chore(main): release 1.815.0 (#11212 )

* chore(main): release 1.815.0 * Apply automatic changes --------- Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com>
feat: add an instance setting to refuse a token in MCP URLs (#11162 )
2026-09-18 16:02:29 +00:00 · 2026-09-18 15:28:25 +02:00 · 2026-09-18 15:24:00 +02:00 · 2026-09-18 15:21:07 +02:00 · 2026-09-18 15:15:35 +02:00 · 2026-09-18 15:15:02 +02:00
146 changed files with 5995 additions and 6104 deletions
@@ -1,3 +1,3 @@
 {
-  ".": "1.814.0"
+  ".": "1.815.0"
 }
@@ -1,5 +1,39 @@
 # Changelog

+## [1.815.0](https://github.com/windmill-labs/windmill/compare/v1.814.0...v1.815.0) (2026-09-18)
+
+
+### Features
+
+* add a workspace toggle that adds its admins and developers to new forks ([#11215](https://github.com/windmill-labs/windmill/issues/11215)) ([9d335de](https://github.com/windmill-labs/windmill/commit/9d335de87a4dbaa51038d55afe8d980761dcdfaf))
+* add an instance setting to refuse a token in MCP URLs ([#11162](https://github.com/windmill-labs/windmill/issues/11162)) ([37e493a](https://github.com/windmill-labs/windmill/commit/37e493ae66ed5c000ecac492d60fc0fdf4bda71f))
+* **ai-chat:** render get_run through the run tools' card ([#11204](https://github.com/windmill-labs/windmill/issues/11204)) ([6f9c4dc](https://github.com/windmill-labs/windmill/commit/6f9c4dc29455d13b0e64af05c2d6aa8bd5ff4fd6))
+* **ai-chat:** tell the chat which kind of app it is looking at ([#11208](https://github.com/windmill-labs/windmill/issues/11208)) ([c8c06d8](https://github.com/windmill-labs/windmill/commit/c8c06d8f79774abf109192e71a8b6fc37c7937ba))
+* attach files to a flow chat message ([#11185](https://github.com/windmill-labs/windmill/issues/11185)) ([c4c9677](https://github.com/windmill-labs/windmill/commit/c4c9677982b75c63d98ebf85b1904e0c341ba957))
+* **auth:** 2 h login links and a click-to-sign-in page for emailed ones ([#11203](https://github.com/windmill-labs/windmill/issues/11203)) ([5639187](https://github.com/windmill-labs/windmill/commit/5639187fec6d517a72e82df49d63d7438301127c))
+* cap user token expiration with an instance setting ([#11159](https://github.com/windmill-labs/windmill/issues/11159)) ([9320312](https://github.com/windmill-labs/windmill/commit/9320312eac56f944c4d31504601293ab4e816ccc))
+* flow chat job-backed detail, smooth streaming and answer chrome ([#11186](https://github.com/windmill-labs/windmill/issues/11186)) ([e2a91ca](https://github.com/windmill-labs/windmill/commit/e2a91ca2b141a0bee64ddfafe3cbf3ff86b6fb35))
+* put a data table's connection under Postgres roles ([#11020](https://github.com/windmill-labs/windmill/issues/11020)) ([0e807fb](https://github.com/windmill-labs/windmill/commit/0e807fb1dd80d7536ec144cd49445abc7961e504))
+* render an AI agent result as its answer, not as raw JSON ([#11051](https://github.com/windmill-labs/windmill/issues/11051)) ([a089928](https://github.com/windmill-labs/windmill/commit/a08992834d45d0211336f4fc32c3421646ca47c5))
+* support $flow_expr[...] dynamic tags on flow steps ([#11170](https://github.com/windmill-labs/windmill/issues/11170)) ([48f0025](https://github.com/windmill-labs/windmill/commit/48f00259c5e7361d3553dbcb809461e1cde96f8f))
+
+
+### Bug Fixes
+
+* **frontend:** inline only the package version, not the whole package.json ([#11191](https://github.com/windmill-labs/windmill/issues/11191)) ([813e486](https://github.com/windmill-labs/windmill/commit/813e486e166ac6215364817a7732b66f8dc1d463))
+* keep instance groups when editing auto-invite ([#11217](https://github.com/windmill-labs/windmill/issues/11217)) ([df61dea](https://github.com/windmill-labs/windmill/commit/df61dea5fa8b18d1e0044dc0db6702b053d5119f))
+* key the large root font size on screen width, not window width ([#11216](https://github.com/windmill-labs/windmill/issues/11216)) ([3b4e13d](https://github.com/windmill-labs/windmill/commit/3b4e13d1c564c6195e30b55b0671f7533e3ce408))
+* re-encrypt git sync secrets on workspace key rotation ([#11218](https://github.com/windmill-labs/windmill/issues/11218)) ([f0d66a4](https://github.com/windmill-labs/windmill/commit/f0d66a42eba27502767423af0c08b2ca1f16e8df))
+* re-point cloned fork identities that name nobody in the fork ([#11161](https://github.com/windmill-labs/windmill/issues/11161)) ([9690c44](https://github.com/windmill-labs/windmill/commit/9690c4462cf264a5577b87d07d465b5442b4e09d))
+* register the job token with the sensitive log masking system ([#10943](https://github.com/windmill-labs/windmill/issues/10943)) ([53afecd](https://github.com/windmill-labs/windmill/commit/53afecd4588247bc1812d3e68a30db1f3c3b2724))
+* show the New menu's description panel only on hover ([#11199](https://github.com/windmill-labs/windmill/issues/11199)) ([ecd0a6c](https://github.com/windmill-labs/windmill/commit/ecd0a6c77bc3a057b8072dbb0aca731e8bd3d882))
+* stop picker listing a draft twice when drafts share a friendly path ([#11214](https://github.com/windmill-labs/windmill/issues/11214)) ([72507d5](https://github.com/windmill-labs/windmill/commit/72507d52a021de8101794ee8f4a3392be1ba20c7))
+
+
+### Performance Improvements
+
+* count completed jobs on the v2_job_completed index with a timeout ([#11211](https://github.com/windmill-labs/windmill/issues/11211)) ([d1a2536](https://github.com/windmill-labs/windmill/commit/d1a25360b070994a31fb033707dbfde1fb553939))
+
 ## [1.814.0](https://github.com/windmill-labs/windmill/compare/v1.813.0...v1.814.0) (2026-09-17)


@@ -49,12 +49,16 @@ export interface BenchmarkWorkspaceFlow {
 export interface BenchmarkWorkspaceApp {
 	path: string
 	summary: string
+	/** Defaults to true. Set false for a drag-and-drop app, which the chat can list
+	 * and read but has no tool to edit — its value is a grid, not files. */
+	rawApp?: boolean
 	value: {
-		files: Record<string, string>
-		runnables: Record<string, unknown>
+		files?: Record<string, string>
+		runnables?: Record<string, unknown>
 		data?: unknown
 		policy?: unknown
 		custom_path?: unknown
+		[key: string]: unknown
 	}
 }

@@ -994,7 +998,7 @@ function buildBenchmarkListableApp(app: BenchmarkWorkspaceApp): ListableApp {
 		extra_perms: {},
 		edited_at: BENCHMARK_TIMESTAMP,
 		execution_mode: 'viewer',
-		raw_app: true
+		raw_app: app.rawApp ?? true
 	}
 }

@@ -1012,7 +1016,7 @@ function buildBenchmarkApp(app: BenchmarkWorkspaceApp): AppWithLastVersion {
 		execution_mode: 'viewer',
 		extra_perms: {},
 		custom_path: app.value.custom_path as string | undefined,
-		raw_app: true
+		raw_app: app.rawApp ?? true
 	}
 }

@@ -2611,3 +2611,40 @@
  judgeChecklist:
    - runs the existing script rather than rewriting it
    - passes the GitHub resource as the bare string $res:f/evals/global/github_main
+
+- id: global-drag-and-drop-app-not-editable
+  prompt: |-
+    Add a refresh button to the ops console app, and the same to the sales board app.
+  initial: ai_evals/fixtures/frontend/global/initial/apps_code_and_drag_and_drop.json
+  runtime:
+    maxTurns: 12
+  validate:
+    # One request, two apps, only one of them editable: the code app must come back with a
+    # draft and the drag-and-drop one must not. Refusing both, or editing both, fails here —
+    # which is what makes this a test of the distinction rather than of caution.
+    draftCountExactly: 1
+    requiredDrafts:
+      - type: app
+        path: f/evals/global/ops_console
+    forbiddenDrafts:
+      - type: app
+        path: f/evals/global/sales_board
+  toolExpect:
+    # Deliberately not constraining write_app_file/patch_app_file by argument: an entry there
+    # fails when its tool was never called, so naming both would fail on whichever the model
+    # did not pick. The draft assertions above cover the same ground, tool-agnostically.
+    forbiddenToolsUsed:
+      - init_app
+      - deploy_workspace_item
+      - delete_app_file
+      - delete_app_runnable
+  assistantExpect:
+    # A refusal leaves no draft for the judge to read, so the explanation is checked here.
+    # Only the app kind: substring tests cannot see paraphrase, and every wording of "I can't
+    # edit it" defeats a fixed list.
+    requiredMentionsAnyOf:
+      - - drag-and-drop
+        - drag and drop
+        - low-code
+        - no-code
+  skipJudge: true
@@ -0,0 +1,30 @@
+{
+  "user": {
+    "username": "admin",
+    "is_admin": true,
+    "folders": ["evals"],
+    "folders_read": ["evals"]
+  },
+  "workspace": {
+    "apps": [
+      {
+        "path": "f/evals/global/sales_board",
+        "summary": "Sales board",
+        "rawApp": false,
+        "value": {
+          "grid": []
+        }
+      },
+      {
+        "path": "f/evals/global/ops_console",
+        "summary": "Ops console",
+        "value": {
+          "files": {
+            "/App.tsx": "export default function App() {\n\treturn <div>Ops console</div>\n}\n"
+          },
+          "runnables": {}
+        }
+      }
+    ]
+  }
+}
@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO workspace_settings (workspace_id, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, git_credentials, ducklake, dbt_warehouses, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts, guest_access_enabled, guest_jwt_public_key, guest_jwt_jwks_url) SELECT $1, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, git_credentials, ducklake, dbt_warehouses, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts, guest_access_enabled, guest_jwt_public_key, guest_jwt_jwks_url FROM workspace_settings WHERE workspace_id = $2",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "1d8ccd32266637d7f7915f92a8483dce0c9986f3847227c2f66daa84d4109d7d"
-}
@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE workspace_settings SET auto_invite = $1 WHERE workspace_id = $2",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Jsonb",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "255ba68caa78d0e814ea817693a319f769907025f9c7d1150d45e8ecb1bff4ab"
-}
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO usr (workspace_id, username, email, is_admin, created_at, operator, disabled, role, is_service_account, added_via)\n         SELECT $1, username, email, is_admin, created_at, operator, disabled, role, is_service_account,\n                CASE WHEN $3 THEN NULL ELSE added_via END\n         FROM usr WHERE workspace_id = $2\n           AND (NOT $3 OR (NOT operator AND NOT disabled AND NOT is_service_account))\n         ON CONFLICT DO NOTHING",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text",
+        "Bool"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "2d6b117324eaf076a0ed06d2cb0ce73279957d6a39fdc6b1ecb6e0a1e02f921f"
+}
@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT add_admins_and_developers_to_forks FROM workspace_settings WHERE workspace_id = $1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "add_admins_and_developers_to_forks",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "2f39fce0ee700117f3e4c066e0b56ee979e4c392970278304e80368b770bb7b4"
+}
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "UPDATE token SET label = $1\n           WHERE email = $2 AND token_prefix = $3\n             AND (label IS NULL OR (\n                 label <> 'session'\n                 AND label <> 'guest_session'\n                 AND lower(label) NOT LIKE 'ephemeral%'\n                 AND label <> 'debugger-token'\n                 AND label NOT LIKE 'mcp-oauth-%'\n                 AND NOT starts_with(label, 'embed_app:')\n                 AND NOT starts_with(label, 'sdk_app:')\n                 AND NOT starts_with(label, 'impersonation:')\n             ))\n           RETURNING token_prefix",
+  "query": "UPDATE token SET label = $1\n           WHERE email = $2 AND token_prefix = $3\n             AND (label IS NULL OR (\n                 label <> 'session'\n                 AND label <> 'guest_session'\n                 AND lower(label) NOT LIKE 'ephemeral%'\n                 AND label <> 'debugger-token'\n                 AND label NOT LIKE 'mcp-oauth-%'\n                 AND NOT starts_with(label, 'embed_app:')\n                 AND NOT starts_with(label, 'sdk_app:')\n                 AND NOT starts_with(label, 'impersonation:')\n                 AND NOT starts_with(label, 'cli-login:')\n             ))\n           RETURNING token_prefix",
  "describe": {
    "columns": [
      {
@@ -20,5 +20,5 @@
      false
    ]
  },
-  "hash": "d631a26e5531589ff37e677f91a4f1d9f850e3e46c17130dd580426cda7a9f65"
+  "hash": "383c80239525d9c4ee90e2f5cb6e46c8a0983c52ad15db083f84a9e344dc4c99"
 }
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "\n        UPDATE workspace_settings\n        SET\n            ai_config = source_ws.ai_config,\n            large_file_storage = source_ws.large_file_storage,\n            ducklake = source_ws.ducklake,\n            dbt_warehouses = source_ws.dbt_warehouses,\n            datatable = source_ws.datatable,\n            git_app_installations = source_ws.git_app_installations\n        FROM workspace_settings source_ws\n        WHERE source_ws.workspace_id = $1\n        AND workspace_settings.workspace_id = $2\n        ",
+  "query": "\n        UPDATE workspace_settings\n        SET\n            ai_config = source_ws.ai_config,\n            large_file_storage = source_ws.large_file_storage,\n            ducklake = source_ws.ducklake,\n            dbt_warehouses = source_ws.dbt_warehouses,\n            datatable = source_ws.datatable,\n            git_app_installations = source_ws.git_app_installations,\n            add_admins_and_developers_to_forks = source_ws.add_admins_and_developers_to_forks\n        FROM workspace_settings source_ws\n        WHERE source_ws.workspace_id = $1\n        AND workspace_settings.workspace_id = $2\n        ",
  "describe": {
    "columns": [],
    "parameters": {
@@ -11,5 +11,5 @@
    },
    "nullable": []
  },
-  "hash": "a6decdebcd9750691f20f874b66a9c6f2ede08c33605c6a3c3dfc213a3eda76a"
+  "hash": "5ccfbd0f345b9b86ca356008def6cc1011a49fc8d8ad046ac572e81cf8938995"
 }
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "DELETE FROM token_expiry_notification n\n         USING token t\n         WHERE n.token_hash = t.token_hash\n           AND n.expiration > now()\n           AND n.expiration <= now() + interval '7 days'\n         RETURNING t.token_prefix, t.label, t.email, t.workspace_id",
+  "query": "DELETE FROM token_expiry_notification n\n         USING token t\n         WHERE n.token_hash = t.token_hash\n           AND n.expiration > now()\n           AND n.expiration <= now() + make_interval(days => $1)\n         RETURNING t.token_prefix, t.label, t.email, t.workspace_id",
  "describe": {
    "columns": [
      {
@@ -25,7 +25,9 @@
      }
    ],
    "parameters": {
-      "Left": []
+      "Left": [
+        "Int4"
+      ]
    },
    "nullable": [
      false,
@@ -34,5 +36,5 @@
      true
    ]
  },
-  "hash": "94fd0a57cfc9341b2e9deae60506c6c06aa6934b87200da14231f12f65149cd3"
+  "hash": "6c57c46c5a0462f379ed6a22ae97e363009177fdc45d795447a920f455f193cc"
 }
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT EXISTS(SELECT 1 FROM usr WHERE email = $1 AND is_service_account IS true\n            AND ($2::varchar IS NULL OR workspace_id = $2))",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "exists",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Varchar"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "75e6b5cd52d63ac094c90abd1524bc7a919692a96b076b8aaf24d812723531c8"
+}
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "SELECT workspace.id, workspace.name, usr.username, workspace_settings.color, workspace.parent_workspace_id,\n                workspace.is_dev_workspace, workspace.dev_workspace_label,\n                workspace.owner AS \"created_by?\",\n                CASE WHEN usr.operator THEN workspace_settings.operator_settings ELSE NULL END as operator_settings,\n                usr.disabled\n         FROM workspace\n         JOIN usr ON usr.workspace_id = workspace.id\n         JOIN workspace_settings ON workspace_settings.workspace_id = workspace.id\n         WHERE usr.email = $1 AND workspace.deleted = false",
+  "query": "SELECT workspace.id, workspace.name, usr.username, workspace_settings.color, workspace.parent_workspace_id,\n                workspace.is_dev_workspace, workspace.dev_workspace_label,\n                workspace.owner AS \"created_by?\",\n                CASE WHEN usr.operator THEN workspace_settings.operator_settings ELSE NULL END as operator_settings,\n                usr.disabled, usr.is_service_account\n         FROM workspace\n         JOIN usr ON usr.workspace_id = workspace.id\n         JOIN workspace_settings ON workspace_settings.workspace_id = workspace.id\n         WHERE usr.email = $1 AND workspace.deleted = false",
  "describe": {
    "columns": [
      {
@@ -52,6 +52,11 @@
        "ordinal": 9,
        "name": "disabled",
        "type_info": "Bool"
+      },
+      {
+        "ordinal": 10,
+        "name": "is_service_account",
+        "type_info": "Bool"
      }
    ],
    "parameters": {
@@ -69,8 +74,9 @@
      true,
      false,
      null,
+      false,
      false
    ]
  },
-  "hash": "88a134e4ca82d5ce0334977c7713021ae3e99a5a61ea1c944c1df1368746dfa5"
+  "hash": "7b33adb5cf051bc123340982b97a80a96ee43e1c91d9907d50cc2ee14111623e"
 }
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "\n        SELECT\n            workspace_id,\n            slack_team_id,\n            teams_team_id,\n            teams_team_name,\n            teams_team_guid,\n            slack_name,\n            slack_command_script,\n            teams_command_script,\n            slack_email,\n            slack_oauth_client_id,\n            slack_oauth_client_secret,\n            customer_id,\n            plan,\n            webhook,\n            ai_config,\n            dbt_warehouses,\n            large_file_storage,\n            datatable,\n            ducklake,\n            git_sync,\n            deploy_ui,\n            default_app,\n            default_scripts,\n            mute_critical_alerts,\n            color,\n            operator_settings,\n            git_app_installations,\n            auto_invite,\n            error_handler,\n            success_handler,\n            public_app_execution_limit_per_minute,\n            error_handler_fallback_to_instance_alerts,\n            guest_access_enabled,\n            guest_jwt_public_key,\n            guest_jwt_jwks_url\n        FROM\n            workspace_settings\n        WHERE\n            workspace_id = $1\n        ",
+  "query": "\n        SELECT\n            workspace_id,\n            slack_team_id,\n            teams_team_id,\n            teams_team_name,\n            teams_team_guid,\n            slack_name,\n            slack_command_script,\n            teams_command_script,\n            slack_email,\n            slack_oauth_client_id,\n            slack_oauth_client_secret,\n            customer_id,\n            plan,\n            webhook,\n            ai_config,\n            dbt_warehouses,\n            large_file_storage,\n            datatable,\n            ducklake,\n            git_sync,\n            deploy_ui,\n            default_app,\n            default_scripts,\n            mute_critical_alerts,\n            color,\n            operator_settings,\n            git_app_installations,\n            auto_invite,\n            error_handler,\n            success_handler,\n            public_app_execution_limit_per_minute,\n            error_handler_fallback_to_instance_alerts,\n            guest_access_enabled,\n            guest_jwt_public_key,\n            guest_jwt_jwks_url,\n            add_admins_and_developers_to_forks\n        FROM\n            workspace_settings\n        WHERE\n            workspace_id = $1\n        ",
  "describe": {
    "columns": [
      {
@@ -177,6 +177,11 @@
        "ordinal": 34,
        "name": "guest_jwt_jwks_url",
        "type_info": "Text"
+      },
+      {
+        "ordinal": 35,
+        "name": "add_admins_and_developers_to_forks",
+        "type_info": "Bool"
      }
    ],
    "parameters": {
@@ -219,8 +224,9 @@
      false,
      false,
      true,
-      true
+      true,
+      false
    ]
  },
-  "hash": "dc4a57df3becc610f631ef22c116450390addbfae85fecc61c991d94167e6e99"
+  "hash": "8ebe054b41793f1a7b85f1f8d29cd21d12fa1207b58bfc46249c250cdcdb5363"
 }
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE workspace_settings SET add_admins_and_developers_to_forks = $1 WHERE workspace_id = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Bool",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "9bd1995747f0073b3a866d1238e78f7e6dfa9185056f7731547ff05b8176b271"
+}
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE workspace_settings SET auto_invite = (COALESCE(auto_invite, '{}'::jsonb) - 'domain') || $1::jsonb WHERE workspace_id = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Jsonb",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "a1bcf143135ecb9f32709a56a353d3246dc238920c3e155caa9cf767246fa6fb"
+}
@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO usr (workspace_id, username, email, is_admin, created_at, operator, disabled, role, is_service_account, added_via)\n         SELECT $1, username, email, is_admin, created_at, operator, disabled, role, is_service_account, added_via\n         FROM usr WHERE workspace_id = $2\n         ON CONFLICT DO NOTHING",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "b98844926ff127c528ed3e7bc63bf1ebed0192be267983e8fbd18f79997e6142"
-}
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "\n        SELECT\n            workspace_id,\n            slack_team_id,\n            slack_name,\n            teams_team_id,\n            teams_team_name,\n            teams_team_guid,\n            mute_critical_alerts,\n            guest_access_enabled,\n            deploy_ui,\n            large_file_storage,\n            datatable\n        FROM\n            workspace_settings\n        WHERE\n            workspace_id = $1\n        ",
+  "query": "\n        SELECT\n            workspace_id,\n            slack_team_id,\n            slack_name,\n            teams_team_id,\n            teams_team_name,\n            teams_team_guid,\n            mute_critical_alerts,\n            guest_access_enabled,\n            add_admins_and_developers_to_forks,\n            deploy_ui,\n            large_file_storage,\n            datatable\n        FROM\n            workspace_settings\n        WHERE\n            workspace_id = $1\n        ",
  "describe": {
    "columns": [
      {
@@ -45,16 +45,21 @@
      },
      {
        "ordinal": 8,
+        "name": "add_admins_and_developers_to_forks",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 9,
        "name": "deploy_ui",
        "type_info": "Jsonb"
      },
      {
-        "ordinal": 9,
+        "ordinal": 10,
        "name": "large_file_storage",
        "type_info": "Jsonb"
      },
      {
-        "ordinal": 10,
+        "ordinal": 11,
        "name": "datatable",
        "type_info": "Jsonb"
      }
@@ -73,10 +78,11 @@
      true,
      true,
      false,
+      false,
      true,
      true,
      true
    ]
  },
-  "hash": "ede15bff96152f209aff756830cbc76b5afa1af6ed324376989117b1054c3447"
+  "hash": "e6e31fdf705896c81f9a0f45d47c1b93db0406aaf278bccba07be00e9f937e2a"
 }
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO workspace_settings (workspace_id, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, git_credentials, ducklake, dbt_warehouses, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts, guest_access_enabled, guest_jwt_public_key, guest_jwt_jwks_url, add_admins_and_developers_to_forks) SELECT $1, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, git_credentials, ducklake, dbt_warehouses, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts, guest_access_enabled, guest_jwt_public_key, guest_jwt_jwks_url, add_admins_and_developers_to_forks FROM workspace_settings WHERE workspace_id = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "eefa0588a6a927fd9b3f65e1df652fb2b4cf7983049d2c490940df360c7e2b30"
+}
@@ -2311,9 +2311,9 @@ dependencies = [

 [[package]]
 name = "cc"
-version = "1.4.6"
+version = "1.4.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a3eb0f42d6c360dc3f8a821f6bf2fdea7f72bfd36b3076eb0e6d1e9e0752fff4"
+checksum = "54413ede23c2daf518f35156dfde027feb2374004d63bd497f983c8db9c0e313"
 dependencies = [
 "find-msvc-tools",
 "jobserver",
@@ -5055,9 +5055,9 @@ dependencies = [

 [[package]]
 name = "find-msvc-tools"
-version = "0.1.12"
+version = "0.1.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3e0f1c7c3a72c66fd80abe965175f7523475c0489a87d3ff9d6e8c87d87a9d2d"
+checksum = "ef25905e51abafe4dcea6c15fec58c57b601cdbd0ee53d22ea1d3016c587d39b"

 [[package]]
 name = "fixedbitset"
@@ -5497,9 +5497,9 @@ dependencies = [

 [[package]]
 name = "generator"
-version = "0.8.9"
+version = "0.8.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b3b854b0e584ead1a33f18b2fcad7cf7be18b3875c78816b753639aa501513ae"
+checksum = "54ade96dc9003043bce7c035c85a9df5a858bfb2039c5a2e6fdf00f324f6c551"
 dependencies = [
 "cc",
 "cfg-if",
@@ -14793,7 +14793,7 @@ dependencies = [

 [[package]]
 name = "windmill"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "async-nats",
@@ -14881,7 +14881,7 @@ dependencies = [

 [[package]]
 name = "windmill-ai"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "async-stream",
 "async-trait",
@@ -14915,7 +14915,7 @@ dependencies = [

 [[package]]
 name = "windmill-alerting"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "axum 0.8.9",
 "chrono",
@@ -14928,7 +14928,7 @@ dependencies = [

 [[package]]
 name = "windmill-api"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "argon2",
@@ -15068,7 +15068,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-agent-workers"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "axum 0.8.9",
 "chrono",
@@ -15091,7 +15091,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-assets"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "axum 0.8.9",
 "chrono",
@@ -15108,7 +15108,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-auth"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "axum 0.8.9",
@@ -15134,7 +15134,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-client"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "reqwest 0.12.28",
 "serde",
@@ -15144,7 +15144,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-configs"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "axum 0.8.9",
 "chrono",
@@ -15161,7 +15161,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-debug"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "axum 0.8.9",
 "base64 0.22.1",
@@ -15183,7 +15183,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-embeddings"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "axum 0.8.9",
@@ -15206,7 +15206,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-flow-conversations"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "axum 0.8.9",
 "chrono",
@@ -15222,7 +15222,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-flows"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "axum 0.8.9",
 "chrono",
@@ -15244,7 +15244,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-groups"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "axum 0.8.9",
 "chrono",
@@ -15266,7 +15266,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-inputs"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "axum 0.8.9",
 "chrono",
@@ -15280,7 +15280,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-integration-tests"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "async-nats",
@@ -15315,7 +15315,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-jobs"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "axum 0.8.9",
@@ -15340,7 +15340,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-npm-proxy"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "axum 0.8.9",
 "chrono",
@@ -15368,7 +15368,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-openapi"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "axum 0.8.9",
@@ -15390,7 +15390,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-schedule"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "axum 0.8.9",
 "chrono",
@@ -15410,7 +15410,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-scripts"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "axum 0.8.9",
 "chrono",
@@ -15448,7 +15448,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-settings"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "axum 0.8.9",
@@ -15477,7 +15477,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-sse"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "lazy_static",
 "serde",
@@ -15489,7 +15489,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-users"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "argon2",
 "axum 0.8.9",
@@ -15513,7 +15513,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-workers"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "axum 0.8.9",
 "chrono",
@@ -15527,7 +15527,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-workspaces"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "axum 0.8.9",
 "chrono",
@@ -15562,7 +15562,7 @@ dependencies = [

 [[package]]
 name = "windmill-audit"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "chrono",
 "lazy_static",
@@ -15576,7 +15576,7 @@ dependencies = [

 [[package]]
 name = "windmill-autoscaling"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "axum 0.8.9",
@@ -15595,7 +15595,7 @@ dependencies = [

 [[package]]
 name = "windmill-common"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "aes-gcm",
 "aho-corasick",
@@ -15702,7 +15702,7 @@ dependencies = [

 [[package]]
 name = "windmill-dep-map"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "chrono",
 "futures",
@@ -15722,7 +15722,7 @@ dependencies = [

 [[package]]
 name = "windmill-git-sync"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "regex",
 "serde",
@@ -15739,7 +15739,7 @@ dependencies = [

 [[package]]
 name = "windmill-indexer"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "astral-tokio-tar",
@@ -15766,7 +15766,7 @@ dependencies = [

 [[package]]
 name = "windmill-jseval"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "futures",
@@ -15783,7 +15783,7 @@ dependencies = [

 [[package]]
 name = "windmill-macros"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "itertools 0.14.0",
 "lazy_static",
@@ -15799,7 +15799,7 @@ dependencies = [

 [[package]]
 name = "windmill-mcp"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "async-trait",
@@ -15820,7 +15820,7 @@ dependencies = [

 [[package]]
 name = "windmill-native-triggers"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "async-trait",
@@ -15851,7 +15851,7 @@ dependencies = [

 [[package]]
 name = "windmill-oauth"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "arc-swap",
@@ -15876,7 +15876,7 @@ dependencies = [

 [[package]]
 name = "windmill-object-store"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "async-stream",
@@ -15911,7 +15911,7 @@ dependencies = [

 [[package]]
 name = "windmill-operator"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "futures",
@@ -15929,7 +15929,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "convert_case 0.6.0",
 "serde",
@@ -15938,7 +15938,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-bash"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "lazy_static",
@@ -15950,7 +15950,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-csharp"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "serde_json",
@@ -15962,7 +15962,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-go"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "gosyn",
@@ -15974,7 +15974,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-graphql"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "lazy_static",
@@ -15986,7 +15986,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-java"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "serde_json",
@@ -15998,7 +15998,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-nu"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "nu-parser",
@@ -16009,7 +16009,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-php"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "itertools 0.14.0",
@@ -16020,7 +16020,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-py"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "itertools 0.14.0",
@@ -16032,7 +16032,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "rustpython-ast",
@@ -16043,7 +16043,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "async-recursion",
@@ -16065,7 +16065,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-r"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "serde_json",
@@ -16077,7 +16077,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-ruby"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "lazy_static",
@@ -16091,7 +16091,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-rust"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "convert_case 0.6.0",
@@ -16108,7 +16108,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-sql"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "lazy_static",
@@ -16121,7 +16121,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "serde",
@@ -16133,7 +16133,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-ts"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "lazy_static",
@@ -16151,7 +16151,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "serde-wasm-bindgen",
@@ -16167,7 +16167,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-wac"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "rustpython-ast",
@@ -16183,7 +16183,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-yaml"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "lazy_static",
@@ -16197,7 +16197,7 @@ dependencies = [

 [[package]]
 name = "windmill-queue"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "async-recursion",
@@ -16236,7 +16236,7 @@ dependencies = [

 [[package]]
 name = "windmill-runtime-nativets"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "const_format",
@@ -16276,7 +16276,7 @@ dependencies = [

 [[package]]
 name = "windmill-sql-datatype-parser-wasm"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "getrandom 0.3.4",
 "wasm-bindgen",
@@ -16287,7 +16287,7 @@ dependencies = [

 [[package]]
 name = "windmill-store"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "async-recursion",
@@ -16322,7 +16322,7 @@ dependencies = [

 [[package]]
 name = "windmill-test-utils"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "async-trait",
@@ -16346,7 +16346,7 @@ dependencies = [

 [[package]]
 name = "windmill-trigger"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "async-trait",
@@ -16379,7 +16379,7 @@ dependencies = [

 [[package]]
 name = "windmill-trigger-amqp"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "async-trait",
@@ -16406,7 +16406,7 @@ dependencies = [

 [[package]]
 name = "windmill-trigger-azure"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "async-trait",
@@ -16439,7 +16439,7 @@ dependencies = [

 [[package]]
 name = "windmill-trigger-email"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "async-trait",
@@ -16459,7 +16459,7 @@ dependencies = [

 [[package]]
 name = "windmill-trigger-gcp"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "async-trait",
@@ -16493,7 +16493,7 @@ dependencies = [

 [[package]]
 name = "windmill-trigger-http"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "async-trait",
@@ -16529,7 +16529,7 @@ dependencies = [

 [[package]]
 name = "windmill-trigger-kafka"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "async-trait",
@@ -16552,7 +16552,7 @@ dependencies = [

 [[package]]
 name = "windmill-trigger-mqtt"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "async-trait",
@@ -16576,7 +16576,7 @@ dependencies = [

 [[package]]
 name = "windmill-trigger-nats"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "async-nats",
@@ -16600,7 +16600,7 @@ dependencies = [

 [[package]]
 name = "windmill-trigger-postgres"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "async-trait",
@@ -16635,7 +16635,7 @@ dependencies = [

 [[package]]
 name = "windmill-trigger-sqs"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "async-trait",
@@ -16663,7 +16663,7 @@ dependencies = [

 [[package]]
 name = "windmill-trigger-websocket"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "async-trait",
@@ -16688,7 +16688,7 @@ dependencies = [

 [[package]]
 name = "windmill-types"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "bitflags 2.13.2",
@@ -16707,7 +16707,7 @@ dependencies = [

 [[package]]
 name = "windmill-worker"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "async-once-cell",
@@ -16825,7 +16825,7 @@ dependencies = [

 [[package]]
 name = "windmill-worker-volumes"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "bytes",
 "futures",
@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.814.0"
+version = "1.815.0"
 authors.workspace = true
 edition.workspace = true

@@ -88,7 +88,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal", "./parsers/windmill-parser-wasm"]

 [workspace.package]
-version = "1.814.0"
+version = "1.815.0"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"

@@ -1 +1 @@
-7e338e4dabf91689bfd7fb0333c6534040b17b59
+bc3ef08c8e4233508c023e6ee847a3cd0b8be43b
@@ -0,0 +1 @@
+ALTER TABLE workspace_settings DROP COLUMN add_admins_and_developers_to_forks;
@@ -0,0 +1 @@
+ALTER TABLE workspace_settings ADD COLUMN add_admins_and_developers_to_forks BOOLEAN NOT NULL DEFAULT false;
@@ -6191,7 +6191,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"

 [[package]]
 name = "windmill-common"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "aho-corasick",
 "anyhow",
@@ -6274,7 +6274,7 @@ dependencies = [

 [[package]]
 name = "windmill-macros"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -6286,7 +6286,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "convert_case",
 "serde",
@@ -6295,7 +6295,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-bash"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "lazy_static",
@@ -6307,7 +6307,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-csharp"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "serde_json",
@@ -6319,7 +6319,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-go"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "gosyn",
@@ -6331,7 +6331,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-graphql"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "lazy_static",
@@ -6343,7 +6343,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-java"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "serde_json",
@@ -6355,7 +6355,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-nu"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "nu-parser",
@@ -6366,7 +6366,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-php"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "itertools 0.14.0",
@@ -6377,7 +6377,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-py"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "itertools 0.14.0",
@@ -6389,7 +6389,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "rustpython-ast",
@@ -6400,7 +6400,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "async-recursion",
@@ -6422,7 +6422,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-r"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "serde_json",
@@ -6434,7 +6434,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-ruby"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "lazy_static",
@@ -6448,7 +6448,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-rust"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "convert_case",
@@ -6465,7 +6465,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-sql"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "lazy_static",
@@ -6478,7 +6478,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "serde",
@@ -6490,7 +6490,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-ts"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "lazy_static",
@@ -6508,7 +6508,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "serde-wasm-bindgen",
@@ -6524,7 +6524,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-wac"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "rustpython-ast",
@@ -6540,7 +6540,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-wasm"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "getrandom 0.2.17",
@@ -6572,7 +6572,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-yaml"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "lazy_static",
@@ -6586,7 +6586,7 @@ dependencies = [

 [[package]]
 name = "windmill-types"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "bitflags",
@@ -12,7 +12,7 @@ resolver = "2"
 members = ["."]

