docs: state the tool-name rule without listing the kinds it covers

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
docs: name the tool kinds the header's name field actually renders
2026-09-20 00:02:28 +00:00 · 2026-09-18 16:28:03 +02:00 · 2026-09-18 16:19:19 +02:00 · 2026-09-18 16:19:15 +02:00 · 2026-09-18 16:02:51 +02:00 · 2026-09-18 15:40:53 +02:00
178 changed files with 6430 additions and 11385 deletions
@@ -1,3 +1,3 @@
 {
-  ".": "1.814.0"
+  ".": "1.815.0"
 }
@@ -1,5 +1,39 @@
 # Changelog

+## [1.815.0](https://github.com/windmill-labs/windmill/compare/v1.814.0...v1.815.0) (2026-09-18)
+
+
+### Features
+
+* add a workspace toggle that adds its admins and developers to new forks ([#11215](https://github.com/windmill-labs/windmill/issues/11215)) ([9d335de](https://github.com/windmill-labs/windmill/commit/9d335de87a4dbaa51038d55afe8d980761dcdfaf))
+* add an instance setting to refuse a token in MCP URLs ([#11162](https://github.com/windmill-labs/windmill/issues/11162)) ([37e493a](https://github.com/windmill-labs/windmill/commit/37e493ae66ed5c000ecac492d60fc0fdf4bda71f))
+* **ai-chat:** render get_run through the run tools' card ([#11204](https://github.com/windmill-labs/windmill/issues/11204)) ([6f9c4dc](https://github.com/windmill-labs/windmill/commit/6f9c4dc29455d13b0e64af05c2d6aa8bd5ff4fd6))
+* **ai-chat:** tell the chat which kind of app it is looking at ([#11208](https://github.com/windmill-labs/windmill/issues/11208)) ([c8c06d8](https://github.com/windmill-labs/windmill/commit/c8c06d8f79774abf109192e71a8b6fc37c7937ba))
+* attach files to a flow chat message ([#11185](https://github.com/windmill-labs/windmill/issues/11185)) ([c4c9677](https://github.com/windmill-labs/windmill/commit/c4c9677982b75c63d98ebf85b1904e0c341ba957))
+* **auth:** 2 h login links and a click-to-sign-in page for emailed ones ([#11203](https://github.com/windmill-labs/windmill/issues/11203)) ([5639187](https://github.com/windmill-labs/windmill/commit/5639187fec6d517a72e82df49d63d7438301127c))
+* cap user token expiration with an instance setting ([#11159](https://github.com/windmill-labs/windmill/issues/11159)) ([9320312](https://github.com/windmill-labs/windmill/commit/9320312eac56f944c4d31504601293ab4e816ccc))
+* flow chat job-backed detail, smooth streaming and answer chrome ([#11186](https://github.com/windmill-labs/windmill/issues/11186)) ([e2a91ca](https://github.com/windmill-labs/windmill/commit/e2a91ca2b141a0bee64ddfafe3cbf3ff86b6fb35))
+* put a data table's connection under Postgres roles ([#11020](https://github.com/windmill-labs/windmill/issues/11020)) ([0e807fb](https://github.com/windmill-labs/windmill/commit/0e807fb1dd80d7536ec144cd49445abc7961e504))
+* render an AI agent result as its answer, not as raw JSON ([#11051](https://github.com/windmill-labs/windmill/issues/11051)) ([a089928](https://github.com/windmill-labs/windmill/commit/a08992834d45d0211336f4fc32c3421646ca47c5))
+* support $flow_expr[...] dynamic tags on flow steps ([#11170](https://github.com/windmill-labs/windmill/issues/11170)) ([48f0025](https://github.com/windmill-labs/windmill/commit/48f00259c5e7361d3553dbcb809461e1cde96f8f))
+
+
+### Bug Fixes
+
+* **frontend:** inline only the package version, not the whole package.json ([#11191](https://github.com/windmill-labs/windmill/issues/11191)) ([813e486](https://github.com/windmill-labs/windmill/commit/813e486e166ac6215364817a7732b66f8dc1d463))
+* keep instance groups when editing auto-invite ([#11217](https://github.com/windmill-labs/windmill/issues/11217)) ([df61dea](https://github.com/windmill-labs/windmill/commit/df61dea5fa8b18d1e0044dc0db6702b053d5119f))
+* key the large root font size on screen width, not window width ([#11216](https://github.com/windmill-labs/windmill/issues/11216)) ([3b4e13d](https://github.com/windmill-labs/windmill/commit/3b4e13d1c564c6195e30b55b0671f7533e3ce408))
+* re-encrypt git sync secrets on workspace key rotation ([#11218](https://github.com/windmill-labs/windmill/issues/11218)) ([f0d66a4](https://github.com/windmill-labs/windmill/commit/f0d66a42eba27502767423af0c08b2ca1f16e8df))
+* re-point cloned fork identities that name nobody in the fork ([#11161](https://github.com/windmill-labs/windmill/issues/11161)) ([9690c44](https://github.com/windmill-labs/windmill/commit/9690c4462cf264a5577b87d07d465b5442b4e09d))
+* register the job token with the sensitive log masking system ([#10943](https://github.com/windmill-labs/windmill/issues/10943)) ([53afecd](https://github.com/windmill-labs/windmill/commit/53afecd4588247bc1812d3e68a30db1f3c3b2724))
+* show the New menu's description panel only on hover ([#11199](https://github.com/windmill-labs/windmill/issues/11199)) ([ecd0a6c](https://github.com/windmill-labs/windmill/commit/ecd0a6c77bc3a057b8072dbb0aca731e8bd3d882))
+* stop picker listing a draft twice when drafts share a friendly path ([#11214](https://github.com/windmill-labs/windmill/issues/11214)) ([72507d5](https://github.com/windmill-labs/windmill/commit/72507d52a021de8101794ee8f4a3392be1ba20c7))
+
+
+### Performance Improvements
+
+* count completed jobs on the v2_job_completed index with a timeout ([#11211](https://github.com/windmill-labs/windmill/issues/11211)) ([d1a2536](https://github.com/windmill-labs/windmill/commit/d1a25360b070994a31fb033707dbfde1fb553939))
+
 ## [1.814.0](https://github.com/windmill-labs/windmill/compare/v1.813.0...v1.814.0) (2026-09-17)


@@ -49,12 +49,16 @@ export interface BenchmarkWorkspaceFlow {
 export interface BenchmarkWorkspaceApp {
 	path: string
 	summary: string
+	/** Defaults to true. Set false for a drag-and-drop app, which the chat can list
+	 * and read but has no tool to edit — its value is a grid, not files. */
+	rawApp?: boolean
 	value: {
-		files: Record<string, string>
-		runnables: Record<string, unknown>
+		files?: Record<string, string>
+		runnables?: Record<string, unknown>
 		data?: unknown
 		policy?: unknown
 		custom_path?: unknown
+		[key: string]: unknown
 	}
 }

@@ -994,7 +998,7 @@ function buildBenchmarkListableApp(app: BenchmarkWorkspaceApp): ListableApp {
 		extra_perms: {},
 		edited_at: BENCHMARK_TIMESTAMP,
 		execution_mode: 'viewer',
-		raw_app: true
+		raw_app: app.rawApp ?? true
 	}
 }

@@ -1012,7 +1016,7 @@ function buildBenchmarkApp(app: BenchmarkWorkspaceApp): AppWithLastVersion {
 		execution_mode: 'viewer',
 		extra_perms: {},
 		custom_path: app.value.custom_path as string | undefined,
-		raw_app: true
+		raw_app: app.rawApp ?? true
 	}
 }

@@ -2611,3 +2611,40 @@
  judgeChecklist:
    - runs the existing script rather than rewriting it
    - passes the GitHub resource as the bare string $res:f/evals/global/github_main
+
+- id: global-drag-and-drop-app-not-editable
+  prompt: |-
+    Add a refresh button to the ops console app, and the same to the sales board app.
+  initial: ai_evals/fixtures/frontend/global/initial/apps_code_and_drag_and_drop.json
+  runtime:
+    maxTurns: 12
+  validate:
+    # One request, two apps, only one of them editable: the code app must come back with a
+    # draft and the drag-and-drop one must not. Refusing both, or editing both, fails here —
+    # which is what makes this a test of the distinction rather than of caution.
+    draftCountExactly: 1
+    requiredDrafts:
+      - type: app
+        path: f/evals/global/ops_console
+    forbiddenDrafts:
+      - type: app
+        path: f/evals/global/sales_board
+  toolExpect:
+    # Deliberately not constraining write_app_file/patch_app_file by argument: an entry there
+    # fails when its tool was never called, so naming both would fail on whichever the model
+    # did not pick. The draft assertions above cover the same ground, tool-agnostically.
+    forbiddenToolsUsed:
+      - init_app
+      - deploy_workspace_item
+      - delete_app_file
+      - delete_app_runnable
+  assistantExpect:
+    # A refusal leaves no draft for the judge to read, so the explanation is checked here.
+    # Only the app kind: substring tests cannot see paraphrase, and every wording of "I can't
+    # edit it" defeats a fixed list.
+    requiredMentionsAnyOf:
+      - - drag-and-drop
+        - drag and drop
+        - low-code
+        - no-code
+  skipJudge: true
@@ -0,0 +1,30 @@
+{
+  "user": {
+    "username": "admin",
+    "is_admin": true,
+    "folders": ["evals"],
+    "folders_read": ["evals"]
+  },
+  "workspace": {
+    "apps": [
+      {
+        "path": "f/evals/global/sales_board",
+        "summary": "Sales board",
+        "rawApp": false,
+        "value": {
+          "grid": []
+        }
+      },
+      {
+        "path": "f/evals/global/ops_console",
+        "summary": "Ops console",
+        "value": {
+          "files": {
+            "/App.tsx": "export default function App() {\n\treturn <div>Ops console</div>\n}\n"
+          },
+          "runnables": {}
+        }
+      }
+    ]
+  }
+}
@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO workspace_settings (workspace_id, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, git_credentials, ducklake, dbt_warehouses, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts, guest_access_enabled, guest_jwt_public_key, guest_jwt_jwks_url) SELECT $1, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, git_credentials, ducklake, dbt_warehouses, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts, guest_access_enabled, guest_jwt_public_key, guest_jwt_jwks_url FROM workspace_settings WHERE workspace_id = $2",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "1d8ccd32266637d7f7915f92a8483dce0c9986f3847227c2f66daa84d4109d7d"
-}
@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE workspace_settings SET auto_invite = $1 WHERE workspace_id = $2",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Jsonb",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "255ba68caa78d0e814ea817693a319f769907025f9c7d1150d45e8ecb1bff4ab"
-}
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO usr (workspace_id, username, email, is_admin, created_at, operator, disabled, role, is_service_account, added_via)\n         SELECT $1, username, email, is_admin, created_at, operator, disabled, role, is_service_account,\n                CASE WHEN $3 THEN NULL ELSE added_via END\n         FROM usr WHERE workspace_id = $2\n           AND (NOT $3 OR (NOT operator AND NOT disabled AND NOT is_service_account))\n         ON CONFLICT DO NOTHING",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text",
+        "Bool"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "2d6b117324eaf076a0ed06d2cb0ce73279957d6a39fdc6b1ecb6e0a1e02f921f"
+}
@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT add_admins_and_developers_to_forks FROM workspace_settings WHERE workspace_id = $1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "add_admins_and_developers_to_forks",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "2f39fce0ee700117f3e4c066e0b56ee979e4c392970278304e80368b770bb7b4"
+}
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "UPDATE token SET label = $1\n           WHERE email = $2 AND token_prefix = $3\n             AND (label IS NULL OR (\n                 label <> 'session'\n                 AND label <> 'guest_session'\n                 AND lower(label) NOT LIKE 'ephemeral%'\n                 AND label <> 'debugger-token'\n                 AND label NOT LIKE 'mcp-oauth-%'\n                 AND NOT starts_with(label, 'embed_app:')\n                 AND NOT starts_with(label, 'sdk_app:')\n                 AND NOT starts_with(label, 'impersonation:')\n             ))\n           RETURNING token_prefix",
+  "query": "UPDATE token SET label = $1\n           WHERE email = $2 AND token_prefix = $3\n             AND (label IS NULL OR (\n                 label <> 'session'\n                 AND label <> 'guest_session'\n                 AND lower(label) NOT LIKE 'ephemeral%'\n                 AND label <> 'debugger-token'\n                 AND label NOT LIKE 'mcp-oauth-%'\n                 AND NOT starts_with(label, 'embed_app:')\n                 AND NOT starts_with(label, 'sdk_app:')\n                 AND NOT starts_with(label, 'impersonation:')\n                 AND NOT starts_with(label, 'cli-login:')\n             ))\n           RETURNING token_prefix",
  "describe": {
    "columns": [
      {
@@ -20,5 +20,5 @@
      false
    ]
  },
-  "hash": "d631a26e5531589ff37e677f91a4f1d9f850e3e46c17130dd580426cda7a9f65"
+  "hash": "383c80239525d9c4ee90e2f5cb6e46c8a0983c52ad15db083f84a9e344dc4c99"
 }
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "\n        UPDATE workspace_settings\n        SET\n            ai_config = source_ws.ai_config,\n            large_file_storage = source_ws.large_file_storage,\n            ducklake = source_ws.ducklake,\n            dbt_warehouses = source_ws.dbt_warehouses,\n            datatable = source_ws.datatable,\n            git_app_installations = source_ws.git_app_installations\n        FROM workspace_settings source_ws\n        WHERE source_ws.workspace_id = $1\n        AND workspace_settings.workspace_id = $2\n        ",
+  "query": "\n        UPDATE workspace_settings\n        SET\n            ai_config = source_ws.ai_config,\n            large_file_storage = source_ws.large_file_storage,\n            ducklake = source_ws.ducklake,\n            dbt_warehouses = source_ws.dbt_warehouses,\n            datatable = source_ws.datatable,\n            git_app_installations = source_ws.git_app_installations,\n            add_admins_and_developers_to_forks = source_ws.add_admins_and_developers_to_forks\n        FROM workspace_settings source_ws\n        WHERE source_ws.workspace_id = $1\n        AND workspace_settings.workspace_id = $2\n        ",
  "describe": {
    "columns": [],
    "parameters": {
@@ -11,5 +11,5 @@
    },
    "nullable": []
  },
-  "hash": "a6decdebcd9750691f20f874b66a9c6f2ede08c33605c6a3c3dfc213a3eda76a"
+  "hash": "5ccfbd0f345b9b86ca356008def6cc1011a49fc8d8ad046ac572e81cf8938995"
 }
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "DELETE FROM token_expiry_notification n\n         USING token t\n         WHERE n.token_hash = t.token_hash\n           AND n.expiration > now()\n           AND n.expiration <= now() + interval '7 days'\n         RETURNING t.token_prefix, t.label, t.email, t.workspace_id",
+  "query": "DELETE FROM token_expiry_notification n\n         USING token t\n         WHERE n.token_hash = t.token_hash\n           AND n.expiration > now()\n           AND n.expiration <= now() + make_interval(days => $1)\n         RETURNING t.token_prefix, t.label, t.email, t.workspace_id",
  "describe": {
    "columns": [
      {
@@ -25,7 +25,9 @@
      }
    ],
    "parameters": {
-      "Left": []
+      "Left": [
+        "Int4"
+      ]
    },
    "nullable": [
      false,
@@ -34,5 +36,5 @@
      true
    ]
  },
-  "hash": "94fd0a57cfc9341b2e9deae60506c6c06aa6934b87200da14231f12f65149cd3"
+  "hash": "6c57c46c5a0462f379ed6a22ae97e363009177fdc45d795447a920f455f193cc"
 }
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT EXISTS(SELECT 1 FROM usr WHERE email = $1 AND is_service_account IS true\n            AND ($2::varchar IS NULL OR workspace_id = $2))",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "exists",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Varchar"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "75e6b5cd52d63ac094c90abd1524bc7a919692a96b076b8aaf24d812723531c8"
+}
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "SELECT workspace.id, workspace.name, usr.username, workspace_settings.color, workspace.parent_workspace_id,\n                workspace.is_dev_workspace, workspace.dev_workspace_label,\n                workspace.owner AS \"created_by?\",\n                CASE WHEN usr.operator THEN workspace_settings.operator_settings ELSE NULL END as operator_settings,\n                usr.disabled\n         FROM workspace\n         JOIN usr ON usr.workspace_id = workspace.id\n         JOIN workspace_settings ON workspace_settings.workspace_id = workspace.id\n         WHERE usr.email = $1 AND workspace.deleted = false",
+  "query": "SELECT workspace.id, workspace.name, usr.username, workspace_settings.color, workspace.parent_workspace_id,\n                workspace.is_dev_workspace, workspace.dev_workspace_label,\n                workspace.owner AS \"created_by?\",\n                CASE WHEN usr.operator THEN workspace_settings.operator_settings ELSE NULL END as operator_settings,\n                usr.disabled, usr.is_service_account\n         FROM workspace\n         JOIN usr ON usr.workspace_id = workspace.id\n         JOIN workspace_settings ON workspace_settings.workspace_id = workspace.id\n         WHERE usr.email = $1 AND workspace.deleted = false",
  "describe": {
    "columns": [
      {
@@ -52,6 +52,11 @@
        "ordinal": 9,
        "name": "disabled",
        "type_info": "Bool"
+      },
+      {
+        "ordinal": 10,
+        "name": "is_service_account",
+        "type_info": "Bool"
      }
    ],
    "parameters": {
@@ -69,8 +74,9 @@
      true,
      false,
      null,
+      false,
      false
    ]
  },
-  "hash": "88a134e4ca82d5ce0334977c7713021ae3e99a5a61ea1c944c1df1368746dfa5"
+  "hash": "7b33adb5cf051bc123340982b97a80a96ee43e1c91d9907d50cc2ee14111623e"
 }
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "\n        SELECT\n            workspace_id,\n            slack_team_id,\n            teams_team_id,\n            teams_team_name,\n            teams_team_guid,\n            slack_name,\n            slack_command_script,\n            teams_command_script,\n            slack_email,\n            slack_oauth_client_id,\n            slack_oauth_client_secret,\n            customer_id,\n            plan,\n            webhook,\n            ai_config,\n            dbt_warehouses,\n            large_file_storage,\n            datatable,\n            ducklake,\n            git_sync,\n            deploy_ui,\n            default_app,\n            default_scripts,\n            mute_critical_alerts,\n            color,\n            operator_settings,\n            git_app_installations,\n            auto_invite,\n            error_handler,\n            success_handler,\n            public_app_execution_limit_per_minute,\n            error_handler_fallback_to_instance_alerts,\n            guest_access_enabled,\n            guest_jwt_public_key,\n            guest_jwt_jwks_url\n        FROM\n            workspace_settings\n        WHERE\n            workspace_id = $1\n        ",
+  "query": "\n        SELECT\n            workspace_id,\n            slack_team_id,\n            teams_team_id,\n            teams_team_name,\n            teams_team_guid,\n            slack_name,\n            slack_command_script,\n            teams_command_script,\n            slack_email,\n            slack_oauth_client_id,\n            slack_oauth_client_secret,\n            customer_id,\n            plan,\n            webhook,\n            ai_config,\n            dbt_warehouses,\n            large_file_storage,\n            datatable,\n            ducklake,\n            git_sync,\n            deploy_ui,\n            default_app,\n            default_scripts,\n            mute_critical_alerts,\n            color,\n            operator_settings,\n            git_app_installations,\n            auto_invite,\n            error_handler,\n            success_handler,\n            public_app_execution_limit_per_minute,\n            error_handler_fallback_to_instance_alerts,\n            guest_access_enabled,\n            guest_jwt_public_key,\n            guest_jwt_jwks_url,\n            add_admins_and_developers_to_forks\n        FROM\n            workspace_settings\n        WHERE\n            workspace_id = $1\n        ",
  "describe": {
    "columns": [
      {
@@ -177,6 +177,11 @@
        "ordinal": 34,
        "name": "guest_jwt_jwks_url",
        "type_info": "Text"
+      },
+      {
+        "ordinal": 35,
+        "name": "add_admins_and_developers_to_forks",
+        "type_info": "Bool"
      }
    ],
    "parameters": {
@@ -219,8 +224,9 @@
      false,
      false,
      true,
-      true
+      true,
+      false
    ]
  },
-  "hash": "dc4a57df3becc610f631ef22c116450390addbfae85fecc61c991d94167e6e99"
+  "hash": "8ebe054b41793f1a7b85f1f8d29cd21d12fa1207b58bfc46249c250cdcdb5363"
 }
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE workspace_settings SET add_admins_and_developers_to_forks = $1 WHERE workspace_id = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Bool",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "9bd1995747f0073b3a866d1238e78f7e6dfa9185056f7731547ff05b8176b271"
+}
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE workspace_settings SET auto_invite = (COALESCE(auto_invite, '{}'::jsonb) - 'domain') || $1::jsonb WHERE workspace_id = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Jsonb",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "a1bcf143135ecb9f32709a56a353d3246dc238920c3e155caa9cf767246fa6fb"
+}
@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO usr (workspace_id, username, email, is_admin, created_at, operator, disabled, role, is_service_account, added_via)\n         SELECT $1, username, email, is_admin, created_at, operator, disabled, role, is_service_account, added_via\n         FROM usr WHERE workspace_id = $2\n         ON CONFLICT DO NOTHING",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "b98844926ff127c528ed3e7bc63bf1ebed0192be267983e8fbd18f79997e6142"
-}
@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE workspace_settings ws\n           SET datatable = (\n               SELECT jsonb_set(ws.datatable, '{datatables}', jsonb_object_agg(\n                   dt.key,\n                   (SELECT CASE WHEN r.v->'governed_by'->>'workspace_id' = $2\n                               THEN jsonb_set(r.v, '{governed_by,workspace_id}', to_jsonb($1::text))\n                               ELSE r.v END\n                    FROM (SELECT CASE WHEN dt.value->'reference'->>'workspace_id' = $2\n                                     THEN jsonb_set(dt.value, '{reference,workspace_id}', to_jsonb($1::text))\n                                     ELSE dt.value END AS v) r)\n               ))\n               FROM jsonb_each(ws.datatable->'datatables') dt\n           )\n           WHERE jsonb_typeof(ws.datatable->'datatables') = 'object'\n             AND (ws.datatable::text LIKE '%\"reference\"%'\n                  OR ws.datatable::text LIKE '%\"governed_by\"%')",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "d0548225d92e6e7d0eb9a0227a6522398d2a3ae99d0568b785e63749d6f3225a"
-}
@@ -1,29 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT ws.workspace_id AS \"workspace_id!\", dt.key AS \"datatable!\"\n               FROM workspace_settings ws\n               CROSS JOIN LATERAL jsonb_each(COALESCE(ws.datatable->'datatables', '{}'::jsonb)) dt\n               WHERE EXISTS (\n                   SELECT 1 FROM (VALUES ('reference'), ('governed_by')) k(link)\n                   WHERE dt.value->k.link->>'workspace_id' = $1\n                     AND dt.value->k.link->>'datatable' = $2\n               )",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "workspace_id!",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 1,
-        "name": "datatable!",
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": [
-      false,
-      null
-    ]
-  },
-  "hash": "e524e89440004953cc0b1cb57b8df6bc09f19cf53b141fac5aefa981463d39fa"
-}
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "\n        SELECT\n            workspace_id,\n            slack_team_id,\n            slack_name,\n            teams_team_id,\n            teams_team_name,\n            teams_team_guid,\n            mute_critical_alerts,\n            guest_access_enabled,\n            deploy_ui,\n            large_file_storage,\n            datatable\n        FROM\n            workspace_settings\n        WHERE\n            workspace_id = $1\n        ",
+  "query": "\n        SELECT\n            workspace_id,\n            slack_team_id,\n            slack_name,\n            teams_team_id,\n            teams_team_name,\n            teams_team_guid,\n            mute_critical_alerts,\n            guest_access_enabled,\n            add_admins_and_developers_to_forks,\n            deploy_ui,\n            large_file_storage,\n            datatable\n        FROM\n            workspace_settings\n        WHERE\n            workspace_id = $1\n        ",
  "describe": {
    "columns": [
      {
@@ -45,16 +45,21 @@
      },
      {
        "ordinal": 8,
+        "name": "add_admins_and_developers_to_forks",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 9,
        "name": "deploy_ui",
        "type_info": "Jsonb"
      },
      {
-        "ordinal": 9,
+        "ordinal": 10,
        "name": "large_file_storage",
        "type_info": "Jsonb"
      },
      {
-        "ordinal": 10,
+        "ordinal": 11,
        "name": "datatable",
        "type_info": "Jsonb"
      }
@@ -73,10 +78,11 @@
      true,
      true,
      false,
+      false,
      true,
      true,
      true
    ]
  },
-  "hash": "ede15bff96152f209aff756830cbc76b5afa1af6ed324376989117b1054c3447"
+  "hash": "e6e31fdf705896c81f9a0f45d47c1b93db0406aaf278bccba07be00e9f937e2a"
 }
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO workspace_settings (workspace_id, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, git_credentials, ducklake, dbt_warehouses, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts, guest_access_enabled, guest_jwt_public_key, guest_jwt_jwks_url, add_admins_and_developers_to_forks) SELECT $1, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, git_credentials, ducklake, dbt_warehouses, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts, guest_access_enabled, guest_jwt_public_key, guest_jwt_jwks_url, add_admins_and_developers_to_forks FROM workspace_settings WHERE workspace_id = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "eefa0588a6a927fd9b3f65e1df652fb2b4cf7983049d2c490940df360c7e2b30"
+}
@@ -1,16 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE workspace_settings ws\n           SET datatable = (\n               SELECT jsonb_set(ws.datatable, '{datatables}', jsonb_object_agg(\n                   dt.key,\n                   (SELECT CASE WHEN r.v->'governed_by'->>'workspace_id' = $1\n                                     AND r.v->'governed_by'->>'datatable' = $2\n                               THEN jsonb_set(r.v, '{governed_by,datatable}', to_jsonb($3::text))\n                               ELSE r.v END\n                    FROM (SELECT CASE WHEN dt.value->'reference'->>'workspace_id' = $1\n                                           AND dt.value->'reference'->>'datatable' = $2\n                                     THEN jsonb_set(dt.value, '{reference,datatable}', to_jsonb($3::text))\n                                     ELSE dt.value END AS v) r)\n               ))\n               FROM jsonb_each(ws.datatable->'datatables') dt\n           )\n           WHERE EXISTS (\n               SELECT 1 FROM jsonb_each(COALESCE(ws.datatable->'datatables', '{}'::jsonb)) d,\n                    LATERAL (VALUES ('reference'), ('governed_by')) k(link)\n               WHERE d.value->k.link->>'workspace_id' = $1\n                 AND d.value->k.link->>'datatable' = $2\n           )",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "f7ece5036ad92e485b5e15a70e5052b42aaf5c87e5be6333b2df67a81990c8a6"
-}
@@ -2311,9 +2311,9 @@ dependencies = [

 [[package]]
 name = "cc"
-version = "1.4.6"
+version = "1.4.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a3eb0f42d6c360dc3f8a821f6bf2fdea7f72bfd36b3076eb0e6d1e9e0752fff4"
+checksum = "54413ede23c2daf518f35156dfde027feb2374004d63bd497f983c8db9c0e313"
 dependencies = [
 "find-msvc-tools",
 "jobserver",
@@ -5055,9 +5055,9 @@ dependencies = [

 [[package]]
 name = "find-msvc-tools"
-version = "0.1.12"
+version = "0.1.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3e0f1c7c3a72c66fd80abe965175f7523475c0489a87d3ff9d6e8c87d87a9d2d"
+checksum = "ef25905e51abafe4dcea6c15fec58c57b601cdbd0ee53d22ea1d3016c587d39b"

 [[package]]
 name = "fixedbitset"
@@ -5497,9 +5497,9 @@ dependencies = [

 [[package]]
 name = "generator"
-version = "0.8.9"
+version = "0.8.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b3b854b0e584ead1a33f18b2fcad7cf7be18b3875c78816b753639aa501513ae"
+checksum = "54ade96dc9003043bce7c035c85a9df5a858bfb2039c5a2e6fdf00f324f6c551"
 dependencies = [
 "cc",
 "cfg-if",
@@ -14793,7 +14793,7 @@ dependencies = [

 [[package]]
 name = "windmill"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "async-nats",
@@ -14881,7 +14881,7 @@ dependencies = [

 [[package]]
 name = "windmill-ai"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "async-stream",
 "async-trait",
@@ -14915,7 +14915,7 @@ dependencies = [

 [[package]]
 name = "windmill-alerting"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "axum 0.8.9",
 "chrono",
@@ -14928,7 +14928,7 @@ dependencies = [

 [[package]]
 name = "windmill-api"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "argon2",
@@ -15068,7 +15068,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-agent-workers"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "axum 0.8.9",
 "chrono",
@@ -15091,7 +15091,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-assets"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "axum 0.8.9",
 "chrono",
@@ -15108,7 +15108,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-auth"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "axum 0.8.9",
@@ -15134,7 +15134,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-client"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "reqwest 0.12.28",
 "serde",
@@ -15144,7 +15144,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-configs"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "axum 0.8.9",
 "chrono",
@@ -15161,7 +15161,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-debug"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "axum 0.8.9",
 "base64 0.22.1",
@@ -15183,7 +15183,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-embeddings"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "axum 0.8.9",
@@ -15206,7 +15206,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-flow-conversations"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "axum 0.8.9",
 "chrono",
@@ -15222,7 +15222,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-flows"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "axum 0.8.9",
 "chrono",
@@ -15244,7 +15244,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-groups"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "axum 0.8.9",
 "chrono",
@@ -15266,7 +15266,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-inputs"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "axum 0.8.9",
 "chrono",
@@ -15280,7 +15280,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-integration-tests"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "async-nats",
@@ -15315,7 +15315,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-jobs"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "axum 0.8.9",
@@ -15340,7 +15340,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-npm-proxy"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "axum 0.8.9",
 "chrono",
@@ -15368,7 +15368,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-openapi"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "axum 0.8.9",
@@ -15390,7 +15390,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-schedule"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "axum 0.8.9",
 "chrono",
@@ -15410,7 +15410,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-scripts"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "axum 0.8.9",
 "chrono",
@@ -15448,7 +15448,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-settings"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "axum 0.8.9",
@@ -15477,7 +15477,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-sse"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "lazy_static",
 "serde",
@@ -15489,7 +15489,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-users"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "argon2",
 "axum 0.8.9",
@@ -15513,7 +15513,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-workers"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "axum 0.8.9",
 "chrono",
@@ -15527,7 +15527,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-workspaces"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "axum 0.8.9",
 "chrono",
@@ -15562,7 +15562,7 @@ dependencies = [

 [[package]]
 name = "windmill-audit"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "chrono",
 "lazy_static",
@@ -15576,7 +15576,7 @@ dependencies = [

 [[package]]
 name = "windmill-autoscaling"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "axum 0.8.9",
@@ -15595,7 +15595,7 @@ dependencies = [

 [[package]]
 name = "windmill-common"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "aes-gcm",
 "aho-corasick",
@@ -15702,7 +15702,7 @@ dependencies = [

 [[package]]
 name = "windmill-dep-map"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "chrono",
 "futures",
@@ -15722,7 +15722,7 @@ dependencies = [

 [[package]]
 name = "windmill-git-sync"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "regex",
 "serde",
@@ -15739,7 +15739,7 @@ dependencies = [

 [[package]]
 name = "windmill-indexer"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "astral-tokio-tar",
@@ -15766,7 +15766,7 @@ dependencies = [

 [[package]]
 name = "windmill-jseval"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "futures",
@@ -15783,7 +15783,7 @@ dependencies = [

 [[package]]
 name = "windmill-macros"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "itertools 0.14.0",
 "lazy_static",
@@ -15799,7 +15799,7 @@ dependencies = [

 [[package]]
 name = "windmill-mcp"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "async-trait",
@@ -15820,7 +15820,7 @@ dependencies = [

 [[package]]
 name = "windmill-native-triggers"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "async-trait",
@@ -15851,7 +15851,7 @@ dependencies = [

 [[package]]
 name = "windmill-oauth"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "arc-swap",
@@ -15876,7 +15876,7 @@ dependencies = [

 [[package]]
 name = "windmill-object-store"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "async-stream",
@@ -15911,7 +15911,7 @@ dependencies = [

 [[package]]
 name = "windmill-operator"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "futures",
@@ -15929,7 +15929,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "convert_case 0.6.0",
 "serde",
@@ -15938,7 +15938,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-bash"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "lazy_static",
@@ -15950,7 +15950,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-csharp"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "serde_json",
@@ -15962,7 +15962,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-go"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "gosyn",
@@ -15974,7 +15974,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-graphql"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "lazy_static",
@@ -15986,7 +15986,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-java"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "serde_json",
@@ -15998,7 +15998,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-nu"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "nu-parser",
@@ -16009,7 +16009,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-php"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "itertools 0.14.0",
@@ -16020,7 +16020,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-py"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "itertools 0.14.0",
@@ -16032,7 +16032,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "rustpython-ast",
@@ -16043,7 +16043,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "async-recursion",
@@ -16065,7 +16065,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-r"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "serde_json",
@@ -16077,7 +16077,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-ruby"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "lazy_static",
@@ -16091,7 +16091,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-rust"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "convert_case 0.6.0",
@@ -16108,7 +16108,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-sql"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "lazy_static",
@@ -16121,7 +16121,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "serde",
@@ -16133,7 +16133,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-ts"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "lazy_static",
@@ -16151,7 +16151,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "serde-wasm-bindgen",
@@ -16167,7 +16167,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-wac"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "rustpython-ast",
@@ -16183,7 +16183,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-yaml"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "lazy_static",
@@ -16197,7 +16197,7 @@ dependencies = [

 [[package]]
 name = "windmill-queue"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "async-recursion",
@@ -16236,7 +16236,7 @@ dependencies = [

 [[package]]
 name = "windmill-runtime-nativets"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "const_format",
@@ -16276,7 +16276,7 @@ dependencies = [

 [[package]]
 name = "windmill-sql-datatype-parser-wasm"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "getrandom 0.3.4",
 "wasm-bindgen",
@@ -16287,7 +16287,7 @@ dependencies = [

 [[package]]
 name = "windmill-store"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "async-recursion",
@@ -16322,7 +16322,7 @@ dependencies = [

 [[package]]
 name = "windmill-test-utils"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "async-trait",
@@ -16346,7 +16346,7 @@ dependencies = [

 [[package]]
 name = "windmill-trigger"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "async-trait",
@@ -16379,7 +16379,7 @@ dependencies = [

 [[package]]
 name = "windmill-trigger-amqp"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "async-trait",
@@ -16406,7 +16406,7 @@ dependencies = [

 [[package]]
 name = "windmill-trigger-azure"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "async-trait",
@@ -16439,7 +16439,7 @@ dependencies = [

 [[package]]
 name = "windmill-trigger-email"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "async-trait",
@@ -16459,7 +16459,7 @@ dependencies = [

 [[package]]
 name = "windmill-trigger-gcp"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "async-trait",
@@ -16493,7 +16493,7 @@ dependencies = [

 [[package]]
 name = "windmill-trigger-http"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "async-trait",
@@ -16529,7 +16529,7 @@ dependencies = [

 [[package]]
 name = "windmill-trigger-kafka"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "async-trait",
@@ -16552,7 +16552,7 @@ dependencies = [

 [[package]]
 name = "windmill-trigger-mqtt"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "async-trait",
@@ -16576,7 +16576,7 @@ dependencies = [

 [[package]]
 name = "windmill-trigger-nats"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "async-nats",
@@ -16600,7 +16600,7 @@ dependencies = [

 [[package]]
 name = "windmill-trigger-postgres"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "async-trait",
@@ -16635,7 +16635,7 @@ dependencies = [

 [[package]]
 name = "windmill-trigger-sqs"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "async-trait",
@@ -16663,7 +16663,7 @@ dependencies = [

 [[package]]
 name = "windmill-trigger-websocket"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "async-trait",
@@ -16688,7 +16688,7 @@ dependencies = [

 [[package]]
 name = "windmill-types"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "bitflags 2.13.2",
@@ -16707,7 +16707,7 @@ dependencies = [

 [[package]]
 name = "windmill-worker"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "async-once-cell",
@@ -16825,7 +16825,7 @@ dependencies = [

 [[package]]
 name = "windmill-worker-volumes"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "bytes",
 "futures",
@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.814.0"
+version = "1.815.0"
 authors.workspace = true
 edition.workspace = true

@@ -88,7 +88,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal", "./parsers/windmill-parser-wasm"]

 [workspace.package]
-version = "1.814.0"
+version = "1.815.0"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"

@@ -1 +1 @@
-6992e02506c163117f28bdd67aec9579e1353665
+bc3ef08c8e4233508c023e6ee847a3cd0b8be43b
@@ -0,0 +1 @@
+ALTER TABLE workspace_settings DROP COLUMN add_admins_and_developers_to_forks;
@@ -0,0 +1 @@
+ALTER TABLE workspace_settings ADD COLUMN add_admins_and_developers_to_forks BOOLEAN NOT NULL DEFAULT false;
@@ -6191,7 +6191,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"

 [[package]]
 name = "windmill-common"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "aho-corasick",
 "anyhow",
@@ -6274,7 +6274,7 @@ dependencies = [

 [[package]]
 name = "windmill-macros"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -6286,7 +6286,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "convert_case",
 "serde",
@@ -6295,7 +6295,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-bash"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "lazy_static",
@@ -6307,7 +6307,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-csharp"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "serde_json",
@@ -6319,7 +6319,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-go"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "gosyn",
@@ -6331,7 +6331,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-graphql"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "lazy_static",
@@ -6343,7 +6343,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-java"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "serde_json",
@@ -6355,7 +6355,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-nu"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "nu-parser",
@@ -6366,7 +6366,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-php"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "itertools 0.14.0",
@@ -6377,7 +6377,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-py"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "itertools 0.14.0",
@@ -6389,7 +6389,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "rustpython-ast",
@@ -6400,7 +6400,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "async-recursion",
@@ -6422,7 +6422,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-r"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "serde_json",
@@ -6434,7 +6434,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-ruby"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "lazy_static",
@@ -6448,7 +6448,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-rust"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "convert_case",
@@ -6465,7 +6465,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-sql"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "lazy_static",
@@ -6478,7 +6478,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "serde",
@@ -6490,7 +6490,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-ts"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "lazy_static",
@@ -6508,7 +6508,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "serde-wasm-bindgen",
@@ -6524,7 +6524,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-wac"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "rustpython-ast",
@@ -6540,7 +6540,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-wasm"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "getrandom 0.2.17",
@@ -6572,7 +6572,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-yaml"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "lazy_static",
@@ -6586,7 +6586,7 @@ dependencies = [

 [[package]]
 name = "windmill-types"
-version = "1.814.0"
+version = "1.815.0"
 dependencies = [
 "anyhow",
 "bitflags",
@@ -12,7 +12,7 @@ resolver = "2"
 members = ["."]

