currentSessionId
+		? sessionState.sessions.find((s) => s.id === sessionState.currentSessionId)
+		: undefined
+	return (
+		(current && sessionInCurrentFamily(current) ? current : undefined) ??
+		sessionState.sessions.find((s) => !s.archived && sessionInCurrentFamily(s))
+	)
+}
+
+// Enter session mode: resume the session `resumableSession` picks, else spin up
+// a fresh one — then route to it.
 // `replace` swaps the current history entry instead of pushing — for the
 // sessions page's family reconcile, where Back must not return to the
 // redirected-away URL just to bounce here again.
 export async function enterSessionMode(opts?: { replace?: boolean }): Promise<void> {
-	const current = sessionState.currentSessionId
-		? sessionState.sessions.find((s) => s.id === sessionState.currentSessionId)
-		: undefined
-	const target =
-		(current && sessionInCurrentFamily(current) ? current : undefined) ??
-		sessionState.sessions.find((s) => !s.archived && sessionInCurrentFamily(s)) ??
-		createSession()
+	const target = resumableSession() ?? createSession()
 	selectSession(target.id)
 	await goto(`/sessions?session_name=${encodeURIComponent(target.name)}`, {
 		replaceState: opts?.replace ?? false
 	})
 }
 
+// How long the resumable session may have sat idle before entering from an item
+// editor starts a session on that item instead. Long enough that stepping out to
+// the editor in the middle of a conversation comes back to the same chat; short
+// enough that a session left since the previous day is not taken for the task
+// the user is now on.
+const RESUME_IDLE_LIMIT_MS = 60 * 60 * 1000
+
+// Enter session mode from the navigation rail. Coming from an item editor with
+// no session to resume, or one idle past RESUME_IDLE_LIMIT_MS, opens a fresh
+// session on that item straight away: a session that old is rarely what a visit
+// from a flow or app is about, and landing in it would only lead to "New
+// session" and the offer takeNewSessionSeed makes. Anything else resumes as
+// enterSessionMode does. Rejects when the editor could not persist its draft,
+// so the caller can stay on the page and say so.
+export async function enterSessionModeFromNav(): Promise<void> {
+	const route = parsePreviewItemRoute(lastNavRoute)
+	if (route) {
+		const resumable = resumableSession()
+		if (!resumable || Date.now() - sessionLastActivityAt(resumable) > RESUME_IDLE_LIMIT_MS) {
+			// The editor's own hand-off is what its "Open in AI session" button uses:
+			// it persists the draft the preview loads (an edit still inside the
+			// autosave debounce, the row of a never-saved new item) and names the
+			// workspace the item lives in. Only an item with no such editor on
+			// screen (a legacy app, a detail page) is opened by route, as last
+			// persisted, in the workspace the route was scoped to.
+			const source = findMountedOpenInSessionSource(route)
+			if (source) await openSourceInSession(source)
+			else await openPageInSession(lastNavRoute, workspaceParamOf(lastNavRoute))
+			return
+		}
+	}
+	await enterSessionMode()
+}
+
+function workspaceParamOf(pathnameWithSearch: string): string | undefined {
+	const query = pathnameWithSearch.split('?')[1]
+	return query ? (new URLSearchParams(query).get('workspace') ?? undefined) : undefined
+}
+
 // Exit session mode: back to the last navigation route (home as a fallback).
 export async function exitSessionMode(): Promise<void> {
 	let target = lastNavRoute || '/'
@@ -90,9 +161,9 @@ export async function openEditorInSession(
 	)
 }
 
-// Open a fresh AI session showing a workspace page (Runs, a trigger list) in its
-// preview. A page is not an editable item, so callers hand over the in-app href
-// they want the tab to load rather than a SessionTarget.
+// Open a fresh AI session showing an in-app href in its preview: a workspace
+// page (Runs, a trigger list), which is not an editable item and so has no
+// SessionTarget, or a location captured as the user left it.
 export async function openPageInSession(
 	href: string,
 	workspaceId?: string,
@@ -121,6 +192,9 @@ async function openInSession(
 		// node-run unit tests.
 		const { resetSessionPreviewTabs } = await import('./sessionRuntime.svelte')
 		resetSessionPreviewTabs(session.id, url)
+		// Hand-offs seed the page they leave, so the arrival has opened the item
+		// itself and "New session" need not offer it again.
+		navRouteOffered = true
 	}
 	selectSession(session.id)
 	await goto(`/sessions?session_name=${encodeURIComponent(session.name)}`)
diff --git a/frontend/src/lib/components/sessions/sessionSwitch.test.ts b/frontend/src/lib/components/sessions/sessionSwitch.test.ts
index 616f5fe751..23ca52a693 100644
--- a/frontend/src/lib/components/sessions/sessionSwitch.test.ts
+++ b/frontend/src/lib/components/sessions/sessionSwitch.test.ts
@@ -2,8 +2,11 @@ import { describe, it, expect, vi, beforeEach } from 'vitest'
 import { get } from 'svelte/store'
 import {
 	enterSessionMode,
+	enterSessionModeFromNav,
 	openSourceInSession,
-	startSessionWithPrompt
+	rememberNavRoute,
+	startSessionWithPrompt,
+	takeNewSessionSeed
 } from './sessionSwitch.svelte'
 import {
 	peekSessionAutoSend,
@@ -20,6 +23,8 @@ import { goto } from '$lib/navigation'
 // monaco (hence that import being dynamic in the first place) and cannot load
 // under node.
 vi.mock('./sessionRuntime.svelte', () => ({ resetSessionPreviewTabs: vi.fn() }))
+import { resetSessionPreviewTabs } from './sessionRuntime.svelte'
+import { registerMountedOpenInSessionHandoff } from './openInSessionContext'
 
 function session(over: Partial<Session> = {}): Session {
 	return { id: 's1', name: 'sess', createdAt: 0, ...over }
@@ -248,3 +253,159 @@ describe('startSessionWithPrompt', () => {
 		}
 	})
 })
+
+describe('takeNewSessionSeed', () => {
+	it('offers the item editor the user came from, once per arrival', () => {
+		rememberNavRoute('/flows/edit/u/me/my_flow?workspace=ws')
+		expect(takeNewSessionSeed()).toEqual({
+			url: '/flows/edit/u/me/my_flow?workspace=ws',
+			route: { kind: 'flow', raw_app: false, itemPath: 'u/me/my_flow' }
+		})
+		// A dismissed or taken offer is not repeated until the user leaves again.
+		expect(takeNewSessionSeed()).toBeUndefined()
+		rememberNavRoute('/apps_raw/edit/f/team/dashboard?workspace=ws')
+		expect(takeNewSessionSeed()?.route).toEqual({
+			kind: 'app',
+			raw_app: true,
+			itemPath: 'f/team/dashboard'
+		})
+	})
+
+	it('offers nothing for a non-item page', () => {
+		rememberNavRoute('/runs?workspace=ws')
+		expect(takeNewSessionSeed()).toBeUndefined()
+	})
+})
+
+describe('enterSessionModeFromNav', () => {
+	const HOUR = 60 * 60 * 1000
+	beforeEach(() => {
+		vi.mocked(goto).mockClear()
+		vi.mocked(resetSessionPreviewTabs).mockClear()
+	})
+
+	// One session in the active family (rootA), as the one the rail would resume.
+	// Restores everything the test touched, the module-level nav route included,
+	// and drops whatever session the call under test created.
+	function withResumable(over: Partial<Session>): { restore: () => void } {
+		const restoreFamilies = withTwoFamilies('rootA')
+		const prevCurrent = sessionState.currentSessionId
+		const before = new Set(sessionState.sessions.map((s) => s.id))
+		const s = session({ workspace_id: 'rootA', ...over })
+		sessionState.sessions.push(s)
+		sessionState.currentSessionId = s.id
+		return {
+			restore: () => {
+				sessionState.sessions = sessionState.sessions.filter((x) => before.has(x.id))
+				sessionState.currentSessionId = prevCurrent
+				rememberNavRoute('/')
+				restoreFamilies()
+			}
+		}
+	}
+
+	it('resumes a recently active session even when coming from an item', async () => {
+		const { restore } = withResumable({
+			id: 'nav-recent',
+			name: 'session-921',
+			lastActivityAt: Date.now() - HOUR / 2
+		})
+		try {
+			rememberNavRoute('/flows/edit/u/me/f?workspace=rootA')
+			await enterSessionModeFromNav()
+			expect(sessionState.currentSessionId).toBe('nav-recent')
+			expect(resetSessionPreviewTabs).not.toHaveBeenCalled()
+		} finally {
+			restore()
+		}
+	})
+
+	it('starts a session on the item, by route, instead of resuming one idle for hours', async () => {
+		const { restore } = withResumable({
+			id: 'nav-stale',
+			name: 'session-922',
+			lastActivityAt: Date.now() - 3 * HOUR
+		})
+		try {
+			rememberNavRoute('/flows/edit/u/me/f?workspace=forkA')
+			await enterSessionModeFromNav()
+			const createdId = sessionState.currentSessionId
+			expect(createdId).not.toBe('nav-stale')
+			expect(resetSessionPreviewTabs).toHaveBeenCalledWith(
+				createdId,
+				'/flows/edit/u/me/f?workspace=forkA'
+			)
+			// The route's workspace, not createSession's pick for the active one.
+			const created = sessionState.sessions.find((s) => s.id === createdId)
+			expect(created?.pending_workspace_id).toBe('forkA')
+			// The arrival opened the item itself, so "New session" does not offer it.
+			expect(takeNewSessionSeed()).toBeUndefined()
+		} finally {
+			restore()
+		}
+	})
+
+	// The editor's hand-off is what its own "Open in AI session" button uses: its
+	// beforeOpen persists the draft the preview loads, and it names the item's
+	// workspace. The rail must take it over opening the route as last persisted.
+	it('hands off through the mounted editor of the item, running its beforeOpen first', async () => {
+		const { restore } = withResumable({
+			id: 'nav-stale-editor',
+			name: 'session-924',
+			lastActivityAt: Date.now() - 3 * HOUR
+		})
+		const order: string[] = []
+		vi.mocked(goto).mockImplementation((async () => {
+			order.push('goto')
+		}) as never)
+		// A script editor mounted alongside (a flow's drawer) must not be taken
+		// for the page's own item.
+		const unregisterScript = registerMountedOpenInSessionHandoff({
+			source: () => ({ target: { kind: 'script', path: 'u/me/s' }, workspaceId: 'rootB' })
+		})
+		const unregisterFlow = registerMountedOpenInSessionHandoff({
+			source: () => ({
+				target: { kind: 'flow', path: 'u/me/f' },
+				workspaceId: 'forkA',
+				beforeOpen: () => {
+					order.push('beforeOpen')
+				}
+			})
+		})
+		try {
+			rememberNavRoute('/flows/edit/u/me/f?workspace=rootA')
+			await enterSessionModeFromNav()
+			const createdId = sessionState.currentSessionId
+			expect(createdId).not.toBe('nav-stale-editor')
+			expect(order).toEqual(['beforeOpen', 'goto'])
+			expect(resetSessionPreviewTabs).toHaveBeenCalledWith(
+				createdId,
+				expect.stringMatching(/\/flows\/edit\/u\/me\/f$/)
+			)
+			const created = sessionState.sessions.find((s) => s.id === createdId)
+			expect(created?.pending_workspace_id).toBe('forkA')
+		} finally {
+			unregisterFlow()
+			unregisterScript()
+			vi.mocked(goto).mockReset()
+			vi.mocked(goto).mockResolvedValue(undefined as never)
+			restore()
+		}
+	})
+
+	it('resumes a stale session when coming from a non-item page', async () => {
+		const { restore } = withResumable({
+			id: 'nav-stale-runs',
+			name: 'session-923',
+			lastActivityAt: Date.now() - 3 * HOUR
+		})
+		try {
+			rememberNavRoute('/runs?workspace=rootA')
+			await enterSessionModeFromNav()
+			expect(sessionState.currentSessionId).toBe('nav-stale-runs')
+			expect(resetSessionPreviewTabs).not.toHaveBeenCalled()
+		} finally {
+			restore()
+		}
+	})
+})
diff --git a/frontend/src/lib/components/sessions/sessionSync.svelte.ts b/frontend/src/lib/components/sessions/sessionSync.svelte.ts
new file mode 100644
index 0000000000..842bb8961c
--- /dev/null
+++ b/frontend/src/lib/components/sessions/sessionSync.svelte.ts
@@ -0,0 +1,206 @@
+import { BROWSER } from 'esm-env'
+import { SvelteMap } from 'svelte/reactivity'
+import { onUserChange, scopedKey } from '$lib/userScopedStorage'
+import { randomUUID } from '$lib/utils/uuid'
+
+// Cross-tab awareness for AI sessions. Invariant: no message carries state —
+// a heartbeat is presence, turn-end triggers an idempotent re-read of the
+// shared IndexedDB record — so tabs converge on the store, never on delivery
+// order. The lock is advisory (a broadcast-latency race stays last-writer-
+// wins, as with no channel), and the channel is per-user like the stores.
+
+const CHANNEL_BASE = 'windmill-sessions-sync'
+
+/** Silence past STALE_MS unlocks watchers a dead driver would strand. The
+ *  window sits above the 1/min floor browsers throttle a hidden tab's timers
+ *  to — and a hidden driver is the normal case here. Only an uncleanly killed
+ *  tab waits it out; a closed one says goodbye via the pagehide farewell. */
+const HEARTBEAT_MS = 3_000
+const STALE_MS = 90_000
+const PRUNE_MS = 2_000
+
+// `from` identifies the driving tab: two drivers racing on one session (the
+// documented advisory race) hold separate slots, so one's turn-end can never
+// unlock a watcher the other still holds.
+export type SyncMsg =
+	| { kind: 'run-heartbeat'; sessionId: string; from: string }
+	| { kind: 'turn-end'; sessionId: string; chatId: string; from: string }
+
+/** This tab's identity on the channel (a tab never receives its own posts). */
+const TAB_ID = randomUUID()
+
+// One slot per (session, driving tab), keyed with a separator no UUID contains.
+// The value is a fresh object per message: turn-end's deferred cleanup asks
+// "is this slot still mine?" by identity — a timestamp can't, since a same-
+// millisecond follow-up heartbeat would compare equal and be deleted.
+const remoteRuns = new SvelteMap<string, { at: number }>()
+
+function runKey(sessionId: string, from: string): string {
+	return sessionId + ':' + from
+}
+
+export function runHeldElsewhere(sessionId: string): boolean {
+	const prefix = sessionId + ':'
+	for (const key of remoteRuns.keys()) {
+		if (key.startsWith(prefix)) return true
+	}
+	return false
+}
+
+let remoteTurnEnd: ((sessionId: string, chatId: string) => void | Promise<void>) | undefined
+
+/** Registered by sessionRuntime, which already imports this module — a
+ *  callback rather than an import keeps that edge one-way. The returned
+ *  promise is when the catch-up has been applied; the composer stays locked
+ *  until it settles. */
+export function onRemoteTurnEnd(
+	fn: (sessionId: string, chatId: string) => void | Promise<void>
+): void {
+	remoteTurnEnd = fn
+}
+
+let channel: BroadcastChannel | undefined
+let channelName: string | undefined
+
+function openChannel(): void {
+	const name = scopedKey(CHANNEL_BASE)
+	if (name === channelName) return
+	channel?.close()
+	channel = undefined
+	channelName = name
+	if (!name) return
+	try {
+		const ch = new BroadcastChannel(name)
+		ch.onmessage = (ev: MessageEvent<SyncMsg>) => receive(ev.data)
+		channel = ch
+	} catch (e) {
+		// No BroadcastChannel (or blocked): every tab simply stays independent,
+		// which is the pre-sync behavior rather than a broken one.
+		console.error('sessionSync: could not open channel', e)
+	}
+}
+
+if (BROWSER) {
+	// A user switch rescopes the channel name, so the previous identity's
+	// channel is closed before the next one opens.
+	onUserChange(() => openChannel())
+}
+
+function receive(msg: SyncMsg): void {
+	switch (msg.kind) {
+		case 'run-heartbeat':
+			remoteRuns.set(runKey(msg.sessionId, msg.from), { at: Date.now() })
+			ensurePruner()
+			break
+		case 'turn-end': {
+			// Unlocking on receipt would let a send here start from history missing
+			// the turn that just ended, so the slot holds until the catch-up
+			// settles — unless the driver's next turn replaced it meanwhile (object
+			// identity, see remoteRuns). The pruner caps a wedged reload at STALE_MS.
+			const key = runKey(msg.sessionId, msg.from)
+			const hold = { at: Date.now() }
+			remoteRuns.set(key, hold)
+			ensurePruner()
+			Promise.resolve()
+				.then(() => remoteTurnEnd?.(msg.sessionId, msg.chatId))
+				.catch((e) => console.error('sessionSync: turn-end handler failed', e))
+				.finally(() => {
+					if (remoteRuns.get(key) === hold) remoteRuns.delete(key)
+				})
+			break
+		}
+	}
+}
+
+function post(msg: SyncMsg): void {
+	if (!channel) return
+	try {
+		channel.postMessage(msg)
+	} catch (e) {
+		// A failed post must never take the turn down with it.
+		console.error('sessionSync: could not post message', e)
+	}
+}
+
+let pruneTimer: ReturnType<typeof setInterval> | undefined
+
+function ensurePruner(): void {
+	if (pruneTimer) return
+	pruneTimer = setInterval(() => {
+		const cutoff = Date.now() - STALE_MS
+		for (const [id, entry] of remoteRuns) {
+			if (entry.at < cutoff) remoteRuns.delete(id)
+		}
+		if (remoteRuns.size === 0) {
+			clearInterval(pruneTimer)
+			pruneTimer = undefined
+		}
+	}, PRUNE_MS)
+}
+
+// ---------------------------------------------------------------------------
+// Driving side
+// ---------------------------------------------------------------------------
+
+// The chat id rides along for the pagehide farewell below, which cannot ask
+// the manager for it. Taken at run start; only a mid-turn rotation could make
+// it stale, and a farewell pointing at the pre-rotation record still converges
+// (the re-read is idempotent and the next turn-end names the right one).
+const heartbeats = new Map<string, { timer: ReturnType<typeof setInterval>; chatId: string }>()
+
+/** Posted when the run's loading bracket opens — after the send's attachment
+ *  upkeep awaits, so a competing send can start during them; the sender's own
+ *  post-preflight re-check is what refuses one that did. */
+export function localRunStarted(sessionId: string, chatId: string): void {
+	if (heartbeats.has(sessionId)) return
+	post({ kind: 'run-heartbeat', sessionId, from: TAB_ID })
+	heartbeats.set(sessionId, {
+		timer: setInterval(
+			() => post({ kind: 'run-heartbeat', sessionId, from: TAB_ID }),
+			HEARTBEAT_MS
+		),
+		chatId
+	})
+}
+
+/** `chatId` is read at turn end, not reused from the start: a rotation
+ *  mid-turn means the transcript now lives under a different record, and the
+ *  watchers' re-read must follow it there. */
+export function localRunEnded(sessionId: string, chatId: string): void {
+	const entry = heartbeats.get(sessionId)
+	if (entry !== undefined) {
+		clearInterval(entry.timer)
+		heartbeats.delete(sessionId)
+	}
+	post({ kind: 'turn-end', sessionId, chatId, from: TAB_ID })
+}
+
+if (BROWSER) {
+	// The run dies with the page: a turn-end farewell (which also has watchers
+	// re-read the last checkpoint) beats making them wait out STALE_MS. Not on
+	// a bfcache freeze (persisted) — that turn resumes with the page, and
+	// nothing would re-arm a farewelled heartbeat.
+	window.addEventListener('pagehide', (ev) => {
+		if (ev.persisted) return
+		for (const [sessionId, entry] of [...heartbeats]) {
+			localRunEnded(sessionId, entry.chatId)
+		}
+	})
+}
+
+/** Test seam: deliver a message as if it arrived on the channel. */
+export function __receiveForTest(msg: SyncMsg): void {
+	receive(msg)
+}
+
+/** Test seam: clear the module's state between tests. */
+export function __resetForTest(): void {
+	remoteRuns.clear()
+	if (pruneTimer) {
+		clearInterval(pruneTimer)
+		pruneTimer = undefined
+	}
+	for (const entry of heartbeats.values()) clearInterval(entry.timer)
+	heartbeats.clear()
+	remoteTurnEnd = undefined
+}
diff --git a/frontend/src/lib/components/sessions/sessionSync.test.ts b/frontend/src/lib/components/sessions/sessionSync.test.ts
new file mode 100644
index 0000000000..e00eab8307
--- /dev/null
+++ b/frontend/src/lib/components/sessions/sessionSync.test.ts
@@ -0,0 +1,90 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+	__receiveForTest,
+	__resetForTest,
+	onRemoteTurnEnd,
+	runHeldElsewhere
+} from './sessionSync.svelte'
+
+// Exercises the receive-side state machine directly (the module opens no
+// BroadcastChannel outside the browser). The channel itself is glue that only
+// a real browser can prove; what these pin are the invariants a refactor could
+// silently break: the identity-token cleanup, the staleness prune, and the
+// turn-end hold.
+
+beforeEach(() => {
+	__resetForTest()
+	vi.useFakeTimers()
+})
+
+afterEach(() => {
+	__resetForTest()
+	vi.useRealTimers()
+})
+
+describe('sessionSync receive-side state', () => {
+	it('locks on a heartbeat and unlocks by staleness when the driver dies silently', async () => {
+		__receiveForTest({ kind: 'run-heartbeat', sessionId: 's1', from: 'driver-a' })
+		expect(runHeldElsewhere('s1')).toBe(true)
+
+		// Refreshed heartbeats keep the lock past the original entry's window.
+		await vi.advanceTimersByTimeAsync(60_000)
+		__receiveForTest({ kind: 'run-heartbeat', sessionId: 's1', from: 'driver-a' })
+		await vi.advanceTimersByTimeAsync(60_000)
+		expect(runHeldElsewhere('s1')).toBe(true)
+
+		// Silence past STALE_MS (90s) prunes the entry.
+		await vi.advanceTimersByTimeAsync(40_000)
+		expect(runHeldElsewhere('s1')).toBe(false)
+	})
+
+	it('holds the lock through the turn-end catch-up and releases when it settles', async () => {
+		let releaseCatchUp: (() => void) | undefined
+		onRemoteTurnEnd(() => new Promise<void>((resolve) => (releaseCatchUp = resolve)))
+
+		__receiveForTest({ kind: 'run-heartbeat', sessionId: 's1', from: 'driver-a' })
+		__receiveForTest({ kind: 'turn-end', sessionId: 's1', chatId: 'c1', from: 'driver-a' })
+		await vi.advanceTimersByTimeAsync(0)
+		// Unlocking on receipt would let a send here start from history missing
+		// the turn that just ended; the lock must outlive the re-read.
+		expect(runHeldElsewhere('s1')).toBe(true)
+
+		releaseCatchUp?.()
+		await vi.advanceTimersByTimeAsync(0)
+		expect(runHeldElsewhere('s1')).toBe(false)
+	})
+
+	it("keeps the lock when the driver's next turn arrives during the catch-up", async () => {
+		let releaseCatchUp: (() => void) | undefined
+		onRemoteTurnEnd(() => new Promise<void>((resolve) => (releaseCatchUp = resolve)))
+
+		__receiveForTest({ kind: 'turn-end', sessionId: 's1', chatId: 'c1', from: 'driver-a' })
+		// Flush so the catch-up handler has started (releaseCatchUp is assigned)
+		// before the follow-up arrives — otherwise the release below no-ops and
+		// the lock would survive for the wrong reason (a catch-up that never
+		// settled), passing even with the identity comparison broken.
+		await vi.advanceTimersByTimeAsync(0)
+		// The queued-follow-up sequence: the next turn's first heartbeat lands
+		// while this tab's catch-up is still reading — in the same millisecond,
+		// which is why the cleanup must compare identity, not timestamps.
+		__receiveForTest({ kind: 'run-heartbeat', sessionId: 's1', from: 'driver-a' })
+
+		releaseCatchUp?.()
+		await vi.advanceTimersByTimeAsync(0)
+		expect(runHeldElsewhere('s1')).toBe(true)
+	})
+
+	// Two drivers on one session is the documented advisory race; a watcher
+	// must not compound it by unlocking when only one of them finishes.
+	it('stays locked when one of two drivers ends its turn', async () => {
+		onRemoteTurnEnd(() => Promise.resolve())
+
+		__receiveForTest({ kind: 'run-heartbeat', sessionId: 's1', from: 'driver-b' })
+		__receiveForTest({ kind: 'turn-end', sessionId: 's1', chatId: 'c1', from: 'driver-a' })
+		await vi.advanceTimersByTimeAsync(0)
+		await vi.advanceTimersByTimeAsync(0)
+
+		// Driver A's slot released with its catch-up; driver B still holds its own.
+		expect(runHeldElsewhere('s1')).toBe(true)
+	})
+})
diff --git a/frontend/src/lib/components/settings/ForkMemberSettings.svelte b/frontend/src/lib/components/settings/ForkMemberSettings.svelte
index 6b75018cae..45de0bf3f0 100644
--- a/frontend/src/lib/components/settings/ForkMemberSettings.svelte
+++ b/frontend/src/lib/components/settings/ForkMemberSettings.svelte
@@ -102,7 +102,7 @@
 
 <SettingsPageHeader
 	title="Members {members != undefined ? `(${members.length})` : ''}"
-	description="Add collaborators to the fork you created."
+	description="Add members to the fork you created."
 	link="https://www.windmill.dev/docs/core_concepts/roles_and_permissions"
 />
 