 [workspace.package]
-version = "1.814.0"
+version = "1.815.0"
 edition = "2021"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]

@@ -52,7 +52,8 @@ use windmill_common::{
        INSTANCE_EVENTS_WEBHOOK_SETTING, INSTANCE_PYTHON_VERSION_SETTING,
        JOB_DEFAULT_TIMEOUT_SECS_SETTING, JOB_ISOLATION_SETTING, JWT_SECRET_SETTING,
        KEEP_JOB_DIR_SETTING, LICENSE_KEY_SETTING, MAVEN_REPOS_SETTING, MAVEN_SETTINGS_XML_SETTING,
-        MONITOR_LOGS_ON_OBJECT_STORE_SETTING, NO_DEFAULT_MAVEN_SETTING,
+        MCP_DISABLE_TOKEN_QUERY_PARAM_SETTING, MONITOR_LOGS_ON_OBJECT_STORE_SETTING,
+        NO_DEFAULT_MAVEN_SETTING,
        NPM_CONFIG_REGISTRY_SETTING, NSJAIL_TMPFS_SIZE_MB_SETTING, NSJAIL_TMP_BACKING_SETTING,
        NUGET_CONFIG_SETTING, OAUTH_SETTING, OTEL_SETTING, OTEL_TRACES_RETENTION_SECS_SETTING,
        OTEL_TRACING_PROXY_SETTING, PIP_INDEX_URL_SETTING, POWERSHELL_REPO_PAT_SETTING,
@@ -126,7 +127,8 @@ use windmill_worker::{

 use crate::monitor::{
    initial_load, load_concurrency_key_max_queued, load_disable_password_login,
-    load_fork_workspace_tag_append_fork_suffix, load_keep_job_dir, load_metrics_debug_enabled,
+    load_fork_workspace_tag_append_fork_suffix, load_keep_job_dir,
+    load_mcp_disable_token_query_param, load_metrics_debug_enabled,
    load_preview_tags_override, load_require_preexisting_user, load_retention_period_overrides,
    load_tag_per_workspace_enabled, load_tag_per_workspace_workspaces,
    load_workspace_fairness_duration_secs, load_workspace_fairness_enabled,
@@ -2164,6 +2166,9 @@ async fn process_notify_event(
                DISABLE_PASSWORD_LOGIN_SETTING => {
                    load_disable_password_login(db).await;
                }
+                MCP_DISABLE_TOKEN_QUERY_PARAM_SETTING => {
+                    load_mcp_disable_token_query_param(db).await;
+                }
                EXPOSE_METRICS_SETTING => {
                    tracing::info!("Metrics setting changed, restarting");
                    spawn_graceful_killpill(tx, db, 30, "metrics setting change", server_mode)
@@ -45,7 +45,10 @@ use windmill_common::otel_oss::{
 use windmill_common::{
    agent_workers::DECODED_AGENT_TOKEN,
    apps::APP_WORKSPACED_ROUTE,
-    auth::{create_token_for_owner, ephemeral_script_token_label, job_token_expiry_secs},
+    auth::{
+        create_token_for_owner, ephemeral_script_token_label, job_token_expiry_secs,
+        TOKEN_EXPIRY_WARNING_DAYS,
+    },
    ee_oss::CriticalErrorChannel,
    email_oss::send_email_if_possible,
    error,
@@ -62,6 +65,7 @@ use windmill_common::{
        FORK_WORKSPACE_TAG_APPEND_FORK_SUFFIX_SETTING, HUB_API_SECRET_SETTING,
        HUB_BASE_URL_SETTING, INSTANCE_PYTHON_VERSION_SETTING, JOB_DEFAULT_TIMEOUT_SECS_SETTING,
        JOB_ISOLATION_SETTING, JWT_SECRET_SETTING, KEEP_JOB_DIR_SETTING, LICENSE_KEY_SETTING,
+        MCP_DISABLE_TOKEN_QUERY_PARAM, MCP_DISABLE_TOKEN_QUERY_PARAM_SETTING,
        MONITOR_LOGS_ON_OBJECT_STORE_SETTING, NPMRC_SETTING, NPM_CONFIG_REGISTRY_SETTING,
        NSJAIL_TMPFS_SIZE_MB_SETTING, NSJAIL_TMP_BACKING_SETTING, NUGET_CONFIG_SETTING,
        OTEL_SETTING, OTEL_TRACES_RETENTION_SECS_SETTING, OTEL_TRACING_PROXY_SETTING,
@@ -285,6 +289,15 @@ pub async fn initial_load(
    );

    if let Some(db) = conn.as_sql() {
+        // Outside the `server_mode` block below: a `MODE=mcp` process serves the MCP routes
+        // with `server_mode` false and would otherwise never read this at all. That mode
+        // joins no monitor loop, so there — as for every global setting, `base_url`
+        // included — this pass is the only read, and a change lands on restart.
+        pass.setting(
+            MCP_DISABLE_TOKEN_QUERY_PARAM_SETTING,
+            false,
+            |v| async move { apply_mcp_disable_token_query_param(v) },
+        );
        pass.setting(DEFAULT_TAGS_PER_WORKSPACE_SETTING, false, |v| async move {
            apply_tag_per_workspace_enabled(v)
        });
@@ -1614,6 +1627,23 @@ pub fn apply_disable_password_login(value: Option<serde_json::Value>) {
    };
 }

+pub async fn load_mcp_disable_token_query_param(db: &DB) {
+    match load_value_from_global_settings(db, MCP_DISABLE_TOKEN_QUERY_PARAM_SETTING).await {
+        Ok(v) => apply_mcp_disable_token_query_param(v),
+        Err(e) => tracing::error!("Error loading mcp_disable_token_query_param setting: {e:#}"),
+    };
+}
+
+pub fn apply_mcp_disable_token_query_param(value: Option<serde_json::Value>) {
+    match value {
+        Some(serde_json::Value::Bool(t)) => {
+            MCP_DISABLE_TOKEN_QUERY_PARAM.store(t, Ordering::Relaxed)
+        }
+        None => MCP_DISABLE_TOKEN_QUERY_PARAM.store(false, Ordering::Relaxed),
+        _ => (),
+    };
+}
+
 struct LogFile {
    file_path: String,
    hostname: String,
@@ -2198,7 +2228,7 @@ async fn cleanup_scheduled_job_deletions(db: &Pool<Postgres>) {
 }

 pub async fn check_expiring_tokens(db: &DB) {
-    // Find tokens expiring within 7 days that still have a pending notification row.
+    // Find tokens expiring within the warning window that still have a pending notification row.
    // The notification table stores token_hash (not plaintext) so the join works
    // even after the hash migration makes token.token nullable.
    let expiring_tokens_r = sqlx::query_as!(
@@ -2207,8 +2237,9 @@ pub async fn check_expiring_tokens(db: &DB) {
         USING token t
         WHERE n.token_hash = t.token_hash
           AND n.expiration > now()
-           AND n.expiration <= now() + interval '7 days'
+           AND n.expiration <= now() + make_interval(days => $1)
         RETURNING t.token_prefix, t.label, t.email, t.workspace_id",
+        TOKEN_EXPIRY_WARNING_DAYS,
    )
    .fetch_all(db)
    .await;
@@ -234,7 +234,7 @@ workspace_protection_rule: workspace_id(char), name(char), rules(int), bypass_gr
  FK: (workspace_id) -> workspace(id)
 workspace_runnable_dependencies: flow_path(char), runnable_path(char), script_hash(bigint), runnable_is_flow(bool), workspace_id(char), app_path(char), id(bigint), runnable_is_agent(bool)
  FK: (app_path, workspace_id) -> app(path, workspace_id) | (flow_path, workspace_id) -> flow(path, workspace_id)
-workspace_settings: workspace_id(char), slack_team_id(char), slack_name(char), slack_command_script(char), slack_email(char), customer_id(char), plan(char), webhook(text), ai_config(jsonb), large_file_storage(jsonb), git_sync(jsonb), default_app(char), default_scripts(jsonb), deploy_ui(jsonb), mute_critical_alerts(bool), color(char), operator_settings(jsonb), teams_command_script(text), teams_team_id(text), teams_team_name(text), git_app_installations(jsonb), ducklake(jsonb), slack_oauth_client_id(char), slack_oauth_client_secret(char), datatable(jsonb), teams_team_guid(text), auto_invite(jsonb), error_handler(jsonb), success_handler(jsonb), public_app_execution_limit_per_minute(int), dbt_warehouses(jsonb), guest_access_enabled(bool), guest_jwt_public_key(text), guest_jwt_jwks_url(text), ai_sessions_backup_generation(int)
+workspace_settings: workspace_id(char), slack_team_id(char), slack_name(char), slack_command_script(char), slack_email(char), customer_id(char), plan(char), webhook(text), ai_config(jsonb), large_file_storage(jsonb), git_sync(jsonb), default_app(char), default_scripts(jsonb), deploy_ui(jsonb), mute_critical_alerts(bool), color(char), operator_settings(jsonb), teams_command_script(text), teams_team_id(text), teams_team_name(text), git_app_installations(jsonb), ducklake(jsonb), slack_oauth_client_id(char), slack_oauth_client_secret(char), datatable(jsonb), teams_team_guid(text), auto_invite(jsonb), error_handler(jsonb), success_handler(jsonb), public_app_execution_limit_per_minute(int), dbt_warehouses(jsonb), guest_access_enabled(bool), guest_jwt_public_key(text), guest_jwt_jwks_url(text), ai_sessions_backup_generation(int), add_admins_and_developers_to_forks(bool)
  FK: (workspace_id) -> workspace(id)
 zombie_job_counter: job_id(uuid), counter(int)
  FK: (job_id) -> v2_job(id)
@@ -3312,3 +3312,60 @@ export function main(i: number) {

    Ok(())
 }
+
+// A `$flow_expr[...]` step tag is resolved from the flow's state before the step is pushed, and
+// one that cannot be resolved fails the step instead of queueing it on a tag no worker serves.
+#[cfg(feature = "deno_core")]
+#[sqlx::test(fixtures("base"))]
+async fn test_flow_expr_step_tag(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+
+    let step = |id: &str, tag: Option<&str>| {
+        flow_module(
+            id,
+            FlowModuleValue::RawScript {
+                input_transforms: Default::default(),
+                language: ScriptLang::Deno,
+                content: "export function main() { return { lang: 'bun' } }".to_string(),
+                path: None,
+                lock: None,
+                tag: tag.map(str::to_string),
+                concurrency_settings: Default::default(),
+                is_trigger: None,
+                assets: None,
+            },
+        )
+    };
+    let flow = FlowValue {
+        modules: vec![
+            step("a", None),
+            step("b", Some("$flow_expr[results.a.lang]")),
+            step("c", Some("nobody-serves-$flow_expr[a.lang]")),
+        ],
+        same_worker: false,
+        ..Default::default()
+    };
+
+    let job = RunJob::from(JobPayload::RawFlow { value: flow, path: None, restarted_from: None })
+        .run_until_complete(&db, false, server.addr.port())
+        .await;
+
+    let b_tag = sqlx::query_scalar::<_, String>(
+        "SELECT tag FROM v2_job WHERE parent_job = $1 AND flow_step_id = 'b'",
+    )
+    .bind(job.id)
+    .fetch_one(&db)
+    .await?;
+    assert_eq!(b_tag, "bun");
+
+    assert!(!job.success);
+    let result = job.json_result().unwrap();
+    let message = result["error"]["message"].as_str().unwrap_or_default();
+    assert!(
+        message.contains("Could not resolve the step tag `nobody-serves-$flow_expr[a.lang]`"),
+        "got {result:?}"
+    );
+
+    Ok(())
+}
@@ -1530,6 +1530,31 @@ async fn declarative_sync_rejects_an_unusable_instance_banner(db: Pool<Postgres>
    );
 }

+#[sqlx::test(fixtures("base"))]
+async fn declarative_sync_rejects_a_malformed_max_token_expiration(db: Pool<Postgres>) {
+    clear_settings_and_configs(&db).await;
+    let before = count_global_settings(&db).await;
+
+    let mut desired = BTreeMap::new();
+    desired.insert(
+        "max_token_expiration_days".to_string(),
+        serde_json::json!("7.0"),
+    );
+
+    let err = windmill_common::instance_config::sync_global_settings_declarative(
+        &db,
+        &BTreeMap::new(),
+        &desired,
+    )
+    .await
+    .expect_err("a ceiling the token routes cannot read must fail the sync");
+    assert!(
+        err.to_string().contains("max_token_expiration_days"),
+        "the error should name the offending setting, got: {err}"
+    );
+    assert_eq!(count_global_settings(&db).await, before);
+}
+
 #[sqlx::test(fixtures("base"))]
 async fn declarative_sync_rejects_an_unusable_default_allowed_origins(db: Pool<Postgres>) {
    // The declarative writers (the sync-config CLI, the operator's ConfigMap
@@ -0,0 +1,108 @@
+/*
+ * The job's own token (`$WM_TOKEN`) stays valid well past the job it was minted
+ * for, and job logs are persisted to `job_logs` and optionally to object storage,
+ * so a script that echoes the token would otherwise park a live credential in
+ * durable storage. `run_worker` registers the token with `sensitive_log_masks`
+ * for the job it pulled; this pins that the persisted log carries the masked form.
+ */
+
+use sqlx::{Pool, Postgres};
+use windmill_common::{
+    jobs::{JobPayload, RawCode},
+    scripts::ScriptLang,
+};
+use windmill_test_utils::*;
+
+/// Prefix of a serialized job token: `jwt_` plus the base64 of a JWT header.
+/// The masked form keeps only `jwt` + the last three characters, so it never matches.
+const RAW_TOKEN_PREFIX: &str = "jwt_ey";
+
+#[sqlx::test(fixtures("base"))]
+async fn test_job_token_masked_in_persisted_logs(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    let job = RunJob::from(JobPayload::Code(RawCode {
+        hash: None,
+        content: "echo \"running with --token $WM_TOKEN\"".to_string(),
+        path: None,
+        lock: None,
+        language: ScriptLang::Bash,
+        cache_ttl: None,
+        cache_ignore_s3_path: None,
+        dedicated_worker: None,
+        concurrency_settings: windmill_common::runnable_settings::ConcurrencySettings::default()
+            .into(),
+        debouncing_settings: windmill_common::runnable_settings::DebouncingSettings::default(),
+        modules: None,
+        tag: None,
+    }))
+    .run_until_complete(&db, false, port)
+    .await;
+    assert!(job.success, "job should have succeeded");
+
+    let logs =
+        sqlx::query_scalar::<_, Option<String>>("SELECT logs FROM job_logs WHERE job_id = $1")
+            .bind(job.id)
+            .fetch_one(&db)
+            .await?
+            .unwrap_or_default();
+
+    assert!(
+        !logs.contains(RAW_TOKEN_PREFIX),
+        "an unmasked job token reached the persisted logs: {logs}"
+    );
+    assert!(
+        logs.contains("secret value was masked"),
+        "expected the masking notice in logs: {logs}"
+    );
+    Ok(())
+}
+
+/// nativets runs V8 in-process and persists `console.log` output through its own
+/// channel, so it is masked by a different mechanism than the bash case above and
+/// needs its own guard.
+#[cfg(feature = "deno_core")]
+#[sqlx::test(fixtures("base"))]
+async fn test_job_token_masked_in_nativets_logs(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    let job = RunJob::from(JobPayload::Code(RawCode {
+        hash: None,
+        content: "export async function main() {\n  console.log('running with --token ' + process.env.WM_TOKEN);\n  return 'ok';\n}".to_string(),
+        path: None,
+        lock: None,
+        language: ScriptLang::Nativets,
+        cache_ttl: None,
+        cache_ignore_s3_path: None,
+        dedicated_worker: None,
+        concurrency_settings: windmill_common::runnable_settings::ConcurrencySettings::default()
+            .into(),
+        debouncing_settings: windmill_common::runnable_settings::DebouncingSettings::default(),
+        modules: None,
+        tag: None,
+    }))
+    .run_until_complete(&db, false, port)
+    .await;
+    assert!(job.success, "job should have succeeded");
+
+    let logs =
+        sqlx::query_scalar::<_, Option<String>>("SELECT logs FROM job_logs WHERE job_id = $1")
+            .bind(job.id)
+            .fetch_one(&db)
+            .await?
+            .unwrap_or_default();
+
+    assert!(
+        !logs.contains(RAW_TOKEN_PREFIX),
+        "an unmasked job token reached the persisted logs: {logs}"
+    );
+    assert!(
+        logs.contains("secret value was masked"),
+        "expected the masking notice in logs: {logs}"
+    );
+    Ok(())
+}
@@ -1249,6 +1249,10 @@ pub async fn register_token_expiry_notification(
    if !windmill_common::auth::is_user_token(label) {
        return;
    }
+    let warning_days = windmill_common::auth::TOKEN_EXPIRY_WARNING_DAYS;
+    if expiration <= chrono::Utc::now() + chrono::Duration::days(warning_days.into()) {
+        return;
+    }
    if let Err(e) = sqlx::query!(
        "INSERT INTO token_expiry_notification (token_hash, expiration) VALUES ($1, $2) ON CONFLICT DO NOTHING",
        token_hash,
@@ -311,3 +311,121 @@ async fn test_fork_keeps_only_resolvable_on_behalf_of(db: Pool<Postgres>) -> any

    Ok(())
 }
+
+/// Apps, schedules, triggers and their drafts cannot drop an identity the way scripts and flows
+/// do, so one naming nobody in the fork goes to its creator while one that still resolves stays.
+/// Forked as an admin, whose app policies the clone otherwise keeps.
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn test_fork_repoints_unresolvable_identities(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+
+    let server = ApiServer::start(db.clone()).await?;
+    let base_url = format!("http://localhost:{}/api", server.addr.port());
+
+    let stranger = json!({
+        "on_behalf_of": "u/test-user-2",
+        "on_behalf_of_email": "test2@windmill.dev",
+        "execution_mode": "publisher",
+    });
+    sqlx::query(
+        "INSERT INTO app (workspace_id, path, summary, policy, versions)
+         VALUES ('test-workspace', 'u/test-user/stranger', '', $1, '{}'),
+                ('test-workspace', 'u/test-user/group', '', $2, '{}')",
+    )
+    .bind(&stranger)
+    .bind(json!({
+        "on_behalf_of": "g/all",
+        "on_behalf_of_email": "group-all@windmill.dev",
+        "execution_mode": "publisher",
+    }))
+    .execute(&db)
+    .await?;
+    // The clone re-aggregates `versions` from `app_version`, and the column is NOT NULL.
+    sqlx::query(
+        "WITH v AS (
+            INSERT INTO app_version (app_id, value, created_by)
+            SELECT id, '{}'::json, 'test-user' FROM app WHERE workspace_id = 'test-workspace'
+            RETURNING id, app_id
+         )
+         UPDATE app SET versions = ARRAY[v.id] FROM v WHERE app.id = v.app_id",
+    )
+    .execute(&db)
+    .await?;
+    sqlx::query(
+        "INSERT INTO draft (workspace_id, path, typ, value, created_at, email)
+         VALUES ('test-workspace', 'u/test-user/stranger', 'raw_app', $1::json, NOW(), 'test@windmill.dev'),
+                ('test-workspace', 'u/test-user/stranger', 'trigger_websocket', $2::json, NOW(), 'test@windmill.dev'),
+                ('test-workspace', 'u/test-user/nul', 'raw_app', $3::json, NOW(), 'test@windmill.dev')",
+    )
+    .bind(json!({ "policy": stranger }))
+    .bind(json!({ "permissioned_as": "u/test-user-2" }))
+    // Saved before drafts were stripped of NULs: any jsonb parse of it raises, so it must be
+    // skipped rather than abort the fork. Built from parts because a NUL escape can't sit in source.
+    .bind(format!(
+        r#"{{"policy":{{"on_behalf_of":"u/test-user-2"}},"files":{{"f":"a{}u0000"}}}}"#,
+        "\\"
+    ))
+    .execute(&db)
+    .await?;
+    sqlx::query(
+        "INSERT INTO schedule (workspace_id, path, edited_by, schedule, script_path, email, permissioned_as, enabled)
+         VALUES ('test-workspace', 'u/test-user/stranger', 'test-user', '0 0 * * * *', 'u/test-user/s', 'test2@windmill.dev', 'u/test-user-2', false)",
+    )
+    .execute(&db)
+    .await?;
+    sqlx::query(
+        "INSERT INTO websocket_trigger (workspace_id, path, url, script_path, is_flow, edited_by, permissioned_as, mode)
+         VALUES ('test-workspace', 'u/test-user/stranger', 'ws://localhost', 'u/test-user/s', false, 'test-user', 'u/test-user-2', 'disabled')",
+    )
+    .execute(&db)
+    .await?;
+
+    let resp = reqwest::Client::new()
+        .post(format!(
+            "{base_url}/w/test-workspace/workspaces/create_fork"
+        ))
+        .header("Authorization", "Bearer SECRET_TOKEN")
+        .json(&json!({ "id": "wm-fork-repoint", "name": "Fork", "color": "#0000ff" }))
+        .send()
+        .await?;
+    assert!(
+        resp.status().is_success(),
+        "creating the fork: {}",
+        resp.text().await?
+    );
+
+    let text = |sql: &'static str| sqlx::query_scalar::<_, String>(sql).fetch_one(&db);
+    assert_eq!(
+        text("SELECT (policy->>'on_behalf_of') || ' ' || (policy->>'on_behalf_of_email') FROM app WHERE workspace_id = 'wm-fork-repoint' AND path = 'u/test-user/stranger'").await?,
+        "u/test-user test@windmill.dev"
+    );
+    assert_eq!(
+        text("SELECT policy->>'on_behalf_of' FROM app WHERE workspace_id = 'wm-fork-repoint' AND path = 'u/test-user/group'").await?,
+        "g/all"
+    );
+    assert_eq!(
+        text("SELECT value->'policy'->>'on_behalf_of' FROM draft WHERE workspace_id = 'wm-fork-repoint' AND path = 'u/test-user/stranger' AND typ = 'raw_app'").await?,
+        "u/test-user"
+    );
+    assert_eq!(
+        text("SELECT CASE WHEN strpos(value::text, 'u/test-user-2') > 0 THEN 'kept' ELSE 'rewritten' END FROM draft WHERE workspace_id = 'wm-fork-repoint' AND path = 'u/test-user/nul'").await?,
+        "kept"
+    );
+    assert_eq!(
+        text("SELECT value->>'permissioned_as' FROM draft WHERE workspace_id = 'wm-fork-repoint' AND typ = 'trigger_websocket'").await?,
+        "u/test-user"
+    );
+    assert_eq!(
+        text("SELECT permissioned_as || ' ' || email FROM schedule WHERE workspace_id = 'wm-fork-repoint'").await?,
+        "u/test-user test@windmill.dev"
+    );
+    assert_eq!(
+        text(
+            "SELECT permissioned_as FROM websocket_trigger WHERE workspace_id = 'wm-fork-repoint'"
+        )
+        .await?,
+        "u/test-user"
+    );
+
+    Ok(())
+}
@@ -0,0 +1,75 @@
+use serde_json::json;
+use sqlx::{Pool, Postgres};
+
+use windmill_test_utils::*;
+
+/// With `add_admins_and_developers_to_forks` on, a fork starts with the parent's admins and
+/// developers at their parent role, even when a developer forks it; operators are left out. The
+/// copies are manual members: a parent membership that came from an instance group must not carry
+/// that provenance into a fork that does not configure the group.
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn test_fork_adds_parent_admins_and_developers(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let base_url = format!(
+        "http://localhost:{}/api/w/test-workspace/workspaces",
+        server.addr.port()
+    );
+    let client = reqwest::Client::new();
+
+    sqlx::query(
+        "UPDATE usr SET operator = true WHERE workspace_id = 'test-workspace' AND username = 'test-user-3'",
+    )
+    .execute(&db)
+    .await?;
+    sqlx::query(
+        "INSERT INTO usr (workspace_id, email, username, is_admin, added_via)
+         VALUES ('test-workspace', 'test4@windmill.dev', 'test-user-4', false,
+                 '{\"source\": \"instance_group\", \"group\": \"devs\"}')",
+    )
+    .execute(&db)
+    .await?;
+
+    let resp = client
+        .post(format!(
+            "{base_url}/edit_add_admins_and_developers_to_forks"
+        ))
+        .header("Authorization", "Bearer SECRET_TOKEN")
+        .json(&json!({ "add_admins_and_developers_to_forks": true }))
+        .send()
+        .await?;
+    assert!(
+        resp.status().is_success(),
+        "enabling the setting: {}",
+        resp.text().await?
+    );
+
+    let resp = client
+        .post(format!("{base_url}/create_fork"))
+        .header("Authorization", "Bearer SECRET_TOKEN_2")
+        .json(&json!({ "id": "wm-fork-team", "name": "Team fork" }))
+        .send()
+        .await?;
+    assert!(
+        resp.status().is_success(),
+        "creating the fork: {}",
+        resp.text().await?
+    );
+
+    let members: Vec<(String, bool, bool)> = sqlx::query_as(
+        "SELECT username, is_admin, added_via IS NULL FROM usr
+         WHERE workspace_id = 'wm-fork-team' ORDER BY username",
+    )
+    .fetch_all(&db)
+    .await?;
+    assert_eq!(
+        members,
+        vec![
+            ("test-user".to_string(), true, true),
+            ("test-user-2".to_string(), false, true),
+            ("test-user-4".to_string(), false, true),
+        ]
+    );
+
+    Ok(())
+}
@@ -115,6 +115,60 @@ async fn login_link_is_single_use_and_same_origin(db: Pool<Postgres>) -> anyhow:
    Ok(())
 }

+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn confirmed_login_link_is_spent_by_the_click_not_the_page(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let base = format!("http://localhost:{port}/api");
+
+    let resp = client()
+        .post(format!("{base}/users/login_links"))
+        .header("Authorization", "Bearer SECRET_TOKEN")
+        .json(&json!({"email": "test2@windmill.dev", "confirm": true}))
+        .send()
+        .await?;
+    assert_eq!(resp.status(), 201);
+    let link = resp.json::<serde_json::Value>().await?;
+    // The URL handed out is the frontend page, not the API path that signs in on a GET.
+    let token = link["url"]
+        .as_str()
+        .unwrap()
+        .split_once("/user/login_link?token=")
+        .expect("confirmation page url")
+        .1
+        .to_string();
+
+    let confirm = || {
+        client()
+            .post(format!("{base}/auth/login_link/{token}"))
+            .send()
+    };
+    let resp = confirm().await?;
+    assert_eq!(resp.status(), 200);
+    assert!(resp
+        .headers()
+        .get_all("set-cookie")
+        .iter()
+        .any(|c| c.to_str().unwrap().starts_with("token=")));
+    assert_eq!(
+        resp.json::<serde_json::Value>().await?["location"],
+        "/user/workspaces"
+    );
+
+    let resp = confirm().await?;
+    assert_eq!(resp.status(), 200);
+    assert!(resp.headers().get("set-cookie").is_none());
+    assert_eq!(
+        resp.json::<serde_json::Value>().await?["location"],
+        "/user/login_link_expired?reason=used"
+    );
+
+    Ok(())
+}
+
 #[sqlx::test(migrations = "../migrations", fixtures("base"))]
 async fn login_link_mint_can_require_a_login_type(db: Pool<Postgres>) -> anyhow::Result<()> {
    initialize_tracing().await;
@@ -0,0 +1,239 @@
+//! `max_token_expiration_days`: the instance-wide ceiling on how far ahead a token a caller
+//! picks the lifetime of may expire, and the service-account exemption.
+
+use serde_json::json;
+use sqlx::types::chrono::{DateTime, Utc};
+use sqlx::{Pool, Postgres};
+use windmill_test_utils::*;
+
+const DAY: u64 = 24 * 60 * 60;
+
+fn client() -> reqwest::Client {
+    reqwest::Client::new()
+}
+
+fn from_now(secs: u64) -> DateTime<Utc> {
+    Utc::now() + std::time::Duration::from_secs(secs)
+}
+
+async fn set_max(db: &Pool<Postgres>, value: serde_json::Value) {
+    sqlx::query(
+        "INSERT INTO global_settings (name, value) VALUES ('max_token_expiration_days', $1)
+         ON CONFLICT (name) DO UPDATE SET value = EXCLUDED.value",
+    )
+    .bind(value)
+    .execute(db)
+    .await
+    .unwrap();
+}
+
+/// Mints as `test2@windmill.dev`, a plain member of `test-workspace`.
+async fn create_token(port: u16, body: serde_json::Value) -> reqwest::Response {
+    client()
+        .post(format!("http://localhost:{port}/api/users/tokens/create"))
+        .header("Authorization", "Bearer SECRET_TOKEN_2")
+        .json(&body)
+        .send()
+        .await
+        .unwrap()
+}
+
+async fn stored_expiration(db: &Pool<Postgres>, label: &str) -> Option<DateTime<Utc>> {
+    sqlx::query_scalar::<_, Option<DateTime<Utc>>>("SELECT expiration FROM token WHERE label = $1")
+        .bind(label)
+        .fetch_one(db)
+        .await
+        .unwrap()
+}
+
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn test_max_token_expiration_days_shortens_user_tokens(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    let resp = create_token(port, json!({ "label": "unset" })).await;
+    assert_eq!(resp.status(), 201);
+    assert_eq!(
+        stored_expiration(&db, "unset").await,
+        None,
+        "with no setting a token may still have no expiration"
+    );
+
+    // Refused at write time: the token routes can only read a value they cannot parse as no
+    // ceiling at all.
+    let resp = client()
+        .post(format!(
+            "http://localhost:{port}/api/settings/global/max_token_expiration_days"
+        ))
+        .header("Authorization", "Bearer SECRET_TOKEN")
+        .json(&json!({ "value": 7.5 }))
+        .send()
+        .await?;
+    assert_eq!(resp.status(), 400);
+
+    set_max(&db, json!(7)).await;
+
+    // The token form reads the ceiling as whoever is creating the token, usually not a
+    // superadmin, so it can offer only expirations the server would keep.
+    let resp = client()
+        .get(format!(
+            "http://localhost:{port}/api/settings/global/max_token_expiration_days"
+        ))
+        .header("Authorization", "Bearer SECRET_TOKEN_2")
+        .send()
+        .await?;
+    assert_eq!(resp.status(), 200);
+    assert_eq!(resp.text().await?, "7");
+
+    let resp = create_token(port, json!({ "label": "none asked" })).await;
+    assert_eq!(resp.status(), 201);
+    let expiration = stored_expiration(&db, "none asked")
+        .await
+        .expect("a token asking for no expiration gets the ceiling");
+    assert!(
+        expiration > from_now(6 * DAY) && expiration <= from_now(7 * DAY),
+        "expected the 7 day ceiling, got {expiration}"
+    );
+
+    let resp = create_token(
+        port,
+        json!({ "label": "past the ceiling", "expiration": from_now(30 * DAY) }),
+    )
+    .await;
+    assert_eq!(resp.status(), 201);
+    let expiration = stored_expiration(&db, "past the ceiling").await.unwrap();
+    assert!(
+        expiration > from_now(6 * DAY) && expiration <= from_now(7 * DAY),
+        "expected an expiration past the ceiling to be shortened to it, got {expiration}"
+    );
+
+    let resp = create_token(
+        port,
+        json!({ "label": "within", "expiration": from_now(3 * DAY) }),
+    )
+    .await;
+    assert_eq!(resp.status(), 201);
+    let expiration = stored_expiration(&db, "within").await.unwrap();
+    assert!(
+        expiration <= from_now(3 * DAY),
+        "an expiration within the ceiling must be kept, got {expiration}"
+    );
+
+    // The settings UI stores an integer, but the YAML instance config and config sync can write
+    // the same whole number as a string or as `5.0`. Reading either as "unset" would silently
+    // drop the ceiling, while the token form (`parseMaxTokenExpirationDays`) still showed it.
+    for (stored, label) in [
+        (json!("5"), "string setting"),
+        (json!(5.0), "float setting"),
+    ] {
+        set_max(&db, stored).await;
+        let resp = create_token(port, json!({ "label": label })).await;
+        assert_eq!(resp.status(), 201);
+        let expiration = stored_expiration(&db, label).await;
+        assert!(
+            expiration.is_some_and(|e| e > from_now(4 * DAY) && e <= from_now(5 * DAY)),
+            "{label}: expected the 5 day ceiling, got {expiration:?}"
+        );
+    }
+
+    // A superadmin impersonating a user picks the lifetime too, so the ceiling applies there;
+    // left out, it would be the one way to mint a token that never expires.
+    let resp = client()
+        .post(format!(
+            "http://localhost:{port}/api/users/tokens/impersonate"
+        ))
+        .header("Authorization", "Bearer SECRET_TOKEN")
+        .json(&json!({ "label": "impersonated", "impersonate_email": "test3@windmill.dev" }))
+        .send()
+        .await?;
+    assert_eq!(resp.status(), 201);
+    assert!(
+        stored_expiration(&db, "impersonated").await.is_some(),
+        "an impersonation token asking for no expiration gets the ceiling"
+    );
+
+    Ok(())
+}
+
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn test_service_accounts_are_exempt(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    set_max(&db, json!(7)).await;
+    // The same email is a service account in one workspace and an ordinary user in another.
+    sqlx::query(
+        "UPDATE usr SET is_service_account = true
+         WHERE email = 'test2@windmill.dev' AND workspace_id = 'test-workspace'",
+    )
+    .execute(&db)
+    .await?;
+    sqlx::query("INSERT INTO workspace (id, name, owner) VALUES ('other', 'other', 'test-user')")
+        .execute(&db)
+        .await?;
+    sqlx::query("INSERT INTO workspace_settings (workspace_id) VALUES ('other')")
+        .execute(&db)
+        .await?;
+    sqlx::query(
+        "INSERT INTO usr (workspace_id, email, username, is_admin, role)
+         VALUES ('other', 'test2@windmill.dev', 'test-user-2', false, 'User')",
+    )
+    .execute(&db)
+    .await?;
+
+    // The token form decides the exemption from this list, so it must carry each membership's flag.
+    let memberships: serde_json::Value = client()
+        .get(format!("http://localhost:{port}/api/workspaces/users"))
+        .header("Authorization", "Bearer SECRET_TOKEN_2")
+        .send()
+        .await?
+        .json()
+        .await?;
+    for (workspace, is_service_account) in [("test-workspace", true), ("other", false)] {
+        let membership = memberships["workspaces"]
+            .as_array()
+            .and_then(|ws| ws.iter().find(|w| w["id"] == workspace))
+            .unwrap_or_else(|| panic!("{workspace} missing from {memberships}"));
+        assert_eq!(membership["is_service_account"], json!(is_service_account));
+    }
+
+    for (label, workspace_id, exempt) in [
+        ("own workspace", Some("test-workspace"), true),
+        ("other workspace", Some("other"), false),
+        // A workspace-less token has no workspace to match, so a service account anywhere counts.
+        ("global", None, true),
+    ] {
+        let resp = create_token(
+            port,
+            json!({ "label": label, "workspace_id": workspace_id }),
+        )
+        .await;
+        assert_eq!(resp.status(), 201);
+        assert_eq!(
+            stored_expiration(&db, label).await.is_none(),
+            exempt,
+            "{label}: expected exempt = {exempt}"
+        );
+    }
+
+    // Impersonation checks the impersonated account, not the superadmin minting the token.
+    let resp = client()
+        .post(format!(
+            "http://localhost:{port}/api/users/tokens/impersonate"
+        ))
+        .header("Authorization", "Bearer SECRET_TOKEN")
+        .json(&json!({ "label": "impersonated service account", "impersonate_email": "test2@windmill.dev" }))
+        .send()
+        .await?;
+    assert_eq!(resp.status(), 201);
+    assert_eq!(
+        stored_expiration(&db, "impersonated service account").await,
+        None
+    );
+
+    Ok(())
+}
@@ -0,0 +1,102 @@
+//! The `mcp_disable_token_query_param` switch closes the URL-borne credential path.
+//!
+//! The rejection is a middleware layered between the `WWW-Authenticate` decorator and
+//! everything that reads a token, on both the workspaced and the gateway mount. Each half of
+//! that sandwich is pinned: the `WWW-Authenticate` header on the refusal catches the layer
+//! being moved outward (a client would lose the pointer that starts OAuth discovery), and
+//! refusing a token that was never valid catches it being moved inward past authentication
+//! (the URL-borne token would be hashed and looked up before anything refused it).
+#![cfg(feature = "mcp")]
+
+use std::sync::atomic::Ordering;
+
+use serde_json::json;
+use sqlx::{Pool, Postgres};
+
+use windmill_common::global_settings::MCP_DISABLE_TOKEN_QUERY_PARAM;
+use windmill_test_utils::*;
+
+/// Workspace-less with an `mcp:` scope, which is what the gateway mount requires; the
+/// workspaced mount takes its workspace from the path, so one token reaches both.
+async fn insert_mcp_token(db: &Pool<Postgres>) -> anyhow::Result<()> {
+    sqlx::query(
+        "INSERT INTO token (token_hash, token_prefix, token, email, label, super_admin, scopes)
+         VALUES (encode(sha256('MCP_TOKEN'::bytea), 'hex'), 'MCP_TOK', 'MCP_TOKEN', 'test@windmill.dev', 'mcp token', true, ARRAY['mcp:all'])",
+    )
+    .execute(db)
+    .await?;
+    Ok(())
+}
+
+/// A token that is not in `token` at all. Authentication would refuse it on its own, so a
+/// refusal carrying the middleware's own wording is evidence nothing looked it up first.
+const BOGUS_TOKEN: &str = "NOT_A_REAL_TOKEN";
+
+async fn tools_list(url: &str) -> anyhow::Result<reqwest::Response> {
+    Ok(reqwest::Client::new()
+        .post(url)
+        .header("Accept", "application/json, text/event-stream")
+        .json(&json!({ "jsonrpc": "2.0", "id": 1, "method": "tools/list", "params": {} }))
+        .send()
+        .await?)
+}
+
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn test_mcp_token_query_param_switch(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    set_jwt_secret().await;
+    insert_mcp_token(&db).await?;
+    let server = ApiServer::start_mcp(db.clone()).await?;
+    let port = server.addr.port();
+    let workspaced =
+        format!("http://localhost:{port}/api/mcp/w/test-workspace/mcp?token=MCP_TOKEN");
+    let gateway = format!("http://localhost:{port}/api/mcp/gateway?token=MCP_TOKEN");
+
+    assert_eq!(
+        tools_list(&workspaced).await?.status(),
+        200,
+        "a URL-borne token is the documented default and must keep working while the switch is off"
+    );
+    assert_eq!(tools_list(&gateway).await?.status(), 200);
+
+    MCP_DISABLE_TOKEN_QUERY_PARAM.store(true, Ordering::Relaxed);
+
+    for url in [&workspaced, &gateway] {
+        let resp = tools_list(url).await?;
+        assert_eq!(
+            resp.status(),
+            401,
+            "{url} still admitted a token in the URL"
+        );
+        // What sends the client into the OAuth flow rather than leaving it stuck on a 401.
+        assert!(
+            resp.headers().contains_key("www-authenticate"),
+            "{url} rejected without pointing at the authorization server"
+        );
+    }
+
+    // Refused before authentication, not after: an invalid token gets the middleware's own
+    // message rather than the generic 401 that looking it up would produce.
+    let resp = tools_list(&format!(
+        "http://localhost:{port}/api/mcp/w/test-workspace/mcp?token={BOGUS_TOKEN}"
+    ))
+    .await?;
+    assert_eq!(resp.status(), 401);
+    assert!(
+        resp.text().await?.contains("does not accept a token in the MCP URL"),
+        "an invalid URL token was answered by authentication, so the token was read before \
+         the switch refused it"
+    );
+
+    // The header stays open: it is the channel the OAuth flow itself hands tokens over on.
+    let resp = reqwest::Client::new()
+        .post(format!("http://localhost:{port}/api/mcp/gateway"))
+        .header("Accept", "application/json, text/event-stream")
+        .header("Authorization", "Bearer MCP_TOKEN")
+        .json(&json!({ "jsonrpc": "2.0", "id": 1, "method": "tools/list", "params": {} }))
+        .send()
+        .await?;
+    assert_eq!(resp.status(), 200);
+
+    Ok(())
+}
@@ -0,0 +1,49 @@
+//! Which user tokens get an "expiring soon" warning queued when they are created.
+
+use serde_json::json;
+use sqlx::types::chrono::Utc;
+use sqlx::{Pool, Postgres};
+use windmill_test_utils::*;
+
+const DAY: u64 = 24 * 60 * 60;
+
+async fn warning_queued(db: &Pool<Postgres>, label: &str) -> bool {
+    sqlx::query_scalar::<_, bool>(
+        "SELECT EXISTS(SELECT 1 FROM token_expiry_notification n
+            JOIN token t ON t.token_hash = n.token_hash WHERE t.label = $1)",
+    )
+    .bind(label)
+    .fetch_one(db)
+    .await
+    .unwrap()
+}
+
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn test_short_lived_tokens_get_no_expiry_warning(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    for (label, lifetime) in [("short", DAY), ("long", 30 * DAY)] {
+        let resp = reqwest::Client::new()
+            .post(format!("http://localhost:{port}/api/users/tokens/create"))
+            .header("Authorization", "Bearer SECRET_TOKEN_2")
+            .json(&json!({
+                "label": label,
+                "expiration": Utc::now() + std::time::Duration::from_secs(lifetime),
+            }))
+            .send()
+            .await?;
+        assert_eq!(resp.status(), 201);
+    }
+
+    assert!(
+        !warning_queued(&db, "short").await,
+        "a token whose whole lifetime fits in the warning window must not be warned about"
+    );
+    assert!(
+        warning_queued(&db, "long").await,
+        "a longer-lived token still gets its warning"
+    );
+    Ok(())
+}
@@ -275,6 +275,67 @@ async fn test_encryption_key_rotation_dispatches_batched_git_sync(
    Ok(())
 }

