fix: leave JSON and other non-CommonJS module formats out of the //nodejs rewrite

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014bq66fSmaPvLtjnDPfMYcj
fix: take an extensionless entry's format from its package scope
2026-09-19 00:02:28 +00:00 · 2026-08-21 10:36:35 +00:00 · 2026-08-21 10:17:10 +00:00 · 2026-08-21 09:17:19 +00:00 · 2026-08-21 09:01:36 +00:00 · 2026-08-21 08:58:12 +00:00
2190 changed files with 32481 additions and 160474 deletions
@@ -1,6 +1,6 @@
 ---
 name: local-review-codex
-description: Run the CI Codex PR review locally against this branch's unpushed work (committed + uncommitted) before pushing. Same policy and reasoning effort as the codex-pr-review GitHub action, on a newer model.
+description: Run the CI Codex PR review locally against this branch's unpushed work (committed + uncommitted) before pushing. Same policy, model, and reasoning effort as the codex-pr-review GitHub action.
 ---

 # Local Codex Review (pre-push)
@@ -11,18 +11,17 @@ before the PR exists. Use this before `git push` on a non-trivial change.

 **Correspondence with CI** — identical:
 - Policy: `REVIEW.md` (severity triage, public-surface checklist, AGENTS.md compliance, test coverage).
- Reasoning effort: `model_reasoning_effort="xhigh"`.
+- Model: `gpt-5.6-sol`, `model_reasoning_effort="xhigh"`.
 - Output: markdown starting with `## Codex Review`, findings tagged P0 / P1 / P2 with file:line.

 **Differences from CI** — local-only:
- Model is `gpt-6-astra`; CI stays on `gpt-5.6-sol`. Not an oversight to reconcile: `gpt-6-astra` is confirmed on the ChatGPT auth `codex login` uses locally, while CI authenticates with `OPENAI_API_KEY` (`codex-pr-review.yml` prefers it over `CODEX_AUTH_JSON`) and that tier is unverified for the model. Move CI once API access is confirmed, or once CI switches to `CODEX_AUTH_JSON`.
 - Scope is the current branch vs `main` at the merge-base, **including uncommitted changes** (CI reviews a pushed PR diff).
 - Sandbox is `read-only` (CI uses `danger-full-access` on an ephemeral runner). Codex reads the diff and files but cannot modify your working tree.
 - Fresh context is inherent: `codex exec` is a separate cold process, so it does not anchor on the current chat session — the same reason `local-review` insists on a subagent.

 ## Prerequisites

- `codex` CLI **>= 0.153.4** installed and authed via `codex login` (an `OPENAI_API_KEY` in the environment takes priority and may not reach `gpt-6-astra` — see the model note above). Older CLIs reject the model with "requires a newer version of Codex"; `run.sh` checks the version up front. Upgrade with `npm install --global @openai/codex@0.153.4` (may need `sudo` for a global install). This matches the pin in `.github/workflows/codex-pr-review.yml` — the CLI version is the same on both sides, only the model differs.
+- `codex` CLI **>= 0.144.1** installed and authed (`codex login` or `OPENAI_API_KEY`). Older CLIs reject `gpt-5.6-sol` with "requires a newer version of Codex". Upgrade with `npm install --global @openai/codex@0.144.1` (may need `sudo` for a global install). Keep this in sync with the pin in `.github/workflows/codex-pr-review.yml`.
 - `git fetch` the base ref if it's stale, so the merge-base is accurate.

 ## Run
@@ -1,44 +1,21 @@
 #!/usr/bin/env bash
 # Local Codex review — mirrors the .github/workflows/codex-pr-review.yml CI job,
 # but scoped to this branch's unpushed work (committed + uncommitted) so you can
-# review before pushing. Same policy (REVIEW.md) and reasoning effort (xhigh) as CI.
-#
-# The model deliberately differs from CI: gpt-6-astra is confirmed available on the
-# ChatGPT auth `codex login` uses here, but CI authenticates with OPENAI_API_KEY and
-# that tier is unverified for it, so codex-pr-review.yml stays on gpt-5.6-sol.
+# review before pushing. Same policy (REVIEW.md), same model (gpt-5.6-sol) and
+# reasoning effort (xhigh) as CI. Runs read-only: Codex cannot modify your tree.
 #
 # Usage: run.sh [BASE_REF]   (BASE_REF defaults to "main")
 set -euo pipefail