@@ -124,12 +124,12 @@
 					nonCaptureEvent={true}
 					startIcon={{ icon: UserPlus }}
 				>
-					Add collaborator
+					Add member
 				</Button>
 			{/snippet}
 			{#snippet content()}
 				<div class="flex flex-col w-[28rem] p-4 gap-2">
-					<span class="text-sm leading-6 font-semibold">Add a collaborator</span>
+					<span class="text-sm leading-6 font-semibold">Add a member</span>
 					<span class="text-xs text-secondary">
 						They join as a developer of this fork. Only members of
 						<b>{parentWorkspaceId}</b> who are developers or admins there can be added.
diff --git a/frontend/src/lib/components/table/Cell.svelte b/frontend/src/lib/components/table/Cell.svelte
index 94aac6db7a..1fc8d1d8fd 100644
--- a/frontend/src/lib/components/table/Cell.svelte
+++ b/frontend/src/lib/components/table/Cell.svelte
@@ -11,7 +11,9 @@
 		shouldStopPropagation?: boolean
 		selected?: boolean
 		sticky?: boolean
-		stickyEnd?: boolean
+		/** The column holding a row's action buttons. It hugs its content at the table's
+		 *  right edge instead of absorbing the width the other columns leave over. */
+		actions?: boolean
 		wrap?: boolean
 		children?: import('svelte').Snippet
 		[key: string]: any
@@ -25,7 +27,7 @@
 		shouldStopPropagation = false,
 		selected = false,
 		sticky = false,
-		stickyEnd = false,
+		actions = false,
 		wrap = false,
 		children,
 		...rest
@@ -55,11 +57,11 @@
 		last && size === 'xs' ? 'sm:pr-3' : '',
 
 		numeric ? 'text-right' : '',
-		// Pin an actions column to the right so it stays visible when a wide table
-		// scrolls horizontally. The background must be opaque so cells sliding under it
-		// are occluded — the row's hover tint is translucent and would bleed through.
-		stickyEnd ? 'sticky right-0 border-l' : '',
-		stickyEnd ? (head ? 'bg-surface-secondary' : 'bg-surface') : '',
+		// `w-0` shrinks the column to its buttons instead of taking the leftover width, and
+		// the pin keeps them reachable while a wide table scrolls. The background must stay
+		// opaque for the cells passing under it to be occluded — see `wm-cell-pinned` below.
+		actions ? 'w-0 text-right [&>*]:ml-auto sticky right-0 wm-cell-pinned' : '',
+		actions ? (head ? 'bg-surface-secondary' : 'bg-surface') : '',
 		sticky ? `!p-0 sticky ${first ? 'left-0' : 'right-0'}` : 'px-2 py-2',
 		size === 'sm' ? 'px-1.5 py-2.5' : '',
 		size === 'lg' ? 'px-3 py-4' : '',
@@ -77,3 +79,32 @@
 		{@render children?.()}
 	{/if}
 </svelte:element>
+
+<style>
+	/* A sticky cell paints over its row's hover tint rather than inheriting it, and the tint
+	   token carries alpha — adopting it would make the cell translucent and stop it
+	   occluding. So it is layered over the opaque colour. A pseudo-element, not a
+	   `background-image`: that is not animatable, and the row fades its tint on this curve. */
+	.wm-cell-pinned::after {
+		content: '';
+		position: absolute;
+		inset: 0;
+		/* Above the cell's own background, below its buttons. */
+		z-index: -1;
+		pointer-events: none;
+		background-color: rgb(var(--color-surface-hover));
+		opacity: 0;
+		transition: opacity 150ms cubic-bezier(0.4, 0, 0.2, 1);
+	}
+
+	:global(tr.wm-row-hoverable:hover) > .wm-cell-pinned::after {
+		opacity: 1;
+	}
+
+	/* Drawn only while the table overflows (DataTable measures it), since the seam marks that
+	   content is passing under. A shadow, not a border: under `border-collapse: collapse` a
+	   cell's borders belong to the table and scroll away with it. */
+	:global(.wm-table-x-overflow) .wm-cell-pinned {
+		box-shadow: -1px 0 0 0 rgb(var(--color-border-light));
+	}
+</style>
diff --git a/frontend/src/lib/components/table/DataTable.svelte b/frontend/src/lib/components/table/DataTable.svelte
index b6ab8d00e6..d86d165883 100644
--- a/frontend/src/lib/components/table/DataTable.svelte
+++ b/frontend/src/lib/components/table/DataTable.svelte
@@ -15,6 +15,24 @@
 	let tableHeight: number = $state(0)
 	const dispatch = createEventDispatcher()
 	let tableContainer: HTMLDivElement | undefined = $state()
+	let tableEl: HTMLTableElement | undefined = $state()
+
+	// A pinned actions column only earns a seam once something can actually pass under it,
+	// so the overflow is measured rather than assumed: on a table that fits, the column
+	// should be indistinguishable from an ordinary one.
+	let xOverflowing = $state(false)
+	$effect(() => {
+		const container = tableContainer
+		const table = tableEl
+		if (!container || !table) return
+		// Sub-pixel widths make an exactly-fitting table read as 0.5px over.
+		const measure = () => (xOverflowing = container.scrollWidth > container.clientWidth + 1)
+		measure()
+		const observer = new ResizeObserver(measure)
+		observer.observe(container)
+		observer.observe(table)
+		return () => observer.disconnect()
+	})
 	interface Props {
 		paginated?: boolean
 		currentPage?: number
@@ -130,11 +148,15 @@
 >
 	<List justify="between" gap="none" hFull={true}>
 		<div
-			class={twMerge('w-full overflow-auto h-fit', preventXOverflow ? 'overflow-x-hidden' : '')}
+			class={twMerge(
+				'w-full overflow-auto h-fit',
+				preventXOverflow ? 'overflow-x-hidden' : '',
+				xOverflowing ? 'wm-table-x-overflow' : ''
+			)}
 			bind:this={tableContainer}
 			onscroll={handleScroll}
 		>
-			<table class={tableFixed ? 'table-fixed w-full' : 'min-w-full'}>
+			<table bind:this={tableEl} class={tableFixed ? 'table-fixed w-full' : 'min-w-full'}>
 				{@render children?.()}
 			</table>
 			{@render emptyMessage?.()}
diff --git a/frontend/src/lib/components/table/Row.svelte b/frontend/src/lib/components/table/Row.svelte
index c3cbd68665..5854a88d3b 100644
--- a/frontend/src/lib/components/table/Row.svelte
+++ b/frontend/src/lib/components/table/Row.svelte
@@ -28,7 +28,9 @@
 
 <tr
 	class={twMerge(
-		hoverable ? 'hover:bg-surface-hover cursor-pointer' : '',
+		// `wm-row-hoverable` lets a pinned cell re-create this tint on top of its own opaque
+		// background — it cannot simply adopt it, since the hover token carries alpha.
+		hoverable ? 'wm-row-hoverable hover:bg-surface-hover cursor-pointer' : '',
 		selected ? 'bg-blue-50 dark:bg-blue-900/50' : '',
 		'transition-all',
 		dividable ? 'divide-x' : '',
diff --git a/frontend/src/lib/components/triggers/workspaceTriggersList.ts b/frontend/src/lib/components/triggers/workspaceTriggersList.ts
index 01f1572813..f0ad24cced 100644
--- a/frontend/src/lib/components/triggers/workspaceTriggersList.ts
+++ b/frontend/src/lib/components/triggers/workspaceTriggersList.ts
@@ -79,6 +79,12 @@ export const TRIGGER_KINDS: Record<
 			onError?: (message: string) => void
 		) => Promise<Array<Record<string, any>>>
 		create?: (workspace: string, requestBody: any) => Promise<unknown>
+		/**
+		 * Write back an existing trigger's config. Used to point an imported trigger at a
+		 * resource the workspace already has; `schedule` has none because its own service
+		 * takes a different body shape, handled by the caller.
+		 */
+		update?: (workspace: string, path: string, requestBody: any) => Promise<unknown>
 	}
 > = {
 	http: {
@@ -101,7 +107,9 @@ export const TRIGGER_KINDS: Record<
 		resourceField: 'authentication_resource_path',
 		list: (workspace) => HttpTriggerService.listHttpTriggers({ workspace }),
 		create: (workspace, requestBody) =>
-			HttpTriggerService.createHttpTrigger({ workspace, requestBody })
+			HttpTriggerService.createHttpTrigger({ workspace, requestBody }),
+		update: (workspace, path, requestBody) =>
+			HttpTriggerService.updateHttpTrigger({ workspace, path, requestBody })
 	},
 	websocket: {
 		configFields: [
@@ -119,7 +127,9 @@ export const TRIGGER_KINDS: Record<
 		note: 'Reconnect WebSocket auth after import if external service requires it.',
 		list: (workspace) => WebsocketTriggerService.listWebsocketTriggers({ workspace }),
 		create: (workspace, requestBody) =>
-			WebsocketTriggerService.createWebsocketTrigger({ workspace, requestBody })
+			WebsocketTriggerService.createWebsocketTrigger({ workspace, requestBody }),
+		update: (workspace, path, requestBody) =>
+			WebsocketTriggerService.updateWebsocketTrigger({ workspace, path, requestBody })
 	},
 	schedule: {
 		configFields: [
@@ -180,7 +190,9 @@ export const TRIGGER_KINDS: Record<
 		eeOnly: true,
 		list: (workspace) => KafkaTriggerService.listKafkaTriggers({ workspace }),
 		create: (workspace, requestBody) =>
-			KafkaTriggerService.createKafkaTrigger({ workspace, requestBody })
+			KafkaTriggerService.createKafkaTrigger({ workspace, requestBody }),
+		update: (workspace, path, requestBody) =>
+			KafkaTriggerService.updateKafkaTrigger({ workspace, path, requestBody })
 	},
 	nats: {
 		configFields: [
@@ -197,7 +209,9 @@ export const TRIGGER_KINDS: Record<
 		eeOnly: true,
 		list: (workspace) => NatsTriggerService.listNatsTriggers({ workspace }),
 		create: (workspace, requestBody) =>
-			NatsTriggerService.createNatsTrigger({ workspace, requestBody })
+			NatsTriggerService.createNatsTrigger({ workspace, requestBody }),
+		update: (workspace, path, requestBody) =>
+			NatsTriggerService.updateNatsTrigger({ workspace, path, requestBody })
 	},
 	sqs: {
 		configFields: [
@@ -212,7 +226,9 @@ export const TRIGGER_KINDS: Record<
 		eeOnly: true,
 		list: (workspace) => SqsTriggerService.listSqsTriggers({ workspace }),
 		create: (workspace, requestBody) =>
-			SqsTriggerService.createSqsTrigger({ workspace, requestBody })
+			SqsTriggerService.createSqsTrigger({ workspace, requestBody }),
+		update: (workspace, path, requestBody) =>
+			SqsTriggerService.updateSqsTrigger({ workspace, path, requestBody })
 	},
 	mqtt: {
 		configFields: [
@@ -228,7 +244,9 @@ export const TRIGGER_KINDS: Record<
 		resourceField: 'mqtt_resource_path',
 		list: (workspace) => MqttTriggerService.listMqttTriggers({ workspace }),
 		create: (workspace, requestBody) =>
-			MqttTriggerService.createMqttTrigger({ workspace, requestBody })
+			MqttTriggerService.createMqttTrigger({ workspace, requestBody }),
+		update: (workspace, path, requestBody) =>
+			MqttTriggerService.updateMqttTrigger({ workspace, path, requestBody })
 	},
 	amqp: {
 		configFields: ['amqp_resource_path', 'queue_name', 'exchange', 'options'],
@@ -238,7 +256,9 @@ export const TRIGGER_KINDS: Record<
 		resourceField: 'amqp_resource_path',
 		list: (workspace) => AmqpTriggerService.listAmqpTriggers({ workspace }),
 		create: (workspace, requestBody) =>
-			AmqpTriggerService.createAmqpTrigger({ workspace, requestBody })
+			AmqpTriggerService.createAmqpTrigger({ workspace, requestBody }),
+		update: (workspace, path, requestBody) =>
+			AmqpTriggerService.updateAmqpTrigger({ workspace, path, requestBody })
 	},
 	gcp: {
 		configFields: [
@@ -256,7 +276,9 @@ export const TRIGGER_KINDS: Record<
 		eeOnly: true,
 		list: (workspace) => GcpTriggerService.listGcpTriggers({ workspace }),
 		create: (workspace, requestBody) =>
-			GcpTriggerService.createGcpTrigger({ workspace, requestBody })
+			GcpTriggerService.createGcpTrigger({ workspace, requestBody }),
+		update: (workspace, path, requestBody) =>
+			GcpTriggerService.updateGcpTrigger({ workspace, path, requestBody })
 	},
 	azure: {
 		configFields: [
@@ -274,7 +296,9 @@ export const TRIGGER_KINDS: Record<
 		eeOnly: true,
 		list: (workspace) => AzureTriggerService.listAzureTriggers({ workspace }),
 		create: (workspace, requestBody) =>
-			AzureTriggerService.createAzureTrigger({ workspace, requestBody })
+			AzureTriggerService.createAzureTrigger({ workspace, requestBody }),
+		update: (workspace, path, requestBody) =>
+			AzureTriggerService.updateAzureTrigger({ workspace, path, requestBody })
 	},
 	postgres: {
 		configFields: [
@@ -288,7 +312,9 @@ export const TRIGGER_KINDS: Record<
 		resourceField: 'postgres_resource_path',
 		list: (workspace) => PostgresTriggerService.listPostgresTriggers({ workspace }),
 		create: (workspace, requestBody) =>
-			PostgresTriggerService.createPostgresTrigger({ workspace, requestBody })
+			PostgresTriggerService.createPostgresTrigger({ workspace, requestBody }),
+		update: (workspace, path, requestBody) =>
+			PostgresTriggerService.updatePostgresTrigger({ workspace, path, requestBody })
 	},
 	email: {
 		configFields: ['local_part', 'workspaced_local_part'],
@@ -297,7 +323,9 @@ export const TRIGGER_KINDS: Record<
 		note: 'Email address regenerates on import.',
 		list: (workspace) => EmailTriggerService.listEmailTriggers({ workspace }),
 		create: (workspace, requestBody) =>
-			EmailTriggerService.createEmailTrigger({ workspace, requestBody })
+			EmailTriggerService.createEmailTrigger({ workspace, requestBody }),
+		update: (workspace, path, requestBody) =>
+			EmailTriggerService.updateEmailTrigger({ workspace, path, requestBody })
 	}
 }
 
diff --git a/frontend/src/lib/components/workspaceSettings/AISettings.svelte b/frontend/src/lib/components/workspaceSettings/AISettings.svelte
index 467003ef12..65187d98c8 100644
--- a/frontend/src/lib/components/workspaceSettings/AISettings.svelte
+++ b/frontend/src/lib/components/workspaceSettings/AISettings.svelte
@@ -78,6 +78,7 @@
 	let modelPricing: Record<string, ModelPriceOverride> = $state({})
 	let usingOpenaiClientCredentialsOauth = $state(false)
 	let workspaceOverrideEditorOpened = $state(false)
+	let copilotDisabled = $state(false)
 
 	// --- Initial state for dirty tracking ---
 	let initialAiProviders: Exclude<AIConfig['providers'], undefined> = $state({})
@@ -88,6 +89,7 @@
 	let initialMaxTokensPerModel: Record<string, number> = $state({})
 	let initialModelPricing: Record<string, ModelPriceOverride> = $state({})
 	let initialPrompts: Record<string, string> = $state({})
+	let initialCopilotDisabled = $state(false)
 	let lastLoadedConfigKey = $state<string | undefined>(undefined)
 
 	function clone<T>(v: T): T {
@@ -115,6 +117,7 @@
 		customPrompts = clone(config?.custom_prompts ?? {})
 		maxTokensPerModel = clone(config?.max_tokens_per_model ?? {})
 		modelPricing = clone(config?.model_pricing ?? {})
+		copilotDisabled = config?.copilot_disabled === true
 		for (const mode of ['edit', 'fix', 'gen']) {
 			if (!(mode in customPrompts)) {
 				customPrompts[mode] = ''
@@ -131,6 +134,7 @@
 		initialMaxTokensPerModel = clone(maxTokensPerModel)
 		initialModelPricing = clone(modelPricing)
 		initialPrompts = clone(customPrompts)
+		initialCopilotDisabled = copilotDisabled
 	}
 
 	export function loadFromConfig(config: AIConfig | undefined) {
@@ -146,6 +150,7 @@
 		customPrompts = clone(initialCustomPrompts)
 		maxTokensPerModel = clone(initialMaxTokensPerModel)
 		modelPricing = clone(initialModelPricing)
+		copilotDisabled = initialCopilotDisabled
 	}
 
 	$effect(() => {
@@ -180,7 +185,8 @@
 			codeCompletionModel !== initialCodeCompletionModel ||
 			JSON.stringify(customPrompts) !== JSON.stringify(initialCustomPrompts) ||
 			JSON.stringify(maxTokensPerModel) !== JSON.stringify(initialMaxTokensPerModel) ||
-			JSON.stringify(modelPricing) !== JSON.stringify(initialModelPricing)
+			JSON.stringify(modelPricing) !== JSON.stringify(initialModelPricing) ||
+			copilotDisabled !== initialCopilotDisabled
 	)
 
 	$effect(() => {
@@ -285,6 +291,8 @@
 			.filter(([_, prompt]) => prompt.trim().length > 0)
 			.reduce((acc, [mode, prompt]) => ({ ...acc, [mode]: prompt }), {})
 
+		// The flag is the one thing a workspace on instance defaults still stores of its own.
+		const copilot_disabled = copilotDisabled ? true : undefined
 		return Object.keys(aiProviders ?? {}).length > 0
 			? {
 					providers: aiProviders,
@@ -294,9 +302,10 @@
 					custom_prompts: Object.keys(custom_prompts).length > 0 ? custom_prompts : undefined,
 					max_tokens_per_model:
 						Object.keys(maxTokensPerModel).length > 0 ? maxTokensPerModel : undefined,
-					model_pricing: Object.keys(modelPricing).length > 0 ? modelPricing : undefined
+					model_pricing: Object.keys(modelPricing).length > 0 ? modelPricing : undefined,
+					copilot_disabled
 				}
-			: {}
+			: { copilot_disabled }
 	}
 
 	function isSaveDisabled(): boolean {
@@ -633,12 +642,27 @@
 	<ModelPricing {aiProviders} bind:modelPricing />
 {/if}
 
-{#if showWorkspaceOverrideEditor}
-	<SettingsFooter
-		hasUnsavedChanges={dirty}
-		onSave={editCopilotConfig}
-		onDiscard={discard}
-		saveLabel="Save AI settings"
-		disabled={isSaveDisabled()}
-	/>
+{#if promptScope === 'workspace'}
+	<SettingCard
+		label="Hide AI sessions"
+		description="Hides AI sessions and every other AI assistant button (chat, code generation and completion, AI fix) from all members of this workspace. AI agent steps and the AI sandbox in flows are not affected and keep using the providers configured above. This hides the assistant in the UI only; it does not restrict API access to the configured providers."
+	>
+		<Toggle
+			checked={copilotDisabled}
+			on:change={(e) => {
+				copilotDisabled = e.detail
+			}}
+			options={{ right: 'Hide AI sessions in this workspace' }}
+		/>
+	</SettingCard>
 {/if}
+
+<!-- Not gated on `showWorkspaceOverrideEditor`: a workspace on instance defaults still has
+     the hide toggle above to save. -->
+<SettingsFooter
+	hasUnsavedChanges={dirty}
+	onSave={editCopilotConfig}
+	onDiscard={discard}
+	saveLabel="Save AI settings"
+	disabled={isSaveDisabled()}
+/>
diff --git a/frontend/src/lib/components/workspaceSettings/S3PermissionRulesEditor.svelte b/frontend/src/lib/components/workspaceSettings/S3PermissionRulesEditor.svelte
new file mode 100644
index 0000000000..d865756ff8
--- /dev/null
+++ b/frontend/src/lib/components/workspaceSettings/S3PermissionRulesEditor.svelte
@@ -0,0 +1,107 @@
+<script lang="ts">
+	import { dragHandle, dragHandleZone } from '@windmill-labs/svelte-dnd-action'
+	import { GripVertical, Plus } from 'lucide-svelte'
+	import { randomUUID } from '$lib/utils/uuid'
+	import type { S3ResourceSettingsItem } from '$lib/workspace_settings'
+	import Alert from '../common/alert/Alert.svelte'
+	import Button from '../common/button/Button.svelte'
+	import ClearableInput from '../common/clearableInput/ClearableInput.svelte'
+	import CloseButton from '../common/CloseButton.svelte'
+	import MultiSelect from '../select/MultiSelect.svelte'
+
+	type Rule = NonNullable<S3ResourceSettingsItem['advancedPermissions']>[number]
+
+	let { rules = $bindable() }: { rules: Rule[] | undefined } = $props()
+
+	// svelte-dnd-action keys its items by `id`. Wrapping the rules rather than adding
+	// an `id` to them keeps the key out of what gets persisted to the backend.
+	let items = $state((rules ?? []).map((rule) => ({ id: randomUUID(), rule })))
+
+	$effect(() => {
+		rules = items.map((item) => item.rule)
+	})
+
+	// Evaluation stops at the first rule whose pattern matches, so a rule matching every
+	// path makes everything below it dead — most often the `**/*` deny-all the default
+	// ruleset ends with.
+	const CATCH_ALL_PATTERNS = ['**/*', '**', '*']
+	let catchAllIdx = $derived.by(() => {
+		const idx = items.findIndex((item) => CATCH_ALL_PATTERNS.includes(item.rule.pattern.trim()))
+		return idx === -1 || idx === items.length - 1 ? undefined : idx
+	})
+	let shadowWarning = $derived.by(() => {
+		if (catchAllIdx === undefined) return undefined
+		const shadowed =
+			catchAllIdx === items.length - 2
+				? `Rule ${items.length} is`
+				: `Rules ${catchAllIdx + 2} to ${items.length} are`
+		return `${shadowed} never evaluated: rule ${catchAllIdx + 1} (${items[catchAllIdx].rule.pattern.trim()}) already matches every path`
+	})
+
+	const flipDurationMs = 200
+</script>
+
+<Alert title="Rules are evaluated in order">
+	The first rule whose pattern matches the path decides what is allowed — drag rules to reorder
+	them. A path matched by no rule is denied.
+	<br /><br />
+	Standard Unix-style glob syntax is supported. The following will be interpolated:
+	<ul class="list-disc pl-6">
+		<li><code>{'{username}'}</code> : Nickname of the user doing the request</li>
+		<li><code>{'{group}'}</code> : Any group that the user belongs to</li>
+		<li><code>{'{folder_read}'}</code> : Any folder that the user has read access to</li>
+		<li><code>{'{folder_write}'}</code> : Any folder that the user has write access to</li>
+	</ul>
+	<br />
+	Note that changes may take up to 1 minute to propagate due to cache invalidation
+</Alert>
+
+<div class="flex-1 overflow-y-auto">
+	<section
+		class="flex flex-col gap-3"
+		use:dragHandleZone={{ items, flipDurationMs, dropTargetStyle: {} }}
+		onconsider={(e) => (items = e.detail.items)}
+		onfinalize={(e) => (items = e.detail.items)}
+	>
+		{#each items as item, idx (item.id)}
+			{@const shadowed = catchAllIdx !== undefined && idx > catchAllIdx}
+			<!-- The transparent border is carried by every row so flagging one doesn't shift the columns. -->
+			<div
+				class="flex gap-2 items-center pl-2 border-l-2 {shadowed
+					? 'border-red-500'
+					: 'border-transparent'}"
+			>
+				<div
+					class="shrink-0 flex items-center gap-1 cursor-move {shadowed
+						? 'text-red-500'
+						: 'text-secondary'}"
+					use:dragHandle
+					aria-label="Reorder rule {idx + 1}"
+				>
+					<GripVertical size={16} />
+					<span class="text-2xs whitespace-nowrap tabular-nums">Rule {idx + 1}</span>
+				</div>
+				<ClearableInput bind:value={item.rule.pattern} placeholder="Pattern" />
+				<MultiSelect
+					items={[{ value: 'read' }, { value: 'write' }, { value: 'delete' }, { value: 'list' }]}
+					bind:value={item.rule.allow}
+					class="w-[20rem]"
+					placeholder="Deny all access"
+					hideMainClearBtn
+				/>
+				<CloseButton onClick={() => (items = items.filter((_, i) => i !== idx))} />
+			</div>
+		{/each}
+	</section>
+</div>
+{#if shadowWarning}
+	<Alert type="error" size="xs" title={shadowWarning} />
+{/if}
+<Button
+	unifiedSize="sm"
+	variant="default"
+	startIcon={{ icon: Plus }}
+	on:click={() => (items = [...items, { id: randomUUID(), rule: { pattern: '', allow: [] } }])}
+>
+	Add permission rule
+</Button>
diff --git a/frontend/src/lib/components/workspaceSettings/StorageSettings.svelte b/frontend/src/lib/components/workspaceSettings/StorageSettings.svelte
index a2ccf0b958..025ef23c38 100644
--- a/frontend/src/lib/components/workspaceSettings/StorageSettings.svelte
+++ b/frontend/src/lib/components/workspaceSettings/StorageSettings.svelte
@@ -19,9 +19,8 @@
 	import S3FilePicker from '../S3FilePicker.svelte'
 	import Portal from '../Portal.svelte'
 	import Popover from '../meltComponents/Popover.svelte'
-	import ClearableInput from '../common/clearableInput/ClearableInput.svelte'
-	import MultiSelect from '../select/MultiSelect.svelte'
 	import CloseButton from '../common/CloseButton.svelte'
+	import S3PermissionRulesEditor from './S3PermissionRulesEditor.svelte'
 	import TextInput from '../text_input/TextInput.svelte'
 	import Select from '../select/Select.svelte'
 	import DataTable from '../table/DataTable.svelte'
@@ -529,7 +528,7 @@
 			disabled={!storage.advancedPermissions && !$enterpriseLicense}
 		/>
 		{#if storage.advancedPermissions}
-			{@render advancedPermissionsEditor(storage.advancedPermissions)}
+			<S3PermissionRulesEditor bind:rules={storage.advancedPermissions} />
 		{/if}
 		{#if !storage.advancedPermissions}
 			{#if storage.resourceType == 's3'}
@@ -585,37 +584,3 @@
 		{/if}
 	{/if}
 </Modal2>
-
-{#snippet advancedPermissionsEditor(rules: S3ResourceSettingsItem['advancedPermissions'])}
-	<Alert title="Standard Unix-style glob syntax is supported">
-		The following will be interpolated :
-		<ul class="list-disc pl-6">
-			<li><code>{'{username}'}</code> : Nickname of the user doing the request</li>
-			<li><code>{'{group}'}</code> : Any group that the user belongs to</li>
-			<li><code>{'{folder_read}'}</code> : Any folder that the user has read access to</li>
-			<li><code>{'{folder_write}'}</code> : Any folder that the user has write access to</li>
-		</ul>
-		<br />
-		Note that changes may take up to 1 minute to propagate due to cache invalidation
-	</Alert>
-
-	<div class="flex-1 overflow-y-auto gap-3 flex flex-col">
-		{#each rules ?? [] as item, idx}
-			<div class="flex gap-2">
-				<ClearableInput bind:value={item.pattern} placeholder="Pattern" />
-				<MultiSelect
-					items={[{ value: 'read' }, { value: 'write' }, { value: 'delete' }, { value: 'list' }]}
-					bind:value={item.allow}
-					class="w-[20rem]"
-					placeholder="Deny all access"
-					hideMainClearBtn
-				/>
-				<CloseButton onClick={() => rules?.splice(idx, 1)} />
-			</div>
-		{/each}
-	</div>
-	<Button size="xs" variant="default" on:click={() => rules?.push({ pattern: '', allow: [] })}>
-		<Plus size={14} />
-		Add permission rule
-	</Button>
-{/snippet}
diff --git a/frontend/src/lib/components/workspaceSettings/projectBundle.test.ts b/frontend/src/lib/components/workspaceSettings/projectBundle.test.ts
index 669c0a43de..1833a33b33 100644
--- a/frontend/src/lib/components/workspaceSettings/projectBundle.test.ts
+++ b/frontend/src/lib/components/workspaceSettings/projectBundle.test.ts
@@ -16,6 +16,8 @@ import {
 	collectExportVarPaths,
 	extractTriggerConfigResourceRefs,
 	extractVarRefsFromValue,
+	projectReferencesResource,
+	textHoldsBarePath,
 	type ProjectExport,
 	type FetchedItem,
 	type ItemRef
@@ -867,3 +869,46 @@ describe('flow_env and preprocessor_module', () => {
 		expect(out.flow_env.PLAIN).toBe('not-a-ref')
 	})
 })
+
+describe('projectReferencesResource', () => {
+	/**
+	 * A project declares one resource per `resource-<type>` input schema as well as one per
+	 * `$res:` reference, so an app pinning `f/proj/google_calendar` for a script whose schema
+	 * says `resource-gcal` ships both it and an unreferenced `f/proj/gcal`. Only the pinned
+	 * one has to hold a credential for the project to work.
+	 */
+	const bundle = {
+		project: { slug: 'proj', name: 'Proj', summary: '', readme: null },
+		scripts: [{ path: 'f/proj/send', content: 'const c = "$res:f/proj/google_calendar"' }],
+		flows: [],
+		apps: [],
+		resources: [
+			{ path: 'f/proj/gcal', resource_type: 'gcal' },
+			{ path: 'f/proj/google_calendar', resource_type: 'gcal' },
+			{ path: 'f/proj/db', resource_type: 'postgresql' }
+		],
+		triggers: [{ path: 'f/proj/ingest', config: { postgres_resource_path: 'f/proj/db' } }]
+	} as unknown as ProjectExport
+
+	it("sees a $res: token and a trigger's bare path, and not a stub nothing points at", () => {
+		expect(projectReferencesResource(bundle, 'f/proj/google_calendar')).toBe(true)
+		expect(projectReferencesResource(bundle, 'f/proj/db')).toBe(true)
+		// Declared only because a script's input schema names the type.
+		expect(projectReferencesResource(bundle, 'f/proj/gcal')).toBe(false)
+	})
+})
+
+describe('textHoldsBarePath', () => {
+	// Gates three deletion decisions, and its two directions cost differently: a false yes
+	// keeps a stub nobody needed, a false no deletes one something still reads.
+	const P = 'f/proj/db'
+	it.each([
+		['a token only', `const c = "$res:${P}"`, false],
+		['a path written in code', `await getResource("${P}")`, true],
+		['both spellings', `"$res:${P}"; getResource("${P}")`, true],
+		['a longer path that starts the same', `await getResource("${P}_prod")`, false],
+		['the same path inside a longer token', `"$res:${P}_prod"`, false]
+	])('%s', (_label, text, expected) => {
+		expect(textHoldsBarePath(text, P)).toBe(expected)
+	})
+})
diff --git a/frontend/src/lib/components/workspaceSettings/projectBundle.ts b/frontend/src/lib/components/workspaceSettings/projectBundle.ts
index 1fd62498d5..8adedeb559 100644
--- a/frontend/src/lib/components/workspaceSettings/projectBundle.ts
+++ b/frontend/src/lib/components/workspaceSettings/projectBundle.ts
@@ -238,6 +238,89 @@ export function extractTriggerConfigResourceRefs(config: any): string[] {
 	return extractScriptRefs(JSON.stringify(config ?? {})).map((r) => r.path)
 }
 