+/// Stored repository tokens and webhook secrets are encrypted under the
+/// workspace key but never synced, so a rotation has to carry them over even
+/// when the caller skips re-encrypting variables.
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn test_encryption_key_rotation_reencrypts_git_sync_secrets(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    use windmill_common::variables::{build_crypt, crypt_from_key_with_suffix, decrypt, encrypt};
+    initialize_tracing().await;
+
+    create_folder(&db, "28103").await?;
+    create_git_repo_resource(&db).await?;
+    let sync_script_path = "f/28103/test_sync_script_git_secrets";
+    create_sync_script(&db, sync_script_path).await?;
+    setup_git_sync_config(&db, sync_script_path).await?;
+
+    let mc = build_crypt(&db, "test-workspace").await?;
+    sqlx::query(
+        r#"
+        UPDATE workspace_settings SET
+            git_credentials = jsonb_build_array(jsonb_build_object(
+                'token', $1::text, 'repo_identity', 'https://gitlab.example.com/grp/proj')),
+            git_sync = jsonb_set(git_sync, '{repositories,0,auto_pull}', jsonb_build_object(
+                'enabled', true, 'mode', 'webhook', 'webhook_id', 1, 'webhook_secret', $2::text))
+        WHERE workspace_id = 'test-workspace'
+        "#,
+    )
+    .bind(encrypt(&mc, "stored-token"))
+    .bind(encrypt(&mc, "hook-secret"))
+    .execute(&db)
+    .await?;
+
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let base = format!("http://localhost:{port}/api/w/test-workspace/workspaces");
+
+    let new_key = "c".repeat(64);
+    let resp = authed(client().post(format!("{base}/encryption_key")))
+        .json(&json!({"new_key": new_key, "skip_reencrypt": true}))
+        .send()
+        .await?;
+    assert_eq!(
+        resp.status(),
+        200,
+        "set_encryption_key failed: {}",
+        resp.text().await?
+    );
+
+    let (token, secret): (String, String) = sqlx::query_as(
+        "SELECT git_credentials->0->>'token', git_sync#>>'{repositories,0,auto_pull,webhook_secret}'
+         FROM workspace_settings WHERE workspace_id = 'test-workspace'",
+    )
+    .fetch_one(&db)
+    .await?;
+    let new_mc = crypt_from_key_with_suffix(&new_key, "");
+    assert_eq!(decrypt(&new_mc, token)?, "stored-token");
+    assert_eq!(decrypt(&new_mc, secret)?, "hook-secret");
+
+    Ok(())
+}
+
 /// Regression test for the non-debouncing fallback: a workspace whose sync
 /// script predates hub version 28103 must still receive git-sync jobs for the
 /// encryption_key entry and every re-encrypted secret. Before the fallback was
@@ -1166,3 +1166,47 @@ async fn test_create_service_account_drops_orphaned_group_memberships(

    Ok(())
 }
+
+#[cfg(feature = "private")]
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn test_edit_auto_invite_preserves_instance_groups(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+
+    sqlx::query(
+        r#"UPDATE workspace_settings
+           SET auto_invite = '{"instance_groups": ["eng"], "instance_groups_roles": {"eng": "developer"}}'
+           WHERE workspace_id = 'test-workspace'"#,
+    )
+    .execute(&db)
+    .await?;
+
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let base = format!("http://localhost:{port}/api/w/test-workspace/workspaces");
+
+    // enable, then disable
+    for body in [
+        json!({"operator": false, "invite_all": true, "auto_add": false}),
+        json!({}),
+    ] {
+        let resp = authed(client().post(format!("{base}/edit_auto_invite")))
+            .json(&body)
+            .send()
+            .await?;
+        assert_eq!(resp.status(), 200, "{body}: {}", resp.text().await?);
+
+        let auto_invite: serde_json::Value = sqlx::query_scalar(
+            "SELECT auto_invite FROM workspace_settings WHERE workspace_id = 'test-workspace'",
+        )
+        .fetch_one(&db)
+        .await?;
+        assert_eq!(auto_invite["instance_groups"], json!(["eng"]), "{body}");
+        assert_eq!(
+            auto_invite["instance_groups_roles"],
+            json!({"eng": "developer"}),
+            "{body}"
+        );
+    }
+
+    Ok(())
+}
@@ -64,6 +64,7 @@ use windmill_common::{
        GITHUB_APP_WEBHOOK_BASE_URL_SETTING, HTTP_ROUTE_DEFAULT_ALLOWED_ORIGINS_SETTING,
        HTTP_ROUTE_WORKSPACED_ROUTE_SETTING, HUB_ACCESSIBLE_URL_SETTING, HUB_BASE_URL_SETTING,
        INSTANCE_BANNER_SETTING, MAX_RETENTION_OVERRIDE_WORKSPACES,
+        MAX_TOKEN_EXPIRATION_DAYS_SETTING, MCP_DISABLE_TOKEN_QUERY_PARAM_SETTING,
        RETENTION_PERIOD_SECS_OVERRIDES_SETTING, RUFF_CONFIG_SETTING, UNIQUE_ID_SETTING,
        WORKSPACE_FAIRNESS_DURATION_SECS_SETTING, WORKSPACE_FAIRNESS_ENABLED_SETTING,
        WORKSPACE_FAIRNESS_MAX_PERCENT_SETTING, WORKSPACE_FAIRNESS_MIN_TOTAL_SETTING,
@@ -1195,6 +1196,12 @@ async fn run_setting_pre_write_hook(
                }
            }
        }
+        MAX_TOKEN_EXPIRATION_DAYS_SETTING => {
+            windmill_common::global_settings::parse_max_token_expiration_days(Some(value))
+                .map_err(|e| {
+                    error::Error::BadRequest(format!("{MAX_TOKEN_EXPIRATION_DAYS_SETTING}: {e}"))
+                })?;
+        }
        INSTANCE_BANNER_SETTING => {
            match value {
                // Clearing (delete row) is handled by the caller; allow it through.
@@ -1356,6 +1363,12 @@ pub async fn get_global_setting(
        && key != HTTP_ROUTE_DEFAULT_ALLOWED_ORIGINS_SETTING
        && key != WS_BASE_URL_SETTING
        && key != INSTANCE_BANNER_SETTING
+        // The token form reads it to stop offering expirations the server would shorten.
+        && key != MAX_TOKEN_EXPIRATION_DAYS_SETTING
+        // Whoever is wiring up an MCP client reads it to know whether a URL-borne token
+        // would be refused, and they are usually not a superadmin. Not a secret: pointing
+        // any MCP client at the instance discovers the same answer.
+        && key != MCP_DISABLE_TOKEN_QUERY_PARAM_SETTING
    {
        require_super_admin(&db, &authed).await?;
    }
@@ -47,7 +47,10 @@ use windmill_audit::audit_oss::audit_log;
 use windmill_audit::ActionKind;
 use windmill_common::audit::AuditAuthor;
 use windmill_common::auth::{hash_token, safe_token_prefix, TOKEN_PREFIX_LEN};
-use windmill_common::global_settings::AUTOMATE_USERNAME_CREATION_SETTING;
+use windmill_common::global_settings::{
+    load_value_from_global_settings, parse_max_token_expiration_days,
+    AUTOMATE_USERNAME_CREATION_SETTING, MAX_TOKEN_EXPIRATION_DAYS_SETTING,
+};
 use windmill_common::oauth2::InstanceEvent;
 use windmill_common::per_minute_counter::PerMinuteCounter;
 use windmill_common::users::truncate_token;
@@ -168,7 +171,10 @@ pub fn make_unauthed_service() -> Router {
        .route("/logout", post(logout).get(logout))
        .route("/is_first_time_setup", get(is_first_time_setup))
        .route("/request_password_reset", post(request_password_reset))
-        .route("/login_link/{token}", get(consume_login_link))
+        .route(
+            "/login_link/{token}",
+            get(consume_login_link).post(confirm_login_link),
+        )
        .route("/is_smtp_configured", get(is_smtp_configured))
        .route(
            "/is_password_login_disabled",
@@ -3092,11 +3098,68 @@ pub async fn create_guest_session_token<'c>(

 // create_token_internal is re-exported from windmill-api-auth above

+/// Applies the instance-wide ceiling on how long a token a caller picks the lifetime of may
+/// live (`create_token`, and `impersonate` for superadmins), returning the expiration to store:
+/// the requested one while it fits, the ceiling otherwise, and the ceiling as well when none was
+/// requested. Only the stored expiration is capped: tokens already stored when the setting is
+/// turned on or lowered keep theirs, since the auth lookup never reads the setting.
+///
+/// It shortens rather than refuses because most callers do not comply on their own. The CLI
+/// authorization page, `wmill user create-token` and the editor's language-server token each
+/// pick a lifetime, often none at all, without reading the setting (and CLIs already installed
+/// never will), so refusing would break logging in and the editor instead of the long-lived
+/// tokens the setting is aimed at.
+///
+/// Read from `global_settings` on each call rather than cached: token creation is rare
+/// enough that the round trip costs nothing, and the ceiling is then never served stale.
+///
+/// A token owned by a service account is exempt: in the workspace the token names, or in any
+/// workspace for a workspace-less token, which has none to match. Service accounts are the
+/// identity automation that needs a long-lived credential runs as. The cost is that any
+/// workspace admin can create and impersonate one to hold an uncapped token, so the ceiling
+/// bounds personal tokens rather than what an admin can obtain.
+async fn cap_token_expiration(
+    db: &DB,
+    owner_email: &str,
+    workspace_id: Option<&str>,
+    requested: Option<chrono::DateTime<chrono::Utc>>,
+) -> Result<Option<chrono::DateTime<chrono::Utc>>> {
+    let value = load_value_from_global_settings(db, MAX_TOKEN_EXPIRATION_DAYS_SETTING).await?;
+    let max_days = match parse_max_token_expiration_days(value.as_ref()) {
+        Ok(Some(max_days)) => max_days,
+        Ok(None) => return Ok(requested),
+        // Both write paths reject this, so only a row written around them gets here.
+        Err(e) => {
+            tracing::warn!("ignoring {MAX_TOKEN_EXPIRATION_DAYS_SETTING}: {e}");
+            return Ok(requested);
+        }
+    };
+    let max = chrono::Utc::now() + chrono::Duration::days(max_days);
+
+    let is_service_account = sqlx::query_scalar!(
+        "SELECT EXISTS(SELECT 1 FROM usr WHERE email = $1 AND is_service_account IS true
+            AND ($2::varchar IS NULL OR workspace_id = $2))",
+        owner_email,
+        workspace_id,
+    )
+    .fetch_one(db)
+    .await?
+    .unwrap_or(false);
+    if is_service_account {
+        return Ok(requested);
+    }
+
+    Ok(Some(match requested {
+        Some(expiration) if expiration < max => expiration,
+        _ => max,
+    }))
+}
+
 async fn create_token(
    Extension(db): Extension<DB>,
    authed: ApiAuthed,
    OptJobAuthed { job_id, .. }: OptJobAuthed,
-    Json(token_config): Json<NewToken>,
+    Json(mut token_config): Json<NewToken>,
 ) -> Result<(StatusCode, String)> {
    forbid_elevated_job_token(&db, &authed.email, job_id).await?;
    check_token_create_rate_limit(&authed.username)?;
@@ -3118,6 +3181,14 @@ async fn create_token(

    windmill_api_auth::ensure_scopes_within_caller(&authed, token_config.scopes.as_deref())?;

+    token_config.expiration = cap_token_expiration(
+        &db,
+        &authed.email,
+        token_config.workspace_id.as_deref(),
+        token_config.expiration,
+    )
+    .await?;
+
    let mut tx = db.begin().await?;

    let token = create_token_internal(&mut *tx, &db, &authed, token_config).await?;
@@ -3174,6 +3245,7 @@ async fn impersonate(
    .fetch_optional(&db)
    .await?
    .unwrap_or(false);
+    let expiration = cap_token_expiration(&db, &impersonated, None, new_token.expiration).await?;
    let mut tx = db.begin().await?;

    sqlx::query!(
@@ -3185,7 +3257,7 @@ async fn impersonate(
        plaintext as Option<&str>,
        impersonated,
        new_token.label,
-        new_token.expiration,
+        expiration,
        is_super_admin
    )
    .execute(&mut *tx)
@@ -3195,7 +3267,7 @@ async fn impersonate(
        &mut *tx,
        &t_hash,
        new_token.label.as_deref(),
-        new_token.expiration,
+        expiration,
    )
    .await;

@@ -3215,9 +3287,12 @@ async fn impersonate(
 }

 const LOGIN_LINK_DEFAULT_TTL_S: u32 = 600;
-const LOGIN_LINK_MAX_TTL_S: u32 = 900;
+// Long enough for a link sent by email to still work when it is read. `require_login_type` is
+// only checked at mint, so a much longer cap would need re-checking it when the link is opened.
+const LOGIN_LINK_MAX_TTL_S: u32 = 7200;
 const LOGIN_LINK_DEFAULT_RD: &str = "/user/workspaces";
 const LOGIN_LINK_EXPIRED_PAGE: &str = "/user/login_link_expired";
+const LOGIN_LINK_CONFIRM_PAGE: &str = "/user/login_link";

 #[derive(Deserialize)]
 pub struct NewLoginLink {
@@ -3228,6 +3303,9 @@ pub struct NewLoginLink {
    /// account it created can require `pending_oauth`, so the link stops working once the
    /// owner has set a password or signed in with a provider.
    pub require_login_type: Option<String>,
+    /// Hand out a page that signs in only when its button is clicked. Mail scanners open links
+    /// on delivery, and opening the plain link spends it, so a link sent by email sets this.
+    pub confirm: Option<bool>,
 }

 #[derive(Serialize)]
@@ -3378,11 +3456,12 @@ async fn create_login_link(
    .await?;
    tx.commit().await?;

-    let url = format!(
-        "{}/api/auth/login_link/{}",
-        (**BASE_URL.load()).clone(),
-        token
-    );
+    let base_url = (**BASE_URL.load()).clone();
+    let url = if nl.confirm.unwrap_or(false) {
+        format!("{base_url}{LOGIN_LINK_CONFIRM_PAGE}?token={token}")
+    } else {
+        format!("{base_url}/api/auth/login_link/{token}")
+    };
    Ok((StatusCode::CREATED, Json(LoginLink { url, expires_at })))
 }

@@ -3628,19 +3707,45 @@ async fn consume_login_link(
    Path(token): Path<String>,
    Query(query): Query<LoginLinkQuery>,
 ) -> Result<Response> {
-    let bounce = |reason: &str| {
-        Ok(login_link_redirect(format!(
-            "{LOGIN_LINK_EXPIRED_PAGE}?reason={reason}"
-        )))
-    };
+    let location = redeem_login_link(&headers, cookies, &db, &token, query.rd).await?;
+    Ok(login_link_redirect(location))
+}
+
+#[derive(Serialize)]
+struct LoginLinkLocation {
+    location: String,
+}
+
+/// The confirmation page's click. It answers with where to go rather than redirecting, and the
+/// page navigates there itself.
+async fn confirm_login_link(
+    headers: axum::http::HeaderMap,
+    cookies: Cookies,
+    Extension(db): Extension<DB>,
+    Path(token): Path<String>,
+) -> JsonResult<LoginLinkLocation> {
+    let location = redeem_login_link(&headers, cookies, &db, &token, None).await?;
+    Ok(Json(LoginLinkLocation { location }))
+}
+
+/// Spends the link and sets the session cookie, returning the post-login destination; or
+/// returns the explanation page, with no session, when the link cannot be used.
+async fn redeem_login_link(
+    headers: &axum::http::HeaderMap,
+    cookies: Cookies,
+    db: &DB,
+    token: &str,
+    requested_rd: Option<String>,
+) -> Result<String> {
+    let bounce = |reason: &str| Ok(format!("{LOGIN_LINK_EXPIRED_PAGE}?reason={reason}"));
    if token.len() != 32 {
        return bounce("invalid");
    }
-    let t_hash = hash_token(&token);
+    let t_hash = hash_token(token);
    // The account is unknown until the row is read, so only the global and per-IP tiers
    // apply here; a 32-char random token leaves nothing for the per-account tier to guard.
    windmill_common::login_rate_limit::check_and_increment_login_attempt(
-        &headers,
+        headers,
        &t_hash[..TOKEN_PREFIX_LEN],
    )?;

@@ -3707,11 +3812,10 @@ async fn consume_login_link(
    .await?;
    tx.commit().await?;

-    let rd = link
+    Ok(link
        .rd
-        .or_else(|| same_origin_rd(query.rd))
-        .unwrap_or_else(|| LOGIN_LINK_DEFAULT_RD.to_string());
-    Ok(login_link_redirect(rd))
+        .or_else(|| same_origin_rd(requested_rd))
+        .unwrap_or_else(|| LOGIN_LINK_DEFAULT_RD.to_string()))
 }

 #[derive(Deserialize)]
@@ -3945,6 +4049,7 @@ async fn update_token_label(
                 AND NOT starts_with(label, 'embed_app:')
                 AND NOT starts_with(label, 'sdk_app:')
                 AND NOT starts_with(label, 'impersonation:')
+                 AND NOT starts_with(label, 'cli-login:')
             ))
           RETURNING token_prefix",
        req.label.as_deref(),
@@ -38,7 +38,7 @@ use windmill_common::global_settings::HTTP_ROUTE_WORKSPACED_ROUTE;
 use windmill_common::query_builders::{render_db_quoted_identifier, DbType};
 use windmill_common::users::username_to_permissioned_as;
 use windmill_common::variables::{
-    build_crypt, decrypt, encrypt, SECRET_SALT, WORKSPACE_CRYPT_CACHE,
+    crypt_from_key_with_suffix, decrypt, encrypt, WORKSPACE_CRYPT_CACHE,
 };
 use windmill_common::worker::{to_raw_value, CLOUD_HOSTED};
 use windmill_common::workspaces::GitRepositorySettings;
@@ -155,6 +155,10 @@ pub fn workspaced_service() -> Router {
        .route("/edit_deploy_ui_config", post(edit_deploy_ui_config))
        .route("/edit_default_app", post(edit_default_app))
        .route("/edit_guest_access", post(edit_guest_access))
+        .route(
+            "/edit_add_admins_and_developers_to_forks",
+            post(edit_add_admins_and_developers_to_forks),
+        )
        .route("/edit_guest_jwt_key", post(edit_guest_jwt_key))
        .route("/guest_usage", get(get_guest_usage))
        .route("/default_app", get(get_default_app))
@@ -338,6 +342,7 @@ pub struct WorkspaceSettings {
    pub guest_jwt_public_key: Option<String>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub guest_jwt_jwks_url: Option<String>,
+    pub add_admins_and_developers_to_forks: bool,
 }

 /// Subset of `WorkspaceSettings` that is safe to return to any workspace
@@ -363,6 +368,8 @@ pub struct WorkspacePublicSettings {
    /// Not sensitive, and the app editor needs it to say whether the guest rung is
    /// live -- an app can be set to `guest` while the workspace has guests off.
    pub guest_access_enabled: bool,
+    /// Read by the fork dialog, which tells the forker who else the fork will include.
+    pub add_admins_and_developers_to_forks: bool,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub deploy_ui: Option<serde_json::Value>,
    #[serde(skip_serializing_if = "Option::is_none")]
@@ -555,6 +562,7 @@ struct UserWorkspace {
    /// screen off this.
    pub created_by: Option<String>,
    pub disabled: bool,
+    pub is_service_account: bool,
 }

 #[derive(Deserialize)]
@@ -1125,7 +1133,8 @@ async fn get_settings(
            error_handler_fallback_to_instance_alerts,
            guest_access_enabled,
            guest_jwt_public_key,
-            guest_jwt_jwks_url
+            guest_jwt_jwks_url,
+            add_admins_and_developers_to_forks
        FROM
            workspace_settings
        WHERE
@@ -1167,6 +1176,7 @@ async fn get_public_settings(
            teams_team_guid,
            mute_critical_alerts,
            guest_access_enabled,
+            add_admins_and_developers_to_forks,
            deploy_ui,
            large_file_storage,
            datatable
@@ -5051,6 +5061,47 @@ async fn edit_guest_access(
    ))
 }

+#[derive(Deserialize)]
+struct EditAddAdminsAndDevelopersToForks {
+    add_admins_and_developers_to_forks: bool,
+}
+
+async fn edit_add_admins_and_developers_to_forks(
+    authed: ApiAuthed,
+    Extension(db): Extension<DB>,
+    Path(w_id): Path<String>,
+    Json(EditAddAdminsAndDevelopersToForks { add_admins_and_developers_to_forks }): Json<
+        EditAddAdminsAndDevelopersToForks,
+    >,
+) -> Result<String> {
+    require_admin(authed.is_admin, &authed.username)?;
+
+    let mut tx = db.begin().await?;
+    sqlx::query!(
+        "UPDATE workspace_settings SET add_admins_and_developers_to_forks = $1 WHERE workspace_id = $2",
+        add_admins_and_developers_to_forks,
+        &w_id
+    )
+    .execute(&mut *tx)
+    .await?;
+
+    audit_log(
+        &mut *tx,
+        &authed,
+        "workspaces.edit_add_admins_and_developers_to_forks",
+        ActionKind::Update,
+        &w_id,
+        Some(&add_admins_and_developers_to_forks.to_string()),
+        None,
+    )
+    .await?;
+    tx.commit().await?;
+
+    Ok(format!(
+        "Adding admins and developers to new forks set to {add_admins_and_developers_to_forks} for workspace {w_id}"
+    ))
+}
+
 #[derive(Deserialize)]
 struct EditGuestJwtKey {
    /// A PEM public key (RS or ES family), or a JWKS URL, at most one. Both empty clears the
@@ -5639,9 +5690,6 @@ async fn set_encryption_key(
        ));
    }

-    // Build the previous cipher before the transaction (reads from cache/pool)
-    let previous_encryption_key = build_crypt(&db, w_id.as_str()).await?;
-
    let mut tx = db.begin().await?;

    // Under the row's lock, so two rotations racing serialize and each sees the key the
@@ -5675,17 +5723,14 @@ async fn set_encryption_key(
        None
    };

+    // From the keys read and written under the lock, never from `build_crypt`: its
+    // cache can still hold a key an earlier rotation replaced, and the git-sync
+    // secrets below are skipped rather than failed when they do not decrypt.
+    let previous_encryption_key = crypt_from_key_with_suffix(&previous_key, "");
+    let new_encryption_key = crypt_from_key_with_suffix(&request.new_key, "");
+
    let mut reencrypted_secret_paths: Vec<String> = Vec::new();
    if !request.skip_reencrypt.unwrap_or(false) {
-        // Build the new cipher directly from the key string, since the transaction
-        // hasn't committed yet and build_crypt() would read the old key from the pool.
-        let crypt_key = if let Some(ref salt) = SECRET_SALT.as_ref() {
-            format!("{}{}", request.new_key, salt)
-        } else {
-            request.new_key.clone()
-        };
-        let new_encryption_key = magic_crypt::new_magic_crypt!(crypt_key, 256);
-
        let mut truncated_new_key = request.new_key.clone();
        truncated_new_key.truncate(8);
        tracing::warn!(
@@ -5725,6 +5770,14 @@ async fn set_encryption_key(
        }
    }

+    reencrypt_git_sync_secrets(
+        &mut tx,
+        &w_id,
+        &previous_encryption_key,
+        &new_encryption_key,
+    )
+    .await?;
+
    tx.commit().await?;

    // Invalidate the cache only after the transaction has committed
@@ -5762,6 +5815,64 @@ async fn set_encryption_key(
    return Ok(());
 }

+/// Move the git-sync secrets the server keeps under the workspace key (stored
+/// repository tokens, webhook secrets) to the new key. They are never synced, so
+/// unlike variables they are still under the old key when the caller skips
+/// re-encryption.
+async fn reencrypt_git_sync_secrets(
+    conn: &mut sqlx::PgConnection,
+    w_id: &str,
+    old: &magic_crypt::MagicCrypt256,
+    new: &magic_crypt::MagicCrypt256,
+) -> Result<()> {
+    let Some((mut credentials, mut git_sync)) =
+        sqlx::query_as::<_, (serde_json::Value, Option<serde_json::Value>)>(
+            "SELECT git_credentials, git_sync FROM workspace_settings WHERE workspace_id = $1 FOR UPDATE",
+        )
+        .bind(w_id)
+        .fetch_optional(&mut *conn)
+        .await?
+    else {
+        return Ok(());
+    };
+    let reencrypt = |value: &mut serde_json::Value| {
+        let Some(ciphertext) = value.as_str() else {
+            return;
+        };
+        match decrypt(old, ciphertext.to_string()) {
+            Ok(plain) => *value = serde_json::Value::String(encrypt(new, &plain)),
+            // Left by an earlier rotation and unrecoverable either way; failing here
+            // would block every later rotation of the workspace.
+            Err(e) => tracing::warn!(
+                "a git-sync secret of workspace {w_id} does not decrypt under its current key, leaving it as is: {e}"
+            ),
+        }
+    };
+    for entry in credentials.as_array_mut().into_iter().flatten() {
+        if let Some(token) = entry.get_mut("token") {
+            reencrypt(token);
+        }
+    }
+    let repositories = git_sync
+        .as_mut()
+        .and_then(|g| g.get_mut("repositories"))
+        .and_then(|r| r.as_array_mut());
+    for repo in repositories.into_iter().flatten() {
+        if let Some(secret) = repo.pointer_mut("/auto_pull/webhook_secret") {
+            reencrypt(secret);
+        }
+    }
+    sqlx::query(
+        "UPDATE workspace_settings SET git_credentials = $2, git_sync = $3 WHERE workspace_id = $1",
+    )
+    .bind(w_id)
+    .bind(credentials)
+    .bind(git_sync)
+    .execute(&mut *conn)
+    .await?;
+    Ok(())
+}
+
 #[derive(Serialize)]
 struct UsedTriggers {
    pub websocket_used: bool,
@@ -5890,7 +6001,7 @@ async fn user_workspaces(
                workspace.is_dev_workspace, workspace.dev_workspace_label,
                workspace.owner AS \"created_by?\",
                CASE WHEN usr.operator THEN workspace_settings.operator_settings ELSE NULL END as operator_settings,
-                usr.disabled
+                usr.disabled, usr.is_service_account
         FROM workspace
         JOIN usr ON usr.workspace_id = workspace.id
         JOIN workspace_settings ON workspace_settings.workspace_id = workspace.id
@@ -6711,7 +6822,8 @@ async fn update_workspace_settings(
            ducklake = source_ws.ducklake,
            dbt_warehouses = source_ws.dbt_warehouses,
            datatable = source_ws.datatable,
-            git_app_installations = source_ws.git_app_installations
+            git_app_installations = source_ws.git_app_installations,
+            add_admins_and_developers_to_forks = source_ws.add_admins_and_developers_to_forks
        FROM workspace_settings source_ws
        WHERE source_ws.workspace_id = $1
        AND workspace_settings.workspace_id = $2
@@ -6852,14 +6964,21 @@ async fn copy_workspace_members(
    tx: &mut Transaction<'_, Postgres>,
    source_workspace_id: &str,
    target_workspace_id: &str,
+    admins_and_developers_only: bool,
 ) -> Result<()> {
+    // Admins and developers join as manual members: the fork does not inherit the source's
+    // instance-group config, so a copied `instance_group` provenance would let the fork's
+    // reconciliation delete them and their data.
    sqlx::query!(
        "INSERT INTO usr (workspace_id, username, email, is_admin, created_at, operator, disabled, role, is_service_account, added_via)
-         SELECT $1, username, email, is_admin, created_at, operator, disabled, role, is_service_account, added_via
+         SELECT $1, username, email, is_admin, created_at, operator, disabled, role, is_service_account,
+                CASE WHEN $3 THEN NULL ELSE added_via END
         FROM usr WHERE workspace_id = $2
+           AND (NOT $3 OR (NOT operator AND NOT disabled AND NOT is_service_account))
         ON CONFLICT DO NOTHING",
        target_workspace_id,
        source_workspace_id,
+        admins_and_developers_only,
    )
    .execute(&mut **tx)
    .await?;
@@ -7276,6 +7395,127 @@ async fn clear_orphaned_compat_address(
    Ok(())
 }

+/// SQL boolean: the principal the `principal` expression yields resolves in the workspace bound as
+/// `$1`. The same predicate `clone_scripts` and `clone_flows` inline, whose `query!` macros cannot
+/// take a composed string, so keep the three in step.
+fn principal_resolves_sql(principal: &str) -> String {
+    format!(
+        "CASE WHEN {principal} LIKE 'u/%' THEN EXISTS (
+                SELECT 1 FROM usr u WHERE u.workspace_id = $1
+                  AND u.username = substring({principal} from 3)
+                UNION ALL
+                SELECT 1 FROM password pw WHERE pw.super_admin
+                  AND (pw.username = substring({principal} from 3)
+                       OR pw.email = substring({principal} from 3)))
+              WHEN {principal} LIKE 'g/%' THEN EXISTS (
+                SELECT 1 FROM group_ g WHERE g.workspace_id = $1
+                  AND g.name = substring({principal} from 3))
+              ELSE EXISTS (
+                SELECT 1 FROM usr u WHERE u.workspace_id = $1 AND u.username = {principal}
+                UNION ALL
+                SELECT 1 FROM password pw WHERE pw.email = {principal} AND pw.super_admin)
+         END"
+    )
+}
+
+/// Re-point the identities a fork clones verbatim at its creator when they name nobody in the fork,
+/// once its membership is final so copied members keep theirs. Unlike scripts and flows these
+/// cannot drop the identity: an app deploy rejects a preserved one that does not resolve, and
+/// publisher apps, schedules and triggers need one to run.
+async fn repoint_unresolvable_cloned_identities(
+    tx: &mut Transaction<'_, Postgres>,
+    target_workspace_id: &str,
+    authed: &ApiAuthed,
+) -> Result<()> {
+    let principal = username_to_permissioned_as(&authed.username);
+
+    sqlx::query(&format!(
+        "UPDATE app SET policy = policy
+             || jsonb_build_object('on_behalf_of', $2::text, 'on_behalf_of_email', $3::text)
+         WHERE workspace_id = $1 AND policy->>'on_behalf_of' IS NOT NULL
+           AND NOT ({})",
+        principal_resolves_sql("(policy->>'on_behalf_of')")
+    ))
+    .bind(target_workspace_id)
+    .bind(&principal)
+    .bind(&authed.email)
+    .execute(&mut **tx)
+    .await?;
+
+    // A draft holding a genuine NUL escape (the rule of `json_text_has_nul_escape`) is left as it
+    // is, since parsing it would abort the fork. The check must stay in a CASE: json `->>` raises on
+    // a NUL anywhere in the value, and Postgres reorders plain AND conditions.
+    let nul_escape = r"(^|[^\\])(\\\\)*\\u0000";
+    sqlx::query(&format!(
+        "UPDATE draft SET value = to_json(jsonb_set(jsonb_set(to_jsonb(value),
+             ARRAY['policy', 'on_behalf_of'], to_jsonb($2::text)),
+             ARRAY['policy', 'on_behalf_of_email'], to_jsonb($3::text)))
+         WHERE workspace_id = $1 AND typ IN ('app', 'raw_app')
+           AND CASE WHEN value::text ~ $4 THEN false
+                    ELSE value->'policy'->>'on_behalf_of' IS NOT NULL AND NOT ({}) END",
+        principal_resolves_sql("(value->'policy'->>'on_behalf_of')")
+    ))
+    .bind(target_workspace_id)
+    .bind(&principal)
+    .bind(&authed.email)
+    .bind(nul_escape)
+    .execute(&mut **tx)
+    .await?;
+
+    sqlx::query(&format!(
+        "UPDATE draft SET value = to_json(jsonb_set(to_jsonb(value),
+             ARRAY['permissioned_as'], to_jsonb($2::text)))
+         WHERE workspace_id = $1 AND starts_with(typ::text, 'trigger_')
+           AND CASE WHEN value::text ~ $3 THEN false
+                    ELSE value->>'permissioned_as' IS NOT NULL AND NOT ({}) END",
+        principal_resolves_sql("(value->>'permissioned_as')")
+    ))
+    .bind(target_workspace_id)
+    .bind(&principal)
+    .bind(nul_escape)
+    .execute(&mut **tx)
+    .await?;
+
+    let column_resolves = principal_resolves_sql("permissioned_as");
+
+    // SAFETY: every table name is a literal from this list, never user input.
+    for table in [
+        "http_trigger",
+        "websocket_trigger",
+        "kafka_trigger",
+        "nats_trigger",
+        "postgres_trigger",
+        "mqtt_trigger",
+        "amqp_trigger",
+        "sqs_trigger",
+        "gcp_trigger",
+        "azure_trigger",
+        "email_trigger",
+    ] {
+        sqlx::query(&format!(
+            "UPDATE {table} SET permissioned_as = $2
+             WHERE workspace_id = $1 AND NOT ({column_resolves})"
+        ))
+        .bind(target_workspace_id)
+        .bind(&principal)
+        .execute(&mut **tx)
+        .await?;
+    }
+
+    // `email` is still written for workers that predate `permissioned_as`.
+    sqlx::query(&format!(
+        "UPDATE schedule SET permissioned_as = $2, email = $3
+         WHERE workspace_id = $1 AND NOT ({column_resolves})"
+    ))
+    .bind(target_workspace_id)
+    .bind(&principal)
+    .bind(&authed.email)
+    .execute(&mut **tx)
+    .await?;
+
+    Ok(())
+}
+
 /// Carries over the recorded principal under the rule spelled out on [`clone_scripts`].
 async fn clone_flows(
    tx: &mut Transaction<'_, Postgres>,
@@ -8529,8 +8769,19 @@ async fn create_workspace_fork(
    // intended. Dev creation is already admin-gated, so this is transitively admin-only too. Done before
    // the explicit creator insert below so the creator (a parent member) is copied with full metadata
    // (operator/role/is_service_account/added_via), not the bare row the insert alone would leave.
+    // Independently, the parent's admins can have every fork of it start with its admins and
+    // developers; the forker cannot opt out, since the point is that those admins can review it.
    if nw.copy_members && nw.is_dev_workspace {
-        copy_workspace_members(&mut tx, &parent_workspace_id, &forked_id).await?;
+        copy_workspace_members(&mut tx, &parent_workspace_id, &forked_id, false).await?;
+    } else if sqlx::query_scalar!(
+        "SELECT add_admins_and_developers_to_forks FROM workspace_settings WHERE workspace_id = $1",
+        parent_workspace_id
+    )
+    .fetch_optional(&mut *tx)
+    .await?
+    .unwrap_or(false)
+    {
+        copy_workspace_members(&mut tx, &parent_workspace_id, &forked_id, true).await?;
    }

    // Ensure the creator is a member of the fork even without copy_members (or if they aren't a parent
@@ -8592,6 +8843,8 @@ async fn create_workspace_fork(
    // re-enables in the fork, with parent-conflict warnings on enable.
    clone_triggers_and_schedules(&mut tx, &parent_workspace_id, &forked_id).await?;

+    repoint_unresolvable_cloned_identities(&mut tx, &forked_id, &authed).await?;
+
    // Update forked datatable settings to point to new databases
    for fdt in &nw.forked_datatables {
        apply_forked_datatable(&db, &mut tx, &authed, &parent_workspace_id, &forked_id, fdt)
@@ -113,7 +113,7 @@ pub(crate) async fn change_workspace_id(
    // Duplicate workspace settings (keep copy in old workspace for reference)
    info!("Duplicating workspace_settings table");
    sqlx::query!(
-        "INSERT INTO workspace_settings (workspace_id, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, git_credentials, ducklake, dbt_warehouses, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts, guest_access_enabled, guest_jwt_public_key, guest_jwt_jwks_url) SELECT $1, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, git_credentials, ducklake, dbt_warehouses, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts, guest_access_enabled, guest_jwt_public_key, guest_jwt_jwks_url FROM workspace_settings WHERE workspace_id = $2",
+        "INSERT INTO workspace_settings (workspace_id, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, git_credentials, ducklake, dbt_warehouses, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts, guest_access_enabled, guest_jwt_public_key, guest_jwt_jwks_url, add_admins_and_developers_to_forks) SELECT $1, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, git_credentials, ducklake, dbt_warehouses, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts, guest_access_enabled, guest_jwt_public_key, guest_jwt_jwks_url, add_admins_and_developers_to_forks FROM workspace_settings WHERE workspace_id = $2",
        &rw.new_id,
        &old_id
    )
@@ -1,7 +1,7 @@
 openapi: "3.0.3"

 info:
-  version: 1.814.0
+  version: 1.815.0
  title: Windmill API

  contact:
@@ -529,6 +529,30 @@ paths:
      responses:
        "302":
          description: redirected to the post-login destination, or to /user/login_link_expired when the link is used, expired or unknown
+    post:
+      security: []
+      summary: consume a single-use login link from its confirmation page, set the session cookie and answer where to go
+      operationId: confirmLoginLink
+      tags:
+        - user
+      parameters:
+        - name: token
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: the post-login destination, or /user/login_link_expired when the link is used, expired or unknown
+          content:
+            application/json:
+              schema:
+                type: object
+                required:
+                  - location
+                properties:
+                  location:
+                    type: string

  /auth/reset_password:
    post:
@@ -4066,9 +4090,13 @@ paths:
                  guest_access_enabled:
                    type: boolean
                    description: Whether this workspace admits guest sessions. An app's own `guest` execution mode is inert while this is false.
+                  add_admins_and_developers_to_forks:
+                    type: boolean
+                    description: Whether every new fork of this workspace starts with its admins and developers as members, keeping their role.
                required:
                  - workspace_id
                  - guest_access_enabled
+                  - add_admins_and_developers_to_forks

  /w/{workspace}/workspaces/get_settings:
    get:
@@ -4159,6 +4187,9 @@ paths:
                  guest_jwt_jwks_url:
                    type: string
                    description: JWKS URL a guest JWT (`jwt_guest_`) is verified against for this workspace. Mutually exclusive with `guest_jwt_public_key`.
+                  add_admins_and_developers_to_forks:
+                    type: boolean
+                    description: Whether every new fork of this workspace starts with its admins and developers as members, keeping their role.