 [workspace.package]
-version = "1.814.0"
+version = "1.815.0"
 edition = "2021"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]

@@ -52,7 +52,8 @@ use windmill_common::{
        INSTANCE_EVENTS_WEBHOOK_SETTING, INSTANCE_PYTHON_VERSION_SETTING,
        JOB_DEFAULT_TIMEOUT_SECS_SETTING, JOB_ISOLATION_SETTING, JWT_SECRET_SETTING,
        KEEP_JOB_DIR_SETTING, LICENSE_KEY_SETTING, MAVEN_REPOS_SETTING, MAVEN_SETTINGS_XML_SETTING,
-        MONITOR_LOGS_ON_OBJECT_STORE_SETTING, NO_DEFAULT_MAVEN_SETTING,
+        MCP_DISABLE_TOKEN_QUERY_PARAM_SETTING, MONITOR_LOGS_ON_OBJECT_STORE_SETTING,
+        NO_DEFAULT_MAVEN_SETTING,
        NPM_CONFIG_REGISTRY_SETTING, NSJAIL_TMPFS_SIZE_MB_SETTING, NSJAIL_TMP_BACKING_SETTING,
        NUGET_CONFIG_SETTING, OAUTH_SETTING, OTEL_SETTING, OTEL_TRACES_RETENTION_SECS_SETTING,
        OTEL_TRACING_PROXY_SETTING, PIP_INDEX_URL_SETTING, POWERSHELL_REPO_PAT_SETTING,
@@ -126,7 +127,8 @@ use windmill_worker::{

 use crate::monitor::{
    initial_load, load_concurrency_key_max_queued, load_disable_password_login,
-    load_fork_workspace_tag_append_fork_suffix, load_keep_job_dir, load_metrics_debug_enabled,
+    load_fork_workspace_tag_append_fork_suffix, load_keep_job_dir,
+    load_mcp_disable_token_query_param, load_metrics_debug_enabled,
    load_preview_tags_override, load_require_preexisting_user, load_retention_period_overrides,
    load_tag_per_workspace_enabled, load_tag_per_workspace_workspaces,
    load_workspace_fairness_duration_secs, load_workspace_fairness_enabled,
@@ -2164,6 +2166,9 @@ async fn process_notify_event(
                DISABLE_PASSWORD_LOGIN_SETTING => {
                    load_disable_password_login(db).await;
                }
+                MCP_DISABLE_TOKEN_QUERY_PARAM_SETTING => {
+                    load_mcp_disable_token_query_param(db).await;
+                }
                EXPOSE_METRICS_SETTING => {
                    tracing::info!("Metrics setting changed, restarting");
                    spawn_graceful_killpill(tx, db, 30, "metrics setting change", server_mode)
@@ -45,7 +45,10 @@ use windmill_common::otel_oss::{
 use windmill_common::{
    agent_workers::DECODED_AGENT_TOKEN,
    apps::APP_WORKSPACED_ROUTE,
-    auth::{create_token_for_owner, ephemeral_script_token_label, job_token_expiry_secs},
+    auth::{
+        create_token_for_owner, ephemeral_script_token_label, job_token_expiry_secs,
+        TOKEN_EXPIRY_WARNING_DAYS,
+    },
    ee_oss::CriticalErrorChannel,
    email_oss::send_email_if_possible,
    error,
@@ -62,6 +65,7 @@ use windmill_common::{
        FORK_WORKSPACE_TAG_APPEND_FORK_SUFFIX_SETTING, HUB_API_SECRET_SETTING,
        HUB_BASE_URL_SETTING, INSTANCE_PYTHON_VERSION_SETTING, JOB_DEFAULT_TIMEOUT_SECS_SETTING,
        JOB_ISOLATION_SETTING, JWT_SECRET_SETTING, KEEP_JOB_DIR_SETTING, LICENSE_KEY_SETTING,
+        MCP_DISABLE_TOKEN_QUERY_PARAM, MCP_DISABLE_TOKEN_QUERY_PARAM_SETTING,
        MONITOR_LOGS_ON_OBJECT_STORE_SETTING, NPMRC_SETTING, NPM_CONFIG_REGISTRY_SETTING,
        NSJAIL_TMPFS_SIZE_MB_SETTING, NSJAIL_TMP_BACKING_SETTING, NUGET_CONFIG_SETTING,
        OTEL_SETTING, OTEL_TRACES_RETENTION_SECS_SETTING, OTEL_TRACING_PROXY_SETTING,
@@ -285,6 +289,15 @@ pub async fn initial_load(
    );

    if let Some(db) = conn.as_sql() {
+        // Outside the `server_mode` block below: a `MODE=mcp` process serves the MCP routes
+        // with `server_mode` false and would otherwise never read this at all. That mode
+        // joins no monitor loop, so there — as for every global setting, `base_url`
+        // included — this pass is the only read, and a change lands on restart.
+        pass.setting(
+            MCP_DISABLE_TOKEN_QUERY_PARAM_SETTING,
+            false,
+            |v| async move { apply_mcp_disable_token_query_param(v) },
+        );
        pass.setting(DEFAULT_TAGS_PER_WORKSPACE_SETTING, false, |v| async move {
            apply_tag_per_workspace_enabled(v)
        });
@@ -1614,6 +1627,23 @@ pub fn apply_disable_password_login(value: Option<serde_json::Value>) {
    };
 }

+pub async fn load_mcp_disable_token_query_param(db: &DB) {
+    match load_value_from_global_settings(db, MCP_DISABLE_TOKEN_QUERY_PARAM_SETTING).await {
+        Ok(v) => apply_mcp_disable_token_query_param(v),
+        Err(e) => tracing::error!("Error loading mcp_disable_token_query_param setting: {e:#}"),
+    };
+}
+
+pub fn apply_mcp_disable_token_query_param(value: Option<serde_json::Value>) {
+    match value {
+        Some(serde_json::Value::Bool(t)) => {
+            MCP_DISABLE_TOKEN_QUERY_PARAM.store(t, Ordering::Relaxed)
+        }
+        None => MCP_DISABLE_TOKEN_QUERY_PARAM.store(false, Ordering::Relaxed),
+        _ => (),
+    };
+}
+
 struct LogFile {
    file_path: String,
    hostname: String,
@@ -2198,7 +2228,7 @@ async fn cleanup_scheduled_job_deletions(db: &Pool<Postgres>) {
 }

 pub async fn check_expiring_tokens(db: &DB) {
-    // Find tokens expiring within 7 days that still have a pending notification row.
+    // Find tokens expiring within the warning window that still have a pending notification row.
    // The notification table stores token_hash (not plaintext) so the join works
    // even after the hash migration makes token.token nullable.
    let expiring_tokens_r = sqlx::query_as!(
@@ -2207,8 +2237,9 @@ pub async fn check_expiring_tokens(db: &DB) {
         USING token t
         WHERE n.token_hash = t.token_hash
           AND n.expiration > now()
-           AND n.expiration <= now() + interval '7 days'
+           AND n.expiration <= now() + make_interval(days => $1)
         RETURNING t.token_prefix, t.label, t.email, t.workspace_id",
+        TOKEN_EXPIRY_WARNING_DAYS,
    )
    .fetch_all(db)
    .await;
@@ -234,7 +234,7 @@ workspace_protection_rule: workspace_id(char), name(char), rules(int), bypass_gr
  FK: (workspace_id) -> workspace(id)
 workspace_runnable_dependencies: flow_path(char), runnable_path(char), script_hash(bigint), runnable_is_flow(bool), workspace_id(char), app_path(char), id(bigint), runnable_is_agent(bool)
  FK: (app_path, workspace_id) -> app(path, workspace_id) | (flow_path, workspace_id) -> flow(path, workspace_id)
-workspace_settings: workspace_id(char), slack_team_id(char), slack_name(char), slack_command_script(char), slack_email(char), customer_id(char), plan(char), webhook(text), ai_config(jsonb), large_file_storage(jsonb), git_sync(jsonb), default_app(char), default_scripts(jsonb), deploy_ui(jsonb), mute_critical_alerts(bool), color(char), operator_settings(jsonb), teams_command_script(text), teams_team_id(text), teams_team_name(text), git_app_installations(jsonb), ducklake(jsonb), slack_oauth_client_id(char), slack_oauth_client_secret(char), datatable(jsonb), teams_team_guid(text), auto_invite(jsonb), error_handler(jsonb), success_handler(jsonb), public_app_execution_limit_per_minute(int), dbt_warehouses(jsonb), guest_access_enabled(bool), guest_jwt_public_key(text), guest_jwt_jwks_url(text), ai_sessions_backup_generation(int)
+workspace_settings: workspace_id(char), slack_team_id(char), slack_name(char), slack_command_script(char), slack_email(char), customer_id(char), plan(char), webhook(text), ai_config(jsonb), large_file_storage(jsonb), git_sync(jsonb), default_app(char), default_scripts(jsonb), deploy_ui(jsonb), mute_critical_alerts(bool), color(char), operator_settings(jsonb), teams_command_script(text), teams_team_id(text), teams_team_name(text), git_app_installations(jsonb), ducklake(jsonb), slack_oauth_client_id(char), slack_oauth_client_secret(char), datatable(jsonb), teams_team_guid(text), auto_invite(jsonb), error_handler(jsonb), success_handler(jsonb), public_app_execution_limit_per_minute(int), dbt_warehouses(jsonb), guest_access_enabled(bool), guest_jwt_public_key(text), guest_jwt_jwks_url(text), ai_sessions_backup_generation(int), add_admins_and_developers_to_forks(bool)
  FK: (workspace_id) -> workspace(id)
 zombie_job_counter: job_id(uuid), counter(int)
  FK: (job_id) -> v2_job(id)
@@ -3312,3 +3312,60 @@ export function main(i: number) {

    Ok(())
 }
+
+// A `$flow_expr[...]` step tag is resolved from the flow's state before the step is pushed, and
+// one that cannot be resolved fails the step instead of queueing it on a tag no worker serves.
+#[cfg(feature = "deno_core")]
+#[sqlx::test(fixtures("base"))]
+async fn test_flow_expr_step_tag(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+
+    let step = |id: &str, tag: Option<&str>| {
+        flow_module(
+            id,
+            FlowModuleValue::RawScript {
+                input_transforms: Default::default(),
+                language: ScriptLang::Deno,
+                content: "export function main() { return { lang: 'bun' } }".to_string(),
+                path: None,
+                lock: None,
+                tag: tag.map(str::to_string),
+                concurrency_settings: Default::default(),
+                is_trigger: None,
+                assets: None,
+            },
+        )
+    };
+    let flow = FlowValue {
+        modules: vec![
+            step("a", None),
+            step("b", Some("$flow_expr[results.a.lang]")),
+            step("c", Some("nobody-serves-$flow_expr[a.lang]")),
+        ],
+        same_worker: false,
+        ..Default::default()
+    };
+
+    let job = RunJob::from(JobPayload::RawFlow { value: flow, path: None, restarted_from: None })
+        .run_until_complete(&db, false, server.addr.port())
+        .await;
+
+    let b_tag = sqlx::query_scalar::<_, String>(
+        "SELECT tag FROM v2_job WHERE parent_job = $1 AND flow_step_id = 'b'",
+    )
+    .bind(job.id)
+    .fetch_one(&db)
+    .await?;
+    assert_eq!(b_tag, "bun");
+
+    assert!(!job.success);
+    let result = job.json_result().unwrap();
+    let message = result["error"]["message"].as_str().unwrap_or_default();
+    assert!(
+        message.contains("Could not resolve the step tag `nobody-serves-$flow_expr[a.lang]`"),
+        "got {result:?}"
+    );
+
+    Ok(())
+}
@@ -1530,6 +1530,31 @@ async fn declarative_sync_rejects_an_unusable_instance_banner(db: Pool<Postgres>
    );
 }

+#[sqlx::test(fixtures("base"))]
+async fn declarative_sync_rejects_a_malformed_max_token_expiration(db: Pool<Postgres>) {
+    clear_settings_and_configs(&db).await;
+    let before = count_global_settings(&db).await;
+
+    let mut desired = BTreeMap::new();
+    desired.insert(
+        "max_token_expiration_days".to_string(),
+        serde_json::json!("7.0"),
+    );
+
+    let err = windmill_common::instance_config::sync_global_settings_declarative(
+        &db,
+        &BTreeMap::new(),
+        &desired,
+    )
+    .await
+    .expect_err("a ceiling the token routes cannot read must fail the sync");
+    assert!(
+        err.to_string().contains("max_token_expiration_days"),
+        "the error should name the offending setting, got: {err}"
+    );
+    assert_eq!(count_global_settings(&db).await, before);
+}
+
 #[sqlx::test(fixtures("base"))]
 async fn declarative_sync_rejects_an_unusable_default_allowed_origins(db: Pool<Postgres>) {
    // The declarative writers (the sync-config CLI, the operator's ConfigMap
@@ -0,0 +1,108 @@
+/*
+ * The job's own token (`$WM_TOKEN`) stays valid well past the job it was minted
+ * for, and job logs are persisted to `job_logs` and optionally to object storage,
+ * so a script that echoes the token would otherwise park a live credential in
+ * durable storage. `run_worker` registers the token with `sensitive_log_masks`
+ * for the job it pulled; this pins that the persisted log carries the masked form.
+ */
+
+use sqlx::{Pool, Postgres};
+use windmill_common::{
+    jobs::{JobPayload, RawCode},
+    scripts::ScriptLang,
+};
+use windmill_test_utils::*;
+
+/// Prefix of a serialized job token: `jwt_` plus the base64 of a JWT header.
+/// The masked form keeps only `jwt` + the last three characters, so it never matches.
+const RAW_TOKEN_PREFIX: &str = "jwt_ey";
+
+#[sqlx::test(fixtures("base"))]
+async fn test_job_token_masked_in_persisted_logs(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    let job = RunJob::from(JobPayload::Code(RawCode {
+        hash: None,
+        content: "echo \"running with --token $WM_TOKEN\"".to_string(),
+        path: None,
+        lock: None,
+        language: ScriptLang::Bash,
+        cache_ttl: None,
+        cache_ignore_s3_path: None,
+        dedicated_worker: None,
+        concurrency_settings: windmill_common::runnable_settings::ConcurrencySettings::default()
+            .into(),
+        debouncing_settings: windmill_common::runnable_settings::DebouncingSettings::default(),
+        modules: None,
+        tag: None,
+    }))
+    .run_until_complete(&db, false, port)
+    .await;
+    assert!(job.success, "job should have succeeded");
+
+    let logs =
+        sqlx::query_scalar::<_, Option<String>>("SELECT logs FROM job_logs WHERE job_id = $1")
+            .bind(job.id)
+            .fetch_one(&db)
+            .await?
+            .unwrap_or_default();
+
+    assert!(
+        !logs.contains(RAW_TOKEN_PREFIX),
+        "an unmasked job token reached the persisted logs: {logs}"
+    );
+    assert!(
+        logs.contains("secret value was masked"),
+        "expected the masking notice in logs: {logs}"
+    );
+    Ok(())
+}
+
+/// nativets runs V8 in-process and persists `console.log` output through its own
+/// channel, so it is masked by a different mechanism than the bash case above and
+/// needs its own guard.
+#[cfg(feature = "deno_core")]
+#[sqlx::test(fixtures("base"))]
+async fn test_job_token_masked_in_nativets_logs(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    let job = RunJob::from(JobPayload::Code(RawCode {
+        hash: None,
+        content: "export async function main() {\n  console.log('running with --token ' + process.env.WM_TOKEN);\n  return 'ok';\n}".to_string(),
+        path: None,
+        lock: None,
+        language: ScriptLang::Nativets,
+        cache_ttl: None,
+        cache_ignore_s3_path: None,
+        dedicated_worker: None,
+        concurrency_settings: windmill_common::runnable_settings::ConcurrencySettings::default()
+            .into(),
+        debouncing_settings: windmill_common::runnable_settings::DebouncingSettings::default(),
+        modules: None,
+        tag: None,
+    }))
+    .run_until_complete(&db, false, port)
+    .await;
+    assert!(job.success, "job should have succeeded");
+
+    let logs =
+        sqlx::query_scalar::<_, Option<String>>("SELECT logs FROM job_logs WHERE job_id = $1")
+            .bind(job.id)
+            .fetch_one(&db)
+            .await?
+            .unwrap_or_default();
+
+    assert!(
+        !logs.contains(RAW_TOKEN_PREFIX),
+        "an unmasked job token reached the persisted logs: {logs}"
+    );
+    assert!(
+        logs.contains("secret value was masked"),
+        "expected the masking notice in logs: {logs}"
+    );
+    Ok(())
+}
@@ -1249,6 +1249,10 @@ pub async fn register_token_expiry_notification(
    if !windmill_common::auth::is_user_token(label) {
        return;
    }
+    let warning_days = windmill_common::auth::TOKEN_EXPIRY_WARNING_DAYS;
+    if expiration <= chrono::Utc::now() + chrono::Duration::days(warning_days.into()) {
+        return;
+    }
    if let Err(e) = sqlx::query!(
        "INSERT INTO token_expiry_notification (token_hash, expiration) VALUES ($1, $2) ON CONFLICT DO NOTHING",
        token_hash,
@@ -1,108 +0,0 @@
-//! Who may read and change a data table's grants and owners. On the Enterprise Edition: its
-//! administrators, from the workspace that governs it. Without it: nobody. Each refusal is decided
-//! before anything connects to the data table, so the fixture's database never has to exist.
-
-use serde_json::{json, Value};
-use sqlx::{Pool, Postgres};
-
-use windmill_test_utils::*;
-
-fn grant_select_on_public() -> Value {
-    json!({
-        "target": {"kind": "schema", "schema": "public"},
-        "change": {"type": "grant", "role": "analytics", "privileges": ["SELECT"],
-                   "scope": "all_tables"},
-        "statements": [r#"GRANT SELECT ON ALL TABLES IN SCHEMA "public" TO "analytics""#]
-    })
-}
-
-async fn post_acl(
-    port: u16,
-    w_id: &str,
-    action: &str,
-    token: &str,
-) -> anyhow::Result<reqwest::Response> {
-    Ok(reqwest::Client::new()
-        .post(format!(
-            "http://localhost:{port}/api/w/{w_id}/workspaces/datatable_acl/main/{action}"
-        ))
-        .header("Authorization", format!("Bearer {token}"))
-        .json(&grant_select_on_public())
-        .send()
-        .await?)
-}
-
-/// A fork reaches the data table through a pointer: it may use it, never change what each role may
-/// touch on it — not even as an admin of the fork.
-#[cfg(all(feature = "private", feature = "enterprise"))]
-#[sqlx::test(migrations = "../migrations", fixtures("base", "datatable_roles"))]
-async fn a_fork_cannot_change_access_on_the_data_table_it_points_at(
-    db: Pool<Postgres>,
-) -> anyhow::Result<()> {
-    initialize_tracing().await;
-    let server = ApiServer::start(db.clone()).await?;
-    let port = server.addr.port();
-    for action in ["plan", "apply"] {
-        let resp = post_acl(port, "wm-fork-dt", action, "SECRET_TOKEN_2").await?;
-        assert_eq!(resp.status(), 401, "{action}: {}", resp.text().await?);
-    }
-    Ok(())
-}
-
-#[cfg(all(feature = "private", feature = "enterprise"))]
-#[sqlx::test(migrations = "../migrations", fixtures("base", "datatable_roles"))]
-async fn a_member_who_is_not_an_admin_cannot_change_access(
-    db: Pool<Postgres>,
-) -> anyhow::Result<()> {
-    initialize_tracing().await;
-    let server = ApiServer::start(db.clone()).await?;
-    let port = server.addr.port();
-    for action in ["plan", "apply"] {
-        let resp = post_acl(port, "test-workspace", action, "SECRET_TOKEN_2").await?;
-        assert_eq!(resp.status(), 401, "{action}: {}", resp.text().await?);
-    }
-    Ok(())
-}
-
-/// Not even reading, and not even on a data table that is not under roles — which any member
-/// reaches, so only the edition stands between them and the instance's credentials.
-#[cfg(not(all(feature = "private", feature = "enterprise")))]
-#[sqlx::test(migrations = "../migrations", fixtures("base", "datatable_roles"))]
-async fn only_the_enterprise_edition_has_the_access_editor(
-    db: Pool<Postgres>,
-) -> anyhow::Result<()> {
-    initialize_tracing().await;
-    sqlx::query(
-        "UPDATE workspace_settings
-         SET datatable = datatable #- '{datatables,main,permissions}'
-         WHERE workspace_id = 'test-workspace'",
-    )
-    .execute(&db)
-    .await?;
-    let server = ApiServer::start(db.clone()).await?;
-    let port = server.addr.port();
-
-    let read = reqwest::Client::new()
-        .get(format!(
-            "http://localhost:{port}/api/w/test-workspace/workspaces/datatable_acl/main?kind=database"
-        ))
-        .header("Authorization", "Bearer SECRET_TOKEN")
-        .send()
-        .await?;
-    let mut responses = vec![("read", read)];
-    for action in ["plan", "apply"] {
-        responses.push((
-            action,
-            post_acl(port, "test-workspace", action, "SECRET_TOKEN").await?,
-        ));
-    }
-    for (action, resp) in responses {
-        assert_eq!(resp.status(), 400, "{action}");
-        let body = resp.text().await?;
-        assert!(
-            body.contains("Data table roles are a Windmill Enterprise Edition feature"),
-            "{action}: {body}"
-        );
-    }
-    Ok(())
-}
@@ -627,234 +627,21 @@ async fn a_rename_has_to_match_the_save_it_claims_to_describe(
    Ok(())
 }

-async fn database_exists(db: &Pool<Postgres>, name: &str) -> anyhow::Result<bool> {
-    Ok(
-        sqlx::query_scalar("SELECT EXISTS (SELECT 1 FROM pg_database WHERE datname = $1)")
-            .bind(name)
-            .fetch_one(db)
-            .await?,
-    )
-}
-
-async fn workspace_exists(db: &Pool<Postgres>, id: &str) -> anyhow::Result<bool> {
-    Ok(
-        sqlx::query_scalar("SELECT EXISTS (SELECT 1 FROM workspace WHERE id = $1)")
-            .bind(id)
-            .fetch_one(db)
-            .await?,
-    )
-}
-
 #[sqlx::test(migrations = "../migrations", fixtures("base", "datatable_roles"))]
-async fn a_data_table_under_roles_is_cloned_only_with_its_grants(
-    db: Pool<Postgres>,
-) -> anyhow::Result<()> {
-    initialize_tracing().await;
-    let server = ApiServer::start(db.clone()).await?;
-    let port = server.addr.port();
-    // The database a fork's copy of `main` goes into is named after the fork. Every request below
-    // is refused before it is created, so the cluster-wide name never collides with a sibling run.
-    let target = "wm_fork_copy__main";
-    let fork = |token: &str, forked: Value| {
-        authed(
-            client().post(format!(
-                "http://localhost:{port}/api/w/test-workspace/workspaces/create_fork"
-            )),
-            token,
-        )
-        .json(&json!({"id": "wm-fork-copy", "name": "copy", "forked_datatables": [forked]}))
-    };
-
-    // Rows are a workspace admin's to copy, as they were before roles.
-    let resp = fork(
-        "SECRET_TOKEN_2",
-        json!({"name": "main", "new_dbname": target, "fork_behavior": "schema_and_data"}),
-    )
-    .send()
-    .await?;
-    assert_eq!(resp.status(), 403, "{}", resp.text().await?);
-    assert!(!database_exists(&db, target).await?);
-
-    // Even the schema alone lists every table, which a member covered by no role cannot read in
-    // the parent.
-    let resp = fork(
-        "SECRET_TOKEN_3",
-        json!({"name": "main", "new_dbname": target, "fork_behavior": "schema_only"}),
-    )
-    .send()
-    .await?;
-    assert_eq!(resp.status(), 401, "{}", resp.text().await?);
-    assert!(!database_exists(&db, target).await?);
-
-    // Refused in the first phase too, before a git branch is created for a fork that cannot be.
-    let resp = authed(
-        client().post(format!(
-            "http://localhost:{port}/api/w/test-workspace/workspaces/create_workspace_fork_branch"
-        )),
-        "SECRET_TOKEN_3",
-    )
-    .json(
-        &json!({"id": "wm-fork-copy", "name": "copy", "forked_datatables": [
-            {"name": "main", "new_dbname": target, "fork_behavior": "schema_only"}
-        ]}),
-    )
-    .send()
-    .await?;
-    assert_eq!(resp.status(), 401, "{}", resp.text().await?);
-
-    // A database the request did not create — whatever the data table, under roles or not — may be
-    // a copy left behind by a deleted fork, which the entry would reach without its governance.
-    let resp = fork(
-        "SECRET_TOKEN",
-        json!({"name": "other", "new_dbname": "wm_fork_copy__other"}),
-    )
-    .send()
-    .await?;
-    assert_eq!(resp.status(), 400);
-    assert!(
-        resp.text().await?.contains("fork_behavior"),
-        "a database the fork did not create was taken"
-    );
-    assert!(!workspace_exists(&db, "wm-fork-copy").await?);
-
-    // The copy an admin asks for goes ahead in an edition that replays grants, and is refused
-    // before any database exists in one that does not. The fixture's database does not exist, so
-    // the dump fails either way — and leaves neither a database nor a fork behind.
-    let resp = fork(
-        "SECRET_TOKEN",
-        json!({"name": "main", "new_dbname": target, "fork_behavior": "schema_only"}),
-    )
-    .send()
-    .await?;
-    assert_ne!(resp.status(), 200);
-    let body = resp.text().await?;
-    #[cfg(all(feature = "private", feature = "enterprise"))]
-    assert!(body.contains("pg_dump"), "{body}");
-    #[cfg(not(all(feature = "private", feature = "enterprise")))]
-    assert!(body.contains("Enterprise Edition"), "{body}");
-    assert!(!database_exists(&db, target).await?);
-    assert!(!workspace_exists(&db, "wm-fork-copy").await?);
-    Ok(())
-}
-
-#[sqlx::test(migrations = "../migrations", fixtures("base", "datatable_roles"))]
-async fn a_clone_takes_its_roles_from_the_data_table_it_was_cloned_from(
-    db: Pool<Postgres>,
-) -> anyhow::Result<()> {
-    initialize_tracing().await;
-    sqlx::query(
-        r#"UPDATE workspace_settings SET datatable = jsonb_set(datatable, '{datatables,copy}', '{
-               "database": {"resource_type": "instance", "resource_path": "wm_fork_dt__copy"},
-               "governed_by": {"workspace_id": "test-workspace", "datatable": "main"},
-               "forked_from": {}
-           }'::jsonb) WHERE workspace_id = 'wm-fork-dt'"#,
-    )
-    .execute(&db)
-    .await?;
-    let server = ApiServer::start(db.clone()).await?;
-    let port = server.addr.port();
-    let fork = format!("http://localhost:{port}/api/w/wm-fork-dt/workspaces");
-
-    // `test-user-2` administers the fork, and is only a tenant of `analytics` in the parent.
-    let resp = authed(
-        client().get(format!("{fork}/datatable_usable_roles/copy")),
-        "SECRET_TOKEN_2",
-    )
-    .send()
-    .await?;
-    let body: Value = resp.json().await?;
-    assert_eq!(body["roles"], json!(["analytics"]), "{body}");
-
-    let resp = authed(
-        client().get(format!("{fork}/datatable_permissions/copy")),
-        "SECRET_TOKEN_2",
-    )
-    .send()
-    .await?;
-    let body: Value = resp.json().await?;
-    assert_eq!(body["editable"], false, "{body}");
-    assert_eq!(body["clone_of"]["workspace_id"], "test-workspace", "{body}");
-
-    // Nobody changes a clone's roles, a superadmin included: they are the source's.
-    for token in ["SECRET_TOKEN_2", "SECRET_TOKEN"] {
-        let resp = authed(
-            client().post(format!("{fork}/datatable_permissions/copy")),
-            token,
-        )
-        .json(&json!({"permissioned": false}))
-        .send()
-        .await?;
-        assert_eq!(resp.status(), 400, "{token} changed a clone's roles");
-    }
-
-    // A settings save cannot clear the link.
-    let resp = authed(
-        client().post(format!("{fork}/edit_datatable_config")),
-        "SECRET_TOKEN_2",
-    )
-    .json(&json!({
-        "settings": {"datatables": {"main": {}, "copy": {
-            "database": {"resource_type": "instance", "resource_path": "wm_fork_dt__copy"}
-        }}},
-        "renames": [], "deleted_datatables": []
-    }))
-    .send()
-    .await?;
-    assert_eq!(resp.status(), 200, "{}", resp.text().await?);
-    let governed_by: Option<Value> = sqlx::query_scalar(
-        "SELECT datatable->'datatables'->'copy'->'governed_by' FROM workspace_settings
-         WHERE workspace_id = 'wm-fork-dt'",
-    )
-    .fetch_one(&db)
-    .await?;
-    assert_eq!(governed_by.unwrap()["datatable"], "main");
-
-    // Nor move it, a superadmin included: its grants were replayed into that database alone.
-    let resp = authed(
-        client().post(format!("{fork}/edit_datatable_config")),
-        "SECRET_TOKEN",
-    )
-    .json(&json!({
-        "settings": {"datatables": {"main": {}, "copy": {
-            "database": {"resource_type": "instance", "resource_path": "wm_fork_dt__elsewhere"}
-        }}},
-        "renames": [], "deleted_datatables": []
-    }))
-    .send()
-    .await?;
-    assert_eq!(resp.status(), 400, "{}", resp.text().await?);
-
-    // Nor reach its database through a second entry without roles, which would connect as `admin`.
-    let resp = authed(
-        client().post(format!(
-            "http://localhost:{port}/api/w/test-workspace/workspaces/edit_datatable_config"
-        )),
-        "SECRET_TOKEN",
-    )
-    .json(&json!({
-        "settings": {"datatables": {
-            "main": {"database": {"resource_type": "instance", "resource_path": "dt_main"}},
-            "alias": {"database": {"resource_type": "instance", "resource_path": "wm_fork_dt__copy"}}
-        }},
-        "renames": [], "deleted_datatables": []
-    }))
-    .send()
-    .await?;
-    let status = resp.status();
-    let body = resp.text().await?;
-    assert_eq!(status, 400, "{body}");
-    assert!(body.contains("without carrying those roles"), "{body}");
-    Ok(())
-}
-
-#[sqlx::test(migrations = "../migrations", fixtures("base", "datatable_roles"))]
-async fn a_data_table_under_roles_is_not_copied_without_its_grants(
+async fn a_data_table_under_roles_is_not_copied_into_a_fork(
    db: Pool<Postgres>,
 ) -> anyhow::Result<()> {
    initialize_tracing().await;
+    // `pg_dump` carries no roles and the restore drops ACLs, so a copy would arrive with the
+    // parent's tenants and none of the grants behind them: every role but admin denied by
+    // Postgres in a data table that reads as configured. Refuse the copy rather than ship that,
+    // and refuse it before any data moves.
    let server = ApiServer::start(db.clone()).await?;
    let port = server.addr.port();

+    // Both halves of the clone: the database the copy would land in, then the copy itself. The
+    // first has to refuse too, or a permissioned fork leaves an empty registered database that
+    // no data table entry names and nothing collects.
    let resp = authed(
        client().post(format!(
            "http://localhost:{port}/api/w/test-workspace/workspaces/create_pg_database"
@@ -311,3 +311,121 @@ async fn test_fork_keeps_only_resolvable_on_behalf_of(db: Pool<Postgres>) -> any

    Ok(())
 }
+
+/// Apps, schedules, triggers and their drafts cannot drop an identity the way scripts and flows
+/// do, so one naming nobody in the fork goes to its creator while one that still resolves stays.
+/// Forked as an admin, whose app policies the clone otherwise keeps.
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn test_fork_repoints_unresolvable_identities(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+
+    let server = ApiServer::start(db.clone()).await?;
+    let base_url = format!("http://localhost:{}/api", server.addr.port());
+
+    let stranger = json!({
+        "on_behalf_of": "u/test-user-2",
+        "on_behalf_of_email": "test2@windmill.dev",
+        "execution_mode": "publisher",
+    });
+    sqlx::query(
+        "INSERT INTO app (workspace_id, path, summary, policy, versions)
+         VALUES ('test-workspace', 'u/test-user/stranger', '', $1, '{}'),
+                ('test-workspace', 'u/test-user/group', '', $2, '{}')",
+    )
+    .bind(&stranger)
+    .bind(json!({
+        "on_behalf_of": "g/all",
+        "on_behalf_of_email": "group-all@windmill.dev",
+        "execution_mode": "publisher",
+    }))
+    .execute(&db)
+    .await?;
+    // The clone re-aggregates `versions` from `app_version`, and the column is NOT NULL.
+    sqlx::query(
+        "WITH v AS (
+            INSERT INTO app_version (app_id, value, created_by)
+            SELECT id, '{}'::json, 'test-user' FROM app WHERE workspace_id = 'test-workspace'
+            RETURNING id, app_id
+         )
+         UPDATE app SET versions = ARRAY[v.id] FROM v WHERE app.id = v.app_id",
+    )
+    .execute(&db)
+    .await?;
+    sqlx::query(
+        "INSERT INTO draft (workspace_id, path, typ, value, created_at, email)
+         VALUES ('test-workspace', 'u/test-user/stranger', 'raw_app', $1::json, NOW(), 'test@windmill.dev'),
+                ('test-workspace', 'u/test-user/stranger', 'trigger_websocket', $2::json, NOW(), 'test@windmill.dev'),
+                ('test-workspace', 'u/test-user/nul', 'raw_app', $3::json, NOW(), 'test@windmill.dev')",
+    )
+    .bind(json!({ "policy": stranger }))
+    .bind(json!({ "permissioned_as": "u/test-user-2" }))
+    // Saved before drafts were stripped of NULs: any jsonb parse of it raises, so it must be
+    // skipped rather than abort the fork. Built from parts because a NUL escape can't sit in source.
+    .bind(format!(
+        r#"{{"policy":{{"on_behalf_of":"u/test-user-2"}},"files":{{"f":"a{}u0000"}}}}"#,
+        "\\"
+    ))
+    .execute(&db)
+    .await?;
+    sqlx::query(
+        "INSERT INTO schedule (workspace_id, path, edited_by, schedule, script_path, email, permissioned_as, enabled)
+         VALUES ('test-workspace', 'u/test-user/stranger', 'test-user', '0 0 * * * *', 'u/test-user/s', 'test2@windmill.dev', 'u/test-user-2', false)",
+    )
+    .execute(&db)
+    .await?;
+    sqlx::query(
+        "INSERT INTO websocket_trigger (workspace_id, path, url, script_path, is_flow, edited_by, permissioned_as, mode)
+         VALUES ('test-workspace', 'u/test-user/stranger', 'ws://localhost', 'u/test-user/s', false, 'test-user', 'u/test-user-2', 'disabled')",
+    )
+    .execute(&db)
+    .await?;
+
+    let resp = reqwest::Client::new()
+        .post(format!(
+            "{base_url}/w/test-workspace/workspaces/create_fork"
+        ))
+        .header("Authorization", "Bearer SECRET_TOKEN")
+        .json(&json!({ "id": "wm-fork-repoint", "name": "Fork", "color": "#0000ff" }))
+        .send()
+        .await?;
+    assert!(
+        resp.status().is_success(),
+        "creating the fork: {}",
+        resp.text().await?
+    );
+
+    let text = |sql: &'static str| sqlx::query_scalar::<_, String>(sql).fetch_one(&db);
+    assert_eq!(
+        text("SELECT (policy->>'on_behalf_of') || ' ' || (policy->>'on_behalf_of_email') FROM app WHERE workspace_id = 'wm-fork-repoint' AND path = 'u/test-user/stranger'").await?,
+        "u/test-user test@windmill.dev"
+    );
+    assert_eq!(
+        text("SELECT policy->>'on_behalf_of' FROM app WHERE workspace_id = 'wm-fork-repoint' AND path = 'u/test-user/group'").await?,
+        "g/all"
+    );
+    assert_eq!(
+        text("SELECT value->'policy'->>'on_behalf_of' FROM draft WHERE workspace_id = 'wm-fork-repoint' AND path = 'u/test-user/stranger' AND typ = 'raw_app'").await?,
+        "u/test-user"
+    );
+    assert_eq!(
+        text("SELECT CASE WHEN strpos(value::text, 'u/test-user-2') > 0 THEN 'kept' ELSE 'rewritten' END FROM draft WHERE workspace_id = 'wm-fork-repoint' AND path = 'u/test-user/nul'").await?,
+        "kept"
+    );
+    assert_eq!(
+        text("SELECT value->>'permissioned_as' FROM draft WHERE workspace_id = 'wm-fork-repoint' AND typ = 'trigger_websocket'").await?,
+        "u/test-user"
+    );
+    assert_eq!(
+        text("SELECT permissioned_as || ' ' || email FROM schedule WHERE workspace_id = 'wm-fork-repoint'").await?,
+        "u/test-user test@windmill.dev"
+    );
+    assert_eq!(
+        text(
+            "SELECT permissioned_as FROM websocket_trigger WHERE workspace_id = 'wm-fork-repoint'"
+        )
+        .await?,
+        "u/test-user"
+    );
+
+    Ok(())
+}
@@ -0,0 +1,75 @@
+use serde_json::json;
+use sqlx::{Pool, Postgres};
+
+use windmill_test_utils::*;
+
+/// With `add_admins_and_developers_to_forks` on, a fork starts with the parent's admins and
+/// developers at their parent role, even when a developer forks it; operators are left out. The
+/// copies are manual members: a parent membership that came from an instance group must not carry
+/// that provenance into a fork that does not configure the group.
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn test_fork_adds_parent_admins_and_developers(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let base_url = format!(
+        "http://localhost:{}/api/w/test-workspace/workspaces",
+        server.addr.port()
+    );
+    let client = reqwest::Client::new();
+
+    sqlx::query(
+        "UPDATE usr SET operator = true WHERE workspace_id = 'test-workspace' AND username = 'test-user-3'",
+    )
+    .execute(&db)
+    .await?;
+    sqlx::query(
+        "INSERT INTO usr (workspace_id, email, username, is_admin, added_via)
+         VALUES ('test-workspace', 'test4@windmill.dev', 'test-user-4', false,
+                 '{\"source\": \"instance_group\", \"group\": \"devs\"}')",
+    )
+    .execute(&db)
+    .await?;
+
+    let resp = client
+        .post(format!(
+            "{base_url}/edit_add_admins_and_developers_to_forks"
+        ))
+        .header("Authorization", "Bearer SECRET_TOKEN")
+        .json(&json!({ "add_admins_and_developers_to_forks": true }))
+        .send()
+        .await?;
+    assert!(
+        resp.status().is_success(),
+        "enabling the setting: {}",
+        resp.text().await?
+    );
+
+    let resp = client
+        .post(format!("{base_url}/create_fork"))
+        .header("Authorization", "Bearer SECRET_TOKEN_2")
+        .json(&json!({ "id": "wm-fork-team", "name": "Team fork" }))
+        .send()
+        .await?;
+    assert!(
+        resp.status().is_success(),
+        "creating the fork: {}",
+        resp.text().await?
+    );
+
+    let members: Vec<(String, bool, bool)> = sqlx::query_as(
+        "SELECT username, is_admin, added_via IS NULL FROM usr
+         WHERE workspace_id = 'wm-fork-team' ORDER BY username",
+    )
+    .fetch_all(&db)
+    .await?;
+    assert_eq!(
+        members,
+        vec![
+            ("test-user".to_string(), true, true),
+            ("test-user-2".to_string(), false, true),
+            ("test-user-4".to_string(), false, true),
+        ]
+    );
+
+    Ok(())
+}
@@ -115,6 +115,60 @@ async fn login_link_is_single_use_and_same_origin(db: Pool<Postgres>) -> anyhow:
    Ok(())
 }