+/**
+ * Whether a value reaches a resource, in either spelling a rewrite has to handle: a
+ * `$res:`/`res://` token embedded in content, or the bare path standing alone as a string
+ * the way trigger configs hold it (`kafka_resource_path: "f/slug/db"`).
+ *
+ * Matching the parsed structure rather than its serialization is what keeps
+ * `f/slug/db` out of `$res:f/slug/db_prod`.
+ */
+export function referencesResourcePath(value: unknown, path: string): boolean {
+	const walk = (v: any): boolean => {
+		if (typeof v === 'string') {
+			if (v === path) return true
+			RES_TOKEN_RE.lastIndex = 0
+			let m: RegExpExecArray | null
+			while ((m = RES_TOKEN_RE.exec(v)) !== null) if (m[1] === path) return true
+			return false
+		}
+		if (Array.isArray(v)) return v.some(walk)
+		if (v && typeof v === 'object') return Object.values(v).some(walk)
+		return false
+	}
+	return walk(value)
+}
+
+/**
+ * Whether a `$res:`/`res://` token for this path survives anywhere in the value — the one
+ * spelling the rewriters relocate, and so the only one whose survival means a rewrite did
+ * not take. A bare path is deliberately not matched: nothing here moves one, so its presence
+ * says nothing about whether the rewrite worked.
+ */
+export function holdsResourceToken(value: unknown, path: string): boolean {
+	const walk = (v: any): boolean => {
+		if (typeof v === 'string') {
+			RES_TOKEN_RE.lastIndex = 0
+			let m: RegExpExecArray | null
+			while ((m = RES_TOKEN_RE.exec(v)) !== null) if (m[1] === path) return true
+			return false
+		}
+		if (Array.isArray(v)) return v.some(walk)
+		if (v && typeof v === 'object') return Object.values(v).some(walk)
+		return false
+	}
+	return walk(value)
+}
+
+/**
+ * Whether the text names the resource somewhere no rewriter reaches — a path written on its
+ * own rather than inside a `$res:` token, the way `getResource("f/proj/db")` does. The
+ * tokens are stripped first so the ones a rewrite would move do not count, and the match is
+ * bounded so `f/proj/db` is not found inside `f/proj/db_prod`.
+ */
+export function textHoldsBarePath(text: string, path: string): boolean {
+	const withoutTokens = text.replace(RES_TOKEN_RE, '')
+	const boundary = /[\w\-./]/
+	for (let i = withoutTokens.indexOf(path); i !== -1; i = withoutTokens.indexOf(path, i + 1)) {
+		const before = withoutTokens[i - 1] ?? ''
+		const after = withoutTokens[i + path.length] ?? ''
+		if (!boundary.test(before) && !boundary.test(after)) return true
+	}
+	return false
+}
+
+/**
+ * Whether anything the project ships points at one of its own resources.
+ *
+ * A project declares two kinds of resource. One is referenced — an app pins `$res:` for a
+ * script argument, a trigger names it — and the project does not work until it holds a
+ * credential. The other is minted from a `resource-<type>` input schema: it names a type
+ * a script accepts, nothing points at it, and a standalone run picks a resource in the
+ * argument picker instead. Only the first kind is worth asking anyone to fill in.
+ *
+ * The `resources` list is excluded from the walk because a stub's own declaration carries
+ * its path, which would make every stub look referenced.
+ */
+export function projectReferencesResource(bundle: ProjectExport, path: string): boolean {
+	const { resources: _resources, ...rest } = bundle as any
+	if (referencesResourcePath(rest, path)) return true
+	// A script that reads the resource by name rather than through a `$res:` token still needs
+	// it filled in. Asked about is the safe side of this answer: the cost of a wrong yes is a
+	// row nobody had to act on, and of a wrong no a credential nobody was told to set up.
+	return textHoldsBarePath(JSON.stringify(rest ?? {}), path)
+}
+
 /**
  * Trigger configs reference resources as plain path strings (e.g.
  * `kafka_resource_path: "f/slug/db"`), not `$res:` tokens, so token rewriting
diff --git a/frontend/src/lib/folderDraft.test.ts b/frontend/src/lib/folderDraft.test.ts
new file mode 100644
index 0000000000..75b8fa6dd0
--- /dev/null
+++ b/frontend/src/lib/folderDraft.test.ts
@@ -0,0 +1,148 @@
+import { describe, it, expect } from 'vitest'
+import {
+	folderPermissionDiff,
+	isFolderDraftDirty,
+	type FolderDraft,
+	type FolderMember,
+	type FolderRole
+} from './folderDraft'
+
+function member(role: FolderRole): FolderMember {
+	return { owner_name: 'u/alice', role }
+}
+
+function baseline(): FolderDraft {
+	return {
+		summary: 'Reporting jobs',
+		labels: ['prod'],
+		defaultPermissionedAs: [{ path_glob: '**', permissioned_as: 'u/admin' }],
+		perms: [
+			{ owner_name: 'u/admin', role: 'admin' },
+			{ owner_name: 'g/all', role: 'viewer' }
+		]
+	}
+}
+
+describe('folderPermissionDiff', () => {
+	// The whole transition matrix: which endpoint each role change maps to. `admin` lives in
+	// `owners` and the other two in `extra_perms`, so leaving admin is the one transition that
+	// cannot go through the ACL endpoint.
+	const transitions: Array<[from: FolderRole | 'absent', to: FolderRole, expected: unknown]> = [
+		['absent', 'viewer', { kind: 'setAcl', owner: 'u/alice', write: false }],
+		['absent', 'writer', { kind: 'setAcl', owner: 'u/alice', write: true }],
+		['absent', 'admin', { kind: 'grantAdmin', owner: 'u/alice' }],
+		['viewer', 'writer', { kind: 'setAcl', owner: 'u/alice', write: true }],
+		['viewer', 'admin', { kind: 'grantAdmin', owner: 'u/alice' }],
+		['writer', 'viewer', { kind: 'setAcl', owner: 'u/alice', write: false }],
+		['writer', 'admin', { kind: 'grantAdmin', owner: 'u/alice' }],
+		['admin', 'viewer', { kind: 'demoteAdmin', owner: 'u/alice', write: false }],
+		['admin', 'writer', { kind: 'demoteAdmin', owner: 'u/alice', write: true }]
+	]
+
+	it.each(transitions)('%s → %s', (from, to, expected) => {
+		const prev = from === 'absent' ? [] : [member(from)]
+		expect(folderPermissionDiff(prev, [member(to)])).toEqual([expected])
+	})
+
+	it.each(['viewer', 'writer', 'admin'] as const)('%s → removed drops owner and acl', (role) => {
+		expect(folderPermissionDiff([member(role)], [])).toEqual([{ kind: 'remove', owner: 'u/alice' }])
+	})
+
+	it.each(['viewer', 'writer', 'admin'] as const)('%s unchanged calls nothing', (role) => {
+		expect(folderPermissionDiff([member(role)], [member(role)])).toEqual([])
+	})
+
+	// The caller is a folder admin only through `g/ops`, so that demotion is the one the write
+	// policy refuses. Sent first it takes the rest of the save down with it.
+	it('gives up the caller own admin last', () => {
+		const prev: FolderMember[] = [
+			{ owner_name: 'g/ops', role: 'admin' },
+			{ owner_name: 'u/bob', role: 'viewer' }
+		]
+		const next: FolderMember[] = [
+			{ owner_name: 'g/ops', role: 'viewer' },
+			{ owner_name: 'u/bob', role: 'admin' }
+		]
+		expect(folderPermissionDiff(prev, next, ['u/alice', 'g/ops'])).toEqual([
+			{ kind: 'grantAdmin', owner: 'u/bob' },
+			{ kind: 'demoteAdmin', owner: 'g/ops', write: false }
+		])
+	})
+
+	// `g/z` is a group the caller belongs to but holds no admin through, so removing it is an
+	// ordinary call — queued behind the refused one it would never run.
+	it('defers only the rows the caller is an admin through', () => {
+		const prev: FolderMember[] = [
+			{ owner_name: 'g/a', role: 'admin' },
+			{ owner_name: 'g/z', role: 'viewer' }
+		]
+		expect(folderPermissionDiff(prev, [], ['u/alice', 'g/a', 'g/z'])).toEqual([
+			{ kind: 'remove', owner: 'g/z' },
+			{ kind: 'remove', owner: 'g/a' }
+		])
+	})
+
+	it('touches only the members that changed', () => {
+		const prev: FolderMember[] = [
+			{ owner_name: 'u/admin', role: 'admin' },
+			{ owner_name: 'g/all', role: 'viewer' },
+			{ owner_name: 'g/ops', role: 'writer' }
+		]
+		const next: FolderMember[] = [
+			{ owner_name: 'u/admin', role: 'admin' },
+			{ owner_name: 'g/all', role: 'writer' }
+		]
+		expect(folderPermissionDiff(prev, next)).toEqual([
+			{ kind: 'setAcl', owner: 'g/all', write: true },
+			{ kind: 'remove', owner: 'g/ops' }
+		])
+	})
+})
+
+describe('isFolderDraftDirty', () => {
+	it('is clean against its own baseline', () => {
+		expect(isFolderDraftDirty(baseline(), baseline())).toBe(false)
+	})
+
+	it('is clean before anything has loaded', () => {
+		expect(isFolderDraftDirty(baseline(), undefined)).toBe(false)
+	})
+
+	// A reload rebuilds the members in the server's order, which is not the order they were
+	// added in. Order-sensitive, an applied change would keep Save lit with nothing to send.
+	it('ignores the order the members are held in', () => {
+		const reordered = baseline()
+		reordered.perms = [...reordered.perms].reverse()
+		expect(isFolderDraftDirty(reordered, baseline())).toBe(false)
+	})
+
+	// Enumerated from the value itself rather than a hand-written list: a field added to
+	// `FolderDraft` and to `baseline()` is covered here without anyone remembering to add a
+	// case. An edit this misses is one the drawer discards without asking.
+	it.each(Object.keys(baseline()) as Array<keyof FolderDraft>)('notices a change to %s', (key) => {
+		const edited = baseline()
+		if (key === 'summary') edited.summary = 'Something else'
+		else if (key === 'labels') edited.labels = [...edited.labels, 'staging']
+		else if (key === 'defaultPermissionedAs') edited.defaultPermissionedAs = []
+		else if (key === 'perms') edited.perms[1].role = 'writer'
+		else throw new Error(`no edit defined for ${key} — add one so the field stays covered`)
+
+		expect(isFolderDraftDirty(edited, baseline())).toBe(true)
+	})
+
+	it('notices a member added and a member removed', () => {
+		const added = baseline()
+		added.perms.push({ owner_name: 'g/ops', role: 'writer' })
+		expect(isFolderDraftDirty(added, baseline())).toBe(true)
+
+		const removed = baseline()
+		removed.perms.pop()
+		expect(isFolderDraftDirty(removed, baseline())).toBe(true)
+	})
+
+	it('is clean again once the baseline catches up', () => {
+		const saved = baseline()
+		saved.summary = 'Renamed'
+		expect(isFolderDraftDirty(saved, structuredClone(saved))).toBe(false)
+	})
+})
diff --git a/frontend/src/lib/folderDraft.ts b/frontend/src/lib/folderDraft.ts
new file mode 100644
index 0000000000..ade1b43d71
--- /dev/null
+++ b/frontend/src/lib/folderDraft.ts
@@ -0,0 +1,96 @@
+import { deepEqual } from 'fast-equals'
+import type { FolderDefaultPermissionedAs } from '$lib/gen'
+
+/** What a member may hold on a folder. `admin` is the `owners` array server-side; `writer`
+ *  and `viewer` are the `true`/`false` entries of `extra_perms`. */
+export type FolderRole = 'viewer' | 'writer' | 'admin'
+
+export type FolderMember = { owner_name: string; role: FolderRole }
+
+/** Everything the folder editor can change, held as one value so the whole edit is one
+ *  comparison against the loaded folder and one Save. */
+export type FolderDraft = {
+	summary: string
+	labels: string[]
+	defaultPermissionedAs: FolderDefaultPermissionedAs
+	perms: FolderMember[]
+}
+
+/** Whether the draft still matches the folder it was loaded from. Every field of
+ *  `FolderDraft` participates, so a field added to the type is covered by construction —
+ *  which is what the discard guard depends on: an edit this misses is an edit the drawer
+ *  throws away without asking. No baseline means nothing has loaded yet, so nothing to lose. */
+export function isFolderDraftDirty(draft: FolderDraft, baseline: FolderDraft | undefined): boolean {
+	return baseline != undefined && !deepEqual(sortedMembers(draft), sortedMembers(baseline))
+}
+
+/** Members are a set, but a reload rebuilds them in the server's `extra_perms` key order while
+ *  the draft keeps the order they were added in. Compared as-is, a change that has already been
+ *  applied still reads as dirty. Labels and rules keep their order, which is meaningful. */
+function sortedMembers(value: FolderDraft): FolderDraft {
+	return {
+		...value,
+		perms: [...value.perms].sort((a, b) => a.owner_name.localeCompare(b.owner_name))
+	}
+}
+
+/** One backend call the folder's members need. Kept as data so the mapping from role
+ *  transitions to endpoints can be read — and tested — without a server. */
+export type FolderPermissionCall =
+	/** `addowner`: appends to `owners` and sets `extra_perms[owner] = true`. */
+	| { kind: 'grantAdmin'; owner: string }
+	/** `removeowner` with a write flag: takes the member out of `owners` and sets their
+	 *  level. The only way down from admin. */
+	| { kind: 'demoteAdmin'; owner: string; write: boolean }
+	/** `acls/add`: sets `extra_perms[owner]`, for a member who is not an admin. */
+	| { kind: 'setAcl'; owner: string; write: boolean }
+	/** Both removals. `removeowner` without a write only drops the member from `owners`,
+	 *  leaving their `extra_perms` entry — alone it demotes an admin rather than removing
+	 *  them, so the ACL delete is not optional. */
+	| { kind: 'remove'; owner: string }
+
+/** The calls that turn `prev` into `next`. Members whose role is unchanged produce none.
+ *
+ *  `callerOwners` is the caller's own `u/name` plus every group they belong to. Giving up the
+ *  last of those that is in `owners` goes last: the write policy checks the row the update
+ *  would produce, so that call is refused for anyone but a workspace admin, and sent early it
+ *  takes the rest of the save with it. */
+export function folderPermissionDiff(
+	prev: FolderMember[],
+	next: FolderMember[],
+	callerOwners?: string[]
+): FolderPermissionCall[] {
+	const previousRole = new Map(prev.map((p) => [p.owner_name, p.role]))
+	const calls: FolderPermissionCall[] = []
+
+	for (const member of next) {
+		const before = previousRole.get(member.owner_name)
+		if (before === member.role) continue
+		if (member.role === 'admin') {
+			calls.push({ kind: 'grantAdmin', owner: member.owner_name })
+		} else if (before === 'admin') {
+			calls.push({
+				kind: 'demoteAdmin',
+				owner: member.owner_name,
+				write: member.role === 'writer'
+			})
+		} else {
+			calls.push({ kind: 'setAcl', owner: member.owner_name, write: member.role === 'writer' })
+		}
+	}
+
+	const kept = new Set(next.map((n) => n.owner_name))
+	for (const member of prev) {
+		if (kept.has(member.owner_name)) continue
+		calls.push({ kind: 'remove', owner: member.owner_name })
+	}
+
+	// `previousRole === 'admin'` is what makes it a handle: `callerOwners` lists every group
+	// the caller belongs to, and one holding only a viewer or writer row is not in `owners`,
+	// so removing it is an ordinary call that should not queue behind the fatal one.
+	const revokesCaller = (call: FolderPermissionCall) =>
+		(call.kind === 'demoteAdmin' || call.kind === 'remove') &&
+		(callerOwners?.includes(call.owner) ?? false) &&
+		previousRole.get(call.owner) === 'admin'
+	return [...calls.filter((c) => !revokesCaller(c)), ...calls.filter(revokesCaller)]
+}
diff --git a/frontend/src/lib/groupDraft.test.ts b/frontend/src/lib/groupDraft.test.ts
new file mode 100644
index 0000000000..2b8ef8c180
--- /dev/null
+++ b/frontend/src/lib/groupDraft.test.ts
@@ -0,0 +1,112 @@
+import { describe, it, expect } from 'vitest'
+import { groupMemberDiff, isGroupDraftDirty, type GroupDraft, type GroupRole } from './groupDraft'
+
+function baseline(): GroupDraft {
+	return {
+		summary: 'On-call engineers',
+		members: [
+			{ member_name: 'admin', role: 'admin' },
+			{ member_name: 'alice', role: 'member' }
+		]
+	}
+}
+
+describe('groupMemberDiff', () => {
+	// The whole transition matrix: which endpoints each role change maps to. A role is a
+	// membership row plus an ACL entry, so only the halves that actually change are sent —
+	// an extra call would log a permission-history row for something that did not move.
+	const transitions: Array<
+		[from: GroupRole | 'absent', to: GroupRole | 'absent', expected: unknown[]]
+	> = [
+		['absent', 'member', [{ kind: 'addUser', username: 'bob' }]],
+		['absent', 'manager', [{ kind: 'setAcl', username: 'bob' }]],
+		[
+			'absent',
+			'admin',
+			[
+				{ kind: 'addUser', username: 'bob' },
+				{ kind: 'setAcl', username: 'bob' }
+			]
+		],
+		['member', 'admin', [{ kind: 'setAcl', username: 'bob' }]],
+		[
+			'member',
+			'manager',
+			[
+				{ kind: 'removeUser', username: 'bob' },
+				{ kind: 'setAcl', username: 'bob' }
+			]
+		],
+		['manager', 'admin', [{ kind: 'addUser', username: 'bob' }]],
+		[
+			'manager',
+			'member',
+			[
+				{ kind: 'addUser', username: 'bob' },
+				{ kind: 'removeAcl', username: 'bob' }
+			]
+		],
+		['admin', 'member', [{ kind: 'removeAcl', username: 'bob' }]],
+		['admin', 'manager', [{ kind: 'removeUser', username: 'bob' }]],
+		['member', 'absent', [{ kind: 'removeUser', username: 'bob' }]],
+		['manager', 'absent', [{ kind: 'removeAcl', username: 'bob' }]],
+		[
+			'admin',
+			'absent',
+			[
+				{ kind: 'removeUser', username: 'bob' },
+				{ kind: 'removeAcl', username: 'bob' }
+			]
+		]
+	]
+
+	for (const [from, to, expected] of transitions) {
+		it(`${from} to ${to}`, () => {
+			const prev = from === 'absent' ? [] : [{ member_name: 'bob', role: from }]
+			const next = to === 'absent' ? [] : [{ member_name: 'bob', role: to }]
+			expect(groupMemberDiff(prev, next)).toEqual(expected)
+		})
+	}
+
+	it('sends nothing for an unchanged member', () => {
+		expect(groupMemberDiff(baseline().members, baseline().members)).toEqual([])
+	})
+
+	it('revokes the caller last so the rest of the save stays authorized', () => {
+		const prev = [{ member_name: 'admin', role: 'admin' as GroupRole }]
+		const next = [
+			{ member_name: 'admin', role: 'member' as GroupRole },
+			{ member_name: 'bob', role: 'admin' as GroupRole }
+		]
+		expect(groupMemberDiff(prev, next, 'admin')).toEqual([
+			{ kind: 'addUser', username: 'bob' },
+			{ kind: 'setAcl', username: 'bob' },
+			{ kind: 'removeAcl', username: 'admin' }
+		])
+	})
+})
+
+describe('isGroupDraftDirty', () => {
+	it('is clean against an equal baseline and dirty on any field', () => {
+		expect(isGroupDraftDirty(baseline(), baseline())).toBe(false)
+		expect(isGroupDraftDirty({ ...baseline(), summary: 'Other' }, baseline())).toBe(true)
+		expect(
+			isGroupDraftDirty(
+				{ ...baseline(), members: [{ member_name: 'admin', role: 'member' }] },
+				baseline()
+			)
+		).toBe(true)
+	})
+
+	it('is clean while nothing has loaded', () => {
+		expect(isGroupDraftDirty(baseline(), undefined)).toBe(false)
+	})
+
+	// A reload rebuilds the members in the server's order, which is not the order they were
+	// added in. Order-sensitive, an applied change would keep Save lit with nothing to send.
+	it('ignores the order the members are held in', () => {
+		const reordered = baseline()
+		reordered.members = [...reordered.members].reverse()
+		expect(isGroupDraftDirty(reordered, baseline())).toBe(false)
+	})
+})
diff --git a/frontend/src/lib/groupDraft.ts b/frontend/src/lib/groupDraft.ts
new file mode 100644
index 0000000000..dfd1767c30
--- /dev/null
+++ b/frontend/src/lib/groupDraft.ts
@@ -0,0 +1,99 @@
+import { deepEqual } from 'fast-equals'
+
+/** What a member may hold on a group. `member` is the `usr_to_group` row server-side and
+ *  `manager` is the `true` entry in `extra_perms`; `admin` is both at once. */
+export type GroupRole = 'member' | 'manager' | 'admin'
+
+export type GroupMember = { member_name: string; role: GroupRole }
+
+/** Everything the group editor can change, held as one value so the whole edit is one
+ *  comparison against the loaded group and one Save. */
+export type GroupDraft = {
+	summary: string
+	members: GroupMember[]
+}
+
+/** Whether the draft still matches the group it was loaded from. Every field of `GroupDraft`
+ *  participates, so a field added to the type is covered by construction — which is what the
+ *  discard guard depends on: an edit this misses is an edit the drawer throws away without
+ *  asking. No baseline means nothing has loaded yet, so nothing to lose. */
+export function isGroupDraftDirty(draft: GroupDraft, baseline: GroupDraft | undefined): boolean {
+	return baseline != undefined && !deepEqual(sortedMembers(draft), sortedMembers(baseline))
+}
+
+/** Members are a set, but a reload rebuilds them in the server's order while the draft keeps
+ *  the order they were added in. Compared as-is, a change that has already been applied still
+ *  reads as dirty. */
+function sortedMembers(value: GroupDraft): GroupDraft {
+	return {
+		...value,
+		members: [...value.members].sort((a, b) => a.member_name.localeCompare(b.member_name))
+	}
+}
+
+/** One backend call a group's members need. Kept as data so the mapping from role
+ *  transitions to endpoints can be read — and tested — without a server. */
+export type GroupMemberCall =
+	/** `addUserToGroup` / `removeUserToGroup`: the `usr_to_group` row. */
+	| { kind: 'addUser'; username: string }
+	| { kind: 'removeUser'; username: string }
+	/** `acls/add` / `acls/remove` on kind `group_`: the write entry that lets someone
+	 *  manage the group. */
+	| { kind: 'setAcl'; username: string }
+	| { kind: 'removeAcl'; username: string }
+
+/** The two independent things a role is made of: belonging to the group, and holding the
+ *  write entry that lets you manage it. Every role is one combination of the two, which is
+ *  why a transition needs at most one call per flag. */
+function flagsOf(role: GroupRole | undefined): { belongs: boolean; manages: boolean } {
+	return {
+		belongs: role === 'member' || role === 'admin',
+		manages: role === 'manager' || role === 'admin'
+	}
+}
+
+/** The calls that turn `prev` into `next`. Members whose role is unchanged produce none, and
+ *  a member dropped from `next` is treated as holding neither flag — which is what removing
+ *  one means.
+ *
+ *  `require_is_owner` authorizes each of these against `extra_perms['u/<caller>']`, so the
+ *  caller's own revocation goes last: in row order it lands first and the rest 403s. */
+export function groupMemberDiff(
+	prev: GroupMember[],
+	next: GroupMember[],
+	caller?: string
+): GroupMemberCall[] {
+	const previousRole = new Map(prev.map((p) => [p.member_name, p.role]))
+	const calls: GroupMemberCall[] = []
+
+	const transition = (
+		username: string,
+		before: GroupRole | undefined,
+		after: GroupRole | undefined
+	) => {
+		const from = flagsOf(before)
+		const to = flagsOf(after)
+		if (to.belongs !== from.belongs) {
+			calls.push({ kind: to.belongs ? 'addUser' : 'removeUser', username })
+		}
+		if (to.manages !== from.manages) {
+			calls.push({ kind: to.manages ? 'setAcl' : 'removeAcl', username })
+		}
+	}
+
+	for (const member of next) {
+		const before = previousRole.get(member.member_name)
+		if (before === member.role) continue
+		transition(member.member_name, before, member.role)
+	}
+
+	const kept = new Set(next.map((n) => n.member_name))
+	for (const member of prev) {
+		if (kept.has(member.member_name)) continue
+		transition(member.member_name, member.role, undefined)
+	}
+
+	const revokesCaller = (call: GroupMemberCall) =>
+		call.kind === 'removeAcl' && call.username === caller
+	return [...calls.filter((c) => !revokesCaller(c)), ...calls.filter(revokesCaller)]
+}
diff --git a/frontend/src/lib/hubPaths.json b/frontend/src/lib/hubPaths.json
index 2862fc7768..ee60298db4 100644
--- a/frontend/src/lib/hubPaths.json
+++ b/frontend/src/lib/hubPaths.json
@@ -1,6 +1,6 @@
 {
 	"gitSyncTest": "hub/28184/git-repo-test-read-write-windmill",
-	"gitInitRepo": "hub/28910/git-sync-init-repository-windmill",
+	"gitInitRepo": "hub/28930/git-sync-init-repository-windmill",
 	"slackErrorHandler": "hub/28794/workspace-or-schedule-error-handler-slack",
 	"emailErrorHandler": "hub/19795/workspace-or-error-handler-email",
 	"slackRecoveryHandler": "hub/28791/slack/schedule-recovery-handler-slack",
diff --git a/frontend/src/lib/importWizard/execution.svelte.ts b/frontend/src/lib/importWizard/execution.svelte.ts
index 06c33f3222..6a2c39b0b6 100644
--- a/frontend/src/lib/importWizard/execution.svelte.ts
+++ b/frontend/src/lib/importWizard/execution.svelte.ts
@@ -8,9 +8,10 @@ import {
 	installProject,
 	type InstallResult
 } from '$lib/components/workspaceSettings/projectInstall'
-import type {
-	ProjectExport,
-	ProjectMigration
+import {
+	projectReferencesResource,
+	type ProjectExport,
+	type ProjectMigration
 } from '$lib/components/workspaceSettings/projectBundle'
 import { planWorkspaceId, type ImportPlan } from './plan'
 import { probeImportedPaths, probeWorkspace } from './probe'
@@ -110,12 +111,16 @@ export class ImportExecution {
 	}
 