  /w/{workspace}/workspaces/get_deploy_to:
    get:
@@ -6289,6 +6320,39 @@ paths:
              schema:
                type: string

+  /w/{workspace}/workspaces/edit_add_admins_and_developers_to_forks:
+    post:
+      summary: choose whether new forks of this workspace start with its admins and developers
+      description: >-
+        When on, every fork created from this workspace gets the workspace's admins and
+        developers as members, with the role they hold here; operators, disabled users and
+        service accounts are left out. The setting is copied into each fork, so forks of a
+        fork follow it too. Off by default. Workspace-admin gated.
+      operationId: editAddAdminsAndDevelopersToForks
+      tags:
+        - workspace
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+      requestBody:
+        description: Whether new forks start with this workspace's admins and developers
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                add_admins_and_developers_to_forks:
+                  type: boolean
+              required:
+                - add_admins_and_developers_to_forks
+      responses:
+        "200":
+          description: status
+          content:
+            text/plain:
+              schema:
+                type: string
+
  /w/{workspace}/workspaces/edit_guest_jwt_key:
    post:
      summary: set the key guest JWTs are verified against for this workspace
@@ -6753,7 +6817,7 @@ paths:
                  type: string
                expires_in_s:
                  type: integer
-                  description: link lifetime in seconds, at most 900 (default 600)
+                  description: link lifetime in seconds, at most 7200 (default 600)
                rd:
                  type: string
                  description: same-origin path the browser lands on after login (default /user/workspaces)
@@ -6763,6 +6827,12 @@ paths:
                    mint only while the account still has this login type (for example
                    pending_oauth), so a link stops working once the owner has set a password
                    or signed in with a provider
+                confirm:
+                  type: boolean
+                  description: >-
+                    return a /user/login_link page that signs in only when its button is
+                    clicked, instead of a link spent by opening it; set it for links sent by
+                    email, which mail scanners open on delivery (default false)
      responses:
        "201":
          description: login link minted
@@ -34731,6 +34801,9 @@ components:
                nullable: true
              disabled:
                type: boolean
+              is_service_account:
+                type: boolean
+                description: Whether this membership is a service account.
            required:
              - id
              - name
@@ -560,7 +560,7 @@ pub async fn run_server(
        if server_mode || mcp_mode {
            use mcp::{
                add_www_authenticate_header, add_www_authenticate_header_gateway,
-                extract_workspace_from_token,
+                extract_workspace_from_token, reject_token_query_param,
            };
            let (mcp_router, mcp_cancellation_token) = setup_mcp_server(
                db.clone(),
@@ -573,15 +573,17 @@ pub async fn run_server(
            let workspaced_mcp_router = mcp_router
                .clone()
                .route_layer(from_extractor::<ApiAuthed>())
+                .layer(axum::middleware::from_fn(reject_token_query_param))
                .layer(axum::middleware::from_fn(add_www_authenticate_header))
                .layer(axum::middleware::from_fn(extract_and_store_workspace_id));
            // Gateway MCP router — resolves workspace from token
            let gateway_mcp_router = mcp_router
                .route_layer(from_extractor::<ApiAuthed>())
+                .layer(axum::middleware::from_fn(extract_workspace_from_token))
+                .layer(axum::middleware::from_fn(reject_token_query_param))
                .layer(axum::middleware::from_fn(
                    add_www_authenticate_header_gateway,
-                ))
-                .layer(axum::middleware::from_fn(extract_workspace_from_token));
+                ));
            (
                workspaced_mcp_router,
                gateway_mcp_router,
@@ -43,11 +43,14 @@ use axum::{
    extract::{Extension, Path},
    http::Request,
    middleware::Next,
-    response::Response,
+    response::{IntoResponse, Response},
    routing::get,
    Json, Router,
 };
-use windmill_common::{auth::hash_token, db::GatewayWorkspaceId, error::JsonResult};
+use windmill_common::{
+    auth::hash_token, db::GatewayWorkspaceId, error::JsonResult,
+    global_settings::MCP_DISABLE_TOKEN_QUERY_PARAM,
+};

 // McpAuth impl for ApiAuthed is in windmill-api-auth (same crate as the type)

@@ -446,6 +449,29 @@ pub async fn add_www_authenticate_header(
    }
 }

+/// Middleware refusing a credential carried in the MCP URL once the instance sets
+/// `mcp_disable_token_query_param`. Sits outside everything that reads the token, so neither
+/// the gateway lookup nor `ApiAuthed` ever sees it, and inside the `WWW-Authenticate` layer,
+/// whose header is what sends the client into the OAuth flow instead. Refused rather than
+/// ignored: the URL leaked the token whether or not the request used it.
+pub async fn reject_token_query_param(request: Request<axum::body::Body>, next: Next) -> Response {
+    let carries_token = MCP_DISABLE_TOKEN_QUERY_PARAM.load(std::sync::atomic::Ordering::Relaxed)
+        && request
+            .uri()
+            .query()
+            .is_some_and(|q| url::form_urlencoded::parse(q.as_bytes()).any(|(k, _)| k == "token"));
+    if carries_token {
+        return (
+            axum::http::StatusCode::UNAUTHORIZED,
+            "This instance does not accept a token in the MCP URL. Remove the token query \
+             parameter and let your client sign in through OAuth, or send the token in an \
+             Authorization header.",
+        )
+            .into_response();
+    }
+    next.run(request).await
+}
+
 /// Extract the bearer token from either the `Authorization` header or the
 /// `?token=` query parameter (MCP clients commonly pass it in the URL).
 fn extract_gateway_token(request: &Request<axum::body::Body>) -> Option<String> {
@@ -12,5 +12,5 @@ pub mod oauth_server;
 pub use core::{
    add_www_authenticate_header, add_www_authenticate_header_gateway,
    extract_and_store_workspace_id, extract_workspace_from_token, list_tools_service,
-    setup_mcp_server,
+    reject_token_query_param, setup_mcp_server,
 };
@@ -20,7 +20,7 @@ use crate::{

 /// Whether `label` denotes a user-created token rather than a system token
 /// (`session`, `guest_session`, `ephemeral*`, `debugger-token`, `mcp-oauth-*`,
-/// `embed_app:*`, `sdk_app:*`, `impersonation:*`). System-token labels are load-bearing —
+/// `embed_app:*`, `sdk_app:*`, `impersonation:*`, `cli-login:*`). System-token labels are load-bearing —
 /// session cleanup, super_admin propagation, expiry notifications and username overrides
 /// all key off them — so they must not be user-editable. `None` (no label) is treated as
 /// a user token.
@@ -47,10 +47,17 @@ pub fn is_user_token(label: Option<&str>) -> bool {
                && !l.starts_with(APP_EMBED_TOKEN_LABEL_PREFIX)
                && !l.starts_with(RAW_APP_SDK_TOKEN_LABEL_PREFIX)
                && !l.starts_with("impersonation:")
+                && !l.starts_with(CLI_LOGIN_TOKEN_LABEL_PREFIX)
        }
    }
 }

+/// How far ahead of a user token's expiration its owner is warned (`check_expiring_tokens` in
+/// the monitor). A token whose whole lifetime fits in this window gets no warning at all: it
+/// would arrive minutes after creation, about a lifetime its creator just picked. Its
+/// "expired and deleted" notice still goes out.
+pub const TOKEN_EXPIRY_WARNING_DAYS: i32 = 7;
+
 /// Label prefix, followed by the app path, of the token an app viewer's sandboxed iframe
 /// runs with. Reserved in [`is_user_token`], whose SQL and frontend mirrors spell it out.
 pub const APP_EMBED_TOKEN_LABEL_PREFIX: &str = "embed_app:";
@@ -59,6 +66,13 @@ pub const APP_EMBED_TOKEN_LABEL_PREFIX: &str = "embed_app:";
 /// frontend SDK. Reserved in [`is_user_token`], whose SQL and frontend mirrors spell it out.
 pub const RAW_APP_SDK_TOKEN_LABEL_PREFIX: &str = "sdk_app:";

+/// Label prefix, followed by the username, of the token the CLI authorization page mints for
+/// `wmill` logins. Reserved in [`is_user_token`], whose SQL and frontend mirrors spell it out:
+/// the CLI signs in again on its own once that token expires, so an expiry email for it asks
+/// the user to do nothing. Not in [`is_server_minted_label`], since the page mints it through
+/// `/users/tokens/create`.
+pub const CLI_LOGIN_TOKEN_LABEL_PREFIX: &str = "cli-login:";
+
 /// Whether `label` belongs to a namespace only the server mints, and which therefore must be
 /// rejected by `create_token`. Narrower than [`is_user_token`], which also drives label
 /// editability and expiry notifications and can afford to reserve more: `Ephemeral lsp token`,
@@ -475,14 +489,16 @@ async fn fetch_authed_from_permissioned_as_inner(
    // principal — a username freed and reassigned while its previous holder keeps a privileged
    // account — would mix one account's role with another's instance privileges.
    let member = match permissioned_as.split_once('/') {
-        Some(("u", name)) => sqlx::query!(
-            "SELECT is_admin, operator, email FROM usr where username = $1 AND \
+        Some(("u", name)) => {
+            sqlx::query!(
+                "SELECT is_admin, operator, email FROM usr where username = $1 AND \
                                         workspace_id = $2 AND disabled = false",
-            name,
-            &w_id
-        )
-        .fetch_optional(&mut *conn)
-        .await?,
+                name,
+                &w_id
+            )
+            .fetch_optional(&mut *conn)
+            .await?
+        }
        _ => None,
    };
    let resolved_email;
@@ -980,6 +996,7 @@ mod tests {
        assert!(!is_user_token(Some("embed_app:f/team/dashboard")));
        assert!(!is_user_token(Some("sdk_app:u/admin/raw app")));
        assert!(!is_user_token(Some("impersonation:admin@windmill.dev")));
+        assert!(!is_user_token(Some("cli-login:admin")));
    }

    #[test]
@@ -102,6 +102,49 @@ pub const HUB_API_SECRET_SETTING: &str = "hub_api_secret";
 pub const AUTOMATE_USERNAME_CREATION_SETTING: &str = "automate_username_creation";
 pub const DISABLE_WORKSPACE_INVITE_EMAILS_SETTING: &str = "disable_workspace_invite_emails";
 pub const DISABLE_PASSWORD_LOGIN_SETTING: &str = "disable_password_login";
+/// Refuse `?token=` on the MCP endpoints, leaving the `Authorization` header as the only way
+/// in. A URL-borne credential ends up in browser history, proxy logs and referrers, so an
+/// instance that cares sends MCP clients through the OAuth flow instead.
+pub const MCP_DISABLE_TOKEN_QUERY_PARAM_SETTING: &str = "mcp_disable_token_query_param";
+/// Ceiling, in days, on how far ahead a token minted through `POST /users/tokens/create` or
+/// `POST /users/tokens/impersonate` may expire; a request asking for more, or for no
+/// expiration at all, is shortened to it rather than refused. On those routes only: server-side
+/// mints (webhook tokens, app embed tokens, sessions) choose a lifetime the caller never picks
+/// and go straight to `create_token_internal`. Read and validated by
+/// [`parse_max_token_expiration_days`].
+pub const MAX_TOKEN_EXPIRATION_DAYS_SETTING: &str = "max_token_expiration_days";
+/// Largest `max_token_expiration_days` read as a ceiling, about 2,700 years. The token form
+/// applies the same bound (`frontend/src/lib/tokenExpiration.ts`) so that it and the server
+/// agree on whether a ceiling exists.
+pub const MAX_TOKEN_EXPIRATION_DAYS_BOUND: i64 = 1_000_000;
+
+/// Reads a stored `max_token_expiration_days`: `Ok(None)` when unset or cleared (null or an
+/// empty string), the ceiling for a whole number of days within
+/// `1..=MAX_TOKEN_EXPIRATION_DAYS_BOUND` stored as an integer, an integral float or a string of
+/// digits, and an error for anything else.
+///
+/// The settings API and config sync both reject the error at write time: the token routes can
+/// only read an unparseable value as no ceiling, so accepting a typo would silently turn the
+/// policy off. `parseMaxTokenExpirationDays` in the frontend must accept exactly the same values.
+pub fn parse_max_token_expiration_days(
+    value: Option<&serde_json::Value>,
+) -> Result<Option<i64>, String> {
+    let days = match value {
+        None | Some(serde_json::Value::Null) => return Ok(None),
+        Some(serde_json::Value::String(s)) if s.trim().is_empty() => return Ok(None),
+        Some(serde_json::Value::Number(n)) => n
+            .as_i64()
+            .or_else(|| n.as_f64().filter(|f| f.fract() == 0.0).map(|f| f as i64)),
+        Some(serde_json::Value::String(s)) => s.trim().parse::<i64>().ok(),
+        Some(_) => None,
+    };
+    match days {
+        Some(days) if (1..=MAX_TOKEN_EXPIRATION_DAYS_BOUND).contains(&days) => Ok(Some(days)),
+        _ => Err(format!(
+            "must be a whole number of days from 1 to {MAX_TOKEN_EXPIRATION_DAYS_BOUND}, or empty for no limit"
+        )),
+    }
+}
 pub const AUTO_LOGIN_PROVIDER_SETTING: &str = "auto_login_provider";
 /// Name of the SAML attribute or OIDC userinfo claim carrying the user's IdP groups. Unset or
 /// empty leaves instance-group membership entirely to SCIM.
@@ -368,6 +411,7 @@ use std::sync::atomic::AtomicBool;
 lazy_static::lazy_static! {
    pub static ref HTTP_ROUTE_WORKSPACED_ROUTE: AtomicBool = AtomicBool::new(false);
    pub static ref DISABLE_PASSWORD_LOGIN: AtomicBool = AtomicBool::new(false);
+    pub static ref MCP_DISABLE_TOKEN_QUERY_PARAM: AtomicBool = AtomicBool::new(false);
    /// Origins HTTP routes allow cross-origin when they configure none of their
    /// own. Empty means unset, which keeps the historical `*`.
    pub static ref HTTP_ROUTE_DEFAULT_ALLOWED_ORIGINS: arc_swap::ArcSwap<Vec<String>> =
@@ -811,6 +855,55 @@ pub fn workspace_integration_auth_endpoint(client_name: &str, base_url: &str) ->
 mod tests {
    use super::*;

+    // `frontend/src/lib/tokenExpiration.test.ts` holds the same table for the token form's
+    // parser; the two must stay in step.
+    #[test]
+    fn max_token_expiration_days_accepts_only_whole_days_within_the_bound() {
+        use serde_json::json;
+        for (stored, days) in [
+            (json!(7), 7),
+            (json!(7.0), 7),
+            (json!("7"), 7),
+            (json!(" 30 "), 30),
+            (json!("+7"), 7),
+            (
+                json!(MAX_TOKEN_EXPIRATION_DAYS_BOUND),
+                MAX_TOKEN_EXPIRATION_DAYS_BOUND,
+            ),
+        ] {
+            assert_eq!(
+                parse_max_token_expiration_days(Some(&stored)),
+                Ok(Some(days)),
+                "{stored}"
+            );
+        }
+        for cleared in [json!(null), json!(""), json!("  ")] {
+            assert_eq!(
+                parse_max_token_expiration_days(Some(&cleared)),
+                Ok(None),
+                "{cleared}"
+            );
+        }
+        assert_eq!(parse_max_token_expiration_days(None), Ok(None));
+        for bad in [
+            json!(7.5),
+            json!(0),
+            json!(-3),
+            json!("7.0"),
+            json!("1e1"),
+            json!("0x7"),
+            json!(MAX_TOKEN_EXPIRATION_DAYS_BOUND + 1),
+            json!("99999999999999999999"),
+            json!(true),
+            json!([7]),
+        ] {
+            assert!(
+                parse_max_token_expiration_days(Some(&bad)).is_err(),
+                "{bad} must be rejected"
+            );
+        }
+    }
+
    #[test]
    fn webhook_base_url_errors_never_echo_credentials() {
        // These strings reach sync-config output and operator logs, so no branch may
@@ -1358,6 +1358,10 @@ pub async fn sync_global_settings_declarative(
    crate::global_settings::parse_allowed_origins_setting(desired.get(origins_key))
        .map_err(|e| anyhow::anyhow!("{origins_key}: {e}"))?;

+    let max_expiration_key = crate::global_settings::MAX_TOKEN_EXPIRATION_DAYS_SETTING;
+    crate::global_settings::parse_max_token_expiration_days(desired.get(max_expiration_key))
+        .map_err(|e| anyhow::anyhow!("{max_expiration_key}: {e}"))?;
+
    let diff = diff_global_settings(current, desired, ApplyMode::Replace);
    apply_settings_diff(db, &diff).await?;

@@ -10,7 +10,7 @@

 use std::borrow::Cow;
 use std::collections::{HashMap, HashSet};
-use std::sync::RwLock;
+use std::sync::{Arc, RwLock};
 use uuid::Uuid;

 /// Minimum length for a secret to be registered for masking.
@@ -20,9 +20,27 @@ const MIN_SECRET_LENGTH: usize = 8;
 const MASKED_NOTICE: &str =
    "[windmill] secret value was masked for security reasons, use string transformations to display full value";

+/// The secrets registered for one job, plus the automaton compiled from them.
+#[derive(Default)]
+struct JobMasks {
+    secrets: HashSet<String>,
+    /// Built on the first `snapshot` after a change and shared by every later
+    /// snapshot. Every job registers at least its own token, so without this
+    /// cache each log batch of each job would rebuild the automaton.
+    compiled: Option<Arc<CompiledMasks>>,
+}
+
+/// Aho-Corasick automaton for O(m) multi-pattern matching in a single pass,
+/// regardless of the number of secrets registered, with the replacement
+/// strings indexed to match the automaton's pattern order.
+struct CompiledMasks {
+    ac: aho_corasick::AhoCorasick,
+    replacements: Vec<String>,
+}
+
 lazy_static::lazy_static! {
-    /// Map of job_id -> set of secret values that should be masked in that job's logs.
-    static ref SENSITIVE_MASKS: RwLock<HashMap<Uuid, HashSet<String>>> =
+    /// Map of job_id -> secret values that should be masked in that job's logs.
+    static ref SENSITIVE_MASKS: RwLock<HashMap<Uuid, JobMasks>> =
        RwLock::new(HashMap::new());

    /// Set of currently running job IDs on this worker process.
@@ -32,13 +50,8 @@ lazy_static::lazy_static! {
 }

 /// A lock-free snapshot of secrets for a job, taken once per log batch.
-/// Uses Aho-Corasick for O(m) multi-pattern matching in a single pass,
-/// regardless of the number of secrets registered.
 pub struct MaskSnapshot {
-    /// Aho-Corasick automaton for fast matching.
-    ac: aho_corasick::AhoCorasick,
-    /// Replacement strings, indexed to match the automaton's pattern order.
-    replacements: Vec<String>,
+    compiled: Arc<CompiledMasks>,
    /// Whether the security notice has already been appended for this snapshot.
    /// Tracked locally to avoid a global write lock on every masked line.
    notice_shown: std::cell::Cell<bool>,
@@ -53,34 +66,104 @@ impl MaskSnapshot {
        }

        // Single-pass check + replace using the pre-built automaton
-        if !self.ac.is_match(text) {
+        if !self.compiled.ac.is_match(text) {
            return Cow::Borrowed(text);
        }

-        let mut result = self.ac.replace_all(text, &self.replacements);
+        let mut result = self
+            .compiled
+            .ac
+            .replace_all(text, &self.compiled.replacements);

-        // Append the notice only once per snapshot (i.e. per batch)
+        // Append the notice only once per snapshot (i.e. per batch), as its own line.
+        // Callers pass either a bare line (`handle_child`) or a chunk that already ends
+        // in a newline (nativets), and the sinks concatenate what they get verbatim:
+        // assuming either shape welds the notice onto a neighbouring line.
        if !self.notice_shown.get() {
            self.notice_shown.set(true);
-            result.push('\n');
-            result.push_str(MASKED_NOTICE);
+            if result.ends_with('\n') {
+                result.push_str(MASKED_NOTICE);
+                result.push('\n');
+            } else {
+                result.push('\n');
+                result.push_str(MASKED_NOTICE);
+            }
        }

        Cow::Owned(result)
    }
 }

+/// A masker for sinks that mask line by line rather than in batches, like nativets
+/// masking each `console.log` chunk as V8 produces it. `snapshot` per line would
+/// re-arm the security notice on every one; this keeps it to once per distinct set
+/// of secrets while still picking up secrets registered mid-run.
+///
+/// Masks by job id alone — the caller is the one that knows the text it passes
+/// belongs to that job.
+pub struct JobMasker {
+    job_id: Uuid,
+    snapshot: Option<MaskSnapshot>,
+}
+
+impl JobMasker {
+    pub fn new(job_id: Uuid) -> Self {
+        JobMasker { job_id, snapshot: snapshot(&job_id) }
+    }
+
+    /// Mask every secret registered for the job. Returns `Cow::Borrowed` when no match.
+    /// Falls back to the masks it last saw once the job is unregistered, so a sink
+    /// still draining past the end of a run does not start emitting secrets.
+    pub fn mask<'a>(&mut self, text: &'a str) -> Cow<'a, str> {
+        if let Some(fresh) = snapshot(&self.job_id) {
+            // Replacing an equivalent snapshot would re-arm the notice, so only take
+            // one built from a secret set we have not seen.
+            let unchanged = self
+                .snapshot
+                .as_ref()
+                .is_some_and(|cur| Arc::ptr_eq(&cur.compiled, &fresh.compiled));
+            if !unchanged {
+                self.snapshot = Some(fresh);
+            }
+        }
+        match self.snapshot.as_ref() {
+            Some(snapshot) => snapshot.mask(text),
+            None => Cow::Borrowed(text),
+        }
+    }
+}
+
 /// Take a snapshot of the current secrets for a job. Returns `None` if no secrets
 /// are registered (the caller can then skip masking entirely for the whole batch).
 ///
 /// Call this once per log batch in `write_lines`, not per line.
 pub fn snapshot(job_id: &Uuid) -> Option<MaskSnapshot> {
-    let masks = SENSITIVE_MASKS.read().unwrap_or_else(|e| e.into_inner());
-    let secrets = masks.get(job_id)?;
-    if secrets.is_empty() {
-        return None;
+    {
+        let masks = SENSITIVE_MASKS.read().unwrap_or_else(|e| e.into_inner());
+        let job = masks.get(job_id)?;
+        if job.secrets.is_empty() {
+            return None;
+        }
+        if let Some(compiled) = job.compiled.as_ref() {
+            return Some(MaskSnapshot {
+                compiled: compiled.clone(),
+                notice_shown: std::cell::Cell::new(false),
+            });
+        }
    }

+    let mut masks = SENSITIVE_MASKS.write().unwrap_or_else(|e| e.into_inner());
+    let job = masks.get_mut(job_id)?;
+    if job.secrets.is_empty() {
+        return None;
+    }
+    let compiled = job
+        .compiled
+        .get_or_insert_with(|| Arc::new(compile(&job.secrets)));
+    Some(MaskSnapshot { compiled: compiled.clone(), notice_shown: std::cell::Cell::new(false) })
+}
+
+fn compile(secrets: &HashSet<String>) -> CompiledMasks {
    // Sort longest-first so longer secrets are matched before shorter substrings
    let mut sorted: Vec<&String> = secrets.iter().collect();
    sorted.sort_by(|a, b| b.len().cmp(&a.len()));
@@ -106,7 +189,7 @@ pub fn snapshot(job_id: &Uuid) -> Option<MaskSnapshot> {
        .build(sorted.iter().map(|s| s.as_str()))
        .expect("failed to build aho-corasick automaton");

-    Some(MaskSnapshot { ac, replacements, notice_shown: std::cell::Cell::new(false) })
+    CompiledMasks { ac, replacements }
 }

 /// Register a job as currently running. Call this before `handle_queued_job`.
@@ -148,20 +231,110 @@ pub fn register_secret_for_all_running_jobs(secret: &str) {

    let mut masks = SENSITIVE_MASKS.write().unwrap_or_else(|e| e.into_inner());
    for job_id in job_ids {
-        if let Some(set) = masks.get_mut(&job_id) {
-            set.insert(secret.to_string());
+        if let Some(job) = masks.get_mut(&job_id) {
+            if job.secrets.insert(secret.to_string()) {
+                job.compiled = None;
+            }
        }
    }
 }

 /// Register a secret value for a specific job.
-/// Used for `$encrypted:` args where we know the job ID.
+/// Used for the job's own token and for `$encrypted:` args, where we know the job ID.
 pub fn register_secret_for_job(job_id: Uuid, secret: &str) {
    if secret.len() < MIN_SECRET_LENGTH {
        return;
    }
    let mut masks = SENSITIVE_MASKS.write().unwrap_or_else(|e| e.into_inner());
-    if let Some(set) = masks.get_mut(&job_id) {
-        set.insert(secret.to_string());
+    if let Some(job) = masks.get_mut(&job_id) {
+        if job.secrets.insert(secret.to_string()) {
+            job.compiled = None;
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// The compiled automaton is cached per job, so a secret registered after the
+    /// first snapshot only gets masked if the cache is invalidated.
+    #[test]
+    fn snapshot_rebuilds_after_a_new_secret_is_registered() {
+        let job_id = Uuid::new_v4();
+        register_running_job(job_id);
+        register_secret_for_job(job_id, "firstsecretvalue");
+        let _ = snapshot(&job_id)
+            .expect("secret registered")
+            .mask("firstsecretvalue");
+
+        register_secret_for_job(job_id, "secondsecretvalue");
+
+        let snap = snapshot(&job_id).expect("secrets registered");
+        let masked = snap.mask("firstsecretvalue then secondsecretvalue");
+        assert!(!masked.contains("firstsecretvalue"), "{masked}");
+        assert!(!masked.contains("secondsecretvalue"), "{masked}");
+        unregister_running_job(job_id);
+    }
+
+    /// A line-by-line sink must not repeat the notice on every line, and must still
+    /// pick up a secret registered after the masker was built.
+    #[test]
+    fn job_masker_notices_once_per_secret_set() {
+        let job_id = Uuid::new_v4();
+        register_running_job(job_id);
+        register_secret_for_job(job_id, "firstsecretvalue");
+        let mut masker = JobMasker::new(job_id);
+
+        let first = masker.mask("saw firstsecretvalue").into_owned();
+        assert!(!first.contains("firstsecretvalue"), "{first}");
+        assert!(first.contains(MASKED_NOTICE), "{first}");
+
+        let second = masker.mask("saw firstsecretvalue again").into_owned();
+        assert!(!second.contains("firstsecretvalue"), "{second}");
+        assert!(!second.contains(MASKED_NOTICE), "{second}");
+
+        register_secret_for_job(job_id, "secondsecretvalue");
+        let third = masker.mask("saw secondsecretvalue").into_owned();
+        assert!(!third.contains("secondsecretvalue"), "{third}");
+        unregister_running_job(job_id);
+    }
+
+    /// Unregistration must not turn masking off under a sink that is still emitting:
+    /// the masker keeps working off the masks it last saw rather than going quiet.
+    #[test]
+    fn job_masker_masks_after_the_job_is_unregistered() {
+        let job_id = Uuid::new_v4();
+        register_running_job(job_id);
+        register_secret_for_job(job_id, "supersecretvalue");
+        let mut masker = JobMasker::new(job_id);
+
+        unregister_running_job(job_id);
+
+        let masked = masker.mask("logged supersecretvalue here");
+        assert!(!masked.contains("supersecretvalue"), "{masked}");
+    }
+
+    /// The notice has to end up on a line of its own for both shapes callers pass:
+    /// a bare line (`handle_child`) and a newline-terminated chunk (nativets). The
+    /// sinks concatenate what they are given verbatim, so getting this wrong welds
+    /// the notice onto whichever line follows it.
+    #[test]
+    fn notice_lands_on_its_own_line_for_both_caller_shapes() {
+        let job_id = Uuid::new_v4();
+        register_running_job(job_id);
+        register_secret_for_job(job_id, "supersecretvalue");
+
+        let line = snapshot(&job_id)
+            .expect("secret registered")
+            .mask("tok supersecretvalue");
+        assert_eq!(line, format!("tok s*****e\n{MASKED_NOTICE}"));
+
+        let chunk = snapshot(&job_id)
+            .expect("secret registered")
+            .mask("tok supersecretvalue\n");
+        assert_eq!(chunk, format!("tok s*****e\n{MASKED_NOTICE}\n"));
+
+        unregister_running_job(job_id);
    }
 }
@@ -4650,6 +4650,30 @@ pub fn tag_reads_args(tag: &str) -> bool {
    RE_ARG_TAG.is_match(tag)
 }

+/// Whether the tag reads the flow's state (`$flow_expr[results.a.foo]`), which only the flow
+/// runtime can resolve, right before pushing the step. A malformed placeholder counts too, so it
+/// is rejected or dropped instead of queueing the job on its literal text.
+pub fn tag_reads_flow_expr(tag: &str) -> bool {
+    tag.contains("$flow_expr[")
+}
+
+/// Renders the value at the dotted `path` below `root` as a dynamic tag component, shared by
+/// `$args[...]` and `$flow_expr[...]`: its JSON text with surrounding quotes trimmed, and empty
+/// once a segment is missing. Only object keys are followed, never array indexes.
+pub fn render_tag_path(root: Option<&RawValue>, path: &str) -> String {
+    let mut value = root.map(|x| x.get()).unwrap_or_default().to_string();
+    for part in path.split('.').filter(|p| !p.is_empty()) {
+        match serde_json::from_str::<serde_json::Value>(&value) {
+            Ok(obj) => value = obj.get(part).map(|v| v.to_string()).unwrap_or_default(),
+            Err(_) => {
+                value = String::new();
+                break;
+            }
+        }
+    }
+    value.trim_matches('"').to_string()
+}
+
 pub fn interpolate_args(x: String, args: &PushArgs, workspace_id: &str) -> String {
    // Save this value to avoid parsing twice
    let workspaced = x.as_str().replace("$workspace", workspace_id).to_string();
@@ -4657,40 +4681,12 @@ pub fn interpolate_args(x: String, args: &PushArgs, workspace_id: &str) -> Strin
        let mut interpolated = workspaced.clone();
        for cap in RE_ARG_TAG.captures_iter(&workspaced) {
            let arg_name = cap.get(1).unwrap().as_str();
-            let arg_value = if arg_name.contains('.') {
-                let parts: Vec<&str> = arg_name.split('.').collect();
-                let root = parts[0];
-                let mut value = args
-                    .args
-                    .get(root)
-                    .or(args.extra.as_ref().and_then(|x| x.get(root)))
-                    .map(|x| x.get())
-                    .unwrap_or_default()
-                    .to_string();
-
-                for part in parts.iter().skip(1) {
-                    if let Ok(obj) = serde_json::from_str::<serde_json::Value>(&value) {
-                        value = obj
-                            .get(part)
-                            .and_then(|v| Some(v.to_string()))
-                            .unwrap_or_default()
-                            .as_str()
-                            .to_string();
-                    } else {
-                        value = "".to_string(); // Invalid JSON or missing field
-                        break;
-                    }
-                }
-                value.trim_matches('"').to_string()
-            } else {
-                args.args
-                    .get(arg_name)
-                    .or(args.extra.as_ref().and_then(|x| x.get(arg_name)))
-                    .map(|x| x.get())
-                    .unwrap_or_default()
-                    .trim_matches('"')
-                    .to_string()
-            };
+            let (root, rest) = arg_name.split_once('.').unwrap_or((arg_name, ""));
+            let root_value = args
+                .args
+                .get(root)
+                .or(args.extra.as_ref().and_then(|x| x.get(root)));
+            let arg_value = render_tag_path(root_value.map(|x| &**x), rest);
            interpolated =
                interpolated.replace(format!("$args[{}]", arg_name).as_str(), &arg_value);
        }
@@ -5269,6 +5265,8 @@ pub fn empty_result() -> Box<RawValue> {

 lazy_static::lazy_static! {
    pub static ref RE_ARG_TAG: Regex = Regex::new(r#"\$args\[((?:\w+\.)*\w+)\]"#).unwrap();
+    pub static ref RE_FLOW_EXPR_TAG: Regex =
+        Regex::new(r#"\$flow_expr\[((?:\w+\.)*\w+)\]"#).unwrap();
 }

 #[cfg(feature = "cloud")]
@@ -6537,7 +6535,10 @@ async fn push_inner<'c, 'd>(
        );
        windmill_common::worker::dedicated_worker_tag(workspace_id, &full_path)
    } else {
-        if tag == Some("".to_string()) {
+        // The flow runtime resolves a step's `$flow_expr[...]` before pushing it, so one still here
+        // was pushed with no flow state to read (a step test, a dependency job) and would name a
+        // queue no worker serves: the job runs on its default tag instead.
+        if tag == Some("".to_string()) || tag.as_deref().is_some_and(tag_reads_flow_expr) {
            tag = None;
        }

@@ -7922,3 +7923,43 @@ mod result_metadata_tests {
        assert_eq!(meta.wm_failure.as_deref(), Some("boom"));
    }
 }
+
+#[cfg(test)]
+mod render_tag_path_tests {
+    use super::{interpolate_args, render_tag_path, PushArgs};
+    use serde_json::value::RawValue;
+    use std::collections::HashMap;
+
+    fn render(root: &str, path: &str) -> String {
+        render_tag_path(
+            Some(&RawValue::from_string(root.to_string()).unwrap()),
+            path,
+        )
+    }
+
+    // Existing `$args[...]` tags route on exactly these renderings.
+    #[test]
+    fn renders_like_args_tags() {
+        assert_eq!(render(r#""eu""#, ""), "eu");
+        assert_eq!(render(r#"{"a": {"b": "eu"}}"#, "a.b"), "eu");
+        assert_eq!(render(r#"{"n": 4}"#, "n"), "4");
+        assert_eq!(render("null", ""), "null");
+        assert_eq!(render(r#"{"a": 1}"#, "b.c"), "");
+        assert_eq!(render(r#"{"a": ["eu"]}"#, "a.0"), "");
+        assert_eq!(render_tag_path(None, "a"), "");
+
+        let args = HashMap::from([("cfg".to_string(), raw(r#"{"lang": "eu"}"#))]);
+        let push_args = PushArgs {
+            args: &args,
+            extra: Some(HashMap::from([("e".to_string(), raw(r#""x""#))])),
+        };
+        assert_eq!(
+            interpolate_args("w-$args[cfg.lang]-$args[e]".to_string(), &push_args, "ws"),
+            "w-eu-x"
+        );
+    }
+
+    fn raw(json: &str) -> Box<RawValue> {
+        RawValue::from_string(json.to_string()).unwrap()
+    }
+}
@@ -838,6 +838,11 @@ pub async fn eval_fetch_timeout(
                }
            }
            let w_id_for_tracing = w_id_for_tracing;
+            // nativets delivers logs in-process, so they never reach the masking in
+            // `handle_child::write_lines` and a `console.log` of `$WM_TOKEN` would be
+            // persisted verbatim. Mask here rather than in the detached task draining into
+            // `append_logs`: this loop normally runs while the job is still registered.
+            let mut masker = windmill_common::sensitive_log_masks::JobMasker::new(job_id);
            let handle = tokio::spawn(async move {
                let mut result_stream = String::new();
                let mut is_stream = false;
@@ -845,10 +850,20 @@ pub async fn eval_fetch_timeout(
                    use windmill_common::result_stream::extract_stream_from_logs;
                    use windmill_common::tracing_init::{OTEL_JOB_LOGS, OTEL_PREFIX};