+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn confirmed_login_link_is_spent_by_the_click_not_the_page(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let base = format!("http://localhost:{port}/api");
+
+    let resp = client()
+        .post(format!("{base}/users/login_links"))
+        .header("Authorization", "Bearer SECRET_TOKEN")
+        .json(&json!({"email": "test2@windmill.dev", "confirm": true}))
+        .send()
+        .await?;
+    assert_eq!(resp.status(), 201);
+    let link = resp.json::<serde_json::Value>().await?;
+    // The URL handed out is the frontend page, not the API path that signs in on a GET.
+    let token = link["url"]
+        .as_str()
+        .unwrap()
+        .split_once("/user/login_link?token=")
+        .expect("confirmation page url")
+        .1
+        .to_string();
+
+    let confirm = || {
+        client()
+            .post(format!("{base}/auth/login_link/{token}"))
+            .send()
+    };
+    let resp = confirm().await?;
+    assert_eq!(resp.status(), 200);
+    assert!(resp
+        .headers()
+        .get_all("set-cookie")
+        .iter()
+        .any(|c| c.to_str().unwrap().starts_with("token=")));
+    assert_eq!(
+        resp.json::<serde_json::Value>().await?["location"],
+        "/user/workspaces"
+    );
+
+    let resp = confirm().await?;
+    assert_eq!(resp.status(), 200);
+    assert!(resp.headers().get("set-cookie").is_none());
+    assert_eq!(
+        resp.json::<serde_json::Value>().await?["location"],
+        "/user/login_link_expired?reason=used"
+    );
+
+    Ok(())
+}
+
 #[sqlx::test(migrations = "../migrations", fixtures("base"))]
 async fn login_link_mint_can_require_a_login_type(db: Pool<Postgres>) -> anyhow::Result<()> {
    initialize_tracing().await;
@@ -0,0 +1,239 @@
+//! `max_token_expiration_days`: the instance-wide ceiling on how far ahead a token a caller
+//! picks the lifetime of may expire, and the service-account exemption.
+
+use serde_json::json;
+use sqlx::types::chrono::{DateTime, Utc};
+use sqlx::{Pool, Postgres};
+use windmill_test_utils::*;
+
+const DAY: u64 = 24 * 60 * 60;
+
+fn client() -> reqwest::Client {
+    reqwest::Client::new()
+}
+
+fn from_now(secs: u64) -> DateTime<Utc> {
+    Utc::now() + std::time::Duration::from_secs(secs)
+}
+
+async fn set_max(db: &Pool<Postgres>, value: serde_json::Value) {
+    sqlx::query(
+        "INSERT INTO global_settings (name, value) VALUES ('max_token_expiration_days', $1)
+         ON CONFLICT (name) DO UPDATE SET value = EXCLUDED.value",
+    )
+    .bind(value)
+    .execute(db)
+    .await
+    .unwrap();
+}
+
+/// Mints as `test2@windmill.dev`, a plain member of `test-workspace`.
+async fn create_token(port: u16, body: serde_json::Value) -> reqwest::Response {
+    client()
+        .post(format!("http://localhost:{port}/api/users/tokens/create"))
+        .header("Authorization", "Bearer SECRET_TOKEN_2")
+        .json(&body)
+        .send()
+        .await
+        .unwrap()
+}
+
+async fn stored_expiration(db: &Pool<Postgres>, label: &str) -> Option<DateTime<Utc>> {
+    sqlx::query_scalar::<_, Option<DateTime<Utc>>>("SELECT expiration FROM token WHERE label = $1")
+        .bind(label)
+        .fetch_one(db)
+        .await
+        .unwrap()
+}
+
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn test_max_token_expiration_days_shortens_user_tokens(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    let resp = create_token(port, json!({ "label": "unset" })).await;
+    assert_eq!(resp.status(), 201);
+    assert_eq!(
+        stored_expiration(&db, "unset").await,
+        None,
+        "with no setting a token may still have no expiration"
+    );
+
+    // Refused at write time: the token routes can only read a value they cannot parse as no
+    // ceiling at all.
+    let resp = client()
+        .post(format!(
+            "http://localhost:{port}/api/settings/global/max_token_expiration_days"
+        ))
+        .header("Authorization", "Bearer SECRET_TOKEN")
+        .json(&json!({ "value": 7.5 }))
+        .send()
+        .await?;
+    assert_eq!(resp.status(), 400);
+
+    set_max(&db, json!(7)).await;
+
+    // The token form reads the ceiling as whoever is creating the token, usually not a
+    // superadmin, so it can offer only expirations the server would keep.
+    let resp = client()
+        .get(format!(
+            "http://localhost:{port}/api/settings/global/max_token_expiration_days"
+        ))
+        .header("Authorization", "Bearer SECRET_TOKEN_2")
+        .send()
+        .await?;
+    assert_eq!(resp.status(), 200);
+    assert_eq!(resp.text().await?, "7");
+
+    let resp = create_token(port, json!({ "label": "none asked" })).await;
+    assert_eq!(resp.status(), 201);
+    let expiration = stored_expiration(&db, "none asked")
+        .await
+        .expect("a token asking for no expiration gets the ceiling");
+    assert!(
+        expiration > from_now(6 * DAY) && expiration <= from_now(7 * DAY),
+        "expected the 7 day ceiling, got {expiration}"
+    );
+
+    let resp = create_token(
+        port,
+        json!({ "label": "past the ceiling", "expiration": from_now(30 * DAY) }),
+    )
+    .await;
+    assert_eq!(resp.status(), 201);
+    let expiration = stored_expiration(&db, "past the ceiling").await.unwrap();
+    assert!(
+        expiration > from_now(6 * DAY) && expiration <= from_now(7 * DAY),
+        "expected an expiration past the ceiling to be shortened to it, got {expiration}"
+    );
+
+    let resp = create_token(
+        port,
+        json!({ "label": "within", "expiration": from_now(3 * DAY) }),
+    )
+    .await;
+    assert_eq!(resp.status(), 201);
+    let expiration = stored_expiration(&db, "within").await.unwrap();
+    assert!(
+        expiration <= from_now(3 * DAY),
+        "an expiration within the ceiling must be kept, got {expiration}"
+    );
+
+    // The settings UI stores an integer, but the YAML instance config and config sync can write
+    // the same whole number as a string or as `5.0`. Reading either as "unset" would silently
+    // drop the ceiling, while the token form (`parseMaxTokenExpirationDays`) still showed it.
+    for (stored, label) in [
+        (json!("5"), "string setting"),
+        (json!(5.0), "float setting"),
+    ] {
+        set_max(&db, stored).await;
+        let resp = create_token(port, json!({ "label": label })).await;
+        assert_eq!(resp.status(), 201);
+        let expiration = stored_expiration(&db, label).await;
+        assert!(
+            expiration.is_some_and(|e| e > from_now(4 * DAY) && e <= from_now(5 * DAY)),
+            "{label}: expected the 5 day ceiling, got {expiration:?}"
+        );
+    }
+
+    // A superadmin impersonating a user picks the lifetime too, so the ceiling applies there;
+    // left out, it would be the one way to mint a token that never expires.
+    let resp = client()
+        .post(format!(
+            "http://localhost:{port}/api/users/tokens/impersonate"
+        ))
+        .header("Authorization", "Bearer SECRET_TOKEN")
+        .json(&json!({ "label": "impersonated", "impersonate_email": "test3@windmill.dev" }))
+        .send()
+        .await?;
+    assert_eq!(resp.status(), 201);
+    assert!(
+        stored_expiration(&db, "impersonated").await.is_some(),
+        "an impersonation token asking for no expiration gets the ceiling"
+    );
+
+    Ok(())
+}
+
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn test_service_accounts_are_exempt(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    set_max(&db, json!(7)).await;
+    // The same email is a service account in one workspace and an ordinary user in another.
+    sqlx::query(
+        "UPDATE usr SET is_service_account = true
+         WHERE email = 'test2@windmill.dev' AND workspace_id = 'test-workspace'",
+    )
+    .execute(&db)
+    .await?;
+    sqlx::query("INSERT INTO workspace (id, name, owner) VALUES ('other', 'other', 'test-user')")
+        .execute(&db)
+        .await?;
+    sqlx::query("INSERT INTO workspace_settings (workspace_id) VALUES ('other')")
+        .execute(&db)
+        .await?;
+    sqlx::query(
+        "INSERT INTO usr (workspace_id, email, username, is_admin, role)
+         VALUES ('other', 'test2@windmill.dev', 'test-user-2', false, 'User')",
+    )
+    .execute(&db)
+    .await?;
+
+    // The token form decides the exemption from this list, so it must carry each membership's flag.
+    let memberships: serde_json::Value = client()
+        .get(format!("http://localhost:{port}/api/workspaces/users"))
+        .header("Authorization", "Bearer SECRET_TOKEN_2")
+        .send()
+        .await?
+        .json()
+        .await?;
+    for (workspace, is_service_account) in [("test-workspace", true), ("other", false)] {
+        let membership = memberships["workspaces"]
+            .as_array()
+            .and_then(|ws| ws.iter().find(|w| w["id"] == workspace))
+            .unwrap_or_else(|| panic!("{workspace} missing from {memberships}"));
+        assert_eq!(membership["is_service_account"], json!(is_service_account));
+    }
+
+    for (label, workspace_id, exempt) in [
+        ("own workspace", Some("test-workspace"), true),
+        ("other workspace", Some("other"), false),
+        // A workspace-less token has no workspace to match, so a service account anywhere counts.
+        ("global", None, true),
+    ] {
+        let resp = create_token(
+            port,
+            json!({ "label": label, "workspace_id": workspace_id }),
+        )
+        .await;
+        assert_eq!(resp.status(), 201);
+        assert_eq!(
+            stored_expiration(&db, label).await.is_none(),
+            exempt,
+            "{label}: expected exempt = {exempt}"
+        );
+    }
+
+    // Impersonation checks the impersonated account, not the superadmin minting the token.
+    let resp = client()
+        .post(format!(
+            "http://localhost:{port}/api/users/tokens/impersonate"
+        ))
+        .header("Authorization", "Bearer SECRET_TOKEN")
+        .json(&json!({ "label": "impersonated service account", "impersonate_email": "test2@windmill.dev" }))
+        .send()
+        .await?;
+    assert_eq!(resp.status(), 201);
+    assert_eq!(
+        stored_expiration(&db, "impersonated service account").await,
+        None
+    );
+
+    Ok(())
+}
@@ -0,0 +1,102 @@
+//! The `mcp_disable_token_query_param` switch closes the URL-borne credential path.
+//!
+//! The rejection is a middleware layered between the `WWW-Authenticate` decorator and
+//! everything that reads a token, on both the workspaced and the gateway mount. Each half of
+//! that sandwich is pinned: the `WWW-Authenticate` header on the refusal catches the layer
+//! being moved outward (a client would lose the pointer that starts OAuth discovery), and
+//! refusing a token that was never valid catches it being moved inward past authentication
+//! (the URL-borne token would be hashed and looked up before anything refused it).
+#![cfg(feature = "mcp")]
+
+use std::sync::atomic::Ordering;
+
+use serde_json::json;
+use sqlx::{Pool, Postgres};
+
+use windmill_common::global_settings::MCP_DISABLE_TOKEN_QUERY_PARAM;
+use windmill_test_utils::*;
+
+/// Workspace-less with an `mcp:` scope, which is what the gateway mount requires; the
+/// workspaced mount takes its workspace from the path, so one token reaches both.
+async fn insert_mcp_token(db: &Pool<Postgres>) -> anyhow::Result<()> {
+    sqlx::query(
+        "INSERT INTO token (token_hash, token_prefix, token, email, label, super_admin, scopes)
+         VALUES (encode(sha256('MCP_TOKEN'::bytea), 'hex'), 'MCP_TOK', 'MCP_TOKEN', 'test@windmill.dev', 'mcp token', true, ARRAY['mcp:all'])",
+    )
+    .execute(db)
+    .await?;
+    Ok(())
+}
+
+/// A token that is not in `token` at all. Authentication would refuse it on its own, so a
+/// refusal carrying the middleware's own wording is evidence nothing looked it up first.
+const BOGUS_TOKEN: &str = "NOT_A_REAL_TOKEN";
+
+async fn tools_list(url: &str) -> anyhow::Result<reqwest::Response> {
+    Ok(reqwest::Client::new()
+        .post(url)
+        .header("Accept", "application/json, text/event-stream")
+        .json(&json!({ "jsonrpc": "2.0", "id": 1, "method": "tools/list", "params": {} }))
+        .send()
+        .await?)
+}
+
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn test_mcp_token_query_param_switch(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    set_jwt_secret().await;
+    insert_mcp_token(&db).await?;
+    let server = ApiServer::start_mcp(db.clone()).await?;
+    let port = server.addr.port();
+    let workspaced =
+        format!("http://localhost:{port}/api/mcp/w/test-workspace/mcp?token=MCP_TOKEN");
+    let gateway = format!("http://localhost:{port}/api/mcp/gateway?token=MCP_TOKEN");
+
+    assert_eq!(
+        tools_list(&workspaced).await?.status(),
+        200,
+        "a URL-borne token is the documented default and must keep working while the switch is off"
+    );
+    assert_eq!(tools_list(&gateway).await?.status(), 200);
+
+    MCP_DISABLE_TOKEN_QUERY_PARAM.store(true, Ordering::Relaxed);
+
+    for url in [&workspaced, &gateway] {
+        let resp = tools_list(url).await?;
+        assert_eq!(
+            resp.status(),
+            401,
+            "{url} still admitted a token in the URL"
+        );
+        // What sends the client into the OAuth flow rather than leaving it stuck on a 401.
+        assert!(
+            resp.headers().contains_key("www-authenticate"),
+            "{url} rejected without pointing at the authorization server"
+        );
+    }
+
+    // Refused before authentication, not after: an invalid token gets the middleware's own
+    // message rather than the generic 401 that looking it up would produce.
+    let resp = tools_list(&format!(
+        "http://localhost:{port}/api/mcp/w/test-workspace/mcp?token={BOGUS_TOKEN}"
+    ))
+    .await?;
+    assert_eq!(resp.status(), 401);
+    assert!(
+        resp.text().await?.contains("does not accept a token in the MCP URL"),
+        "an invalid URL token was answered by authentication, so the token was read before \
+         the switch refused it"
+    );
+
+    // The header stays open: it is the channel the OAuth flow itself hands tokens over on.
+    let resp = reqwest::Client::new()
+        .post(format!("http://localhost:{port}/api/mcp/gateway"))
+        .header("Accept", "application/json, text/event-stream")
+        .header("Authorization", "Bearer MCP_TOKEN")
+        .json(&json!({ "jsonrpc": "2.0", "id": 1, "method": "tools/list", "params": {} }))
+        .send()
+        .await?;
+    assert_eq!(resp.status(), 200);
+
+    Ok(())
+}
@@ -0,0 +1,49 @@
+//! Which user tokens get an "expiring soon" warning queued when they are created.
+
+use serde_json::json;
+use sqlx::types::chrono::Utc;
+use sqlx::{Pool, Postgres};
+use windmill_test_utils::*;
+
+const DAY: u64 = 24 * 60 * 60;
+
+async fn warning_queued(db: &Pool<Postgres>, label: &str) -> bool {
+    sqlx::query_scalar::<_, bool>(
+        "SELECT EXISTS(SELECT 1 FROM token_expiry_notification n
+            JOIN token t ON t.token_hash = n.token_hash WHERE t.label = $1)",
+    )
+    .bind(label)
+    .fetch_one(db)
+    .await
+    .unwrap()
+}
+
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn test_short_lived_tokens_get_no_expiry_warning(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    for (label, lifetime) in [("short", DAY), ("long", 30 * DAY)] {
+        let resp = reqwest::Client::new()
+            .post(format!("http://localhost:{port}/api/users/tokens/create"))
+            .header("Authorization", "Bearer SECRET_TOKEN_2")
+            .json(&json!({
+                "label": label,
+                "expiration": Utc::now() + std::time::Duration::from_secs(lifetime),
+            }))
+            .send()
+            .await?;
+        assert_eq!(resp.status(), 201);
+    }
+
+    assert!(
+        !warning_queued(&db, "short").await,
+        "a token whose whole lifetime fits in the warning window must not be warned about"
+    );
+    assert!(
+        warning_queued(&db, "long").await,
+        "a longer-lived token still gets its warning"
+    );
+    Ok(())
+}
@@ -275,6 +275,67 @@ async fn test_encryption_key_rotation_dispatches_batched_git_sync(
    Ok(())
 }

+/// Stored repository tokens and webhook secrets are encrypted under the
+/// workspace key but never synced, so a rotation has to carry them over even
+/// when the caller skips re-encrypting variables.
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn test_encryption_key_rotation_reencrypts_git_sync_secrets(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    use windmill_common::variables::{build_crypt, crypt_from_key_with_suffix, decrypt, encrypt};
+    initialize_tracing().await;
+
+    create_folder(&db, "28103").await?;
+    create_git_repo_resource(&db).await?;
+    let sync_script_path = "f/28103/test_sync_script_git_secrets";
+    create_sync_script(&db, sync_script_path).await?;
+    setup_git_sync_config(&db, sync_script_path).await?;
+
+    let mc = build_crypt(&db, "test-workspace").await?;
+    sqlx::query(
+        r#"
+        UPDATE workspace_settings SET
+            git_credentials = jsonb_build_array(jsonb_build_object(
+                'token', $1::text, 'repo_identity', 'https://gitlab.example.com/grp/proj')),
+            git_sync = jsonb_set(git_sync, '{repositories,0,auto_pull}', jsonb_build_object(
+                'enabled', true, 'mode', 'webhook', 'webhook_id', 1, 'webhook_secret', $2::text))
+        WHERE workspace_id = 'test-workspace'
+        "#,
+    )
+    .bind(encrypt(&mc, "stored-token"))
+    .bind(encrypt(&mc, "hook-secret"))
+    .execute(&db)
+    .await?;
+
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let base = format!("http://localhost:{port}/api/w/test-workspace/workspaces");
+
+    let new_key = "c".repeat(64);
+    let resp = authed(client().post(format!("{base}/encryption_key")))
+        .json(&json!({"new_key": new_key, "skip_reencrypt": true}))
+        .send()
+        .await?;
+    assert_eq!(
+        resp.status(),
+        200,
+        "set_encryption_key failed: {}",
+        resp.text().await?
+    );
+
+    let (token, secret): (String, String) = sqlx::query_as(
+        "SELECT git_credentials->0->>'token', git_sync#>>'{repositories,0,auto_pull,webhook_secret}'
+         FROM workspace_settings WHERE workspace_id = 'test-workspace'",
+    )
+    .fetch_one(&db)
+    .await?;
+    let new_mc = crypt_from_key_with_suffix(&new_key, "");
+    assert_eq!(decrypt(&new_mc, token)?, "stored-token");
+    assert_eq!(decrypt(&new_mc, secret)?, "hook-secret");
+
+    Ok(())
+}
+
 /// Regression test for the non-debouncing fallback: a workspace whose sync
 /// script predates hub version 28103 must still receive git-sync jobs for the
 /// encryption_key entry and every re-encrypted secret. Before the fallback was
@@ -1166,3 +1166,47 @@ async fn test_create_service_account_drops_orphaned_group_memberships(

    Ok(())
 }
+
+#[cfg(feature = "private")]
+#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+async fn test_edit_auto_invite_preserves_instance_groups(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+
+    sqlx::query(
+        r#"UPDATE workspace_settings
+           SET auto_invite = '{"instance_groups": ["eng"], "instance_groups_roles": {"eng": "developer"}}'
+           WHERE workspace_id = 'test-workspace'"#,
+    )
+    .execute(&db)
+    .await?;
+
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let base = format!("http://localhost:{port}/api/w/test-workspace/workspaces");
+
+    // enable, then disable
+    for body in [
+        json!({"operator": false, "invite_all": true, "auto_add": false}),
+        json!({}),
+    ] {
+        let resp = authed(client().post(format!("{base}/edit_auto_invite")))
+            .json(&body)
+            .send()
+            .await?;
+        assert_eq!(resp.status(), 200, "{body}: {}", resp.text().await?);
+
+        let auto_invite: serde_json::Value = sqlx::query_scalar(
+            "SELECT auto_invite FROM workspace_settings WHERE workspace_id = 'test-workspace'",
+        )
+        .fetch_one(&db)
+        .await?;
+        assert_eq!(auto_invite["instance_groups"], json!(["eng"]), "{body}");
+        assert_eq!(
+            auto_invite["instance_groups_roles"],
+            json!({"eng": "developer"}),
+            "{body}"
+        );
+    }
+
+    Ok(())
+}
@@ -64,6 +64,7 @@ use windmill_common::{
        GITHUB_APP_WEBHOOK_BASE_URL_SETTING, HTTP_ROUTE_DEFAULT_ALLOWED_ORIGINS_SETTING,
        HTTP_ROUTE_WORKSPACED_ROUTE_SETTING, HUB_ACCESSIBLE_URL_SETTING, HUB_BASE_URL_SETTING,
        INSTANCE_BANNER_SETTING, MAX_RETENTION_OVERRIDE_WORKSPACES,
+        MAX_TOKEN_EXPIRATION_DAYS_SETTING, MCP_DISABLE_TOKEN_QUERY_PARAM_SETTING,
        RETENTION_PERIOD_SECS_OVERRIDES_SETTING, RUFF_CONFIG_SETTING, UNIQUE_ID_SETTING,
        WORKSPACE_FAIRNESS_DURATION_SECS_SETTING, WORKSPACE_FAIRNESS_ENABLED_SETTING,
        WORKSPACE_FAIRNESS_MAX_PERCENT_SETTING, WORKSPACE_FAIRNESS_MIN_TOTAL_SETTING,
@@ -1195,6 +1196,12 @@ async fn run_setting_pre_write_hook(
                }
            }
        }
+        MAX_TOKEN_EXPIRATION_DAYS_SETTING => {
+            windmill_common::global_settings::parse_max_token_expiration_days(Some(value))
+                .map_err(|e| {
+                    error::Error::BadRequest(format!("{MAX_TOKEN_EXPIRATION_DAYS_SETTING}: {e}"))
+                })?;
+        }
        INSTANCE_BANNER_SETTING => {
            match value {
                // Clearing (delete row) is handled by the caller; allow it through.
@@ -1356,6 +1363,12 @@ pub async fn get_global_setting(
        && key != HTTP_ROUTE_DEFAULT_ALLOWED_ORIGINS_SETTING
        && key != WS_BASE_URL_SETTING
        && key != INSTANCE_BANNER_SETTING
+        // The token form reads it to stop offering expirations the server would shorten.
+        && key != MAX_TOKEN_EXPIRATION_DAYS_SETTING
+        // Whoever is wiring up an MCP client reads it to know whether a URL-borne token
+        // would be refused, and they are usually not a superadmin. Not a secret: pointing
+        // any MCP client at the instance discovers the same answer.
+        && key != MCP_DISABLE_TOKEN_QUERY_PARAM_SETTING
    {
        require_super_admin(&db, &authed).await?;
    }
@@ -47,7 +47,10 @@ use windmill_audit::audit_oss::audit_log;
 use windmill_audit::ActionKind;
 use windmill_common::audit::AuditAuthor;
 use windmill_common::auth::{hash_token, safe_token_prefix, TOKEN_PREFIX_LEN};
-use windmill_common::global_settings::AUTOMATE_USERNAME_CREATION_SETTING;
+use windmill_common::global_settings::{
+    load_value_from_global_settings, parse_max_token_expiration_days,
+    AUTOMATE_USERNAME_CREATION_SETTING, MAX_TOKEN_EXPIRATION_DAYS_SETTING,
+};
 use windmill_common::oauth2::InstanceEvent;
 use windmill_common::per_minute_counter::PerMinuteCounter;
 use windmill_common::users::truncate_token;
@@ -168,7 +171,10 @@ pub fn make_unauthed_service() -> Router {
        .route("/logout", post(logout).get(logout))
        .route("/is_first_time_setup", get(is_first_time_setup))
        .route("/request_password_reset", post(request_password_reset))
-        .route("/login_link/{token}", get(consume_login_link))
+        .route(
+            "/login_link/{token}",
+            get(consume_login_link).post(confirm_login_link),
+        )
        .route("/is_smtp_configured", get(is_smtp_configured))
        .route(
            "/is_password_login_disabled",
@@ -3092,11 +3098,68 @@ pub async fn create_guest_session_token<'c>(

 // create_token_internal is re-exported from windmill-api-auth above

+/// Applies the instance-wide ceiling on how long a token a caller picks the lifetime of may
+/// live (`create_token`, and `impersonate` for superadmins), returning the expiration to store:
+/// the requested one while it fits, the ceiling otherwise, and the ceiling as well when none was
+/// requested. Only the stored expiration is capped: tokens already stored when the setting is
+/// turned on or lowered keep theirs, since the auth lookup never reads the setting.
+///
+/// It shortens rather than refuses because most callers do not comply on their own. The CLI
+/// authorization page, `wmill user create-token` and the editor's language-server token each
+/// pick a lifetime, often none at all, without reading the setting (and CLIs already installed
+/// never will), so refusing would break logging in and the editor instead of the long-lived
+/// tokens the setting is aimed at.
+///
+/// Read from `global_settings` on each call rather than cached: token creation is rare
+/// enough that the round trip costs nothing, and the ceiling is then never served stale.
+///
+/// A token owned by a service account is exempt: in the workspace the token names, or in any
+/// workspace for a workspace-less token, which has none to match. Service accounts are the
+/// identity automation that needs a long-lived credential runs as. The cost is that any
+/// workspace admin can create and impersonate one to hold an uncapped token, so the ceiling
+/// bounds personal tokens rather than what an admin can obtain.
+async fn cap_token_expiration(
+    db: &DB,
+    owner_email: &str,
+    workspace_id: Option<&str>,
+    requested: Option<chrono::DateTime<chrono::Utc>>,
+) -> Result<Option<chrono::DateTime<chrono::Utc>>> {
+    let value = load_value_from_global_settings(db, MAX_TOKEN_EXPIRATION_DAYS_SETTING).await?;
+    let max_days = match parse_max_token_expiration_days(value.as_ref()) {
+        Ok(Some(max_days)) => max_days,
+        Ok(None) => return Ok(requested),
+        // Both write paths reject this, so only a row written around them gets here.
+        Err(e) => {
+            tracing::warn!("ignoring {MAX_TOKEN_EXPIRATION_DAYS_SETTING}: {e}");
+            return Ok(requested);
+        }
+    };
+    let max = chrono::Utc::now() + chrono::Duration::days(max_days);
+
+    let is_service_account = sqlx::query_scalar!(
+        "SELECT EXISTS(SELECT 1 FROM usr WHERE email = $1 AND is_service_account IS true
+            AND ($2::varchar IS NULL OR workspace_id = $2))",
+        owner_email,
+        workspace_id,
+    )
+    .fetch_one(db)
+    .await?
+    .unwrap_or(false);
+    if is_service_account {
+        return Ok(requested);
+    }
+
+    Ok(Some(match requested {
+        Some(expiration) if expiration < max => expiration,
+        _ => max,
+    }))
+}
+
 async fn create_token(
    Extension(db): Extension<DB>,
    authed: ApiAuthed,
    OptJobAuthed { job_id, .. }: OptJobAuthed,
-    Json(token_config): Json<NewToken>,
+    Json(mut token_config): Json<NewToken>,
 ) -> Result<(StatusCode, String)> {
    forbid_elevated_job_token(&db, &authed.email, job_id).await?;
    check_token_create_rate_limit(&authed.username)?;
@@ -3118,6 +3181,14 @@ async fn create_token(

    windmill_api_auth::ensure_scopes_within_caller(&authed, token_config.scopes.as_deref())?;

+    token_config.expiration = cap_token_expiration(
+        &db,
+        &authed.email,
+        token_config.workspace_id.as_deref(),
+        token_config.expiration,
+    )
+    .await?;
+
    let mut tx = db.begin().await?;

    let token = create_token_internal(&mut *tx, &db, &authed, token_config).await?;
@@ -3174,6 +3245,7 @@ async fn impersonate(
    .fetch_optional(&db)
    .await?
    .unwrap_or(false);
+    let expiration = cap_token_expiration(&db, &impersonated, None, new_token.expiration).await?;
    let mut tx = db.begin().await?;

    sqlx::query!(
@@ -3185,7 +3257,7 @@ async fn impersonate(
        plaintext as Option<&str>,
        impersonated,
        new_token.label,
-        new_token.expiration,
+        expiration,
        is_super_admin
    )
    .execute(&mut *tx)
@@ -3195,7 +3267,7 @@ async fn impersonate(
        &mut *tx,
        &t_hash,
        new_token.label.as_deref(),
-        new_token.expiration,
+        expiration,
    )
    .await;

@@ -3215,9 +3287,12 @@ async fn impersonate(
 }

 const LOGIN_LINK_DEFAULT_TTL_S: u32 = 600;
-const LOGIN_LINK_MAX_TTL_S: u32 = 900;
+// Long enough for a link sent by email to still work when it is read. `require_login_type` is
+// only checked at mint, so a much longer cap would need re-checking it when the link is opened.
+const LOGIN_LINK_MAX_TTL_S: u32 = 7200;
 const LOGIN_LINK_DEFAULT_RD: &str = "/user/workspaces";
 const LOGIN_LINK_EXPIRED_PAGE: &str = "/user/login_link_expired";
+const LOGIN_LINK_CONFIRM_PAGE: &str = "/user/login_link";

 #[derive(Deserialize)]
 pub struct NewLoginLink {
@@ -3228,6 +3303,9 @@ pub struct NewLoginLink {
    /// account it created can require `pending_oauth`, so the link stops working once the
    /// owner has set a password or signed in with a provider.
    pub require_login_type: Option<String>,
+    /// Hand out a page that signs in only when its button is clicked. Mail scanners open links
+    /// on delivery, and opening the plain link spends it, so a link sent by email sets this.
+    pub confirm: Option<bool>,
 }

 #[derive(Serialize)]
@@ -3378,11 +3456,12 @@ async fn create_login_link(
    .await?;
    tx.commit().await?;

-    let url = format!(
-        "{}/api/auth/login_link/{}",
-        (**BASE_URL.load()).clone(),
-        token
-    );
+    let base_url = (**BASE_URL.load()).clone();
+    let url = if nl.confirm.unwrap_or(false) {
+        format!("{base_url}{LOGIN_LINK_CONFIRM_PAGE}?token={token}")
+    } else {
+        format!("{base_url}/api/auth/login_link/{token}")
+    };
    Ok((StatusCode::CREATED, Json(LoginLink { url, expires_at })))
 }

@@ -3628,19 +3707,45 @@ async fn consume_login_link(
    Path(token): Path<String>,
    Query(query): Query<LoginLinkQuery>,
 ) -> Result<Response> {
-    let bounce = |reason: &str| {
-        Ok(login_link_redirect(format!(
-            "{LOGIN_LINK_EXPIRED_PAGE}?reason={reason}"
-        )))
-    };
+    let location = redeem_login_link(&headers, cookies, &db, &token, query.rd).await?;
+    Ok(login_link_redirect(location))
+}
+
+#[derive(Serialize)]
+struct LoginLinkLocation {
+    location: String,
+}
+
+/// The confirmation page's click. It answers with where to go rather than redirecting, and the
+/// page navigates there itself.
+async fn confirm_login_link(
+    headers: axum::http::HeaderMap,
+    cookies: Cookies,
+    Extension(db): Extension<DB>,
+    Path(token): Path<String>,
+) -> JsonResult<LoginLinkLocation> {
+    let location = redeem_login_link(&headers, cookies, &db, &token, None).await?;
+    Ok(Json(LoginLinkLocation { location }))
+}
+
+/// Spends the link and sets the session cookie, returning the post-login destination; or
+/// returns the explanation page, with no session, when the link cannot be used.
+async fn redeem_login_link(
+    headers: &axum::http::HeaderMap,
+    cookies: Cookies,
+    db: &DB,
+    token: &str,
+    requested_rd: Option<String>,
+) -> Result<String> {
+    let bounce = |reason: &str| Ok(format!("{LOGIN_LINK_EXPIRED_PAGE}?reason={reason}"));
    if token.len() != 32 {
        return bounce("invalid");
    }
-    let t_hash = hash_token(&token);
+    let t_hash = hash_token(token);
    // The account is unknown until the row is read, so only the global and per-IP tiers
    // apply here; a 32-char random token leaves nothing for the per-account tier to guard.
    windmill_common::login_rate_limit::check_and_increment_login_attempt(
-        &headers,
+        headers,
        &t_hash[..TOKEN_PREFIX_LEN],
    )?;

@@ -3707,11 +3812,10 @@ async fn consume_login_link(
    .await?;
    tx.commit().await?;

-    let rd = link
+    Ok(link
        .rd
-        .or_else(|| same_origin_rd(query.rd))
-        .unwrap_or_else(|| LOGIN_LINK_DEFAULT_RD.to_string());
-    Ok(login_link_redirect(rd))
+        .or_else(|| same_origin_rd(requested_rd))
+        .unwrap_or_else(|| LOGIN_LINK_DEFAULT_RD.to_string()))
 }