-MODEL="gpt-6-astra"
-CODEX_MIN="0.153.4"
-
 BASE_REF="${1:-main}"
 REPO_ROOT="$(git rev-parse --show-toplevel)"
 cd "$REPO_ROOT"

 if ! command -v codex >/dev/null 2>&1; then
-  echo "codex CLI not found. Install with: npm install --global @openai/codex@$CODEX_MIN" >&2
+  echo "codex CLI not found. Install with: npm install --global @openai/codex@0.144.1" >&2
  exit 1
 fi

-# Older CLIs reject the model with an error that never names the CLI version as the
-# cause, so check it up front rather than letting the exec fail opaquely. The `|| true`
-# keeps an unrecognised --version format from aborting under `set -e`: an unparseable
-# version means "cannot tell", which must fall through to the exec, not kill the review.
-CODEX_VER="$(codex --version 2>/dev/null | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1 || true)"
-if [ -n "$CODEX_VER" ] && [ "$(printf '%s\n%s\n' "$CODEX_MIN" "$CODEX_VER" | sort -V | head -1)" != "$CODEX_MIN" ]; then
-  echo "codex $CODEX_VER is too old for $MODEL (need >= $CODEX_MIN). Upgrade with: npm install --global @openai/codex@$CODEX_MIN" >&2
-  exit 1
-fi
-
-# codex prefers OPENAI_API_KEY over the ChatGPT credentials `codex login` stores, and
-# that tier is not confirmed for $MODEL — the resulting failure names the model, not the
-# auth that selected it.
-if [ -n "${OPENAI_API_KEY:-}" ]; then
-  echo "warning: OPENAI_API_KEY is set and takes priority over 'codex login' credentials; $MODEL may be unavailable on that tier." >&2
-fi
-
 # Resolve the base to a concrete commit, preferring a local ref but falling back to
 # the remote-tracking ref — checkouts (CI, single-branch clones) often have only
 # origin/main, not a local main.
@@ -103,7 +80,7 @@ EOF

 codex exec \
  -C "$REPO_ROOT" \
-  -m "$MODEL" \
+  -m gpt-5.6-sol \
  -c 'model_reasoning_effort="xhigh"' \
  -s read-only \
  -o "$OUT" \
@@ -55,18 +55,22 @@
      "mcp__claude_ai_Gmail__list_drafts"
    ],
    "deny": [
+      "Read(.env)",
+      "Read(.env.*)",
+      "Read(**/.env)",
+      "Read(**/.env.*)",
+      "Read(**/secrets/**)",
+      "Read(**/*.pem)",
+      "Read(**/*.key)",
+      "Read(**/credentials.json)",
+      "Read(**/.secret*)",
+      "Read(**/.secrets*)",
+      "Read(**/*.secret)",
+      "Read(**/*.secrets)",
      "Edit(.env)",
      "Edit(.env.*)",
      "Edit(**/.env)",
-      "Edit(**/.env.*)",
-      "Edit(**/secrets/**)",
-      "Edit(**/*.pem)",
-      "Edit(**/*.key)",
-      "Edit(**/credentials.json)",
-      "Edit(**/.secret*)",
-      "Edit(**/.secrets*)",
-      "Edit(**/*.secret)",
-      "Edit(**/*.secrets)"
+      "Edit(**/.env.*)"
    ],
    "ask": [
      "Bash(rmdir:*)",
@@ -42,7 +42,7 @@ RUN wget https://www.python.org/ftp/python/${PYTHON_VERSION}/Python-${PYTHON_VER
 RUN /usr/local/bin/python3 -m pip install pip-tools

 # Bun
-COPY --from=oven/bun:1.4.0 /usr/local/bin/bun /usr/bin/bun
+COPY --from=oven/bun:1.3.10 /usr/local/bin/bun /usr/bin/bun