+                    let stream = extract_stream_from_logs(&log.trim_end_matches("\n"));
+
+                    // A stream chunk is result data, not a log line — it never reaches
+                    // `job_logs`, and `merge_result_stream` can make it the job's result —
+                    // so it stays raw wherever it goes, here and in the mirror below.
+                    // Deliberately unlike `handle_child`, which streams the masked text.
+                    // Routed before masking because the notice is one-shot: spent on a chunk
+                    // no sink persists, a later redaction in `job_logs` would go unexplained.
+                    let logged = stream.is_none().then(|| masker.mask(&log).into_owned());
+
                    // Mirror `process_streaming_log_lines` (EE) + the OTEL_JOB_LOGS
                    // hook from handle_child.rs, neither of which runs for nativets
                    // since nativets delivers logs in-process via the log channel.
-                    for line in log.lines() {
+                    for line in logged.as_deref().unwrap_or(&log).lines() {
                        tracing::info!(
                            target: "windmill:job_log",
                            job_id = ?job_id,
@@ -862,7 +877,7 @@ pub async fn eval_fetch_timeout(
                        }
                    }

-                    if let Some(stream) = extract_stream_from_logs(&log.trim_end_matches("\n")) {
+                    if let Some(stream) = stream {
                        if !is_stream {
                            is_stream = true;
                            if let Some(ref f) = stream_notifier_update {
@@ -874,8 +889,8 @@ pub async fn eval_fetch_timeout(
                        if let Err(e) = result_stream_sender.send(stream) {
                            tracing::error!("failed to send result stream: {e}");
                        }
-                    } else {
-                        if let Err(e) = append_logs_sender.send(log) {
+                    } else if let Some(logged) = logged {
+                        if let Err(e) = append_logs_sender.send(logged) {
                            tracing::error!("failed to send log: {e}");
                        }
                    }
@@ -79,6 +79,15 @@ lazy_static::lazy_static! {
 const DEFAULT_MAX_AGENT_ITERATIONS: usize = 10;
 const HARD_MAX_AGENT_ITERATIONS: usize = 1000;

+/// What a run stopped by `max_iterations` reports back. `Message` rather than
+/// `OpenAIMessage` is load-bearing: `agent_action` is `skip_serializing` on the
+/// latter and reaches JSON only through this wrapper, so serializing these raw
+/// drops every tool name and job id and leaves the partial run unreadable.
+#[derive(serde::Serialize)]
+struct MaxIterPartialResult<'a> {
+    messages: Vec<Message<'a>>,
+}
+
 fn strip_system_messages(messages: &[OpenAIMessage]) -> Vec<OpenAIMessage> {
    messages
        .iter()
@@ -1785,10 +1794,6 @@ pub async fn run_agent(
                        step_id: Option<&'a str>,
                        result: MaxIterPartialResult<'a>,
                    }
-                    #[derive(serde::Serialize)]
-                    struct MaxIterPartialResult<'a> {
-                        messages: &'a [OpenAIMessage],
-                    }
                    return Err(Error::ExecutionRawError(
                        serde_json::value::to_raw_value(&MaxIterError {
                            message: format!(
@@ -1797,7 +1802,15 @@ pub async fn run_agent(
                            ),
                            name: "ExecutionErr",
                            step_id: effective_flow_step_id,
-                            result: MaxIterPartialResult { messages: &messages },
+                            result: MaxIterPartialResult {
+                                messages: messages
+                                    .iter()
+                                    .map(|m| Message {
+                                        message: m,
+                                        agent_action: m.agent_action.as_ref(),
+                                    })
+                                    .collect(),
+                            },
                        })?,
                    ));
                }
@@ -2322,6 +2335,33 @@ mod tests {
        assert!(!streaming_requested(Some(false)));
    }

+    #[test]
+    fn max_iterations_partial_result_keeps_the_action_tags() {
+        let messages = vec![OpenAIMessage {
+            role: "tool".to_string(),
+            content: Some(OpenAIContent::Text("{\"rows\":2}".to_string())),
+            tool_call_id: Some("call_1".to_string()),
+            agent_action: Some(AgentAction::ToolCall {
+                job_id: uuid::Uuid::nil(),
+                function_name: "list_payouts".to_string(),
+                module_id: "b".to_string(),
+            }),
+            ..Default::default()
+        }];
+
+        let partial = MaxIterPartialResult {
+            messages: messages
+                .iter()
+                .map(|m| Message { message: m, agent_action: m.agent_action.as_ref() })
+                .collect(),
+        };
+        let json = serde_json::to_value(&partial).unwrap();
+
+        let action = &json["messages"][0]["agent_action"];
+        assert_eq!(action["type"], "tool_call");
+        assert_eq!(action["function_name"], "list_payouts");
+    }
+
    /// Over 64 characters OpenAI rejects the key outright, which costs a wasted round
    /// trip per run and silently leaves that step with no prompt caching at all.
    #[test]
@@ -3859,8 +3859,6 @@ pub async fn run_worker(

                    let arc_job = Arc::new(job);

-                    windmill_common::sensitive_log_masks::register_running_job(arc_job.id);
-
                    let span = create_span_with_name(&arc_job, &worker_name, Some(hostname), "job");
                    let log_ctx = log_context_for_job(&arc_job, &worker_name, Some(hostname));

@@ -3976,8 +3974,6 @@ pub async fn run_worker(
                        _ => {}
                    }

-                    windmill_common::sensitive_log_masks::unregister_running_job(job_id);
-
                    #[cfg(feature = "prometheus")]
                    if let Some(duration) = _timer.map(|x| x.stop_and_record()) {
                        register_metric(
@@ -4512,6 +4508,30 @@ async fn detect_and_store_runtime_assets_from_job_args(
    }
 }

+/// Holds a job's entry in the log-masking registry for as long as it executes, so
+/// that secrets it fetches can be registered against it, and masks the job's own
+/// token from the start: `$WM_TOKEN` stays valid well past the run, and a script
+/// that echoes it would otherwise leave a live credential in the persisted logs.
+///
+/// Lives here rather than at the call sites so that every way of running a job —
+/// the poller, the interactive worker shell, an inline AI agent tool — is covered
+/// by construction.
+struct RunningJobMasks(Uuid);
+
+impl RunningJobMasks {
+    fn register(job_id: Uuid, token: &str) -> Self {
+        windmill_common::sensitive_log_masks::register_running_job(job_id);
+        windmill_common::sensitive_log_masks::register_secret_for_job(job_id, token);
+        RunningJobMasks(job_id)
+    }
+}
+
+impl Drop for RunningJobMasks {
+    fn drop(&mut self) {
+        windmill_common::sensitive_log_masks::unregister_running_job(self.0);
+    }
+}
+
 pub async fn handle_queued_job(
    job: Arc<MiniPulledJob>,
    raw_code: Option<String>,
@@ -4533,6 +4553,8 @@ pub async fn handle_queued_job(
    flow_runners: Option<Arc<FlowRunners>>,
    #[cfg(feature = "benchmark")] _bench: &mut BenchmarkIter,
 ) -> windmill_common::error::Result<JobOutcome> {
+    let _masks = RunningJobMasks::register(job.id, &client.token);
+
    if job.canceled_by.is_some() {
        return Err(Error::JsonErr(canceled_job_to_result(&job)));
    }
@@ -69,10 +69,10 @@ use windmill_common::{
 use windmill_queue::schedule::get_schedule_opt;
 use windmill_queue::{
    add_completed_job, add_completed_job_error, append_logs, get_mini_pulled_job,
-    insert_concurrency_key_capped, interpolate_args,
+    insert_concurrency_key_capped, interpolate_args, render_tag_path,
    report_error_to_workspace_handler_or_critical_side_channel, tag_reads_args,
-    try_schedule_next_job, CanceledBy, FlowRunners, MiniCompletedJob, MiniPulledJob, PushArgs,
-    PushIsolationLevel, SameWorkerPayload, WrappedError,
+    tag_reads_flow_expr, try_schedule_next_job, CanceledBy, FlowRunners, MiniCompletedJob,
+    MiniPulledJob, PushArgs, PushIsolationLevel, SameWorkerPayload, WrappedError, RE_FLOW_EXPR_TAG,
 };

 use windmill_audit::audit_oss::audit_log;
@@ -3115,6 +3115,66 @@ fn resolve_flow_step_tag(
    }
 }

+/// Resolves each `$flow_expr[root.key.path]` of a step tag by reading `key.path` from `results`
+/// (where `key` is a step id), `flow_input` or `flow_env`, rendered as `$args[key.path]` would be.
+async fn interpolate_flow_expr_tag(
+    tag: &str,
+    db: &DB,
+    flow_job: &MiniPulledJob,
+    flow_input: &HashMap<String, Box<RawValue>>,
+    flow_env: Option<&HashMap<String, Box<RawValue>>>,
+) -> error::Result<String> {
+    if RE_FLOW_EXPR_TAG
+        .replace_all(tag, "")
+        .contains("$flow_expr[")
+    {
+        return Err(Error::ExecutionErr(format!(
+            "Could not resolve the step tag `{tag}`: each `$flow_expr[...]` must hold a dotted \
+             path such as `results.a.b.c`"
+        )));
+    }
+    let mut rendered: HashMap<&str, String> = HashMap::new();
+    for cap in RE_FLOW_EXPR_TAG.captures_iter(tag) {
+        let path = cap.get(1).unwrap().as_str();
+        if rendered.contains_key(path) {
+            continue;
+        }
+        let (root, key_path) = path.split_once('.').unwrap_or((path, ""));
+        let (key, rest) = key_path.split_once('.').unwrap_or((key_path, ""));
+        if key.is_empty() || !matches!(root, "results" | "flow_input" | "flow_env") {
+            return Err(Error::ExecutionErr(format!(
+                "Could not resolve the step tag `{tag}`: `{path}` must start with \
+                 `results.<step_id>`, `flow_input.<key>` or `flow_env.<key>`"
+            )));
+        }
+        let value = match root {
+            "flow_input" => render_tag_path(flow_input.get(key).map(|x| &**x), rest),
+            "flow_env" => render_tag_path(flow_env.and_then(|e| e.get(key)).map(|x| &**x), rest),
+            _ => match windmill_queue::get_result_by_id(
+                db.clone(),
+                flow_job.workspace_id.clone(),
+                flow_job.id,
+                key.to_string(),
+                None,
+            )
+            .await
+            {
+                Ok(result) => render_tag_path(Some(&*result), rest),
+                Err(Error::NotFound(_)) => String::new(),
+                Err(e) => {
+                    return Err(Error::ExecutionErr(format!(
+                        "Could not resolve the step tag `{tag}`: {e}"
+                    )))
+                }
+            },
+        };
+        rendered.insert(path, value);
+    }
+    Ok(RE_FLOW_EXPR_TAG
+        .replace_all(tag, |cap: &regex::Captures| rendered[&cap[1]].clone())
+        .into_owned())
+}
+
 #[cfg(test)]
 mod tag_resolution_tests {
    use super::resolve_flow_step_tag;
@@ -4193,6 +4253,10 @@ async fn push_next_flow_job(
            None
        };

+        // The `flow_input` the step's input transforms read, which a `$flow_expr[flow_input...]`
+        // tag must read too: the body of a simple for-loop also sees `iter` there.
+        let mut step_flow_input = arc_flow_job_args.clone();
+
        let marc;
        let me;
        let args = match &next_status {
@@ -4217,8 +4281,10 @@ async fn push_next_flow_job(
                if let Some(input_transforms) = simple_input_transforms {
                    //previous id is none because we do not want to use previous id if we are in a for loop
                    let ctx = get_transform_context(&flow_job, "", &status);
+                    let args = Marc::new(args);
+                    step_flow_input = args.clone();
                    let ti = transform_input(
-                        Marc::new(args),
+                        args,
                        flow_env,
                        arc_last_job_result.clone(),
                        input_transforms,
@@ -4397,17 +4463,21 @@ async fn push_next_flow_job(
            payload_tag.tag.as_deref(),
        );

-        // `push_args` is empty once the input transforms failed, so a tag reading `$args[...]`
-        // interpolates to a queue nobody serves and the step sits there instead of reporting
-        // the error. Send it to the flow's tag, which a worker is provably serving right now.
+        // A step whose inputs failed to evaluate, or whose `$flow_expr[...]` tag failed to resolve,
+        // is pushed only to report the error, and a computed tag can then name a queue nobody
+        // serves (`push_args` is empty, so `$args[...]` reads nothing), leaving the step stuck
+        // instead. Send it to the flow's tag, which a worker is provably serving right now.
        //
        // A step handed over by id, or one whose tag `push` replaces, never reaches a worker
        // through its tag, so rewriting theirs would be noise.
        let step_is_pulled_by_tag = !continue_on_same_worker
            && !continue_with_runners
            && !payload_tag.payload.is_dedicated_worker();
-        let reroute_to_flow_tag =
-            err.is_some() && step_is_pulled_by_tag && tag.as_deref().is_some_and(tag_reads_args);
+        let reroute_to_flow_tag = err.is_some()
+            && step_is_pulled_by_tag
+            && tag
+                .as_deref()
+                .is_some_and(|t| tag_reads_args(t) || tag_reads_flow_expr(t));
        let tag = if reroute_to_flow_tag {
            Some(flow_job.tag.clone())
        } else {
@@ -4449,6 +4519,30 @@ async fn push_next_flow_job(
            .await?;
        }

+        // Resolved only after the check: CUSTOM_TAGS allows the template, so its value may name
+        // any queue, as the value of an `$args[...]` tag does.
+        let mut tag_err = None;
+        let tag = match tag {
+            Some(t) if err.is_none() && tag_reads_flow_expr(&t) => {
+                match interpolate_flow_expr_tag(&t, db, &flow_job, &step_flow_input, flow_env)
+                    .warn_after_seconds(3)
+                    .await
+                {
+                    Ok(resolved) => Some(resolved),
+                    Err(e) => {
+                        tag_err = Some(e);
+                        Some(if step_is_pulled_by_tag {
+                            flow_job.tag.clone()
+                        } else {
+                            t
+                        })
+                    }
+                }
+            }
+            t => t,
+        };
+        let err = err.or(tag_err.as_ref());
+
        let evaluated_timeout = if let Some(timeout_transform) = &module.timeout {
            let ctx = get_transform_context(&flow_job, &previous_id, &status);

@@ -2,7 +2,7 @@ import { sleep } from "https://deno.land/x/sleep@v1.2.1/mod.ts";
 import * as windmill from "https://deno.land/x/windmill@v1.174.0/mod.ts";
 import * as api from "https://deno.land/x/windmill@v1.174.0/windmill-api/index.ts";

-export const VERSION = "v1.814.0";
+export const VERSION = "v1.815.0";

 export async function login(email: string, password: string): Promise<string> {
  return await windmill.UserService.login({
@@ -1,12 +1,12 @@
 {
  "name": "windmill-chat",
-  "version": "1.814.0",
+  "version": "1.815.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "windmill-chat",
-      "version": "1.814.0",
+      "version": "1.815.0",
      "license": "Apache-2.0",
      "devDependencies": {
        "@ai-sdk/react": "^4.0.102",
@@ -1,7 +1,7 @@
 {
  "name": "windmill-chat",
  "description": "Build chat interfaces on Windmill flows deployed in chat mode, from any frontend or raw app",
-  "version": "1.814.0",
+  "version": "1.815.0",
  "author": "Ruben Fiszel",
  "license": "Apache-2.0",
  "homepage": "https://github.com/windmill-labs/windmill/tree/main/chat-sdk#readme",
@@ -72,7 +72,7 @@ const packageJson = {
    url: "https://github.com/windmill-labs/windmill/issues",
  },
  dependencies: {
-    esbuild: "0.28.0",
+    esbuild: "0.28.2",
    ...Object.fromEntries(parserPackages.map(p => [p, cliDeps[p] ?? "*"])),
  },
  optionalDependencies: {
@@ -11,7 +11,7 @@
        "@cliffy/table": "npm:@jsr/cliffy__table@1.0.0",
        "@windmill-labs/shared-utils": "^1.0.13",
        "diff": "^5.2.0",
-        "esbuild": "0.28.0",
+        "esbuild": "0.28.2",
        "get-port": "7.1.0",
        "jszip": "3.8.0",
        "minimatch": "^10.0.0",
@@ -34,7 +34,7 @@
        "windmill-parser-wasm-ts": "1.695.0",
        "windmill-parser-wasm-yaml": "1.770.0",
        "windmill-yaml-validator": "1.1.1",
-        "ws": "8.18.0",
+        "ws": "8.21.3",
        "yaml": "^2.7.0",
      },
      "devDependencies": {
@@ -57,57 +57,57 @@

    "@cliffy/table": ["@jsr/cliffy__table@1.0.0", "https://npm.jsr.io/~/11/@jsr/cliffy__table/1.0.0.tgz", { "dependencies": { "@jsr/std__fmt": "^1.0.9" } }, "sha512-VoLxH0DjofHWPWKUc5N+oCwXB6O6e+carnhp23yJTa7qokBb+SCrTIABEgQdIe/p0bxgmZhz17xt2efaAxXvbQ=="],

-    "@esbuild/aix-ppc64": ["@esbuild/aix-ppc64@0.28.0", "", { "os": "aix", "cpu": "ppc64" }, "sha512-lhRUCeuOyJQURhTxl4WkpFTjIsbDayJHih5kZC1giwE+MhIzAb7mEsQMqMf18rHLsrb5qI1tafG20mLxEWcWlA=="],
+    "@esbuild/aix-ppc64": ["@esbuild/aix-ppc64@0.28.2", "", { "os": "aix", "cpu": "ppc64" }, "sha512-XExcO+dvLKvVtNTibSTBej1NCAbaGhWn9Ww1ZPx80qsahhPFe/8jgWP0IchNe0F3HwkU7n8ejhH8bjonqht8mQ=="],

-    "@esbuild/android-arm": ["@esbuild/android-arm@0.28.0", "", { "os": "android", "cpu": "arm" }, "sha512-wqh0ByljabXLKHeWXYLqoJ5jKC4XBaw6Hk08OfMrCRd2nP2ZQ5eleDZC41XHyCNgktBGYMbqnrJKq/K/lzPMSQ=="],
+    "@esbuild/android-arm": ["@esbuild/android-arm@0.28.2", "", { "os": "android", "cpu": "arm" }, "sha512-kXXoiPVVGQcnIYGOeaovwOURpniDBpSq4A03qkQ+BMQqtGG6HYap3xne9C1O1yo4TR3qxlCX5IqqmX6fFo2Lqg=="],

-    "@esbuild/android-arm64": ["@esbuild/android-arm64@0.28.0", "", { "os": "android", "cpu": "arm64" }, "sha512-+WzIXQOSaGs33tLEgYPYe/yQHf0WTU0X42Jca3y8NWMbUVhp7rUnw+vAsRC/QiDrdD31IszMrZy+qwPOPjd+rw=="],
+    "@esbuild/android-arm64": ["@esbuild/android-arm64@0.28.2", "", { "os": "android", "cpu": "arm64" }, "sha512-5YfKeeI8qWfBZIX+u2xZC3Zlb3Os/gLS2sbEKM+I4ZOcsWmHS2WLysCcQZDAFRslDUU5Oiq44gf6PYN1vGwG5A=="],

-    "@esbuild/android-x64": ["@esbuild/android-x64@0.28.0", "", { "os": "android", "cpu": "x64" }, "sha512-+VJggoaKhk2VNNqVL7f6S189UzShHC/mR9EE8rDdSkdpN0KflSwWY/gWjDrNxxisg8Fp1ZCD9jLMo4m0OUfeUA=="],
+    "@esbuild/android-x64": ["@esbuild/android-x64@0.28.2", "", { "os": "android", "cpu": "x64" }, "sha512-O387ite7SzUyCcy3JQX4P4bLtEA7bLLkx+esve5JHnyYfNTxcVpXZo9jhdB0lTKN44gztELTdU7nS8Nr16Fs1Q=="],

-    "@esbuild/darwin-arm64": ["@esbuild/darwin-arm64@0.28.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-0T+A9WZm+bZ84nZBtk1ckYsOvyA3x7e2Acj1KdVfV4/2tdG4fzUp91YHx+GArWLtwqp77pBXVCPn2We7Letr0Q=="],
+    "@esbuild/darwin-arm64": ["@esbuild/darwin-arm64@0.28.2", "", { "os": "darwin", "cpu": "arm64" }, "sha512-n4KqkOQrraxHJcgjM1RvwbigfQKIKJVpM7xp+KsxiyUSrRdIXnt73VhrPAx0fV44hgfmIVKjxMN9J1t5jySVkw=="],

-    "@esbuild/darwin-x64": ["@esbuild/darwin-x64@0.28.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-fyzLm/DLDl/84OCfp2f/XQ4flmORsjU7VKt8HLjvIXChJoFFOIL6pLJPH4Yhd1n1gGFF9mPwtlN5Wf82DZs+LQ=="],
+    "@esbuild/darwin-x64": ["@esbuild/darwin-x64@0.28.2", "", { "os": "darwin", "cpu": "x64" }, "sha512-uq6suIWYP37qzGddBKPw5QEQPi6HiLGsO7UmkpfyaYNQ3D+rN6w6WfwH+nuqcGXWvawGwxOEroO4YGnFh95azw=="],

-    "@esbuild/freebsd-arm64": ["@esbuild/freebsd-arm64@0.28.0", "", { "os": "freebsd", "cpu": "arm64" }, "sha512-l9GeW5UZBT9k9brBYI+0WDffcRxgHQD8ShN2Ur4xWq/NFzUKm3k5lsH4PdaRgb2w7mI9u61nr2gI2mLI27Nh3Q=="],
+    "@esbuild/freebsd-arm64": ["@esbuild/freebsd-arm64@0.28.2", "", { "os": "freebsd", "cpu": "arm64" }, "sha512-n+I0BTSRIoy+d6RPKnEVwql5UwBJolytvY4mAOIEJorKlqgPII8ix6slVVrfZ5Tnj7glIZvloylbB/EJPMWEXw=="],

-    "@esbuild/freebsd-x64": ["@esbuild/freebsd-x64@0.28.0", "", { "os": "freebsd", "cpu": "x64" }, "sha512-BXoQai/A0wPO6Es3yFJ7APCiKGc1tdAEOgeTNy3SsB491S3aHn4S4r3e976eUnPdU+NbdtmBuLncYir2tMU9Nw=="],
+    "@esbuild/freebsd-x64": ["@esbuild/freebsd-x64@0.28.2", "", { "os": "freebsd", "cpu": "x64" }, "sha512-78XJTJkvPs0kz2w61301PJjXl4g7q3JqiYMZ/M/yVI73EHBrCRTgkhu9oqG7vPqq+a/yadEW8aD+agKlk5xrmg=="],

-    "@esbuild/linux-arm": ["@esbuild/linux-arm@0.28.0", "", { "os": "linux", "cpu": "arm" }, "sha512-CjaaREJagqJp7iTaNQjjidaNbCKYcd4IDkzbwwxtSvjI7NZm79qiHc8HqciMddQ6CKvJT6aBd8lO9kN/ZudLlw=="],
+    "@esbuild/linux-arm": ["@esbuild/linux-arm@0.28.2", "", { "os": "linux", "cpu": "arm" }, "sha512-XlDnu2q5yoqems+xay6wSAcg9DDD7K9RLKZEBOMZm3ckNpJBvOX20tSfby8KfrrhINDyv9V2YVZKY/SpoGJI8w=="],

-    "@esbuild/linux-arm64": ["@esbuild/linux-arm64@0.28.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-RVyzfb3FWsGA55n6WY0MEIEPURL1FcbhFE6BffZEMEekfCzCIMtB5yyDcFnVbTnwk+CLAgTujmV/Lgvih56W+A=="],
+    "@esbuild/linux-arm64": ["@esbuild/linux-arm64@0.28.2", "", { "os": "linux", "cpu": "arm64" }, "sha512-pW4AC0P3it8c7do9MVM4p51FzHzdM/TZrerurgRcHJ2WTa1VQ1CIq18xncfpBJw4ojkiZZrKW2yIBWBP92j6Ug=="],

-    "@esbuild/linux-ia32": ["@esbuild/linux-ia32@0.28.0", "", { "os": "linux", "cpu": "ia32" }, "sha512-KBnSTt1kxl9x70q+ydterVdl+Cn0H18ngRMRCEQfrbqdUuntQQ0LoMZv47uB97NljZFzY6HcfqEZ2SAyIUTQBQ=="],
+    "@esbuild/linux-ia32": ["@esbuild/linux-ia32@0.28.2", "", { "os": "linux", "cpu": "ia32" }, "sha512-CYbnj78HsIeA+DhgUKgFCfvNsTHFhMMrinUrMZpDXJXKN8T3XViTZ/+wtHeVxEWY8ewSzTFN+nRmSwO2tZaLUQ=="],

-    "@esbuild/linux-loong64": ["@esbuild/linux-loong64@0.28.0", "", { "os": "linux", "cpu": "none" }, "sha512-zpSlUce1mnxzgBADvxKXX5sl8aYQHo2ezvMNI8I0lbblJtp8V4odlm3Yzlj7gPyt3T8ReksE6bK+pT3WD+aJRg=="],
+    "@esbuild/linux-loong64": ["@esbuild/linux-loong64@0.28.2", "", { "os": "linux", "cpu": "none" }, "sha512-buwkd8nsph4R+ajRvw0qM5Hja/TXQow3ptzWO2EbG/cqcIkHloRrdlBtQlshyYGTNFvfkfJ5tpPLVkY4DtsPfQ=="],

-    "@esbuild/linux-mips64el": ["@esbuild/linux-mips64el@0.28.0", "", { "os": "linux", "cpu": "none" }, "sha512-2jIfP6mmjkdmeTlsX/9vmdmhBmKADrWqN7zcdtHIeNSCH1SqIoNI63cYsjQR8J+wGa4Y5izRcSHSm8K3QWmk3w=="],
+    "@esbuild/linux-mips64el": ["@esbuild/linux-mips64el@0.28.2", "", { "os": "linux", "cpu": "none" }, "sha512-ZVykbDyk7519VwiNb9Lcj9m8XM6v5V9uKPvrEMkkEedVewf+0itkhahp4HDpgERXhwLRpWFypsGbG/J8s0QjJA=="],

-    "@esbuild/linux-ppc64": ["@esbuild/linux-ppc64@0.28.0", "", { "os": "linux", "cpu": "ppc64" }, "sha512-bc0FE9wWeC0WBm49IQMPSPILRocGTQt3j5KPCA8os6VprfuJ7KD+5PzESSrJ6GmPIPJK965ZJHTUlSA6GNYEhg=="],
+    "@esbuild/linux-ppc64": ["@esbuild/linux-ppc64@0.28.2", "", { "os": "linux", "cpu": "ppc64" }, "sha512-CAXl+Dtd9UUuJd8pKKdwh6MLm3MUMiqMPmhZ3tTSXPqfyQ3vDl6R5hZdZ/kYojK4ofXtdfSv1tFq8XzWx3heNQ=="],

-    "@esbuild/linux-riscv64": ["@esbuild/linux-riscv64@0.28.0", "", { "os": "linux", "cpu": "none" }, "sha512-SQPZOwoTTT/HXFXQJG/vBX8sOFagGqvZyXcgLA3NhIqcBv1BJU1d46c0rGcrij2B56Z2rNiSLaZOYW5cUk7yLQ=="],
+    "@esbuild/linux-riscv64": ["@esbuild/linux-riscv64@0.28.2", "", { "os": "linux", "cpu": "none" }, "sha512-GeXCej4IQtU1B+QlDV8W/RRvbzI3O/Stss+/bCXv4lZls5WGRtu2a+3JkA3i4qIUlMXpcHebWpF8AkJhATowuA=="],

-    "@esbuild/linux-s390x": ["@esbuild/linux-s390x@0.28.0", "", { "os": "linux", "cpu": "s390x" }, "sha512-SCfR0HN8CEEjnYnySJTd2cw0k9OHB/YFzt5zgJEwa+wL/T/raGWYMBqwDNAC6dqFKmJYZoQBRfHjgwLHGSrn3Q=="],
+    "@esbuild/linux-s390x": ["@esbuild/linux-s390x@0.28.2", "", { "os": "linux", "cpu": "s390x" }, "sha512-3H1weTYZPxt/WOhByszQZybS9w5lKzUn1FDMsgEChbHWQwHYQQRfBxgCcZvPhjHfKyJjIievvMmEUawJrdY9Dg=="],

-    "@esbuild/linux-x64": ["@esbuild/linux-x64@0.28.0", "", { "os": "linux", "cpu": "x64" }, "sha512-us0dSb9iFxIi8srnpl931Nvs65it/Jd2a2K3qs7fz2WfGPHqzfzZTfec7oxZJRNPXPnNYZtanmRc4AL/JwVzHQ=="],
+    "@esbuild/linux-x64": ["@esbuild/linux-x64@0.28.2", "", { "os": "linux", "cpu": "x64" }, "sha512-4xTZr1FUmSoQW4XIWmit3tzQrUTZM+N3P0XV8xROKYF50XfI7xeO90+1bZvNwxIufQ9hDQVRJH5YhgPVF8A/HQ=="],

-    "@esbuild/netbsd-arm64": ["@esbuild/netbsd-arm64@0.28.0", "", { "os": "none", "cpu": "arm64" }, "sha512-CR/RYotgtCKwtftMwJlUU7xCVNg3lMYZ0RzTmAHSfLCXw3NtZtNpswLEj/Kkf6kEL3Gw+BpOekRX0BYCtklhUw=="],
+    "@esbuild/netbsd-arm64": ["@esbuild/netbsd-arm64@0.28.2", "", { "os": "none", "cpu": "arm64" }, "sha512-sSATRjPeDBg3pdgHoQfoYBob11Kk1FGa9lui5RIHZCoCkJa9QKlvl3/vKz2usCmYYjs7ymJR/2Nnsqe+Hjt5nw=="],

-    "@esbuild/netbsd-x64": ["@esbuild/netbsd-x64@0.28.0", "", { "os": "none", "cpu": "x64" }, "sha512-nU1yhmYutL+fQ71Kxnhg8uEOdC0pwEW9entHykTgEbna2pw2dkbFSMeqjjyHZoCmt8SBkOSvV+yNmm94aUrrqw=="],
+    "@esbuild/netbsd-x64": ["@esbuild/netbsd-x64@0.28.2", "", { "os": "none", "cpu": "x64" }, "sha512-lqnzCV+mM0gIADaKihiCg6ifgfU2L3h5E33rNQBN1Y4MaVGnzryzmvvf7UHxprpQdE8hpqLolJ9Rl+SkIRDpyw=="],

-    "@esbuild/openbsd-arm64": ["@esbuild/openbsd-arm64@0.28.0", "", { "os": "openbsd", "cpu": "arm64" }, "sha512-cXb5vApOsRsxsEl4mcZ1XY3D4DzcoMxR/nnc4IyqYs0rTI8ZKmW6kyyg+11Z8yvgMfAEldKzP7AdP64HnSC/6g=="],
+    "@esbuild/openbsd-arm64": ["@esbuild/openbsd-arm64@0.28.2", "", { "os": "openbsd", "cpu": "arm64" }, "sha512-AL2qJILH7lNjrDmCQDvdxMfAUIv8KMNZOvrwAQ8i8//ntL9FflhOyMJ8OZSMBb8/AWXe3/5v5S20y3zCoZWKoQ=="],

-    "@esbuild/openbsd-x64": ["@esbuild/openbsd-x64@0.28.0", "", { "os": "openbsd", "cpu": "x64" }, "sha512-8wZM2qqtv9UP3mzy7HiGYNH/zjTA355mpeuA+859TyR+e+Tc08IHYpLJuMsfpDJwoLo1ikIJI8jC3GFjnRClzA=="],
+    "@esbuild/openbsd-x64": ["@esbuild/openbsd-x64@0.28.2", "", { "os": "openbsd", "cpu": "x64" }, "sha512-QtiuPytchRyC4rwUKhexJdQKvDuZ6hWloi3igqPQNUJCS1/v9EiO3UTOXR6A3FoMo4fnAKbWJdqaIwhOzh8qEw=="],

-    "@esbuild/openharmony-arm64": ["@esbuild/openharmony-arm64@0.28.0", "", { "os": "none", "cpu": "arm64" }, "sha512-FLGfyizszcef5C3YtoyQDACyg95+dndv79i2EekILBofh5wpCa1KuBqOWKrEHZg3zrL3t5ouE5jgr94vA+Wb2w=="],
+    "@esbuild/openharmony-arm64": ["@esbuild/openharmony-arm64@0.28.2", "", { "os": "none", "cpu": "arm64" }, "sha512-WkhYDmpTjLvGlScA1rwjRUmhl4k8oXR3cIbtqWmELgU/dFeHHlEllxDvdWcNJV9rbzCexB5vz8gtNewWLgCT7Q=="],

-    "@esbuild/sunos-x64": ["@esbuild/sunos-x64@0.28.0", "", { "os": "sunos", "cpu": "x64" }, "sha512-1ZgjUoEdHZZl/YlV76TSCz9Hqj9h9YmMGAgAPYd+q4SicWNX3G5GCyx9uhQWSLcbvPW8Ni7lj4gDa1T40akdlw=="],
+    "@esbuild/sunos-x64": ["@esbuild/sunos-x64@0.28.2", "", { "os": "sunos", "cpu": "x64" }, "sha512-GPMSkTOtMnv2U2F8gxe4Io6qmVs+YKyp832Etqqxr0hFngmXQ3rzwytelm3GIn7T4VviRUlf3sOgBOiTdvaf7g=="],

-    "@esbuild/win32-arm64": ["@esbuild/win32-arm64@0.28.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-Q9StnDmQ/enxnpxCCLSg0oo4+34B9TdXpuyPeTedN/6+iXBJ4J+zwfQI28u/Jl40nOYAxGoNi7mFP40RUtkmUA=="],
+    "@esbuild/win32-arm64": ["@esbuild/win32-arm64@0.28.2", "", { "os": "win32", "cpu": "arm64" }, "sha512-PIhhEkE9uPBleRBrQEJpUn7MBnibZzbGzYWPmY3x+YoVg/95zbjB4CxPPOQ8l5tYYM4mMaCthF8/1DIfBQQyWQ=="],

-    "@esbuild/win32-ia32": ["@esbuild/win32-ia32@0.28.0", "", { "os": "win32", "cpu": "ia32" }, "sha512-zF3ag/gfiCe6U2iczcRzSYJKH1DCI+ByzSENHlM2FcDbEeo5Zd2C86Aq0tKUYAJJ1obRP84ymxIAksZUcdztHA=="],
+    "@esbuild/win32-ia32": ["@esbuild/win32-ia32@0.28.2", "", { "os": "win32", "cpu": "ia32" }, "sha512-YmJbfTlvU7Sdn9BB+4PRES4oB6pxgS37MAONj+hBr/cpXS1aBPKXxNnDbu+QCWPj0o9dgyxeq79g6c5P8KeuYA=="],

-    "@esbuild/win32-x64": ["@esbuild/win32-x64@0.28.0", "", { "os": "win32", "cpu": "x64" }, "sha512-pEl1bO9mfAmIC+tW5btTmrKaujg3zGtUmWNdCw/xs70FBjwAL3o9OEKNHvNmnyylD6ubxUERiEhdsL0xBQ9efw=="],
+    "@esbuild/win32-x64": ["@esbuild/win32-x64@0.28.2", "", { "os": "win32", "cpu": "x64" }, "sha512-5ebpxr3nWMzrL/rnUI755Jkuee0bHL/Gq0WTF9lvcpv73wAp5eu8MfBUgWK9bhWvZjj7yX8etf/8tI8Ney695g=="],

    "@jridgewell/gen-mapping": ["@jridgewell/gen-mapping@0.3.13", "", { "dependencies": { "@jridgewell/sourcemap-codec": "^1.5.0", "@jridgewell/trace-mapping": "^0.3.24" } }, "sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA=="],

@@ -211,7 +211,7 @@

    "diff": ["diff@5.2.2", "", {}, "sha512-vtcDfH3TOjP8UekytvnHH1o1P4FcUdt4eQ1Y+Abap1tk/OB2MWQvcwS2ClCd1zuIhc3JKOx6p3kod8Vfys3E+A=="],

-    "esbuild": ["esbuild@0.28.0", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.28.0", "@esbuild/android-arm": "0.28.0", "@esbuild/android-arm64": "0.28.0", "@esbuild/android-x64": "0.28.0", "@esbuild/darwin-arm64": "0.28.0", "@esbuild/darwin-x64": "0.28.0", "@esbuild/freebsd-arm64": "0.28.0", "@esbuild/freebsd-x64": "0.28.0", "@esbuild/linux-arm": "0.28.0", "@esbuild/linux-arm64": "0.28.0", "@esbuild/linux-ia32": "0.28.0", "@esbuild/linux-loong64": "0.28.0", "@esbuild/linux-mips64el": "0.28.0", "@esbuild/linux-ppc64": "0.28.0", "@esbuild/linux-riscv64": "0.28.0", "@esbuild/linux-s390x": "0.28.0", "@esbuild/linux-x64": "0.28.0", "@esbuild/netbsd-arm64": "0.28.0", "@esbuild/netbsd-x64": "0.28.0", "@esbuild/openbsd-arm64": "0.28.0", "@esbuild/openbsd-x64": "0.28.0", "@esbuild/openharmony-arm64": "0.28.0", "@esbuild/sunos-x64": "0.28.0", "@esbuild/win32-arm64": "0.28.0", "@esbuild/win32-ia32": "0.28.0", "@esbuild/win32-x64": "0.28.0" }, "bin": "bin/esbuild" }, "sha512-sNR9MHpXSUV/XB4zmsFKN+QgVG82Cc7+/aaxJ8Adi8hyOac+EXptIp45QBPaVyX3N70664wRbTcLTOemCAnyqw=="],
+    "esbuild": ["esbuild@0.28.2", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.28.2", "@esbuild/android-arm": "0.28.2", "@esbuild/android-arm64": "0.28.2", "@esbuild/android-x64": "0.28.2", "@esbuild/darwin-arm64": "0.28.2", "@esbuild/darwin-x64": "0.28.2", "@esbuild/freebsd-arm64": "0.28.2", "@esbuild/freebsd-x64": "0.28.2", "@esbuild/linux-arm": "0.28.2", "@esbuild/linux-arm64": "0.28.2", "@esbuild/linux-ia32": "0.28.2", "@esbuild/linux-loong64": "0.28.2", "@esbuild/linux-mips64el": "0.28.2", "@esbuild/linux-ppc64": "0.28.2", "@esbuild/linux-riscv64": "0.28.2", "@esbuild/linux-s390x": "0.28.2", "@esbuild/linux-x64": "0.28.2", "@esbuild/netbsd-arm64": "0.28.2", "@esbuild/netbsd-x64": "0.28.2", "@esbuild/openbsd-arm64": "0.28.2", "@esbuild/openbsd-x64": "0.28.2", "@esbuild/openharmony-arm64": "0.28.2", "@esbuild/sunos-x64": "0.28.2", "@esbuild/win32-arm64": "0.28.2", "@esbuild/win32-ia32": "0.28.2", "@esbuild/win32-x64": "0.28.2" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-HKVLS8dvII+xoKW9kmqxbRKrnWEXfJJr/FZhhJmiqIB0e053QNYFqOBouTMO/k5sID4MvCiUCvv8b9M4h32wIA=="],