 #[derive(Deserialize)]
@@ -3945,6 +4049,7 @@ async fn update_token_label(
                 AND NOT starts_with(label, 'embed_app:')
                 AND NOT starts_with(label, 'sdk_app:')
                 AND NOT starts_with(label, 'impersonation:')
+                 AND NOT starts_with(label, 'cli-login:')
             ))
           RETURNING token_prefix",
        req.label.as_deref(),
@@ -1,44 +0,0 @@
-/*
- * Author: Ruben Fiszel
- * Copyright: Windmill Labs, Inc 2022
- * This file and its contents are licensed under the AGPLv3 License.
- * Please see the included NOTICE for copyright information and
- * LICENSE-AGPL for a copy of the license.
- */
-
-//! Where the ACL planner comes from: the enterprise one, or a refusal.
-//!
-//! Data table roles are an Enterprise Edition feature, and so is everything here — reading who
-//! owns what included. `private` alone is not that edition — community builds carry it — so the
-//! planner is behind `enterprise` as well.
-
-#[cfg(all(feature = "private", feature = "enterprise"))]
-pub(crate) use crate::datatable_acl_ee::plan_statements;
-
-#[cfg(all(feature = "private", feature = "enterprise"))]
-pub(crate) fn ensure_datatable_acl_available() -> windmill_common::error::Result<()> {
-    Ok(())
-}
-
-#[cfg(not(all(feature = "private", feature = "enterprise")))]
-use {
-    crate::datatable_acl::{AclChange, AclPlan, AclTarget, CatalogFacts},
-    windmill_common::{datatable_roles_oss::datatable_roles_unavailable, error::Result},
-};
-
-/// Checked first by every ACL route, before anything is read or connected to.
-#[cfg(not(all(feature = "private", feature = "enterprise")))]
-pub(crate) fn ensure_datatable_acl_available() -> Result<()> {
-    Err(datatable_roles_unavailable())
-}
-
-#[cfg(not(all(feature = "private", feature = "enterprise")))]
-pub(crate) fn plan_statements(
-    _target: &AclTarget,
-    _change: &AclChange,
-    _dbname: &str,
-    _pg_role: &str,
-    _facts: &CatalogFacts,
-) -> Result<AclPlan> {
-    Err(datatable_roles_unavailable())
-}
@@ -1,560 +0,0 @@
-/*
- * Author: Ruben Fiszel
- * Copyright: Windmill Labs, Inc 2022
- * This file and its contents are licensed under the AGPLv3 License.
- * Please see the included NOTICE for copyright information and
- * LICENSE-AGPL for a copy of the license.
- */
-
-//! Copying a data table's database for the fork being created.
-//!
-//! The fork request makes its copies before it writes the fork: each is created, filled and — for a
-//! data table under roles — given the source's owners and grants. What each copy was made from
-//! stays in the request ([`MadeCopy`]), so the fork's transaction checks it against the source as it
-//! is then, and a fork that fails drops the instance copies it made ([`drop_copies_after`]) and names
-//! the others, which live on servers of the workspace's own.
-
-use std::collections::BTreeSet;
-
-use windmill_api_auth::ApiAuthed;
-use windmill_common::datatable_roles::{lock_role_catalog, read_role_catalog_tx};
-use windmill_common::error::{pg_error_message, Error, Result};
-use windmill_common::utils::require_admin;
-use windmill_common::worker::CLOUD_HOSTED;
-use windmill_common::workspaces::{
-    get_datatable_resource_from_db_unchecked, DataTableDatabase, DataTableForkBehavior,
-    GoverningDatatable,
-};
-use windmill_common::{PgDatabase, DB};
-
-use crate::datatable_acl::connect_with_notices;
-use crate::datatable_permissions::ensure_reaches_governing_datatable;
-use crate::workspaces::{
-    create_database_on_server, ensure_datatable_is_clonable, pg_dump_database, pg_import_dump,
-    DumpFile, PgDumpOptions,
-};
-
-/// A database this request created and filled for one data table of the fork.
-pub(crate) struct MadeCopy {
-    /// The data table's name, in the parent and in the fork.
-    pub(crate) name: String,
-    pub(crate) dbname: String,
-    pub(crate) behavior: DataTableForkBehavior,
-    /// The database the source resolved to when it was copied.
-    pub(crate) source_database: DataTableDatabase,
-    /// Whether the source's owners and grants were replayed into the copy: it was under roles.
-    pub(crate) replayed: bool,
-    /// For a resource-backed copy, the resource and variables its connection was resolved from.
-    pub(crate) connection: Option<ConnectionSnapshot>,
-}
-
-/// What a resource-backed data table's connection is resolved from: its resource, and every
-/// resource and variable that one references, as stored — and, for a secret kept in an external
-/// backend, the value that backend holds. The connection is resolved from the snapshot itself
-/// ([`ConnectionSnapshot::resolve`]), so it is exactly the one these rows describe.
-#[derive(PartialEq)]
-pub(crate) struct ConnectionSnapshot {
-    root: String,
-    resources: std::collections::BTreeMap<String, Option<serde_json::Value>>,
-    /// Stored value and whether it is secret.
-    variables: std::collections::BTreeMap<String, Option<(String, bool)>>,
-    external_secrets: std::collections::BTreeMap<String, String>,
-}
-
-/// Read the [`ConnectionSnapshot`] of resource `resource_path` in workspace `w_id`.
-///
-/// Authorization: none, and it holds secret values. Callers MUST have authorized using that
-/// resource, and never disclose the snapshot or what it resolves to.
-pub(crate) async fn connection_snapshot(
-    db: &DB,
-    conn: &mut sqlx::PgConnection,
-    w_id: &str,
-    resource_path: &str,
-) -> Result<ConnectionSnapshot> {
-    let root = resource_path.trim_start_matches("$res:").to_string();
-    let mut snapshot = ConnectionSnapshot {
-        root: root.clone(),
-        resources: Default::default(),
-        variables: Default::default(),
-        external_secrets: Default::default(),
-    };
-    let mut pending = vec![root];
-    while let Some(path) = pending.pop() {
-        if snapshot.resources.contains_key(&path) {
-            continue;
-        }
-        let value: Option<serde_json::Value> = sqlx::query_scalar(
-            "SELECT value FROM resource WHERE workspace_id = $1 AND path = $2",
-        )
-        .bind(w_id)
-        .bind(&path)
-        .fetch_optional(&mut *conn)
-        .await?
-        .flatten();
-        let mut strings = vec![];
-        collect_strings(value.as_ref(), &mut strings);
-        for reference in strings {
-            if let Some(var) = reference.strip_prefix("$var:") {
-                if snapshot.variables.contains_key(var) {
-                    continue;
-                }
-                let row: Option<(String, bool)> = sqlx::query_as(
-                    "SELECT value, is_secret FROM variable WHERE workspace_id = $1 AND path = $2",
-                )
-                .bind(w_id)
-                .bind(var)
-                .fetch_optional(&mut *conn)
-                .await?;
-                if let Some((stored, true)) = &row {
-                    if windmill_common::secret_backend::is_external_stored_value(stored) {
-                        let secret = windmill_common::secret_backend::get_secret_value(
-                            db, w_id, var, stored,
-                        )
-                        .await?;
-                        snapshot.external_secrets.insert(var.to_string(), secret);
-                    }
-                }
-                snapshot.variables.insert(var.to_string(), row);
-            } else if let Some(res) = reference.strip_prefix("$res:") {
-                pending.push(res.to_string());
-            }
-        }
-        snapshot.resources.insert(path, value);
-    }
-    Ok(snapshot)
-}
-
-impl ConnectionSnapshot {
-    /// The connection these rows resolve to, as the data table's own resolution would: references
-    /// substituted, secrets decrypted.
-    pub(crate) async fn resolve(&self, db: &DB, w_id: &str) -> Result<serde_json::Value> {
-        let root = self.resource(&self.root)?;
-        self.substitute(db, w_id, root, 0).await
-    }
-
-    /// Whether the resource itself holds the connection's fields, which the fork repoints by setting
-    /// its `dbname`, rather than being a reference to another resource.
-    pub(crate) fn root_holds_connection(&self) -> bool {
-        self.resource(&self.root).is_ok_and(|v| v.is_object())
-    }
-
-    fn resource(&self, path: &str) -> Result<&serde_json::Value> {
-        self.resources
-            .get(path)
-            .and_then(|v| v.as_ref())
-            .ok_or_else(|| Error::NotFound(format!("resource {path} does not exist")))
-    }
-
-    fn substitute<'a>(
-        &'a self,
-        db: &'a DB,
-        w_id: &'a str,
-        value: &'a serde_json::Value,
-        depth: usize,
-    ) -> std::pin::Pin<Box<dyn std::future::Future<Output = Result<serde_json::Value>> + Send + 'a>>
-    {
-        Box::pin(async move {
-            if depth > 32 {
-                return Err(Error::BadRequest("resource references nest too deeply".to_string()));
-            }
-            Ok(match value {
-                serde_json::Value::Object(map) => {
-                    let mut out = serde_json::Map::new();
-                    for (key, val) in map {
-                        out.insert(key.clone(), self.substitute(db, w_id, val, depth).await?);
-                    }
-                    serde_json::Value::Object(out)
-                }
-                serde_json::Value::Array(items) => {
-                    let mut out = vec![];
-                    for val in items {
-                        out.push(self.substitute(db, w_id, val, depth).await?);
-                    }
-                    serde_json::Value::Array(out)
-                }
-                serde_json::Value::String(s) if s.starts_with("$res:") => {
-                    let path = &s[5..];
-                    self.substitute(db, w_id, self.resource(path)?, depth + 1).await?
-                }
-                serde_json::Value::String(s) if s.starts_with("$var:") => {
-                    let path = &s[5..];
-                    let (stored, secret) = self
-                        .variables
-                        .get(path)
-                        .and_then(|v| v.as_ref())
-                        .ok_or_else(|| Error::NotFound(format!("variable {path} does not exist")))?;
-                    serde_json::Value::String(match (secret, self.external_secrets.get(path)) {
-                        (false, _) => stored.clone(),
-                        (true, Some(external)) => external.clone(),
-                        (true, None) => windmill_common::variables::decrypt(
-                            &windmill_common::variables::build_crypt(db, w_id).await?,
-                            stored.clone(),
-                        )
-                        .map_err(|e| {
-                            Error::internal_err(format!("Error decrypting variable {s}: {e}"))
-                        })?,
-                    })
-                }
-                other => other.clone(),
-            })
-        })
-    }
-}
-
-fn collect_strings<'a>(value: Option<&'a serde_json::Value>, out: &mut Vec<&'a str>) {
-    match value {
-        Some(serde_json::Value::String(s)) => out.push(s),
-        Some(serde_json::Value::Array(items)) => {
-            items.iter().for_each(|v| collect_strings(Some(v), out))
-        }
-        Some(serde_json::Value::Object(map)) => {
-            map.values().for_each(|v| collect_strings(Some(v), out))
-        }
-        _ => {}
-    }
-}
-
-/// What a data table of the fork should be copied as.
-pub(crate) struct CopyRequest<'a> {
-    pub(crate) name: &'a str,
-    pub(crate) dbname: &'a str,
-    pub(crate) behavior: DataTableForkBehavior,
-}
-
-/// Check that `authed` may copy each data table of `parent_w_id` as asked, before anything is
-/// created.
-///
-/// Who may copy is what it was before data table roles — anyone for the schema, an admin of the
-/// workspace for the rows — narrowed under roles to whoever may connect as one of them: even the
-/// schema alone lists every table, which under roles only role holders can read in the parent.
-pub(crate) async fn authorize_copies(
-    db: &DB,
-    authed: &ApiAuthed,
-    parent_w_id: &str,
-    requests: &[CopyRequest<'_>],
-) -> Result<()> {
-    for request in requests {
-        match request.behavior {
-            DataTableForkBehavior::KeepOriginal => {
-                return Err(Error::BadRequest(format!(
-                    "Data table '{}' is kept, which copies nothing",
-                    request.name
-                )))
-            }
-            DataTableForkBehavior::SchemaOnly => {}
-            DataTableForkBehavior::SchemaAndData => {
-                require_admin(authed.is_admin, &authed.username)?;
-                if *CLOUD_HOSTED {
-                    return Err(Error::BadRequest(
-                        "Cloning schema and data is not available on cloud".to_string(),
-                    ));
-                }
-            }
-        }
-        windmill_common::validate_dbname(request.dbname)?;
-        if !request.dbname.starts_with("wm_fork_") {
-            return Err(Error::BadRequest(format!(
-                "Forked datatable database name '{}' must start with 'wm_fork_'",
-                request.dbname
-            )));
-        }
-        let governing = ensure_datatable_is_clonable(db, parent_w_id, request.name).await?;
-        ensure_reaches_governing_datatable(db, parent_w_id, request.name, &governing, authed)
-            .await?;
-        if governing.datatable.permissions.is_some() {
-            crate::datatable_replay_oss::ensure_replay()?;
-        }
-    }
-    Ok(())
-}
-
-/// Make every copy in `requests`, in order, once [`authorize_copies`] allows them all. When one
-/// fails, the copies already made are dropped before the error is returned.
-pub(crate) async fn make_copies(
-    db: &DB,
-    authed: &ApiAuthed,
-    parent_w_id: &str,
-    requests: &[CopyRequest<'_>],
-) -> Result<Vec<MadeCopy>> {
-    authorize_copies(db, authed, parent_w_id, requests).await?;
-    let mut copies = Vec::with_capacity(requests.len());
-    for request in requests {
-        match make_copy(db, authed, parent_w_id, request).await {
-            Ok(copy) => copies.push(copy),
-            Err(e) => return Err(drop_copies_after(db, copies, e).await),
-        }
-    }
-    Ok(copies)
-}
-
-/// Drop every copy, returning `error` — with what could not be dropped appended, since nothing
-/// else will name those databases again.
-pub(crate) async fn drop_copies_after(db: &DB, copies: Vec<MadeCopy>, error: Error) -> Error {
-    let mut stranded = Vec::new();
-    for copy in copies {
-        if let Err(e) = drop_copy(db, &copy.source_database, &copy.dbname).await {
-            tracing::error!("Could not drop '{}' after a failed fork: {e}", copy.dbname);
-            stranded.push(format!("'{}' ({e})", copy.dbname));
-        }
-    }
-    if stranded.is_empty() {
-        error
-    } else {
-        Error::ExecutionErr(format!(
-            "{error}. These databases created for the fork could not be dropped: {}",
-            stranded.join(", ")
-        ))
-    }
-}
-
-async fn drop_copy(db: &DB, source_database: &DataTableDatabase, dbname: &str) -> Result<()> {
-    if source_database.resource_type
-        == windmill_common::workspaces::DataTableCatalogResourceType::Instance
-    {
-        let users = windmill_common::drop_unused_instance_database(db, dbname).await?;
-        if users.is_empty() {
-            Ok(())
-        } else {
-            Err(Error::BadRequest(format!(
-                "kept, since workspaces {} now use it",
-                users.join(", ")
-            )))
-        }
-    } else {
-        // On a server of the workspace's own, where a resource edited meanwhile can already name it
-        // and nothing locks such an edit: dropping it could take someone's data.
-        Err(Error::BadRequest(
-            "kept on its PostgreSQL server, where it may already be in use; drop it there once it \
-             is not, before forking the same data table under this id again"
-                .to_string(),
-        ))
-    }
-}
-
-async fn make_copy(
-    db: &DB,
-    authed: &ApiAuthed,
-    parent_w_id: &str,
-    request: &CopyRequest<'_>,
-) -> Result<MadeCopy> {
-    let governing = ensure_datatable_is_clonable(db, parent_w_id, request.name).await?;
-    let source_database = governing.datatable.database.clone().ok_or_else(|| {
-        Error::internal_err(format!(
-            "Data table '{}' resolves to an entry that owns no database",
-            request.name
-        ))
-    })?;
-    let is_instance = governing.is_instance();
-    // Resolved from the snapshot, not read again: the connection the copy is made on is then
-    // exactly what these rows describe, which the fork's own clone of them is checked against.
-    let (server, connection): (PgDatabase, Option<ConnectionSnapshot>) = if is_instance {
-        let server = serde_json::from_value(
-            get_datatable_resource_from_db_unchecked(db, parent_w_id, request.name).await?,
-        )
-        .map_err(|e| Error::internal_err(format!("Failed to parse database credentials: {e}")))?;
-        (server, None)
-    } else {
-        let snapshot = connection_snapshot(
-            db,
-            &mut *db.acquire().await?,
-            &governing.workspace_id,
-            &source_database.resource_path,
-        )
-        .await?;
-        if !snapshot.root_holds_connection() {
-            return Err(Error::BadRequest(format!(
-                "Data table '{}' uses resource '{}', which only refers to another resource: the \
-                 fork's copy of it could not be pointed at the copied database. Point the data \
-                 table at the resource holding the connection, then fork again.",
-                request.name, source_database.resource_path
-            )));
-        }
-        let server = serde_json::from_value(snapshot.resolve(db, &governing.workspace_id).await?)
-            .map_err(|e| {
-                Error::internal_err(format!("Failed to parse database credentials: {e}"))
-            })?;
-        (server, Some(snapshot))
-    };
-
-    // Dumped before the database exists, so a source that cannot be read leaves nothing behind.
-    // Ownership never carries over: the restore runs as the target's connection user. Grants do,
-    // except on the instance, where the replay below is what reproduces them.
-    let dump = pg_dump_database(
-        &server,
-        PgDumpOptions {
-            schema_only: request.behavior == DataTableForkBehavior::SchemaOnly,
-            no_owner: true,
-            no_acl: is_instance,
-            ..Default::default()
-        },
-    )
-    .await?;
-
-    if is_instance {
-        windmill_common::create_custom_instance_database(db, request.dbname, "datatable").await?;
-    } else {
-        create_database_on_server(db, &server, request.dbname).await?;
-    }
-
-    let target = PgDatabase { dbname: request.dbname.to_string(), ..server.clone() };
-    let filled = fill(
-        db,
-        authed,
-        parent_w_id,
-        request.name,
-        &governing,
-        &server,
-        &target,
-        &dump,
-    )
-    .await;
-    match filled {
-        Ok(replayed) => Ok(MadeCopy {
-            name: request.name.to_string(),
-            dbname: request.dbname.to_string(),
-            behavior: request.behavior,
-            source_database,
-            replayed,
-            connection,
-        }),
-        Err(e) => {
-            if let Err(drop_err) = drop_copy(db, &source_database, request.dbname).await {
-                tracing::error!(
-                    "Could not drop '{}' after a failed copy of data table '{}': {drop_err}",
-                    request.dbname,
-                    request.name
-                );
-                return Err(Error::ExecutionErr(format!(
-                    "{e}. The database '{}' created for the copy could not be dropped: {drop_err}",
-                    request.dbname
-                )));
-            }
-            Err(e)
-        }
-    }
-}
-
-/// Restore the dump into the new database and, for a data table under roles, replay the source's
-/// owners and grants into it. Returns whether it replayed.
-#[allow(clippy::too_many_arguments)]
-async fn fill(
-    db: &DB,
-    authed: &ApiAuthed,
-    parent_w_id: &str,
-    name: &str,
-    governing: &GoverningDatatable,
-    source: &PgDatabase,
-    target: &PgDatabase,
-    dump: &DumpFile,
-) -> Result<bool> {
-    pg_import_dump(target, dump).await?;
-
-    // Held until the replay commits: a role renamed or dropped meanwhile would change what the
-    // replay names, and a settings save could move the source onto another database or put it under
-    // roles. Taken in the same order as the permissions save and the ACL apply.
-    // On a connection of its own: the checks below take theirs from the pool, and a lock holder
-    // drawn from the pool too could leave a small one with nothing to give them.
-    let database_url = windmill_common::get_database_url().await?;
-    let mut lock_holder =
-        <sqlx::PgConnection as sqlx::Connection>::connect_with(&database_url.connect_options().await?)
-            .await
-            .map_err(|e| Error::internal_err(format!("Failed to connect to the database: {e}")))?;
-    let mut tx = sqlx::Connection::begin(&mut lock_holder).await?;
-    lock_role_catalog(&mut tx).await?;
-    lock_settings_rows(&mut tx, parent_w_id, name).await?;
-
-    // Everything so far was decided before the locks.
-    let now = ensure_datatable_is_clonable(db, parent_w_id, name).await?;
-    ensure_reaches_governing_datatable(db, parent_w_id, name, &now, authed).await?;
-    if !same_database(&now.datatable.database, &governing.datatable.database) {
-        return Err(Error::BadRequest(format!(
-            "Data table '{name}' moved to another database while it was being copied; fork again"
-        )));
-    }
-
-    let replayed = now.datatable.permissions.is_some();
-    if replayed {
-        crate::datatable_replay_oss::ensure_replay()?;
-        let catalog = read_role_catalog_tx(&mut tx).await?;
-        // The replay leaves `CONNECT` to the catalog, and creating the database only tried to set
-        // it: a copy `PUBLIC` could still connect to would admit logins the source turns away.
-        windmill_common::datatable_roles::converge_connect_grants_with(
-            db,
-            &target.dbname,
-            &catalog,
-        )
-        .await?;
-        let catalog_roles: BTreeSet<String> = catalog.values().map(|r| r.name.clone()).collect();
-        let (source, _source_notices) = connect_with_notices(db, source).await?;
-        let (mut target, mut notices) = connect_with_notices(db, target).await?;
-        // One transaction on the copy: a replay that stops halfway leaves objects owned by one role
-        // and granted as another.
-        let pg_tx = target.transaction().await.map_err(|e| {
-            Error::internal_err(format!(
-                "Failed to open a transaction on the copy: {}",
-                pg_error_message(&e)
-            ))
-        })?;
-        crate::datatable_replay_oss::replay_owners_and_grants(
-            &source,
-            &pg_tx,
-            &mut notices,
-            &catalog_roles,
-        )
-        .await?;
-        pg_tx.commit().await.map_err(|e| {
-            Error::internal_err(format!(
-                "Failed to commit the replayed grants: {}",
-                pg_error_message(&e)
-            ))
-        })?;
-    }
-    tx.commit().await?;
-    Ok(replayed)
-}
-
-/// Lock every settings row the resolution of data table `name` of `start_w_id` passes through, in
-/// the order it passes them — each pointer, the entry that owns the database, and each workspace its
-/// roles come from — and return them. Deleting or repointing any of them would leave a copy made
-/// for the resolution answering for another one.
-pub(crate) async fn lock_settings_rows(
-    tx: &mut sqlx::Transaction<'_, sqlx::Postgres>,
-    start_w_id: &str,
-    name: &str,
-) -> Result<Vec<String>> {
-    let mut path: Vec<(String, String)> = vec![];
-    let (mut w_id, mut datatable) = (start_w_id.to_string(), name.to_string());
-    loop {
-        if path.contains(&(w_id.clone(), datatable.clone())) || path.len() > 32 {
-            return Err(Error::BadRequest(format!(
-                "Data table '{name}' of workspace '{start_w_id}' resolves through a cycle"
-            )));
-        }
-        let entry: Option<serde_json::Value> = sqlx::query_scalar(
-            "SELECT datatable->'datatables'->$2 FROM workspace_settings
-             WHERE workspace_id = $1 FOR UPDATE",
-        )
-        .bind(&w_id)
-        .bind(&datatable)
-        .fetch_optional(&mut **tx)
-        .await?
-        .flatten();
-        path.push((w_id.clone(), datatable.clone()));
-        let entry: Option<windmill_common::workspaces::DataTable> =
-            entry.and_then(|e| serde_json::from_value(e).ok());
-        match entry.and_then(|e| e.reference.or(e.governed_by)) {
-            Some(next) => (w_id, datatable) = (next.workspace_id, next.datatable),
-            None => break,
-        }
-    }
-    Ok(path.into_iter().map(|(w_id, _)| w_id).collect())
-}
-
-pub(crate) fn same_database(a: &Option<DataTableDatabase>, b: &Option<DataTableDatabase>) -> bool {
-    match (a, b) {
-        (Some(a), Some(b)) => {
-            a.resource_type == b.resource_type && a.resource_path == b.resource_path
-        }
-        _ => false,
-    }
-}
@@ -65,15 +65,3 @@ pub(crate) async fn ensure_reaches_datatable(
 ) -> Result<()> {
    roles::ensure_reaches_datatable(db, w_id, datatable_name, authed).await
 }
-
-/// [`ensure_reaches_datatable`] against an entry already resolved, for a caller that goes on to
-/// connect from that same entry.
-pub(crate) async fn ensure_reaches_governing_datatable(
-    db: &DB,
-    w_id: &str,
-    datatable_name: &str,
-    governing: &GoverningDatatable,
-    authed: &ApiAuthed,
-) -> Result<()> {
-    roles::ensure_reaches_governing_datatable(db, w_id, datatable_name, governing, authed).await
-}
@@ -12,8 +12,8 @@

 #[cfg(all(feature = "private", feature = "enterprise"))]
 pub(crate) use crate::datatable_permissions_ee::{
-    ensure_governs_datatable, ensure_reaches_datatable, ensure_reaches_governing_datatable,
-    get_datatable_permissions, list_usable_datatable_roles, set_datatable_permissions,
+    ensure_governs_datatable, ensure_reaches_datatable, get_datatable_permissions,
+    list_usable_datatable_roles, set_datatable_permissions,
 };

 #[cfg(not(all(feature = "private", feature = "enterprise")))]
@@ -56,20 +56,6 @@ mod ce {
        }
    }

-    pub(crate) async fn ensure_reaches_governing_datatable(
-        _db: &DB,
-        _w_id: &str,
-        _datatable_name: &str,
-        governing: &GoverningDatatable,
-        _authed: &ApiAuthed,
-    ) -> Result<()> {
-        if governing.datatable.permissions.is_none() {
-            Ok(())
-        } else {
-            Err(unavailable())
-        }
-    }
-
    // The routes stay registered so the API has one shape; each answers after authentication,
    // before anything is read.

@@ -1,48 +0,0 @@
-/*
- * Author: Ruben Fiszel
- * Copyright: Windmill Labs, Inc 2022
- * This file and its contents are licensed under the AGPLv3 License.
- * Please see the included NOTICE for copyright information and
- * LICENSE-AGPL for a copy of the license.
- */
-
-//! Where the replay of a data table's owners and grants into its copy comes from: the enterprise
-//! one, or a refusal. Without it a data table under roles is not copied at all: its rows would
-//! arrive owned by the admin connection with no grant for any role.
-
-#[cfg(all(feature = "private", feature = "enterprise"))]
-pub(crate) use crate::datatable_replay_ee::replay_owners_and_grants;
-
-#[cfg(all(feature = "private", feature = "enterprise"))]
-pub(crate) fn ensure_replay() -> windmill_common::error::Result<()> {
-    Ok(())
-}
-
-#[cfg(not(all(feature = "private", feature = "enterprise")))]
-use {
-    std::collections::BTreeSet,
-    tokio::sync::mpsc,
-    tokio_postgres::error::DbError,
-    windmill_common::error::{Error, Result},
-};
-
-/// Checked before anything is created.
-#[cfg(not(all(feature = "private", feature = "enterprise")))]
-pub(crate) fn ensure_replay() -> Result<()> {
-    Err(Error::BadRequest(
-        "Cloning a data table under roles is a Windmill Enterprise Edition feature: the copy \
-         needs the source's owners and grants replayed. Fork it keeping the original database \
-         instead."
-            .to_string(),
-    ))
-}
-
-#[cfg(not(all(feature = "private", feature = "enterprise")))]
-pub(crate) async fn replay_owners_and_grants(
-    _source: &tokio_postgres::Client,
-    _target: &tokio_postgres::Transaction<'_>,
-    _notices: &mut mpsc::UnboundedReceiver<DbError>,
-    _catalog_roles: &BTreeSet<String>,
-) -> Result<()> {
-    ensure_replay()
-}
@@ -1,13 +1,9 @@
 #[cfg(feature = "parquet")]
 pub mod ai_session_backups;
 pub mod data_metrics;
-pub mod datatable_acl;
-pub mod datatable_acl_oss;
-pub mod datatable_clone;
 pub mod datatable_migrations;
 pub mod datatable_permissions;
 pub mod datatable_permissions_oss;
-pub mod datatable_replay_oss;
 pub mod deployment_requests;
 pub mod workspaces;
 pub mod workspaces_extra;
@@ -16,10 +12,5 @@ pub mod workspaces_oss;
 #[cfg(feature = "private")]
 pub mod workspaces_ee;

-#[cfg(all(feature = "private", feature = "enterprise"))]
-pub mod datatable_acl_ee;
-#[cfg(all(feature = "private", feature = "enterprise"))]
-pub mod datatable_replay_ee;
-
 #[cfg(all(feature = "private", feature = "enterprise"))]
 pub mod datatable_permissions_ee;
@@ -113,7 +113,7 @@ pub(crate) async fn change_workspace_id(
    // Duplicate workspace settings (keep copy in old workspace for reference)
    info!("Duplicating workspace_settings table");
    sqlx::query!(
-        "INSERT INTO workspace_settings (workspace_id, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, git_credentials, ducklake, dbt_warehouses, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts, guest_access_enabled, guest_jwt_public_key, guest_jwt_jwks_url) SELECT $1, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, git_credentials, ducklake, dbt_warehouses, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts, guest_access_enabled, guest_jwt_public_key, guest_jwt_jwks_url FROM workspace_settings WHERE workspace_id = $2",
+        "INSERT INTO workspace_settings (workspace_id, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, git_credentials, ducklake, dbt_warehouses, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts, guest_access_enabled, guest_jwt_public_key, guest_jwt_jwks_url, add_admins_and_developers_to_forks) SELECT $1, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, git_credentials, ducklake, dbt_warehouses, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts, guest_access_enabled, guest_jwt_public_key, guest_jwt_jwks_url, add_admins_and_developers_to_forks FROM workspace_settings WHERE workspace_id = $2",
        &rw.new_id,
        &old_id
    )
@@ -495,25 +495,21 @@ pub(crate) async fn change_workspace_id(
    // A fork's data table entry names the workspace that governs it by id, so the rename has to
    // follow there too — anywhere, not just in the reparented children: a detached workspace can
    // point at this one without being its fork. Left behind, the pointer resolves to the archived
-    // shell and every job through it stops. A clone's `governed_by` names it the same way.
+    // shell and every job through it stops.
    info!("Re-pointing data table references to the new workspace id");
    sqlx::query!(
        r#"UPDATE workspace_settings ws
           SET datatable = (
               SELECT jsonb_set(ws.datatable, '{datatables}', jsonb_object_agg(
                   dt.key,
-                   (SELECT CASE WHEN r.v->'governed_by'->>'workspace_id' = $2
-                               THEN jsonb_set(r.v, '{governed_by,workspace_id}', to_jsonb($1::text))
-                               ELSE r.v END
-                    FROM (SELECT CASE WHEN dt.value->'reference'->>'workspace_id' = $2
-                                     THEN jsonb_set(dt.value, '{reference,workspace_id}', to_jsonb($1::text))
-                                     ELSE dt.value END AS v) r)
+                   CASE WHEN dt.value->'reference'->>'workspace_id' = $2
+                       THEN jsonb_set(dt.value, '{reference,workspace_id}', to_jsonb($1::text))
+                       ELSE dt.value END
               ))
               FROM jsonb_each(ws.datatable->'datatables') dt
           )
           WHERE jsonb_typeof(ws.datatable->'datatables') = 'object'
-             AND (ws.datatable::text LIKE '%"reference"%'
-                  OR ws.datatable::text LIKE '%"governed_by"%')"#,
+             AND ws.datatable::text LIKE '%"reference"%'"#,
        &rw.new_id,
        &old_id,
    )
@@ -1000,19 +996,17 @@ pub(crate) async fn delete_workspace(
    // fails mid-way must never leave a live workspace with its fork data destroyed and no
    // registry row to retry from. Read-only: nothing is dropped here.
    // Read before the delete: another workspace's data table entry can point at one of this
-    // workspace's, or be a clone taking its roles from one, and deleting the workspace it names
-    // leaves it resolving to nothing. Nothing sweeps them — turning them back into copies would
-    // hand each fork the database outright — so the deleter is told which data tables they just
-    // stranded.
-    let stranded_pointers = sqlx::query_as::<_, (String, String)>(
-        r#"SELECT ws.workspace_id, dt.key
+    // workspace's, and deleting the workspace it names leaves that pointer resolving to nothing.
+    // Nothing sweeps them — turning them back into copies would hand each fork the database
+    // outright — so the deleter is told which data tables they just stranded.
+    let stranded_pointers = sqlx::query!(
+        r#"SELECT ws.workspace_id AS "workspace_id!", dt.key AS "datatable!"
           FROM workspace_settings ws
           CROSS JOIN LATERAL jsonb_each(COALESCE(ws.datatable->'datatables', '{}'::jsonb)) dt
           WHERE dt.value->'reference'->>'workspace_id' = $1
-              OR dt.value->'governed_by'->>'workspace_id' = $1
           ORDER BY ws.workspace_id, dt.key"#,
+        &w_id,
    )
-    .bind(&w_id)
    .fetch_all(&db)
    .await
    .unwrap_or_default();
@@ -1340,7 +1334,7 @@ pub(crate) async fn delete_workspace(
    } else {
        let stranded = stranded_pointers
            .iter()
-            .map(|(workspace_id, datatable)| format!("{workspace_id}/{datatable}"))
+            .map(|r| format!("{}/{}", r.workspace_id, r.datatable))
            .collect::<Vec<_>>()
            .join(", ");
        Ok(format!(
@@ -1,7 +1,7 @@
 openapi: "3.0.3"

 info:
-  version: 1.814.0
+  version: 1.815.0
  title: Windmill API

  contact:
@@ -529,6 +529,30 @@ paths:
      responses:
        "302":
          description: redirected to the post-login destination, or to /user/login_link_expired when the link is used, expired or unknown
+    post:
+      security: []
+      summary: consume a single-use login link from its confirmation page, set the session cookie and answer where to go
+      operationId: confirmLoginLink
+      tags:
+        - user
+      parameters:
+        - name: token
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: the post-login destination, or /user/login_link_expired when the link is used, expired or unknown
+          content:
+            application/json:
+              schema:
+                type: object
+                required:
+                  - location
+                properties:
+                  location:
+                    type: string

  /auth/reset_password:
    post:
@@ -4066,9 +4090,13 @@ paths:
                  guest_access_enabled:
                    type: boolean
                    description: Whether this workspace admits guest sessions. An app's own `guest` execution mode is inert while this is false.
+                  add_admins_and_developers_to_forks:
+                    type: boolean
+                    description: Whether every new fork of this workspace starts with its admins and developers as members, keeping their role.
                required:
                  - workspace_id
                  - guest_access_enabled
+                  - add_admins_and_developers_to_forks

  /w/{workspace}/workspaces/get_settings:
    get:
@@ -4159,6 +4187,9 @@ paths:
                  guest_jwt_jwks_url:
                    type: string
                    description: JWKS URL a guest JWT (`jwt_guest_`) is verified against for this workspace. Mutually exclusive with `guest_jwt_public_key`.
+                  add_admins_and_developers_to_forks:
+                    type: boolean
+                    description: Whether every new fork of this workspace starts with its admins and developers as members, keeping their role.

  /w/{workspace}/workspaces/get_deploy_to:
    get:
@@ -5294,97 +5325,6 @@ paths:
              schema:
                type: string

-  /w/{workspace}/workspaces/datatable_acl/{datatable_name}:
-    get:
-      summary: read the owner and grants of an instance data table's database, schema or table
-      operationId: getDatatableAcl
-      tags:
-        - workspace
-      parameters:
-        - $ref: "#/components/parameters/WorkspaceId"
-        - name: datatable_name
-          in: path
-          required: true
-          schema:
-            type: string
-        - name: kind
-          in: query
-          required: true
-          schema:
-            type: string
-            enum: [database, schema, table]
-        - name: schema
-          in: query
-          required: false
-          schema:
-            type: string
-        - name: table
-          in: query
-          required: false
-          schema:
-            type: string
-      responses:
-        "200":
-          description: owner and grants
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/DatatableAclInfo"
-
-  /w/{workspace}/workspaces/datatable_acl/{datatable_name}/plan:
-    post:
-      summary: preview the SQL an ownership or grant change would run (data table administrators only)
-      operationId: planDatatableAcl
-      tags:
-        - workspace
-      parameters:
-        - $ref: "#/components/parameters/WorkspaceId"
-        - name: datatable_name
-          in: path
-          required: true
-          schema:
-            type: string
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              $ref: "#/components/schemas/AclChangeRequest"
-      responses:
-        "200":
-          description: statements that would run, in a single transaction
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/AclPlan"
-
-  /w/{workspace}/workspaces/datatable_acl/{datatable_name}/apply:
-    post:
-      summary: run an ownership or grant change exactly as planned (data table administrators only)
-      operationId: applyDatatableAcl
-      tags:
-        - workspace
-      parameters:
-        - $ref: "#/components/parameters/WorkspaceId"
-        - name: datatable_name
-          in: path
-          required: true
-          schema:
-            type: string
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              $ref: "#/components/schemas/AclChangeRequest"
-      responses:
-        "200":
-          description: change applied
-          content:
-            text/plain:
-              schema:
-                type: string
-
  /w/{workspace}/workspaces/datatable_usable_roles/{datatable_name}:
    get:
      summary: list the data table roles the caller may connect as
@@ -6380,6 +6320,39 @@ paths:
              schema:
                type: string

+  /w/{workspace}/workspaces/edit_add_admins_and_developers_to_forks:
+    post:
+      summary: choose whether new forks of this workspace start with its admins and developers
+      description: >-
+        When on, every fork created from this workspace gets the workspace's admins and
+        developers as members, with the role they hold here; operators, disabled users and
+        service accounts are left out. The setting is copied into each fork, so forks of a
+        fork follow it too. Off by default. Workspace-admin gated.
+      operationId: editAddAdminsAndDevelopersToForks
+      tags:
+        - workspace
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+      requestBody:
+        description: Whether new forks start with this workspace's admins and developers
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                add_admins_and_developers_to_forks:
+                  type: boolean
+              required:
+                - add_admins_and_developers_to_forks
+      responses:
+        "200":
+          description: status
+          content:
+            text/plain:
+              schema:
+                type: string
+
  /w/{workspace}/workspaces/edit_guest_jwt_key:
    post:
      summary: set the key guest JWTs are verified against for this workspace
@@ -6844,7 +6817,7 @@ paths:
                  type: string
                expires_in_s:
                  type: integer
-                  description: link lifetime in seconds, at most 900 (default 600)
+                  description: link lifetime in seconds, at most 7200 (default 600)
                rd:
                  type: string
                  description: same-origin path the browser lands on after login (default /user/workspaces)
@@ -6854,6 +6827,12 @@ paths:
                    mint only while the account still has this login type (for example
                    pending_oauth), so a link stops working once the owner has set a password
                    or signed in with a provider
+                confirm:
+                  type: boolean
+                  description: >-
+                    return a /user/login_link page that signs in only when its button is
+                    clicked, instead of a link spent by opening it; set it for links sent by
+                    email, which mail scanners open on delivery (default false)
      responses:
        "201":
          description: login link minted
@@ -33723,15 +33702,6 @@ components:
            $ref: "#/components/schemas/DatatableRoleTenants"
        governing_workspace_id:
          type: string
-        clone_of:
-          type: object
-          description: for a clone, the data table whose roles it takes
-          required: [workspace_id, datatable]
-          properties:
-            workspace_id:
-              type: string
-            datatable:
-              type: string
        editable:
          type: boolean
        available_roles:
@@ -33749,258 +33719,6 @@ components:
              datatable:
                type: string