 	/**
-	 * How many resources the project shipped. Every one arrives as an empty stub —
-	 * the hub never publishes resource values — so a non-zero count means the setup
-	 * step has something to offer.
+	 * How many of the project's resources the setup step will ask about. Every resource
+	 * arrives as an empty stub — the hub never publishes resource values — but only the ones
+	 * something in the project points at have to hold a credential for it to work, and those
+	 * are the ones the step lists. Counting all of them here would offer a fourth step that
+	 * then has nothing on it.
 	 */
 	get resourceCount(): number {
-		return this.#export?.resources?.length ?? 0
+		const e = this.#export
+		if (!e) return 0
+		return (e.resources ?? []).filter((r) => projectReferencesResource(e, String(r.path))).length
 	}
 
 	get extraCounts(): { triggers: number; migrations: number } | undefined {
@@ -453,9 +458,7 @@ export class ImportExecution {
 		const problems: string[] = []
 		if (failed > 0) problems.push(`${failed} item${failed === 1 ? '' : 's'} failed to import`)
 		if (badMigrations > 0) {
-			problems.push(
-				`${badMigrations} data table migration${badMigrations === 1 ? '' : 's'} failed`
-			)
+			problems.push(`${badMigrations} data table migration${badMigrations === 1 ? '' : 's'} failed`)
 		}
 		if (problems.length) this.error = `${problems.join(', ')}.`
 	}
diff --git a/frontend/src/lib/importWizard/retargetDeployed.test.ts b/frontend/src/lib/importWizard/retargetDeployed.test.ts
new file mode 100644
index 0000000000..adf7a4c795
--- /dev/null
+++ b/frontend/src/lib/importWizard/retargetDeployed.test.ts
@@ -0,0 +1,393 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+/**
+ * The safety property: the stub survives anything the scan cannot account for. Rewriting an
+ * item onto the chosen resource is safe on its own, so it always happens; deleting the stub
+ * while an item still reads it is what breaks the imported project, and that item is exactly
+ * the one nobody looks at afterwards.
+ */
+
+const state = vi.hoisted(() => ({
+	apps: [] as any[],
+	scripts: [] as any[],
+	triggers: [] as any[],
+	scheduleListError: undefined as any,
+	failingTriggerPath: undefined as string | undefined,
+	deployedJs: 'COMPILED',
+	deletedResources: [] as string[],
+	updatedRawApps: [] as any[],
+	updatedApps: [] as any[],
+	updatedFlows: [] as any[],
+	flows: [] as any[],
+	updatedTriggers: [] as any[]
+}))
+
+vi.mock('$lib/gen', () => ({
+	ScriptService: {
+		listSearchScript: vi.fn(async () => state.scripts),
+		getScriptByPath: vi.fn(),
+		createScript: vi.fn()
+	},
+	FlowService: {
+		listSearchFlow: vi.fn(async () => state.flows),
+		getFlowByPath: vi.fn(async ({ path }: any) => state.flows.find((f: any) => f.path === path)),
+		updateFlow: vi.fn(async (p: any) => state.updatedFlows.push(p))
+	},
+	AppService: {
+		listSearchApp: vi.fn(async () => state.apps),
+		getAppByPath: vi.fn(async ({ path }: any) => state.apps.find((a) => a.path === path)),
+		getPublicSecretOfLatestVersionOfApp: vi.fn(async () => 'secret'),
+		updateApp: vi.fn(async (p: any) => state.updatedApps.push(p)),
+		updateAppRaw: vi.fn(async (p: any) => state.updatedRawApps.push(p))
+	},
+	ScheduleService: { updateSchedule: vi.fn() },
+	ResourceService: {
+		deleteResource: vi.fn(async ({ path }: any) => state.deletedResources.push(path))
+	}
+}))
+
+vi.mock('$lib/components/triggers/workspaceTriggersList', () => ({
+	TRIGGER_KINDS: {
+		schedule: {
+			badge: 'Schedule',
+			list: vi.fn(async () => {
+				if (state.scheduleListError) throw state.scheduleListError
+				return []
+			})
+		},
+		postgres: {
+			badge: 'Postgres',
+			list: vi.fn(async () => state.triggers),
+			update: vi.fn(async (_w: string, path: string, body: any) => {
+				if (path === state.failingTriggerPath) throw new Error('the update was rejected')
+				state.updatedTriggers.push({ path, body })
+			})
+		}
+	},
+	WORKSPACE_TRIGGER_KINDS: ['schedule', 'postgres'],
+	createWorkspaceTriggerDisabled: vi.fn(),
+	triggerHandlerRefs: () => []
+}))
+
+vi.mock('$lib/components/apps/editor/appPolicy', () => ({ updatePolicy: vi.fn(async () => ({})) }))
+vi.mock('$lib/sharedUtils', () => ({ updateRawAppPolicy: vi.fn(async () => ({})) }))
+
+// The deployed bundle is served by secret, not through the generated client.
+vi.stubGlobal(
+	'fetch',
+	vi.fn(async (url: string) => ({
+		ok: true,
+		status: 200,
+		text: async () => (url.endsWith('.js') ? state.deployedJs : 'STYLES')
+	}))
+)
+
+import { applyRetarget, seesWholeWorkspace } from './retargetDeployed'
+
+const FROM = 'f/proj/smtp'
+const TO = 'f/shared/company_smtp'
+
+/** A deployed raw app: sources plus runnables, with the bundle stored out of the value. */
+const rawApp = {
+	path: 'f/proj/dash',
+	raw_app: true,
+	value: { files: { '/App.tsx': 'v1' }, runnables: { send: { fields: { smtp: `$res:${FROM}` } } } }
+}
+
+async function run() {
+	return applyRetarget({
+		workspace: 'w',
+		folder: 'proj',
+		from: FROM,
+		to: TO,
+		seesWholeWorkspace: true
+	})
+}
+
+describe('applyRetarget', () => {
+	beforeEach(() => {
+		state.apps = [rawApp]
+		state.scripts = []
+		state.triggers = []
+		state.deployedJs = 'COMPILED'
+		state.scheduleListError = undefined
+		state.failingTriggerPath = undefined
+		state.deletedResources = []
+		state.updatedRawApps = []
+		state.updatedApps = []
+		state.flows = []
+		state.updatedFlows = []
+		state.updatedTriggers = []
+	})
+
+	// `updateAppRaw` refuses without a bundle, and the browser cannot rebuild one. The bundle
+	// that goes back is the deployed one, read back by secret.
+	it('sends the deployed bundle back with the rewritten value, then drops the stub', async () => {
+		const outcome = await run()
+		expect(outcome.error).toBeUndefined()
+		expect(outcome.gaps).toEqual([])
+		expect(outcome.stubDeleted).toBe(true)
+		expect(state.deletedResources).toEqual([FROM])
+		const sent = state.updatedRawApps[0]
+		expect(sent.formData.js).toBe('COMPILED')
+		expect(sent.formData.css).toBe('STYLES')
+		// Rewritten, and the bundle entries stay out of the value the way the import leaves them.
+		expect(JSON.stringify(sent.formData.app.value)).toContain(`$res:${TO}`)
+		expect(Object.keys(sent.formData.app.value.files)).toEqual(['/App.tsx'])
+	})
+
+	// The bundle is compiled from the sources, so a `$res:` a source spells out is baked into
+	// it. `retargetProjectExport` rewrites that copy on import, while /bundle.js is still one
+	// of `files` — sending the deployed bundle back untouched would undo exactly that.
+	it("rewrites the deployed bundle's own tokens before sending it back", async () => {
+		state.deployedJs = `const cfg = "$res:${FROM}"; export default cfg`
+		const outcome = await run()
+		expect(outcome.error).toBeUndefined()
+		expect(outcome.stubDeleted).toBe(true)
+		const sent = state.updatedRawApps[0]
+		expect(sent.formData.js).toContain(`$res:${TO}`)
+		expect(sent.formData.js).not.toContain(`$res:${FROM}`)
+	})
+
+	// A path the bundle names any other way is one nothing here can move, so the app is left
+	// alone and the stub it still reads has to survive.
+	it('keeps the stub when the bundle names the resource outside a $res: token', async () => {
+		state.deployedJs = `const cfg = await getResource("${FROM}")`
+		const outcome = await run()
+		expect(outcome.error).toBeUndefined()
+		expect(outcome.stubDeleted).toBe(false)
+		expect(state.deletedResources).toEqual([])
+		expect(state.updatedRawApps).toEqual([])
+	})
+
+	// The path written inside a source file is a reference too, and no rewriter reaches it.
+	//
+	it('keeps the stub when a source file names the resource in code', async () => {
+		state.apps = [
+			{
+				path: 'f/proj/dash',
+				raw_app: true,
+				value: {
+					files: { '/App.tsx': `const c = await getResource("${FROM}")` },
+					runnables: {}
+				}
+			}
+		]
+		const outcome = await run()
+		expect(outcome.error).toBeUndefined()
+		expect(outcome.stubDeleted).toBe(false)
+		expect(state.deletedResources).toEqual([])
+		expect(state.updatedRawApps).toEqual([])
+	})
+
+	// A trigger holds its resource as a bare path in its own column, not as a `$res:` token.
+	it('finds a trigger that holds the resource as a bare path', async () => {
+		state.apps = []
+		state.triggers = [
+			{
+				path: 'f/proj/ingest',
+				script_path: 'f/proj/run',
+				postgres_resource_path: FROM,
+				permissioned_as: 'u/service_account',
+				enabled: true
+			}
+		]
+		const outcome = await run()
+		expect(outcome.error).toBeUndefined()
+		expect(state.updatedTriggers[0].body.postgres_resource_path).toBe(TO)
+		// The trigger keeps its own path even though it was the string being remapped.
+		expect(state.updatedTriggers[0].path).toBe('f/proj/ingest')
+		// Pointing a trigger at a credential must not also start it: `enabled` is left out so
+		// the backend keeps whatever the trigger is set to.
+		expect(state.updatedTriggers[0].body).not.toHaveProperty('enabled')
+		// Nor run it as whoever picked the credential: a trigger states its identity as
+		// `permissioned_as`, which the backend keeps only when told to preserve it.
+		expect(state.updatedTriggers[0].body.permissioned_as).toBe('u/service_account')
+		expect(state.updatedTriggers[0].body.preserve_permissioned_as).toBe(true)
+		expect(state.deletedResources).toEqual([FROM])
+	})
+
+	// The stub is what a reference this run did not move still resolves through, so a write
+	// that fails partway must not take it: the moved items and the rest both keep working.
+	it('keeps the stub when a write fails, and reports what had already moved', async () => {
+		state.apps = []
+		state.triggers = [
+			{ path: 'f/proj/first', postgres_resource_path: FROM },
+			{ path: 'f/proj/second', postgres_resource_path: FROM }
+		]
+		state.failingTriggerPath = 'f/proj/second'
+		const outcome = await run()
+		expect(outcome.error).toContain('the update was rejected')
+		expect(outcome.rewritten.map((r) => r.path)).toEqual(['f/proj/first'])
+		expect(outcome.stubDeleted).toBe(false)
+		expect(state.deletedResources).toEqual([])
+	})
+
+	// Most trigger kinds are cargo features an instance may not compile in, and their routes
+	// then 404. Reading that as a failed listing keeps the stub on every stock build.
+	it('drops the stub when a trigger kind is not compiled in, keeps it when one truly fails', async () => {
+		state.scheduleListError = { status: 404 }
+		expect((await run()).gaps).toEqual([])
+		expect(state.deletedResources).toEqual([FROM])
+
+		state.deletedResources = []
+		state.scheduleListError = { status: 500 }
+		expect((await run()).gaps.map((g) => g.path)).toContain('Schedule triggers')
+		expect(state.deletedResources).toEqual([])
+	})
+
+	// The referrer scan matches a bare path anywhere in an app's value, while the rewriter only
+	// relocates `$res:` tokens and runnable paths. Rewriting such an app would claim a move that
+	// did not happen, and the stub it still reads would go.
+	it('leaves an app holding the resource path as a bare string alone, and keeps the stub', async () => {
+		state.apps = [
+			{
+				path: 'f/proj/page',
+				value: { grid: [{ data: { input: { type: 'static', value: FROM } } }] }
+			}
+		]
+		const outcome = await run()
+		expect(outcome.rewritten).toEqual([])
+		expect(outcome.gaps.map((g) => g.path)).toEqual(['f/proj/page'])
+		expect(state.deletedResources).toEqual([])
+	})
+
+	// Both spellings at once. The token is moved so the item stops depending on the stub for
+	// what it could, and the mention it spells out still keeps the stub alive.
+	it('rewrites the token of an app that also names the resource in code, and keeps the stub', async () => {
+		state.apps = [
+			{
+				path: 'f/proj/dash',
+				raw_app: true,
+				value: {
+					files: { '/App.tsx': `// the credential lives at ${FROM}` },
+					runnables: { send: { fields: { smtp: `$res:${FROM}` } } }
+				}
+			}
+		]
+		const outcome = await run()
+		expect(outcome.error).toBeUndefined()
+		expect(outcome.rewritten.map((r) => r.path)).toEqual(['f/proj/dash'])
+		expect(outcome.gaps.map((g) => g.path)).toEqual(['f/proj/dash'])
+		expect(outcome.stubDeleted).toBe(false)
+		expect(JSON.stringify(state.updatedRawApps[0].formData.app.value)).toContain(`$res:${TO}`)
+	})
+
+	// Scripts, flows and resources share a path namespace, and the map holds a resource path.
+	// The import's rewriters remap a runnable's own `path` on an exact match, which here would
+	// repoint the step at the credential.
+	it("moves an app's tokens without repointing a runnable that shares the path", async () => {
+		state.apps = [
+			{
+				path: 'f/proj/page',
+				value: {
+					grid: [{ data: { type: 'runnableByPath', runType: 'script', path: FROM } }],
+					inline: `$res:${FROM}`
+				}
+			}
+		]
+		const outcome = await run()
+		expect(outcome.error).toBeUndefined()
+		const sent = state.updatedApps[0]
+		expect(sent.requestBody.value.inline).toBe(`$res:${TO}`)
+		expect(sent.requestBody.value.grid[0].data.path).toBe(FROM)
+	})
+
+	// A token moves wherever it sits in the value, and a step's own path is left alone.
+	it('moves a flow token outside the fields the import rewriter reached', async () => {
+		state.flows = [
+			{
+				path: 'f/proj/pipeline',
+				value: {
+					modules: [
+						{ id: 'a', summary: `reads $res:${FROM}`, value: { type: 'script', path: FROM } }
+					]
+				}
+			}
+		]
+		const outcome = await run()
+		expect(outcome.error).toBeUndefined()
+		const sent = state.updatedFlows[0]
+		expect(sent.requestBody.value.modules[0].summary).toBe(`reads $res:${TO}`)
+		expect(sent.requestBody.value.modules[0].value.path).toBe(FROM)
+	})
+
+	// The listings run as the caller and row-level security filters them inside the query, so
+	// an item a member cannot read is invisible rather than counted. The stub has to outlive
+	// a scan that cannot see the whole workspace.
+	it('keeps the stub when the caller is not shown the whole workspace', async () => {
+		const outcome = await applyRetarget({
+			workspace: 'w',
+			folder: 'proj',
+			from: FROM,
+			to: TO,
+			seesWholeWorkspace: false
+		})
+		expect(outcome.error).toBeUndefined()
+		expect(outcome.stubDeleted).toBe(false)
+		expect(state.deletedResources).toEqual([])
+		expect(outcome.gaps.map((g) => g.path)).toContain('This workspace')
+	})
+
+	// A handler field names a runnable, and the map holds a resource path. A script sharing
+	// that path is not the reference being moved.
+	it("moves a trigger's resource field without repointing its error handler", async () => {
+		state.apps = []
+		state.triggers = [
+			{
+				path: 'f/proj/ingest',
+				script_path: 'f/proj/run',
+				postgres_resource_path: FROM,
+				on_failure: `script/${FROM}`,
+				error_handler_path: FROM,
+				permissioned_as: 'u/service_account'
+			}
+		]
+		const outcome = await run()
+		expect(outcome.error).toBeUndefined()
+		expect(state.updatedTriggers[0].body.postgres_resource_path).toBe(TO)
+		expect(state.updatedTriggers[0].body.on_failure).toBe(`script/${FROM}`)
+		// The bare spelling too: a handler path is a path and never a `$res:` token.
+		expect(state.updatedTriggers[0].body.error_handler_path).toBe(FROM)
+	})
+
+	// `listSearchApp` caps at 1000 rows server-side, unordered and unpaginated, so a full page
+	// may not hold the project's own app — and the stub would go anyway.
+	it('keeps the stub when the app listing comes back at its server-side cap', async () => {
+		state.apps = Array.from({ length: 1000 }, (_, i) => ({ path: `f/other/a${i}`, value: {} }))
+		const outcome = await run()
+		expect(outcome.gaps.map((g) => g.path)).toContain('Apps')
+		expect(state.deletedResources).toEqual([])
+	})
+
+	// The listings are workspace-wide. An item outside the project's folder is the user's own,
+	// so it is not rewritten — and it is exactly why the stub it reads has to stay.
+	it('rewrites what it owns and keeps the stub for a reference outside the project', async () => {
+		state.apps = []
+		state.scripts = [{ path: 'u/alice/report', content: `$res:${FROM}` }]
+		state.triggers = [
+			{ path: 'f/proj/ingest', script_path: 'f/proj/run', postgres_resource_path: FROM }
+		]
+		const outcome = await run()
+		expect(outcome.error).toBeUndefined()
+		expect(state.updatedTriggers[0].body.postgres_resource_path).toBe(TO)
+		expect(outcome.gaps.map((g) => g.path)).toEqual(['u/alice/report'])
+		expect(outcome.stubDeleted).toBe(false)
+		expect(state.deletedResources).toEqual([])
+	})
+})
+
+describe('seesWholeWorkspace', () => {
+	// The user record is per-workspace and survives a workspace change, so reading `is_admin`
+	// without checking which workspace it describes answers for the wrong one — and a wrong
+	// yes here is what lets an RLS-filtered scan clear the stub for deletion.
+	it.each([
+		['admin of this workspace', { workspace_id: 'w', is_admin: true }, false, true],
+		['admin of another workspace', { workspace_id: 'other', is_admin: true }, false, false],
+		['member of this workspace', { workspace_id: 'w', is_admin: false }, false, false],
+		['superadmin, record stale', { workspace_id: 'other', is_admin: false }, true, true],
+		['no user record', undefined, false, false]
+	])('%s', (_label, user, isSuperadmin, expected) => {
+		expect(seesWholeWorkspace(user as any, isSuperadmin, 'w')).toBe(expected)
+	})
+})
diff --git a/frontend/src/lib/importWizard/retargetDeployed.ts b/frontend/src/lib/importWizard/retargetDeployed.ts
new file mode 100644
index 0000000000..b33a69a667
--- /dev/null
+++ b/frontend/src/lib/importWizard/retargetDeployed.ts
@@ -0,0 +1,650 @@
+/**
+ * Point an already-imported project at a resource the workspace already has.
+ *
+ * The import writes `$res:f/<folder>/<name>` into every item that uses the project's
+ * resource — except a trigger, which holds the bare path in its own `*_resource_path`
+ * field. This rewrites those references to an existing resource, so the project reads the
+ * workspace's own credential — the same end state the import would have produced, reached
+ * after the fact.
+ *
+ * Two rules make that safe to run over deployed items:
+ *
+ *  - Only items inside the project's folder are rewritten. The import wrote nothing outside
+ *    it, so a reference from elsewhere is the user's own and not ours to move.
+ *  - The stub is deleted only when the scan can prove it saw every reference to it.
+ *    Listings come back capped, a trigger kind can fail to list, a reference can sit where no
+ *    rewriter reaches, and the listings themselves are row-level-security filtered so a
+ *    caller who is not a workspace admin is not shown every item — each of those is a gap,
+ *    and any gap keeps the stub.
+ *
+ * Rewriting is separable from deleting, and only the delete is destructive. An item moved
+ * onto the chosen resource resolves whether or not the stub survives; an item the scan never
+ * saw resolves only while the stub is there. So an incomplete scan downgrades the run to
+ * "rewritten, stub kept" rather than refusing it — the outcome names the gaps so the caller
+ * can say the placeholder is still around.
+ */
+
+import { AppService, FlowService, ResourceService, ScheduleService, ScriptService } from '$lib/gen'
+import {
+	rewriteContent,
+	rewriteTriggerConfig,
+	referencesResourcePath,
+	holdsResourceToken,
+	textHoldsBarePath
+} from '$lib/components/workspaceSettings/projectBundle'
+import {
+	TRIGGER_KINDS,
+	WORKSPACE_TRIGGER_KINDS,
+	type WorkspaceTriggerKind
+} from '$lib/components/triggers/workspaceTriggersList'
+import { updatePolicy } from '$lib/components/apps/editor/appPolicy'
+import { updateRawAppPolicy } from '$lib/sharedUtils'
+import type { App } from '$lib/components/apps/types'
+import { apiErrorMessage as errorMessage } from '$lib/utils'
+
+export type ReferrerKind = 'script' | 'flow' | 'app' | 'trigger'
+
+export interface Referrer {
+	kind: ReferrerKind
+	path: string
+	/** Present for triggers: which kind's table it lives in. */
+	triggerKind?: WorkspaceTriggerKind
+	/**
+	 * The plan already recorded this item as naming the path somewhere no rewrite reaches, so
+	 * the stub survives whatever the write does. Its tokens are still worth moving, and the
+	 * write's own staleness check has nothing left to add.
+	 */
+	gapped?: true
+	/**
+	 * Present for triggers: the row the scan read, which is also what the write sends back.
+	 * Re-reading it costs another listing of the whole kind per trigger — and for schedules a
+	 * listing plus a detail fetch per row, since `list` resolves each one.
+	 */
+	row?: Record<string, any>
+}
+
+/** Something the scan could not account for. `path` names an item, or a listing standing in
+ *  for every item it failed to return. */
+export interface Gap {
+	path: string
+	reason: string
+}
+
+export interface RetargetPlan {
+	/** Items whose reference this run will move. */
+	referrers: Referrer[]
+	/**
+	 * Why the scan cannot claim it saw every reference to the stub. Empty is the only state
+	 * in which deleting the stub is provably safe.
+	 */
+	gaps: Gap[]
+}
+
+export interface RetargetOutcome {
+	/** Items now reading the chosen resource. */
+	rewritten: Referrer[]
+	/** Why the stub was kept, when it was. */
+	gaps: Gap[]
+	stubDeleted: boolean
+	/** Set when a write failed. The run stopped there and the stub stays, so what was
+	 *  rewritten before it and what was not both resolve. */
+	error?: string
+}
+
+/**
+ * Whether this caller's listings are the whole workspace, and so whether a clean scan proves
+ * anything. Row-level security filters the listings inside the query for everyone else.
+ *
+ * `UserExt` is per-workspace and outlives a workspace change, so the role is only this
+ * workspace's role when the record says it is. On the setup step's reload path nothing
+ * re-fetches it, and it still describes the workspace the user came from — reading
+ * `is_admin` alone there answers for the wrong workspace. An instance superadmin bypasses
+ * the policies everywhere, which is why it is asked separately.
+ */
+export function seesWholeWorkspace(
+	user: { workspace_id?: string; is_admin?: boolean } | undefined,
+	isSuperadmin: boolean,
+	workspace: string
+): boolean {
+	if (isSuperadmin) return true
+	return !!user?.is_admin && user.workspace_id === workspace
+}
+
+/** Everything under the project's folder, which is all this rewrites. */
+function inFolder(path: unknown, folder: string): boolean {
+	return typeof path === 'string' && path.startsWith(`f/${folder}/`)
+}
+
+/**
+ * Whether the item names the resource path anywhere a rewriter would not reach it.
+ *
+ * A script, flow or app spells a reference the rewriters move as a `$res:` token and nothing
+ * else. The path appearing any other way is either a reference beyond them — a static string
+ * value in a component, an argument inline code assembles itself — or not the resource at
+ * all, such as a step running a script that happens to share the path. Neither is rewritable:
+ * moving the first is beyond the rewriters, and moving the second would repoint a runnable at
+ * a credential. Both are reasons the stub has to outlive the run.
+ *
+ * The whole serialized item is searched, because inline code is a string inside it and a path
+ * written in code is no less a reference for being surrounded by other characters. Triggers
+ * are the exception and hold the bare path by design, so they never come here.
+ */
+function namesPathUnreachably(value: unknown, path: string): boolean {
+	return textHoldsBarePath(JSON.stringify(value ?? null), path)
+}
+
+/**
+ * What each `listSearch*` endpoint caps its answer at, server-side. The queries carry no
+ * `ORDER BY` and the routes take no pagination, so a full page is an arbitrary subset with no
+ * page two to ask for.
+ *
+ * A full page is a sound truncation test only for an unscoped caller, which a wizard session
+ * is. The server applies its scope-path predicate to the rows the `LIMIT` already returned,
+ * so a scoped token can be handed a short page cut from a truncated query — reuse this scan
+ * under one and the cap goes undetected.
+ */
+const SEARCH_LIMITS = { script: 10000, flow: 1000, app: 1000 }
+
+/**
+ * What a trigger listing caps at. The kinds' list routes take pagination this table does not
+ * pass, so each answers with the server's `DEFAULT_PER_PAGE`. A full page is read the same
+ * way as a full `listSearch*` page: as a listing that cannot account for the rest.
+ */
+const TRIGGER_LIST_LIMIT = 1000
+
+/**
+ * Where a trigger names a runnable, taken from what `triggerHandlerRefs` reads.
+ *
+ * `rewriteTriggerConfig` remaps a runnable reference on an exact path match, which is right
+ * for the folder-wide map the import hands it and wrong for a map holding one resource path:
+ * a script sharing that path is not the reference being moved, and remapping it makes the
+ * trigger run a resource. So these are put back from the row after the rewrite.
+ *
+ * Split by spelling, because only one of the two can also hold a `$res:` token. A prefixed
+ * field is restored only when it holds the runnable spelling, so a token in it still moves;
+ * a bare field is a path and nothing else, so it is always restored.
+ */
+const PREFIXED_RUNNABLE_FIELDS = ['on_failure', 'on_recovery', 'on_success', 'url']
+const PREFIXED_RUNNABLE_RE = /^(?:\$(?:script|flow):|(?:script|flow)\/)/
+const BARE_RUNNABLE_FIELDS = ['dynamic_skip', 'error_handler_path', 'script_path']
+
+/** The rewritten config with every runnable reference put back as the row holds it. */
+function restoreRunnableRefs(rewritten: any, row: any): any {
+	const out = { ...rewritten }
+	for (const k of PREFIXED_RUNNABLE_FIELDS) {
+		if (typeof row?.[k] === 'string' && PREFIXED_RUNNABLE_RE.test(row[k])) out[k] = row[k]
+	}
+	for (const k of BARE_RUNNABLE_FIELDS) {
+		if (typeof row?.[k] === 'string') out[k] = row[k]
+	}
+	// A websocket's initial messages can each carry a runnable result, whose `path` is bare.
+	// Only that field is put back; the rest of the message is rewritten like any other value.
+	if (Array.isArray(out.initial_messages)) {
+		out.initial_messages = out.initial_messages.map((m: any, i: number) => {
+			const was = row?.initial_messages?.[i]?.runnable_result?.path
+			return m?.runnable_result && typeof was === 'string'
+				? { ...m, runnable_result: { ...m.runnable_result, path: was } }
+				: m
+		})
+	}
+	return out
+}
+
+/** A reference this run will not move, recorded so the stub outlives it. */
+const OUTSIDE_PROJECT = 'reads this resource from outside the project'
+const UNSEEN_BY_CALLER = 'holds items this account is not shown'
+const UNREACHABLE_REFERENCE = 'names the resource path outside a $res: reference'
+
+/**
+ * Which deployed items reference the stub, which of them this run can move, and what it
+ * could not account for.
+ *
+ * The `listSearch*` endpoints return each item's content in one call per kind, so this is
+ * three calls plus one per trigger kind rather than one per item.
+ */
+export async function planRetarget(
+	workspace: string,
+	folder: string,
+	from: string,
+	opts: { seesWholeWorkspace: boolean }
+): Promise<RetargetPlan> {
+	const referrers: Referrer[] = []
+	const gaps: Gap[] = []
+
+	// The listings run as the caller. Row-level security filters the rows out inside the
+	// query, so an item this account cannot read is not merely absent from the answer — it
+	// does not count towards the full-page test either, and nothing downstream can notice it.
+	// A colleague's private script reading this stub is exactly that shape.
+	if (!opts.seesWholeWorkspace) gaps.push({ path: 'This workspace', reason: UNSEEN_BY_CALLER })
+
+	const [scripts, flows, apps] = await Promise.all([
+		ScriptService.listSearchScript({ workspace }),
+		FlowService.listSearchFlow({ workspace }),
+		AppService.listSearchApp({ workspace })
+	])
+
+	for (const [label, rows, limit] of [
+		['Scripts', scripts, SEARCH_LIMITS.script],
+		['Flows', flows, SEARCH_LIMITS.flow],
+		['Apps', apps, SEARCH_LIMITS.app]
+	] as const) {
+		if ((rows?.length ?? 0) >= limit) gaps.push({ path: label, reason: 'could not all be listed' })
+	}
+
+	// The listings are workspace-wide, so an item outside the folder is seen for free. It is
+	// the user's own and stays on the stub, which is the whole reason the stub stays too.
+	for (const s of scripts ?? []) {
+		const content = String(s.content ?? '')
+		const reads = referencesResourcePath(content, from)
+		// `rewriteContent` moves the `$res:` tokens and nothing else, so a path the code spells
+		// out is a reference this run leaves behind.
+		const bare = textHoldsBarePath(content, from)
+		if (!reads && !bare) continue
+		if (!inFolder(s.path, folder)) {
+			gaps.push({ path: s.path!, reason: OUTSIDE_PROJECT })
+			continue
+		}
+		if (bare) {
+			gaps.push({ path: s.path!, reason: UNREACHABLE_REFERENCE })
+			if (!reads) continue
+		}
+		referrers.push({ kind: 'script', path: s.path!, ...(bare ? { gapped: true as const } : {}) })
+	}
+	for (const f of flows ?? []) {
+		const value: any = f.value ?? {}
+		// A token is the only spelling a rewriter moves. `referencesResourcePath` would also
+		// count a whole string equal to the path, which is the unreachable case `bare` covers.
+		const reads = holdsResourceToken(value, from)
+		const bare = namesPathUnreachably(value, from)
+		if (!reads && !bare) continue
+		if (!inFolder(f.path, folder)) {
+			gaps.push({ path: f.path!, reason: OUTSIDE_PROJECT })
+			continue
+		}
+		if (bare) {
+			gaps.push({ path: f.path!, reason: UNREACHABLE_REFERENCE })
+			if (!reads) continue
+		}
+		const gapped = bare ? ({ gapped: true } as const) : undefined
+		referrers.push({ kind: 'flow', path: f.path!, ...gapped })
+	}
+	for (const a of apps ?? []) {
+		const value: any = a.value ?? {}
+		// A token is the only spelling a rewriter moves. `referencesResourcePath` would also
+		// count a whole string equal to the path, which is the unreachable case `bare` covers.
+		const reads = holdsResourceToken(value, from)
+		const bare = namesPathUnreachably(value, from)
+		if (!reads && !bare) continue
+		if (!inFolder(a.path, folder)) {
+			gaps.push({ path: a.path!, reason: OUTSIDE_PROJECT })
+			continue
+		}
+		if (bare) {
+			gaps.push({ path: a.path!, reason: UNREACHABLE_REFERENCE })
+			if (!reads) continue
+		}
+		const gapped = bare ? ({ gapped: true } as const) : undefined
+		referrers.push({ kind: 'app', path: a.path!, ...gapped })
+	}
+
+	for (const kind of WORKSPACE_TRIGGER_KINDS) {
+		const def = TRIGGER_KINDS[kind]
+		// No `eeOnly` skip. That reads a client-side store, which is empty on an EE instance
+		// whose licence is unset or whose fetch failed — while the rows are still in the
+		// database and the routes still answer. A kind skipped that way leaves no gap, so the
+		// stub would go while an EE trigger still points at it. On CE the routes are not
+		// registered and the 404 below says so, from the server.
+		let rows: Array<Record<string, any>> = []
+		// A 404 is not an incomplete listing — the instance has that trigger feature compiled
+		// out, so there is no trigger of the kind to have missed. Anything else means triggers
+		// of this kind may reference the stub without this ever seeing them.
+		let incomplete = false
+		try {
+			rows = await def.list(workspace, () => (incomplete = true))
+		} catch (e: any) {
+			if (e?.status === 404) continue
+			incomplete = true
+		}
+		if (incomplete) {
+			gaps.push({ path: `${def.badge} triggers`, reason: 'could not be listed' })
+			continue
+		}
+		if (rows.length >= TRIGGER_LIST_LIMIT) {
+			gaps.push({ path: `${def.badge} triggers`, reason: 'could not all be listed' })
+			continue
+		}
+		for (const t of rows) {
+			if (!referencesResourcePath(t, from)) continue
+			if (!inFolder(t.path, folder)) {
+				gaps.push({ path: String(t.path), reason: OUTSIDE_PROJECT })
+				continue
+			}
+			// `schedule` has no `update` in the table because its service takes a different body
+			// shape; `rewriteTrigger` handles it directly, the way the import's create does.
+			if (kind !== 'schedule' && !def.update) {
+				gaps.push({
+					path: String(t.path),
+					reason: `${def.badge} triggers cannot be updated from here`
+				})
+				continue
+			}
+			referrers.push({ kind: 'trigger', path: String(t.path), triggerKind: kind, row: t })
+		}
+	}
+
+	return { referrers, gaps }
+}
+
+/**
+ * Rewrite every referrer the plan found, then delete the stub if the plan came back clean.
+ *
+ * A gap never stops the rewriting — moving an item onto the chosen resource is safe on its
+ * own. It stops only the delete, which is the one step that can strand a reference nobody
+ * looked at.
+ */
+export async function applyRetarget(args: {
+	workspace: string
+	folder: string
+	from: string
+	to: string
+	/** Whether the listings the scan reads are the whole workspace. See `planRetarget`. */
+	seesWholeWorkspace: boolean
+}): Promise<RetargetOutcome> {
+	const { workspace, folder, from, to, seesWholeWorkspace } = args
+	const map = new Map([[from, to]])
+	const rewritten: Referrer[] = []
+
+	const plan = await planRetarget(workspace, folder, from, { seesWholeWorkspace })
+	const gaps = [...plan.gaps]
+
+	for (const r of plan.referrers) {
+		let moved: true | string
+		try {
+			if (r.kind === 'script') moved = await rewriteScript(workspace, r, map)
+			else if (r.kind === 'flow') moved = await rewriteFlow(workspace, r, map)
+			else if (r.kind === 'app') moved = await rewriteApp(workspace, r, map)
+			else moved = await rewriteTrigger(workspace, r, map)
+		} catch (e: any) {
+			return { rewritten, gaps, stubDeleted: false, error: errorMessage(e) }
+		}
+		if (moved === true) rewritten.push(r)
+		else gaps.push({ path: r.path, reason: moved })
+	}
+
+	if (gaps.length > 0) return { rewritten, gaps, stubDeleted: false }
+
+	try {
+		await ResourceService.deleteResource({ workspace, path: from })
+	} catch (e: any) {
+		return { rewritten, gaps, stubDeleted: false, error: errorMessage(e) }
+	}
+	return { rewritten, gaps, stubDeleted: true }
+}
+
+/**
+ * The rewrite this module needs: `$res:` tokens and nothing else.
+ *
+ * `rewriteFlowValue` and `rewriteAppValue` also remap a runnable's own `path` on an exact
+ * match. That is right for the folder-wide map the import hands them, where every path is
+ * moving. Here the map holds one entry, a resource path — and scripts, flows and resources
+ * share a namespace, so a project shipping both a script and a resource named `smtp` would
+ * have the step calling `f/<folder>/smtp` repointed at the credential. Rewriting the
+ * serialized value moves the tokens and leaves every path alone.
+ */
+function rewriteTokens<T>(value: T, map: Map<string, string>): T {
+	return JSON.parse(rewriteContent(JSON.stringify(value ?? null), map))
+}
+
+/**
+ * Whether the item as just read names a path where no rewrite reaches it.
+ *
+ * The plan classifies items from the `listSearch*` rows; every rewriter then re-reads its
+ * item by path. A value that has gained an unreachable mention in between is one the plan
+ * cleared and the write must not: rewriting its tokens is fine, but the stub it still names
+ * has to survive. Checking the read the write is about to send is the only place that can be
+ * seen.
+ */
+function readsPathUnreachably(value: unknown, map: Map<string, string>): boolean {
+	for (const from of map.keys()) if (namesPathUnreachably(value, from)) return true
+	return false
+}
+
+/**
+ * Every write here is an in-place edit of a deployed item, not a redeployment by whoever
+ * opened the wizard, so each one has to say so.
+ *
+ * `preserve_on_behalf_of` is the flag that says it. Without it the backend replaces the
+ * item's stored run identity with the caller's — `resolve_on_behalf_of` for scripts and
+ * flows, the `should_preserve` branch of `update_app` for apps — and an imported item that
+ * ran as a service account would silently start running as the person who picked a
+ * credential. The backend still gates it on `wm_deployers` membership, so a caller who
+ * cannot preserve gets what they would have got anyway.
+ *
+ * For apps the policy is the other half: it carries the run identity, the execution mode and
+ * the sandbox rules, so it is read from the deployed app and handed back to the recompute
+ * rather than rebuilt from nothing.
+ */
+const PRESERVE_DEPLOYED_IDENTITY = { preserve_on_behalf_of: true }
+
+/**
+ * A new script version, the way the editor saves one. Spread rather than field-by-field:
+ * `Script` and `NewScript` share their names, and listing them here would silently drop
+ * whichever field someone adds next.
+ */
+async function rewriteScript(
+	workspace: string,
+	r: Referrer,
+	map: Map<string, string>
+): Promise<true | string> {
+	const path = r.path
+	const s: any = await ScriptService.getScriptByPath({ workspace, path })
+	if (!r.gapped)
+		for (const stub of map.keys())
+			if (textHoldsBarePath(String(s.content ?? ''), stub)) return UNREACHABLE_REFERENCE
+	const content = rewriteContent(s.content ?? '', map)
+	if (content === s.content) return true
+	await ScriptService.createScript({
+		workspace,
+		requestBody: {
+			...s,
+			...PRESERVE_DEPLOYED_IDENTITY,
+			content,
+			parent_hash: s.hash,
+			deployment_message: undefined
+		}
+	})
+	return true
+}
+
+async function rewriteFlow(
+	workspace: string,
+	r: Referrer,
+	map: Map<string, string>
+): Promise<true | string> {
+	const path = r.path
+	const f: any = await FlowService.getFlowByPath({ workspace, path })
+	if (!r.gapped && readsPathUnreachably(f.value ?? {}, map)) return UNREACHABLE_REFERENCE
+	const value = rewriteTokens(f.value ?? {}, map)
+	// The tokens the plan saw are gone from the deployed item, so there is nothing to write.
+	if (JSON.stringify(value) === JSON.stringify(f.value ?? {})) return true
+	await FlowService.updateFlow({
+		workspace,
+		path,
+		requestBody: { ...f, ...PRESERVE_DEPLOYED_IDENTITY, path, value }
+	})
+	return true
+}
+
+/**
+ * The deployed policy is recomputed, not rebuilt. Recomputing is required: `triggerables_v2`
+ * is keyed by `<component>:rawscript/<sha256(inline content)>`, and rewriting an inline
+ * runnable's content changes that key, so a policy copied verbatim would leave the component
+ * "forbidden by policy". Handing the deployed policy to the recompute is what keeps the run
+ * identity, the sandbox rules and everything else it does not touch.
+ *
+ * No execution mode is defaulted. The backend keeps the deployed mode when the submitted
+ * policy states none, and stating one here would put a `viewer` app on the publisher's
+ * identity.
+ */
+async function rewriteApp(
+	workspace: string,
+	r: Referrer,
+	map: Map<string, string>
+): Promise<true | string> {
+	const path = r.path
+	const a: any = await AppService.getAppByPath({ workspace, path })
+	// The deployed record says which kind this is. `list_search_apps` returns only the path and
+	// the value, so the scan could only have guessed from the value's shape — and a guess wrong
+	// in either direction is a deploy the backend refuses for changing an app's kind.
+	if (a.raw_app) return rewriteRawApp(workspace, r, map, a)
+	if (!r.gapped && readsPathUnreachably(a.value ?? {}, map)) return UNREACHABLE_REFERENCE
+	const next = rewriteTokens(a.value ?? {}, map)
+	// The tokens the plan saw are gone from the deployed item, so there is nothing to write.
+	if (JSON.stringify(next) === JSON.stringify(a.value ?? {})) return true
+	const policy = (await updatePolicy(next as App, a.policy)) as any
+	await AppService.updateApp({
+		workspace,
+		path,
+		requestBody: { ...PRESERVE_DEPLOYED_IDENTITY, path, value: next, policy }
+	})
+	return true
+}
+
+/**
+ * One half of a deployed raw app's compiled bundle, read back the way the Hub publish reads
+ * it: `/apps/get_data/v/{secret}.{ext}` serves it to anyone holding the secret, and the
+ * secret is minted for the caller against a plain `apps:read:<path>` check.
+ *
+ * A missing `.css` is an app that ships no styles. A missing `.js` is a broken deployment,
+ * and uploading an empty one in its place would break it further.
+ */
+async function fetchBundlePart(
+	workspace: string,
+	secret: string,
+	ext: 'js' | 'css'
+): Promise<string> {
+	const res = await fetch(
+		`/api/w/${encodeURIComponent(workspace)}/apps/get_data/v/${secret}.${ext}`,
+		{ credentials: 'include' }
+	)
+	if (res.ok) return await res.text()
+	if (ext === 'css' && res.status === 404) return ''
+	throw new Error(`the compiled bundle could not be read (${res.status})`)
+}
+
+/**
+ * A raw app: its deployed value carries the sources and the runnables, and `updateAppRaw`
+ * refuses without a bundle. The bundle is the deployed one, read back, rewritten and sent
+ * again — rebuilding it is not possible from the browser and is not needed, but re-uploading
+ * it untouched is not an option either.
+ *
+ * The bundle is compiled from the sources, so a `$res:` a source file spells out is baked
+ * into it. The import rewrites that copy — `retargetProjectExport` runs while `/bundle.js`
+ * is still one of `files`, and only `installProject` splits it out afterwards. Sending the
+ * deployed bundle back unrewritten would undo on reuse what the import got right, and the
+ * app would keep reading a resource this run is about to delete.
+ */
+async function rewriteRawApp(
+	workspace: string,
+	r: Referrer,
+	map: Map<string, string>,
+	a: any
+): Promise<true | string> {
+	const path = r.path
+	const value: any = a.value ?? {}
+	// One walk over the whole value: `$res:` tokens live in the runnables and can appear in
+	// the sources too, and both are plain text inside this JSON.
+	if (!r.gapped && readsPathUnreachably(value, map)) return UNREACHABLE_REFERENCE
+	const next = rewriteTokens(value, map)
+	const runnables = next.runnables ?? {}
+	const policy = (await updateRawAppPolicy(runnables, a.policy)) as any
+	const secret = await AppService.getPublicSecretOfLatestVersionOfApp({ workspace, path })
+	const [deployedJs, deployedCss] = await Promise.all([
+		fetchBundlePart(workspace, secret, 'js'),
+		fetchBundlePart(workspace, secret, 'css')
+	])
+	const js = rewriteContent(deployedJs, map)
+	const css = rewriteContent(deployedCss, map)
+	// `rewriteContent` moves the `$res:` tokens. A path the bundle spells out any other way
+	// is one nothing here can move, and uploading it would leave the app reading a resource
+	// about to be deleted.
+	for (const stub of map.keys()) if (textHoldsBarePath(js, stub)) return UNREACHABLE_REFERENCE
+	// The tokens the plan saw are gone from both the value and the bundle, so there is nothing
+	// to write, and uploading would cut a version differing from the last in nothing.
+	if (js === deployedJs && css === deployedCss && JSON.stringify(next) === JSON.stringify(value))
+		return true
+	const files = { ...(next.files ?? {}) }
+	delete files['/bundle.js']
+	delete files['/bundle.css']
+	await AppService.updateAppRaw({
+		workspace,
+		path,
+		formData: {
+			app: {
+				...PRESERVE_DEPLOYED_IDENTITY,
+				path,
+				summary: a.summary ?? '',
+				value: {
+					files,
+					runnables,
+					...(next.data !== undefined ? { data: next.data } : {}),
+					...(next.datatables !== undefined ? { datatables: next.datatables } : {})
+				},
+				policy
+			},
+			js,
+			css
+		}
+	})
+	return true
+}
+
+/**
+ * The trigger's own row, rewritten and written back. `enabled` is deliberately not sent:
+ * imported triggers are created disabled and re-enabling one is the user's decision, not a
+ * side effect of pointing it at a credential.
+ *
+ * `path` is put back from the row afterwards, and so is every runnable reference — see
+ * `restoreRunnableRefs`. The rewrite remaps any string equal to the stub's path, so a trigger
+ * sitting at the path the resource used to hold would otherwise be renamed along with the
+ * reference.
+ *
+ * A trigger states its run identity as `permissioned_as`, not the `on_behalf_of` the other
+ * kinds use, and `resolve_permissioned_as` keeps the row's value only when
+ * `preserve_permissioned_as` says so. Without the pair a trigger created under a folder's
+ * `default_permissioned_as` would start running as whoever picked the credential.
+ */
+async function rewriteTrigger(
+	workspace: string,
+	r: Referrer,
+	map: Map<string, string>
+): Promise<true | string> {
+	const def = TRIGGER_KINDS[r.triggerKind!]
+	const row: any = r.row ?? {}
+	const { enabled: _enabled, ...rest } = {
+		...restoreRunnableRefs(rewriteTriggerConfig(row, map), row),
+		path: r.path,
+		...(typeof row.permissioned_as === 'string'
+			? { permissioned_as: row.permissioned_as, preserve_permissioned_as: true }
+			: {})
+	}
+	// No unreachable-mention check: a trigger holds the bare path by design, in its own
+	// resource field, and `rewriteTriggerConfig` remaps every bare match at every depth. What
+	// can still read `from` afterwards is a restored identity field, not a reference.
+	if (r.triggerKind === 'schedule') {
+		// `EditSchedule` needs these three; everything else on the row carries over by name.
+		await ScheduleService.updateSchedule({
+			workspace,
+			path: r.path,
+			requestBody: {
+				...rest,
+				schedule: rest.schedule ?? '0 0 * * * *',
+				timezone: rest.timezone ?? 'UTC',
+				args: rest.args ?? {}
+			}
+		})
+		return true
+	}
+	await def.update!(workspace, r.path, rest)
+	return true
+}
diff --git a/frontend/src/lib/mcpEndpointTools.ts b/frontend/src/lib/mcpEndpointTools.ts
index 3e8ae4cba0..ce4adf82be 100644
--- a/frontend/src/lib/mcpEndpointTools.ts
+++ b/frontend/src/lib/mcpEndpointTools.ts
@@ -885,7 +885,7 @@ export const mcpEndpointTools: EndpointTool[] = [
     {
         name: "runScriptByPath",
         description: "run script by path",
-        instructions: "You should first use getScriptByPath to retrieve the script's schema and understand what arguments are expected.",
+        instructions: "You should first use getScriptByPath to retrieve the script's schema and understand what arguments are expected. A resource argument (schema format `resource-<type>`) is the bare string `$res:<path>` as that whole argument value -- not a wrapper object, not a plain path. A variable is `$var:<path>`.",
         path: "/w/{workspace}/jobs/run/p/{path}",
         method: "POST",
         pathParamsSchema: {
@@ -1426,7 +1426,7 @@ export const mcpEndpointTools: EndpointTool[] = [
     {
         name: "runFlowByPath",
         description: "run flow by path",
-        instructions: "You should first use getFlowByPath to retrieve the flow's schema and understand what arguments are expected.",
+        instructions: "You should first use getFlowByPath to retrieve the flow's schema and understand what arguments are expected. A resource argument (schema format `resource-<type>`) is the bare string `$res:<path>` as that whole argument value -- not a wrapper object, not a plain path. A variable is `$var:<path>`.",
         path: "/w/{workspace}/jobs/run/f/{path}",
         method: "POST",
         pathParamsSchema: {
diff --git a/frontend/src/routes/(root)/(logged)/+layout.svelte b/frontend/src/routes/(root)/(logged)/+layout.svelte
index 257af0fbbd..a20c61f2ff 100644
--- a/frontend/src/routes/(root)/(logged)/+layout.svelte
+++ b/frontend/src/routes/(root)/(logged)/+layout.svelte
@@ -83,6 +83,7 @@
 	import SessionPicker from '$lib/components/sessions/SessionPicker.svelte'
 	import SessionModeSwitch from '$lib/components/sessions/SessionModeSwitch.svelte'
 	import { isGlobalAiEnabled } from '$lib/components/copilot/chat/global/gate'
+	import { copilotInfo } from '$lib/aiStore'
 	import { parsePreviewItemRoute } from '$lib/components/sessions/previewPaths'
 	import { rememberNavRoute } from '$lib/components/sessions/sessionSwitch.svelte'
 	import { sessionState } from '$lib/components/sessions/sessionState.svelte'
@@ -250,6 +251,10 @@
 	// so it follows the gate; opted-out users get the legacy Ask-AI pane instead.
 	// The /sessions page has its own gate for direct navigation.
 	const globalAiEnabled = isGlobalAiEnabled()
+	// A workspace that hid the assistant (`ai_config.copilot_disabled`) loses both entry
+	// points: the Workspace ⇄ Sessions switch and the legacy Ask-AI button.
+	const sessionsSwitchShown = $derived(globalAiEnabled && !$copilotInfo.workspaceDisabled)
+	const askAiShown = $derived(!globalAiEnabled && !$copilotInfo.workspaceDisabled)
 