    "esm-env": ["esm-env@1.2.2", "", {}, "sha512-Epxrv+Nr/CaL4ZcFGPJIYLWFom+YeV1DqMLHJoEd9SYRxNbaFruBwfEX/kkHUJf55j2+TUbmDcmuilbP1TmXHA=="],

@@ -321,7 +321,7 @@

    "windmill-yaml-validator": ["windmill-yaml-validator@1.1.1", "", { "dependencies": { "@stoplight/yaml": "^4.3.0", "ajv": "^8.17.1" } }, "sha512-CVgAwEoBdJhF39q2N012QffhlGPRIyIWd8gj7NnfG+/lMWgH2k5CBLtKIt6cPF8Bxz+6DGC3st1ARSsecDtbTg=="],

-    "ws": ["ws@8.18.0", "", { "peerDependencies": { "bufferutil": "^4.0.1", "utf-8-validate": ">=5.0.2" }, "optionalPeers": ["bufferutil", "utf-8-validate"] }, "sha512-8VbfWfHLbbwu3+N6OKsOMpBdT4kXPDDB9cJk2bJ6mh9ucxdlnNvH1e+roYkKmN9Nxw2yjz7VzeO9oOz2zJ04Pw=="],
+    "ws": ["ws@8.21.3", "", { "peerDependencies": { "bufferutil": "^4.0.1", "utf-8-validate": ">=5.0.2" }, "optionalPeers": ["bufferutil", "utf-8-validate"] }, "sha512-201TZ/kPWxoPr/OKWjquZR1SWKXcvxdH+e1xrx89b3YbmzLMFCLfnaG1HFIgWzJOEWZ7MvpK++odZufgYR50Rw=="],

    "wsl-utils": ["wsl-utils@0.1.0", "", { "dependencies": { "is-wsl": "^3.1.0" } }, "sha512-h3Fbisa2nKGPxCpm89Hk33lBLsnaGBvctQopaBSOW/uIs6FTe1ATyAnKFJrzVs9vpGdsTe73WF3V4lIsk4Gacw=="],

@@ -23,7 +23,7 @@
    "@cliffy/table": "npm:@jsr/cliffy__table@1.0.0",
    "@windmill-labs/shared-utils": "^1.0.13",
    "diff": "^5.2.0",
-    "esbuild": "0.28.0",
+    "esbuild": "0.28.2",
    "get-port": "7.1.0",
    "jszip": "3.8.0",
    "minimatch": "^10.0.0",
@@ -46,7 +46,7 @@
    "windmill-parser-wasm-ts": "1.695.0",
    "windmill-parser-wasm-yaml": "1.770.0",
    "windmill-yaml-validator": "1.1.1",
-    "ws": "8.18.0",
+    "ws": "8.21.3",
    "yaml": "^2.7.0"
  },
  "devDependencies": {
@@ -2546,9 +2546,9 @@ export function preservePendingScriptLocks(
 }

 // `sync push` never applies the workspace's display name from settings.yaml and
-// applies its color only when the local file carries one (see
-// pushWorkspaceSettings), so on a push the fields it would not apply must
-// compare equal, or the row is listed on every run.
+// applies its color and auto_invite.instance_groups only when the local file
+// carries them (see pushWorkspaceSettings), so on a push the fields it would not
+// apply must compare equal, or the row is listed on every run.
 const isWorkspaceSettingsFile = (p: string) =>
  /^settings(\.[^./\\]+)?\.(yaml|json)$/.test(p);
 function stripUnappliedSettingsFields(local: any, remote: any) {
@@ -2558,6 +2558,20 @@ function stripUnappliedSettingsFields(local: any, remote: any) {
    delete local?.color;
    delete remote?.color;
  }
+  // push reads a missing auto_invite as {} on both sides
+  if (local) local.auto_invite ??= {};
+  if (remote) remote.auto_invite ??= {};
+  const localInvite = local?.auto_invite;
+  const remoteInvite = remote?.auto_invite;
+  if (localInvite?.instance_groups == null) {
+    for (const invite of [localInvite, remoteInvite]) {
+      delete invite?.instance_groups;
+      delete invite?.instance_groups_roles;
+    }
+  } else {
+    localInvite.instance_groups_roles ??= {};
+    if (remoteInvite) remoteInvite.instance_groups_roles ??= {};
+  }
 }

 export async function compareDynFSElement(
@@ -10,4 +10,4 @@ export const WM_FORK_PREFIX = "wm-fork";
 // (e.g. utils.ts) can read it without importing main.ts and creating a circular
 // dependency (main → workspace → utils → main) that triggers a TDZ.
 // Re-exported from main.ts for backwards compatibility.
-export const VERSION = "1.814.0";
+export const VERSION = "1.815.0";
@@ -239,8 +239,19 @@ export async function pushWorkspaceSettings(
    });
  }

-  // Handle auto_invite using grouped format
-  if (!deepEqual(localSettings.auto_invite, settings.auto_invite)) {
+  // Handle auto_invite using grouped format. The domain invite and the instance groups
+  // are applied by separate endpoints, each rewriting only its own keys.
+  const {
+    instance_groups: localGroups,
+    instance_groups_roles: localGroupRoles,
+    ...localDomainInvite
+  } = localSettings.auto_invite ?? {};
+  const {
+    instance_groups: remoteGroups,
+    instance_groups_roles: remoteGroupRoles,
+    ...remoteDomainInvite
+  } = settings.auto_invite ?? {};
+  if (!deepEqual(localDomainInvite, remoteDomainInvite)) {
    log.debug(`Updating auto invite...`);

    const localAutoInvite = localSettings.auto_invite;
@@ -278,6 +289,20 @@ export async function pushWorkspaceSettings(
    }
  }

+  // Only when settings.yaml declares instance_groups: clearing a group removes the
+  // workspace members it granted, so an absent key must never clear it.
+  if (
+    localGroups != undefined &&
+    (!deepEqual(localGroups, remoteGroups) ||
+      !deepEqual(localGroupRoles ?? {}, remoteGroupRoles ?? {}))
+  ) {
+    log.debug(`Updating instance groups...`);
+    await wmill.editInstanceGroups({
+      workspace,
+      requestBody: { groups: localGroups, roles: localGroupRoles ?? {} },
+    });
+  }
+
  if (!deepEqual(localSettings.ai_config, settings.ai_config)) {
    log.debug(`Updating copilot settings...`);
    await wmill.editCopilotConfig({
@@ -25,7 +25,7 @@ type Esbuild = typeof import("esbuild");

 // Version to fall back to if the native host's version can't be read. Keep in
 // sync with the "esbuild" pin in cli/package.json.
-const FALLBACK_VERSION = "0.28.0";
+const FALLBACK_VERSION = "0.28.2";

 let cached: Esbuild | undefined;
 let inFlight: Promise<Esbuild> | undefined;
@@ -320,3 +320,29 @@ test("push: settings.yaml differing only by name or an unset color is not a chan
  });
  expect(await diff(otherColor, remote, skips)).toEqual(["edited settings.yaml"]);
 });
+
+// A push applies auto_invite.instance_groups only when the local file declares
+// them (see pushWorkspaceSettings).
+test("push: settings.yaml without instance_groups is not a change", async () => {
+  const remote = local({
+    "settings.yaml":
+      "name: prod\nauto_invite:\n  enabled: false\n  instance_groups:\n    - eng\n  instance_groups_roles:\n    eng: developer\n",
+  });
+  const undeclared = local({
+    "settings.yaml": "name: prod\nauto_invite:\n  enabled: false\n",
+  });
+  const skips = { includeSettings: true };
+  expect(await diff(undeclared, remote, skips)).toEqual([]);
+
+  const groupsOnlyRemote = local({
+    "settings.yaml": "name: prod\nauto_invite:\n  instance_groups:\n    - eng\n",
+  });
+  const noAutoInvite = local({ "settings.yaml": "name: prod\n" });
+  expect(await diff(noAutoInvite, groupsOnlyRemote, skips)).toEqual([]);
+
+  const otherGroups = local({
+    "settings.yaml":
+      "name: prod\nauto_invite:\n  enabled: false\n  instance_groups: []\n",
+  });
+  expect(await diff(otherGroups, remote, skips)).toEqual(["edited settings.yaml"]);
+});
@@ -0,0 +1,82 @@
+/**
+ * Regression guard: `sync push` (pushWorkspaceSettings) applies the domain invite and
+ * the instance groups of `auto_invite` through their own endpoints, and never clears
+ * instance groups that settings.yaml does not declare.
+ */
+
+import { expect, test, describe, beforeEach, mock } from "bun:test";
+
+let editAutoInviteCalls: unknown[] = [];
+let editInstanceGroupsCalls: unknown[] = [];
+const remoteAutoInvite = {
+  enabled: true,
+  domain: "*",
+  operator: false,
+  mode: "invite",
+  instance_groups: ["eng"],
+  instance_groups_roles: { eng: "developer" },
+};
+
+// Every wmill.* call reachable from pushWorkspaceSettings is stubbed: bun shares one
+// mocked module across test files, and names missing from whichever mock loads first
+// stay missing for the others.
+mock.module("../gen/services.gen.ts", () => ({
+  getSettings: async () => ({ auto_invite: remoteAutoInvite }),
+  getWorkspaceName: async () => "phoenix",
+  changeWorkspaceName: async () => {},
+  changeWorkspaceColor: async () => {},
+  editWebhook: async () => {},
+  editAutoInvite: async (a: unknown) => {
+    editAutoInviteCalls.push(a);
+  },
+  editInstanceGroups: async (a: unknown) => {
+    editInstanceGroupsCalls.push(a);
+  },
+  editErrorHandler: async () => {},
+  editSuccessHandler: async () => {},
+  editCopilotConfig: async () => {},
+  editLargeFileStorageConfig: async () => {},
+  editWorkspaceGitSyncConfig: async () => {},
+  editWorkspaceDefaultApp: async () => {},
+  editDefaultScripts: async () => {},
+  workspaceMuteCriticalAlertsUi: async () => {},
+  updateOperatorSettings: async () => {},
+  editDataTableConfig: async () => {},
+  editSlackCommand: async () => {},
+  setWorkspaceSlackOauthConfig: async () => {},
+  deleteWorkspaceSlackOauthConfig: async () => {},
+}));
+
+const { pushWorkspaceSettings } = await import("../src/core/settings.ts");
+
+describe("pushWorkspaceSettings auto_invite", () => {
+  beforeEach(() => {
+    editAutoInviteCalls = [];
+    editInstanceGroupsCalls = [];
+  });
+
+  test("an instance-group-only change updates the groups and leaves the domain invite", async () => {
+    await pushWorkspaceSettings("phoenix", "settings", undefined, {
+      name: "phoenix",
+      auto_invite: { ...remoteAutoInvite, instance_groups_roles: { eng: "admin" } },
+    });
+    expect(editAutoInviteCalls.length).toBe(0);
+    expect(editInstanceGroupsCalls).toEqual([
+      {
+        workspace: "phoenix",
+        requestBody: { groups: ["eng"], roles: { eng: "admin" } },
+      },
+    ]);
+  });
+
+  test("a settings.yaml without instance_groups does not clear them", async () => {
+    const { instance_groups: _g, instance_groups_roles: _r, ...domainInvite } =
+      remoteAutoInvite;
+    await pushWorkspaceSettings("phoenix", "settings", undefined, {
+      name: "phoenix",
+      auto_invite: { ...domainInvite, operator: true },
+    });
+    expect(editAutoInviteCalls.length).toBe(1);
+    expect(editInstanceGroupsCalls.length).toBe(0);
+  });
+});
@@ -31,6 +31,7 @@ mock.module("../gen/services.gen.ts", () => ({
    editWebhookCalls.push(a);
  },
  editAutoInvite: async () => {},
+  editInstanceGroups: async () => {},
  editErrorHandler: async () => {},
  editSuccessHandler: async () => {},
  editCopilotConfig: async () => {},
@@ -110,11 +110,12 @@ WORKDIR /multiplayer

 # Copy multiplayer server files
 COPY multiplayer/package.json .
+COPY multiplayer/package-lock.json .
 COPY multiplayer/server.mjs .
 COPY multiplayer/gateway.mjs .

 # Install dependencies
-RUN npm install
+RUN npm ci --omit=dev

 # ============================================================================
 # Entrypoint Setup
@@ -12,14 +12,36 @@ Symbols, not line numbers, are cited: they drift less.
  by `create_session_token` (`windmill-api-users/src/users.rs`). `GET /api/users/refresh_token`
  mints one for any non-job token but returns plain text, no redirect.
 - **`tokens/impersonate`** (superadmin) returns a multi-use token and sets no cookie.
- **A token's label decides whether its expiry raises alerts.** When `delete_expired_items`
-  removes an expired `token` row, the monitor emails the owner and raises a critical alert (if
-  enabled); rows registered by `register_token_expiry_notification` also get an "expiring soon"
-  warning first. Neither happens when `is_user_token` (`windmill-common/src/auth.rs`) reserves
-  the label, so a token the system mints for itself, whether from the backend or from the frontend
-  through `tokens/create`, needs a reserved label. An `ephemeral-` prefix needs no other change
-  (keep it clear of `is_server_minted_label` if minted through `tokens/create`); a new prefix
-  also goes into the SQL and Svelte mirrors that function's doc lists.
+- **`max_token_expiration_days`** caps `POST /users/tokens/create` and `tokens/impersonate`, by
+  shortening the stored expiration (`cap_token_expiration`), never by refusing: the CLI
+  authorization page, `wmill user create-token` and the editor's language-server token all pick a
+  lifetime without reading the setting, and CLIs already installed never will. The CLI signs in
+  again on its own when its token expires, which is why the authorization page labels it
+  `cli-login:<username>`, reserved in `is_user_token` so its expiry does not email the user. A token
+  owned by a service account is exempt: one in the workspace the token names, or in any workspace
+  for a workspace-less token (for `tokens/impersonate`, the impersonated account). Any workspace
+  admin can therefore create and impersonate a service account to hold an uncapped token, so the
+  ceiling bounds personal tokens only. Only the stored expiration is capped: the auth lookup never
+  reads the setting, so tokens that exist when it is turned on or lowered keep theirs, including
+  none. Deliberately outside it: server-side mints (`create_token_internal` callers such as native
+  trigger webhook tokens, which never expire for GitHub and Nextcloud), and tokens with their own
+  fixed lifetime that outlive a short ceiling: sessions (`MAX_SESSION_VALIDITY_SECONDS`, 3 days, and
+  re-mintable through `GET /users/refresh_token`) and MCP OAuth access tokens (7 days, with a
+  rotating 30-day refresh token). Any logged-in user can read the setting through `GET
+  /settings/global/{key}`, which the token form uses to offer only expirations within it. The
+  settings API and config sync reject any value `parse_max_token_expiration_days` cannot read, since
+  the token routes would read it as no ceiling; `parseMaxTokenExpirationDays` in the frontend must
+  accept exactly the same values.
+- **A token's label decides whether its expiry raises alerts.** When `delete_expired_items` removes
+  an expired `token` row, the monitor emails the owner and raises a critical alert (if enabled);
+  rows registered by `register_token_expiry_notification` also get an "expiring soon" warning first,
+  except a token whose whole lifetime fits in `TOKEN_EXPIRY_WARNING_DAYS` (7), which gets no row
+  since the warning would arrive minutes after it was created. Neither happens when `is_user_token`
+  (`windmill-common/src/auth.rs`) reserves the label, so a token the system mints for itself,
+  whether from the backend or from the frontend through `tokens/create`, needs a reserved label. An
+  `ephemeral-` prefix needs no other change (keep it clear of `is_server_minted_label` if minted
+  through `tokens/create`); a new prefix also goes into the SQL and Svelte mirrors that function's
+  doc lists.
 - **Every superadmin route refuses a job token**: `require_super_admin`
  (`windmill-api-auth/src/lib.rs`) errors on `authed.job_id.is_some()`. A script that needs
  `users/create`, `tokens/impersonate`, `set_login_type`, … must use a dedicated superadmin user
@@ -29,8 +51,10 @@ Symbols, not line numbers, are cited: they drift less.
  the account into a `password` one in the same statement (an account created ahead of its owner
  gets its first credential that way, or through the OAuth claim below).
 - **Login links** (`login_link` table, `POST /users/login_links` superadmin-only,
-  `GET /auth/login_link/{token}` unauthenticated): single-use, ≤15 min, a session cookie and a
-  302 to a same-origin `rd`. `require_login_type` on the mint refuses (409) an account whose
+  `GET /auth/login_link/{token}` unauthenticated): single-use, ≤2 h, a session cookie and a
+  302 to a same-origin `rd`. A link minted with `confirm` is the `/user/login_link` page
+  instead, which spends it only on a click (`POST` to the same path, answering `{location}`), so
+  a mail scanner opening it does not. `require_login_type` on the mint refuses (409) an account whose
  `login_type` has moved on — the way a caller re-entering an account it created stops being
  able to once the owner has a password or a provider.
 - **Pre-approved trial offer** (`cloud_trial_offer`, cloud-only routes under
@@ -1,6 +1,6 @@
 {
 	"name": "@windmill-labs/components",
-	"version": "1.814.0",
+	"version": "1.815.0",
 	"scripts": {
 		"dev": "vite dev",
 		"dev:ui-builder": "mv static/ui_builder static/ui_builder.dev-disabled 2>/dev/null || true ; trap 'mv static/ui_builder.dev-disabled static/ui_builder 2>/dev/null || true' EXIT ; vite dev",
@@ -28,14 +28,13 @@
 		"@melt-ui/svelte": "^0.86.2",
 		"@playwright/test": "^1.57.0",
 		"@sveltejs/adapter-static": "^3.0.6",
-		"@sveltejs/kit": "^2.53.4",
+		"@sveltejs/kit": "^2.69.1",
 		"@sveltejs/package": "^2.5.7",
 		"@sveltejs/vite-plugin-svelte": "^7.0.0",
 		"@tailwindcss/forms": "^0.5.3",
 		"@tailwindcss/typography": "^0.5.8",
 		"@types/d3": "^7.4.0",
 		"@types/d3-zoom": "^3.0.3",
-		"@types/diff": "^7.0.1",
 		"@types/lodash": "^4.14.195",
 		"@types/vscode": "^1.83.5",
 		"@typescript-eslint/eslint-plugin": "^5.59.8",
@@ -59,7 +58,7 @@
 		"prettier-plugin-svelte": "^3.3.3",
 		"style-to-object": "^0.4.1",
 		"stylelint-config-recommended": "^13.0.0",
-		"svelte": "^5.53.5",
+		"svelte": "^5.55.7",
 		"svelte-awesome-color-picker": "^3.0.4",
 		"svelte-check": "^4.4.3",
 		"svelte-fast-check": "^0.4.5",
@@ -70,19 +69,22 @@
 		"svelte-range-slider-pips": "^2.3.1",
 		"svelte-splitpanes": "^8.0.9",
 		"tailwindcss": "^3.4.1",
-		"tar": "^7.5.4",
+		"tar": "^7.5.18",
 		"tslib": "^2.6.1",
 		"typescript": "^5.5.0",
 		"vite": "^8.2.0",
 		"vite-plugin-mkcert": "^2.0.0",
-		"vitest": "^4.1.0",
+		"vitest": "^4.1.11",
 		"vitest-browser-svelte": "^2.0.1"
 	},
 	"overrides": {
 		"monaco-graphql": {
 			"monaco-editor": "$monaco-editor"
 		},
-		"tar": "$tar"
+		"tar": "$tar",
+		"dompurify": "$dompurify",
+		"cookie": "^0.7.0",
+		"handlebars": "^4.7.9"
 	},
 	"type": "module",
 	"dependencies": {
@@ -117,8 +119,8 @@
 		"clone": "^2.1.2",
 		"d3-zoom": "^3.0.0",
 		"date-fns": "^2.30.0",
-		"diff": "^7.0.0",
-		"dompurify": "^3.3.1",
+		"diff": "^8.0.3",
+		"dompurify": "^3.4.13",
 		"driver.js": "^1.3.0",
 		"esm-env": "^1.0.0",
 		"fast-equals": "^5.0.1",
@@ -130,8 +132,8 @@
 		"lru-cache": "^11.1.0",
 		"lucide-svelte": "^0.540.0",
 		"mdast-util-find-and-replace": "^3.0.2",
-		"mermaid": "^11.15.0",
-		"minimatch": "^10.0.1",
+		"mermaid": "^11.16.1",
+		"minimatch": "^10.2.3",
 		"modern-screenshot": "^4.7.0",
 		"monaco-editor": "npm:@codingame/monaco-vscode-editor-api@=25.0.0",
 		"monaco-languageclient": "10.6.0",
@@ -178,7 +180,7 @@
 		"xterm-readline": "^1.1.2",
 		"y-monaco": "^0.1.4",
 		"y-websocket": "^1.5.4",
-		"yaml": "^2.8.0",
+		"yaml": "^2.8.3",
 		"yjs": "^13.6.7",
 		"zod": "^4.1.10"
 	},
@@ -3,7 +3,10 @@
@tailwind components;
@tailwind utilities;

-@media (min-width: 1760px) {
+/* Keyed on the screen, not the window: a viewport query rescales the whole app
+   whenever the window is resized or split. Mirrored in editorFontSize.svelte.ts,
+   TextInput.svelte's leading classes and FlowGraphPreviewButton.svelte. */
+@media (min-device-width: 1760px) {
 	:root {
 		font-size: 18px;
 	}
@@ -1,281 +0,0 @@
-<script lang="ts">
-	import type { GraphModuleState } from './graph'
-	import {
-		JobService,
-		type CompletedJob,
-		type FlowModule,
-		type FlowStatusModule,
-		type Job
-	} from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
-	import FlowLogViewerWrapper from './FlowLogViewerWrapper.svelte'
-	import { z } from 'zod'
-	import { untrack } from 'svelte'
-	import type { AgentTool } from './flows/agentToolUtils'
-
-	type AgentActionWithContent = NonNullable<FlowStatusModule['agent_actions']>[number] & {
-		content?: unknown
-	}
-
-	const resultSchema = z.object({
-		messages: z.array(
-			z.object({
-				role: z.string(),
-				content: z.unknown(),
-				agent_action: z
-					.union([
-						z.object({
-							type: z.literal('tool_call'),
-							job_id: z.string(),
-							module_id: z.string(),
-							function_name: z.string()
-						}),
-						z.object({
-							type: z.literal('mcp_tool_call'),
-							call_id: z.string(),
-							function_name: z.string(),
-							resource_path: z.string(),
-							arguments: z.record(z.any(), z.any()).optional()
-						}),
-						z.object({
-							type: z.literal('message')
-						}),
-						z.object({
-							type: z.literal('web_search')
-						})
-					])
-					.optional()
-			})
-		)
-	})
-
-	interface Props {
-		tools: AgentTool[]
-		agentJob: Partial<CompletedJob> & Pick<CompletedJob, 'id'> & { type: 'CompletedJob' }
-		workspaceId?: string | undefined
-		storedToolCallJobs?: Record<number, Job>
-		onToolJobLoaded?: (job: Job, idx: number) => void
-		noPadding?: boolean
-	}
-
-	let {
-		tools,
-		agentJob,
-		workspaceId,
-		onToolJobLoaded,
-		storedToolCallJobs,
-		noPadding = false
-	}: Props = $props()
-
-	const fakeModuleStates: Record<string, GraphModuleState> = $state({})
-
-	async function loadMissingJobs(
-		agentActions: AgentActionWithContent[],
-		gen: number
-	): Promise<Record<string, GraphModuleState>> {
-		const states: Record<string, GraphModuleState> = {}
-		const promises = agentActions.map(async (toolCall, idx) => {
-			if (toolCall.type === 'tool_call') {
-				let job: Job | undefined = storedToolCallJobs?.[idx]
-
-				if (!job || job.type !== 'CompletedJob') {
-					job = await JobService.getJob({
-						id: toolCall.job_id,
-						workspace: workspaceId ?? $workspaceStore!
-					})
-				}
-				states[idx.toString()] = {
-					args: job.args,
-					type: job['success'] ? 'Success' : 'Failure',
-					logs: job.logs,
-					result: job['result'],
-					job_id: toolCall.job_id
-				}
-				// Keyed by index in the parent's cache, so a superseded run must not write into it.
-				if (gen === loadGen) {
-					onToolJobLoaded?.(job, idx)
-				}
-			} else if (toolCall.type === 'mcp_tool_call') {
-				states[idx.toString()] = {
-					type: 'Success',
-					args: toolCall.arguments ?? {},
-					logs: '',
-					result: toolCall.content
-				}
-			} else if (toolCall.type === 'web_search') {
-				states[idx.toString()] = {
-					type: 'Success',
-					args: {},
-					logs: '',
-					result: toolCall.content
-				}
-			} else {
-				states[idx.toString()] = {
-					type: 'Success',
-					args: {},
-					logs: '',
-					result: toolCall.content
-				}
-			}
-		})
-
-		await Promise.all(promises)
-		return states
-	}
-
-	let job: Partial<Job> | undefined = $state(undefined)
-	// Every prop change starts another load; only the newest may write the shared view, else a
-	// slower reload for a previous run restores its logs over the one now selected.
-	let loadGen = 0
-	async function loadToolCalls(agentJob: Props['agentJob'], tools: AgentTool[]) {
-		const gen = ++loadGen
-		let parsedResult = resultSchema.safeParse(agentJob.result)
-		if (!parsedResult.success) {
-			console.error('Invalid result', parsedResult.error)
-			// A failed agent job has no parseable action list. Drop the view rather than leave the
-			// previously selected step's tool tree rendered under this one's header.
-			if (gen === loadGen) {
-				job = undefined
-				for (const key of Object.keys(fakeModuleStates)) {
-					delete fakeModuleStates[key]
-				}
-			}
-			return
-		}
-		let agentActions = parsedResult.data.messages
-			.map(
-				(m) =>
-					(m.agent_action?.type === 'message'
-						? {
-								type: 'message',
-								content: m.content
-							}
-						: m.agent_action?.type === 'tool_call'
-							? {
-									type: 'tool_call',
-									job_id: m.agent_action.job_id,
-									module_id: m.agent_action.module_id,
-									function_name: m.agent_action.function_name
-								}
-							: m.agent_action?.type === 'mcp_tool_call'
-								? {
-										type: 'mcp_tool_call',
-										content: m.content,
-										call_id: m.agent_action.call_id,
-										function_name: m.agent_action.function_name,
-										arguments: m.agent_action.arguments
-									}
-								: m.agent_action?.type === 'web_search'
-									? {
-											type: 'web_search',
-											content: m.content
-										}
-									: undefined) as AgentActionWithContent | undefined
-			)
-			.filter((m) => m !== undefined)
-
-		const states = await loadMissingJobs(agentActions, gen)
-		if (gen !== loadGen) {
-			return
-		}
-		for (const key of Object.keys(fakeModuleStates)) {
-			delete fakeModuleStates[key]
-		}
-		Object.assign(fakeModuleStates, states)
-
-		job = {
-			...agentJob,
-			raw_flow: {
-				modules: agentActions
-					.map((toolCall, idx) => {
-						if (toolCall.type === 'message') {
-							return {
-								id: idx.toString(),
-								value: {
-									type: 'identity' as const
-								}
-							}
-						} else if (toolCall.type === 'mcp_tool_call') {
-							return {
-								id: idx.toString(),
-								value: {
-									type: 'identity' as const
-								},
-								summary: toolCall.function_name,
-								arguments: toolCall.arguments
-							}
-						} else if (toolCall.type === 'web_search') {
-							return {
-								id: idx.toString(),
-								value: {
-									type: 'identity' as const
-								},
-								summary: 'Web Search'
-							}
-						} else {
-							const module = tools.find((m) => m.summary === toolCall.function_name)
-							// A definition can be missing for a call that did run: the tool was renamed or
-							// removed since, or it belongs to a linked agent whose resource is no longer
-							// readable. Keep the recorded call — its args, logs and result come from the
-							// child job — rather than dropping it from the history.
-							return module
-								? ({
-										...module,
-										id: idx.toString()
-									} as FlowModule)
-								: ({
-										id: idx.toString(),
-										value: { type: 'identity' as const },
-										summary: toolCall.function_name
-									} as FlowModule)
-						}
-					})
-			}
-		}
-	}
-
-	// Identity, not a summary digest: a refreshed resource can change a tool's path, code or id while
-	// keeping its name and count. The store swaps the array only when its contents actually differ,
-	// so one version per array instance tracks that exactly. An empty list is always the same key,
-	// since callers hand out a fresh [] for it on every render.
-	const toolsVersions = new WeakMap<object, number>()
-	let nextToolsVersion = 0
-	function toolsIdentity(list: AgentTool[]): string {
-		if (list.length === 0) {
-			return 'empty'
-		}
-		let version = toolsVersions.get(list)
-		if (version === undefined) {
-			version = ++nextToolsVersion
-			toolsVersions.set(list, version)
-		}
-		return String(version)
-	}
-
-	// Rebuild when the inputs change, not only on mount: a linked agent's tools resolve
-	// asynchronously after the first render, and switching between completed runs reuses this
-	// component — either would otherwise keep the first snapshot. Keyed by value, because callers
-	// rebuild the `agentJob` object on every render and identity alone would reload in a loop.
-	let reloadKey = $derived(`${agentJob?.id ?? ''}|${toolsIdentity(tools)}`)
-	$effect(() => {
-		reloadKey
-		untrack(() => {
-			if (agentJob) {
-				loadToolCalls(agentJob, tools)
-			}
-		})
-	})
-</script>
-
-{#if job}
-	<div class={noPadding ? '' : 'p-2'}>
-		<FlowLogViewerWrapper
-			{job}
-			localModuleStates={fakeModuleStates}
-			{workspaceId}
-			render={true}
-			onSelectedIteration={async () => {}}
-			mode="aiagent"
-		/>
-	</div>
-{/if}
@@ -0,0 +1,116 @@
+<script lang="ts">
+	import type { Snippet } from 'svelte'
+	import { Badge } from '$lib/components/common'
+	import GfmMarkdown from './GfmMarkdown.svelte'
+	import AgentTrace from './AgentTrace.svelte'
+	import ChatCollapsibleCard from './copilot/chat/ChatCollapsibleCard.svelte'
+	import LabeledDivider from './LabeledDivider.svelte'
+	import WebSearchSourcesDisplay from './copilot/chat/WebSearchSourcesDisplay.svelte'
+	import { buildAgentTrace, splitFinalAnswer } from './agentTrace'
+	import { runPane } from './agentScroll'
+	import { createBottomSticker } from './stickToBottom'
+	import { formatTokenCount, summarizeAgentResult, type AgentResult } from './aiAgentResult'
+
+	interface Props {
+		result: AgentResult
+		workspaceId?: string
+		/** Identifies the run, so a reused viewer lands on the new one's output. */
+		runKey?: string
+		/**
+		 * How to render an output that is not text: whatever the result viewer would do
+		 * with that object on its own, a table for rows or the file viewer for an S3
+		 * object. Passed in rather than imported so this does not reach back into the
+		 * viewer rendering it.
+		 */
+		structuredOutput: Snippet<[unknown]>
+	}
+
+	let { result, workspaceId, runKey, structuredOutput }: Props = $props()
+
+	let summary = $derived(summarizeAgentResult(result))
+	let textOutput = $derived(typeof result.output === 'string' ? result.output : undefined)
+
+	// The turn that produced `output` is not a trace row: the output block below is
+	// that same text, and printing it twice in one scroll reads as the agent having
+	// answered itself. Its citations move down with it.
+	let answer = $derived(splitFinalAnswer(buildAgentTrace(result.messages), result.output))
+	let trace = $derived(answer.trace)
+	let reasoning = $derived(result.reasoning?.trim())
+	let reasoningExpanded = $state(false)
+
+	let anchor: HTMLElement | undefined = $state()
+	const sticker = createBottomSticker()
+	$effect(() => {
+		// Also on arrival from a stream: the run finishing adds the output separator,
+		// so the end has moved from wherever the stream had the reader parked.
+		runKey
+		trace.length
+		reasoning
+		sticker.scrollToEnd(runPane(anchor))
+	})
+</script>
+
+<div bind:this={anchor} class="flex flex-col w-full py-3">
+	{#if trace.length > 0}
+		<AgentTrace entries={trace} {workspaceId} />
+	{/if}
+	{#if reasoning}
+		<!-- The whole run's thinking, which the worker hands back joined rather than
+		     per iteration, so it reads as one block above the answer it led to. -->
+		<ChatCollapsibleCard
+			label="Thinking"
+			expanded={reasoningExpanded}
+			onToggle={() => (reasoningExpanded = !reasoningExpanded)}
+			contentClass="font-main"
+		>
+			<GfmMarkdown md={reasoning} prose="xs" noPadding />
+		</ChatCollapsibleCard>
+	{/if}
+	{#if trace.length > 0 || reasoning}
+		<LabeledDivider class="my-3">
+			<span class="text-2xs text-hint">Output</span>
+		</LabeledDivider>
+	{/if}
+	<div>
+		{#if textOutput !== undefined}
+			{#if textOutput === ''}
+				<span class="text-tertiary text-xs">The agent returned no answer</span>
+			{:else}
+				<!-- A model writes this, and what it writes is steerable by whatever
+					     reached its context — a user message, a tool's output. So it is
+					     untrusted input and goes through the shared sanitizing chain, which
+					     is also what makes it inert on the public replay page. -->
+				<GfmMarkdown md={textOutput} noPadding />
+			{/if}
+		{:else}
+			{@render structuredOutput(result.output)}
+		{/if}
+		{#if answer.sources}
+			<div class="mt-2">
+				<WebSearchSourcesDisplay sources={answer.sources} />
+			</div>
+		{/if}
+	</div>
+
+	<!-- What the run cost, as a footnote to what it produced. -->
+	<div class="flex items-center gap-2 flex-wrap text-xs mt-3">
+		{#if summary.toolCalls > 0}
+			<Badge color="blue">
+				{summary.toolCalls}
+				{summary.toolCalls === 1 ? 'tool call' : 'tool calls'}
+			</Badge>
+		{/if}
+		{#if summary.webSearches > 0}
+			<Badge color="blue">
+				{summary.webSearches}
+				{summary.webSearches === 1 ? 'web search' : 'web searches'}
+			</Badge>
+		{/if}
+		{#if summary.tokens !== undefined}
+			<Badge color="gray">{formatTokenCount(summary.tokens)} tokens</Badge>
+		{/if}
+		{#if summary.cachedTokens}
+			<Badge color="gray">{formatTokenCount(summary.cachedTokens)} cached</Badge>
+		{/if}
+	</div>
+</div>
@@ -0,0 +1,111 @@
+<script lang="ts">
+	import { untrack } from 'svelte'
+	import ChatCollapsibleCard from './copilot/chat/ChatCollapsibleCard.svelte'
+	import GfmMarkdown from './GfmMarkdown.svelte'
+	import { runPane } from './agentScroll'
+	import { createBottomSticker } from './stickToBottom'
+	import {
+		advanceAgentStream,
+		emptyAgentStreamProgress,
+		type AgentStreamProgress
+	} from './aiAgentResult'
+
+	interface Props {
+		/** The raw `result_stream` buffer, which only ever grows for a given run. */
+		raw: string
+		/** Identifies the run, so a viewer reused for another one starts over. */
+		streamKey?: string
+	}
+
+	let { raw, streamKey }: Props = $props()
+
+	let progress: AgentStreamProgress & { key?: string } = $state(emptyAgentStreamProgress())
+
+	$effect(() => {
+		raw
+		streamKey
+		untrack(() => {
+			// A shorter buffer than what was already folded in cannot be a longer
+			// version of the same stream, so treat it as a different one.
+			const continues = progress.key === streamKey && raw.length >= progress.consumed
+			const base = continues ? progress : emptyAgentStreamProgress()
+			progress = { ...advanceAgentStream(raw, base), key: streamKey }
+			if (!continues) {
+				// Another run, so the reader's decision to stop following the previous
+				// one does not carry over: this one starts at its latest output.
+				following = true
+			}
+		})
+	})
+
+	let stream = $derived(progress.stream)
+
+	let anchor: HTMLElement | undefined = $state()
+	// Carry the reader along as the text is written, unless they have scrolled up
+	// to read something — then the pane is theirs until they come back to the end.
+	let following = true
+	const sticker = createBottomSticker()
+
+	// The listener goes on the pane, not on this element: a scroll event fires on
+	// whatever actually scrolled and does not bubble, so a handler here would never
+	// run and the reader would be dragged back on every poll.
+	$effect(() => {
+		const pane = runPane(anchor)
+		if (!pane) {
+			return
+		}
+		const onScroll = () => {
+			if (!sticker.isOwnScroll()) {
+				following = sticker.isAtEnd(pane)
+			}
+		}
+		pane.addEventListener('scroll', onScroll, { passive: true })
+		return () => pane.removeEventListener('scroll', onScroll)
+	})
+
+	$effect(() => {
+		stream.current
+		stream.reasoning
+		stream.entries.length
+		if (following) {
+			sticker.scrollToEnd(runPane(anchor))
+		}
+	})
+</script>
+
+<!-- One gap on the container rather than margins per child, and the same gap the
+     finished trace uses: a turn's text must not shift when a tool call turns it from
+     the live text into a row. The text at the bottom is deliberately unlabelled — a
+     turn that goes on to call a tool was narration, and the run's end settles which. -->
+<div bind:this={anchor} class="flex flex-col w-full py-3 gap-1">
+	{#each stream.entries as entry, index (entry.kind === 'tool' ? entry.callId : index)}
+		{#if entry.kind === 'tool'}
+			<ChatCollapsibleCard
+				label={entry.name}
+				expanded={false}
+				toggleable={false}
+				shimmer={entry.running}
+				onToggle={() => {}}
+				labelClass={entry.success === false ? 'text-red-500' : ''}
+			/>
+		{:else}
+			<div>
+				<GfmMarkdown md={entry.content} noPadding />
+			</div>
+		{/if}
+	{/each}
+
+	{#if stream.current !== ''}
+		<div>
+			<!-- Same sanitizing chain as a finished output: a partial answer is written
+			     by the same model and is no more trusted for arriving in pieces. -->
+			<GfmMarkdown md={stream.current} noPadding />
+		</div>
+	{:else if stream.reasoning !== ''}
+		<!-- Reasoning arrives before the text, so on its own it means the model is
+		     still thinking rather than that this run has nothing to say. -->
+		<div class="text-secondary">
+			<GfmMarkdown md={stream.reasoning} prose="xs" noPadding />
+		</div>
+	{/if}
+</div>
@@ -0,0 +1,135 @@
+<script lang="ts">
+	import { ExternalLink, Globe } from 'lucide-svelte'
+	import { JobService, type Job } from '$lib/gen'
+	import { base } from '$lib/base'
+	import { workspaceStore } from '$lib/stores'
+	import { msToReadableTimeShort } from '$lib/utils'
+	import ChatCollapsibleCard from './copilot/chat/ChatCollapsibleCard.svelte'
+	import ToolContentDisplay from './copilot/chat/ToolContentDisplay.svelte'
+	import WebSearchSourcesDisplay from './copilot/chat/WebSearchSourcesDisplay.svelte'
+	import GfmMarkdown from './GfmMarkdown.svelte'
+	import type { AgentTraceEntry } from './agentTrace'
+	import { SvelteMap, SvelteSet } from 'svelte/reactivity'
+
+	interface Props {
+		entries: AgentTraceEntry[]
+		workspaceId?: string
+	}
+
+	let { entries, workspaceId }: Props = $props()
+
+	let expanded = new SvelteSet<number>()
+	// Row state is keyed by position, which means nothing once the viewer is handed
+	// another run: row 0 would stay open showing the previous run's job.
+	$effect(() => {
+		entries
+		expanded.clear()
+		jobs.clear()
+	})
+	// A tool's own job holds what the envelope does not: its logs, how long it
+	// took, and whether it succeeded. Fetched when a row is opened rather than
+	// upfront, so a run with twenty calls does not issue twenty requests to draw
+	// a list of names.
+	let jobs = new SvelteMap<string, Job | 'loading' | 'failed'>()
+
+	async function loadJob(jobId: string) {
+		if (jobs.has(jobId)) {
+			return
+		}
+		jobs.set(jobId, 'loading')
+		try {
+			jobs.set(
+				jobId,
+				await JobService.getJob({ id: jobId, workspace: workspaceId ?? $workspaceStore! })
+			)
+		} catch {
+			// A tool job can be gone (retention) or unreadable. The row still has its
+			// arguments and result from the envelope, so only the extras are lost.
+			jobs.set(jobId, 'failed')
+		}
+	}
+
+	function toggle(index: number, entry: AgentTraceEntry) {
+		if (expanded.delete(index)) {
+			return
+		}
+		expanded.add(index)
+		if (entry.kind === 'tool' && entry.jobId) {
+			loadJob(entry.jobId)
+		}
+	}
+
+	function jobOf(jobId: string | undefined): Job | undefined {
+		if (!jobId) return undefined
+		const job = jobs.get(jobId)
+		return typeof job === 'object' ? job : undefined
+	}
+
+	function toolLabel(entry: Extract<AgentTraceEntry, { kind: 'tool' }>): string {
+		const job = jobOf(entry.jobId)
+		const duration = job?.['duration_ms']
+		return duration === undefined
+			? entry.name
+			: `${entry.name} · ${msToReadableTimeShort(duration)}`
+	}
+</script>
+
+<div class="flex flex-col w-full min-w-0 gap-1">
+	{#each entries as entry, index (index)}
+		{#if entry.kind === 'assistant'}
+			<div class="min-w-0">
+				<GfmMarkdown md={entry.content} noPadding />
+				{#if entry.sources}
+					<div class="mt-2">
+						<WebSearchSourcesDisplay sources={entry.sources} />
+					</div>
+				{/if}
+			</div>
+		{:else if entry.kind === 'search'}
+			<!-- Nothing to reveal: the worker records only that a search ran, and its
+			     citations render under the assistant turn that follows. -->
+			<ChatCollapsibleCard
+				label="Web search"
+				expanded={false}
+				toggleable={false}
+				onToggle={() => {}}
+			/>
+		{:else}
+			{@const job = jobOf(entry.jobId)}
+			<ChatCollapsibleCard
+				label={toolLabel(entry)}
+				expanded={expanded.has(index)}
+				onToggle={() => toggle(index, entry)}
+				contentClass="space-y-3"
+			>
+				{#if entry.args}
+					<ToolContentDisplay title="Parameters" content={entry.args} toolName={entry.name} />
+				{/if}
+				{#if job?.logs}
+					<ToolContentDisplay title="Logs" content={job.logs} />
+				{/if}
+				<ToolContentDisplay
+					title="Result"
+					content={entry.result}
+					error={job?.type === 'CompletedJob' && !job.success ? entry.result : undefined}
+				/>
+				{#if entry.resourcePath}
+					<div class="text-2xs text-hint flex items-center gap-1">
+						<Globe size={11} />
+						{entry.resourcePath}
+					</div>
+				{:else if entry.jobId}
+					<a
+						class="text-2xs text-accent inline-flex items-center gap-1 w-fit hover:underline"
+						href="{base}/run/{entry.jobId}?workspace={workspaceId ?? $workspaceStore}"
+						target="_blank"
+						rel="noreferrer"
+					>
+						<ExternalLink size={11} />
+						Open job
+					</a>
+				{/if}
+			</ChatCollapsibleCard>
+		{/if}
+	{/each}
+</div>
@@ -39,7 +39,8 @@