-    AclTarget:
-      description: what access is read or changed on
-      oneOf:
-        - $ref: "#/components/schemas/AclTargetDatabase"
-        - $ref: "#/components/schemas/AclTargetSchema"
-        - $ref: "#/components/schemas/AclTargetTable"
-      discriminator:
-        propertyName: kind
-        mapping:
-          database: "#/components/schemas/AclTargetDatabase"
-          schema: "#/components/schemas/AclTargetSchema"
-          table: "#/components/schemas/AclTargetTable"
-
-    AclTargetDatabase:
-      type: object
-      required: [kind]
-      properties:
-        kind:
-          type: string
-          enum: [database]
-
-    AclTargetSchema:
-      type: object
-      required: [kind, schema]
-      properties:
-        kind:
-          type: string
-          enum: [schema]
-        schema:
-          type: string
-
-    AclTargetTable:
-      type: object
-      required: [kind, schema, table]
-      properties:
-        kind:
-          type: string
-          enum: [table]
-        schema:
-          type: string
-        table:
-          type: string
-
-    AclChange:
-      description: one change to plan or apply
-      oneOf:
-        - $ref: "#/components/schemas/AclChangeSetOwner"
-        - $ref: "#/components/schemas/AclChangeGrant"
-        - $ref: "#/components/schemas/AclChangeRevoke"
-      discriminator:
-        propertyName: type
-        mapping:
-          set_owner: "#/components/schemas/AclChangeSetOwner"
-          grant: "#/components/schemas/AclChangeGrant"
-          revoke: "#/components/schemas/AclChangeRevoke"
-
-    AclChangeSetOwner:
-      type: object
-      description: >-
-        hands the target to role — for a schema, with everything already in it but an extension's
-        members, which stay with the extension
-      required: [type, role]
-      properties:
-        type:
-          type: string
-          enum: [set_owner]
-        role:
-          type: string
-          description: a data table role of the instance, or admin
-
-    AclChangeGrant:
-      type: object
-      required: [type, role, privileges, scope]
-      properties:
-        type:
-          type: string
-          enum: [grant]
-        role:
-          type: string
-          description: a data table role of the instance, or admin
-        privileges:
-          type: array
-          items:
-            type: string
-        scope:
-          $ref: "#/components/schemas/AclGrantScope"
-
-    AclChangeRevoke:
-      type: object
-      required: [type, role, privileges, scope]
-      properties:
-        type:
-          type: string
-          enum: [revoke]
-        role:
-          type: string
-          description: a data table role of the instance, other than admin
-        privileges:
-          type: array
-          items:
-            type: string
-        scope:
-          $ref: "#/components/schemas/AclGrantScope"
-        objects:
-          type: array
-          description: >-
-            objects inside the target the revoke covers, empty for the target itself. Only with the
-            target scope; a revoke on all objects of a kind is refused, since it cannot say which
-            grants it takes back.
-          items:
-            $ref: "#/components/schemas/AclObject"
-
-    AclGrantScope:
-      type: string
-      enum:
-        [
-          target,
-          all_tables,
-          all_sequences,
-          all_functions,
-          future_tables,
-          future_sequences,
-          future_functions,
-        ]
-
-    AclChangeRequest:
-      type: object
-      required: [target, change]
-      properties:
-        target:
-          $ref: "#/components/schemas/AclTarget"
-        change:
-          $ref: "#/components/schemas/AclChange"
-        statements:
-          type: array
-          description: >-
-            The statements the plan showed. Required to apply, which plans again and refuses if
-            the result differs.
-          items:
-            type: string
-
-    AclPlan:
-      type: object
-      required: [statements, warnings]
-      properties:
-        statements:
-          type: array
-          items:
-            type: string
-        warnings:
-          type: array
-          items:
-            type: string
-
-    AclObject:
-      type: object
-      required: [name, kind]
-      properties:
-        name:
-          type: string
-        kind:
-          type: string
-          description: >-
-            TABLE, SEQUENCE, FUNCTION, PROCEDURE or TYPE — what the object is. A revoke turns it
-            into the keyword it takes, ROUTINE for both routine kinds; a type's grants are read
-            only.
-        args:
-          type: string
-          description: identity arguments of a routine, which is what tells two of the same name apart
-
-    AclGrant:
-      type: object
-      required: [grantee, privileges, sources]
-      properties:
-        grantee:
-          type: string
-        privileges:
-          type: array
-          items:
-            type: string
-        object:
-          $ref: "#/components/schemas/AclObject"
-        future:
-          type: string
-          description: >-
-            set for a default privilege, naming the kind of object it covers (TABLES, SEQUENCES,
-            FUNCTIONS, TYPES, or SCHEMAS). On a schema, the defaults set in that schema; on the
-            database, the ones set database-wide, which apply in every schema and which no schema's
-            own defaults take back.
-        sources:
-          type: array
-          description: >-
-            the roles the grant comes from, each once — who granted it, or for a default privilege
-            the role whose future objects it covers. A revoke of some of the grant's privileges
-            takes them back from every source that gave them.
-          items:
-            $ref: "#/components/schemas/AclSource"
-
-    AclSource:
-      type: object
-      required: [role, privileges, reachable]
-      properties:
-        role:
-          type: string
-        privileges:
-          type: array
-          description: >-
-            what role gave of the grant's privileges. A revoke is held back only by a source out of
-            reach that gave some of what it takes back.
-          items:
-            type: string
-        reachable:
-          type: boolean
-          description: >-
-            whether the data table's connection can take back what role gave. On an object that is
-            the owner, when the connection acts for the owner, and otherwise the connection itself;
-            for a default privilege, a creating role the connection acts for. What a source out of
-            reach gave is not revocable from here; privileges only other sources gave still are.
-
-    DatatableAclInfo:
-      type: object
-      required: [owner, roles, editable, clone, supports_maintain, dbname, grants, children]
-      properties:
-        owner:
-          type: string
-        roles:
-          type: array
-          description: the roles a change may name; empty unless the caller may change anything
-          items:
-            type: string
-        editable:
-          type: boolean
-          description: whether the caller may plan and apply changes
-        clone:
-          type: boolean
-          description: whether this is a clone, whose grants stay as they were copied
-        supports_maintain:
-          type: boolean
-          description: whether the server is Postgres 17+, which added the MAINTAIN table privilege
-        dbname:
-          type: string
-          description: the database the target lives in
-        grants:
-          type: array
-          items:
-            $ref: "#/components/schemas/AclGrant"
-        children:
-          type: array
-          description: a database's schemas, or a schema's tables
-          items:
-            type: string
-
    CustomInstanceDb:
      type: object
      required:
@@ -35083,6 +34801,9 @@ components:
                nullable: true
              disabled:
                type: boolean
+              is_service_account:
+                type: boolean
+                description: Whether this membership is a service account.
            required:
              - id
              - name
@@ -35134,16 +34855,6 @@ components:
              new_dbname:
                type: string
                description: "New database name for the fork"
-              fork_behavior:
-                type: string
-                enum:
-                  - schema_only
-                  - schema_and_data
-                description: >-
-                  What the fork request copies into `new_dbname`, which it creates — with the
-                  owners and grants of a data table under roles. This server refuses an entry
-                  without it; servers predating it expect `new_dbname` created and filled
-                  beforehand.
        shared_ducklakes:
          type: array
          items:
@@ -36086,17 +35797,6 @@ components:
                    type: string
                  datatable:
                    type: string
-              governed_by:
-                description: >-
-                  On a clone, the data table it was copied from, whose roles it takes. Server-owned
-                  like `reference`.
-                type: object
-                required: [workspace_id, datatable]
-                properties:
-                  workspace_id:
-                    type: string
-                  datatable:
-                    type: string
              migrations_enabled:
                type: boolean
                description: Whether the SQL migrations feature is opted in for this data table
@@ -560,7 +560,7 @@ pub async fn run_server(
        if server_mode || mcp_mode {
            use mcp::{
                add_www_authenticate_header, add_www_authenticate_header_gateway,
-                extract_workspace_from_token,
+                extract_workspace_from_token, reject_token_query_param,
            };
            let (mcp_router, mcp_cancellation_token) = setup_mcp_server(
                db.clone(),
@@ -573,15 +573,17 @@ pub async fn run_server(
            let workspaced_mcp_router = mcp_router
                .clone()
                .route_layer(from_extractor::<ApiAuthed>())
+                .layer(axum::middleware::from_fn(reject_token_query_param))
                .layer(axum::middleware::from_fn(add_www_authenticate_header))
                .layer(axum::middleware::from_fn(extract_and_store_workspace_id));
            // Gateway MCP router — resolves workspace from token
            let gateway_mcp_router = mcp_router
                .route_layer(from_extractor::<ApiAuthed>())
+                .layer(axum::middleware::from_fn(extract_workspace_from_token))
+                .layer(axum::middleware::from_fn(reject_token_query_param))
                .layer(axum::middleware::from_fn(
                    add_www_authenticate_header_gateway,
-                ))
-                .layer(axum::middleware::from_fn(extract_workspace_from_token));
+                ));
            (
                workspaced_mcp_router,
                gateway_mcp_router,
@@ -43,11 +43,14 @@ use axum::{
    extract::{Extension, Path},
    http::Request,
    middleware::Next,
-    response::Response,
+    response::{IntoResponse, Response},
    routing::get,
    Json, Router,
 };
-use windmill_common::{auth::hash_token, db::GatewayWorkspaceId, error::JsonResult};
+use windmill_common::{
+    auth::hash_token, db::GatewayWorkspaceId, error::JsonResult,
+    global_settings::MCP_DISABLE_TOKEN_QUERY_PARAM,
+};

 // McpAuth impl for ApiAuthed is in windmill-api-auth (same crate as the type)

@@ -446,6 +449,29 @@ pub async fn add_www_authenticate_header(
    }
 }

+/// Middleware refusing a credential carried in the MCP URL once the instance sets
+/// `mcp_disable_token_query_param`. Sits outside everything that reads the token, so neither
+/// the gateway lookup nor `ApiAuthed` ever sees it, and inside the `WWW-Authenticate` layer,
+/// whose header is what sends the client into the OAuth flow instead. Refused rather than
+/// ignored: the URL leaked the token whether or not the request used it.
+pub async fn reject_token_query_param(request: Request<axum::body::Body>, next: Next) -> Response {
+    let carries_token = MCP_DISABLE_TOKEN_QUERY_PARAM.load(std::sync::atomic::Ordering::Relaxed)
+        && request
+            .uri()
+            .query()
+            .is_some_and(|q| url::form_urlencoded::parse(q.as_bytes()).any(|(k, _)| k == "token"));
+    if carries_token {
+        return (
+            axum::http::StatusCode::UNAUTHORIZED,
+            "This instance does not accept a token in the MCP URL. Remove the token query \
+             parameter and let your client sign in through OAuth, or send the token in an \
+             Authorization header.",
+        )
+            .into_response();
+    }
+    next.run(request).await
+}
+
 /// Extract the bearer token from either the `Authorization` header or the
 /// `?token=` query parameter (MCP clients commonly pass it in the URL).
 fn extract_gateway_token(request: &Request<axum::body::Body>) -> Option<String> {
@@ -12,5 +12,5 @@ pub mod oauth_server;
 pub use core::{
    add_www_authenticate_header, add_www_authenticate_header_gateway,
    extract_and_store_workspace_id, extract_workspace_from_token, list_tools_service,
-    setup_mcp_server,
+    reject_token_query_param, setup_mcp_server,
 };
@@ -20,7 +20,7 @@ use crate::{

 /// Whether `label` denotes a user-created token rather than a system token
 /// (`session`, `guest_session`, `ephemeral*`, `debugger-token`, `mcp-oauth-*`,
-/// `embed_app:*`, `sdk_app:*`, `impersonation:*`). System-token labels are load-bearing —
+/// `embed_app:*`, `sdk_app:*`, `impersonation:*`, `cli-login:*`). System-token labels are load-bearing —
 /// session cleanup, super_admin propagation, expiry notifications and username overrides
 /// all key off them — so they must not be user-editable. `None` (no label) is treated as
 /// a user token.
@@ -47,10 +47,17 @@ pub fn is_user_token(label: Option<&str>) -> bool {
                && !l.starts_with(APP_EMBED_TOKEN_LABEL_PREFIX)
                && !l.starts_with(RAW_APP_SDK_TOKEN_LABEL_PREFIX)
                && !l.starts_with("impersonation:")
+                && !l.starts_with(CLI_LOGIN_TOKEN_LABEL_PREFIX)
        }
    }
 }

+/// How far ahead of a user token's expiration its owner is warned (`check_expiring_tokens` in
+/// the monitor). A token whose whole lifetime fits in this window gets no warning at all: it
+/// would arrive minutes after creation, about a lifetime its creator just picked. Its
+/// "expired and deleted" notice still goes out.
+pub const TOKEN_EXPIRY_WARNING_DAYS: i32 = 7;
+
 /// Label prefix, followed by the app path, of the token an app viewer's sandboxed iframe
 /// runs with. Reserved in [`is_user_token`], whose SQL and frontend mirrors spell it out.
 pub const APP_EMBED_TOKEN_LABEL_PREFIX: &str = "embed_app:";
@@ -59,6 +66,13 @@ pub const APP_EMBED_TOKEN_LABEL_PREFIX: &str = "embed_app:";
 /// frontend SDK. Reserved in [`is_user_token`], whose SQL and frontend mirrors spell it out.
 pub const RAW_APP_SDK_TOKEN_LABEL_PREFIX: &str = "sdk_app:";

+/// Label prefix, followed by the username, of the token the CLI authorization page mints for
+/// `wmill` logins. Reserved in [`is_user_token`], whose SQL and frontend mirrors spell it out:
+/// the CLI signs in again on its own once that token expires, so an expiry email for it asks
+/// the user to do nothing. Not in [`is_server_minted_label`], since the page mints it through
+/// `/users/tokens/create`.
+pub const CLI_LOGIN_TOKEN_LABEL_PREFIX: &str = "cli-login:";
+
 /// Whether `label` belongs to a namespace only the server mints, and which therefore must be
 /// rejected by `create_token`. Narrower than [`is_user_token`], which also drives label
 /// editability and expiry notifications and can afford to reserve more: `Ephemeral lsp token`,
@@ -475,14 +489,16 @@ async fn fetch_authed_from_permissioned_as_inner(
    // principal — a username freed and reassigned while its previous holder keeps a privileged
    // account — would mix one account's role with another's instance privileges.
    let member = match permissioned_as.split_once('/') {
-        Some(("u", name)) => sqlx::query!(
-            "SELECT is_admin, operator, email FROM usr where username = $1 AND \
+        Some(("u", name)) => {
+            sqlx::query!(
+                "SELECT is_admin, operator, email FROM usr where username = $1 AND \
                                         workspace_id = $2 AND disabled = false",
-            name,
-            &w_id
-        )
-        .fetch_optional(&mut *conn)
-        .await?,
+                name,
+                &w_id
+            )
+            .fetch_optional(&mut *conn)
+            .await?
+        }
        _ => None,
    };
    let resolved_email;
@@ -980,6 +996,7 @@ mod tests {
        assert!(!is_user_token(Some("embed_app:f/team/dashboard")));
        assert!(!is_user_token(Some("sdk_app:u/admin/raw app")));
        assert!(!is_user_token(Some("impersonation:admin@windmill.dev")));
+        assert!(!is_user_token(Some("cli-login:admin")));
    }

    #[test]
@@ -102,6 +102,49 @@ pub const HUB_API_SECRET_SETTING: &str = "hub_api_secret";
 pub const AUTOMATE_USERNAME_CREATION_SETTING: &str = "automate_username_creation";
 pub const DISABLE_WORKSPACE_INVITE_EMAILS_SETTING: &str = "disable_workspace_invite_emails";
 pub const DISABLE_PASSWORD_LOGIN_SETTING: &str = "disable_password_login";
+/// Refuse `?token=` on the MCP endpoints, leaving the `Authorization` header as the only way
+/// in. A URL-borne credential ends up in browser history, proxy logs and referrers, so an
+/// instance that cares sends MCP clients through the OAuth flow instead.
+pub const MCP_DISABLE_TOKEN_QUERY_PARAM_SETTING: &str = "mcp_disable_token_query_param";
+/// Ceiling, in days, on how far ahead a token minted through `POST /users/tokens/create` or
+/// `POST /users/tokens/impersonate` may expire; a request asking for more, or for no
+/// expiration at all, is shortened to it rather than refused. On those routes only: server-side
+/// mints (webhook tokens, app embed tokens, sessions) choose a lifetime the caller never picks
+/// and go straight to `create_token_internal`. Read and validated by
+/// [`parse_max_token_expiration_days`].
+pub const MAX_TOKEN_EXPIRATION_DAYS_SETTING: &str = "max_token_expiration_days";
+/// Largest `max_token_expiration_days` read as a ceiling, about 2,700 years. The token form
+/// applies the same bound (`frontend/src/lib/tokenExpiration.ts`) so that it and the server
+/// agree on whether a ceiling exists.
+pub const MAX_TOKEN_EXPIRATION_DAYS_BOUND: i64 = 1_000_000;
+
+/// Reads a stored `max_token_expiration_days`: `Ok(None)` when unset or cleared (null or an
+/// empty string), the ceiling for a whole number of days within
+/// `1..=MAX_TOKEN_EXPIRATION_DAYS_BOUND` stored as an integer, an integral float or a string of
+/// digits, and an error for anything else.
+///
+/// The settings API and config sync both reject the error at write time: the token routes can
+/// only read an unparseable value as no ceiling, so accepting a typo would silently turn the
+/// policy off. `parseMaxTokenExpirationDays` in the frontend must accept exactly the same values.
+pub fn parse_max_token_expiration_days(
+    value: Option<&serde_json::Value>,
+) -> Result<Option<i64>, String> {
+    let days = match value {
+        None | Some(serde_json::Value::Null) => return Ok(None),
+        Some(serde_json::Value::String(s)) if s.trim().is_empty() => return Ok(None),
+        Some(serde_json::Value::Number(n)) => n
+            .as_i64()
+            .or_else(|| n.as_f64().filter(|f| f.fract() == 0.0).map(|f| f as i64)),
+        Some(serde_json::Value::String(s)) => s.trim().parse::<i64>().ok(),
+        Some(_) => None,
+    };
+    match days {
+        Some(days) if (1..=MAX_TOKEN_EXPIRATION_DAYS_BOUND).contains(&days) => Ok(Some(days)),
+        _ => Err(format!(
+            "must be a whole number of days from 1 to {MAX_TOKEN_EXPIRATION_DAYS_BOUND}, or empty for no limit"
+        )),
+    }
+}
 pub const AUTO_LOGIN_PROVIDER_SETTING: &str = "auto_login_provider";
 /// Name of the SAML attribute or OIDC userinfo claim carrying the user's IdP groups. Unset or
 /// empty leaves instance-group membership entirely to SCIM.
@@ -368,6 +411,7 @@ use std::sync::atomic::AtomicBool;
 lazy_static::lazy_static! {
    pub static ref HTTP_ROUTE_WORKSPACED_ROUTE: AtomicBool = AtomicBool::new(false);
    pub static ref DISABLE_PASSWORD_LOGIN: AtomicBool = AtomicBool::new(false);
+    pub static ref MCP_DISABLE_TOKEN_QUERY_PARAM: AtomicBool = AtomicBool::new(false);
    /// Origins HTTP routes allow cross-origin when they configure none of their
    /// own. Empty means unset, which keeps the historical `*`.
    pub static ref HTTP_ROUTE_DEFAULT_ALLOWED_ORIGINS: arc_swap::ArcSwap<Vec<String>> =
@@ -811,6 +855,55 @@ pub fn workspace_integration_auth_endpoint(client_name: &str, base_url: &str) ->
 mod tests {
    use super::*;

+    // `frontend/src/lib/tokenExpiration.test.ts` holds the same table for the token form's
+    // parser; the two must stay in step.
+    #[test]
+    fn max_token_expiration_days_accepts_only_whole_days_within_the_bound() {
+        use serde_json::json;
+        for (stored, days) in [
+            (json!(7), 7),
+            (json!(7.0), 7),
+            (json!("7"), 7),
+            (json!(" 30 "), 30),
+            (json!("+7"), 7),
+            (
+                json!(MAX_TOKEN_EXPIRATION_DAYS_BOUND),
+                MAX_TOKEN_EXPIRATION_DAYS_BOUND,
+            ),
+        ] {
+            assert_eq!(
+                parse_max_token_expiration_days(Some(&stored)),
+                Ok(Some(days)),
+                "{stored}"
+            );
+        }
+        for cleared in [json!(null), json!(""), json!("  ")] {
+            assert_eq!(
+                parse_max_token_expiration_days(Some(&cleared)),
+                Ok(None),
+                "{cleared}"
+            );
+        }
+        assert_eq!(parse_max_token_expiration_days(None), Ok(None));
+        for bad in [
+            json!(7.5),
+            json!(0),
+            json!(-3),
+            json!("7.0"),
+            json!("1e1"),
+            json!("0x7"),
+            json!(MAX_TOKEN_EXPIRATION_DAYS_BOUND + 1),
+            json!("99999999999999999999"),
+            json!(true),
+            json!([7]),
+        ] {
+            assert!(
+                parse_max_token_expiration_days(Some(&bad)).is_err(),
+                "{bad} must be rejected"
+            );
+        }
+    }
+
    #[test]
    fn webhook_base_url_errors_never_echo_credentials() {
        // These strings reach sync-config output and operator logs, so no branch may
@@ -1358,6 +1358,10 @@ pub async fn sync_global_settings_declarative(
    crate::global_settings::parse_allowed_origins_setting(desired.get(origins_key))
        .map_err(|e| anyhow::anyhow!("{origins_key}: {e}"))?;

+    let max_expiration_key = crate::global_settings::MAX_TOKEN_EXPIRATION_DAYS_SETTING;
+    crate::global_settings::parse_max_token_expiration_days(desired.get(max_expiration_key))
+        .map_err(|e| anyhow::anyhow!("{max_expiration_key}: {e}"))?;
+
    let diff = diff_global_settings(current, desired, ApplyMode::Replace);
    apply_settings_diff(db, &diff).await?;

@@ -1024,20 +1024,6 @@ impl Future for TokioPgConnection {
    }
 }

-impl TokioPgConnection {
-    /// Drive the connection and hand back what the server sends outside of a query's response —
-    /// notices above all, which driving it as a future silently discards.
-    pub fn poll_message(
-        &mut self,
-        cx: &mut core::task::Context<'_>,
-    ) -> core::task::Poll<Option<Result<tokio_postgres::AsyncMessage, tokio_postgres::Error>>> {
-        match self {
-            TokioPgConnection::Tls(conn) => conn.poll_message(cx),
-            TokioPgConnection::NoTls(conn) => conn.poll_message(cx),
-        }
-    }
-}
-
 impl PgDatabase {
    /// The role the connection logs in as, whichever way it authenticates.
    pub fn login_name(&self) -> &str {
@@ -1474,98 +1460,8 @@ pub fn validate_dbname(dbname: &str) -> error::Result<()> {
    Ok(())
 }

-/// Lock the instance databases among `names` until `tx` ends, in a stable order. Taken by every
-/// settings save naming an instance database, and by [`drop_unused_instance_database`]: a save
-/// cannot start using a database between that drop's check that nothing does and the drop.
-pub async fn lock_instance_databases<'a>(
-    tx: &mut sqlx::Transaction<'_, sqlx::Postgres>,
-    names: impl IntoIterator<Item = &'a str>,
-) -> error::Result<()> {
-    let names: std::collections::BTreeSet<&str> = names.into_iter().collect();
-    for name in names {
-        sqlx::query("SELECT pg_advisory_xact_lock(hashtext('instance_database:' || $1))")
-            .bind(name)
-            .execute(&mut **tx)
-            .await?;
-    }
-    Ok(())
-}
-
-/// Drop instance database `dbname`, which a request just created, unless a workspace names it as a
-/// data table or a ducklake catalog — the workspaces returned, with nothing dropped. A database is
-/// registered on the instance as soon as it is created, so a superadmin can point a workspace at it
-/// before the request that created it gives up on it.
-///
-/// Authorization: none. Callers MUST pass only a database the same request created and has not
-/// handed to anything yet.
-///
-/// The lock, the check and the drop share one connection: a second one taken from the pool while
-/// the first is held could wait forever on a small pool.
-pub async fn drop_unused_instance_database(db: &DB, dbname: &str) -> error::Result<Vec<String>> {
-    let mut conn = db.acquire().await?;
-    let key = format!("instance_database:{dbname}");
-    sqlx::query("SELECT pg_advisory_lock(hashtext($1))")
-        .bind(&key)
-        .execute(&mut *conn)
-        .await?;
-    let dropped = drop_if_unused_on(&mut conn, dbname).await;
-    let unlocked = sqlx::query("SELECT pg_advisory_unlock(hashtext($1))")
-        .bind(&key)
-        .execute(&mut *conn)
-        .await;
-    if unlocked.is_err() {
-        // Closing the connection is what releases a session lock it could not release itself.
-        drop(conn.detach());
-    }
-    dropped
-}
-
-async fn drop_if_unused_on(
-    conn: &mut sqlx::PgConnection,
-    dbname: &str,
-) -> error::Result<Vec<String>> {
-    let users = instance_database_users(conn, dbname).await?;
-    if users.is_empty() {
-        drop_custom_instance_database_on(conn, dbname).await?;
-    }
-    Ok(users)
-}
-
-/// The workspaces naming instance database `dbname` as a data table or a ducklake catalog. Taken
-/// under [`lock_instance_databases`] for `dbname`, the answer holds until that lock is released.
-///
-/// Authorization: none, and it reads every workspace's settings. Callers MUST pass only a database
-/// their own request created, and may name the workspaces returned only to a caller allowed to
-/// create or drop instance databases.
-pub async fn instance_database_users(
-    conn: &mut sqlx::PgConnection,
-    dbname: &str,
-) -> error::Result<Vec<String>> {
-    Ok(sqlx::query_scalar(
-        "SELECT DISTINCT ws.workspace_id FROM workspace_settings ws
-         WHERE EXISTS (SELECT 1 FROM jsonb_each(CASE WHEN jsonb_typeof(ws.datatable->'datatables') = 'object'
-                                                THEN ws.datatable->'datatables' ELSE '{}'::jsonb END) dt
-                       WHERE dt.value->'database'->>'resource_type' = 'instance'
-                         AND dt.value->'database'->>'resource_path' = $1)
-            OR EXISTS (SELECT 1 FROM jsonb_each(CASE WHEN jsonb_typeof(ws.ducklake->'ducklakes') = 'object'
-                                                THEN ws.ducklake->'ducklakes' ELSE '{}'::jsonb END) dl
-                       WHERE dl.value->'catalog'->>'resource_type' = 'instance'
-                         AND dl.value->'catalog'->>'resource_path' = $1)",
-    )
-    .bind(dbname)
-    .fetch_all(conn)
-    .await?)
-}
-
 /// Drop a custom instance database: validate, terminate connections, DROP DATABASE, remove from global_settings.
 pub async fn drop_custom_instance_database(db: &DB, dbname: &str) -> error::Result<()> {
-    drop_custom_instance_database_on(&mut *db.acquire().await?, dbname).await
-}
-
-async fn drop_custom_instance_database_on(
-    conn: &mut sqlx::PgConnection,
-    dbname: &str,
-) -> error::Result<()> {
    let dbname = dbname.trim();
    validate_dbname(dbname)?;

@@ -1580,7 +1476,7 @@ async fn drop_custom_instance_database_on(
        "SELECT EXISTS (SELECT 1 FROM pg_catalog.pg_database WHERE datname = $1)",
        dbname
    )
-    .fetch_one(&mut *conn)
+    .fetch_one(db)
    .await?
    .unwrap_or(false);

@@ -1591,7 +1487,7 @@ async fn drop_custom_instance_database_on(
            "SELECT pg_terminate_backend(pid) FROM pg_stat_activity WHERE datname = '{}' AND pid <> pg_backend_pid()",
            dbname.replace('\'', "''")
        ))
-        .execute(&mut *conn)
+        .execute(db)
        .await
        {
            tracing::warn!("Failed to terminate connections to '{}': {}", dbname, e);
@@ -1600,7 +1496,7 @@ async fn drop_custom_instance_database_on(
        // Drop the database
        // SAFETY: `dbname` has been validated via validate_dbname() before reaching this point.
        sqlx::query(&format!("DROP DATABASE IF EXISTS \"{}\"", dbname))
-            .execute(&mut *conn)
+            .execute(db)
            .await
            .map_err(|e| {
                error::Error::internal_err(format!("Failed to drop database '{}': {}", dbname, e))
@@ -1616,7 +1512,7 @@ async fn drop_custom_instance_database_on(
        r#"UPDATE global_settings SET value = value #- ARRAY['databases', $1] WHERE name = 'custom_instance_pg_databases'"#,
        dbname
    )
-    .execute(&mut *conn)
+    .execute(db)
    .await?;

    Ok(())
@@ -1690,35 +1586,6 @@ pub async fn create_custom_instance_database(
            error::Error::internal_err(format!("Failed to create database '{}': {}", dbname, e))
        })?;

-    // Nothing names a database that failed past this point, and its name blocks the retry: drop it
-    // rather than leave it behind.
-    if let Err(e) = finish_custom_instance_database(db, dbname, tag).await {
-        match drop_unused_instance_database(db, dbname).await {
-            Ok(users) if !users.is_empty() => tracing::warn!(
-                "Kept '{dbname}' after failing to set it up: workspaces {} use it",
-                users.join(", ")
-            ),
-            Ok(_) => {}
-            Err(drop_err) => {
-                tracing::error!("Could not drop '{dbname}' after failing to set it up: {drop_err}")
-            }
-        }
-        return Err(e);
-    }
-
-    // A data table role can only reach a database it may CONNECT to, and PUBLIC's default CONNECT
-    // would otherwise let every role in regardless of what this instance defines. Best-effort: a
-    // failure here leaves the database usable as `admin`, and the next role change repairs it.
-    if let Err(e) = crate::datatable_roles::converge_connect_grants(db, dbname).await {
-        tracing::warn!("Could not set CONNECT grants on instance database '{dbname}': {e}");
-    }
-
-    tracing::info!("Created custom instance database '{}'", dbname);
-    Ok(())
-}
-
-/// Grant `custom_instance_user` its privileges on a database just created, and register it.
-async fn finish_custom_instance_database(db: &DB, dbname: &str, tag: &str) -> error::Result<()> {
    // Grant permissions to custom_instance_user
    let wmill_pg_creds = PgDatabase::parse_uri(&get_database_url().await?.as_str().await)?;
    let new_pg_creds = PgDatabase { dbname: dbname.to_string(), ..wmill_pg_creds };
@@ -1753,6 +1620,15 @@ async fn finish_custom_instance_database(db: &DB, dbname: &str, tag: &str) -> er
    )
    .execute(db)
    .await?;
+
+    // A data table role can only reach a database it may CONNECT to, and PUBLIC's default CONNECT
+    // would otherwise let every role in regardless of what this instance defines. Best-effort: a
+    // failure here leaves the database usable as `admin`, and the next role change repairs it.
+    if let Err(e) = crate::datatable_roles::converge_connect_grants(db, dbname).await {
+        tracing::warn!("Could not set CONNECT grants on instance database '{dbname}': {e}");
+    }
+
+    tracing::info!("Created custom instance database '{}'", dbname);
    Ok(())
 }

@@ -10,7 +10,7 @@

 use std::borrow::Cow;
 use std::collections::{HashMap, HashSet};
-use std::sync::RwLock;
+use std::sync::{Arc, RwLock};
 use uuid::Uuid;

 /// Minimum length for a secret to be registered for masking.
@@ -20,9 +20,27 @@ const MIN_SECRET_LENGTH: usize = 8;
 const MASKED_NOTICE: &str =
    "[windmill] secret value was masked for security reasons, use string transformations to display full value";

+/// The secrets registered for one job, plus the automaton compiled from them.
+#[derive(Default)]
+struct JobMasks {
+    secrets: HashSet<String>,
+    /// Built on the first `snapshot` after a change and shared by every later
+    /// snapshot. Every job registers at least its own token, so without this
+    /// cache each log batch of each job would rebuild the automaton.
+    compiled: Option<Arc<CompiledMasks>>,
+}
+
+/// Aho-Corasick automaton for O(m) multi-pattern matching in a single pass,
+/// regardless of the number of secrets registered, with the replacement
+/// strings indexed to match the automaton's pattern order.
+struct CompiledMasks {
+    ac: aho_corasick::AhoCorasick,
+    replacements: Vec<String>,
+}
+
 lazy_static::lazy_static! {
-    /// Map of job_id -> set of secret values that should be masked in that job's logs.
-    static ref SENSITIVE_MASKS: RwLock<HashMap<Uuid, HashSet<String>>> =
+    /// Map of job_id -> secret values that should be masked in that job's logs.
+    static ref SENSITIVE_MASKS: RwLock<HashMap<Uuid, JobMasks>> =
        RwLock::new(HashMap::new());

    /// Set of currently running job IDs on this worker process.
@@ -32,13 +50,8 @@ lazy_static::lazy_static! {
 }

 /// A lock-free snapshot of secrets for a job, taken once per log batch.
-/// Uses Aho-Corasick for O(m) multi-pattern matching in a single pass,
-/// regardless of the number of secrets registered.
 pub struct MaskSnapshot {
-    /// Aho-Corasick automaton for fast matching.
-    ac: aho_corasick::AhoCorasick,
-    /// Replacement strings, indexed to match the automaton's pattern order.
-    replacements: Vec<String>,
+    compiled: Arc<CompiledMasks>,
    /// Whether the security notice has already been appended for this snapshot.
    /// Tracked locally to avoid a global write lock on every masked line.
    notice_shown: std::cell::Cell<bool>,
@@ -53,34 +66,104 @@ impl MaskSnapshot {
        }

        // Single-pass check + replace using the pre-built automaton
-        if !self.ac.is_match(text) {
+        if !self.compiled.ac.is_match(text) {
            return Cow::Borrowed(text);
        }

-        let mut result = self.ac.replace_all(text, &self.replacements);
+        let mut result = self
+            .compiled
+            .ac
+            .replace_all(text, &self.compiled.replacements);

-        // Append the notice only once per snapshot (i.e. per batch)
+        // Append the notice only once per snapshot (i.e. per batch), as its own line.
+        // Callers pass either a bare line (`handle_child`) or a chunk that already ends
+        // in a newline (nativets), and the sinks concatenate what they get verbatim:
+        // assuming either shape welds the notice onto a neighbouring line.
        if !self.notice_shown.get() {
            self.notice_shown.set(true);
-            result.push('\n');
-            result.push_str(MASKED_NOTICE);
+            if result.ends_with('\n') {
+                result.push_str(MASKED_NOTICE);
+                result.push('\n');
+            } else {
+                result.push('\n');
+                result.push_str(MASKED_NOTICE);
+            }
        }

        Cow::Owned(result)
    }
 }

+/// A masker for sinks that mask line by line rather than in batches, like nativets
+/// masking each `console.log` chunk as V8 produces it. `snapshot` per line would
+/// re-arm the security notice on every one; this keeps it to once per distinct set
+/// of secrets while still picking up secrets registered mid-run.
+///
+/// Masks by job id alone — the caller is the one that knows the text it passes
+/// belongs to that job.
+pub struct JobMasker {
+    job_id: Uuid,
+    snapshot: Option<MaskSnapshot>,
+}
+
+impl JobMasker {
+    pub fn new(job_id: Uuid) -> Self {
+        JobMasker { job_id, snapshot: snapshot(&job_id) }
+    }
+
+    /// Mask every secret registered for the job. Returns `Cow::Borrowed` when no match.
+    /// Falls back to the masks it last saw once the job is unregistered, so a sink
+    /// still draining past the end of a run does not start emitting secrets.
+    pub fn mask<'a>(&mut self, text: &'a str) -> Cow<'a, str> {
+        if let Some(fresh) = snapshot(&self.job_id) {
+            // Replacing an equivalent snapshot would re-arm the notice, so only take
+            // one built from a secret set we have not seen.
+            let unchanged = self
+                .snapshot
+                .as_ref()
+                .is_some_and(|cur| Arc::ptr_eq(&cur.compiled, &fresh.compiled));
+            if !unchanged {
+                self.snapshot = Some(fresh);
+            }
+        }
+        match self.snapshot.as_ref() {
+            Some(snapshot) => snapshot.mask(text),
+            None => Cow::Borrowed(text),
+        }
+    }
+}
+
 /// Take a snapshot of the current secrets for a job. Returns `None` if no secrets
 /// are registered (the caller can then skip masking entirely for the whole batch).
 ///
 /// Call this once per log batch in `write_lines`, not per line.
 pub fn snapshot(job_id: &Uuid) -> Option<MaskSnapshot> {
-    let masks = SENSITIVE_MASKS.read().unwrap_or_else(|e| e.into_inner());
-    let secrets = masks.get(job_id)?;
-    if secrets.is_empty() {
-        return None;
+    {
+        let masks = SENSITIVE_MASKS.read().unwrap_or_else(|e| e.into_inner());
+        let job = masks.get(job_id)?;
+        if job.secrets.is_empty() {
+            return None;
+        }
+        if let Some(compiled) = job.compiled.as_ref() {
+            return Some(MaskSnapshot {
+                compiled: compiled.clone(),
+                notice_shown: std::cell::Cell::new(false),
+            });
+        }
    }

+    let mut masks = SENSITIVE_MASKS.write().unwrap_or_else(|e| e.into_inner());
+    let job = masks.get_mut(job_id)?;
+    if job.secrets.is_empty() {
+        return None;
+    }
+    let compiled = job
+        .compiled
+        .get_or_insert_with(|| Arc::new(compile(&job.secrets)));
+    Some(MaskSnapshot { compiled: compiled.clone(), notice_shown: std::cell::Cell::new(false) })
+}
+
+fn compile(secrets: &HashSet<String>) -> CompiledMasks {
    // Sort longest-first so longer secrets are matched before shorter substrings
    let mut sorted: Vec<&String> = secrets.iter().collect();
    sorted.sort_by(|a, b| b.len().cmp(&a.len()));
@@ -106,7 +189,7 @@ pub fn snapshot(job_id: &Uuid) -> Option<MaskSnapshot> {
        .build(sorted.iter().map(|s| s.as_str()))
        .expect("failed to build aho-corasick automaton");

-    Some(MaskSnapshot { ac, replacements, notice_shown: std::cell::Cell::new(false) })
+    CompiledMasks { ac, replacements }
 }

 /// Register a job as currently running. Call this before `handle_queued_job`.
@@ -148,20 +231,110 @@ pub fn register_secret_for_all_running_jobs(secret: &str) {

    let mut masks = SENSITIVE_MASKS.write().unwrap_or_else(|e| e.into_inner());
    for job_id in job_ids {
-        if let Some(set) = masks.get_mut(&job_id) {
-            set.insert(secret.to_string());
+        if let Some(job) = masks.get_mut(&job_id) {
+            if job.secrets.insert(secret.to_string()) {
+                job.compiled = None;
+            }
        }
    }
 }

 /// Register a secret value for a specific job.
-/// Used for `$encrypted:` args where we know the job ID.
+/// Used for the job's own token and for `$encrypted:` args, where we know the job ID.
 pub fn register_secret_for_job(job_id: Uuid, secret: &str) {
    if secret.len() < MIN_SECRET_LENGTH {
        return;
    }
    let mut masks = SENSITIVE_MASKS.write().unwrap_or_else(|e| e.into_inner());
-    if let Some(set) = masks.get_mut(&job_id) {
-        set.insert(secret.to_string());
+    if let Some(job) = masks.get_mut(&job_id) {
+        if job.secrets.insert(secret.to_string()) {
+            job.compiled = None;
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// The compiled automaton is cached per job, so a secret registered after the
+    /// first snapshot only gets masked if the cache is invalidated.
+    #[test]
+    fn snapshot_rebuilds_after_a_new_secret_is_registered() {
+        let job_id = Uuid::new_v4();
+        register_running_job(job_id);
+        register_secret_for_job(job_id, "firstsecretvalue");
+        let _ = snapshot(&job_id)
+            .expect("secret registered")
+            .mask("firstsecretvalue");
+
+        register_secret_for_job(job_id, "secondsecretvalue");
+
+        let snap = snapshot(&job_id).expect("secrets registered");
+        let masked = snap.mask("firstsecretvalue then secondsecretvalue");
+        assert!(!masked.contains("firstsecretvalue"), "{masked}");
+        assert!(!masked.contains("secondsecretvalue"), "{masked}");
+        unregister_running_job(job_id);
+    }
+
+    /// A line-by-line sink must not repeat the notice on every line, and must still
+    /// pick up a secret registered after the masker was built.
+    #[test]
+    fn job_masker_notices_once_per_secret_set() {
+        let job_id = Uuid::new_v4();
+        register_running_job(job_id);
+        register_secret_for_job(job_id, "firstsecretvalue");
+        let mut masker = JobMasker::new(job_id);
+
+        let first = masker.mask("saw firstsecretvalue").into_owned();
+        assert!(!first.contains("firstsecretvalue"), "{first}");
+        assert!(first.contains(MASKED_NOTICE), "{first}");
+
+        let second = masker.mask("saw firstsecretvalue again").into_owned();
+        assert!(!second.contains("firstsecretvalue"), "{second}");
+        assert!(!second.contains(MASKED_NOTICE), "{second}");
+
+        register_secret_for_job(job_id, "secondsecretvalue");
+        let third = masker.mask("saw secondsecretvalue").into_owned();
+        assert!(!third.contains("secondsecretvalue"), "{third}");
+        unregister_running_job(job_id);
+    }
+
+    /// Unregistration must not turn masking off under a sink that is still emitting:
+    /// the masker keeps working off the masks it last saw rather than going quiet.
+    #[test]
+    fn job_masker_masks_after_the_job_is_unregistered() {
+        let job_id = Uuid::new_v4();
+        register_running_job(job_id);
+        register_secret_for_job(job_id, "supersecretvalue");
+        let mut masker = JobMasker::new(job_id);
+
+        unregister_running_job(job_id);
+
+        let masked = masker.mask("logged supersecretvalue here");
+        assert!(!masked.contains("supersecretvalue"), "{masked}");
+    }
+
+    /// The notice has to end up on a line of its own for both shapes callers pass:
+    /// a bare line (`handle_child`) and a newline-terminated chunk (nativets). The
+    /// sinks concatenate what they are given verbatim, so getting this wrong welds
+    /// the notice onto whichever line follows it.
+    #[test]
+    fn notice_lands_on_its_own_line_for_both_caller_shapes() {
+        let job_id = Uuid::new_v4();
+        register_running_job(job_id);
+        register_secret_for_job(job_id, "supersecretvalue");
+
+        let line = snapshot(&job_id)
+            .expect("secret registered")
+            .mask("tok supersecretvalue");
+        assert_eq!(line, format!("tok s*****e\n{MASKED_NOTICE}"));
+
+        let chunk = snapshot(&job_id)
+            .expect("secret registered")
+            .mask("tok supersecretvalue\n");
+        assert_eq!(chunk, format!("tok s*****e\n{MASKED_NOTICE}\n"));
+
+        unregister_running_job(job_id);
    }
 }
@@ -1304,12 +1304,6 @@ pub struct DataTable {
    /// nothing local for a fork admin to widen.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub reference: Option<DataTableReference>,
-    /// Set on a *clone* — a terminal entry whose database was copied from the entry this names. The
-    /// copy holds that entry's rows, so who may connect as which role stays that entry's decision:
-    /// the clone carries no `permissions` of its own and is governed like a pointer, while
-    /// connecting to its own database.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub governed_by: Option<DataTableReference>,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub forked_from: Option<DataTableForkedFrom>,
    /// Whether the SQL-migrations feature is opted in for this data table.
@@ -1368,16 +1362,9 @@ pub const DATATABLE_TENANT_WILDCARD: &str = "*";
 /// enough to survive a fork of a fork.
 const DATATABLE_REFERENCE_MAX_DEPTH: usize = 20;