 	if (page.status == 404) {
 		goto('/user/login')
@@ -999,7 +1004,7 @@
 										</Menubar>
 									</div>
 
-									{#if !embedded && globalAiEnabled}
+									{#if !embedded && sessionsSwitchShown}
 										<!-- The switch: workspace navigation ⇄ sessions sidebar. -->
 										<div class="px-2 pb-1 w-52">
 											<SessionModeSwitch
@@ -1011,7 +1016,7 @@
 
 									{#if !sessionMode}
 										<!-- Workspace scope (fork picker): part of the top workspace group. -->
-										<div class="pb-1 w-52 {globalAiEnabled ? '' : '-mt-1'}">
+										<div class="pb-1 w-52 {sessionsSwitchShown ? '' : '-mt-1'}">
 											<WorkspaceScopeHeader isCollapsed={false} />
 										</div>
 									{/if}
@@ -1047,7 +1052,7 @@
 													class="!text-xs"
 													shortcut={`${getModifierKey()}k`}
 												/>
-												{#if !globalAiEnabled}
+												{#if askAiShown}
 													<!-- Legacy Ask-AI pane, shown only when the user opted out of the
 													     AI Sessions beta (otherwise SessionModeSwitch replaces it). -->
 													<MenuButton
@@ -1134,7 +1139,7 @@
 								</Menubar>
 							</div>
 
-							{#if !embedded && globalAiEnabled}
+							{#if !embedded && sessionsSwitchShown}
 								<!-- The switch: workspace navigation ⇄ sessions sidebar. -->
 								<div class="px-2 pb-1 {isCollapsed ? 'flex justify-center' : ''}">
 									<SessionModeSwitch mode={sessionMode ? 'session' : 'nav'} {isCollapsed} />
@@ -1145,7 +1150,7 @@
 								<!-- Workspace scope (fork picker): part of the top workspace group,
 								     together with the family menu and the mode switch above. Without
 								     the switch, pull it up so the group still reads as one block. -->
-								<div class="pb-1 {globalAiEnabled ? '' : '-mt-1'}">
+								<div class="pb-1 {sessionsSwitchShown ? '' : '-mt-1'}">
 									<WorkspaceScopeHeader {isCollapsed} />
 								</div>
 							{/if}
@@ -1184,7 +1189,7 @@
 											class="!text-xs"
 											shortcut={`${getModifierKey()}k`}
 										/>
-										{#if !globalAiEnabled}
+										{#if askAiShown}
 											<!-- Legacy Ask-AI pane, shown only when the user opted out of the
 											     AI Sessions beta (otherwise SessionModeSwitch replaces it). -->
 											<MenuButton
@@ -1323,19 +1328,21 @@
 									class="!text-xs"
 									shortcut={`${getModifierKey()}k`}
 								/>
-								<MenuButton
-									stopPropagationOnClick={true}
-									on:click={() => aiChatManager.toggleOpen()}
-									{isCollapsed}
-									icon={WandSparkles}
-									iconProps={{
-										forceDarkMode: true
-									}}
-									label="Ask AI"
-									class="!text-xs"
-									iconClasses="!text-ai"
-									shortcut={`${getModifierKey()}L`}
-								/>
+								{#if !$copilotInfo.workspaceDisabled}
+									<MenuButton
+										stopPropagationOnClick={true}
+										on:click={() => aiChatManager.toggleOpen()}
+										{isCollapsed}
+										icon={WandSparkles}
+										iconProps={{
+											forceDarkMode: true
+										}}
+										label="Ask AI"
+										class="!text-xs"
+										iconClasses="!text-ai"
+										shortcut={`${getModifierKey()}L`}
+									/>
+								{/if}
 							</div>
 
 							<SidebarContent
diff --git a/frontend/src/routes/(root)/(logged)/+page.svelte b/frontend/src/routes/(root)/(logged)/+page.svelte
index 38189c22ce..5e9bda4e2c 100644
--- a/frontend/src/routes/(root)/(logged)/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/+page.svelte
@@ -263,13 +263,14 @@
 	<ForkWorkspaceBanner />
 	<WorkspaceDraftsBanner />
 	<div class="max-w-7xl px-4 sm:px-8 md:px-8 h-fit w-full mb-6">
+		<TutorialBanner />
+
 		<!-- HomeAIChat carries both the AI composer and the AI-independent CLI/MCP connect row,
 		     so it shows whenever the sessions beta is on; the composer itself is gated on operator
-		     status inside the component (operators are refused by /sessions). -->
+		     status and on the workspace inside the component, which owns its own vertical spacing
+		     because the hero and the bare connect row want different amounts of it. -->
 		{#if isGlobalAiEnabled()}
-			<div class="w-full mb-16 mt-20">
-				<HomeAIChat />
-			</div>
+			<HomeAIChat />
 		{/if}
 
 		{#if $workspaceStore == 'admins'}
@@ -280,8 +281,6 @@
 			<div class="my-4"></div>
 		{/if}
 
-		<TutorialBanner />
-
 		<NoDirectDeployAlert onUpdateCanEditStatus={(v) => (showCreateButtons = v)} />
 
 		{#if tab == 'hub'}
diff --git a/frontend/src/routes/(root)/(logged)/flows/get/[...path]/+page.svelte b/frontend/src/routes/(root)/(logged)/flows/get/[...path]/+page.svelte
index 6d2a0a5ca4..441ed52373 100644
--- a/frontend/src/routes/(root)/(logged)/flows/get/[...path]/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/flows/get/[...path]/+page.svelte
@@ -84,6 +84,7 @@
 		onEditInForkClick
 	} from '$lib/utils/editInFork'
 	import { isCloudHosted } from '$lib/cloud'
+	import { agentStreamingEnabled } from '$lib/components/flows/agentFormFields'
 
 	let flow: Flow | undefined = $state()
 	let can_write = $state(false)
@@ -525,11 +526,8 @@
 	let shouldUseStreaming = $derived.by(() => {
 		const modules = flow?.value?.modules
 		const lastModule = modules && modules.length > 0 ? modules[modules.length - 1] : undefined
-		return (
-			lastModule?.value?.type === 'aiagent' &&
-			lastModule?.value?.input_transforms?.streaming?.type === 'static' &&
-			lastModule?.value?.input_transforms?.streaming?.value === true
-		)
+		if (lastModule?.value?.type !== 'aiagent') return false
+		return agentStreamingEnabled(lastModule.value)
 	})
 </script>
 
diff --git a/frontend/src/routes/(root)/(logged)/folders/+page.svelte b/frontend/src/routes/(root)/(logged)/folders/+page.svelte
index e35c4a7381..b184e4aa4a 100644
--- a/frontend/src/routes/(root)/(logged)/folders/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/folders/+page.svelte
@@ -4,11 +4,10 @@
 
 	import CenteredPage from '$lib/components/CenteredPage.svelte'
 	import Dropdown from '$lib/components/DropdownV2.svelte'
-	import FolderEditor from '$lib/components/FolderEditor.svelte'
+	import FolderEditorDrawer from '$lib/components/FolderEditorDrawer.svelte'
 	import PageHeader from '$lib/components/PageHeader.svelte'
 	import { userStore, workspaceStore, userWorkspaces } from '$lib/stores'
 	import { Button, Drawer, DrawerContent, EmptyState, Skeleton } from '$lib/components/common'
-	import Popover from '$lib/components/meltComponents/Popover.svelte'
 	import FolderInfo from '$lib/components/FolderInfo.svelte'
 	import FolderUsageInfo from '$lib/components/FolderUsageInfo.svelte'
 	import { sendUserToast } from '$lib/utils'
@@ -28,9 +27,8 @@
 		isDemoWorkspaceRestricted($workspaceStore, $userStore?.is_admin, $userStore?.is_super_admin)
 	)
 