 	// Mirrors CUSTOM_TAG_REGEX in backend/windmill-common/src/worker.rs — keep both in sync.
 	const customTagRegex = /^([\w-]+)\(((?:[\w-]+\*?\+)*[\w-]+\*?|(?:\^[\w-]+\*?)+)\)$/
-	const dynamicTagRegex = /\$args\[((?:\w+\.)*\w+)\]/
+	// Mirrors RE_ARG_TAG and RE_FLOW_EXPR_TAG in backend/windmill-queue/src/jobs.rs.
+	const dynamicTagRegex = /\$(args|flow_expr)\[((?:\w+\.)*\w+)\]/

 	function formatWorkspace(w: { id: string; includeForks: boolean }) {
 		return w.includeForks ? `${w.id} (and its forks)` : w.id
@@ -49,7 +50,7 @@
 		let r = newTag.trim()
 		if (r == '') return undefined
 		let matched = r.match(dynamicTagRegex)
-		return matched?.[1]
+		return matched ? { kind: matched[1], path: matched[2] } : undefined
 	})

 	let extractedCustomTag = $derived.by(() => {
@@ -183,7 +184,7 @@
 				</div>
 			</div>
 		{:else if newTag.trim()}
-			{#if newTag.includes('(') || newTag.includes(')') || newTag.includes('+') || newTag.includes('^') || newTag.includes('*') || ((newTag.includes('.') || newTag.includes('$args[')) && !dynamicTag)}
+			{#if newTag.includes('(') || newTag.includes(')') || newTag.includes('+') || newTag.includes('^') || newTag.includes('*') || ((newTag.includes('.') || newTag.includes('$args[') || newTag.includes('$flow_expr[')) && !dynamicTag)}
 				<div class="text-2xs text-primary p-2 bg-surface-secondary rounded border">
 					<div class="font-medium mb-1 text-red-500">Invalid tag</div>
 					<div>
@@ -194,7 +195,7 @@
 			{:else}
 				<div class="text-2xs text-primary p-2 bg-surface-secondary rounded border">
 					<div class="font-medium mb-1">
-						{#if newTag.includes('$workspace') || newTag.includes('$args')}
+						{#if newTag.includes('$workspace') || dynamicTag}
 							Dynamic tag
 						{:else}
 							Simple tag
@@ -207,8 +208,13 @@
 					{#if newTag.includes('$workspace') && !dynamicTag}
 						<div>Interpolated tag based on workspace id the job was created in </div>
 					{/if}
-					{#if dynamicTag}
-						<div>Interpolated tag based on args input of <b>{dynamicTag}</b></div>
+					{#if dynamicTag?.kind == 'flow_expr'}
+						<div>
+							Interpolated tag based on the flow value at <b>{dynamicTag.path}</b>, resolved when
+							the flow step starts
+						</div>
+					{:else if dynamicTag}
+						<div>Interpolated tag based on args input of <b>{dynamicTag.path}</b></div>
 					{/if}
 				</div>
 			{/if}
@@ -252,6 +258,17 @@
 			>
 			based on args input, use <pre class="inline text-emphasis">$args[a.b.c]</pre> where
 			<pre class="inline">a.b.c</pre> is the path to the value in the args object.
+			<br />{#if variant !== 'drawer'}<br />{/if}
+			For
+			<a
+				href="https://www.windmill.dev/docs/core_concepts/worker_groups#dynamic-tag"
+				target="_blank">dynamic tags <ExternalLink size={12} class="inline-block" /></a
+			>
+			based on flow step results, flow input or flow env, use
+			<pre class="inline text-emphasis">$flow_expr[results.a.b.c]</pre> where
+			<pre class="inline">a</pre> is the step id, or
+			<pre class="inline text-emphasis">$flow_expr[flow_input.a.b.c]</pre> and
+			<pre class="inline text-emphasis">$flow_expr[flow_env.a.b.c]</pre>.
 		</span>
 	{/if}
 </div>
@@ -54,6 +54,11 @@
 	import DOMPurify from 'dompurify'
 	import MarkupApprovalGate from './MarkupApprovalGate.svelte'
 	import type { MarkupTrust } from './apps/markupTrust'
+	import AgentResultDisplay from './AgentResultDisplay.svelte'
+	import AgentStreamDisplay from './AgentStreamDisplay.svelte'
+	import AgentTrace from './AgentTrace.svelte'
+	import { isAgentStream, parseAgentErrorMessages, parseAgentResult } from './aiAgentResult'
+	import { buildAgentTrace } from './agentTrace'

 	const TABLE_MAX_SIZE = 5000000
 	const DISPLAY_MAX_SIZE = 100000
@@ -85,6 +90,7 @@
 		| 'map'
 		| 'nondisplayable'
 		| 'pdf'
+		| 'aiagent'
 		| undefined
 	let resultKind: ResultKind = $state()
 	/** Kinds whose renderer leaves the page: S3/ducklake previews fetch the file or
@@ -94,7 +100,10 @@
 	const REPLAY_INERT_KINDS: ResultKind[] = ['s3object', 's3object-list', 'materialized', 'approval']
 	/** Kinds whose markup pulls subresources: DOMPurify stops scripting but keeps
 	 * `<img src>` and SVG `<image href>`, and `map` tiles are requests by
-	 * construction. Kinds absent here carry their bytes as `data:` and reach nothing.
+	 * construction. Kinds absent here carry their bytes as `data:` and reach nothing,
+	 * or render through a component that is itself inert on the public page —
+	 * `aiagent` is the second case, via `GfmMarkdown`, which is why it renders
+	 * markdown yet is not listed while `markdown` still is.
 	 * Inert only on the public page, which promises to issue no requests. */
 	const OFFLINE_INERT_KINDS: ResultKind[] = ['markdown', 'html', 'svg', 'map']
 	let length = $state(1)
@@ -110,6 +119,12 @@
 		filename?: string | undefined
 		disableExpand?: boolean
 		jobId?: string | undefined
+		/**
+		 * Which run this result belongs to. Separate from `jobId`, which the replay
+		 * page withholds so nothing fetches: the agent views still have to tell one
+		 * run from the next, or a second one continues the first one's fold.
+		 */
+		runKey?: string | undefined
 		workspaceId?: string | undefined
 		hideAsJson?: boolean
 		noControls?: boolean
@@ -135,6 +150,7 @@
 		filename = undefined,
 		disableExpand = false,
 		jobId = undefined,
+		runKey = undefined,
 		workspaceId = undefined,
 		hideAsJson = false,
 		noControls = false,
@@ -154,6 +170,16 @@
 		growVertical = false
 	}: Props = $props()
 	let s3FileDisplayRawMode = $state(false)
+	/** What a max-iterations failure got through before it gave up, if this is one.
+	 *  Empty for a run that failed before the worker tagged anything, and for one
+	 *  that predates the tags reaching this payload at all — in which case the
+	 *  section is not rendered rather than heading an empty box. */
+	let agentErrorTrace = $derived.by(() => {
+		const messages = parseAgentErrorMessages(result)
+		if (!messages) return undefined
+		const entries = buildAgentTrace(messages)
+		return entries.length > 0 ? entries : undefined
+	})

 	// Build the image/PDF source URL for an S3 object. When `appPath` is set
 	// (deployed app view) the read is authorized on-behalf of the app author via
@@ -293,6 +319,17 @@
 					return 'materialized'
 				}

+				// Classified before the size caps below: an agent's answer stays small
+				// however long its conversation grows, so a run with a long trace
+				// must not fall back to the JSON tree that hides the answer inside it.
+				// `largeObject` is still set honestly, so switching to JSON gets the
+				// same too-big handling as any other oversized result.
+				if (parseAgentResult(result)) {
+					is_render_all = false
+					largeObject = roughSizeOfObject(result) > DISPLAY_MAX_SIZE
+					return 'aiagent'
+				}
+
 				is_render_all =
 					keys.length == 1 && keys.includes('render_all') && Array.isArray(result['render_all'])

@@ -731,7 +768,13 @@
 		<div class="flex items-center gap-2 text-secondary text-xs">
 			<Loader2 class="animate-spin" size={14} /> Streaming result
 		</div>
-		<ResultStreamDisplay {result_stream} />
+		{#if isAgentStream(result_stream)}
+			<!-- An agent streams one JSON event per line, so the raw stream is a wall of
+			     event objects rather than the answer being written. -->
+			<AgentStreamDisplay raw={result_stream} streamKey={runKey ?? jobId} />
+		{:else}
+			<ResultStreamDisplay {result_stream} />
+		{/if}
 	</div>
 {:else if is_render_all}
 	<div class="flex flex-col w-full gap-2">
@@ -973,6 +1016,16 @@
 						{/if}
 						{@render children?.()}
 					</div>
+					{#if agentErrorTrace}
+						<!-- A run stopped by max_iterations fails, so the error above is what it
+						     returned. What it managed to do rides inside that error and is the
+						     whole reason to look at such a run, so it is added under the error
+						     rather than replacing it. -->
+						<div class="flex flex-col gap-1 pt-4 w-full min-w-0">
+							<span class="text-emphasis text-xs font-semibold">Trace</span>
+							<AgentTrace entries={agentErrorTrace} {workspaceId} />
+						</div>
+					{/if}
 					{#if !isTest && language === 'bun'}
 						<div class="pt-20"></div>
 						<Alert size="xs" type="info" title="Seeing an odd error?">
@@ -1229,6 +1282,27 @@
 							{/each}
 						</div>
 					</div>
+				{:else if !forceJson && resultKind === 'aiagent'}
+					{@const agentResult = parseAgentResult(result)}
+					{#if agentResult}
+						<AgentResultDisplay result={agentResult} {workspaceId} runKey={runKey ?? jobId}>
+							{#snippet structuredOutput(output)}
+								<DisplayResult
+									noControls
+									hideAsJson
+									result={output}
+									{markupTrust}
+									{filename}
+									{disableExpand}
+									{jobId}
+									{nodeId}
+									{workspaceId}
+									{appPath}
+									growVertical
+								/>
+							{/snippet}
+						</AgentResultDisplay>
+					{/if}
 				{:else if !forceJson && resultKind === 'markdown'}
 					<div class={markdownProse.sm}>
 						<Markdown md={result?.md ?? result?.markdown} />
@@ -2,10 +2,7 @@
 	import { Loader2 } from 'lucide-svelte'
 	import DisplayResult from './DisplayResult.svelte'
 	import LogViewer from './LogViewer.svelte'
-	import type { CompletedJob, Job } from '$lib/gen'
-	import AiAgentLogViewer from './AIAgentLogViewer.svelte'
 	import { twMerge } from 'tailwind-merge'
-	import type { AgentTool } from './flows/agentToolUtils'

 	interface Props {
 		waitingForExecutor?: boolean
@@ -16,17 +13,13 @@
 		loading: boolean
 		filename?: string | undefined
 		jobId?: string | undefined
+		/** Identifies the run, which `jobId` cannot on the replay page. */
+		runKey?: string | undefined
 		tag?: string | undefined
 		workspaceId?: string | undefined
 		refreshLog?: boolean
 		downloadLogs?: boolean
 		tagLabel?: string | undefined
-		aiAgentStatus?: {
-			tools: AgentTool[]
-			agentJob: Partial<CompletedJob> & Pick<CompletedJob, 'id'> & { type: 'CompletedJob' }
-			storedToolCallJobs?: Record<number, Job>
-			onToolJobLoaded?: (job: Job, idx: number) => void
-		}
 	}

 	let {
@@ -38,11 +31,11 @@
 		loading,
 		filename = undefined,
 		jobId = undefined,
+		runKey = undefined,
 		tag = undefined,
 		workspaceId = undefined,
 		downloadLogs = true,
-		tagLabel = undefined,
-		aiAgentStatus = undefined
+		tagLabel = undefined
 	}: Props = $props()
 </script>

@@ -60,7 +53,15 @@
 				: 'max-h-80'} overflow-auto rounded-md grow min-h-0 border bg-surface-tertiary p-2"
 		>
 			{#if result !== undefined || result_stream !== undefined}
-				<DisplayResult {workspaceId} {jobId} {filename} {result} {result_stream} growVertical />
+				<DisplayResult
+					{workspaceId}
+					{jobId}
+					{runKey}
+					{filename}
+					{result}
+					{result_stream}
+					growVertical
+				/>
 			{:else if loading}
 				<Loader2 class="animate-spin" />
 			{:else}
@@ -70,19 +71,15 @@
 	</div>
 	<div class="relative flex flex-col gap-1">
 		<span class="text-emphasis text-xs font-semibold">Logs</span>
-		{#if aiAgentStatus}
-			<AiAgentLogViewer {...aiAgentStatus} {workspaceId} noPadding />
-		{:else}
-			<div class="rounded-md grow min-h-0 border bg-surface-tertiary overflow-hidden">
-				<LogViewer
-					{tagLabel}
-					download={downloadLogs}
-					content={logs ?? ''}
-					{jobId}
-					isLoading={waitingForExecutor}
-					{tag}
-				/>
-			</div>
-		{/if}
+		<div class="rounded-md grow min-h-0 border bg-surface-tertiary overflow-hidden">
+			<LogViewer
+				{tagLabel}
+				download={downloadLogs}
+				content={logs ?? ''}
+				{jobId}
+				isLoading={waitingForExecutor}
+				{tag}
+			/>
+		</div>
 	</div>
 </div>
@@ -49,7 +49,6 @@
 		) => Promise<void>
 		getSelectedIteration: (stepId: string) => number
 		flowSummary?: string
-		mode?: 'flow' | 'aiagent'
 		currentId?: string | null
 		navigationChain?: NavigationChain
 		select: (id: string) => void
@@ -81,7 +80,6 @@
 		onSelectedIteration,
 		getSelectedIteration,
 		flowSummary,
-		mode = 'flow',
 		currentId,
 		navigationChain = $bindable(),
 		select,
@@ -127,18 +125,16 @@
 	function getStepProgress(job: RootJobData | undefined, totalSteps: number): string {
 		if (!job || totalSteps === 0) return ''

-		const stepWord = mode === 'aiagent' ? 'action' : 'step'
-
 		// If flow is completed, show total steps
 		if (job.type === 'CompletedJob') {
-			return ` (${totalSteps} ${stepWord}${totalSteps === 1 ? '' : 's'})`
+			return ` (${totalSteps} step${totalSteps === 1 ? '' : 's'})`
 		}

 		// If flow is running, use flow_status.step if available (like JobStatus.svelte)
 		if (job.type === 'QueuedJob') {
 			if (job.flow_status?.step !== undefined) {
 				const currentStep = (job.flow_status.step ?? 0) + 1
-				return ` (${stepWord} ${currentStep} of ${totalSteps})`
+				return ` (step ${currentStep} of ${totalSteps})`
 			}

 			return ''
@@ -558,7 +554,7 @@
 					{@render flowIcon(getFlowStatus(rootJob), flowInfo?.hasErrors)}

 					<div class="text-xs text-left font-mono">
-						{mode === 'aiagent' ? 'AI Agent' : level == 0 ? 'Flow' : 'Subflow'}
+						{level == 0 ? 'Flow' : 'Subflow'}
 						{#if flowInfo?.label}
 							: {flowInfo.label}
 						{/if}
@@ -703,32 +699,22 @@
 												<div class="flex items-center gap-2">
 													<span class="text-xs font-mono text-left">
 														<b class="flex items-center gap-1">
-															{#if mode === 'aiagent'}
-																{#if module.summary}
-																	Tool call: {module.summary}
-																{:else}
-																	Message
-																{/if}
-															{:else}
-																{module.id}
-															{/if}
+															{module.id}
 														</b>
-														{#if mode === 'flow'}
-															{#if module.value.type === 'forloopflow'}
-																For loop
-															{:else if module.value.type === 'whileloopflow'}
-																While loop
-															{:else if module.value.type === 'branchall'}
-																Branch to all
-															{:else if module.value.type === 'branchone'}
-																Branch to one
-															{:else if module.value.type === 'flow'}
-																Subflow
-															{:else}
-																Step
-															{/if}
+														{#if module.value.type === 'forloopflow'}
+															For loop
+														{:else if module.value.type === 'whileloopflow'}
+															While loop
+														{:else if module.value.type === 'branchall'}
+															Branch to all
+														{:else if module.value.type === 'branchone'}
+															Branch to one
+														{:else if module.value.type === 'flow'}
+															Subflow
+														{:else}
+															Step
 														{/if}
-														{#if module.summary && mode !== 'aiagent'}
+														{#if module.summary}
 															: {module.summary}
 														{/if}
 														{#if hasEmptySubflowValue}
@@ -20,7 +20,6 @@
 				| { id: string; index: number; manuallySet: true; moduleId: string }
 				| { manuallySet: false; moduleId: string }
 		) => Promise<void>
-		mode?: 'flow' | 'aiagent'
 	}

 	let {
@@ -29,8 +28,7 @@
 		localDurationStatuses,
 		workspaceId,
 		render,
-		onSelectedIteration,
-		mode = 'flow'
+		onSelectedIteration
 	}: Props = $props()

 	// State for tracking expanded rows - using Record to allow explicit control
@@ -180,7 +178,6 @@
 		{render}
 		{getSelectedIteration}
 		flowId="root"
-		{mode}
 		{currentId}
 		bind:navigationChain
 		{select}
@@ -65,7 +65,6 @@
 	import { getActiveReplay } from './recording/replay.svelte'
 	import { publishLinkedAgentTools } from './flows/flowState'
 	import {
-		getLinkedAgentTools,
 		linkedToolsScope,
 		releaseLinkedToolsScope,
 		retainLinkedToolsScope
@@ -2121,6 +2120,7 @@
 														tagLabel={customUi?.tagLabel}
 														workspaceId={isReplay ? undefined : job?.workspace_id}
 														jobId={isReplay ? undefined : job?.id}
+														runKey={job?.id}
 														filename={job.id}
 														loading={job['running']}
 														tag={job?.tag}
@@ -2142,15 +2142,6 @@
 														<p class="text-secondary">No arguments</p>
 													{/if}
 												{:else if node}
-													{@const module =
-														stepDetail && typeof stepDetail !== 'string' ? stepDetail : undefined}
-													{@const agentTools =
-														module && module.value.type === 'aiagent'
-															? module.value.agent
-																? getLinkedAgentTools(linkedToolsViewScope, module.id)
-																: (module.value.tools ?? [])
-															: undefined}
-													{@const parentLoopsPrefix = getParentLoopsPrefix(module?.id ?? '')}
 													{#if node.flow_jobs_results}
 														<div>
 															<span class="pl-1 text-emphasis text-xs font-medium"
@@ -2236,6 +2227,7 @@
 																tagLabel={customUi?.tagLabel}
 																workspaceId={isReplay ? undefined : job?.workspace_id}
 																jobId={isReplay ? undefined : node.job_id}
+																runKey={node.job_id}
 																loading={node.type != 'Success' && node.type != 'Failure'}
 																waitingForExecutor={node.type == 'WaitingForExecutor'}
 																refreshLog={node.type == 'InProgress'}
@@ -2245,30 +2237,6 @@
 																tag={node.tag}
 																logs={node.logs}
 																downloadLogs={!hideDownloadLogs && !isReplay}
-																aiAgentStatus={agentTools &&
-																node?.job_id &&
-																(node.type === 'Success' || node.type === 'Failure')
-																	? {
-																			tools: agentTools,
-																			agentJob: {
-																				id: node.job_id,
-																				result: node.result,
-																				logs: node.logs,
-																				args: node.args,
-																				success: node.type === 'Success',
-																				type: 'CompletedJob'
-																			},
-																			storedToolCallJobs: module
-																				? toolCallStore?.getLocalToolCallJobs(parentLoopsPrefix)
-																				: undefined,
-																			onToolJobLoaded: (job, idx) => {
-																				if (module) {
-																					const storeKey = parentLoopsPrefix + module.id + '-' + idx
-																					toolCallStore?.setStoredToolCallJob(storeKey, job)
-																				}
-																			}
-																		}
-																	: undefined}
 															/>
 														</div>
 													</div>
@@ -0,0 +1,19 @@
+<!-- A horizontal rule with something centred in it: the login page's "or" and the
+	agent run's output separator. Takes a snippet rather than a string because the
+	middle is sometimes a button, not a label. -->
+<script lang="ts">
+	import { twMerge } from 'tailwind-merge'
+
+	interface Props {
+		class?: string
+		children: import('svelte').Snippet
+	}
+
+	let { class: clazz, children }: Props = $props()
+</script>
+
+<div class={twMerge('flex items-center gap-2', clazz)}>
+	<div class="h-px flex-1 bg-border-light"></div>
+	{@render children()}
+	<div class="h-px flex-1 bg-border-light"></div>
+</div>
@@ -1,5 +1,6 @@
 <script module lang="ts">
 	import { noteSessionEmail } from '$lib/onboardingProfile'
+	import LabeledDivider from './LabeledDivider.svelte'
 	import type { LastLoginMethod } from '$lib/lastLoginMethod'

 	/** Feeds the login card a fixed instance configuration instead of the live one.
@@ -396,7 +397,8 @@
 		if (loginsResult.status === 'fulfilled') {
 			logins = loginsResult.value.oauth.map((login) => ({
 				type: login.type,
-				displayName: login.display_name || login.type
+				displayName:
+					login.display_name || providers.find((p) => p.type === login.type)?.name || login.type
 			}))
 			saml = loginsResult.value.saml
 			autoLogin = loginsResult.value.auto_login
@@ -747,11 +749,9 @@
 {/snippet}

 {#snippet orDivider()}
-	<div class="flex items-center gap-3 my-6">
-		<div class="h-px flex-1 bg-border-light"></div>
+	<LabeledDivider class="gap-3 my-6">
 		<span class="text-2xs uppercase text-secondary">or</span>
-		<div class="h-px flex-1 bg-border-light"></div>
-	</div>
+	</LabeledDivider>
 {/snippet}

 <div class="bg-surface px-4 py-8 border sm:rounded-lg sm:px-10">
@@ -8,10 +8,8 @@
 	import OutputPickerInner from '$lib/components/flows/propPicker/OutputPickerInner.svelte'
 	import { Pane, Splitpanes } from 'svelte-splitpanes'
 	import type { FlowEditorContext, OutputViewerJob } from './flows/types'
-	import type { AgentTool } from './flows/agentToolUtils'
 	import { getContext } from 'svelte'
 	import { getStringError } from './copilot/chat/utils'
-	import AiAgentLogViewer from './AIAgentLogViewer.svelte'

 	interface Props {
 		lang: Script['language']
@@ -27,9 +25,6 @@
 		onUpdateMock?: (mock: { enabled: boolean; return_value?: unknown }) => void
 		loadingJob?: boolean
 		tagLabel?: string
-		// A linked agent persists no tools of its own; its resolved resource tools are passed here so
-		// the log viewer can label each tool_call with the definition that ran.
-		linkedAgentTools?: AgentTool[]
 	}

 	let {
@@ -45,8 +40,7 @@
 		disableHistory = false,
 		onUpdateMock,
 		loadingJob = false,
-		tagLabel = undefined,
-		linkedAgentTools = undefined
+		tagLabel = undefined
 	}: Props = $props()

 	const { stepsInputArgs, flowStateStore } = getContext<FlowEditorContext>('FlowEditorContext')
@@ -105,15 +99,6 @@
 				customEmptyMessage="Using pinned data"
 				{tagLabel}
 			/>
-		{:else if mod.value.type === 'aiagent' && logJob?.type === 'CompletedJob'}
-			<AiAgentLogViewer
-				tools={linkedAgentTools ?? mod.value.tools ?? []}
-				agentJob={{
-					...logJob,
-					type: 'CompletedJob'
-				}}
-				workspaceId={logJob.workspace_id}
-			/>
 		{:else}
 			<LogViewer
 				small
@@ -0,0 +1,59 @@
+<!-- The description field of a resource, wherever one is created or edited: the
+	resource form and the save-as-reusable-agent drawer. One component, for the same
+	reason as ResourcePathHint next to it — two copies drift. -->
+<script lang="ts">
+	import { Pen } from 'lucide-svelte'
+	import { Button } from '$lib/components/common'
+	import GfmMarkdown from './GfmMarkdown.svelte'
+	import Required from './Required.svelte'
+	import TextInput from './text_input/TextInput.svelte'
+
+	interface Props {
+		description: string
+		label?: string
+		placeholder?: string
+		canWrite?: boolean
+	}
+
+	let {
+		description = $bindable(),
+		label = 'Resource description',
+		placeholder = 'Describe what this resource is for',
+		canWrite = true
+	}: Props = $props()
+
+	let editing = $state(false)
+</script>
+
+<div class="flex flex-col gap-1">
+	<h4 class="inline-flex items-center gap-2 text-xs text-emphasis font-semibold"
+		>{label}
+		<Required required={false} />
+		{#if canWrite}
+			<Button
+				variant="subtle"
+				unifiedSize="xs"
+				btnClasses={editing ? 'bg-surface-hover' : ''}
+				startIcon={{ icon: Pen }}
+				iconOnly
+				title={editing ? 'Stop editing the description' : 'Edit the description'}
+				aria-label={editing ? 'Stop editing the description' : 'Edit the description'}
+				on:click={() => (editing = !editing)}
+			/>
+		{/if}
+	</h4>
+	{#if canWrite && editing}
+		<div class="relative">
+			<div class="text-2xs text-primary absolute -top-4 right-0">GH Markdown</div>
+			<TextInput
+				underlyingInputEl="textarea"
+				bind:value={description}
+				inputProps={{ placeholder, 'aria-label': label, disabled: !canWrite }}
+			/>
+		</div>
+	{:else if description == undefined || description == ''}
+		<div class="text-xs text-secondary font-normal">No description provided</div>
+	{:else}
+		<GfmMarkdown md={description} prose="sm" noPadding />
+	{/if}
+</div>
@@ -1,4 +1,5 @@
 <script lang="ts">
+	import ResourceDescriptionField from './ResourceDescriptionField.svelte'
 	import type { Schema } from '$lib/common'
 	import type { Resource, ResourceType } from '$lib/gen'
 	import { onDestroy } from 'svelte'
@@ -7,20 +8,16 @@
 	import { Alert, Skeleton } from './common'
 	import Path from './Path.svelte'
 	import LabelsInput from './LabelsInput.svelte'
-	import Required from './Required.svelte'
 	import { workspaceStore, type UserExt } from '$lib/stores'
 	import SchemaForm from './SchemaForm.svelte'
 	import SimpleEditor from './SimpleEditor.svelte'
 	import FilesetEditor from './FilesetEditor.svelte'
 	import Toggle from './Toggle.svelte'
 	import TestConnection from './TestConnection.svelte'
-	import { Pen } from 'lucide-svelte'
-	import autosize from '$lib/autosize'
 	import GfmMarkdown from './GfmMarkdown.svelte'
 	import TestTriggerConnection from './triggers/TestTriggerConnection.svelte'
 	import GitHubAppIntegration from './GitHubAppIntegration.svelte'
 	import GitLabIntegration from './GitLabIntegration.svelte'
-	import Button from './common/button/Button.svelte'
 	import ResourceGen from './copilot/ResourceGen.svelte'
 	import SyncResourceTypes from './SyncResourceTypes.svelte'
 	import Label from './Label.svelte'
@@ -86,7 +83,6 @@

 	let ws = $derived(workspace ?? $workspaceStore)

-	let editDescription = $state(false)
 	let rawCode: string | undefined = $state(undefined)
 	let textFileContent: string = $state('')

@@ -193,36 +189,7 @@
 	</Label>
 {/if}

-<div class="flex flex-col gap-1">
-	<h4 class="inline-flex items-center gap-2 text-xs text-emphasis font-semibold"
-		>Resource description <Required required={false} />
-		{#if can_write}
-			<Button
-				variant="subtle"
-				unifiedSize="xs"
-				btnClasses={editDescription ? 'bg-surface-hover' : ''}
-				startIcon={{ icon: Pen }}
-				on:click={() => (editDescription = !editDescription)}
-			/>
-		{/if}
-	</h4>
-	{#if can_write && editDescription}
-		<div class="relative">
-			<div class="text-2xs text-primary absolute -top-4 right-0">GH Markdown</div>
-			<textarea
-				class="text-xs text-primary font-normal"
-				disabled={!can_write}
-				use:autosize
-				bind:value={description}
-				placeholder="Describe what this resource is for"
-			></textarea>
-		</div>
-	{:else if description == undefined || description == ''}
-		<div class="text-xs text-secondary font-normal">No description provided</div>
-	{:else}
-		<GfmMarkdown md={description} prose="sm" noPadding />
-	{/if}
-</div>
+<ResourceDescriptionField bind:description canWrite={can_write} />