-/// Exactly one of `database` and `reference` must be set, and a clone's `governed_by` leaves no
-/// `permissions` beside it. Called wherever an entry is persisted, so nothing downstream has to
-/// handle an entry that is both or neither, or a clone with a decision of its own.
+/// Exactly one of `database` and `reference` must be set. Called wherever an entry is persisted,
+/// so nothing downstream has to handle an entry that is both or neither.
 pub fn validate_datatable_shape(name: &str, dt: &DataTable) -> Result<()> {
-    if dt.governed_by.is_some() && (dt.database.is_none() || dt.permissions.is_some()) {
-        return Err(Error::BadRequest(format!(
-            "Data table '{name}' is a clone, which owns a database and takes its roles from the \
-             data table it was cloned from"
-        )));
-    }
    match (&dt.database, &dt.reference) {
        (Some(_), None) | (None, Some(_)) => Ok(()),
        (Some(_), Some(_)) => Err(Error::BadRequest(format!(
@@ -1465,28 +1452,23 @@ pub async fn read_datatable_entry(db: &DB, w_id: &str, name: &str) -> Result<Dat
    Ok(serde_json::from_value::<DataTable>(datatable.clone())?)
 }

-/// The terminal entry a reference chain lands on, and what governs it: the workspace and name of
-/// the entry that owns the database, the entry itself, and — for a clone — the entry its
-/// `governed_by` chain lands on. A terminal entry that is not a clone resolves to itself and
-/// governs itself.
+/// The terminal entry a reference chain lands on: the workspace that governs the data table, the
+/// entry name there, and the entry itself. A terminal entry resolves to itself.
 ///
-/// Every decision downstream is taken on this, never on the entry the caller named. Which database
-/// to connect to comes from `workspace_id` / `name` / `datatable.database`; whose `permissions`
-/// apply (already in `datatable.permissions`), whose members tenants are evaluated against and who
-/// may administer it come from [`GoverningDatatable::governing_workspace_id`].
+/// Every decision downstream — which database to connect to, whose `permissions` apply, whose
+/// members tenants are evaluated against, who may administer it — is taken on this, never on the
+/// entry the caller named.
 ///
 /// Authorization: resolving deliberately crosses into the governing workspace, so it answers for a
 /// workspace the caller may not belong to and checks nothing itself. It is the input to the
 /// checks, not one of them: callers MUST pass what it returns to
 /// [`can_use_datatable_role_in_governing_workspace`] or [`ensure_datatable_admin_access`] before
-/// acting on it, and MUST NOT return its `permissions` or workspace ids to a caller from
+/// acting on it, and MUST NOT return its `permissions` or `workspace_id` to a caller from
 /// elsewhere without gating on the answer.
 pub struct GoverningDatatable {
    pub workspace_id: String,
    pub name: String,
    pub datatable: DataTable,
-    /// For a clone, the entry whose `permissions` govern it. `None` when the entry governs itself.
-    pub governor: Option<DataTableReference>,
 }

 impl GoverningDatatable {
@@ -1498,13 +1480,6 @@ impl GoverningDatatable {
            .as_ref()
            .is_some_and(|d| d.resource_type == DataTableCatalogResourceType::Instance)
    }
-
-    /// The workspace whose admins administer the data table and whose members its tenants are.
-    pub fn governing_workspace_id(&self) -> &str {
-        self.governor
-            .as_ref()
-            .map_or(&self.workspace_id, |g| &g.workspace_id)
-    }
 }

 pub async fn resolve_governing_datatable(
@@ -1515,9 +1490,6 @@ pub async fn resolve_governing_datatable(
    let mut workspace_id = w_id.to_string();
    let mut name = name.to_string();
    let mut hops = 0;
-    // The clone a `governed_by` chain started from: it keeps its database, and takes the
-    // `permissions` of wherever the chain lands.
-    let mut clone: Option<(String, String, DataTable)> = None;
    for _ in 0..DATATABLE_REFERENCE_MAX_DEPTH {
        let datatable = read_datatable_entry(db, &workspace_id, &name)
            .await
@@ -1528,48 +1500,21 @@ pub async fn resolve_governing_datatable(
                    // A pointer outlives the workspace it names: deleting one only nulls the fork
                    // lineage, it does not sweep the entries that pointed at it. Say which one is
                    // gone rather than reporting a data table this workspace never had.
-                    if clone.is_some() {
-                        Error::NotFound(format!(
-                            "Data table '{name}' of workspace '{workspace_id}', which this clone \
-                             takes its roles from, no longer exists, so nobody is let into the copy."
-                        ))
-                    } else {
-                        Error::NotFound(format!(
-                            "Data table '{name}' of workspace '{workspace_id}' governs this one and \
-                             no longer exists. A superadmin can point this data table somewhere \
-                             else."
-                        ))
-                    }
+                    Error::NotFound(format!(
+                        "Data table '{name}' of workspace '{workspace_id}' governs this one and no \
+                         longer exists. A superadmin can point this data table somewhere else."
+                    ))
                }
            })?;
        hops += 1;
        validate_datatable_shape(&name, &datatable)?;
-        let next = match (&datatable.reference, &datatable.governed_by) {
-            (Some(reference), _) => reference.clone(),
-            (None, Some(governed_by)) => {
-                let governed_by = governed_by.clone();
-                if clone.is_none() {
-                    clone = Some((workspace_id.clone(), name.clone(), datatable));
-                }
-                governed_by
+        match &datatable.reference {
+            None => return Ok(GoverningDatatable { workspace_id, name, datatable }),
+            Some(reference) => {
+                workspace_id = reference.workspace_id.clone();
+                name = reference.datatable.clone();
            }
-            (None, None) => {
-                return Ok(match clone {
-                    None => GoverningDatatable { workspace_id, name, datatable, governor: None },
-                    Some((clone_w_id, clone_name, mut clone_datatable)) => {
-                        clone_datatable.permissions = datatable.permissions;
-                        GoverningDatatable {
-                            workspace_id: clone_w_id,
-                            name: clone_name,
-                            datatable: clone_datatable,
-                            governor: Some(DataTableReference { workspace_id, datatable: name }),
-                        }
-                    }
-                });
-            }
-        };
-        workspace_id = next.workspace_id;
-        name = next.datatable;
+        }
    }
    Err(Error::BadRequest(format!(
        "Data table '{name}' points at another data table through more than \
@@ -1609,20 +1554,17 @@ pub async fn resolve_workspace_governing_datatables(

    let mut entries = Entries::new();
    let listed = load(db, &[w_id.to_string()], &mut entries).await?;
-    // (index into `listed`, workspace, entry name, the clone the chain started from) still to be
-    // followed. A clone keeps its own database and takes the `permissions` of wherever its
-    // `governed_by` chain lands, as the single resolution does.
-    type Clone = Option<(String, String, DataTable)>;
-    let mut cursors: Vec<(usize, String, String, Clone)> = listed
+    // (index into `listed`, workspace, entry name) still to be followed.
+    let mut cursors: Vec<(usize, String, String)> = listed
        .iter()
        .enumerate()
-        .map(|(i, name)| (i, w_id.to_string(), name.clone(), None))
+        .map(|(i, name)| (i, w_id.to_string(), name.clone()))
        .collect();
    let mut resolved: Vec<(usize, GoverningDatatable)> = vec![];

    for _ in 0..DATATABLE_REFERENCE_MAX_DEPTH {
        let mut next = vec![];
-        for (i, ws, name, clone) in cursors.drain(..) {
+        for (i, ws, name) in cursors.drain(..) {
            let Some(value) = entries
                .get(&ws)
                .and_then(|m| m.get(&name))
@@ -1636,41 +1578,14 @@ pub async fn resolve_workspace_governing_datatables(
            if validate_datatable_shape(&name, &datatable).is_err() {
                continue;
            }
-            match (&datatable.reference, &datatable.governed_by) {
-                (Some(reference), _) => next.push((
+            match &datatable.reference {
+                None => {
+                    resolved.push((i, GoverningDatatable { workspace_id: ws, name, datatable }))
+                }
+                Some(reference) => next.push((
                    i,
                    reference.workspace_id.clone(),
                    reference.datatable.clone(),
-                    clone,
-                )),
-                (None, Some(governed_by)) => {
-                    let (governor_ws, governor_name) =
-                        (governed_by.workspace_id.clone(), governed_by.datatable.clone());
-                    let clone = clone.or(Some((ws, name, datatable)));
-                    next.push((i, governor_ws, governor_name, clone));
-                }
-                (None, None) => resolved.push((
-                    i,
-                    match clone {
-                        None => GoverningDatatable {
-                            workspace_id: ws,
-                            name,
-                            datatable,
-                            governor: None,
-                        },
-                        Some((clone_ws, clone_name, mut clone_datatable)) => {
-                            clone_datatable.permissions = datatable.permissions;
-                            GoverningDatatable {
-                                workspace_id: clone_ws,
-                                name: clone_name,
-                                datatable: clone_datatable,
-                                governor: Some(DataTableReference {
-                                    workspace_id: ws,
-                                    datatable: name,
-                                }),
-                            }
-                        }
-                    },
                )),
            }
        }
@@ -1679,7 +1594,7 @@ pub async fn resolve_workspace_governing_datatables(
        }
        let to_load: Vec<String> = next
            .iter()
-            .map(|(_, ws, _, _)| ws.clone())
+            .map(|(_, ws, _)| ws.clone())
            .filter(|ws| !entries.contains_key(ws))
            .collect::<std::collections::BTreeSet<_>>()
            .into_iter()
@@ -3429,7 +3344,6 @@ mod tests {
                resource_path: "dt_main".to_string(),
            }),
            reference: None,
-            governed_by: None,
            forked_from: None,
            migrations_enabled: None,
            permissions: None,
@@ -4650,6 +4650,30 @@ pub fn tag_reads_args(tag: &str) -> bool {
    RE_ARG_TAG.is_match(tag)
 }

+/// Whether the tag reads the flow's state (`$flow_expr[results.a.foo]`), which only the flow
+/// runtime can resolve, right before pushing the step. A malformed placeholder counts too, so it
+/// is rejected or dropped instead of queueing the job on its literal text.
+pub fn tag_reads_flow_expr(tag: &str) -> bool {
+    tag.contains("$flow_expr[")
+}
+
+/// Renders the value at the dotted `path` below `root` as a dynamic tag component, shared by
+/// `$args[...]` and `$flow_expr[...]`: its JSON text with surrounding quotes trimmed, and empty
+/// once a segment is missing. Only object keys are followed, never array indexes.
+pub fn render_tag_path(root: Option<&RawValue>, path: &str) -> String {
+    let mut value = root.map(|x| x.get()).unwrap_or_default().to_string();
+    for part in path.split('.').filter(|p| !p.is_empty()) {
+        match serde_json::from_str::<serde_json::Value>(&value) {
+            Ok(obj) => value = obj.get(part).map(|v| v.to_string()).unwrap_or_default(),
+            Err(_) => {
+                value = String::new();
+                break;
+            }
+        }
+    }
+    value.trim_matches('"').to_string()
+}
+
 pub fn interpolate_args(x: String, args: &PushArgs, workspace_id: &str) -> String {
    // Save this value to avoid parsing twice
    let workspaced = x.as_str().replace("$workspace", workspace_id).to_string();
@@ -4657,40 +4681,12 @@ pub fn interpolate_args(x: String, args: &PushArgs, workspace_id: &str) -> Strin
        let mut interpolated = workspaced.clone();
        for cap in RE_ARG_TAG.captures_iter(&workspaced) {
            let arg_name = cap.get(1).unwrap().as_str();
-            let arg_value = if arg_name.contains('.') {
-                let parts: Vec<&str> = arg_name.split('.').collect();
-                let root = parts[0];
-                let mut value = args
-                    .args
-                    .get(root)
-                    .or(args.extra.as_ref().and_then(|x| x.get(root)))
-                    .map(|x| x.get())
-                    .unwrap_or_default()
-                    .to_string();
-
-                for part in parts.iter().skip(1) {
-                    if let Ok(obj) = serde_json::from_str::<serde_json::Value>(&value) {
-                        value = obj
-                            .get(part)
-                            .and_then(|v| Some(v.to_string()))
-                            .unwrap_or_default()
-                            .as_str()
-                            .to_string();
-                    } else {
-                        value = "".to_string(); // Invalid JSON or missing field
-                        break;
-                    }
-                }
-                value.trim_matches('"').to_string()
-            } else {
-                args.args
-                    .get(arg_name)
-                    .or(args.extra.as_ref().and_then(|x| x.get(arg_name)))
-                    .map(|x| x.get())
-                    .unwrap_or_default()
-                    .trim_matches('"')
-                    .to_string()
-            };
+            let (root, rest) = arg_name.split_once('.').unwrap_or((arg_name, ""));
+            let root_value = args
+                .args
+                .get(root)
+                .or(args.extra.as_ref().and_then(|x| x.get(root)));
+            let arg_value = render_tag_path(root_value.map(|x| &**x), rest);
            interpolated =
                interpolated.replace(format!("$args[{}]", arg_name).as_str(), &arg_value);
        }
@@ -5269,6 +5265,8 @@ pub fn empty_result() -> Box<RawValue> {

 lazy_static::lazy_static! {
    pub static ref RE_ARG_TAG: Regex = Regex::new(r#"\$args\[((?:\w+\.)*\w+)\]"#).unwrap();
+    pub static ref RE_FLOW_EXPR_TAG: Regex =
+        Regex::new(r#"\$flow_expr\[((?:\w+\.)*\w+)\]"#).unwrap();
 }

 #[cfg(feature = "cloud")]
@@ -6537,7 +6535,10 @@ async fn push_inner<'c, 'd>(
        );
        windmill_common::worker::dedicated_worker_tag(workspace_id, &full_path)
    } else {
-        if tag == Some("".to_string()) {
+        // The flow runtime resolves a step's `$flow_expr[...]` before pushing it, so one still here
+        // was pushed with no flow state to read (a step test, a dependency job) and would name a
+        // queue no worker serves: the job runs on its default tag instead.
+        if tag == Some("".to_string()) || tag.as_deref().is_some_and(tag_reads_flow_expr) {
            tag = None;
        }

@@ -7922,3 +7923,43 @@ mod result_metadata_tests {
        assert_eq!(meta.wm_failure.as_deref(), Some("boom"));
    }
 }
+
+#[cfg(test)]
+mod render_tag_path_tests {
+    use super::{interpolate_args, render_tag_path, PushArgs};
+    use serde_json::value::RawValue;
+    use std::collections::HashMap;
+
+    fn render(root: &str, path: &str) -> String {
+        render_tag_path(
+            Some(&RawValue::from_string(root.to_string()).unwrap()),
+            path,
+        )
+    }
+
+    // Existing `$args[...]` tags route on exactly these renderings.
+    #[test]
+    fn renders_like_args_tags() {
+        assert_eq!(render(r#""eu""#, ""), "eu");
+        assert_eq!(render(r#"{"a": {"b": "eu"}}"#, "a.b"), "eu");
+        assert_eq!(render(r#"{"n": 4}"#, "n"), "4");
+        assert_eq!(render("null", ""), "null");
+        assert_eq!(render(r#"{"a": 1}"#, "b.c"), "");
+        assert_eq!(render(r#"{"a": ["eu"]}"#, "a.0"), "");
+        assert_eq!(render_tag_path(None, "a"), "");
+
+        let args = HashMap::from([("cfg".to_string(), raw(r#"{"lang": "eu"}"#))]);
+        let push_args = PushArgs {
+            args: &args,
+            extra: Some(HashMap::from([("e".to_string(), raw(r#""x""#))])),
+        };
+        assert_eq!(
+            interpolate_args("w-$args[cfg.lang]-$args[e]".to_string(), &push_args, "ws"),
+            "w-eu-x"
+        );
+    }
+
+    fn raw(json: &str) -> Box<RawValue> {
+        RawValue::from_string(json.to_string()).unwrap()
+    }
+}
@@ -838,6 +838,11 @@ pub async fn eval_fetch_timeout(
                }
            }
            let w_id_for_tracing = w_id_for_tracing;
+            // nativets delivers logs in-process, so they never reach the masking in
+            // `handle_child::write_lines` and a `console.log` of `$WM_TOKEN` would be
+            // persisted verbatim. Mask here rather than in the detached task draining into
+            // `append_logs`: this loop normally runs while the job is still registered.
+            let mut masker = windmill_common::sensitive_log_masks::JobMasker::new(job_id);
            let handle = tokio::spawn(async move {
                let mut result_stream = String::new();
                let mut is_stream = false;
@@ -845,10 +850,20 @@ pub async fn eval_fetch_timeout(
                    use windmill_common::result_stream::extract_stream_from_logs;
                    use windmill_common::tracing_init::{OTEL_JOB_LOGS, OTEL_PREFIX};

+                    let stream = extract_stream_from_logs(&log.trim_end_matches("\n"));
+
+                    // A stream chunk is result data, not a log line — it never reaches
+                    // `job_logs`, and `merge_result_stream` can make it the job's result —
+                    // so it stays raw wherever it goes, here and in the mirror below.
+                    // Deliberately unlike `handle_child`, which streams the masked text.
+                    // Routed before masking because the notice is one-shot: spent on a chunk
+                    // no sink persists, a later redaction in `job_logs` would go unexplained.
+                    let logged = stream.is_none().then(|| masker.mask(&log).into_owned());
+
                    // Mirror `process_streaming_log_lines` (EE) + the OTEL_JOB_LOGS
                    // hook from handle_child.rs, neither of which runs for nativets
                    // since nativets delivers logs in-process via the log channel.
-                    for line in log.lines() {
+                    for line in logged.as_deref().unwrap_or(&log).lines() {
                        tracing::info!(
                            target: "windmill:job_log",
                            job_id = ?job_id,
@@ -862,7 +877,7 @@ pub async fn eval_fetch_timeout(
                        }
                    }

-                    if let Some(stream) = extract_stream_from_logs(&log.trim_end_matches("\n")) {
+                    if let Some(stream) = stream {
                        if !is_stream {
                            is_stream = true;
                            if let Some(ref f) = stream_notifier_update {
@@ -874,8 +889,8 @@ pub async fn eval_fetch_timeout(
                        if let Err(e) = result_stream_sender.send(stream) {
                            tracing::error!("failed to send result stream: {e}");
                        }
-                    } else {
-                        if let Err(e) = append_logs_sender.send(log) {
+                    } else if let Some(logged) = logged {
+                        if let Err(e) = append_logs_sender.send(logged) {
                            tracing::error!("failed to send log: {e}");
                        }
                    }
@@ -79,6 +79,15 @@ lazy_static::lazy_static! {
 const DEFAULT_MAX_AGENT_ITERATIONS: usize = 10;
 const HARD_MAX_AGENT_ITERATIONS: usize = 1000;

+/// What a run stopped by `max_iterations` reports back. `Message` rather than
+/// `OpenAIMessage` is load-bearing: `agent_action` is `skip_serializing` on the
+/// latter and reaches JSON only through this wrapper, so serializing these raw
+/// drops every tool name and job id and leaves the partial run unreadable.
+#[derive(serde::Serialize)]
+struct MaxIterPartialResult<'a> {
+    messages: Vec<Message<'a>>,
+}
+
 fn strip_system_messages(messages: &[OpenAIMessage]) -> Vec<OpenAIMessage> {
    messages
        .iter()
@@ -1785,10 +1794,6 @@ pub async fn run_agent(
                        step_id: Option<&'a str>,
                        result: MaxIterPartialResult<'a>,
                    }
-                    #[derive(serde::Serialize)]
-                    struct MaxIterPartialResult<'a> {
-                        messages: &'a [OpenAIMessage],
-                    }
                    return Err(Error::ExecutionRawError(
                        serde_json::value::to_raw_value(&MaxIterError {
                            message: format!(
@@ -1797,7 +1802,15 @@ pub async fn run_agent(
                            ),
                            name: "ExecutionErr",
                            step_id: effective_flow_step_id,
-                            result: MaxIterPartialResult { messages: &messages },
+                            result: MaxIterPartialResult {
+                                messages: messages
+                                    .iter()
+                                    .map(|m| Message {
+                                        message: m,
+                                        agent_action: m.agent_action.as_ref(),
+                                    })
+                                    .collect(),
+                            },
                        })?,
                    ));
                }
@@ -2322,6 +2335,33 @@ mod tests {
        assert!(!streaming_requested(Some(false)));
    }

+    #[test]
+    fn max_iterations_partial_result_keeps_the_action_tags() {
+        let messages = vec![OpenAIMessage {
+            role: "tool".to_string(),
+            content: Some(OpenAIContent::Text("{\"rows\":2}".to_string())),
+            tool_call_id: Some("call_1".to_string()),
+            agent_action: Some(AgentAction::ToolCall {
+                job_id: uuid::Uuid::nil(),
+                function_name: "list_payouts".to_string(),
+                module_id: "b".to_string(),
+            }),
+            ..Default::default()
+        }];
+
+        let partial = MaxIterPartialResult {
+            messages: messages
+                .iter()
+                .map(|m| Message { message: m, agent_action: m.agent_action.as_ref() })
+                .collect(),
+        };
+        let json = serde_json::to_value(&partial).unwrap();
+
+        let action = &json["messages"][0]["agent_action"];
+        assert_eq!(action["type"], "tool_call");
+        assert_eq!(action["function_name"], "list_payouts");
+    }
+
    /// Over 64 characters OpenAI rejects the key outright, which costs a wasted round
    /// trip per run and silently leaves that step with no prompt caching at all.
    #[test]
@@ -3859,8 +3859,6 @@ pub async fn run_worker(

                    let arc_job = Arc::new(job);

-                    windmill_common::sensitive_log_masks::register_running_job(arc_job.id);
-
                    let span = create_span_with_name(&arc_job, &worker_name, Some(hostname), "job");
                    let log_ctx = log_context_for_job(&arc_job, &worker_name, Some(hostname));

@@ -3976,8 +3974,6 @@ pub async fn run_worker(
                        _ => {}
                    }

-                    windmill_common::sensitive_log_masks::unregister_running_job(job_id);
-
                    #[cfg(feature = "prometheus")]
                    if let Some(duration) = _timer.map(|x| x.stop_and_record()) {
                        register_metric(
@@ -4512,6 +4508,30 @@ async fn detect_and_store_runtime_assets_from_job_args(
    }
 }

+/// Holds a job's entry in the log-masking registry for as long as it executes, so
+/// that secrets it fetches can be registered against it, and masks the job's own
+/// token from the start: `$WM_TOKEN` stays valid well past the run, and a script
+/// that echoes it would otherwise leave a live credential in the persisted logs.
+///
+/// Lives here rather than at the call sites so that every way of running a job —
+/// the poller, the interactive worker shell, an inline AI agent tool — is covered
+/// by construction.
+struct RunningJobMasks(Uuid);
+
+impl RunningJobMasks {
+    fn register(job_id: Uuid, token: &str) -> Self {
+        windmill_common::sensitive_log_masks::register_running_job(job_id);
+        windmill_common::sensitive_log_masks::register_secret_for_job(job_id, token);
+        RunningJobMasks(job_id)
+    }
+}
+
+impl Drop for RunningJobMasks {
+    fn drop(&mut self) {
+        windmill_common::sensitive_log_masks::unregister_running_job(self.0);
+    }
+}
+
 pub async fn handle_queued_job(
    job: Arc<MiniPulledJob>,
    raw_code: Option<String>,
@@ -4533,6 +4553,8 @@ pub async fn handle_queued_job(
    flow_runners: Option<Arc<FlowRunners>>,
    #[cfg(feature = "benchmark")] _bench: &mut BenchmarkIter,
 ) -> windmill_common::error::Result<JobOutcome> {
+    let _masks = RunningJobMasks::register(job.id, &client.token);
+
    if job.canceled_by.is_some() {
        return Err(Error::JsonErr(canceled_job_to_result(&job)));
    }
@@ -69,10 +69,10 @@ use windmill_common::{
 use windmill_queue::schedule::get_schedule_opt;
 use windmill_queue::{
    add_completed_job, add_completed_job_error, append_logs, get_mini_pulled_job,
-    insert_concurrency_key_capped, interpolate_args,
+    insert_concurrency_key_capped, interpolate_args, render_tag_path,
    report_error_to_workspace_handler_or_critical_side_channel, tag_reads_args,
-    try_schedule_next_job, CanceledBy, FlowRunners, MiniCompletedJob, MiniPulledJob, PushArgs,
-    PushIsolationLevel, SameWorkerPayload, WrappedError,
+    tag_reads_flow_expr, try_schedule_next_job, CanceledBy, FlowRunners, MiniCompletedJob,
+    MiniPulledJob, PushArgs, PushIsolationLevel, SameWorkerPayload, WrappedError, RE_FLOW_EXPR_TAG,
 };

 use windmill_audit::audit_oss::audit_log;
@@ -3115,6 +3115,66 @@ fn resolve_flow_step_tag(
    }
 }

+/// Resolves each `$flow_expr[root.key.path]` of a step tag by reading `key.path` from `results`
+/// (where `key` is a step id), `flow_input` or `flow_env`, rendered as `$args[key.path]` would be.
+async fn interpolate_flow_expr_tag(
+    tag: &str,
+    db: &DB,
+    flow_job: &MiniPulledJob,
+    flow_input: &HashMap<String, Box<RawValue>>,
+    flow_env: Option<&HashMap<String, Box<RawValue>>>,
+) -> error::Result<String> {
+    if RE_FLOW_EXPR_TAG
+        .replace_all(tag, "")
+        .contains("$flow_expr[")
+    {
+        return Err(Error::ExecutionErr(format!(
+            "Could not resolve the step tag `{tag}`: each `$flow_expr[...]` must hold a dotted \
+             path such as `results.a.b.c`"
+        )));
+    }
+    let mut rendered: HashMap<&str, String> = HashMap::new();
+    for cap in RE_FLOW_EXPR_TAG.captures_iter(tag) {
+        let path = cap.get(1).unwrap().as_str();
+        if rendered.contains_key(path) {
+            continue;
+        }
+        let (root, key_path) = path.split_once('.').unwrap_or((path, ""));
+        let (key, rest) = key_path.split_once('.').unwrap_or((key_path, ""));
+        if key.is_empty() || !matches!(root, "results" | "flow_input" | "flow_env") {
+            return Err(Error::ExecutionErr(format!(
+                "Could not resolve the step tag `{tag}`: `{path}` must start with \
+                 `results.<step_id>`, `flow_input.<key>` or `flow_env.<key>`"
+            )));
+        }
+        let value = match root {
+            "flow_input" => render_tag_path(flow_input.get(key).map(|x| &**x), rest),
+            "flow_env" => render_tag_path(flow_env.and_then(|e| e.get(key)).map(|x| &**x), rest),
+            _ => match windmill_queue::get_result_by_id(
+                db.clone(),
+                flow_job.workspace_id.clone(),
+                flow_job.id,
+                key.to_string(),
+                None,
+            )
+            .await
+            {
+                Ok(result) => render_tag_path(Some(&*result), rest),
+                Err(Error::NotFound(_)) => String::new(),
+                Err(e) => {
+                    return Err(Error::ExecutionErr(format!(
+                        "Could not resolve the step tag `{tag}`: {e}"
+                    )))
+                }
+            },
+        };
+        rendered.insert(path, value);
+    }
+    Ok(RE_FLOW_EXPR_TAG
+        .replace_all(tag, |cap: &regex::Captures| rendered[&cap[1]].clone())
+        .into_owned())
+}
+
 #[cfg(test)]
 mod tag_resolution_tests {
    use super::resolve_flow_step_tag;
@@ -4193,6 +4253,10 @@ async fn push_next_flow_job(
            None
        };

+        // The `flow_input` the step's input transforms read, which a `$flow_expr[flow_input...]`
+        // tag must read too: the body of a simple for-loop also sees `iter` there.
+        let mut step_flow_input = arc_flow_job_args.clone();
+
        let marc;
        let me;
        let args = match &next_status {
@@ -4217,8 +4281,10 @@ async fn push_next_flow_job(
                if let Some(input_transforms) = simple_input_transforms {
                    //previous id is none because we do not want to use previous id if we are in a for loop
                    let ctx = get_transform_context(&flow_job, "", &status);
+                    let args = Marc::new(args);
+                    step_flow_input = args.clone();
                    let ti = transform_input(
-                        Marc::new(args),
+                        args,
                        flow_env,
                        arc_last_job_result.clone(),
                        input_transforms,
@@ -4397,17 +4463,21 @@ async fn push_next_flow_job(
            payload_tag.tag.as_deref(),
        );

-        // `push_args` is empty once the input transforms failed, so a tag reading `$args[...]`
-        // interpolates to a queue nobody serves and the step sits there instead of reporting
-        // the error. Send it to the flow's tag, which a worker is provably serving right now.
+        // A step whose inputs failed to evaluate, or whose `$flow_expr[...]` tag failed to resolve,
+        // is pushed only to report the error, and a computed tag can then name a queue nobody
+        // serves (`push_args` is empty, so `$args[...]` reads nothing), leaving the step stuck
+        // instead. Send it to the flow's tag, which a worker is provably serving right now.
        //
        // A step handed over by id, or one whose tag `push` replaces, never reaches a worker
        // through its tag, so rewriting theirs would be noise.
        let step_is_pulled_by_tag = !continue_on_same_worker
            && !continue_with_runners
            && !payload_tag.payload.is_dedicated_worker();
-        let reroute_to_flow_tag =
-            err.is_some() && step_is_pulled_by_tag && tag.as_deref().is_some_and(tag_reads_args);
+        let reroute_to_flow_tag = err.is_some()
+            && step_is_pulled_by_tag
+            && tag
+                .as_deref()
+                .is_some_and(|t| tag_reads_args(t) || tag_reads_flow_expr(t));
        let tag = if reroute_to_flow_tag {
            Some(flow_job.tag.clone())
        } else {
@@ -4449,6 +4519,30 @@ async fn push_next_flow_job(
            .await?;
        }

+        // Resolved only after the check: CUSTOM_TAGS allows the template, so its value may name
+        // any queue, as the value of an `$args[...]` tag does.
+        let mut tag_err = None;
+        let tag = match tag {
+            Some(t) if err.is_none() && tag_reads_flow_expr(&t) => {
+                match interpolate_flow_expr_tag(&t, db, &flow_job, &step_flow_input, flow_env)
+                    .warn_after_seconds(3)
+                    .await
+                {
+                    Ok(resolved) => Some(resolved),
+                    Err(e) => {
+                        tag_err = Some(e);
+                        Some(if step_is_pulled_by_tag {
+                            flow_job.tag.clone()
+                        } else {
+                            t
+                        })
+                    }
+                }
+            }
+            t => t,
+        };
+        let err = err.or(tag_err.as_ref());
+
        let evaluated_timeout = if let Some(timeout_transform) = &module.timeout {
            let ctx = get_transform_context(&flow_job, &previous_id, &status);

@@ -2,7 +2,7 @@ import { sleep } from "https://deno.land/x/sleep@v1.2.1/mod.ts";
 import * as windmill from "https://deno.land/x/windmill@v1.174.0/mod.ts";
 import * as api from "https://deno.land/x/windmill@v1.174.0/windmill-api/index.ts";

-export const VERSION = "v1.814.0";
+export const VERSION = "v1.815.0";

 export async function login(email: string, password: string): Promise<string> {
  return await windmill.UserService.login({
@@ -1,12 +1,12 @@
 {
  "name": "windmill-chat",
-  "version": "1.814.0",
+  "version": "1.815.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "windmill-chat",
-      "version": "1.814.0",
+      "version": "1.815.0",
      "license": "Apache-2.0",
      "devDependencies": {
        "@ai-sdk/react": "^4.0.102",
@@ -1,7 +1,7 @@
 {
  "name": "windmill-chat",
  "description": "Build chat interfaces on Windmill flows deployed in chat mode, from any frontend or raw app",
-  "version": "1.814.0",
+  "version": "1.815.0",
  "author": "Ruben Fiszel",
  "license": "Apache-2.0",
  "homepage": "https://github.com/windmill-labs/windmill/tree/main/chat-sdk#readme",
@@ -72,7 +72,7 @@ const packageJson = {
    url: "https://github.com/windmill-labs/windmill/issues",
  },
  dependencies: {
-    esbuild: "0.28.0",
+    esbuild: "0.28.2",
    ...Object.fromEntries(parserPackages.map(p => [p, cliDeps[p] ?? "*"])),
  },
  optionalDependencies: {
@@ -11,7 +11,7 @@
        "@cliffy/table": "npm:@jsr/cliffy__table@1.0.0",
        "@windmill-labs/shared-utils": "^1.0.13",
        "diff": "^5.2.0",
-        "esbuild": "0.28.0",
+        "esbuild": "0.28.2",
        "get-port": "7.1.0",
        "jszip": "3.8.0",
        "minimatch": "^10.0.0",
@@ -34,7 +34,7 @@
        "windmill-parser-wasm-ts": "1.695.0",
        "windmill-parser-wasm-yaml": "1.770.0",
        "windmill-yaml-validator": "1.1.1",
-        "ws": "8.18.0",
+        "ws": "8.21.3",
        "yaml": "^2.7.0",
      },
      "devDependencies": {
@@ -57,57 +57,57 @@

    "@cliffy/table": ["@jsr/cliffy__table@1.0.0", "https://npm.jsr.io/~/11/@jsr/cliffy__table/1.0.0.tgz", { "dependencies": { "@jsr/std__fmt": "^1.0.9" } }, "sha512-VoLxH0DjofHWPWKUc5N+oCwXB6O6e+carnhp23yJTa7qokBb+SCrTIABEgQdIe/p0bxgmZhz17xt2efaAxXvbQ=="],

-    "@esbuild/aix-ppc64": ["@esbuild/aix-ppc64@0.28.0", "", { "os": "aix", "cpu": "ppc64" }, "sha512-lhRUCeuOyJQURhTxl4WkpFTjIsbDayJHih5kZC1giwE+MhIzAb7mEsQMqMf18rHLsrb5qI1tafG20mLxEWcWlA=="],
+    "@esbuild/aix-ppc64": ["@esbuild/aix-ppc64@0.28.2", "", { "os": "aix", "cpu": "ppc64" }, "sha512-XExcO+dvLKvVtNTibSTBej1NCAbaGhWn9Ww1ZPx80qsahhPFe/8jgWP0IchNe0F3HwkU7n8ejhH8bjonqht8mQ=="],

-    "@esbuild/android-arm": ["@esbuild/android-arm@0.28.0", "", { "os": "android", "cpu": "arm" }, "sha512-wqh0ByljabXLKHeWXYLqoJ5jKC4XBaw6Hk08OfMrCRd2nP2ZQ5eleDZC41XHyCNgktBGYMbqnrJKq/K/lzPMSQ=="],
+    "@esbuild/android-arm": ["@esbuild/android-arm@0.28.2", "", { "os": "android", "cpu": "arm" }, "sha512-kXXoiPVVGQcnIYGOeaovwOURpniDBpSq4A03qkQ+BMQqtGG6HYap3xne9C1O1yo4TR3qxlCX5IqqmX6fFo2Lqg=="],

-    "@esbuild/android-arm64": ["@esbuild/android-arm64@0.28.0", "", { "os": "android", "cpu": "arm64" }, "sha512-+WzIXQOSaGs33tLEgYPYe/yQHf0WTU0X42Jca3y8NWMbUVhp7rUnw+vAsRC/QiDrdD31IszMrZy+qwPOPjd+rw=="],
+    "@esbuild/android-arm64": ["@esbuild/android-arm64@0.28.2", "", { "os": "android", "cpu": "arm64" }, "sha512-5YfKeeI8qWfBZIX+u2xZC3Zlb3Os/gLS2sbEKM+I4ZOcsWmHS2WLysCcQZDAFRslDUU5Oiq44gf6PYN1vGwG5A=="],

-    "@esbuild/android-x64": ["@esbuild/android-x64@0.28.0", "", { "os": "android", "cpu": "x64" }, "sha512-+VJggoaKhk2VNNqVL7f6S189UzShHC/mR9EE8rDdSkdpN0KflSwWY/gWjDrNxxisg8Fp1ZCD9jLMo4m0OUfeUA=="],
+    "@esbuild/android-x64": ["@esbuild/android-x64@0.28.2", "", { "os": "android", "cpu": "x64" }, "sha512-O387ite7SzUyCcy3JQX4P4bLtEA7bLLkx+esve5JHnyYfNTxcVpXZo9jhdB0lTKN44gztELTdU7nS8Nr16Fs1Q=="],

-    "@esbuild/darwin-arm64": ["@esbuild/darwin-arm64@0.28.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-0T+A9WZm+bZ84nZBtk1ckYsOvyA3x7e2Acj1KdVfV4/2tdG4fzUp91YHx+GArWLtwqp77pBXVCPn2We7Letr0Q=="],
+    "@esbuild/darwin-arm64": ["@esbuild/darwin-arm64@0.28.2", "", { "os": "darwin", "cpu": "arm64" }, "sha512-n4KqkOQrraxHJcgjM1RvwbigfQKIKJVpM7xp+KsxiyUSrRdIXnt73VhrPAx0fV44hgfmIVKjxMN9J1t5jySVkw=="],

-    "@esbuild/darwin-x64": ["@esbuild/darwin-x64@0.28.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-fyzLm/DLDl/84OCfp2f/XQ4flmORsjU7VKt8HLjvIXChJoFFOIL6pLJPH4Yhd1n1gGFF9mPwtlN5Wf82DZs+LQ=="],
+    "@esbuild/darwin-x64": ["@esbuild/darwin-x64@0.28.2", "", { "os": "darwin", "cpu": "x64" }, "sha512-uq6suIWYP37qzGddBKPw5QEQPi6HiLGsO7UmkpfyaYNQ3D+rN6w6WfwH+nuqcGXWvawGwxOEroO4YGnFh95azw=="],