-	let newFolderName: string = $state('')
 	let folders: FolderW[] | undefined = $state(undefined)
-	let folderDrawer: Drawer | undefined = $state()
+	let folderEditorDrawer: FolderEditorDrawer | undefined = $state()
 	let hubDrawer: Drawer | undefined = $state()
 	let publishFolderName: string = $state('')
 
@@ -47,23 +45,11 @@
 		})
 	}
 
-	function handleKeyUp(event: KeyboardEvent, close: () => void) {
-		const key = event.key
-		if (key === 'Enter') {
-			event.preventDefault()
-			addFolder()
-			close()
-		}
-	}
-	async function addFolder() {
-		await FolderService.createFolder({
-			workspace: $workspaceStore ?? '',
-			requestBody: { name: newFolderName }
-		})
-		$userStore?.folders.push(newFolderName)
-		loadFolders()
-		editFolderName = newFolderName
-		folderDrawer?.openDrawer()
+	function onFolderSaved(name: string, created: boolean) {
+		if (created) $userStore?.folders.push(name)
+		// Returned, not fired: the drawer reports a failed reload, and it can only see one
+		// through the promise this hands back.
+		return loadFolders()
 	}
 
 	$effect(() => {
@@ -74,8 +60,6 @@
 		}
 	})
 
-	let editFolderName: string = $state('')
-
 	function computeMembers(owners: string[], extra_perms: Record<string, any>) {
 		const members = new Set(owners)
 		for (const [user, _] of Object.entries(extra_perms)) {
@@ -85,48 +69,18 @@
 	}
 </script>
 
-{#snippet newFolderPopover(
-	label: string,
-	placement: 'bottom' | 'bottom-end',
-	variant: 'accent' | 'default'
-)}
-	<Popover
-		floatingConfig={{ strategy: 'absolute', placement }}
-		contentClasses="flex flex-col gap-2 p-4"
+{#snippet newFolderButton(label: string, variant: 'accent' | 'default')}
+	<Button
+		{variant}
+		unifiedSize="md"
+		startIcon={{ icon: Plus }}
+		on:click={() => folderEditorDrawer?.initNew()}
 	>
-		{#snippet trigger()}
-			<Button {variant} unifiedSize="md" startIcon={{ icon: Plus }} nonCaptureEvent>{label}</Button>
-		{/snippet}
-		{#snippet content({ close })}
-			<input
-				class="mr-2"
-				onkeyup={(e) => handleKeyUp(e, () => close())}
-				placeholder="New folder name"
-				bind:value={newFolderName}
-			/>
-
-			<div>
-				<Button
-					variant="accent"
-					startIcon={{ icon: Plus }}
-					disabled={!newFolderName}
-					on:click={() => {
-						addFolder()
-						close()
-					}}
-				>
-					Create
-				</Button>
-			</div>
-		{/snippet}
-	</Popover>
+		{label}
+	</Button>
 {/snippet}
 
-<Drawer bind:this={folderDrawer}>
-	<DrawerContent title="Folder {editFolderName}" on:close={folderDrawer.closeDrawer}>
-		<FolderEditor on:update={loadFolders} name={editFolderName} />
-	</DrawerContent>
-</Drawer>
+<FolderEditorDrawer bind:this={folderEditorDrawer} onSaved={onFolderSaved} />
 
 <Drawer bind:this={hubDrawer} size="1100px">
 	<DrawerContent
@@ -168,7 +122,7 @@
 						New folder
 					</Button>
 				{:else}
-					{@render newFolderPopover('New folder', 'bottom-end', 'accent')}
+					{@render newFolderButton('New folder', 'accent')}
 				{/if}
 			</div>
 		</PageHeader>
@@ -181,7 +135,7 @@
 					description="Folders are how you grant permissions: make a user or group viewer, writer or admin on a folder and that access applies to every script, flow, app, resource and schedule inside it."
 				>
 					{#if !restricted}
-						{@render newFolderPopover('Add a folder', 'bottom', 'default')}
+						{@render newFolderButton('Add a folder', 'default')}
 					{/if}
 				</EmptyState>
 			{:else}
@@ -196,8 +150,8 @@
 							<Cell head class="w-20">Schedules</Cell>
 							<Cell head class="w-20">Variables</Cell>
 							<Cell head class="w-20">Resources</Cell>
-							<Cell head class="w-20">Participants</Cell>
-							<Cell head last stickyEnd />
+							<Cell head class="w-20">Members</Cell>
+							<Cell head last actions>Actions</Cell>
 						</tr>
 					</Head>
 					<tbody class="divide-y">
@@ -211,13 +165,7 @@
 							{/each}
 						{:else}
 							{#each folders as { name, extra_perms, owners, canWrite, summary, labels } (name)}
-								<Row
-									hoverable
-									on:click={() => {
-										editFolderName = name
-										folderDrawer?.openDrawer()
-									}}
-								>
+								<Row hoverable on:click={() => folderEditorDrawer?.initEdit(name)}>
 									<Cell first>
 										<span class="text-emphasis text-xs font-semibold">{name}</span>
 										{#if summary}
@@ -250,17 +198,14 @@
 									<FolderUsageInfo {name} tabular />
 
 									<Cell><FolderInfo members={computeMembers(owners, extra_perms)} /></Cell>
-									<Cell last stickyEnd shouldStopPropagation>
+									<Cell last actions shouldStopPropagation>
 										<Dropdown
 											items={[
 												{
 													displayName: 'Manage folder',
 													icon: Pen,
 													disabled: !canWrite,
-													action: () => {
-														editFolderName = name
-														folderDrawer?.openDrawer()
-													}
+													action: () => folderEditorDrawer?.initEdit(name)
 												},
 												{
 													displayName: 'Publish to Hub',
diff --git a/frontend/src/routes/(root)/(logged)/groups/+page.svelte b/frontend/src/routes/(root)/(logged)/groups/+page.svelte
index 85b4b536fe..ce8c6a8db0 100644
--- a/frontend/src/routes/(root)/(logged)/groups/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/groups/+page.svelte
@@ -5,9 +5,8 @@
 
 	import CenteredPage from '$lib/components/CenteredPage.svelte'
 	import { Button, Drawer, DrawerContent, Skeleton } from '$lib/components/common'
-	import Popover from '$lib/components/meltComponents/Popover.svelte'
 	import Dropdown from '$lib/components/DropdownV2.svelte'
-	import GroupEditor from '$lib/components/GroupEditor.svelte'
+	import GroupEditorDrawer from '$lib/components/GroupEditorDrawer.svelte'
 	import InstanceGroupEditor from '$lib/components/InstanceGroupEditor.svelte'
 	import GroupInfo from '$lib/components/GroupInfo.svelte'
 	import PageHeader from '$lib/components/PageHeader.svelte'
@@ -20,7 +19,6 @@
 	import Cell from '$lib/components/table/Cell.svelte'
 	import Row from '$lib/components/table/Row.svelte'
 	import { untrack } from 'svelte'
-	import TextInput from '$lib/components/text_input/TextInput.svelte'
 	import { Tooltip } from '$lib/components/meltComponents'
 	import { DEMO_RESTRICTION_HINT, isDemoWorkspaceRestricted } from '$lib/cloud'
 
@@ -30,10 +28,9 @@
 		isDemoWorkspaceRestricted($workspaceStore, $userStore?.is_admin, $userStore?.is_super_admin)
 	)
 
-	let newGroupName: string = $state('')
 	let groups: GroupW[] | undefined = $state(undefined)
 	let instanceGroups: InstanceGroupWithWorkspaces[] | undefined = $state(undefined)
-	let groupDrawer: Drawer | undefined = $state()
+	let groupEditorDrawer: GroupEditorDrawer | undefined = $state()
 
 	async function loadGroups(): Promise<void> {
 		groups = (await GroupService.listGroups({ workspace: $workspaceStore! })).map((x) => {
@@ -49,24 +46,6 @@
 		}
 	}
 
-	function handleKeyUp(event: KeyboardEvent, close: () => void) {
-		const key = event.key
-		if (key === 'Enter') {
-			event.preventDefault()
-			addGroup()
-			close()
-		}
-	}
-	async function addGroup() {
-		await GroupService.createGroup({
-			workspace: $workspaceStore ?? '',
-			requestBody: { name: newGroupName }
-		})
-		loadGroups()
-		editGroupName = newGroupName
-		groupDrawer?.openDrawer()
-	}
-
 	$effect(() => {
 		untrack(() => loadInstanceGroups())
 		if ($workspaceStore && $userStore) {
@@ -74,16 +53,11 @@
 		}
 	})
 
-	let editGroupName: string = $state('')
 	let instanceGroupDrawer: Drawer | undefined = $state()
 	let editInstanceGroupName: string = $state('')
 </script>
 
-<Drawer bind:this={groupDrawer}>
-	<DrawerContent title="Group {editGroupName}" on:close={groupDrawer.closeDrawer}>
-		<GroupEditor on:update={loadGroups} name={editGroupName} />
-	</DrawerContent>
-</Drawer>
+<GroupEditorDrawer bind:this={groupEditorDrawer} onSaved={loadGroups} />
 
 <Drawer bind:this={instanceGroupDrawer}>
 	<DrawerContent
@@ -119,37 +93,14 @@
 							New&nbsp;group
 						</Button>
 					{:else}
-						<Popover floatingConfig={{ strategy: 'absolute', placement: 'bottom-end' }}>
-							{#snippet trigger()}
-								<Button unifiedSize="md" variant="accent" startIcon={{ icon: Plus }} nonCaptureEvent
-									>New&nbsp;group</Button
-								>
-							{/snippet}
-							{#snippet content({ close })}
-								<div class="flex-col flex gap-2 p-4">
-									<TextInput
-										size="md"
-										inputProps={{
-											placeholder: 'New group name',
-											onkeyup: (e) => handleKeyUp(e, close)
-										}}
-										bind:value={newGroupName}
-									/>
-									<Button
-										unifiedSize="md"
-										variant="accent"
-										startIcon={{ icon: Plus }}
-										disabled={!newGroupName}
-										on:click={() => {
-											addGroup()
-											close()
-										}}
-									>
-										Create
-									</Button>
-								</div>
-							{/snippet}
-						</Popover>
+						<Button
+							unifiedSize="md"
+							variant="accent"
+							startIcon={{ icon: Plus }}
+							on:click={() => groupEditorDrawer?.initNew()}
+						>
+							New&nbsp;group
+						</Button>
 					{/if}
 				</div>
 			</div>
@@ -161,7 +112,7 @@
 					<tr>
 						<Cell head first>Name</Cell>
 						<Cell head>Members</Cell>
-						<Cell head last />
+						<Cell head last actions>Actions</Cell>
 					</tr>
 				</Head>
 				<tbody class="divide-y">
@@ -175,13 +126,7 @@
 						{/each}
 					{:else}
 						{#each groups as { name, summary, extra_perms, canWrite } (name)}
-							<Row
-								hoverable
-								on:click={() => {
-									editGroupName = name
-									groupDrawer?.openDrawer()
-								}}
-							>
+							<Row hoverable on:click={() => groupEditorDrawer?.initEdit(name)}>
 								<Cell first>
 									<div class="flex flex-row gap-2 justify-between">
 										<div>
@@ -197,7 +142,7 @@
 								<Cell>
 									<GroupInfo {name} />
 								</Cell>
-								<Cell>
+								<Cell last actions shouldStopPropagation>
 									<Dropdown
 										items={[
 											{
@@ -206,8 +151,7 @@
 												disabled: !canWrite,
 												action: (e) => {
 													e?.stopPropagation()
-													editGroupName = name
-													groupDrawer?.openDrawer()
+													groupEditorDrawer?.initEdit(name)
 												}
 											},
 											{
diff --git a/frontend/src/routes/(root)/(logged)/projects/import/+page@(root).svelte b/frontend/src/routes/(root)/(logged)/projects/import/+page@(root).svelte
index a1bc2ab970..a6f4632526 100644
--- a/frontend/src/routes/(root)/(logged)/projects/import/+page@(root).svelte
+++ b/frontend/src/routes/(root)/(logged)/projects/import/+page@(root).svelte
@@ -261,9 +261,10 @@
 			setupUndecided = false
 			return
 		}
-		// Every resource the project ships arrives as an empty stub, so any project with
-		// resources has something to fill in. The step itself re-checks and shows only
-		// what is genuinely outstanding, which is what makes a re-import quiet.
+		// `resourceCount` is the referenced subset — the resources something in the project
+		// points at — and each one arrives as an empty stub, so any project that has them has
+		// something to fill in. The step itself re-checks and shows only what is genuinely
+		// outstanding, which is what makes a re-import quiet.
 		if (execution.resourceCount > 0) {
 			setupNeeded = true
 			setupUndecided = false
diff --git a/frontend/src/routes/(root)/(logged)/resources/+page.svelte b/frontend/src/routes/(root)/(logged)/resources/+page.svelte
index 6f3fd1a6dc..d1ca52e60d 100644
--- a/frontend/src/routes/(root)/(logged)/resources/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/resources/+page.svelte
@@ -68,7 +68,6 @@
 		Plus,
 		RotateCw,
 		Save,
-		FlaskConical,
 		SearchX,
 		Shield,
 		Trash,
@@ -78,12 +77,19 @@
 	import autosize from '$lib/autosize'
 	import EditableSchemaWrapper from '$lib/components/schema/EditableSchemaWrapper.svelte'
 	import ResourceEditorDrawer from '$lib/components/ResourceEditorDrawer.svelte'
+	import {
+		agentEditorTarget,
+		closeAgentEditor,
+		openAgentEditor
+	} from '$lib/components/flows/agentEditorStore.svelte'
+	import { copilotInfo } from '$lib/aiStore'
+	import { setPageDrawerAnchor } from '$lib/components/sessions/pageDrawerSession'
+	import { RESOURCES_PATH } from '$lib/components/sessions/previewPaths'
 	import GfmMarkdown from '$lib/components/GfmMarkdown.svelte'
 	import ExploreAssetButton, {
 		assetCanBeExplored
 	} from '../../../../lib/components/ExploreAssetButton.svelte'
 	import NoDirectDeployAlert from '$lib/components/NoDirectDeployAlert.svelte'
-	import AgentEvalModal from '$lib/components/aiEvals/AgentEvalModal.svelte'
 
 	type ResourceW = ListableResource & { canWrite: boolean; marked?: string }
 	type ResourceTypeW = ResourceType & { canWrite: boolean }
@@ -129,14 +135,33 @@
 		isFileset: false
 	})
 	let resourceEditor: ResourceEditorDrawer | undefined = $state(undefined)
+
+	/** An `ai_agent` gets the agent editor rather than the generic resource form, which would
+	 *  render its configuration as raw JSON. Both write the same resource draft, so the choice is
+	 *  presentational and either can open a path the other left a draft at. */
+	function openResourceEditor(path: string, resourceType: string | undefined) {
+		if (resourceType === 'ai_agent') {
+			// The generic editor anchors itself from `initEdit`; this one has to, or the URL, a
+			// refresh, and the AI session's idea of where you are all miss the open agent. Claim the
+			// hash first so the deep-link effect does not treat our own write as a new navigation.
+			handledHash = `#/resource/${path}`
+			// One row at a time: the hash can retarget from a resource to an agent, and the two
+			// editors are separate overlays that would otherwise stack, the older one surfacing again
+			// when the newer is closed.
+			resourceEditor?.close?.({ keepAnchor: true })
+			openAgentEditor({ path })
+			setPageDrawerAnchor(RESOURCES_PATH, path)
+		} else {
+			closeAgentEditor()
+			resourceEditor?.initEdit?.(path)
+		}
+	}
 	let shareModal: ShareModal | undefined = $state(undefined)
 	let appConnect: AppConnect | undefined = $state(undefined)
 	let supabaseConnect: SupabaseConnect | undefined = $state(undefined)
 	let deleteConfirmedCallback: (() => void) | undefined = $state(undefined)
 	let deleteIsLinked = $state(false)
 	let deletePath = $state('')
-	let evalsOpen = $state(false)
-	let evalsAgentPath = $state<string | undefined>(undefined)
 	let loading = $state({
 		resources: true,
 		types: true
@@ -646,10 +671,40 @@
 			return
 		}
 		if (hash === handledHash || !resourceEditor) return
+		// The type decides which editor opens, so wait for the list that carries it.
+		if (!resources) return
 		handledHash = hash
-		resourceEditor.initEdit(hash.slice(11))
+		const path = hash.slice(11)
+		void openResourceFromHash(path)
 	})
 
+	/** The listing is narrowed by the active filters, so a deep-linked resource may not be in it.
+	 *  Treating that absence as "unknown type" would open the generic form, which materializes a
+	 *  default into every field the value omits and so writes a draft just by rendering. Ask the
+	 *  server instead. */
+	async function openResourceFromHash(path: string) {
+		let resourceType = resources?.find((r) => r.path === path)?.resource_type
+		if (resourceType === undefined) {
+			// The hash can move on while this is in flight, and two lookups can land out of order.
+			// Whichever resolves last must not open an editor the URL has already left.
+			const openingFor = handledHash
+			try {
+				resourceType = (await ResourceService.getResource({ workspace: $workspaceStore!, path }))
+					.resource_type
+			} catch (err) {
+				if (handledHash !== openingFor) return
+				// Opening the generic form on an unknown type is the very thing this avoids, so a
+				// failed lookup opens nothing at all. The hash stays claimed: the effect above reads
+				// it, so releasing it here would re-enter this lookup and toast on a loop. Clicking
+				// the row is the way to try again.
+				sendUserToast(`Could not open ${path}: ${err}`, true)
+				return
+			}
+			if (handledHash !== openingFor) return
+		}
+		openResourceEditor(path, resourceType)
+	}
+
 	let showTable = $derived(
 		tab == 'workspace' || tab == 'states' || tab == 'cache' || tab == 'theme'
 	)
@@ -1086,8 +1141,8 @@
 									<Cell head>Path</Cell>
 									<Cell head>Resource type</Cell>
 									<Cell head>Description</Cell>
-									<Cell head />
-									<Cell head last stickyEnd />
+									<Cell head>Status</Cell>
+									<Cell head last actions>Actions</Cell>
 								</Row>
 							</Head>
 							<tbody class="divide-y bg-surface">
@@ -1106,7 +1161,7 @@
 														href="#/resource/{path}"
 														onclick={() => {
 															handledHash = `#/resource/${path}`
-															resourceEditor?.initEdit?.(path)
+															openResourceEditor(path, resource_type)
 														}}
 														>{#if marked}{@html marked}{:else}{path}{/if}{hasDraft ? '*' : ''}</a
 													>
@@ -1254,8 +1309,8 @@
 													{/if}
 												</div>
 											</Cell>
-											<Cell last stickyEnd>
-												<div class="flex justify-end">
+											<Cell last actions>
+												<div class="flex justify-end items-center gap-2">
 													{#if path && assetCanBeExplored({ kind: 'resource', path }, { resource_type }) && !$userStore?.operator}
 														<ExploreAssetButton
 															asset={{ kind: 'resource', path }}
@@ -1266,18 +1321,6 @@
 													<Dropdown
 														class="w-fit"
 														items={[
-															...(resource_type === 'ai_agent' && !draft_only
-																? [
-																		{
-																			displayName: 'Evals',
-																			icon: FlaskConical,
-																			action: () => {
-																				evalsAgentPath = path
-																				evalsOpen = true
-																			}
-																		}
-																	]
-																: []),
 															{
 																displayName: 'Permissions',
 																icon: Shield,
@@ -1290,9 +1333,31 @@
 																icon: Pen,
 																disabled: !canWrite || !showCreateButtons,
 																action: () => {
-																	resourceEditor?.initEdit?.(path)
+																	openResourceEditor(path, resource_type)
 																}
 															},
+															// The agent form covers an agent's configuration, not everything a
+															// resource carries: the workspace-specific toggle in particular is
+															// only in the generic editor. JSON rather than that editor's form,
+															// which would render the configuration field by field and write a
+															// default into every one the agent leaves unset. Both write the same
+															// draft row, so this is a second view of the same edits.
+															...(resource_type === 'ai_agent'
+																? [
+																		{
+																			displayName: 'Edit as JSON',
+																			icon: Braces,
+																			disabled: !canWrite || !showCreateButtons,
+																			action: () => {
+																				// The drawer anchors itself in the hash, which the deep-link
+																				// effect would then read and route back to the agent editor.
+																				// Claim it first, as the row's own link does.
+																				handledHash = `#/resource/${path}`
+																				resourceEditor?.initEdit?.(path, { json: true })
+																			}
+																		}
+																	]
+																: []),
 															...(!ws_specific && isDeployable('resource', path, deployUiSettings)
 																? [
 																		{
@@ -1374,7 +1439,7 @@
 								<Row>
 									<Cell head first>Name</Cell>
 									<Cell head>Description</Cell>
-									<Cell head last stickyEnd />
+									<Cell head last actions>Actions</Cell>
 								</Row>
 							</Head>
 							<tbody class="divide-y bg-surface">
@@ -1418,7 +1483,7 @@
 													</span>
 												</div>
 											</Cell>
-											<Cell last stickyEnd class="border-l-0 text-right">
+											<Cell last actions>
 												{#if !canWrite}
 													<!-- Badge is inline-flex, so it needs a right-aligning wrapper to sit
 														flush with the action buttons on the rows that have them. -->
@@ -1478,7 +1543,6 @@
 
 <SupabaseConnect bind:this={supabaseConnect} on:refresh={loadResources} />
 <AppConnect bind:this={appConnect} on:refresh={loadResources} />
-<AgentEvalModal agentPath={evalsAgentPath} bind:open={evalsOpen} />
 
 <ResourceEditorDrawer
 	bind:this={resourceEditor}
@@ -1492,3 +1556,13 @@
 		loadResources()
 	}}
 />
+
+<!-- Same capabilities as from a flow step: the editor is the same one, so which surface opened it
+     must not decide whether its tools can be written with the copilot. -->
+<!-- Imported only once an agent is opened: the editor pulls in the flow editor, which is most of
+     this route's JavaScript and none of what the resources table needs. -->
+{#if agentEditorTarget()}
+	{#await import('$lib/components/flows/content/AgentEditorModal.svelte') then { default: AgentEditorModal }}
+		<AgentEditorModal enableAi={$copilotInfo.enabled} owns={(t) => t.host === undefined} />
+	{/await}
+{/if}
diff --git a/frontend/src/routes/(root)/(logged)/sessions/+page.svelte b/frontend/src/routes/(root)/(logged)/sessions/+page.svelte
index fbf045fe19..da8fc31c65 100644
--- a/frontend/src/routes/(root)/(logged)/sessions/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/sessions/+page.svelte
@@ -21,6 +21,8 @@
 		type Scope
 	} from '$lib/components/sessions/PreviewRouterPicker.svelte'
 	import { goto } from '$lib/navigation'
+	import { resource } from 'runed'
+	import { WorkspaceService } from '$lib/gen'
 	import SessionWrapper from '$lib/components/sessions/SessionWrapper.svelte'
 	import PreviewTabHost from '$lib/components/sessions/PreviewTabHost.svelte'
 	import { useIsDarkMode } from '$lib/components/DarkModeObserver.svelte'
@@ -278,6 +280,36 @@
 		(activeSession ? getEffectiveWorkspaceId(activeSession) : undefined) ?? $workspaceStore
 	)
 
+	// Whether that workspace hid the AI assistant (`ai_config.copilot_disabled`). Read
+	// directly rather than from `copilotInfo`: that store holds whichever workspace loaded
+	// last, and the gate below unmounts the session wrapper that would refresh it, so a
+	// hidden verdict would stick across session and workspace switches. Tagged with its
+	// workspace and guarded against a superseded response like the protection-rules
+	// resource: runed keeps the previous `current` while a new source loads, so a switch
+	// would otherwise be judged on the previous workspace's verdict. A failed read leaves
+	// the page usable, as an unloaded config does everywhere else.
+	const workspaceAiHidden = resource(
+		() => previewWorkspace,
+		async (workspace, _prev, { signal }) => {
+			if (!workspace) return { workspace, hidden: false }
+			let hidden = false
+			try {
+				hidden = (await WorkspaceService.getCopilotInfo({ workspace })).copilot_disabled === true
+			} catch (e) {
+				console.error(`Failed to read the AI config of workspace ${workspace}:`, e)
+			}
+			// The generated client can't take an abort signal, so drop a superseded response here.
+			if (signal.aborted) throw new DOMException('superseded', 'AbortError')
+			return { workspace, hidden }
+		}
+	)
+	// Only a verdict for the workspace currently judged counts; `undefined` means it has not
+	// landed yet.
+	const aiHiddenVerdict = $derived.by(() => {
+		const current = workspaceAiHidden.current
+		return current && current.workspace === previewWorkspace ? current.hidden : undefined
+	})
+
 	// Lazy-mount gate: a tab's content only renders once its key lands here (on
 	// first activation) — so restoring a session with N saved tabs boots just
 	// the active one instead of N full Windmill apps at once. Pure "has this
@@ -559,9 +591,7 @@
 		}
 	})
 
-	// Preview cards on create/update tool calls dispatch here. Open
-	// (or focus, if already shown) the item's preview in the active session's panel —
-	// the visible chat is always the active session, so `owner` is its panel. Read
+	// The visible chat is always the active session, so `owner` is its panel. Read
 	// `owner` lazily inside the handler (not in the effect body) so this registers
 	// once, not on every session switch.
 	$effect(() => {
@@ -836,284 +866,309 @@
 			<Loader2 class="animate-spin" />
 		</div>
 	{:else}
-		<div class="flex-1 min-h-0 flex flex-row relative" use:splitterPointerCapture>
-			<Splitpanes
-				horizontal={false}
-				class="flex-1 min-h-0 session-splitter {previewCollapsed ? 'splitter-off' : ''}"
+		<!-- The hidden-assistant verdict overlays the session stack rather than replacing
+		     it: warm sessions and mounted preview editors must survive a cross-workspace
+		     switch, and a verdict still loading would otherwise tear them down on every
+		     one. The covered stack is inert so nothing under the overlay takes focus. -->
+		<div class="flex-1 min-h-0 flex flex-col relative">
+			<div
+				class="flex-1 min-h-0 flex flex-row relative z-0"
+				use:splitterPointerCapture
+				inert={aiHiddenVerdict !== false}
 			>
-				{#if !fullscreen}
-					<!-- Chat column. Warm sessions stay mounted (stacked, visibility-toggled)
+				<Splitpanes
+					horizontal={false}
+					class="flex-1 min-h-0 session-splitter {previewCollapsed ? 'splitter-off' : ''}"
+				>
+					{#if !fullscreen}
+						<!-- Chat column. Warm sessions stay mounted (stacked, visibility-toggled)
 					     so switching between them preserves chat scroll/draft state. -->
-					<Pane bind:size={chatPaneSize} minSize={25} class="flex flex-col min-h-0">
-						<div class="relative flex-1 min-h-0">
-							{#each warmSessions as s (s.id)}
-								<div
-									class="absolute inset-0 flex flex-col {s.id === activeSession?.id
-										? 'z-10 opacity-100 pointer-events-auto'
-										: 'z-0 opacity-0 pointer-events-none'}"
-									aria-hidden={s.id !== activeSession?.id}
-								>
-									<SessionWrapper sessionId={s.id} />
-								</div>
-							{/each}
-						</div>
-					</Pane>
-				{/if}
+						<Pane bind:size={chatPaneSize} minSize={25} class="flex flex-col min-h-0">
+							<div class="relative flex-1 min-h-0">
+								{#each warmSessions as s (s.id)}
+									<div
+										class="absolute inset-0 flex flex-col {s.id === activeSession?.id
+											? 'z-10 opacity-100 pointer-events-auto'
+											: 'z-0 opacity-0 pointer-events-none'}"
+										aria-hidden={s.id !== activeSession?.id}
+									>
+										<SessionWrapper sessionId={s.id} />
+									</div>
+								{/each}
+							</div>
+						</Pane>
+					{/if}
 