 <div class="flex flex-col gap-1">
 	<div class="w-full flex gap-4 flex-row-reverse items-center">
@@ -1,5 +1,6 @@
-<!-- Shown above the Path input wherever a resource is created: the resource form and the
-	connect drawer's last step. One component so the two screens cannot drift apart. -->
+<!-- Shown above the Path input wherever a resource is created: the resource form, the
+	connect drawer's last step, and the save-as-reusable-agent drawer. One component so
+	those screens cannot drift apart. -->
 <div class="text-xs text-secondary font-normal mb-1">
 	The path sets who can access this resource: a <code>u/</code> path is private to that user, an
 	<code>f/</code> path follows the folder's permissions — read access lets people use the resource, write
@@ -0,0 +1,17 @@
+/**
+ * The pane an agent run is rendered in. Selected on `overflow-y` alone, never on
+ * whether the element currently overflows: a pane that fits its content is still
+ * the pane, and an overflow test walks past it into `#content`, which overflows
+ * merely because the document scrolls — scrolling that drops the whole page.
+ */
+export function runPane(node: HTMLElement | undefined | null): HTMLElement | undefined {
+	let current = node?.parentElement
+	while (current && current !== document.body && current.id !== 'content') {
+		const overflowY = getComputedStyle(current).overflowY
+		if (overflowY === 'auto' || overflowY === 'scroll') {
+			return current
+		}
+		current = current.parentElement
+	}
+	return undefined
+}
@@ -0,0 +1,182 @@
+import { describe, expect, it } from 'vitest'
+import { buildAgentTrace, splitFinalAnswer } from './agentTrace'
+import { parseAgentErrorMessages } from './aiAgentResult'
+import type { AgentMessage } from './aiAgentResult'
+
+// The worker splits one tool call across two messages: the assistant message
+// carries the arguments and no action tag, the `tool` message answering it
+// carries the result and the `tool_call` tag naming the job. Joining them on
+// `tool_call_id` is the whole contract, and reading it off the wrong message
+// yields a row with no parameters.
+const messages: AgentMessage[] = [
+	{ role: 'system', content: 'You are an SRE assistant.' },
+	{ role: 'user', content: 'Which region is broken?' },
+	{
+		role: 'assistant',
+		tool_calls: [
+			{
+				id: 'call_1',
+				type: 'function',
+				function: { name: 'query_metrics', arguments: '{"w":"30m"}' }
+			}
+		]
+	},
+	{
+		role: 'tool',
+		tool_call_id: 'call_1',
+		content: '{"eu-central-1":0.184}',
+		agent_action: {
+			type: 'tool_call',
+			job_id: '0199-job',
+			module_id: 'b',
+			function_name: 'query_metrics'
+		}
+	},
+	{ role: 'assistant', content: 'eu-central-1 is down.', agent_action: { type: 'message' } }
+]
+
+describe('buildAgentTrace', () => {
+	it('joins a tool call to the arguments on the message that requested it', () => {
+		expect(buildAgentTrace(messages)).toEqual([
+			{
+				kind: 'tool',
+				name: 'query_metrics',
+				args: '{"w":"30m"}',
+				result: '{"eu-central-1":0.184}',
+				jobId: '0199-job'
+			},
+			{ kind: 'assistant', content: 'eu-central-1 is down.', sources: undefined }
+		])
+	})
+
+	it('keeps an MCP call, whose arguments live on the action itself', () => {
+		const entries = buildAgentTrace([
+			{
+				role: 'tool',
+				content: 'sunny',
+				agent_action: {
+					type: 'mcp_tool_call',
+					call_id: 'c1',
+					function_name: 'get_weather',
+					resource_path: 'f/mcp/weather',
+					arguments: { city: 'Paris' }
+				}
+			}
+		])
+		expect(entries).toEqual([
+			{
+				kind: 'tool',
+				name: 'get_weather',
+				args: '{\n  "city": "Paris"\n}',
+				result: 'sunny',
+				resourcePath: 'f/mcp/weather'
+			}
+		])
+	})
+
+	// The worker splits a search the same way: a `tool` message tagged web_search
+	// carrying a constant sentence, then the assistant turn that carries the
+	// citations. The search row therefore has nothing of its own to show.
+	it('records the search and puts its citations on the turn that follows', () => {
+		const entries = buildAgentTrace([
+			{
+				role: 'tool',
+				content: 'Used websearch tool successfully',
+				agent_action: { type: 'web_search' }
+			},
+			{
+				role: 'assistant',
+				content: 'Postgres 17 changed the default.',
+				annotations: [{ url: 'https://postgresql.org/docs', title: 'Release notes' }],
+				agent_action: { type: 'message' }
+			}
+		])
+		expect(entries).toEqual([
+			{ kind: 'search' },
+			{
+				kind: 'assistant',
+				content: 'Postgres 17 changed the default.',
+				sources: [{ url: 'https://postgresql.org/docs', title: 'Release notes' }]
+			}
+		])
+	})
+
+	// The prompt and the question are the step's inputs, shown as inputs. A replayed
+	// turn comes back from memory without its tag, and crediting this run with an
+	// answer a previous one gave would be a lie about what happened.
+	it('traces only what this run did', () => {
+		expect(
+			buildAgentTrace([
+				{ role: 'system', content: 'You are an SRE assistant.' },
+				{ role: 'user', content: 'Which region is broken?' },
+				{ role: 'assistant', content: 'Answered in an earlier turn, replayed from memory.' },
+				{ role: 'assistant', tool_calls: [{ id: 'c1', function: { name: 'x', arguments: '{}' } }] },
+				{ role: 'assistant', content: '', agent_action: { type: 'message' } }
+			])
+		).toEqual([])
+	})
+})
+
+describe('splitFinalAnswer', () => {
+	it('moves the answering turn out of the trace, with its citations', () => {
+		const entries = buildAgentTrace([
+			{ role: 'tool', content: 'Used websearch tool', agent_action: { type: 'web_search' } },
+			{
+				role: 'assistant',
+				content: 'Postgres 17 changed the default.',
+				annotations: [{ url: 'https://postgresql.org/docs', title: 'Release notes' }],
+				agent_action: { type: 'message' }
+			}
+		])
+		expect(splitFinalAnswer(entries, 'Postgres 17 changed the default.')).toEqual({
+			trace: [{ kind: 'search' }],
+			sources: [{ url: 'https://postgresql.org/docs', title: 'Release notes' }]
+		})
+	})
+
+	// A run whose last turn returned a tool call and no text leaves its answer
+	// mid-trace. Looking only at the final entry finds nothing to move and prints
+	// that answer as a row and again under the output.
+	it('finds the answering turn even when it is not the last one', () => {
+		const entries = buildAgentTrace([
+			{ role: 'assistant', content: 'Let me check.', agent_action: { type: 'message' } },
+			{
+				role: 'tool',
+				tool_call_id: 'call_1',
+				content: '{}',
+				agent_action: {
+					type: 'tool_call',
+					job_id: '0199-job',
+					module_id: 'b',
+					function_name: 'query_metrics'
+				}
+			}
+		])
+		expect(splitFinalAnswer(entries, 'Let me check.').trace).toEqual([entries[1]])
+	})
+
+	it('leaves the trace whole when the output is not a turn of its own', () => {
+		const entries = buildAgentTrace(messages)
+		expect(splitFinalAnswer(entries, { rows: 3 })).toEqual({ trace: entries })
+	})
+})
+
+// A run stopped by max_iterations serializes its partial messages itself rather
+// than reusing the success envelope's writer. `agent_action` is `skip_serializing`
+// on `OpenAIMessage`, so if that path ever stops wrapping them the tags vanish and
+// this trace silently empties — which is the one run worth reading.
+describe('the max-iterations path', () => {
+	it('traces the partial messages the error carries', () => {
+		const partial = parseAgentErrorMessages({
+			error: {
+				name: 'ExecutionErr',
+				message: 'AI agent reached max iterations (10)',
+				step_id: 'd',
+				result: { messages }
+			}
+		})
+		// The trace itself is `buildAgentTrace`'s, pinned above; what this path can
+		// lose is the tags it reads, and an untagged conversation traces to nothing.
+		expect(buildAgentTrace(partial ?? [])).toHaveLength(2)
+	})
+})
@@ -0,0 +1,134 @@
+import type { WebSearchSource } from './copilot/chat/shared'
+import type { AgentMessage } from './aiAgentResult'
+
+/**
+ * One entry in the trace of an agent run, built from the envelope alone so it
+ * renders without waiting on any request; a tool's child job is enrichment. The
+ * prompt and the question are deliberately absent: they are the step's inputs and
+ * are shown as inputs, while the trace is what the agent did with them.
+ */
+export type AgentTraceEntry =
+	| { kind: 'assistant'; content: string; sources?: WebSearchSource[] }
+	/** A search records only that one happened: the worker writes a constant
+	 *  sentence, and the citations ride on the assistant turn that follows. */
+	| { kind: 'search' }
+	| {
+			kind: 'tool'
+			name: string
+			args?: string
+			result: string
+			/** Present for a flow-module tool, which runs as its own job. */
+			jobId?: string
+			/** An MCP tool runs in the worker, so it names its server instead. */
+			resourcePath?: string
+	  }
+
+/** `content` is a string for text messages and a part list once images are involved. */
+function contentText(content: unknown): string {
+	if (typeof content === 'string') {
+		return content
+	}
+	if (Array.isArray(content)) {
+		return content
+			.map((part) =>
+				part && typeof part === 'object' && typeof (part as { text?: unknown }).text === 'string'
+					? (part as { text: string }).text
+					: ''
+			)
+			.join('')
+	}
+	return ''
+}
+
+function sourcesOf(message: AgentMessage): WebSearchSource[] | undefined {
+	const annotations = message.annotations
+	if (!annotations?.length) {
+		return undefined
+	}
+	return annotations.map((a) => ({ url: a.url, title: a.title }))
+}
+
+export function buildAgentTrace(messages: AgentMessage[]): AgentTraceEntry[] {
+	// The arguments live on the assistant message that requested the call, while
+	// the action tag and the result live on the `tool` message answering it, so
+	// the two are joined by `tool_call_id`.
+	const argsByCallId = new Map<string, string>()
+	for (const message of messages) {
+		for (const call of message.tool_calls ?? []) {
+			if (call.id && typeof call.function?.arguments === 'string') {
+				argsByCallId.set(call.id, call.function.arguments)
+			}
+		}
+	}
+
+	const entries: AgentTraceEntry[] = []
+	for (const message of messages) {
+		const action = message.agent_action
+		if (action?.type === 'tool_call') {
+			entries.push({
+				kind: 'tool',
+				name: action.function_name,
+				args: message.tool_call_id ? argsByCallId.get(message.tool_call_id) : undefined,
+				result: contentText(message.content),
+				jobId: action.job_id
+			})
+			continue
+		}
+		if (action?.type === 'mcp_tool_call') {
+			entries.push({
+				kind: 'tool',
+				name: action.function_name,
+				// An MCP call records its arguments on the action itself: it never
+				// became a job, so there is nowhere else for them to live.
+				args: action.arguments ? JSON.stringify(action.arguments, null, 2) : undefined,
+				result: contentText(message.content),
+				resourcePath: action.resource_path
+			})
+			continue
+		}
+		if (action?.type === 'web_search') {
+			entries.push({ kind: 'search' })
+			continue
+		}
+		// Every message this run produced is tagged, including the agent narrating
+		// its next move and its final answer. Untagged ones are the prompt, the
+		// question, or a previous turn replayed out of memory — history loses its
+		// tags on the way back, and attributing it to this run would credit it with
+		// answers it never gave.
+		if (action?.type !== 'message') {
+			continue
+		}
+		const content = contentText(message.content)
+		if (message.role === 'assistant' && content !== '') {
+			entries.push({ kind: 'assistant', content, sources: sourcesOf(message) })
+		}
+	}
+	return entries
+}
+
+/**
+ * Separates the turn that produced the output from the rest of the trace, so the
+ * answer is rendered once with the citations that belong to it. Found by content
+ * and searched from the end: a run whose last turn returned a tool call leaves its
+ * answer mid-trace, where inspecting only the final entry prints it twice.
+ */
+export function splitFinalAnswer(
+	entries: AgentTraceEntry[],
+	output: unknown
+): { trace: AgentTraceEntry[]; sources?: WebSearchSource[] } {
+	if (typeof output !== 'string') {
+		// A schema-shaped output is rendered by the result viewer itself and matches
+		// no turn, so the whole trace stands.
+		return { trace: entries }
+	}
+	for (let i = entries.length - 1; i >= 0; i--) {
+		const entry = entries[i]
+		if (entry.kind === 'assistant' && entry.content === output) {
+			// The citations are an annotation on that turn, so moving the turn without
+			// them would leave a run that shows a web search ran and no source for
+			// what it answered.
+			return { trace: [...entries.slice(0, i), ...entries.slice(i + 1)], sources: entry.sources }
+		}
+	}
+	return { trace: entries }
+}
@@ -0,0 +1,257 @@
+import { describe, expect, it } from 'vitest'
+import { buildAgentTrace } from './agentTrace'
+import {
+	advanceAgentStream,
+	emptyAgentStreamProgress,
+	formatTokenCount,
+	isAgentStream,
+	parseAgentResult,
+	summarizeAgentResult
+} from './aiAgentResult'
+
+const envelope = {
+	output: 'the answer',
+	messages: [
+		{ role: 'user', content: 'ask' },
+		{ role: 'assistant', content: 'the answer', agent_action: { type: 'message' } }
+	],
+	usage: { input_tokens: 10, output_tokens: 2, total_tokens: 12 }
+}
+
+describe('parseAgentResult', () => {
+	it('accepts the envelope with and without its optional keys', () => {
+		expect(parseAgentResult(envelope)?.output).toBe('the answer')
+		expect(parseAgentResult({ output: 1, messages: [{ role: 'user' }] })?.messages).toHaveLength(1)
+		// A key the worker serializes and the signature does not know costs every run
+		// carrying it the pretty display, so each one is pinned here.
+		expect(parseAgentResult({ ...envelope, reasoning: 'let me think' })?.reasoning).toBe(
+			'let me think'
+		)
+	})
+
+	// The signature is the only thing separating an agent result from any other
+	// object, so each of these near-misses has to stay a miss.
+	it.each([
+		['a key outside the envelope', { ...envelope, retries: 2 }],
+		['no output', { messages: envelope.messages }],
+		['messages that are not a list', { output: 'a', messages: { role: 'user' } }],
+		['no messages at all', { output: 'a', messages: [] }],
+		['a message without a role', { output: 'a', messages: [{ content: 'ask' }] }],
+		['null', null]
+	])('rejects %s', (_label, value) => {
+		expect(parseAgentResult(value)).toBeUndefined()
+	})
+})
+
+describe('summarizeAgentResult', () => {
+	it('counts the actions and falls back to the parts when no total is reported', () => {
+		const summary = summarizeAgentResult({
+			output: '',
+			messages: [
+				{ role: 'user' },
+				{ role: 'assistant', agent_action: { type: 'tool_call' } as any },
+				{ role: 'assistant', agent_action: { type: 'mcp_tool_call' } as any },
+				{ role: 'assistant', agent_action: { type: 'web_search' } },
+				{ role: 'assistant', agent_action: { type: 'message' } }
+			],
+			usage: { input_tokens: 8421, output_tokens: 512, cache_read_input_tokens: 6144 }
+		})
+		expect(summary).toEqual({
+			toolCalls: 2,
+			webSearches: 1,
+			tokens: 8933,
+			cachedTokens: 6144
+		})
+	})
+})
+
+describe('agent stream', () => {
+	const lines = [
+		'{"type":"tool_call","call_id":"c1","function_name":"query_metrics"}',
+		'{"type":"tool_result","call_id":"c1","function_name":"query_metrics","result":"{}","success":true}',
+		'{"type":"reasoning_token_delta","content":"checking"}',
+		'{"type":"token_delta","content":"eu-central-1"}',
+		'{"type":"token_delta","content":" is down"}'
+	]
+	const events = lines.join('\n') + '\n'
+
+	it('recognises an agent stream from its first line only', () => {
+		expect(isAgentStream(events)).toBe(true)
+		expect(isAgentStream('processing row 1\nprocessing row 2\n')).toBe(false)
+		expect(isAgentStream('{"level":"info","msg":"hello"}\n')).toBe(false)
+		// No newline yet, so the first line may still be half-written.
+		expect(isAgentStream('{"type":"token_delta","content":"a"}')).toBe(false)
+		// A provider that does not filter its empty deltas opens with one, and the
+		// run is an agent's all the same.
+		expect(isAgentStream('{"type":"token_delta","content":""}\n')).toBe(true)
+		// What the fold cannot use must not claim the pane either, or the script's
+		// own output is replaced by a view with nothing to draw.
+		expect(isAgentStream('{"type":"tool_call","function_name":"q"}\n')).toBe(false)
+	})
+
+	// The stream only grows, so each poll must fold in the new lines and re-read
+	// none of the old ones — the reason this is incremental at all.
+	it('resumes where the previous poll stopped', () => {
+		const firstPoll = advanceAgentStream(
+			lines.slice(0, 3).join('\n') + '\n',
+			emptyAgentStreamProgress()
+		)
+		const secondPoll = advanceAgentStream(events, firstPoll)
+		expect(secondPoll.consumed).toBe(events.length)
+		expect(secondPoll.stream.current).toBe('eu-central-1 is down')
+		expect(secondPoll.stream.reasoning).toBe('checking')
+	})
+
+	it('leaves a half-written trailing line for the next poll', () => {
+		const partial = advanceAgentStream(`${events}{"type":"token_de`, emptyAgentStreamProgress())
+		expect(partial.stream.current).toBe('eu-central-1 is down')
+		const completed = advanceAgentStream(`${events}{"type":"token_delta","content":"!"}\n`, partial)
+		expect(completed.stream.current).toBe('eu-central-1 is down!')
+	})
+
+	it('marks a tool still running, and a failed one', () => {
+		const started = '{"type":"tool_execution","call_id":"c1","function_name":"fetch"}\n'
+		const running = advanceAgentStream(started, emptyAgentStreamProgress())
+		expect(running.stream.entries).toEqual([
+			{ kind: 'tool', callId: 'c1', name: 'fetch', running: true, success: undefined }
+		])
+		const failed = advanceAgentStream(
+			started +
+				'{"type":"tool_result","call_id":"c1","function_name":"fetch","result":"boom","success":false}\n',
+			running
+		)
+		// One row for the call, not one per event about it.
+		expect(failed.stream.entries).toEqual([
+			{ kind: 'tool', callId: 'c1', name: 'fetch', running: false, success: false }
+		])
+	})
+})
+
+describe('formatTokenCount', () => {
+	it('keeps small counts exact and rounds the rest', () => {
+		expect(formatTokenCount(940)).toBe('940')
+		expect(formatTokenCount(8933)).toBe('8.9k')
+		expect(formatTokenCount(48211)).toBe('48k')
+	})
+})
+
+// The worker streams every iteration's text, and a turn may narrate and call a
+// tool at once. Appending across that boundary makes the live answer read
+// "I'll checkThe issue is..." and never converge on the finished output.
+describe('a stream that narrates before calling a tool', () => {
+	it('turns the narration into a row and starts the answer fresh', () => {
+		const raw = [
+			'{"type":"token_delta","content":"Let me check the metrics."}',
+			'{"type":"tool_call","call_id":"c1","function_name":"query_metrics"}',
+			'{"type":"tool_result","call_id":"c1","function_name":"query_metrics","result":"{}","success":true}',
+			'{"type":"token_delta","content":"eu-central-1 is down."}',
+			''
+		].join('\n')
+		const { stream } = advanceAgentStream(raw, emptyAgentStreamProgress())
+		expect(stream.current).toBe('eu-central-1 is down.')
+		// The narration became a row rather than disappearing.
+		expect(stream.entries[0]).toEqual({ kind: 'assistant', content: 'Let me check the metrics.' })
+	})
+
+	it('closes the turn at the boundary even when polls split it', () => {
+		const first = '{"type":"token_delta","content":"Let me check."}\n'
+		const afterCall = first + '{"type":"tool_call","call_id":"c1","function_name":"q"}\n'
+		const poll1 = advanceAgentStream(first, emptyAgentStreamProgress())
+		expect(poll1.stream.current).toBe('Let me check.')
+		const poll2 = advanceAgentStream(afterCall, poll1)
+		expect(poll2.stream.current).toBe('')
+		expect(poll2.stream.entries[0]).toEqual({ kind: 'assistant', content: 'Let me check.' })
+		const poll3 = advanceAgentStream(
+			afterCall + '{"type":"token_delta","content":"Done."}\n',
+			poll2
+		)
+		expect(poll3.stream.current).toBe('Done.')
+	})
+
+	// Extended thinking emits reasoning with no narration before the tool call, so
+	// the turn boundary is the only thing that can end it.
+	it('ends a turn that thought without narrating', () => {
+		const raw = [
+			'{"type":"reasoning_token_delta","content":"The user wants the metrics."}',
+			'{"type":"tool_call","call_id":"c1","function_name":"q"}',
+			'{"type":"tool_result","call_id":"c1","function_name":"q","result":"{}","success":true}',
+			'{"type":"reasoning_token_delta","content":"eu-central-1 looks down."}',
+			''
+		].join('\n')
+		const { stream } = advanceAgentStream(raw, emptyAgentStreamProgress())
+		expect(stream.reasoning).toBe('eu-central-1 looks down.')
+	})
+
+	// Bedrock has its own streaming implementation rather than the shared SSE
+	// parsers, and never announces `tool_call` — only the arguments, then the
+	// worker's `tool_execution`. Keying the reset on `tool_call` alone leaves the
+	// narration in place for that provider.
+	it('resets on a provider that never announces the call itself', () => {
+		const raw = [
+			'{"type":"token_delta","content":"Let me check the metrics."}',
+			'{"type":"tool_call_arguments","call_id":"c1","function_name":"q","arguments":"{}"}',
+			'{"type":"tool_execution","call_id":"c1","function_name":"q"}',
+			'{"type":"tool_result","call_id":"c1","function_name":"q","result":"{}","success":true}',
+			'{"type":"token_delta","content":"eu-central-1 is down."}',
+			''
+		].join('\n')
+		const { stream } = advanceAgentStream(raw, emptyAgentStreamProgress())
+		expect(stream.current).toBe('eu-central-1 is down.')
+		// The narration became a row rather than disappearing.
+		expect(stream.entries[0]).toEqual({ kind: 'assistant', content: 'Let me check the metrics.' })
+	})
+
+	// A script can write anything to `result_stream`, so an event is not guaranteed
+	// the fields its type declares.
+	it('ignores an event with nothing to key a row by, or no text to add', () => {
+		const raw =
+			'{"type":"token_delta","content":"Hi."}\n{"type":"token_delta"}\n{"type":"tool_call"}\n'
+		const { stream } = advanceAgentStream(raw, emptyAgentStreamProgress())
+		expect(stream.entries).toEqual([])
+		expect(stream.current).toBe('Hi.')
+	})
+})
+
+// A result is whatever a script returned, so a message that has a `role` still has
+// arbitrary anything underneath. Coercing once here is what lets every reader
+// treat `AgentMessage` as true; a bad value reaching them throws mid-render and
+// takes the result viewer down, including the plain error it usually rides on.
+describe('coercing messages at the boundary', () => {
+	function messagesOf(raw: unknown) {
+		return parseAgentResult({ output: '', messages: raw })?.messages
+	}
+
+	it.each([
+		['tool_calls that are not a list', { role: 'assistant', tool_calls: {} }],
+		['a null entry inside tool_calls', { role: 'assistant', tool_calls: [null] }],
+		[
+			'a tool call whose function is a string',
+			{ role: 'assistant', tool_calls: [{ id: 'c1', function: 'q' }] }
+		],
+		[
+			'non-string arguments',
+			{ role: 'assistant', tool_calls: [{ id: 'c1', function: { arguments: 3 } }] }
+		],
+		['annotations that are not a list', { role: 'assistant', annotations: 'abc' }],
+		['a null entry inside annotations', { role: 'assistant', annotations: [null] }],
+		['an annotation with no url', { role: 'assistant', annotations: [{ title: 'x' }] }],
+		['an agent_action that is not an object', { role: 'tool', agent_action: 'tool_call' }],
+		['an agent_action with no type', { role: 'tool', agent_action: {} }]
+	])('survives %s', (_label, message) => {
+		const parsed = messagesOf([message])
+		expect(parsed).toHaveLength(1)
+		expect(() => buildAgentTrace(parsed!)).not.toThrow()
+	})
+
+	it('keeps a well-formed call intact', () => {
+		const parsed = messagesOf([
+			{
+				role: 'assistant',
+				tool_calls: [{ id: 'c1', type: 'function', function: { name: 'q', arguments: '{}' } }]
+			}
+		])
+		expect(parsed?.[0].tool_calls).toEqual([
+			{ id: 'c1', type: 'function', function: { name: 'q', arguments: '{}' } }
+		])
+	})
+})
@@ -0,0 +1,341 @@
+import type { FlowStatusModule } from '$lib/gen'
+import { parseStreamEvents, type AgentStreamEvent } from 'windmill-chat'
+
+/** The `agent_action` tag the worker puts on every message it records. */
+export type AgentAction = NonNullable<FlowStatusModule['agent_actions']>[number]
+
+export type AgentTokenUsage = {
+	input_tokens?: number
+	output_tokens?: number
+	total_tokens?: number
+	cache_read_input_tokens?: number
+	cache_write_input_tokens?: number
+}
+
+export type AgentMessage = {
+	role: string
+	content?: unknown
+	tool_calls?: Array<{
+		id?: string
+		type?: string
+		function?: { name?: string; arguments?: string }
+	}>
+	tool_call_id?: string
+	agent_action?: AgentAction
+	annotations?: Array<{ url: string; title?: string; start_index?: number; end_index?: number }>
+}
+
+/** The envelope every AI agent step returns, built by `AIAgentResult`. */
+export type AgentResult = {
+	output: unknown
+	messages: AgentMessage[]
+	usage?: AgentTokenUsage
+	wm_stream?: string
+	/** The model's thinking across every iteration, blank-line separated. */
+	reasoning?: string
+}
+
+/**
+ * Every key `AIAgentResult` can serialize; the optional ones are skipped when
+ * empty. The signature below is closed, so a key the worker gains and this list
+ * does not makes every run carrying it fall back to the raw JSON.
+ */
+const ENVELOPE_KEYS = ['output', 'messages', 'usage', 'wm_stream', 'reasoning']
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+	return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+function hasRole(message: unknown): boolean {
+	return isRecord(message) && typeof message.role === 'string'
+}
+
+/**
+ * A job result is whatever its script returned, so a message that passed the shape
+ * check still has anything underneath. Coerced once here rather than guarded at
+ * each reader: a wrong type reaching one throws mid-render and takes the whole
+ * result viewer down, including the plain error it usually rides on.
+ */
+function toAgentMessage(raw: Record<string, unknown>): AgentMessage {
+	const toolCalls = Array.isArray(raw.tool_calls)
+		? raw.tool_calls.filter(isRecord).map((call) => ({
+				id: typeof call.id === 'string' ? call.id : undefined,
+				type: typeof call.type === 'string' ? call.type : undefined,
+				function: isRecord(call.function)
+					? {
+							name: typeof call.function.name === 'string' ? call.function.name : undefined,
+							arguments:
+								typeof call.function.arguments === 'string' ? call.function.arguments : undefined
+						}
+					: undefined
+			}))
+		: undefined
+	const annotations = Array.isArray(raw.annotations)
+		? raw.annotations.filter(
+				(a): a is Record<string, unknown> => isRecord(a) && typeof a.url === 'string'
+			)
+		: undefined
+	return {
+		role: raw.role as string,
+		content: raw.content,
+		tool_calls: toolCalls,
+		tool_call_id: typeof raw.tool_call_id === 'string' ? raw.tool_call_id : undefined,
+		// The union is discriminated on `type`; an action without a string one
+		// matches no branch and is treated as untagged.
+		agent_action:
+			isRecord(raw.agent_action) && typeof raw.agent_action.type === 'string'
+				? (raw.agent_action as unknown as AgentAction)
+				: undefined,
+		annotations: annotations as AgentMessage['annotations']
+	}
+}
+
+function toAgentMessages(raw: unknown[]): AgentMessage[] {
+	return raw.map((message) => toAgentMessage(message as Record<string, unknown>))
+}
+
+/**
+ * Recognised by shape, not a marker key: sniffing works on completed runs, and an
+ * added key would travel into a parent agent's conversation. Deliberately not also
+ * requiring a tagged `agent_action` — a run answering through a structured-output
+ * tool tags nothing, and hiding a real answer costs more than claiming a lookalike.
+ */
+export function parseAgentResult(result: unknown): AgentResult | undefined {
+	if (!isRecord(result)) {
+		return undefined
+	}
+	const keys = Object.keys(result)
+	if (!keys.every((key) => ENVELOPE_KEYS.includes(key))) {
+		return undefined
+	}
+	if (!('output' in result) || !Array.isArray(result.messages)) {
+		return undefined
+	}
+	// An agent always records at least the message it was asked, so an empty list
+	// is someone else's result rather than a run that did nothing.
+	if (result.messages.length === 0 || !result.messages.every(hasRole)) {
+		return undefined
+	}
+	return {
+		output: result.output,
+		messages: toAgentMessages(result.messages),
+		usage: isRecord(result.usage) ? (result.usage as AgentTokenUsage) : undefined,
+		wm_stream: typeof result.wm_stream === 'string' ? result.wm_stream : undefined,
+		reasoning: typeof result.reasoning === 'string' ? result.reasoning : undefined
+	}
+}
+
+/**
+ * A run stopped by `max_iterations` fails, so it returns an error rather than an
+ * envelope — but the worker attaches the conversation so far to it. That partial
+ * transcript is the whole reason to look at a run that hit the cap.
+ */
+export function parseAgentErrorMessages(result: unknown): AgentMessage[] | undefined {
+	if (!isRecord(result) || !isRecord(result.error)) {
+		return undefined
+	}
+	const inner = result.error.result
+	if (!isRecord(inner) || !Array.isArray(inner.messages)) {
+		return undefined
+	}
+	if (inner.messages.length === 0 || !inner.messages.every(hasRole)) {
+		return undefined
+	}
+	return toAgentMessages(inner.messages)
+}
+
+export type AgentResultSummary = {
+	toolCalls: number
+	webSearches: number
+	tokens: number | undefined
+	cachedTokens: number | undefined
+}
+
+function actionType(message: AgentMessage): string | undefined {
+	return message.agent_action?.type
+}
+
+export function summarizeAgentResult(result: AgentResult): AgentResultSummary {
+	let toolCalls = 0
+	let webSearches = 0
+	for (const message of result.messages) {
+		const type = actionType(message)
+		if (type === 'tool_call' || type === 'mcp_tool_call') {
+			toolCalls++
+		} else if (type === 'web_search') {
+			webSearches++
+		}
+	}
+	const usage = result.usage
+	// `total_tokens` is what providers report when they report anything; fall back
+	// to the parts so a provider that only sends the split still shows a count.
+	const tokens =
+		usage?.total_tokens ??
+		(usage?.input_tokens !== undefined || usage?.output_tokens !== undefined
+			? (usage?.input_tokens ?? 0) + (usage?.output_tokens ?? 0)
+			: undefined)
+	return {
+		toolCalls,
+		webSearches,
+		tokens,
+		cachedTokens: usage?.cache_read_input_tokens
+	}
+}
+
+export type AgentStreamEntry =
+	| { kind: 'assistant'; content: string }
+	| { kind: 'tool'; callId: string; name: string; running: boolean; success?: boolean }
+
+export type AgentStream = {
+	/**
+	 * What the run has finished doing, in order — the same rows the completed
+	 * trace will show, so nothing on screen moves when the result lands.
+	 */
+	entries: AgentStreamEntry[]
+	/**
+	 * The text of the turn being written. It is not yet the output: a turn that
+	 * goes on to call a tool was narration, and only the run ending decides which
+	 * this was. So it stays unlabelled here and becomes one or the other.
+	 */
+	current: string
+	reasoning: string
+}
+
+/** How much of the stream has been folded in, so the next poll starts there. */
+export type AgentStreamProgress = { consumed: number; stream: AgentStream }
+
+export function emptyAgentStreamProgress(): AgentStreamProgress {
+	return { consumed: 0, stream: { entries: [], current: '', reasoning: '' } }
+}
+
+/**
+ * Any of these means a tool call is beginning, and which one arrives depends on
+ * the provider: the SSE parsers announce `tool_call`, while Bedrock streams only
+ * the arguments and the worker follows with `tool_execution`. Resetting on all
+ * three is idempotent and keeps the rule provider-independent.
+ */
+const TOOL_TURN_STARTED: AgentStreamEvent['type'][] = [
+	'tool_call',
+	'tool_call_arguments',
+	'tool_execution'
+]
+
+/**
+ * Whether an event carries what its type declares: a delta its text, a tool event
+ * the `call_id` its row is keyed on and the name that labels it. `result_stream` is
+ * whatever the job wrote, so detection and the fold ask the same question — were
+ * they to differ, a stream would be claimed and then render nothing.
+ */
+function isWellFormedEvent(event: AgentStreamEvent): boolean {
+	if (event.type === 'token_delta' || event.type === 'reasoning_token_delta') {
+		return typeof event.content === 'string'
+	}
+	return (
+		typeof event.call_id === 'string' &&
+		event.call_id !== '' &&
+		typeof event.function_name === 'string' &&
+		event.function_name !== ''
+	)
+}
+
+/**
+ * Whether `result_stream` is an agent's event stream rather than something a
+ * script printed. Reads only the first complete line, because it runs on every
+ * poll of a running job.
+ */
+export function isAgentStream(raw: string): boolean {
+	let start = 0
+	while (start < raw.length) {
+		const end = raw.indexOf('\n', start)
+		if (end === -1) {
+			// Only a partial first line so far; wait for the poll that completes it.
+			return false
+		}
+		const line = raw.slice(start, end)
+		if (line.trim() !== '') {
+			return parseStreamEvents(line).some(isWellFormedEvent)
+		}
+		start = end + 1
+	}
+	return false
+}
+
+/**
+ * Fold the events that arrived since `previous` into the answer so far. Incremental
+ * rather than a parse of the whole buffer: the stream only grows, a poll can arrive
+ * every 50ms, and a `tool_result` carries the tool's entire output, so re-reading it
+ * all each tick is quadratic with a large constant.
+ */
+export function advanceAgentStream(
+	raw: string,
+	previous: AgentStreamProgress
+): AgentStreamProgress {
+	// A trailing line with no newline yet is still being written, so it stays
+	// unconsumed until the poll that completes it.
+	const complete = raw.lastIndexOf('\n') + 1
+	if (complete <= previous.consumed) {
+		return previous
+	}
+	const stream: AgentStream = { ...previous.stream, entries: [...previous.stream.entries] }
+	for (const event of parseStreamEvents(raw.slice(previous.consumed, complete))) {
+		if (!isWellFormedEvent(event)) {
+			continue
+		}
+		if (event.type === 'token_delta') {
+			stream.current += event.content
+			continue
+		}
+		if (event.type === 'reasoning_token_delta') {
+			stream.reasoning += event.content
+			continue
+		}
+		if (TOOL_TURN_STARTED.includes(event.type)) {
+			if (stream.current !== '') {
+				// A model can narrate and request a tool in the same turn. The call
+				// settles what that text was: narration, not the output. It becomes a
+				// row rather than being dropped, so nothing vanishes from the screen
+				// only to reappear when the result lands.
+				stream.entries.push({ kind: 'assistant', content: stream.current })
+				stream.current = ''
+			}
+			// Thinking belongs to the turn that produced it, and a turn can think
+			// without narrating — extended thinking before a tool call is exactly
+			// that shape. So this clears on the boundary itself, not with the
+			// narration, or one turn's thoughts run into the next turn's.
+			stream.reasoning = ''
+		}
+		// The same call is announced, then argued, then executed, then answered.
+		// Keyed on `call_id` so those four events are one row rather than four.
+		const existing = stream.entries.find(
+			(e): e is Extract<AgentStreamEntry, { kind: 'tool' }> =>
+				e.kind === 'tool' && e.callId === event.call_id
+		)
+		const settled = event.type === 'tool_result'
+		if (existing) {
+			existing.running = !settled
+			existing.success = settled ? event.success === true : existing.success
+		} else {
+			stream.entries.push({
+				kind: 'tool',
+				callId: event.call_id,
+				name: event.function_name,
+				running: !settled,
+				success: settled ? event.success === true : undefined
+			})
+		}
+	}
+	return { consumed: complete, stream }
+}
+
+/**
+ * Token counts run to five and six figures, where the exact digit is noise. The
+ * millions branch is not decoration: usage accumulates over every loop
+ * iteration, and each one re-sends the whole context.
+ */
+export function formatTokenCount(count: number): string {
+	if (count < 1000) {
+		return String(count)
+	}
+	const [scaled, unit] = count < 1_000_000 ? [count / 1000, 'k'] : [count / 1_000_000, 'M']
+	return `${scaled < 10 ? scaled.toFixed(1) : Math.round(scaled)}${unit}`
+}
@@ -1,4 +1,5 @@
 <script lang="ts">
+	import { createBottomSticker } from '$lib/components/stickToBottom'
 	import AIChatMessage from './AIChatMessage.svelte'
 	import AppAvailableContextList from './AppAvailableContextList.svelte'
 	import ChatContextPicker from './ChatContextPicker.svelte'
@@ -266,21 +267,11 @@
 		return () => window.removeEventListener('keydown', onWindowKeydownCapture, true)
 	})

-	// Programmatic-scroll guard. `scrollDown()` triggers an async `scroll`
-	// event; if a token-append between the scrollTo and the dispatch makes
-	// scrollHeight grow, the gap can briefly exceed STICK_TO_BOTTOM_PX and
-	// disengage auto-scroll mid-stream. A short cooldown after our own
-	// scroll swallows that spurious event without affecting genuine user
-	// scrolls (wheel/touch/keyboard are reaction-time orders of magnitude
-	// slower than the cooldown).
-	const PROGRAMMATIC_SCROLL_COOLDOWN_MS = 120
-	let programmaticScrollAt: number | undefined
-	// Instant scroll — smooth would animate every token append, racing with
-	// the next scrollDown and confusing the onscroll bottom-detection below.
+	// Shared with the agent run viewer, which needs the same programmatic-scroll
+	// guard for the same reason.
+	const sticker = createBottomSticker()
 	function scrollDown() {
-		if (!scrollElement) return
-		programmaticScrollAt = Date.now()
-		scrollElement.scrollTo({ top: scrollElement.scrollHeight, behavior: 'auto' })
+		sticker.scrollToEnd(scrollElement)
 	}

 	let height = $state(0)
@@ -299,10 +290,6 @@
 		}
 	})

-	// Pixel distance from the bottom under which we treat the user as
-	// "stuck to the bottom" and re-enable automatic scroll. 8px allows for
-	// sub-pixel rounding from scrollTo + the occasional overscroll bounce.
-	const STICK_TO_BOTTOM_PX = 8
 	// Show the "scroll to latest" arrow only once the user has scrolled
 	// meaningfully away from the tail — a couple of message-heights up. Avoids
 	// flicker when the auto-scroll lags by a few px during streaming.
@@ -317,13 +304,10 @@
 		// whose only event would otherwise be swallowed, leaving the arrow
 		// stuck visible after we already reached the bottom.
 		showScrollToLatest = distance > SCROLL_TO_LATEST_THRESHOLD_PX
-		if (
-			programmaticScrollAt !== undefined &&
-			Date.now() - programmaticScrollAt < PROGRAMMATIC_SCROLL_COOLDOWN_MS
-		) {
+		if (sticker.isOwnScroll()) {
 			return
 		}
-		if (distance <= STICK_TO_BOTTOM_PX) {
+		if (sticker.isAtEnd(scrollElement)) {
 			chatHost.enableAutomaticScroll()
 		} else {
 			chatHost.disableAutomaticScroll()
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				`ALTER TABLE workspace_settings DROP COLUMN add_admins_and_developers_to_forks;`
				`@@ -0,0 +1 @@`
				`ALTER TABLE workspace_settings ADD COLUMN add_admins_and_developers_to_forks BOOLEAN NOT NULL DEFAULT false;`