-    "@esbuild/freebsd-arm64": ["@esbuild/freebsd-arm64@0.28.0", "", { "os": "freebsd", "cpu": "arm64" }, "sha512-l9GeW5UZBT9k9brBYI+0WDffcRxgHQD8ShN2Ur4xWq/NFzUKm3k5lsH4PdaRgb2w7mI9u61nr2gI2mLI27Nh3Q=="],
+    "@esbuild/freebsd-arm64": ["@esbuild/freebsd-arm64@0.28.2", "", { "os": "freebsd", "cpu": "arm64" }, "sha512-n+I0BTSRIoy+d6RPKnEVwql5UwBJolytvY4mAOIEJorKlqgPII8ix6slVVrfZ5Tnj7glIZvloylbB/EJPMWEXw=="],

-    "@esbuild/freebsd-x64": ["@esbuild/freebsd-x64@0.28.0", "", { "os": "freebsd", "cpu": "x64" }, "sha512-BXoQai/A0wPO6Es3yFJ7APCiKGc1tdAEOgeTNy3SsB491S3aHn4S4r3e976eUnPdU+NbdtmBuLncYir2tMU9Nw=="],
+    "@esbuild/freebsd-x64": ["@esbuild/freebsd-x64@0.28.2", "", { "os": "freebsd", "cpu": "x64" }, "sha512-78XJTJkvPs0kz2w61301PJjXl4g7q3JqiYMZ/M/yVI73EHBrCRTgkhu9oqG7vPqq+a/yadEW8aD+agKlk5xrmg=="],

-    "@esbuild/linux-arm": ["@esbuild/linux-arm@0.28.0", "", { "os": "linux", "cpu": "arm" }, "sha512-CjaaREJagqJp7iTaNQjjidaNbCKYcd4IDkzbwwxtSvjI7NZm79qiHc8HqciMddQ6CKvJT6aBd8lO9kN/ZudLlw=="],
+    "@esbuild/linux-arm": ["@esbuild/linux-arm@0.28.2", "", { "os": "linux", "cpu": "arm" }, "sha512-XlDnu2q5yoqems+xay6wSAcg9DDD7K9RLKZEBOMZm3ckNpJBvOX20tSfby8KfrrhINDyv9V2YVZKY/SpoGJI8w=="],

-    "@esbuild/linux-arm64": ["@esbuild/linux-arm64@0.28.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-RVyzfb3FWsGA55n6WY0MEIEPURL1FcbhFE6BffZEMEekfCzCIMtB5yyDcFnVbTnwk+CLAgTujmV/Lgvih56W+A=="],
+    "@esbuild/linux-arm64": ["@esbuild/linux-arm64@0.28.2", "", { "os": "linux", "cpu": "arm64" }, "sha512-pW4AC0P3it8c7do9MVM4p51FzHzdM/TZrerurgRcHJ2WTa1VQ1CIq18xncfpBJw4ojkiZZrKW2yIBWBP92j6Ug=="],

-    "@esbuild/linux-ia32": ["@esbuild/linux-ia32@0.28.0", "", { "os": "linux", "cpu": "ia32" }, "sha512-KBnSTt1kxl9x70q+ydterVdl+Cn0H18ngRMRCEQfrbqdUuntQQ0LoMZv47uB97NljZFzY6HcfqEZ2SAyIUTQBQ=="],
+    "@esbuild/linux-ia32": ["@esbuild/linux-ia32@0.28.2", "", { "os": "linux", "cpu": "ia32" }, "sha512-CYbnj78HsIeA+DhgUKgFCfvNsTHFhMMrinUrMZpDXJXKN8T3XViTZ/+wtHeVxEWY8ewSzTFN+nRmSwO2tZaLUQ=="],

-    "@esbuild/linux-loong64": ["@esbuild/linux-loong64@0.28.0", "", { "os": "linux", "cpu": "none" }, "sha512-zpSlUce1mnxzgBADvxKXX5sl8aYQHo2ezvMNI8I0lbblJtp8V4odlm3Yzlj7gPyt3T8ReksE6bK+pT3WD+aJRg=="],
+    "@esbuild/linux-loong64": ["@esbuild/linux-loong64@0.28.2", "", { "os": "linux", "cpu": "none" }, "sha512-buwkd8nsph4R+ajRvw0qM5Hja/TXQow3ptzWO2EbG/cqcIkHloRrdlBtQlshyYGTNFvfkfJ5tpPLVkY4DtsPfQ=="],

-    "@esbuild/linux-mips64el": ["@esbuild/linux-mips64el@0.28.0", "", { "os": "linux", "cpu": "none" }, "sha512-2jIfP6mmjkdmeTlsX/9vmdmhBmKADrWqN7zcdtHIeNSCH1SqIoNI63cYsjQR8J+wGa4Y5izRcSHSm8K3QWmk3w=="],
+    "@esbuild/linux-mips64el": ["@esbuild/linux-mips64el@0.28.2", "", { "os": "linux", "cpu": "none" }, "sha512-ZVykbDyk7519VwiNb9Lcj9m8XM6v5V9uKPvrEMkkEedVewf+0itkhahp4HDpgERXhwLRpWFypsGbG/J8s0QjJA=="],

-    "@esbuild/linux-ppc64": ["@esbuild/linux-ppc64@0.28.0", "", { "os": "linux", "cpu": "ppc64" }, "sha512-bc0FE9wWeC0WBm49IQMPSPILRocGTQt3j5KPCA8os6VprfuJ7KD+5PzESSrJ6GmPIPJK965ZJHTUlSA6GNYEhg=="],
+    "@esbuild/linux-ppc64": ["@esbuild/linux-ppc64@0.28.2", "", { "os": "linux", "cpu": "ppc64" }, "sha512-CAXl+Dtd9UUuJd8pKKdwh6MLm3MUMiqMPmhZ3tTSXPqfyQ3vDl6R5hZdZ/kYojK4ofXtdfSv1tFq8XzWx3heNQ=="],

-    "@esbuild/linux-riscv64": ["@esbuild/linux-riscv64@0.28.0", "", { "os": "linux", "cpu": "none" }, "sha512-SQPZOwoTTT/HXFXQJG/vBX8sOFagGqvZyXcgLA3NhIqcBv1BJU1d46c0rGcrij2B56Z2rNiSLaZOYW5cUk7yLQ=="],
+    "@esbuild/linux-riscv64": ["@esbuild/linux-riscv64@0.28.2", "", { "os": "linux", "cpu": "none" }, "sha512-GeXCej4IQtU1B+QlDV8W/RRvbzI3O/Stss+/bCXv4lZls5WGRtu2a+3JkA3i4qIUlMXpcHebWpF8AkJhATowuA=="],

-    "@esbuild/linux-s390x": ["@esbuild/linux-s390x@0.28.0", "", { "os": "linux", "cpu": "s390x" }, "sha512-SCfR0HN8CEEjnYnySJTd2cw0k9OHB/YFzt5zgJEwa+wL/T/raGWYMBqwDNAC6dqFKmJYZoQBRfHjgwLHGSrn3Q=="],
+    "@esbuild/linux-s390x": ["@esbuild/linux-s390x@0.28.2", "", { "os": "linux", "cpu": "s390x" }, "sha512-3H1weTYZPxt/WOhByszQZybS9w5lKzUn1FDMsgEChbHWQwHYQQRfBxgCcZvPhjHfKyJjIievvMmEUawJrdY9Dg=="],

-    "@esbuild/linux-x64": ["@esbuild/linux-x64@0.28.0", "", { "os": "linux", "cpu": "x64" }, "sha512-us0dSb9iFxIi8srnpl931Nvs65it/Jd2a2K3qs7fz2WfGPHqzfzZTfec7oxZJRNPXPnNYZtanmRc4AL/JwVzHQ=="],
+    "@esbuild/linux-x64": ["@esbuild/linux-x64@0.28.2", "", { "os": "linux", "cpu": "x64" }, "sha512-4xTZr1FUmSoQW4XIWmit3tzQrUTZM+N3P0XV8xROKYF50XfI7xeO90+1bZvNwxIufQ9hDQVRJH5YhgPVF8A/HQ=="],

-    "@esbuild/netbsd-arm64": ["@esbuild/netbsd-arm64@0.28.0", "", { "os": "none", "cpu": "arm64" }, "sha512-CR/RYotgtCKwtftMwJlUU7xCVNg3lMYZ0RzTmAHSfLCXw3NtZtNpswLEj/Kkf6kEL3Gw+BpOekRX0BYCtklhUw=="],
+    "@esbuild/netbsd-arm64": ["@esbuild/netbsd-arm64@0.28.2", "", { "os": "none", "cpu": "arm64" }, "sha512-sSATRjPeDBg3pdgHoQfoYBob11Kk1FGa9lui5RIHZCoCkJa9QKlvl3/vKz2usCmYYjs7ymJR/2Nnsqe+Hjt5nw=="],

-    "@esbuild/netbsd-x64": ["@esbuild/netbsd-x64@0.28.0", "", { "os": "none", "cpu": "x64" }, "sha512-nU1yhmYutL+fQ71Kxnhg8uEOdC0pwEW9entHykTgEbna2pw2dkbFSMeqjjyHZoCmt8SBkOSvV+yNmm94aUrrqw=="],
+    "@esbuild/netbsd-x64": ["@esbuild/netbsd-x64@0.28.2", "", { "os": "none", "cpu": "x64" }, "sha512-lqnzCV+mM0gIADaKihiCg6ifgfU2L3h5E33rNQBN1Y4MaVGnzryzmvvf7UHxprpQdE8hpqLolJ9Rl+SkIRDpyw=="],

-    "@esbuild/openbsd-arm64": ["@esbuild/openbsd-arm64@0.28.0", "", { "os": "openbsd", "cpu": "arm64" }, "sha512-cXb5vApOsRsxsEl4mcZ1XY3D4DzcoMxR/nnc4IyqYs0rTI8ZKmW6kyyg+11Z8yvgMfAEldKzP7AdP64HnSC/6g=="],
+    "@esbuild/openbsd-arm64": ["@esbuild/openbsd-arm64@0.28.2", "", { "os": "openbsd", "cpu": "arm64" }, "sha512-AL2qJILH7lNjrDmCQDvdxMfAUIv8KMNZOvrwAQ8i8//ntL9FflhOyMJ8OZSMBb8/AWXe3/5v5S20y3zCoZWKoQ=="],

-    "@esbuild/openbsd-x64": ["@esbuild/openbsd-x64@0.28.0", "", { "os": "openbsd", "cpu": "x64" }, "sha512-8wZM2qqtv9UP3mzy7HiGYNH/zjTA355mpeuA+859TyR+e+Tc08IHYpLJuMsfpDJwoLo1ikIJI8jC3GFjnRClzA=="],
+    "@esbuild/openbsd-x64": ["@esbuild/openbsd-x64@0.28.2", "", { "os": "openbsd", "cpu": "x64" }, "sha512-QtiuPytchRyC4rwUKhexJdQKvDuZ6hWloi3igqPQNUJCS1/v9EiO3UTOXR6A3FoMo4fnAKbWJdqaIwhOzh8qEw=="],

-    "@esbuild/openharmony-arm64": ["@esbuild/openharmony-arm64@0.28.0", "", { "os": "none", "cpu": "arm64" }, "sha512-FLGfyizszcef5C3YtoyQDACyg95+dndv79i2EekILBofh5wpCa1KuBqOWKrEHZg3zrL3t5ouE5jgr94vA+Wb2w=="],
+    "@esbuild/openharmony-arm64": ["@esbuild/openharmony-arm64@0.28.2", "", { "os": "none", "cpu": "arm64" }, "sha512-WkhYDmpTjLvGlScA1rwjRUmhl4k8oXR3cIbtqWmELgU/dFeHHlEllxDvdWcNJV9rbzCexB5vz8gtNewWLgCT7Q=="],

-    "@esbuild/sunos-x64": ["@esbuild/sunos-x64@0.28.0", "", { "os": "sunos", "cpu": "x64" }, "sha512-1ZgjUoEdHZZl/YlV76TSCz9Hqj9h9YmMGAgAPYd+q4SicWNX3G5GCyx9uhQWSLcbvPW8Ni7lj4gDa1T40akdlw=="],
+    "@esbuild/sunos-x64": ["@esbuild/sunos-x64@0.28.2", "", { "os": "sunos", "cpu": "x64" }, "sha512-GPMSkTOtMnv2U2F8gxe4Io6qmVs+YKyp832Etqqxr0hFngmXQ3rzwytelm3GIn7T4VviRUlf3sOgBOiTdvaf7g=="],

-    "@esbuild/win32-arm64": ["@esbuild/win32-arm64@0.28.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-Q9StnDmQ/enxnpxCCLSg0oo4+34B9TdXpuyPeTedN/6+iXBJ4J+zwfQI28u/Jl40nOYAxGoNi7mFP40RUtkmUA=="],
+    "@esbuild/win32-arm64": ["@esbuild/win32-arm64@0.28.2", "", { "os": "win32", "cpu": "arm64" }, "sha512-PIhhEkE9uPBleRBrQEJpUn7MBnibZzbGzYWPmY3x+YoVg/95zbjB4CxPPOQ8l5tYYM4mMaCthF8/1DIfBQQyWQ=="],

-    "@esbuild/win32-ia32": ["@esbuild/win32-ia32@0.28.0", "", { "os": "win32", "cpu": "ia32" }, "sha512-zF3ag/gfiCe6U2iczcRzSYJKH1DCI+ByzSENHlM2FcDbEeo5Zd2C86Aq0tKUYAJJ1obRP84ymxIAksZUcdztHA=="],
+    "@esbuild/win32-ia32": ["@esbuild/win32-ia32@0.28.2", "", { "os": "win32", "cpu": "ia32" }, "sha512-YmJbfTlvU7Sdn9BB+4PRES4oB6pxgS37MAONj+hBr/cpXS1aBPKXxNnDbu+QCWPj0o9dgyxeq79g6c5P8KeuYA=="],

-    "@esbuild/win32-x64": ["@esbuild/win32-x64@0.28.0", "", { "os": "win32", "cpu": "x64" }, "sha512-pEl1bO9mfAmIC+tW5btTmrKaujg3zGtUmWNdCw/xs70FBjwAL3o9OEKNHvNmnyylD6ubxUERiEhdsL0xBQ9efw=="],
+    "@esbuild/win32-x64": ["@esbuild/win32-x64@0.28.2", "", { "os": "win32", "cpu": "x64" }, "sha512-5ebpxr3nWMzrL/rnUI755Jkuee0bHL/Gq0WTF9lvcpv73wAp5eu8MfBUgWK9bhWvZjj7yX8etf/8tI8Ney695g=="],

    "@jridgewell/gen-mapping": ["@jridgewell/gen-mapping@0.3.13", "", { "dependencies": { "@jridgewell/sourcemap-codec": "^1.5.0", "@jridgewell/trace-mapping": "^0.3.24" } }, "sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA=="],

@@ -211,7 +211,7 @@

    "diff": ["diff@5.2.2", "", {}, "sha512-vtcDfH3TOjP8UekytvnHH1o1P4FcUdt4eQ1Y+Abap1tk/OB2MWQvcwS2ClCd1zuIhc3JKOx6p3kod8Vfys3E+A=="],

-    "esbuild": ["esbuild@0.28.0", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.28.0", "@esbuild/android-arm": "0.28.0", "@esbuild/android-arm64": "0.28.0", "@esbuild/android-x64": "0.28.0", "@esbuild/darwin-arm64": "0.28.0", "@esbuild/darwin-x64": "0.28.0", "@esbuild/freebsd-arm64": "0.28.0", "@esbuild/freebsd-x64": "0.28.0", "@esbuild/linux-arm": "0.28.0", "@esbuild/linux-arm64": "0.28.0", "@esbuild/linux-ia32": "0.28.0", "@esbuild/linux-loong64": "0.28.0", "@esbuild/linux-mips64el": "0.28.0", "@esbuild/linux-ppc64": "0.28.0", "@esbuild/linux-riscv64": "0.28.0", "@esbuild/linux-s390x": "0.28.0", "@esbuild/linux-x64": "0.28.0", "@esbuild/netbsd-arm64": "0.28.0", "@esbuild/netbsd-x64": "0.28.0", "@esbuild/openbsd-arm64": "0.28.0", "@esbuild/openbsd-x64": "0.28.0", "@esbuild/openharmony-arm64": "0.28.0", "@esbuild/sunos-x64": "0.28.0", "@esbuild/win32-arm64": "0.28.0", "@esbuild/win32-ia32": "0.28.0", "@esbuild/win32-x64": "0.28.0" }, "bin": "bin/esbuild" }, "sha512-sNR9MHpXSUV/XB4zmsFKN+QgVG82Cc7+/aaxJ8Adi8hyOac+EXptIp45QBPaVyX3N70664wRbTcLTOemCAnyqw=="],
+    "esbuild": ["esbuild@0.28.2", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.28.2", "@esbuild/android-arm": "0.28.2", "@esbuild/android-arm64": "0.28.2", "@esbuild/android-x64": "0.28.2", "@esbuild/darwin-arm64": "0.28.2", "@esbuild/darwin-x64": "0.28.2", "@esbuild/freebsd-arm64": "0.28.2", "@esbuild/freebsd-x64": "0.28.2", "@esbuild/linux-arm": "0.28.2", "@esbuild/linux-arm64": "0.28.2", "@esbuild/linux-ia32": "0.28.2", "@esbuild/linux-loong64": "0.28.2", "@esbuild/linux-mips64el": "0.28.2", "@esbuild/linux-ppc64": "0.28.2", "@esbuild/linux-riscv64": "0.28.2", "@esbuild/linux-s390x": "0.28.2", "@esbuild/linux-x64": "0.28.2", "@esbuild/netbsd-arm64": "0.28.2", "@esbuild/netbsd-x64": "0.28.2", "@esbuild/openbsd-arm64": "0.28.2", "@esbuild/openbsd-x64": "0.28.2", "@esbuild/openharmony-arm64": "0.28.2", "@esbuild/sunos-x64": "0.28.2", "@esbuild/win32-arm64": "0.28.2", "@esbuild/win32-ia32": "0.28.2", "@esbuild/win32-x64": "0.28.2" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-HKVLS8dvII+xoKW9kmqxbRKrnWEXfJJr/FZhhJmiqIB0e053QNYFqOBouTMO/k5sID4MvCiUCvv8b9M4h32wIA=="],

    "esm-env": ["esm-env@1.2.2", "", {}, "sha512-Epxrv+Nr/CaL4ZcFGPJIYLWFom+YeV1DqMLHJoEd9SYRxNbaFruBwfEX/kkHUJf55j2+TUbmDcmuilbP1TmXHA=="],

@@ -321,7 +321,7 @@

    "windmill-yaml-validator": ["windmill-yaml-validator@1.1.1", "", { "dependencies": { "@stoplight/yaml": "^4.3.0", "ajv": "^8.17.1" } }, "sha512-CVgAwEoBdJhF39q2N012QffhlGPRIyIWd8gj7NnfG+/lMWgH2k5CBLtKIt6cPF8Bxz+6DGC3st1ARSsecDtbTg=="],

-    "ws": ["ws@8.18.0", "", { "peerDependencies": { "bufferutil": "^4.0.1", "utf-8-validate": ">=5.0.2" }, "optionalPeers": ["bufferutil", "utf-8-validate"] }, "sha512-8VbfWfHLbbwu3+N6OKsOMpBdT4kXPDDB9cJk2bJ6mh9ucxdlnNvH1e+roYkKmN9Nxw2yjz7VzeO9oOz2zJ04Pw=="],
+    "ws": ["ws@8.21.3", "", { "peerDependencies": { "bufferutil": "^4.0.1", "utf-8-validate": ">=5.0.2" }, "optionalPeers": ["bufferutil", "utf-8-validate"] }, "sha512-201TZ/kPWxoPr/OKWjquZR1SWKXcvxdH+e1xrx89b3YbmzLMFCLfnaG1HFIgWzJOEWZ7MvpK++odZufgYR50Rw=="],

    "wsl-utils": ["wsl-utils@0.1.0", "", { "dependencies": { "is-wsl": "^3.1.0" } }, "sha512-h3Fbisa2nKGPxCpm89Hk33lBLsnaGBvctQopaBSOW/uIs6FTe1ATyAnKFJrzVs9vpGdsTe73WF3V4lIsk4Gacw=="],

@@ -23,7 +23,7 @@
    "@cliffy/table": "npm:@jsr/cliffy__table@1.0.0",
    "@windmill-labs/shared-utils": "^1.0.13",
    "diff": "^5.2.0",
-    "esbuild": "0.28.0",
+    "esbuild": "0.28.2",
    "get-port": "7.1.0",
    "jszip": "3.8.0",
    "minimatch": "^10.0.0",
@@ -46,7 +46,7 @@
    "windmill-parser-wasm-ts": "1.695.0",
    "windmill-parser-wasm-yaml": "1.770.0",
    "windmill-yaml-validator": "1.1.1",
-    "ws": "8.18.0",
+    "ws": "8.21.3",
    "yaml": "^2.7.0"
  },
  "devDependencies": {
@@ -2546,9 +2546,9 @@ export function preservePendingScriptLocks(
 }

 // `sync push` never applies the workspace's display name from settings.yaml and
-// applies its color only when the local file carries one (see
-// pushWorkspaceSettings), so on a push the fields it would not apply must
-// compare equal, or the row is listed on every run.
+// applies its color and auto_invite.instance_groups only when the local file
+// carries them (see pushWorkspaceSettings), so on a push the fields it would not
+// apply must compare equal, or the row is listed on every run.
 const isWorkspaceSettingsFile = (p: string) =>
  /^settings(\.[^./\\]+)?\.(yaml|json)$/.test(p);
 function stripUnappliedSettingsFields(local: any, remote: any) {
@@ -2558,6 +2558,20 @@ function stripUnappliedSettingsFields(local: any, remote: any) {
    delete local?.color;
    delete remote?.color;
  }
+  // push reads a missing auto_invite as {} on both sides
+  if (local) local.auto_invite ??= {};
+  if (remote) remote.auto_invite ??= {};
+  const localInvite = local?.auto_invite;
+  const remoteInvite = remote?.auto_invite;
+  if (localInvite?.instance_groups == null) {
+    for (const invite of [localInvite, remoteInvite]) {
+      delete invite?.instance_groups;
+      delete invite?.instance_groups_roles;
+    }
+  } else {
+    localInvite.instance_groups_roles ??= {};
+    if (remoteInvite) remoteInvite.instance_groups_roles ??= {};
+  }
 }

 export async function compareDynFSElement(
@@ -239,7 +239,6 @@ async function createWorkspaceFork(
  interface ForkedDatatableInfo {
    name: string;
    new_dbname: string;
-    fork_behavior?: "schema_only" | "schema_and_data";
  }
  const forkedDatatables: ForkedDatatableInfo[] = [];

@@ -286,23 +285,6 @@ async function createWorkspaceFork(

        const newDbName = `${trueWorkspaceId.replace(/-/g, "_")}__${dt.name}`;

-        const forkBehavior = dtBehavior as "schema_only" | "schema_and_data";
-        // A server that reports `permissioned` copies each data table in the fork request itself,
-        // and refuses a database copied beforehand. An older one only takes a database copied here.
-        if (typeof dt.permissioned === "boolean") {
-          log.info(
-            colors.blue(
-              `  Datatable "${dt.name}" will be cloned (${forkBehavior === "schema_only" ? "schema" : "schema + data"}) into "${newDbName}" when the fork is created.`
-            )
-          );
-          forkedDatatables.push({
-            name: dt.name,
-            new_dbname: newDbName,
-            fork_behavior: forkBehavior,
-          });
-          continue;
-        }
-
        try {
          log.info(
            colors.blue(`  Creating database "${newDbName}" for datatable "${dt.name}"...`)
@@ -318,7 +300,7 @@ async function createWorkspaceFork(

          log.info(
            colors.blue(
-              `  Importing ${forkBehavior === "schema_only" ? "schema" : "schema + data"}...`
+              `  Importing ${dtBehavior === "schema_only" ? "schema" : "schema + data"}...`
            )
          );

@@ -328,7 +310,7 @@ async function createWorkspaceFork(
              source: `datatable://${dt.name}`,
              target: `datatable://${dt.name}`,
              target_dbname_override: newDbName,
-              fork_behavior: forkBehavior,
+              fork_behavior: dtBehavior as "schema_only" | "schema_and_data",
            },
          });

@@ -354,8 +336,6 @@ async function createWorkspaceFork(
        id: trueWorkspaceId,
        name: opts.createWorkspaceName ?? workspaceName ?? trueWorkspaceId,
        color: forkColor,
-        // So a clone the fork would refuse is refused before any branch is created.
-        forked_datatables: forkedDatatables,
      },
    });
    if (gitSyncJobIds && gitSyncJobIds.length > 0) {
@@ -10,4 +10,4 @@ export const WM_FORK_PREFIX = "wm-fork";
 // (e.g. utils.ts) can read it without importing main.ts and creating a circular
 // dependency (main → workspace → utils → main) that triggers a TDZ.
 // Re-exported from main.ts for backwards compatibility.
-export const VERSION = "1.814.0";
+export const VERSION = "1.815.0";
@@ -239,8 +239,19 @@ export async function pushWorkspaceSettings(
    });
  }

-  // Handle auto_invite using grouped format
-  if (!deepEqual(localSettings.auto_invite, settings.auto_invite)) {
+  // Handle auto_invite using grouped format. The domain invite and the instance groups
+  // are applied by separate endpoints, each rewriting only its own keys.
+  const {
+    instance_groups: localGroups,
+    instance_groups_roles: localGroupRoles,
+    ...localDomainInvite
+  } = localSettings.auto_invite ?? {};
+  const {
+    instance_groups: remoteGroups,
+    instance_groups_roles: remoteGroupRoles,
+    ...remoteDomainInvite
+  } = settings.auto_invite ?? {};
+  if (!deepEqual(localDomainInvite, remoteDomainInvite)) {
    log.debug(`Updating auto invite...`);

    const localAutoInvite = localSettings.auto_invite;
@@ -278,6 +289,20 @@ export async function pushWorkspaceSettings(
    }
  }

+  // Only when settings.yaml declares instance_groups: clearing a group removes the
+  // workspace members it granted, so an absent key must never clear it.
+  if (
+    localGroups != undefined &&
+    (!deepEqual(localGroups, remoteGroups) ||
+      !deepEqual(localGroupRoles ?? {}, remoteGroupRoles ?? {}))
+  ) {
+    log.debug(`Updating instance groups...`);
+    await wmill.editInstanceGroups({
+      workspace,
+      requestBody: { groups: localGroups, roles: localGroupRoles ?? {} },
+    });
+  }
+
  if (!deepEqual(localSettings.ai_config, settings.ai_config)) {
    log.debug(`Updating copilot settings...`);
    await wmill.editCopilotConfig({
@@ -25,7 +25,7 @@ type Esbuild = typeof import("esbuild");

 // Version to fall back to if the native host's version can't be read. Keep in
 // sync with the "esbuild" pin in cli/package.json.
-const FALLBACK_VERSION = "0.28.0";
+const FALLBACK_VERSION = "0.28.2";

 let cached: Esbuild | undefined;
 let inFlight: Promise<Esbuild> | undefined;
@@ -320,3 +320,29 @@ test("push: settings.yaml differing only by name or an unset color is not a chan
  });
  expect(await diff(otherColor, remote, skips)).toEqual(["edited settings.yaml"]);
 });
+
+// A push applies auto_invite.instance_groups only when the local file declares
+// them (see pushWorkspaceSettings).
+test("push: settings.yaml without instance_groups is not a change", async () => {
+  const remote = local({
+    "settings.yaml":
+      "name: prod\nauto_invite:\n  enabled: false\n  instance_groups:\n    - eng\n  instance_groups_roles:\n    eng: developer\n",
+  });
+  const undeclared = local({
+    "settings.yaml": "name: prod\nauto_invite:\n  enabled: false\n",
+  });
+  const skips = { includeSettings: true };
+  expect(await diff(undeclared, remote, skips)).toEqual([]);
+
+  const groupsOnlyRemote = local({
+    "settings.yaml": "name: prod\nauto_invite:\n  instance_groups:\n    - eng\n",
+  });
+  const noAutoInvite = local({ "settings.yaml": "name: prod\n" });
+  expect(await diff(noAutoInvite, groupsOnlyRemote, skips)).toEqual([]);
+
+  const otherGroups = local({
+    "settings.yaml":
+      "name: prod\nauto_invite:\n  enabled: false\n  instance_groups: []\n",
+  });
+  expect(await diff(otherGroups, remote, skips)).toEqual(["edited settings.yaml"]);
+});
@@ -0,0 +1,82 @@
+/**
+ * Regression guard: `sync push` (pushWorkspaceSettings) applies the domain invite and
+ * the instance groups of `auto_invite` through their own endpoints, and never clears
+ * instance groups that settings.yaml does not declare.
+ */
+
+import { expect, test, describe, beforeEach, mock } from "bun:test";
+
+let editAutoInviteCalls: unknown[] = [];
+let editInstanceGroupsCalls: unknown[] = [];
+const remoteAutoInvite = {
+  enabled: true,
+  domain: "*",
+  operator: false,
+  mode: "invite",
+  instance_groups: ["eng"],
+  instance_groups_roles: { eng: "developer" },
+};
+
+// Every wmill.* call reachable from pushWorkspaceSettings is stubbed: bun shares one
+// mocked module across test files, and names missing from whichever mock loads first
+// stay missing for the others.
+mock.module("../gen/services.gen.ts", () => ({
+  getSettings: async () => ({ auto_invite: remoteAutoInvite }),
+  getWorkspaceName: async () => "phoenix",
+  changeWorkspaceName: async () => {},
+  changeWorkspaceColor: async () => {},
+  editWebhook: async () => {},
+  editAutoInvite: async (a: unknown) => {
+    editAutoInviteCalls.push(a);
+  },
+  editInstanceGroups: async (a: unknown) => {
+    editInstanceGroupsCalls.push(a);
+  },
+  editErrorHandler: async () => {},
+  editSuccessHandler: async () => {},
+  editCopilotConfig: async () => {},
+  editLargeFileStorageConfig: async () => {},
+  editWorkspaceGitSyncConfig: async () => {},
+  editWorkspaceDefaultApp: async () => {},
+  editDefaultScripts: async () => {},
+  workspaceMuteCriticalAlertsUi: async () => {},
+  updateOperatorSettings: async () => {},
+  editDataTableConfig: async () => {},
+  editSlackCommand: async () => {},
+  setWorkspaceSlackOauthConfig: async () => {},
+  deleteWorkspaceSlackOauthConfig: async () => {},
+}));
+
+const { pushWorkspaceSettings } = await import("../src/core/settings.ts");
+
+describe("pushWorkspaceSettings auto_invite", () => {
+  beforeEach(() => {
+    editAutoInviteCalls = [];
+    editInstanceGroupsCalls = [];
+  });
+
+  test("an instance-group-only change updates the groups and leaves the domain invite", async () => {
+    await pushWorkspaceSettings("phoenix", "settings", undefined, {
+      name: "phoenix",
+      auto_invite: { ...remoteAutoInvite, instance_groups_roles: { eng: "admin" } },
+    });
+    expect(editAutoInviteCalls.length).toBe(0);
+    expect(editInstanceGroupsCalls).toEqual([
+      {
+        workspace: "phoenix",
+        requestBody: { groups: ["eng"], roles: { eng: "admin" } },
+      },
+    ]);
+  });
+
+  test("a settings.yaml without instance_groups does not clear them", async () => {
+    const { instance_groups: _g, instance_groups_roles: _r, ...domainInvite } =
+      remoteAutoInvite;
+    await pushWorkspaceSettings("phoenix", "settings", undefined, {
+      name: "phoenix",
+      auto_invite: { ...domainInvite, operator: true },
+    });
+    expect(editAutoInviteCalls.length).toBe(1);
+    expect(editInstanceGroupsCalls.length).toBe(0);
+  });
+});
@@ -31,6 +31,7 @@ mock.module("../gen/services.gen.ts", () => ({
    editWebhookCalls.push(a);
  },
  editAutoInvite: async () => {},
+  editInstanceGroups: async () => {},
  editErrorHandler: async () => {},
  editSuccessHandler: async () => {},
  editCopilotConfig: async () => {},
@@ -110,11 +110,12 @@ WORKDIR /multiplayer

 # Copy multiplayer server files
 COPY multiplayer/package.json .
+COPY multiplayer/package-lock.json .
 COPY multiplayer/server.mjs .
 COPY multiplayer/gateway.mjs .

 # Install dependencies
-RUN npm install
+RUN npm ci --omit=dev

 # ============================================================================
 # Entrypoint Setup
@@ -12,14 +12,36 @@ Symbols, not line numbers, are cited: they drift less.
  by `create_session_token` (`windmill-api-users/src/users.rs`). `GET /api/users/refresh_token`
  mints one for any non-job token but returns plain text, no redirect.
 - **`tokens/impersonate`** (superadmin) returns a multi-use token and sets no cookie.
- **A token's label decides whether its expiry raises alerts.** When `delete_expired_items`
-  removes an expired `token` row, the monitor emails the owner and raises a critical alert (if
-  enabled); rows registered by `register_token_expiry_notification` also get an "expiring soon"
-  warning first. Neither happens when `is_user_token` (`windmill-common/src/auth.rs`) reserves
-  the label, so a token the system mints for itself, whether from the backend or from the frontend
-  through `tokens/create`, needs a reserved label. An `ephemeral-` prefix needs no other change
-  (keep it clear of `is_server_minted_label` if minted through `tokens/create`); a new prefix
-  also goes into the SQL and Svelte mirrors that function's doc lists.
+- **`max_token_expiration_days`** caps `POST /users/tokens/create` and `tokens/impersonate`, by
+  shortening the stored expiration (`cap_token_expiration`), never by refusing: the CLI
+  authorization page, `wmill user create-token` and the editor's language-server token all pick a
+  lifetime without reading the setting, and CLIs already installed never will. The CLI signs in
+  again on its own when its token expires, which is why the authorization page labels it
+  `cli-login:<username>`, reserved in `is_user_token` so its expiry does not email the user. A token
+  owned by a service account is exempt: one in the workspace the token names, or in any workspace
+  for a workspace-less token (for `tokens/impersonate`, the impersonated account). Any workspace
+  admin can therefore create and impersonate a service account to hold an uncapped token, so the
+  ceiling bounds personal tokens only. Only the stored expiration is capped: the auth lookup never
+  reads the setting, so tokens that exist when it is turned on or lowered keep theirs, including
+  none. Deliberately outside it: server-side mints (`create_token_internal` callers such as native
+  trigger webhook tokens, which never expire for GitHub and Nextcloud), and tokens with their own
+  fixed lifetime that outlive a short ceiling: sessions (`MAX_SESSION_VALIDITY_SECONDS`, 3 days, and
+  re-mintable through `GET /users/refresh_token`) and MCP OAuth access tokens (7 days, with a
+  rotating 30-day refresh token). Any logged-in user can read the setting through `GET
+  /settings/global/{key}`, which the token form uses to offer only expirations within it. The
+  settings API and config sync reject any value `parse_max_token_expiration_days` cannot read, since
+  the token routes would read it as no ceiling; `parseMaxTokenExpirationDays` in the frontend must
+  accept exactly the same values.
+- **A token's label decides whether its expiry raises alerts.** When `delete_expired_items` removes
+  an expired `token` row, the monitor emails the owner and raises a critical alert (if enabled);
+  rows registered by `register_token_expiry_notification` also get an "expiring soon" warning first,
+  except a token whose whole lifetime fits in `TOKEN_EXPIRY_WARNING_DAYS` (7), which gets no row
+  since the warning would arrive minutes after it was created. Neither happens when `is_user_token`
+  (`windmill-common/src/auth.rs`) reserves the label, so a token the system mints for itself,
+  whether from the backend or from the frontend through `tokens/create`, needs a reserved label. An
+  `ephemeral-` prefix needs no other change (keep it clear of `is_server_minted_label` if minted
+  through `tokens/create`); a new prefix also goes into the SQL and Svelte mirrors that function's
+  doc lists.
 - **Every superadmin route refuses a job token**: `require_super_admin`
  (`windmill-api-auth/src/lib.rs`) errors on `authed.job_id.is_some()`. A script that needs
  `users/create`, `tokens/impersonate`, `set_login_type`, … must use a dedicated superadmin user
@@ -29,8 +51,10 @@ Symbols, not line numbers, are cited: they drift less.
  the account into a `password` one in the same statement (an account created ahead of its owner
  gets its first credential that way, or through the OAuth claim below).
 - **Login links** (`login_link` table, `POST /users/login_links` superadmin-only,
-  `GET /auth/login_link/{token}` unauthenticated): single-use, ≤15 min, a session cookie and a
-  302 to a same-origin `rd`. `require_login_type` on the mint refuses (409) an account whose
+  `GET /auth/login_link/{token}` unauthenticated): single-use, ≤2 h, a session cookie and a
+  302 to a same-origin `rd`. A link minted with `confirm` is the `/user/login_link` page
+  instead, which spends it only on a click (`POST` to the same path, answering `{location}`), so
+  a mail scanner opening it does not. `require_login_type` on the mint refuses (409) an account whose
  `login_type` has moved on — the way a caller re-entering an account it created stops being
  able to once the owner has a password or a provider.
 - **Pre-approved trial offer** (`cloud_trial_offer`, cloud-only routes under
@@ -1,6 +1,6 @@
 {
 	"name": "@windmill-labs/components",
-	"version": "1.814.0",
+	"version": "1.815.0",
 	"scripts": {
 		"dev": "vite dev",
 		"dev:ui-builder": "mv static/ui_builder static/ui_builder.dev-disabled 2>/dev/null || true ; trap 'mv static/ui_builder.dev-disabled static/ui_builder 2>/dev/null || true' EXIT ; vite dev",
@@ -28,14 +28,13 @@
 		"@melt-ui/svelte": "^0.86.2",
 		"@playwright/test": "^1.57.0",
 		"@sveltejs/adapter-static": "^3.0.6",
-		"@sveltejs/kit": "^2.53.4",
+		"@sveltejs/kit": "^2.69.1",
 		"@sveltejs/package": "^2.5.7",
 		"@sveltejs/vite-plugin-svelte": "^7.0.0",
 		"@tailwindcss/forms": "^0.5.3",
 		"@tailwindcss/typography": "^0.5.8",
 		"@types/d3": "^7.4.0",
 		"@types/d3-zoom": "^3.0.3",
-		"@types/diff": "^7.0.1",
 		"@types/lodash": "^4.14.195",
 		"@types/vscode": "^1.83.5",
 		"@typescript-eslint/eslint-plugin": "^5.59.8",
@@ -59,7 +58,7 @@
 		"prettier-plugin-svelte": "^3.3.3",
 		"style-to-object": "^0.4.1",
 		"stylelint-config-recommended": "^13.0.0",
-		"svelte": "^5.53.5",
+		"svelte": "^5.55.7",
 		"svelte-awesome-color-picker": "^3.0.4",
 		"svelte-check": "^4.4.3",
 		"svelte-fast-check": "^0.4.5",
@@ -70,19 +69,22 @@
 		"svelte-range-slider-pips": "^2.3.1",
 		"svelte-splitpanes": "^8.0.9",
 		"tailwindcss": "^3.4.1",
-		"tar": "^7.5.4",
+		"tar": "^7.5.18",
 		"tslib": "^2.6.1",
 		"typescript": "^5.5.0",
 		"vite": "^8.2.0",
 		"vite-plugin-mkcert": "^2.0.0",
-		"vitest": "^4.1.0",
+		"vitest": "^4.1.11",
 		"vitest-browser-svelte": "^2.0.1"
 	},
 	"overrides": {
 		"monaco-graphql": {
 			"monaco-editor": "$monaco-editor"
 		},
-		"tar": "$tar"
+		"tar": "$tar",
+		"dompurify": "$dompurify",
+		"cookie": "^0.7.0",
+		"handlebars": "^4.7.9"
 	},
 	"type": "module",
 	"dependencies": {
@@ -117,8 +119,8 @@
 		"clone": "^2.1.2",
 		"d3-zoom": "^3.0.0",
 		"date-fns": "^2.30.0",
-		"diff": "^7.0.0",
-		"dompurify": "^3.3.1",
+		"diff": "^8.0.3",
+		"dompurify": "^3.4.13",
 		"driver.js": "^1.3.0",
 		"esm-env": "^1.0.0",
 		"fast-equals": "^5.0.1",
@@ -130,8 +132,8 @@
 		"lru-cache": "^11.1.0",
 		"lucide-svelte": "^0.540.0",
 		"mdast-util-find-and-replace": "^3.0.2",
-		"mermaid": "^11.15.0",
-		"minimatch": "^10.0.1",
+		"mermaid": "^11.16.1",
+		"minimatch": "^10.2.3",
 		"modern-screenshot": "^4.7.0",
 		"monaco-editor": "npm:@codingame/monaco-vscode-editor-api@=25.0.0",
 		"monaco-languageclient": "10.6.0",
@@ -178,7 +180,7 @@
 		"xterm-readline": "^1.1.2",
 		"y-monaco": "^0.1.4",
 		"y-websocket": "^1.5.4",
-		"yaml": "^2.8.0",
+		"yaml": "^2.8.3",
 		"yjs": "^13.6.7",
 		"zod": "^4.1.10"
 	},
@@ -3,7 +3,10 @@
@tailwind components;
@tailwind utilities;