-				<!-- Preview panel: the live Windmill page, framed like the editor pane.
+					<!-- Preview panel: the live Windmill page, framed like the editor pane.
 				     Always mounted (collapse resizes it to 0 — see previewPaneSize) so
 				     warm sessions' preview hosts survive a collapsed active session. -->
-				<Pane
-					bind:size={previewPaneSize}
-					minSize={previewCollapsed ? 0 : 30}
-					maxSize={previewCollapsed ? 0 : 100}
-					class="flex flex-col min-h-0"
-				>
-					<div class="flex-1 min-h-0 flex flex-col {fullscreen ? 'p-0' : 'p-2 pl-0'}">
-						<div
-							class="flex flex-col flex-1 min-h-0 overflow-hidden relative bg-surface {fullscreen
-								? ''
-								: 'rounded-md border border-light'}"
-						>
-							{#if !fullscreen}
-								<!-- Collapse the preview panel — floats over the top-left corner so
+					<Pane
+						bind:size={previewPaneSize}
+						minSize={previewCollapsed ? 0 : 30}
+						maxSize={previewCollapsed ? 0 : 100}
+						class="flex flex-col min-h-0"
+					>
+						<div class="flex-1 min-h-0 flex flex-col {fullscreen ? 'p-0' : 'p-2 pl-0'}">
+							<div
+								class="flex flex-col flex-1 min-h-0 overflow-hidden relative bg-surface {fullscreen
+									? ''
+									: 'rounded-md border border-light'}"
+							>
+								{#if !fullscreen}
+									<!-- Collapse the preview panel — floats over the top-left corner so
 									     the tab strip keeps the full width. -->
-								<button
-									type="button"
-									onclick={() => owner?.setCollapsed(true)}
-									title="Collapse preview"
-									aria-label="Collapse preview"
-									class="absolute top-1 left-1 z-30 inline-flex items-center justify-center w-6 h-6 rounded text-tertiary hover:text-primary hover:bg-surface-hover"
-								>
-									<PanelRightClose size={14} />
-								</button>
-							{/if}
+									<button
+										type="button"
+										onclick={() => owner?.setCollapsed(true)}
+										title="Collapse preview"
+										aria-label="Collapse preview"
+										class="absolute top-1 left-1 z-30 inline-flex items-center justify-center w-6 h-6 rounded text-tertiary hover:text-primary hover:bg-surface-hover"
+									>
+										<PanelRightClose size={14} />
+									</button>
+								{/if}
 
-							<!-- Open-in-full-page + full-screen toggle, floating over the top-right
+								<!-- Open-in-full-page + full-screen toggle, floating over the top-right
 								     corner to mirror the collapse control. -->
-							<div class="absolute top-1 right-1 z-30 flex items-center gap-0.5">
-								{#if !activeTabIsArtifact}
-									<a
-										href={withWorkspaceParam(
-											owner?.activeTab?.loc || owner?.activeTab?.url || `${base}/`,
-											previewWorkspace
-										)}
-										title="Open in workspace"
-										aria-label="Open in workspace"
+								<div class="absolute top-1 right-1 z-30 flex items-center gap-0.5">
+									{#if !activeTabIsArtifact}
+										<a
+											href={withWorkspaceParam(
+												owner?.activeTab?.loc || owner?.activeTab?.url || `${base}/`,
+												previewWorkspace
+											)}
+											title="Open in workspace"
+											aria-label="Open in workspace"
+											class="inline-flex items-center justify-center w-6 h-6 rounded text-tertiary hover:text-primary hover:bg-surface-hover"
+										>
+											<ExternalLink size={14} />
+										</a>
+									{/if}
+									<button
+										type="button"
+										onclick={() => (fullscreen = !fullscreen)}
+										title={fullscreen ? 'Exit full screen' : 'Full screen'}
+										aria-label={fullscreen ? 'Exit full screen' : 'Full screen'}
 										class="inline-flex items-center justify-center w-6 h-6 rounded text-tertiary hover:text-primary hover:bg-surface-hover"
 									>
-										<ExternalLink size={14} />
-									</a>
-								{/if}
-								<button
-									type="button"
-									onclick={() => (fullscreen = !fullscreen)}
-									title={fullscreen ? 'Exit full screen' : 'Full screen'}
-									aria-label={fullscreen ? 'Exit full screen' : 'Full screen'}
-									class="inline-flex items-center justify-center w-6 h-6 rounded text-tertiary hover:text-primary hover:bg-surface-hover"
-								>
-									{#if fullscreen}
-										<Minimize2 size={14} />
-									{:else}
-										<Maximize2 size={14} />
-									{/if}
-								</button>
-							</div>
+										{#if fullscreen}
+											<Minimize2 size={14} />
+										{:else}
+											<Maximize2 size={14} />
+										{/if}
+									</button>
+								</div>
 
-							<!-- Tab strip: open preview pages, shared with the raw-app editor
+								<!-- Tab strip: open preview pages, shared with the raw-app editor
 								     (DraggableTabs). Clicking the active tab (label or accessory chevron)
 								     toggles its breadcrumb picker; the "+" trailing opens the router picker.
 								     Left/right padding clears the floating collapse/fullscreen buttons. -->
-							<DraggableTabs
-								tabs={previewTabItems}
-								activeId={owner?.activeId ?? ''}
-								onSelect={selectTab}
-								onActiveClick={() => (activeTabPickerOpen = !activeTabPickerOpen)}
-								onClose={closeTab}
-								onReorder={reorderTabs}
-								class="session-preview-tab-strip h-8 border-b border-light bg-surface-secondary/50 {fullscreen
-									? 'pl-1.5'
-									: 'pl-9'} pr-16"
-							>
-								{#snippet tabAccessory(_tab, isActive)}
-									{#if isActive}
-										<!-- Any active-tab click toggles the picker (`onActiveClick`); the tab
+								<DraggableTabs
+									tabs={previewTabItems}
+									activeId={owner?.activeId ?? ''}
+									onSelect={selectTab}
+									onActiveClick={() => (activeTabPickerOpen = !activeTabPickerOpen)}
+									onClose={closeTab}
+									onReorder={reorderTabs}
+									class="session-preview-tab-strip h-8 border-b border-light bg-surface-secondary/50 {fullscreen
+										? 'pl-1.5'
+										: 'pl-9'} pr-16"
+								>
+									{#snippet tabAccessory(_tab, isActive)}
+										{#if isActive}
+											<!-- Any active-tab click toggles the picker (`onActiveClick`); the tab
 										     is excluded from pointerdown-outside so toggle doesn't race close.
 										     The trigger is an inert whole-tab overlay (anchor only — clickable
 										     would break dnd reorder); the chevron is purely visual. -->
-										<Popover
-											placement="bottom-start"
-											usePointerDownOutside
-											excludeSelectors=".drawer, .session-preview-tab-strip [role='tab'][aria-selected='true']"
-											disableFocusTrap
-											closeOnOtherPopoverOpen
-											enableFlyTransition
-											bind:isOpen={activeTabPickerOpen}
-											openFocus="[data-workspace-picker-search]"
-											contentClasses="flex flex-col overflow-hidden"
-											class="absolute inset-0 pointer-events-none"
-											triggerAttrs={{
-												'aria-label': 'Change preview',
-												tabindex: -1,
-												// The inert trigger only ever receives focus from melt's
-												// close-time restore; hand it straight to the tab so
-												// arrow/Delete tab shortcuts keep working.
-												onfocus: (e: FocusEvent) =>
-													(e.currentTarget as HTMLElement)
-														.closest<HTMLElement>('[role="tab"]')
-														?.focus()
-											}}
-										>
-											{#snippet content()}
-												<!-- The picker snapshots its scope at mount, but `friendlyPath` is
+											<Popover
+												placement="bottom-start"
+												usePointerDownOutside
+												excludeSelectors=".drawer, .session-preview-tab-strip [role='tab'][aria-selected='true']"
+												disableFocusTrap
+												closeOnOtherPopoverOpen
+												enableFlyTransition
+												bind:isOpen={activeTabPickerOpen}
+												openFocus="[data-workspace-picker-search]"
+												contentClasses="flex flex-col overflow-hidden"
+												class="absolute inset-0 pointer-events-none"
+												triggerAttrs={{
+													'aria-label': 'Change preview',
+													tabindex: -1,
+													// The inert trigger only ever receives focus from melt's
+													// close-time restore; hand it straight to the tab so
+													// arrow/Delete tab shortcuts keep working.
+													onfocus: (e: FocusEvent) =>
+														(e.currentTarget as HTMLElement)
+															.closest<HTMLElement>('[role="tab"]')
+															?.focus()
+												}}
+											>
+												{#snippet content()}
+													<!-- The picker snapshots its scope at mount, but `friendlyPath` is
 												     stamped async once the editor cell loads — a picker opened
 												     before the stamp is scoped to the `draft_<uuid>` storage
 												     folder while the tree groups the draft under its friendly
 												     folder. Remount on the scope dir so it re-lands on the item. -->
-												{#key activePickerScope?.dir ?? ''}
-													<PreviewRouterPicker
-														initialScope={activePickerScope}
-														initialHighlight={activePickerHighlight}
-														{currentItem}
-														workspaceId={previewWorkspace}
-														artifacts={sessionArtifacts}
-														onPick={(t) => {
-															activeTabPickerOpen = false
-															navigatePreviewTo(t)
-														}}
-													/>
-												{/key}
-											{/snippet}
-										</Popover>
-										<ChevronDown
-											size={12}
-											class="shrink-0 text-tertiary group-hover:text-primary"
-										/>
-									{/if}
-								{/snippet}
-								{#snippet afterTabs()}
-									<Popover
-										placement="bottom-start"
-										usePointerDownOutside
-										excludeSelectors=".drawer"
-										disableFocusTrap
-										closeOnOtherPopoverOpen
-										bind:isOpen={newTabOpen}
-										enableFlyTransition
-										openFocus="[data-workspace-picker-search]"
-										contentClasses="flex flex-col overflow-hidden"
-										class="shrink-0 inline-flex items-center justify-center w-6 h-6 rounded text-tertiary hover:text-primary hover:bg-surface-hover cursor-pointer"
-									>
-										{#snippet trigger()}
-											<Plus size={14} />
-										{/snippet}
-										{#snippet content()}
-											<PreviewRouterPicker
-												workspaceId={previewWorkspace}
-												artifacts={sessionArtifacts}
-												onPick={(t) => {
-													newTabOpen = false
-													openInNewTab(t)
-												}}
+													{#key activePickerScope?.dir ?? ''}
+														<PreviewRouterPicker
+															initialScope={activePickerScope}
+															initialHighlight={activePickerHighlight}
+															{currentItem}
+															workspaceId={previewWorkspace}
+															artifacts={sessionArtifacts}
+															onPick={(t) => {
+																activeTabPickerOpen = false
+																navigatePreviewTo(t)
+															}}
+														/>
+													{/key}
+												{/snippet}
+											</Popover>
+											<ChevronDown
+												size={12}
+												class="shrink-0 text-tertiary group-hover:text-primary"
 											/>
-										{/snippet}
-									</Popover>
-								{/snippet}
-							</DraggableTabs>
-
-							<!-- One host per tab of every warm session, stacked and
-								     visibility-toggled so switching tabs or sessions never reloads
-								     a mounted tab — hosts live as long as the session's runtime,
-								     content-gated by the shared mount MRU. Each host renders a
-								     live editor (script/flow/raw_app target) or an iframe fallback. -->
-							<div class="relative flex-1 min-h-0">
-								{#each warmSessions as s (s.id)}
-									{@const rt = getRuntime(s.id)}
-									{@const tabs = rt?.previewTabs}
-									{#each tabs?.tabs ?? [] as tab (tab.id)}
-										<!-- tabHosts is an imperative ref-bag (only tabHosts[key]?.reload() in
-										     reloadTabs); it is intentionally a plain object so component
-										     instances aren't proxied. Nothing reads it reactively, so the
-										     non-reactive binding is fine. -->
-										<!-- svelte-ignore binding_property_non_reactive -->
-										<PreviewTabHost
-											bind:this={tabHosts[tabKey(s.id, tab.id)]}
-											{tab}
-											session={s}
-											runtime={rt}
-											active={s.id === activeSession?.id && tab.id === tabs?.activeId}
-											collapsed={(tabs?.collapsed ?? false) && !fullscreen}
-											mounted={mountedTabKeys.has(tabKey(s.id, tab.id))}
-											label={tabLabelFor(tab, s.workspace_id ?? '')}
-											darkMode={isDarkMode.val}
-											{fullscreen}
-											onNavigate={navigateEditorTo}
-											onLoad={(frame) => tabs && onTabLoad(tabs, tab, frame)}
-										/>
-									{/each}
-								{/each}
-								{#if (owner?.tabs.length ?? 0) === 0}
-									<!-- New session with nothing to preview: an empty state with a
-										     picker to open one, instead of defaulting to the home page. -->
-									<div
-										class="absolute inset-0 flex flex-col items-center justify-center gap-3 text-center px-6 bg-surface"
-									>
-										<MonitorPlay size={28} class="text-tertiary" />
-										<div class="flex flex-col gap-1">
-											<span class="text-sm font-medium text-secondary">No preview open</span>
-											<span class="text-xs text-tertiary max-w-xs"
-												>Open a page, flow, script or app to preview it alongside the chat.</span
-											>
-										</div>
+										{/if}
+									{/snippet}
+									{#snippet afterTabs()}
 										<Popover
-											placement="bottom"
+											placement="bottom-start"
 											usePointerDownOutside
 											excludeSelectors=".drawer"
 											disableFocusTrap
 											closeOnOtherPopoverOpen
-											bind:isOpen={emptyStateNewTabOpen}
+											bind:isOpen={newTabOpen}
 											enableFlyTransition
 											openFocus="[data-workspace-picker-search]"
 											contentClasses="flex flex-col overflow-hidden"
+											class="shrink-0 inline-flex items-center justify-center w-6 h-6 rounded text-tertiary hover:text-primary hover:bg-surface-hover cursor-pointer"
 										>
 											{#snippet trigger()}
-												<span
-													class="inline-flex items-center gap-1.5 px-2.5 py-1.5 rounded-md text-xs border border-light text-secondary hover:bg-surface-hover cursor-pointer"
-												>
-													<Plus size={14} /> Open a preview
-												</span>
+												<Plus size={14} />
 											{/snippet}
 											{#snippet content()}
 												<PreviewRouterPicker
 													workspaceId={previewWorkspace}
 													artifacts={sessionArtifacts}
 													onPick={(t) => {
-														emptyStateNewTabOpen = false
+														newTabOpen = false
 														openInNewTab(t)
 													}}
 												/>
 											{/snippet}
 										</Popover>
-									</div>
-								{/if}
+									{/snippet}
+								</DraggableTabs>
+
+								<!-- One host per tab of every warm session, stacked and
+								     visibility-toggled so switching tabs or sessions never reloads
+								     a mounted tab — hosts live as long as the session's runtime,
+								     content-gated by the shared mount MRU. Each host renders a
+								     live editor (script/flow/raw_app target) or an iframe fallback. -->
+								<div class="relative flex-1 min-h-0">
+									{#each warmSessions as s (s.id)}
+										{@const rt = getRuntime(s.id)}
+										{@const tabs = rt?.previewTabs}
+										{#each tabs?.tabs ?? [] as tab (tab.id)}
+											<!-- tabHosts is an imperative ref-bag (only tabHosts[key]?.reload() in
+										     reloadTabs); it is intentionally a plain object so component
+										     instances aren't proxied. Nothing reads it reactively, so the
+										     non-reactive binding is fine. -->
+											<!-- svelte-ignore binding_property_non_reactive -->
+											<PreviewTabHost
+												bind:this={tabHosts[tabKey(s.id, tab.id)]}
+												{tab}
+												session={s}
+												runtime={rt}
+												active={s.id === activeSession?.id && tab.id === tabs?.activeId}
+												collapsed={(tabs?.collapsed ?? false) && !fullscreen}
+												mounted={mountedTabKeys.has(tabKey(s.id, tab.id))}
+												label={tabLabelFor(tab, s.workspace_id ?? '')}
+												darkMode={isDarkMode.val}
+												{fullscreen}
+												onNavigate={navigateEditorTo}
+												onLoad={(frame) => tabs && onTabLoad(tabs, tab, frame)}
+											/>
+										{/each}
+									{/each}
+									{#if (owner?.tabs.length ?? 0) === 0}
+										<!-- New session with nothing to preview: an empty state with a
+										     picker to open one, instead of defaulting to the home page. -->
+										<div
+											class="absolute inset-0 flex flex-col items-center justify-center gap-3 text-center px-6 bg-surface"
+										>
+											<MonitorPlay size={28} class="text-tertiary" />
+											<div class="flex flex-col gap-1">
+												<span class="text-sm font-medium text-secondary">No preview open</span>
+												<span class="text-xs text-tertiary max-w-xs"
+													>Open a page, flow, script or app to preview it alongside the chat.</span
+												>
+											</div>
+											<Popover
+												placement="bottom"
+												usePointerDownOutside
+												excludeSelectors=".drawer"
+												disableFocusTrap
+												closeOnOtherPopoverOpen
+												bind:isOpen={emptyStateNewTabOpen}
+												enableFlyTransition
+												openFocus="[data-workspace-picker-search]"
+												contentClasses="flex flex-col overflow-hidden"
+											>
+												{#snippet trigger()}
+													<span
+														class="inline-flex items-center gap-1.5 px-2.5 py-1.5 rounded-md text-xs border border-light text-secondary hover:bg-surface-hover cursor-pointer"
+													>
+														<Plus size={14} /> Open a preview
+													</span>
+												{/snippet}
+												{#snippet content()}
+													<PreviewRouterPicker
+														workspaceId={previewWorkspace}
+														artifacts={sessionArtifacts}
+														onPick={(t) => {
+															emptyStateNewTabOpen = false
+															openInNewTab(t)
+														}}
+													/>
+												{/snippet}
+											</Popover>
+										</div>
+									{/if}
+								</div>
 							</div>
 						</div>
-					</div>
-				</Pane>
-			</Splitpanes>
-			{#if previewCollapsed && !fullscreen}
-				<!-- Collapsed preview: no rail — a floating launcher in the top-right to
+					</Pane>
+				</Splitpanes>
+				{#if previewCollapsed && !fullscreen}
+					<!-- Collapsed preview: no rail — a floating launcher in the top-right to
 				     reopen the side panel. -->
-				<div class="absolute top-2 right-3 z-50">
-					<Button
-						variant="subtle"
-						unifiedSize="sm"
-						startIcon={{ icon: PanelRightOpen }}
-						title="Open side panel"
-						onclick={() => owner?.setCollapsed(false)}
-					>
-						Open side panel
-					</Button>
+					<div class="absolute top-2 right-3 z-50">
+						<Button
+							variant="subtle"
+							unifiedSize="sm"
+							startIcon={{ icon: PanelRightOpen }}
+							title="Open side panel"
+							onclick={() => owner?.setCollapsed(false)}
+						>
+							Open side panel
+						</Button>
+					</div>
+				{/if}
+			</div>
+			{#if aiHiddenVerdict === undefined}
+				<div class="absolute inset-0 z-20 flex items-center justify-center bg-surface">
+					<Loader2 class="animate-spin" />
+				</div>
+			{:else if aiHiddenVerdict}
+				<!-- The workspace hid the assistant, and the sidebar switch with it, so only a
+				     direct URL or a session acting on such a workspace lands here. -->
+				<div
+					class="absolute inset-0 z-20 bg-surface p-8 flex flex-col items-start gap-3 text-secondary text-sm"
+				>
+					<p class="text-primary font-medium">AI Sessions are hidden in this workspace</p>
+					<p>A workspace admin hid AI sessions in the workspace settings.</p>
+					<Button unifiedSize="sm" onclick={() => goto('/')}>Back to workspace</Button>
 				</div>
 			{/if}
 		</div>
diff --git a/frontend/src/routes/(root)/(logged)/variables/+page.svelte b/frontend/src/routes/(root)/(logged)/variables/+page.svelte
index 0a23656514..016841f1ae 100644
--- a/frontend/src/routes/(root)/(logged)/variables/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/variables/+page.svelte
@@ -391,8 +391,8 @@
 									<Cell head>Path</Cell>
 									<Cell head>Value</Cell>
 									<Cell head>Description</Cell>
-									<Cell head />
-									<Cell head last stickyEnd />
+									<Cell head>Status</Cell>
+									<Cell head last actions>Actions</Cell>
 								</tr>
 							</Head>
 							<tbody class="divide-y">
@@ -494,7 +494,7 @@
 														{#if refresh_error}
 															<Popover notClickable>
 																<!-- isolate: confine the ping indicator's z-50 to a local stacking context
-											     so it can't paint over a sticky-pinned actions column scrolling past it -->
+											     so it can't paint over anything that scrolls past it -->
 																<div
 																	class="relative inline-flex justify-center items-center w-4 h-4 isolate"
 																>
@@ -546,7 +546,7 @@
 												{/if}
 											</div>
 										</Cell>
-										<Cell last stickyEnd shouldStopPropagation>
+										<Cell last actions shouldStopPropagation>
 											<Dropdown
 												items={() => {
 													let owner = isOwner(path, $userStore, $workspaceStore)
diff --git a/frontend/src/routes/flows/dev/+page.svelte b/frontend/src/routes/flows/dev/+page.svelte
index bbd3d0d76e..dc8d5e7b40 100644
--- a/frontend/src/routes/flows/dev/+page.svelte
+++ b/frontend/src/routes/flows/dev/+page.svelte
@@ -16,6 +16,7 @@
 	import type { FlowState } from '$lib/components/flows/flowState'
 	import FlowModuleSchemaMap from '$lib/components/flows/map/FlowModuleSchemaMap.svelte'
 	import FlowEditorPanel from '$lib/components/flows/content/FlowEditorPanel.svelte'
+	import AgentEditorModal from '$lib/components/flows/content/AgentEditorModal.svelte'
 	import { deepEqual } from 'fast-equals'
 	import { findModuleInFlow } from '$lib/components/flows/flowDiff'
 	import { page } from '$app/state'
@@ -343,5 +344,9 @@
 				</div>
 			{/if}
 		</div>
+		<!-- Every surface that can select an agent step needs one: the card's Edit only sets a
+		     module-global target, and without a mount here it would do nothing. `disableAi` matches
+		     the map and panel above. -->
+		<AgentEditorModal owns={() => true} />
 	</div>
 </main>
diff --git a/frontend/src/routes/kitchen_sink/+page.svelte b/frontend/src/routes/kitchen_sink/+page.svelte
index 8681fb78da..a001da222f 100644
--- a/frontend/src/routes/kitchen_sink/+page.svelte
+++ b/frontend/src/routes/kitchen_sink/+page.svelte
@@ -9,6 +9,7 @@
 	import type { DisplayMessage } from '$lib/components/copilot/chat/shared'
 	import DraggableTabs, { type TabItem } from '$lib/components/common/tabs/DraggableTabs.svelte'
 	import { Globe } from 'lucide-svelte'
+	import { workspaceStore } from '$lib/stores'
 
 	let tab = $state('button')
 
@@ -195,7 +196,7 @@ That's the full round-trip.`
 				<code>CodeDisplay</code> → <code>HighlightCode</code>), constrained to the chat panel width.
 			</div>
 			<div class="border border-border-light rounded-lg p-3 bg-surface" style="max-width: 420px;">
-				<AssistantMessage message={chatMessage} />
+				<AssistantMessage message={chatMessage} workspace={$workspaceStore} />
 			</div>
 		</TabContent>
 		<TabContent value="scrollbar" class="p-4">
diff --git a/integration_tests/test/git_sync_test.py b/integration_tests/test/git_sync_test.py
index 3cc54f2796..47ac02351e 100644
--- a/integration_tests/test/git_sync_test.py
+++ b/integration_tests/test/git_sync_test.py
@@ -1,9 +1,12 @@
+import json
 import os
+import re
 import shutil
 import tempfile
 import time
 import unittest
 import uuid
+from pathlib import Path
 
 import git as gitpython
 
@@ -19,6 +22,21 @@ def unique_name(prefix: str = "git-sync-test") -> str:
     return f"{prefix}-{uuid.uuid4().hex[:8]}"
 
 
+REPO_ROOT = Path(__file__).resolve().parents[2]
+
+
+def ui_pull_script_path() -> str:
+    """The hub script the git-sync UI runs for a pull (git → workspace)."""
+    with open(REPO_ROOT / "frontend/src/lib/hubPaths.json") as f:
+        return json.load(f)["gitInitRepo"]
+
+
+def backend_pull_script_path() -> str:
+    """The hub script the backend runs for an auto-pull: `GIT_SYNC_PULL_SCRIPT_PATH`."""
+    source = (REPO_ROOT / "backend/windmill-common/src/workspaces.rs").read_text()
+    return re.search(r'GIT_SYNC_PULL_SCRIPT_PATH: &str = "([^"]+)"', source).group(1)
+
+
 class GitSyncTestBase(unittest.TestCase):
     """Shared fixture + helpers for git sync e2e tests (no tests of its own).
 