-@media (min-width: 1760px) {
+/* Keyed on the screen, not the window: a viewport query rescales the whole app
+   whenever the window is resized or split. Mirrored in editorFontSize.svelte.ts,
+   TextInput.svelte's leading classes and FlowGraphPreviewButton.svelte. */
+@media (min-device-width: 1760px) {
 	:root {
 		font-size: 18px;
 	}
@@ -1,281 +0,0 @@
-<script lang="ts">
-	import type { GraphModuleState } from './graph'
-	import {
-		JobService,
-		type CompletedJob,
-		type FlowModule,
-		type FlowStatusModule,
-		type Job
-	} from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
-	import FlowLogViewerWrapper from './FlowLogViewerWrapper.svelte'
-	import { z } from 'zod'
-	import { untrack } from 'svelte'
-	import type { AgentTool } from './flows/agentToolUtils'
-
-	type AgentActionWithContent = NonNullable<FlowStatusModule['agent_actions']>[number] & {
-		content?: unknown
-	}
-
-	const resultSchema = z.object({
-		messages: z.array(
-			z.object({
-				role: z.string(),
-				content: z.unknown(),
-				agent_action: z
-					.union([
-						z.object({
-							type: z.literal('tool_call'),
-							job_id: z.string(),
-							module_id: z.string(),
-							function_name: z.string()
-						}),
-						z.object({
-							type: z.literal('mcp_tool_call'),
-							call_id: z.string(),
-							function_name: z.string(),
-							resource_path: z.string(),
-							arguments: z.record(z.any(), z.any()).optional()
-						}),
-						z.object({
-							type: z.literal('message')
-						}),
-						z.object({
-							type: z.literal('web_search')
-						})
-					])
-					.optional()
-			})
-		)
-	})
-
-	interface Props {
-		tools: AgentTool[]
-		agentJob: Partial<CompletedJob> & Pick<CompletedJob, 'id'> & { type: 'CompletedJob' }
-		workspaceId?: string | undefined
-		storedToolCallJobs?: Record<number, Job>
-		onToolJobLoaded?: (job: Job, idx: number) => void
-		noPadding?: boolean
-	}
-
-	let {
-		tools,
-		agentJob,
-		workspaceId,
-		onToolJobLoaded,
-		storedToolCallJobs,
-		noPadding = false
-	}: Props = $props()
-
-	const fakeModuleStates: Record<string, GraphModuleState> = $state({})
-
-	async function loadMissingJobs(
-		agentActions: AgentActionWithContent[],
-		gen: number
-	): Promise<Record<string, GraphModuleState>> {
-		const states: Record<string, GraphModuleState> = {}
-		const promises = agentActions.map(async (toolCall, idx) => {
-			if (toolCall.type === 'tool_call') {
-				let job: Job | undefined = storedToolCallJobs?.[idx]
-
-				if (!job || job.type !== 'CompletedJob') {
-					job = await JobService.getJob({
-						id: toolCall.job_id,
-						workspace: workspaceId ?? $workspaceStore!
-					})
-				}
-				states[idx.toString()] = {
-					args: job.args,
-					type: job['success'] ? 'Success' : 'Failure',
-					logs: job.logs,
-					result: job['result'],
-					job_id: toolCall.job_id
-				}
-				// Keyed by index in the parent's cache, so a superseded run must not write into it.
-				if (gen === loadGen) {
-					onToolJobLoaded?.(job, idx)
-				}
-			} else if (toolCall.type === 'mcp_tool_call') {
-				states[idx.toString()] = {
-					type: 'Success',
-					args: toolCall.arguments ?? {},
-					logs: '',
-					result: toolCall.content
-				}
-			} else if (toolCall.type === 'web_search') {
-				states[idx.toString()] = {
-					type: 'Success',
-					args: {},
-					logs: '',
-					result: toolCall.content
-				}
-			} else {
-				states[idx.toString()] = {
-					type: 'Success',
-					args: {},
-					logs: '',
-					result: toolCall.content
-				}
-			}
-		})
-
-		await Promise.all(promises)
-		return states
-	}
-
-	let job: Partial<Job> | undefined = $state(undefined)
-	// Every prop change starts another load; only the newest may write the shared view, else a
-	// slower reload for a previous run restores its logs over the one now selected.
-	let loadGen = 0
-	async function loadToolCalls(agentJob: Props['agentJob'], tools: AgentTool[]) {
-		const gen = ++loadGen
-		let parsedResult = resultSchema.safeParse(agentJob.result)
-		if (!parsedResult.success) {
-			console.error('Invalid result', parsedResult.error)
-			// A failed agent job has no parseable action list. Drop the view rather than leave the
-			// previously selected step's tool tree rendered under this one's header.
-			if (gen === loadGen) {
-				job = undefined
-				for (const key of Object.keys(fakeModuleStates)) {
-					delete fakeModuleStates[key]
-				}
-			}
-			return
-		}
-		let agentActions = parsedResult.data.messages
-			.map(
-				(m) =>
-					(m.agent_action?.type === 'message'
-						? {
-								type: 'message',
-								content: m.content
-							}
-						: m.agent_action?.type === 'tool_call'
-							? {
-									type: 'tool_call',
-									job_id: m.agent_action.job_id,
-									module_id: m.agent_action.module_id,
-									function_name: m.agent_action.function_name
-								}
-							: m.agent_action?.type === 'mcp_tool_call'
-								? {
-										type: 'mcp_tool_call',
-										content: m.content,
-										call_id: m.agent_action.call_id,
-										function_name: m.agent_action.function_name,
-										arguments: m.agent_action.arguments
-									}
-								: m.agent_action?.type === 'web_search'
-									? {
-											type: 'web_search',
-											content: m.content
-										}
-									: undefined) as AgentActionWithContent | undefined
-			)
-			.filter((m) => m !== undefined)
-
-		const states = await loadMissingJobs(agentActions, gen)
-		if (gen !== loadGen) {
-			return
-		}
-		for (const key of Object.keys(fakeModuleStates)) {
-			delete fakeModuleStates[key]
-		}
-		Object.assign(fakeModuleStates, states)
-
-		job = {
-			...agentJob,
-			raw_flow: {
-				modules: agentActions
-					.map((toolCall, idx) => {
-						if (toolCall.type === 'message') {
-							return {
-								id: idx.toString(),
-								value: {
-									type: 'identity' as const
-								}
-							}
-						} else if (toolCall.type === 'mcp_tool_call') {
-							return {
-								id: idx.toString(),
-								value: {
-									type: 'identity' as const
-								},
-								summary: toolCall.function_name,
-								arguments: toolCall.arguments
-							}
-						} else if (toolCall.type === 'web_search') {
-							return {
-								id: idx.toString(),
-								value: {
-									type: 'identity' as const
-								},
-								summary: 'Web Search'
-							}
-						} else {
-							const module = tools.find((m) => m.summary === toolCall.function_name)
-							// A definition can be missing for a call that did run: the tool was renamed or
-							// removed since, or it belongs to a linked agent whose resource is no longer
-							// readable. Keep the recorded call — its args, logs and result come from the
-							// child job — rather than dropping it from the history.
-							return module
-								? ({
-										...module,
-										id: idx.toString()
-									} as FlowModule)
-								: ({
-										id: idx.toString(),
-										value: { type: 'identity' as const },
-										summary: toolCall.function_name
-									} as FlowModule)
-						}
-					})
-			}
-		}
-	}
-
-	// Identity, not a summary digest: a refreshed resource can change a tool's path, code or id while
-	// keeping its name and count. The store swaps the array only when its contents actually differ,
-	// so one version per array instance tracks that exactly. An empty list is always the same key,
-	// since callers hand out a fresh [] for it on every render.
-	const toolsVersions = new WeakMap<object, number>()
-	let nextToolsVersion = 0
-	function toolsIdentity(list: AgentTool[]): string {
-		if (list.length === 0) {
-			return 'empty'
-		}
-		let version = toolsVersions.get(list)
-		if (version === undefined) {
-			version = ++nextToolsVersion
-			toolsVersions.set(list, version)
-		}
-		return String(version)
-	}
-
-	// Rebuild when the inputs change, not only on mount: a linked agent's tools resolve
-	// asynchronously after the first render, and switching between completed runs reuses this
-	// component — either would otherwise keep the first snapshot. Keyed by value, because callers
-	// rebuild the `agentJob` object on every render and identity alone would reload in a loop.
-	let reloadKey = $derived(`${agentJob?.id ?? ''}|${toolsIdentity(tools)}`)
-	$effect(() => {
-		reloadKey
-		untrack(() => {
-			if (agentJob) {
-				loadToolCalls(agentJob, tools)
-			}
-		})
-	})
-</script>
-
-{#if job}
-	<div class={noPadding ? '' : 'p-2'}>
-		<FlowLogViewerWrapper
-			{job}
-			localModuleStates={fakeModuleStates}
-			{workspaceId}
-			render={true}
-			onSelectedIteration={async () => {}}
-			mode="aiagent"
-		/>
-	</div>
-{/if}
@@ -0,0 +1,116 @@
+<script lang="ts">
+	import type { Snippet } from 'svelte'
+	import { Badge } from '$lib/components/common'
+	import GfmMarkdown from './GfmMarkdown.svelte'
+	import AgentTrace from './AgentTrace.svelte'
+	import ChatCollapsibleCard from './copilot/chat/ChatCollapsibleCard.svelte'
+	import LabeledDivider from './LabeledDivider.svelte'
+	import WebSearchSourcesDisplay from './copilot/chat/WebSearchSourcesDisplay.svelte'
+	import { buildAgentTrace, splitFinalAnswer } from './agentTrace'
+	import { runPane } from './agentScroll'
+	import { createBottomSticker } from './stickToBottom'
+	import { formatTokenCount, summarizeAgentResult, type AgentResult } from './aiAgentResult'
+
+	interface Props {
+		result: AgentResult
+		workspaceId?: string
+		/** Identifies the run, so a reused viewer lands on the new one's output. */
+		runKey?: string
+		/**
+		 * How to render an output that is not text: whatever the result viewer would do
+		 * with that object on its own, a table for rows or the file viewer for an S3
+		 * object. Passed in rather than imported so this does not reach back into the
+		 * viewer rendering it.
+		 */
+		structuredOutput: Snippet<[unknown]>
+	}
+
+	let { result, workspaceId, runKey, structuredOutput }: Props = $props()
+
+	let summary = $derived(summarizeAgentResult(result))
+	let textOutput = $derived(typeof result.output === 'string' ? result.output : undefined)
+
+	// The turn that produced `output` is not a trace row: the output block below is
+	// that same text, and printing it twice in one scroll reads as the agent having
+	// answered itself. Its citations move down with it.
+	let answer = $derived(splitFinalAnswer(buildAgentTrace(result.messages), result.output))
+	let trace = $derived(answer.trace)
+	let reasoning = $derived(result.reasoning?.trim())
+	let reasoningExpanded = $state(false)
+
+	let anchor: HTMLElement | undefined = $state()
+	const sticker = createBottomSticker()
+	$effect(() => {
+		// Also on arrival from a stream: the run finishing adds the output separator,
+		// so the end has moved from wherever the stream had the reader parked.
+		runKey
+		trace.length
+		reasoning
+		sticker.scrollToEnd(runPane(anchor))
+	})
+</script>
+
+<div bind:this={anchor} class="flex flex-col w-full py-3">
+	{#if trace.length > 0}
+		<AgentTrace entries={trace} {workspaceId} />
+	{/if}
+	{#if reasoning}
+		<!-- The whole run's thinking, which the worker hands back joined rather than
+		     per iteration, so it reads as one block above the answer it led to. -->
+		<ChatCollapsibleCard
+			label="Thinking"
+			expanded={reasoningExpanded}
+			onToggle={() => (reasoningExpanded = !reasoningExpanded)}
+			contentClass="font-main"
+		>
+			<GfmMarkdown md={reasoning} prose="xs" noPadding />
+		</ChatCollapsibleCard>
+	{/if}
+	{#if trace.length > 0 || reasoning}
+		<LabeledDivider class="my-3">
+			<span class="text-2xs text-hint">Output</span>
+		</LabeledDivider>
+	{/if}
+	<div>
+		{#if textOutput !== undefined}
+			{#if textOutput === ''}
+				<span class="text-tertiary text-xs">The agent returned no answer</span>
+			{:else}
+				<!-- A model writes this, and what it writes is steerable by whatever
+					     reached its context — a user message, a tool's output. So it is
+					     untrusted input and goes through the shared sanitizing chain, which
+					     is also what makes it inert on the public replay page. -->
+				<GfmMarkdown md={textOutput} noPadding />
+			{/if}
+		{:else}
+			{@render structuredOutput(result.output)}
+		{/if}
+		{#if answer.sources}
+			<div class="mt-2">
+				<WebSearchSourcesDisplay sources={answer.sources} />
+			</div>
+		{/if}
+	</div>
+
+	<!-- What the run cost, as a footnote to what it produced. -->
+	<div class="flex items-center gap-2 flex-wrap text-xs mt-3">
+		{#if summary.toolCalls > 0}
+			<Badge color="blue">
+				{summary.toolCalls}
+				{summary.toolCalls === 1 ? 'tool call' : 'tool calls'}
+			</Badge>
+		{/if}
+		{#if summary.webSearches > 0}
+			<Badge color="blue">
+				{summary.webSearches}
+				{summary.webSearches === 1 ? 'web search' : 'web searches'}
+			</Badge>
+		{/if}
+		{#if summary.tokens !== undefined}
+			<Badge color="gray">{formatTokenCount(summary.tokens)} tokens</Badge>
+		{/if}
+		{#if summary.cachedTokens}
+			<Badge color="gray">{formatTokenCount(summary.cachedTokens)} cached</Badge>
+		{/if}
+	</div>
+</div>
@@ -0,0 +1,111 @@
+<script lang="ts">
+	import { untrack } from 'svelte'
+	import ChatCollapsibleCard from './copilot/chat/ChatCollapsibleCard.svelte'
+	import GfmMarkdown from './GfmMarkdown.svelte'
+	import { runPane } from './agentScroll'
+	import { createBottomSticker } from './stickToBottom'
+	import {
+		advanceAgentStream,
+		emptyAgentStreamProgress,
+		type AgentStreamProgress
+	} from './aiAgentResult'
+
+	interface Props {
+		/** The raw `result_stream` buffer, which only ever grows for a given run. */
+		raw: string
+		/** Identifies the run, so a viewer reused for another one starts over. */
+		streamKey?: string
+	}
+
+	let { raw, streamKey }: Props = $props()
+
+	let progress: AgentStreamProgress & { key?: string } = $state(emptyAgentStreamProgress())
+
+	$effect(() => {
+		raw
+		streamKey
+		untrack(() => {
+			// A shorter buffer than what was already folded in cannot be a longer
+			// version of the same stream, so treat it as a different one.
+			const continues = progress.key === streamKey && raw.length >= progress.consumed
+			const base = continues ? progress : emptyAgentStreamProgress()
+			progress = { ...advanceAgentStream(raw, base), key: streamKey }
+			if (!continues) {
+				// Another run, so the reader's decision to stop following the previous
+				// one does not carry over: this one starts at its latest output.
+				following = true
+			}
+		})
+	})
+
+	let stream = $derived(progress.stream)
+
+	let anchor: HTMLElement | undefined = $state()
+	// Carry the reader along as the text is written, unless they have scrolled up
+	// to read something — then the pane is theirs until they come back to the end.
+	let following = true
+	const sticker = createBottomSticker()
+
+	// The listener goes on the pane, not on this element: a scroll event fires on
+	// whatever actually scrolled and does not bubble, so a handler here would never
+	// run and the reader would be dragged back on every poll.
+	$effect(() => {
+		const pane = runPane(anchor)
+		if (!pane) {
+			return
+		}
+		const onScroll = () => {
+			if (!sticker.isOwnScroll()) {
+				following = sticker.isAtEnd(pane)
+			}
+		}
+		pane.addEventListener('scroll', onScroll, { passive: true })
+		return () => pane.removeEventListener('scroll', onScroll)
+	})
+
+	$effect(() => {
+		stream.current
+		stream.reasoning
+		stream.entries.length
+		if (following) {
+			sticker.scrollToEnd(runPane(anchor))
+		}
+	})
+</script>
+
+<!-- One gap on the container rather than margins per child, and the same gap the
+     finished trace uses: a turn's text must not shift when a tool call turns it from
+     the live text into a row. The text at the bottom is deliberately unlabelled — a
+     turn that goes on to call a tool was narration, and the run's end settles which. -->
+<div bind:this={anchor} class="flex flex-col w-full py-3 gap-1">
+	{#each stream.entries as entry, index (entry.kind === 'tool' ? entry.callId : index)}
+		{#if entry.kind === 'tool'}
+			<ChatCollapsibleCard
+				label={entry.name}
+				expanded={false}
+				toggleable={false}
+				shimmer={entry.running}
+				onToggle={() => {}}
+				labelClass={entry.success === false ? 'text-red-500' : ''}
+			/>
+		{:else}
+			<div>
+				<GfmMarkdown md={entry.content} noPadding />
+			</div>
+		{/if}
+	{/each}
+
+	{#if stream.current !== ''}
+		<div>
+			<!-- Same sanitizing chain as a finished output: a partial answer is written
+			     by the same model and is no more trusted for arriving in pieces. -->
+			<GfmMarkdown md={stream.current} noPadding />
+		</div>
+	{:else if stream.reasoning !== ''}
+		<!-- Reasoning arrives before the text, so on its own it means the model is
+		     still thinking rather than that this run has nothing to say. -->
+		<div class="text-secondary">
+			<GfmMarkdown md={stream.reasoning} prose="xs" noPadding />
+		</div>
+	{/if}
+</div>
@@ -0,0 +1,135 @@
+<script lang="ts">
+	import { ExternalLink, Globe } from 'lucide-svelte'
+	import { JobService, type Job } from '$lib/gen'
+	import { base } from '$lib/base'
+	import { workspaceStore } from '$lib/stores'
+	import { msToReadableTimeShort } from '$lib/utils'
+	import ChatCollapsibleCard from './copilot/chat/ChatCollapsibleCard.svelte'
+	import ToolContentDisplay from './copilot/chat/ToolContentDisplay.svelte'
+	import WebSearchSourcesDisplay from './copilot/chat/WebSearchSourcesDisplay.svelte'
+	import GfmMarkdown from './GfmMarkdown.svelte'
+	import type { AgentTraceEntry } from './agentTrace'
+	import { SvelteMap, SvelteSet } from 'svelte/reactivity'
+
+	interface Props {
+		entries: AgentTraceEntry[]
+		workspaceId?: string
+	}
+
+	let { entries, workspaceId }: Props = $props()
+
+	let expanded = new SvelteSet<number>()
+	// Row state is keyed by position, which means nothing once the viewer is handed
+	// another run: row 0 would stay open showing the previous run's job.
+	$effect(() => {
+		entries
+		expanded.clear()
+		jobs.clear()
+	})
+	// A tool's own job holds what the envelope does not: its logs, how long it
+	// took, and whether it succeeded. Fetched when a row is opened rather than
+	// upfront, so a run with twenty calls does not issue twenty requests to draw
+	// a list of names.
+	let jobs = new SvelteMap<string, Job | 'loading' | 'failed'>()
+
+	async function loadJob(jobId: string) {
+		if (jobs.has(jobId)) {
+			return
+		}
+		jobs.set(jobId, 'loading')
+		try {
+			jobs.set(
+				jobId,
+				await JobService.getJob({ id: jobId, workspace: workspaceId ?? $workspaceStore! })
+			)
+		} catch {
+			// A tool job can be gone (retention) or unreadable. The row still has its
+			// arguments and result from the envelope, so only the extras are lost.
+			jobs.set(jobId, 'failed')
+		}
+	}
+
+	function toggle(index: number, entry: AgentTraceEntry) {
+		if (expanded.delete(index)) {
+			return
+		}
+		expanded.add(index)
+		if (entry.kind === 'tool' && entry.jobId) {
+			loadJob(entry.jobId)
+		}
+	}
+
+	function jobOf(jobId: string | undefined): Job | undefined {
+		if (!jobId) return undefined
+		const job = jobs.get(jobId)
+		return typeof job === 'object' ? job : undefined
+	}
+
+	function toolLabel(entry: Extract<AgentTraceEntry, { kind: 'tool' }>): string {
+		const job = jobOf(entry.jobId)
+		const duration = job?.['duration_ms']
+		return duration === undefined
+			? entry.name
+			: `${entry.name} · ${msToReadableTimeShort(duration)}`
+	}
+</script>
+
+<div class="flex flex-col w-full min-w-0 gap-1">
+	{#each entries as entry, index (index)}
+		{#if entry.kind === 'assistant'}
+			<div class="min-w-0">
+				<GfmMarkdown md={entry.content} noPadding />
+				{#if entry.sources}
+					<div class="mt-2">
+						<WebSearchSourcesDisplay sources={entry.sources} />
+					</div>
+				{/if}
+			</div>
+		{:else if entry.kind === 'search'}
+			<!-- Nothing to reveal: the worker records only that a search ran, and its
+			     citations render under the assistant turn that follows. -->
+			<ChatCollapsibleCard
+				label="Web search"
+				expanded={false}
+				toggleable={false}
+				onToggle={() => {}}
+			/>
+		{:else}
+			{@const job = jobOf(entry.jobId)}
+			<ChatCollapsibleCard
+				label={toolLabel(entry)}
+				expanded={expanded.has(index)}
+				onToggle={() => toggle(index, entry)}
+				contentClass="space-y-3"
+			>
+				{#if entry.args}
+					<ToolContentDisplay title="Parameters" content={entry.args} toolName={entry.name} />
+				{/if}
+				{#if job?.logs}
+					<ToolContentDisplay title="Logs" content={job.logs} />
+				{/if}
+				<ToolContentDisplay
+					title="Result"
+					content={entry.result}
+					error={job?.type === 'CompletedJob' && !job.success ? entry.result : undefined}
+				/>
+				{#if entry.resourcePath}
+					<div class="text-2xs text-hint flex items-center gap-1">
+						<Globe size={11} />
+						{entry.resourcePath}
+					</div>
+				{:else if entry.jobId}
+					<a
+						class="text-2xs text-accent inline-flex items-center gap-1 w-fit hover:underline"
+						href="{base}/run/{entry.jobId}?workspace={workspaceId ?? $workspaceStore}"
+						target="_blank"
+						rel="noreferrer"
+					>
+						<ExternalLink size={11} />
+						Open job
+					</a>
+				{/if}
+			</ChatCollapsibleCard>
+		{/if}
+	{/each}
+</div>
@@ -39,7 +39,8 @@

 	// Mirrors CUSTOM_TAG_REGEX in backend/windmill-common/src/worker.rs — keep both in sync.
 	const customTagRegex = /^([\w-]+)\(((?:[\w-]+\*?\+)*[\w-]+\*?|(?:\^[\w-]+\*?)+)\)$/
-	const dynamicTagRegex = /\$args\[((?:\w+\.)*\w+)\]/
+	// Mirrors RE_ARG_TAG and RE_FLOW_EXPR_TAG in backend/windmill-queue/src/jobs.rs.
+	const dynamicTagRegex = /\$(args|flow_expr)\[((?:\w+\.)*\w+)\]/

 	function formatWorkspace(w: { id: string; includeForks: boolean }) {
 		return w.includeForks ? `${w.id} (and its forks)` : w.id
@@ -49,7 +50,7 @@
 		let r = newTag.trim()
 		if (r == '') return undefined
 		let matched = r.match(dynamicTagRegex)
-		return matched?.[1]
+		return matched ? { kind: matched[1], path: matched[2] } : undefined
 	})

 	let extractedCustomTag = $derived.by(() => {
@@ -183,7 +184,7 @@
 				</div>
 			</div>
 		{:else if newTag.trim()}
-			{#if newTag.includes('(') || newTag.includes(')') || newTag.includes('+') || newTag.includes('^') || newTag.includes('*') || ((newTag.includes('.') || newTag.includes('$args[')) && !dynamicTag)}
+			{#if newTag.includes('(') || newTag.includes(')') || newTag.includes('+') || newTag.includes('^') || newTag.includes('*') || ((newTag.includes('.') || newTag.includes('$args[') || newTag.includes('$flow_expr[')) && !dynamicTag)}
 				<div class="text-2xs text-primary p-2 bg-surface-secondary rounded border">
 					<div class="font-medium mb-1 text-red-500">Invalid tag</div>
 					<div>
@@ -194,7 +195,7 @@
 			{:else}
 				<div class="text-2xs text-primary p-2 bg-surface-secondary rounded border">
 					<div class="font-medium mb-1">
-						{#if newTag.includes('$workspace') || newTag.includes('$args')}
+						{#if newTag.includes('$workspace') || dynamicTag}
 							Dynamic tag
 						{:else}
 							Simple tag
@@ -207,8 +208,13 @@
 					{#if newTag.includes('$workspace') && !dynamicTag}
 						<div>Interpolated tag based on workspace id the job was created in </div>
 					{/if}
-					{#if dynamicTag}
-						<div>Interpolated tag based on args input of <b>{dynamicTag}</b></div>
+					{#if dynamicTag?.kind == 'flow_expr'}
+						<div>
+							Interpolated tag based on the flow value at <b>{dynamicTag.path}</b>, resolved when
+							the flow step starts
+						</div>
+					{:else if dynamicTag}
+						<div>Interpolated tag based on args input of <b>{dynamicTag.path}</b></div>
 					{/if}
 				</div>
 			{/if}
@@ -252,6 +258,17 @@
 			>
 			based on args input, use <pre class="inline text-emphasis">$args[a.b.c]</pre> where
 			<pre class="inline">a.b.c</pre> is the path to the value in the args object.
+			<br />{#if variant !== 'drawer'}<br />{/if}
+			For
+			<a
+				href="https://www.windmill.dev/docs/core_concepts/worker_groups#dynamic-tag"
+				target="_blank">dynamic tags <ExternalLink size={12} class="inline-block" /></a
+			>
+			based on flow step results, flow input or flow env, use
+			<pre class="inline text-emphasis">$flow_expr[results.a.b.c]</pre> where
+			<pre class="inline">a</pre> is the step id, or
+			<pre class="inline text-emphasis">$flow_expr[flow_input.a.b.c]</pre> and
+			<pre class="inline text-emphasis">$flow_expr[flow_env.a.b.c]</pre>.
 		</span>
 	{/if}
 </div>
@@ -54,6 +54,11 @@
 	import DOMPurify from 'dompurify'
 	import MarkupApprovalGate from './MarkupApprovalGate.svelte'
 	import type { MarkupTrust } from './apps/markupTrust'
+	import AgentResultDisplay from './AgentResultDisplay.svelte'
+	import AgentStreamDisplay from './AgentStreamDisplay.svelte'
+	import AgentTrace from './AgentTrace.svelte'
+	import { isAgentStream, parseAgentErrorMessages, parseAgentResult } from './aiAgentResult'
+	import { buildAgentTrace } from './agentTrace'

 	const TABLE_MAX_SIZE = 5000000
 	const DISPLAY_MAX_SIZE = 100000
@@ -85,6 +90,7 @@
 		| 'map'
 		| 'nondisplayable'
 		| 'pdf'
+		| 'aiagent'
 		| undefined
 	let resultKind: ResultKind = $state()
 	/** Kinds whose renderer leaves the page: S3/ducklake previews fetch the file or
@@ -94,7 +100,10 @@
 	const REPLAY_INERT_KINDS: ResultKind[] = ['s3object', 's3object-list', 'materialized', 'approval']
 	/** Kinds whose markup pulls subresources: DOMPurify stops scripting but keeps
 	 * `<img src>` and SVG `<image href>`, and `map` tiles are requests by
-	 * construction. Kinds absent here carry their bytes as `data:` and reach nothing.
+	 * construction. Kinds absent here carry their bytes as `data:` and reach nothing,
+	 * or render through a component that is itself inert on the public page —
+	 * `aiagent` is the second case, via `GfmMarkdown`, which is why it renders
+	 * markdown yet is not listed while `markdown` still is.
 	 * Inert only on the public page, which promises to issue no requests. */
 	const OFFLINE_INERT_KINDS: ResultKind[] = ['markdown', 'html', 'svg', 'map']
 	let length = $state(1)
@@ -110,6 +119,12 @@
 		filename?: string | undefined
 		disableExpand?: boolean
 		jobId?: string | undefined
+		/**
+		 * Which run this result belongs to. Separate from `jobId`, which the replay
+		 * page withholds so nothing fetches: the agent views still have to tell one
+		 * run from the next, or a second one continues the first one's fold.
+		 */
+		runKey?: string | undefined
 		workspaceId?: string | undefined
 		hideAsJson?: boolean
 		noControls?: boolean
@@ -135,6 +150,7 @@
 		filename = undefined,
 		disableExpand = false,
 		jobId = undefined,
+		runKey = undefined,
 		workspaceId = undefined,
 		hideAsJson = false,
 		noControls = false,
@@ -154,6 +170,16 @@
 		growVertical = false
 	}: Props = $props()
 	let s3FileDisplayRawMode = $state(false)
+	/** What a max-iterations failure got through before it gave up, if this is one.
+	 *  Empty for a run that failed before the worker tagged anything, and for one
+	 *  that predates the tags reaching this payload at all — in which case the
+	 *  section is not rendered rather than heading an empty box. */
+	let agentErrorTrace = $derived.by(() => {
+		const messages = parseAgentErrorMessages(result)
+		if (!messages) return undefined
+		const entries = buildAgentTrace(messages)
+		return entries.length > 0 ? entries : undefined
+	})

 	// Build the image/PDF source URL for an S3 object. When `appPath` is set
 	// (deployed app view) the read is authorized on-behalf of the app author via
@@ -293,6 +319,17 @@
 					return 'materialized'
 				}

+				// Classified before the size caps below: an agent's answer stays small
+				// however long its conversation grows, so a run with a long trace
+				// must not fall back to the JSON tree that hides the answer inside it.
+				// `largeObject` is still set honestly, so switching to JSON gets the
+				// same too-big handling as any other oversized result.
+				if (parseAgentResult(result)) {
+					is_render_all = false
+					largeObject = roughSizeOfObject(result) > DISPLAY_MAX_SIZE
+					return 'aiagent'
+				}
+
 				is_render_all =
 					keys.length == 1 && keys.includes('render_all') && Array.isArray(result['render_all'])

@@ -731,7 +768,13 @@
 		<div class="flex items-center gap-2 text-secondary text-xs">
 			<Loader2 class="animate-spin" size={14} /> Streaming result
 		</div>
-		<ResultStreamDisplay {result_stream} />
+		{#if isAgentStream(result_stream)}
+			<!-- An agent streams one JSON event per line, so the raw stream is a wall of
+			     event objects rather than the answer being written. -->
+			<AgentStreamDisplay raw={result_stream} streamKey={runKey ?? jobId} />
+		{:else}
+			<ResultStreamDisplay {result_stream} />
+		{/if}
 	</div>
 {:else if is_render_all}
 	<div class="flex flex-col w-full gap-2">
@@ -973,6 +1016,16 @@
 						{/if}
 						{@render children?.()}
 					</div>
+					{#if agentErrorTrace}
+						<!-- A run stopped by max_iterations fails, so the error above is what it
+						     returned. What it managed to do rides inside that error and is the
+						     whole reason to look at such a run, so it is added under the error
+						     rather than replacing it. -->
+						<div class="flex flex-col gap-1 pt-4 w-full min-w-0">
+							<span class="text-emphasis text-xs font-semibold">Trace</span>
+							<AgentTrace entries={agentErrorTrace} {workspaceId} />
+						</div>
+					{/if}
 					{#if !isTest && language === 'bun'}
 						<div class="pt-20"></div>
 						<Alert size="xs" type="info" title="Seeing an odd error?">
@@ -1229,6 +1282,27 @@
 							{/each}
 						</div>
 					</div>
+				{:else if !forceJson && resultKind === 'aiagent'}
+					{@const agentResult = parseAgentResult(result)}
+					{#if agentResult}
+						<AgentResultDisplay result={agentResult} {workspaceId} runKey={runKey ?? jobId}>
+							{#snippet structuredOutput(output)}
+								<DisplayResult
+									noControls
+									hideAsJson
+									result={output}
+									{markupTrust}
+									{filename}
+									{disableExpand}
+									{jobId}
+									{nodeId}
+									{workspaceId}
+									{appPath}
+									growVertical
+								/>
+							{/snippet}
+						</AgentResultDisplay>
+					{/if}
 				{:else if !forceJson && resultKind === 'markdown'}
 					<div class={markdownProse.sm}>
 						<Markdown md={result?.md ?? result?.markdown} />
@@ -2,10 +2,7 @@
 	import { Loader2 } from 'lucide-svelte'
 	import DisplayResult from './DisplayResult.svelte'
 	import LogViewer from './LogViewer.svelte'
-	import type { CompletedJob, Job } from '$lib/gen'
-	import AiAgentLogViewer from './AIAgentLogViewer.svelte'
 	import { twMerge } from 'tailwind-merge'
-	import type { AgentTool } from './flows/agentToolUtils'

 	interface Props {
 		waitingForExecutor?: boolean
@@ -16,17 +13,13 @@
 		loading: boolean
 		filename?: string | undefined
 		jobId?: string | undefined
+		/** Identifies the run, which `jobId` cannot on the replay page. */
+		runKey?: string | undefined
 		tag?: string | undefined
 		workspaceId?: string | undefined
 		refreshLog?: boolean
 		downloadLogs?: boolean
 		tagLabel?: string | undefined
-		aiAgentStatus?: {
-			tools: AgentTool[]
-			agentJob: Partial<CompletedJob> & Pick<CompletedJob, 'id'> & { type: 'CompletedJob' }
-			storedToolCallJobs?: Record<number, Job>
-			onToolJobLoaded?: (job: Job, idx: number) => void
-		}
 	}

 	let {
@@ -38,11 +31,11 @@
 		loading,
 		filename = undefined,
 		jobId = undefined,
+		runKey = undefined,
 		tag = undefined,
 		workspaceId = undefined,
 		downloadLogs = true,
-		tagLabel = undefined,
-		aiAgentStatus = undefined
+		tagLabel = undefined
 	}: Props = $props()
 </script>

@@ -60,7 +53,15 @@
 				: 'max-h-80'} overflow-auto rounded-md grow min-h-0 border bg-surface-tertiary p-2"
 		>
 			{#if result !== undefined || result_stream !== undefined}
-				<DisplayResult {workspaceId} {jobId} {filename} {result} {result_stream} growVertical />
+				<DisplayResult
+					{workspaceId}
+					{jobId}
+					{runKey}
+					{filename}
+					{result}
+					{result_stream}
+					growVertical
+				/>
 			{:else if loading}
 				<Loader2 class="animate-spin" />
 			{:else}
@@ -70,19 +71,15 @@
 	</div>
 	<div class="relative flex flex-col gap-1">
 		<span class="text-emphasis text-xs font-semibold">Logs</span>
-		{#if aiAgentStatus}
-			<AiAgentLogViewer {...aiAgentStatus} {workspaceId} noPadding />
-		{:else}
-			<div class="rounded-md grow min-h-0 border bg-surface-tertiary overflow-hidden">
-				<LogViewer
-					{tagLabel}
-					download={downloadLogs}
-					content={logs ?? ''}
-					{jobId}
-					isLoading={waitingForExecutor}
-					{tag}
-				/>
-			</div>
-		{/if}
+		<div class="rounded-md grow min-h-0 border bg-surface-tertiary overflow-hidden">
+			<LogViewer
+				{tagLabel}
+				download={downloadLogs}
+				content={logs ?? ''}
+				{jobId}
+				isLoading={waitingForExecutor}
+				{tag}
+			/>
+		</div>
 	</div>
 </div>
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				`ALTER TABLE workspace_settings DROP COLUMN add_admins_and_developers_to_forks;`
				`@@ -0,0 +1 @@`
				`ALTER TABLE workspace_settings ADD COLUMN add_admins_and_developers_to_forks BOOLEAN NOT NULL DEFAULT false;`