@@ -221,6 +239,84 @@ class GitSyncTestBase(unittest.TestCase):
         )
         return matching[0]
 
+    def _seed_wmill_yaml(
+        self, repo_name: str, branch: str = "main", include_schedules: bool = False
+    ):
+        """Commit a minimal wmill.yaml: the pull CLI requires one in the repo.
+        Real setups get it from the init/settings-push flow; pushes alone
+        don't write it."""
+        self._gitea.create_file(
+            repo_name,
+            "wmill.yaml",
+            "defaultTs: bun\n"
+            "includes:\n"
+            '  - "**"\n'
+            "excludes: []\n"
+            "codebases: []\n"
+            "skipVariables: true\n"
+            "skipResources: true\n"
+            "skipResourceTypes: true\n"
+            "skipSecrets: true\n"
+            f"includeSchedules: {'true' if include_schedules else 'false'}\n"
+            "includeTriggers: false\n",
+            branch=branch,
+        )
+
+    def _create_fork(self, client: WindmillClient) -> tuple:
+        """Fork `client`'s workspace the way the UI does (branch job first, then
+        the workspace). Returns (fork_id, fork_branch)."""
+        fork_id = f"wm-fork-{uuid.uuid4().hex[:8]}"
+        self._fork_workspaces_to_cleanup.append(fork_id)
+        job_ids = client.create_workspace_fork_branch(fork_id, f"Fork {fork_id}")
+        if job_ids:
+            client.wait_for_jobs_by_ids(job_ids, timeout=90)
+            time.sleep(3)
+        client.create_workspace_fork(fork_id, f"Fork {fork_id}")
+        return fork_id, f"wm-fork/main/{fork_id[len('wm-fork-'):]}"
+
+    def _run_ui_pull(
+        self,
+        client: WindmillClient,
+        resource_path: str,
+        include_type: list,
+        clone_ref: str = None,
+        dry_run: bool = False,
+        timeout: int = 180,
+    ) -> dict:
+        """Run the pull the git-sync UI runs (git → `client`'s workspace) and
+        return the job's result. `dry_run` is the UI's preview."""
+        payload = {
+            "workspace_id": client._workspace,
+            "repo_url_resource_path": resource_path,
+            "dry_run": dry_run,
+            "pull": True,
+            "only_wmill_yaml": False,
+            "settings_json": json.dumps({
+                "include_path": ["**"],
+                "exclude_path": [],
+                "extra_include_path": [],
+                "include_type": include_type,
+            }),
+            "use_promotion_overrides": False,
+            **({"clone_ref": clone_ref} if clone_ref else {}),
+        }
+        response = client._client.post(
+            f"/api/w/{client._workspace}/jobs/run/p/{ui_pull_script_path()}",
+            params={"skip_preprocessor": "true"},
+            json=payload,
+        )
+        self.assertEqual(
+            response.status_code // 100, 2, f"UI pull failed to start: {response.content.decode()}"
+        )
+        job_id = response.content.decode()
+        client.wait_for_jobs_by_ids([job_id], timeout=timeout)
+        job = client._client.get(f"/api/w/{client._workspace}/jobs_u/get/{job_id}").json()
+        self.assertTrue(
+            job.get("success"),
+            f"UI pull job {job_id} failed: {job.get('result')}\n{job.get('logs')}",
+        )
+        return job.get("result") or {}
+
 
 class TestGitSync(GitSyncTestBase):
     # ──────────────────────────────────────────────────
@@ -802,27 +898,6 @@ class TestGitSyncAutoPull(GitSyncTestBase):
     # Two poll cycles + job execution, with slack for a loaded CI runner.
     PULL_TIMEOUT = 240
 
-    def _seed_wmill_yaml(self, repo_name: str, branch: str = "main"):
-        """Commit a minimal wmill.yaml: the pull CLI requires one in the repo.
-        Real setups get it from the init/settings-push flow; pushes alone
-        don't write it."""
-        self._gitea.create_file(
-            repo_name,
-            "wmill.yaml",
-            "defaultTs: bun\n"
-            "includes:\n"
-            '  - "**"\n'
-            "excludes: []\n"
-            "codebases: []\n"
-            "skipVariables: true\n"
-            "skipResources: true\n"
-            "skipResourceTypes: true\n"
-            "skipSecrets: true\n"
-            "includeSchedules: false\n"
-            "includeTriggers: false\n",
-            branch=branch,
-        )
-
     def _configure_auto_pull(self, resource_path: str, sync_forks: bool = False):
         """Single sync repo with auto-pull enabled in polling mode."""
         auto_pull = {"enabled": True, "mode": "polling"}
@@ -914,16 +989,7 @@ class TestGitSyncAutoPull(GitSyncTestBase):
 
         self._configure_auto_pull(resource_path, sync_forks=True)
 
-        # Create the fork (branch first, then workspace), like the UI does.
-        fork_id = f"wm-fork-{uuid.uuid4().hex[:8]}"
-        self._fork_workspaces_to_cleanup.append(fork_id)
-        job_ids = self._client.create_workspace_fork_branch(fork_id, f"Fork {fork_id}")
-        if job_ids:
-            self._client.wait_for_jobs_by_ids(job_ids, timeout=90)
-            time.sleep(3)
-        self._client.create_workspace_fork(fork_id, f"Fork {fork_id}")
-
-        fork_branch = f"wm-fork/main/{fork_id[len('wm-fork-'):]}"
+        fork_id, fork_branch = self._create_fork(self._client)
         self._gitea.create_file(
             repo_name, script_file, ts_script("return 'fork only'"),
             branch=fork_branch,
@@ -1012,19 +1078,12 @@ class TestGitSyncAutoPull(GitSyncTestBase):
             f"attach_dev_workspace failed: {attach.content.decode()}",
         )
 
-        # Fork the dev workspace (branch first, then workspace) — its parent is
-        # the dev, so this is a fork OF a dev workspace.
-        fork_id = f"wm-fork-{uuid.uuid4().hex[:8]}"
-        self._fork_workspaces_to_cleanup.append(fork_id)
-        job_ids = dev_client.create_workspace_fork_branch(fork_id, f"Fork {fork_id}")
-        if job_ids:
-            dev_client.wait_for_jobs_by_ids(job_ids, timeout=90)
-            time.sleep(3)
-        dev_client.create_workspace_fork(fork_id, f"Fork {fork_id}")
+        # Fork the dev workspace — its parent is the dev, so this is a fork OF
+        # a dev workspace.
+        fork_id, fork_branch = self._create_fork(dev_client)
 
         # The fork branch is named after the tracked branch, not the dev label.
         fork_suffix = fork_id[len("wm-fork-"):]
-        fork_branch = f"wm-fork/main/{fork_suffix}"
         branches = self._get_branches(self._clone_repo_all_branches(repo_name))
         self.assertTrue(
             any(fork_branch in b for b in branches),
@@ -1195,3 +1254,73 @@ class TestGitSyncAutoPull(GitSyncTestBase):
             initial_count,
             "Unknown webhook delivery enqueued a job",
         )
+
+
+class TestGitSyncUiPull(GitSyncTestBase):
+    """The pull the git-sync UI runs (hub init script, git → workspace)."""
+
+    def test_ui_pull_script_is_the_backend_pull_script(self):
+        """The UI's pull and the backend's auto-pull are the same hub script,
+        so the two pins must move together."""
+        self.assertEqual(ui_pull_script_path(), backend_pull_script_path())
+
+    def test_fork_pull_does_not_report_parent_owned_schedule_enabled(self):
+        """In a fork, a schedule the parent also has takes its `enabled` from
+        the parent, so a fork-branch file that disagrees on that flag can never
+        be made to agree: a pull that treated it as a change would list the
+        same row on every run. Pull into the fork, then preview: the schedule
+        must not be reported, while an ordinary fork-branch edit does land."""
+        repo_name, _ = self._create_test_repo()
+        resource_path = self._setup_git_sync_resource(repo_name)
+        include_type = ["script", "schedule"]
+        self._configure_single_repo_sync(resource_path, include_type=include_type)
+
+        script_path = self._deploy_seed_script("forkuipull")
+        schedule_path = f"u/admin/{unique_name('forkuipull_sched')}"
+        initial_count = self._client.count_deployment_callback_jobs()
+        self._client.create_schedule(schedule_path, script_path, schedule="0 0 0 1 1 *")
+        self.addCleanup(self._client.delete_schedule, schedule_path)
+        self._client.wait_for_sync_jobs(initial_count, min_new=1)
+        time.sleep(3)
+        self._seed_wmill_yaml(repo_name, include_schedules=True)
+
+        # Fork after the schedule reached git so the fork branch inherits it
+        # with the parent's `enabled: true`; the fork's own copy lands disabled.
+        fork_id, fork_branch = self._create_fork(self._client)
+
+        schedule_file = f"{schedule_path}.schedule.yaml"
+        fork_dir = self._clone_repo(repo_name, branch=fork_branch)
+        content = self._read_file_content(fork_dir, schedule_file)
+        self.assertIn(
+            "enabled: true", content, f"expected the parent's enabled schedule in git:\n{content}"
+        )
+        self._gitea.create_file(
+            repo_name,
+            schedule_file,
+            content.replace("enabled: true", "enabled: false"),
+            branch=fork_branch,
+        )
+        # A real change alongside it proves the pull ran against the fork branch.
+        script_file = self._repo_script_file(repo_name, script_path, branch=fork_branch)
+        self._gitea.create_file(
+            repo_name, script_file, ts_script("return 'fork ui pull'"), branch=fork_branch
+        )
+
+        fork_client = WindmillClient(workspace=fork_id)
+        self._run_ui_pull(fork_client, resource_path, include_type, clone_ref=fork_branch)
+        self.assertIn(
+            "fork ui pull",
+            fork_client.get_script_content(script_path),
+            "the fork-branch script edit was not applied by the pull",
+        )
+        preview = self._run_ui_pull(
+            fork_client, resource_path, include_type, clone_ref=fork_branch, dry_run=True
+        )
+        self.assertIn("changes", preview, f"preview result has no changes list: {preview}")
+        changes = preview["changes"]
+        self.assertIsInstance(changes, list, f"preview changes is not a list: {preview}")
+        self.assertEqual(
+            [c for c in changes if c.get("path", "").endswith(schedule_file)],
+            [],
+            f"a pull into the fork keeps reporting the parent-owned schedule flag: {changes}",
+        )
diff --git a/lsp/Pipfile b/lsp/Pipfile
index cf1bb1ec17..0bc31bcb41 100644
--- a/lsp/Pipfile
+++ b/lsp/Pipfile
@@ -4,7 +4,7 @@ verify_ssl = true
 name = "pypi"
 
 [packages]
-wmill = ">=1.800.1"
+wmill = ">=1.803.0"
 sendgrid = "*"
 mysql-connector-python = "*"
 pymongo = "*"
diff --git a/openflow.openapi.yaml b/openflow.openapi.yaml
index 0350536df4..bdf8ecce08 100644
--- a/openflow.openapi.yaml
+++ b/openflow.openapi.yaml
@@ -1,7 +1,7 @@
 openapi: '3.0.3'
 
 info:
-  version: 1.800.1
+  version: 1.803.0
   title: OpenFlow Spec
   contact:
     name: Ruben Fiszel
diff --git a/powershell-client/WindmillClient/WindmillClient.psd1 b/powershell-client/WindmillClient/WindmillClient.psd1
index df980c46a0..089f7ff05a 100644
--- a/powershell-client/WindmillClient/WindmillClient.psd1
+++ b/powershell-client/WindmillClient/WindmillClient.psd1
@@ -12,7 +12,7 @@
     RootModule        = 'WindmillClient.psm1'
 
     # Version number of this module.
-    ModuleVersion     = '1.800.1'
+    ModuleVersion     = '1.803.0'
 
     # Supported PSEditions
     # CompatiblePSEditions = @()
diff --git a/python-client/wmill/pyproject.toml b/python-client/wmill/pyproject.toml
index 00582eecd2..35a2b8d857 100644
--- a/python-client/wmill/pyproject.toml
+++ b/python-client/wmill/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill"
-version = "1.800.1"
+version = "1.803.0"
 description = "A client library for accessing Windmill server wrapping the Windmill client API"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/system_prompts/auto-generated/cli/cli-commands.md b/system_prompts/auto-generated/cli/cli-commands.md
index e51c8371dc..acf6622dc9 100644
--- a/system_prompts/auto-generated/cli/cli-commands.md
+++ b/system_prompts/auto-generated/cli/cli-commands.md
@@ -160,11 +160,11 @@ flow related commands
 - `flow push <file_path:string> <remote_path:string>` - push a local flow spec. This overrides any remote versions.
   - `--message <message:string>` - Deployment message
 - `flow run <path:string>` - run a flow by path.
-  - `-d --data <data:string>` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-.
+  - `-d --data <data:string>` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-. A resource argument is the bare string $res:<path> as its whole value, and a variable argument is the bare string $var:<path> — not an object wrapper keyed on $res/$var, and not a plain path.
   - `-s --silent` - Do not ouput anything other then the final output. Useful for scripting.
   - `--tag <tag:string>` - Override the worker tag the run is dispatched to (e.g. to route it to dev workers instead of the flow's default tag).
 - `flow preview <flow_path:string>` - preview a local flow without deploying it. Runs the flow definition from local files and uses local PathScripts by default. Pass --step <id> to run only one module in isolation (resolves nested steps inside branchone/branchall/forloopflow/whileloopflow plus the special preprocessor/failure modules; supported step types: rawscript, script, flow).
-  - `-d --data <data:string>` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-.
+  - `-d --data <data:string>` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-. A resource argument is the bare string $res:<path> as its whole value, and a variable argument is the bare string $var:<path> — not an object wrapper keyed on $res/$var, and not a plain path.
   - `-s --silent` - Do not output anything other then the final output. Useful for scripting.
   - `--remote` - Use deployed workspace scripts for PathScript steps instead of local files.
   - `--step <step_id:string>` - Run only the named step instead of the whole flow. Honors --data as the step's args and --remote / local-PathScript resolution the same way the full-flow preview does.
@@ -560,11 +560,11 @@ script related commands
   - `--json` - Output as JSON (for piping to jq)
 - `script show <path:file>` - show a script's content (alias for get)
 - `script run <path:file>` - run a script by path
-  - `-d --data <data:file>` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-.
+  - `-d --data <data:file>` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-. A resource argument is the bare string $res:<path> as its whole value, and a variable argument is the bare string $var:<path> — not an object wrapper keyed on $res/$var, and not a plain path.
   - `-s --silent` - Do not output anything other then the final output. Useful for scripting.
   - `--tag <tag:string>` - Override the worker tag the run is dispatched to (e.g. to route it to dev workers instead of the script's default tag).
 - `script preview <path:file>` - preview a local script without deploying it. Supports both regular and codebase scripts.
-  - `-d --data <data:file>` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-.
+  - `-d --data <data:file>` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-. A resource argument is the bare string $res:<path> as its whole value, and a variable argument is the bare string $var:<path> — not an object wrapper keyed on $res/$var, and not a plain path.
   - `-s --silent` - Do not output anything other than the final output. Useful for scripting.
   - `--tag <tag:string>` - Override the worker tag the preview is dispatched to (e.g. to route it to dev workers instead of the script's default tag).
 - `script new <path:file> <language:string>` - create a new script
diff --git a/system_prompts/auto-generated/prompts.ts b/system_prompts/auto-generated/prompts.ts
index 918b88cb21..1feeadc162 100644
--- a/system_prompts/auto-generated/prompts.ts
+++ b/system_prompts/auto-generated/prompts.ts
@@ -498,6 +498,41 @@ Reference other resources:
 }
 \`\`\`
 
+## Passing a Resource or Variable as a Run Argument
+
+A script or flow argument typed as a resource (schema \`format: resource-<type>\`) is passed as
+the **bare string** \`$res:<path>\` — the whole argument value. Same for a variable, with
+\`$var:<path>\`. This applies everywhere job arguments are supplied: \`wmill script run/preview\`,
+\`wmill flow run/preview\`, the \`runScriptByPath\` / \`runFlowByPath\` API, a schedule's \`args\`, a
+trigger's configured static args.
+
+\`\`\`json
+{
+  "db": "$res:f/databases/postgres_prod",
+  "api_token": "$var:g/all/api_token"
+}
+\`\`\`
+
+The reference is resolved when the job runs, under the job's run-as identity — the caller for an
+ordinary run, but the configured principal for a schedule, a trigger, or a runnable set to run on
+behalf of someone else. The run fails if that identity cannot read the referenced resource or
+variable.
+
+**Never wrap it in an object.** The resolver only rewrites a JSON value that *is* a string
+starting with \`$res:\` / \`$var:\`; keys are never inspected. These are all wrong and are passed
+through to the script unchanged:
+
+\`\`\`json
+{ "db": { "$res": "f/databases/postgres_prod" } }
+{ "db": { "resource": "f/databases/postgres_prod" } }
+{ "db": "f/databases/postgres_prod" }
+\`\`\`
+
+The string may sit anywhere a string can — a top-level argument, a nested object field
+(\`{ "gh_auth": { "token": "$var:g/all/gh_token" } }\`), or an array element (array elements are
+walked only while nested at most two levels deep, and only for arrays of at most 1000 items).
+The prefix must be on the string itself.
+
 ## Common Resource Types
 
 ### PostgreSQL
@@ -3226,11 +3261,11 @@ flow related commands
 - \`flow push <file_path:string> <remote_path:string>\` - push a local flow spec. This overrides any remote versions.
   - \`--message <message:string>\` - Deployment message
 - \`flow run <path:string>\` - run a flow by path.
-  - \`-d --data <data:string>\` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-.
+  - \`-d --data <data:string>\` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-. A resource argument is the bare string $res:<path> as its whole value, and a variable argument is the bare string $var:<path> — not an object wrapper keyed on $res/$var, and not a plain path.
   - \`-s --silent\` - Do not ouput anything other then the final output. Useful for scripting.
   - \`--tag <tag:string>\` - Override the worker tag the run is dispatched to (e.g. to route it to dev workers instead of the flow's default tag).
 - \`flow preview <flow_path:string>\` - preview a local flow without deploying it. Runs the flow definition from local files and uses local PathScripts by default. Pass --step <id> to run only one module in isolation (resolves nested steps inside branchone/branchall/forloopflow/whileloopflow plus the special preprocessor/failure modules; supported step types: rawscript, script, flow).
-  - \`-d --data <data:string>\` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-.
+  - \`-d --data <data:string>\` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-. A resource argument is the bare string $res:<path> as its whole value, and a variable argument is the bare string $var:<path> — not an object wrapper keyed on $res/$var, and not a plain path.
   - \`-s --silent\` - Do not output anything other then the final output. Useful for scripting.
   - \`--remote\` - Use deployed workspace scripts for PathScript steps instead of local files.
   - \`--step <step_id:string>\` - Run only the named step instead of the whole flow. Honors --data as the step's args and --remote / local-PathScript resolution the same way the full-flow preview does.
@@ -3626,11 +3661,11 @@ script related commands
   - \`--json\` - Output as JSON (for piping to jq)
 - \`script show <path:file>\` - show a script's content (alias for get)
 - \`script run <path:file>\` - run a script by path
-  - \`-d --data <data:file>\` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-.
+  - \`-d --data <data:file>\` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-. A resource argument is the bare string $res:<path> as its whole value, and a variable argument is the bare string $var:<path> — not an object wrapper keyed on $res/$var, and not a plain path.
   - \`-s --silent\` - Do not output anything other then the final output. Useful for scripting.
   - \`--tag <tag:string>\` - Override the worker tag the run is dispatched to (e.g. to route it to dev workers instead of the script's default tag).
 - \`script preview <path:file>\` - preview a local script without deploying it. Supports both regular and codebase scripts.
-  - \`-d --data <data:file>\` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-.
+  - \`-d --data <data:file>\` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-. A resource argument is the bare string $res:<path> as its whole value, and a variable argument is the bare string $var:<path> — not an object wrapper keyed on $res/$var, and not a plain path.
   - \`-s --silent\` - Do not output anything other than the final output. Useful for scripting.
   - \`--tag <tag:string>\` - Override the worker tag the preview is dispatched to (e.g. to route it to dev workers instead of the script's default tag).
 - \`script new <path:file> <language:string>\` - create a new script
diff --git a/system_prompts/auto-generated/skills/cli-commands/SKILL.md b/system_prompts/auto-generated/skills/cli-commands/SKILL.md
index 1f3c54ea26..fef40d3341 100644
--- a/system_prompts/auto-generated/skills/cli-commands/SKILL.md
+++ b/system_prompts/auto-generated/skills/cli-commands/SKILL.md
@@ -165,11 +165,11 @@ flow related commands
 - `flow push <file_path:string> <remote_path:string>` - push a local flow spec. This overrides any remote versions.
   - `--message <message:string>` - Deployment message
 - `flow run <path:string>` - run a flow by path.
-  - `-d --data <data:string>` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-.
+  - `-d --data <data:string>` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-. A resource argument is the bare string $res:<path> as its whole value, and a variable argument is the bare string $var:<path> — not an object wrapper keyed on $res/$var, and not a plain path.
   - `-s --silent` - Do not ouput anything other then the final output. Useful for scripting.
   - `--tag <tag:string>` - Override the worker tag the run is dispatched to (e.g. to route it to dev workers instead of the flow's default tag).
 - `flow preview <flow_path:string>` - preview a local flow without deploying it. Runs the flow definition from local files and uses local PathScripts by default. Pass --step <id> to run only one module in isolation (resolves nested steps inside branchone/branchall/forloopflow/whileloopflow plus the special preprocessor/failure modules; supported step types: rawscript, script, flow).
-  - `-d --data <data:string>` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-.
+  - `-d --data <data:string>` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-. A resource argument is the bare string $res:<path> as its whole value, and a variable argument is the bare string $var:<path> — not an object wrapper keyed on $res/$var, and not a plain path.
   - `-s --silent` - Do not output anything other then the final output. Useful for scripting.
   - `--remote` - Use deployed workspace scripts for PathScript steps instead of local files.
   - `--step <step_id:string>` - Run only the named step instead of the whole flow. Honors --data as the step's args and --remote / local-PathScript resolution the same way the full-flow preview does.
@@ -565,11 +565,11 @@ script related commands
   - `--json` - Output as JSON (for piping to jq)
 - `script show <path:file>` - show a script's content (alias for get)
 - `script run <path:file>` - run a script by path
-  - `-d --data <data:file>` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-.
+  - `-d --data <data:file>` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-. A resource argument is the bare string $res:<path> as its whole value, and a variable argument is the bare string $var:<path> — not an object wrapper keyed on $res/$var, and not a plain path.
   - `-s --silent` - Do not output anything other then the final output. Useful for scripting.
   - `--tag <tag:string>` - Override the worker tag the run is dispatched to (e.g. to route it to dev workers instead of the script's default tag).
 - `script preview <path:file>` - preview a local script without deploying it. Supports both regular and codebase scripts.
-  - `-d --data <data:file>` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-.
+  - `-d --data <data:file>` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-. A resource argument is the bare string $res:<path> as its whole value, and a variable argument is the bare string $var:<path> — not an object wrapper keyed on $res/$var, and not a plain path.
   - `-s --silent` - Do not output anything other than the final output. Useful for scripting.
   - `--tag <tag:string>` - Override the worker tag the preview is dispatched to (e.g. to route it to dev workers instead of the script's default tag).
 - `script new <path:file> <language:string>` - create a new script
diff --git a/system_prompts/auto-generated/skills/resources/SKILL.md b/system_prompts/auto-generated/skills/resources/SKILL.md
index 19b8c9f420..396b3b9d8e 100644
--- a/system_prompts/auto-generated/skills/resources/SKILL.md
+++ b/system_prompts/auto-generated/skills/resources/SKILL.md
@@ -64,6 +64,41 @@ Reference other resources:
 }
 ```
 
+## Passing a Resource or Variable as a Run Argument
+
+A script or flow argument typed as a resource (schema `format: resource-<type>`) is passed as
+the **bare string** `$res:<path>` — the whole argument value. Same for a variable, with
+`$var:<path>`. This applies everywhere job arguments are supplied: `wmill script run/preview`,
+`wmill flow run/preview`, the `runScriptByPath` / `runFlowByPath` API, a schedule's `args`, a
+trigger's configured static args.
+
+```json
+{
+  "db": "$res:f/databases/postgres_prod",
+  "api_token": "$var:g/all/api_token"
+}
+```
+
+The reference is resolved when the job runs, under the job's run-as identity — the caller for an
+ordinary run, but the configured principal for a schedule, a trigger, or a runnable set to run on
+behalf of someone else. The run fails if that identity cannot read the referenced resource or
+variable.
+
+**Never wrap it in an object.** The resolver only rewrites a JSON value that *is* a string
+starting with `$res:` / `$var:`; keys are never inspected. These are all wrong and are passed
+through to the script unchanged:
+
+```json
+{ "db": { "$res": "f/databases/postgres_prod" } }
+{ "db": { "resource": "f/databases/postgres_prod" } }
+{ "db": "f/databases/postgres_prod" }
+```
+
+The string may sit anywhere a string can — a top-level argument, a nested object field
+(`{ "gh_auth": { "token": "$var:g/all/gh_token" } }`), or an array element (array elements are
+walked only while nested at most two levels deep, and only for arrays of at most 1000 items).
+The prefix must be on the string itself.
+
 ## Common Resource Types
 
 ### PostgreSQL
diff --git a/system_prompts/auto-generated/skills/write-flow/SKILL.md b/system_prompts/auto-generated/skills/write-flow/SKILL.md
index 6a5f36e9b4..925ffbe6ec 100644
--- a/system_prompts/auto-generated/skills/write-flow/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-flow/SKILL.md
@@ -77,6 +77,8 @@ If the user hasn't already told you to run/test the flow, offer it as a one-sent
 
 If the user already asked to test/run/try the flow in their original request, skip the offer and just execute `wmill flow preview <path> -d '<args>'` directly — pick plausible args from the flow's input schema.
 
+An input typed as a resource (`format: resource-<type>` in the schema) takes the bare string `"$res:<path>"` as its whole value — `-d '{"db": "$res:f/databases/postgres_prod"}'`, not `{"db": {"$res": "..."}}` and not a plain path. Same for a variable, with `"$var:<path>"`. See the `resources` skill.
+
 `wmill flow preview` is safe to run yourself (it does not deploy). `wmill generate-metadata` does not deploy either (it only writes local lock/hash files) but re-resolves deps — offer it and run on agreement, unless the project's `AGENTS.md` opts into automatic metadata. After running it, check the regenerated `.lock` diff and tell the user which inline-script dependency versions changed, so they can catch an unwanted bump before deploying. Only `wmill sync push` deploys; run it only when the user explicitly asks.
 
 ### Visual preview
diff --git a/system_prompts/base/flow-cli.md b/system_prompts/base/flow-cli.md
index d8a2b41b13..fa4ec9cfcc 100644
--- a/system_prompts/base/flow-cli.md
+++ b/system_prompts/base/flow-cli.md
@@ -72,6 +72,8 @@ If the user hasn't already told you to run/test the flow, offer it as a one-sent
 
 If the user already asked to test/run/try the flow in their original request, skip the offer and just execute `wmill flow preview <path> -d '<args>'` directly — pick plausible args from the flow's input schema.
 
+An input typed as a resource (`format: resource-<type>` in the schema) takes the bare string `"$res:<path>"` as its whole value — `-d '{"db": "$res:f/databases/postgres_prod"}'`, not `{"db": {"$res": "..."}}` and not a plain path. Same for a variable, with `"$var:<path>"`. See the `resources` skill.
+
 `wmill flow preview` is safe to run yourself (it does not deploy). `wmill generate-metadata` does not deploy either (it only writes local lock/hash files) but re-resolves deps — offer it and run on agreement, unless the project's `AGENTS.md` opts into automatic metadata. After running it, check the regenerated `.lock` diff and tell the user which inline-script dependency versions changed, so they can catch an unwanted bump before deploying. Only `wmill sync push` deploys; run it only when the user explicitly asks.
 
 ### Visual preview
diff --git a/system_prompts/base/resources.md b/system_prompts/base/resources.md
index 1c548a2484..5252683a81 100644
--- a/system_prompts/base/resources.md
+++ b/system_prompts/base/resources.md
@@ -59,6 +59,41 @@ Reference other resources:
 }
 ```
 
+## Passing a Resource or Variable as a Run Argument
+
+A script or flow argument typed as a resource (schema `format: resource-<type>`) is passed as
+the **bare string** `$res:<path>` — the whole argument value. Same for a variable, with
+`$var:<path>`. This applies everywhere job arguments are supplied: `wmill script run/preview`,
+`wmill flow run/preview`, the `runScriptByPath` / `runFlowByPath` API, a schedule's `args`, a
+trigger's configured static args.
+
+```json
+{
+  "db": "$res:f/databases/postgres_prod",
+  "api_token": "$var:g/all/api_token"
+}
+```
+
+The reference is resolved when the job runs, under the job's run-as identity — the caller for an
+ordinary run, but the configured principal for a schedule, a trigger, or a runnable set to run on
+behalf of someone else. The run fails if that identity cannot read the referenced resource or
+variable.
+
+**Never wrap it in an object.** The resolver only rewrites a JSON value that *is* a string
+starting with `$res:` / `$var:`; keys are never inspected. These are all wrong and are passed
+through to the script unchanged:
+
+```json
+{ "db": { "$res": "f/databases/postgres_prod" } }
+{ "db": { "resource": "f/databases/postgres_prod" } }
+{ "db": "f/databases/postgres_prod" }
+```
+
+The string may sit anywhere a string can — a top-level argument, a nested object field
+(`{ "gh_auth": { "token": "$var:g/all/gh_token" } }`), or an array element (array elements are
+walked only while nested at most two levels deep, and only for arrays of at most 1000 items).
+The prefix must be on the string itself.
+
 ## Common Resource Types
 
 ### PostgreSQL
diff --git a/typescript-client/jsr.json b/typescript-client/jsr.json
index 122221df80..f148f1f03c 100644
--- a/typescript-client/jsr.json
+++ b/typescript-client/jsr.json
@@ -1,6 +1,6 @@
 {
   "name": "@windmill/windmill",
-  "version": "1.800.1",
+  "version": "1.803.0",
   "exports": "./src/index.ts",
   "publish": {
     "exclude": ["!src", "./s3Types.ts", "./sqlUtils.ts", "./client.ts", "./wacError.ts"]
diff --git a/typescript-client/package.json b/typescript-client/package.json
index 802d99056a..4970364ccd 100644
--- a/typescript-client/package.json
+++ b/typescript-client/package.json
@@ -1,7 +1,7 @@
 {
   "name": "windmill-client",
   "description": "Windmill SDK client for browsers and Node.js",
-  "version": "1.800.1",
+  "version": "1.803.0",
   "author": "Ruben Fiszel",
   "license": "Apache 2.0",
   "homepage": "https://github.com/windmill-labs/windmill/tree/main/typescript-client#readme",
diff --git a/version.txt b/version.txt
index 16cbd6c8ab..e5952c62ae 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-1.800.1
+1.803.0
diff --git a/windmill-yaml-validator/package-lock.json b/windmill-yaml-validator/package-lock.json
index 197da5a8a8..d8c4b1e0fd 100644
--- a/windmill-yaml-validator/package-lock.json
+++ b/windmill-yaml-validator/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "windmill-yaml-validator",
-  "version": "1.800.1",
+  "version": "1.803.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "windmill-yaml-validator",
-      "version": "1.800.1",
+      "version": "1.803.0",
       "license": "Apache 2.0",
       "dependencies": {
         "@stoplight/yaml": "^4.3.0",
diff --git a/windmill-yaml-validator/package.json b/windmill-yaml-validator/package.json
index eb1eded0cc..8245569685 100644
--- a/windmill-yaml-validator/package.json
+++ b/windmill-yaml-validator/package.json
@@ -1,6 +1,6 @@
 {
   "name": "windmill-yaml-validator",
-  "version": "1.800.1",
+  "version": "1.803.0",
   "description": "YAML validator for Windmill flow, schedule, and trigger files",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",