 # Install windmill CLI
 RUN bun install -g windmill-cli \
@@ -1,56 +0,0 @@
-name: Sign image and attach provenance
-description: >
-  Keyless-signs a pushed image digest with cosign (index and per-arch
-  manifests) and records SLSA provenance as a GitHub artifact attestation
-  pushed to the registry. SBOMs are not generated here: the build step embeds
-  them as BuildKit attestation manifests (depot `sbom: true`), which the index
-  signature then covers. The calling job must already be logged in to the
-  registry and must have id-token: write, attestations: write and
-  packages: write permissions (write-all covers all three).
-inputs:
-  image:
-    description: "Fully-qualified image name without tag, e.g. ghcr.io/windmill-labs/windmill"
-    required: true
-  digest:
-    description: "Pushed manifest digest (sha256:...) from build-push-action"
-    required: true
-runs:
-  using: composite
-  steps:
-    - name: Preflight
-      shell: bash
-      env:
-        DIGEST: ${{ inputs.digest }}
-      run: |
-        if [ -z "${ACTIONS_ID_TOKEN_REQUEST_URL:-}" ]; then
-          echo "::error::No OIDC token available; the calling job needs id-token: write"
-          exit 1
-        fi
-        case "$DIGEST" in
-          sha256:*) ;;
-          *)
-            echo "::error::digest '$DIGEST' is not a sha256: digest"
-            exit 1
-            ;;
-        esac
-
-    # cosign v2 writes the classic sha256-<digest>.sig tag format that the
-    # installed base of cosign clients can verify; v3's bundle format cannot be
-    # verified by v2 clients yet, so stay on v2 until v3 verification is common.
-    - uses: sigstore/cosign-installer@v4.1.2
-      with:
-        cosign-release: "v2.6.5"
-
-    - name: Cosign keyless sign (index + per-arch manifests)
-      shell: bash
-      env:
-        IMAGE: ${{ inputs.image }}
-        DIGEST: ${{ inputs.digest }}
-      run: cosign sign --yes --recursive "${IMAGE}@${DIGEST}"
-
-    - name: SLSA provenance (GitHub artifact attestation)
-      uses: actions/attest-build-provenance@v4
-      with:
-        subject-name: ${{ inputs.image }}
-        subject-digest: ${{ inputs.digest }}
-        push-to-registry: true
@@ -12,7 +12,6 @@ sed -i '' -e "/^export const VERSION =/s/= .*/= \"v$VERSION\";/" ${root_dirpath}
 sed -i '' -e "/version: /s/: .*/: $VERSION/" ${root_dirpath}/backend/windmill-api/openapi.yaml
 sed -i '' -e "/version: /s/: .*/: $VERSION/" ${root_dirpath}/openflow.openapi.yaml
 sed -i '' -e "/\"version\": /s/: .*,/: \"$VERSION\",/" ${root_dirpath}/typescript-client/package.json
-sed -i '' -e "/\"version\": /s/: .*,/: \"$VERSION\",/" ${root_dirpath}/chat-sdk/package.json
 sed -i '' -e "/\"version\": /s/: .*,/: \"$VERSION\",/" ${root_dirpath}/frontend/package.json
 sed -i '' -e "/^version =/s/= .*/= \"$VERSION\"/" ${root_dirpath}/python-client/wmill/pyproject.toml
 sed -i '' -e "/^windmill-api =/s/= .*/= \"\\^$VERSION\"/" ${root_dirpath}/python-client/wmill/pyproject.toml
@@ -13,7 +13,6 @@ sed -i -e "/version: /s/: .*/: $VERSION/" ${root_dirpath}/backend/windmill-api/o
 sed -i -e "/version: /s/: .*/: $VERSION/" ${root_dirpath}/openflow.openapi.yaml
 sed -i -e "/\"version\": /s/: .*,/: \"$VERSION\",/" ${root_dirpath}/typescript-client/package.json
 sed -i -e "/\"version\": /s/: .*,/: \"$VERSION\",/" ${root_dirpath}/typescript-client/jsr.json
-sed -i -e "/\"version\": /s/: .*,/: \"$VERSION\",/" ${root_dirpath}/chat-sdk/package.json
 sed -i -e "/\"version\": /s/: .*,/: \"$VERSION\",/" ${root_dirpath}/frontend/package.json
 sed -i -e "/\"version\": /s/: .*,/: \"$VERSION\",/" ${root_dirpath}/windmill-yaml-validator/package.json
 sed -i -e "/^version =/s/= .*/= \"$VERSION\"/" ${root_dirpath}/python-client/wmill/pyproject.toml
@@ -34,5 +33,3 @@ cd ${root_dirpath}/frontend && npm i --package-lock-only --ignore-scripts
 # The CLI installs this package on every `bun install`, which would otherwise rewrite the
 # lockfile's version and leave a dirty tree.
 cd ${root_dirpath}/windmill-yaml-validator && npm i --package-lock-only --ignore-scripts
-
-cd ${root_dirpath}/chat-sdk && npm i --package-lock-only --ignore-scripts
@@ -61,7 +61,7 @@ jobs:

      - uses: oven-sh/setup-bun@v2
        with:
-          bun-version: 1.4.0
+          bun-version: 1.3.10

      - uses: actions/setup-node@v4
        with:
@@ -75,7 +75,7 @@ jobs:

      - uses: oven-sh/setup-bun@v2
        with:
-          bun-version: 1.4.0
+          bun-version: 1.3.10

      - uses: actions/setup-node@v4
        with:
@@ -73,7 +73,7 @@ jobs:

      - uses: oven-sh/setup-bun@v2
        with:
-          bun-version: 1.4.0
+          bun-version: 1.3.10

      - uses: actions/setup-node@v4
        with:
@@ -101,6 +101,7 @@ jobs:

      - name: Install OpenSSL via vcpkg
        run: |
+          vcpkg.exe install openssl-windows:x64-windows
          vcpkg.exe install openssl:x64-windows-static
          vcpkg.exe integrate install

@@ -178,14 +179,15 @@ jobs:
          # binary link spikes several hundred MB of transient I/O. Capping at
          # 8 trades ~25% wall time for headroom on the ~75GB runner disk.
          CARGO_BUILD_JOBS: 8
-          # backend/Cargo.toml keeps line tables on profile.dev for the (large)
-          # windmill workspace crates; that debuginfo is emitted into every
-          # object file and embedded in each test binary, and on windows-msvc
-          # also spawns the mspdbsrv.exe PDB type server. Across the worker
-          # crates' test build it drives the peak on the ~63GB free of the
-          # runner disk (LNK1180 / disk-full during linking). CI reads no
-          # backtraces, so drop it entirely for the dev/test profiles here:
-          # debug = 0 means no .pdb and no LNK1318 type-server limit.
+          # backend/Cargo.toml leaves profile.dev at the default debug = 2 for
+          # the (large) windmill workspace crates; that debuginfo is emitted
+          # into every object file and embedded in each test binary, and on
+          # windows-msvc also spawns the mspdbsrv.exe PDB type server. Across a
+          # full --all --features build it is the dominant consumer of the
+          # ~63GB free on the runner disk (LNK1180 / disk-full during linking).
+          # CI needs no debug info, so drop it entirely for the dev/test
+          # profiles here. debug = 0 supersedes the previous split-debuginfo=off
+          # knob (no debuginfo => no .pdb and no LNK1318 type-server limit).
          CARGO_PROFILE_DEV_DEBUG: "0"
          CARGO_PROFILE_TEST_DEBUG: "0"
          # Tests' poll-time stack frames (deep nested async fn chains in
@@ -58,10 +58,10 @@ jobs:
          go-version: 1.21.5
      - uses: oven-sh/setup-bun@v2
        with:
-          bun-version: 1.4.0
+          bun-version: 1.3.10
      - uses: actions/setup-node@v4
        with:
-          node-version: "24"
+          node-version: "20"
      - uses: astral-sh/setup-uv@v6.2.1
        with:
          version: "0.11.24"
@@ -268,13 +268,13 @@ jobs:
          # overhead and extra disk. Off here (kept on for local dev via
          # .cargo/config.toml). Matches backend-test-windows.yml.
          CARGO_INCREMENTAL: "0"
-          # backend/Cargo.toml keeps line tables on profile.dev for the (large)
-          # windmill workspace crates; that debug info is emitted into every
-          # object file and embedded in each test binary. Across the full
-          # --all --features build it drives the memory/disk peak when mold
-          # links the windmill-api-integration-tests binary, tipping the runner
-          # over (lost runner reported as a canceled step). CI reads no
-          # backtraces, so drop it entirely for the dev/test profiles here.
+          # backend/Cargo.toml leaves profile.dev at the default debug = 2 for
+          # the (large) windmill workspace crates; that debug info is emitted
+          # into every object file and embedded in each test binary. Across the
+          # full --all --features build it is the dominant memory/disk consumer
+          # when mold links the windmill-api-integration-tests binary, tipping
+          # the runner over (lost runner reported as a canceled step). CI needs
+          # no debug info, so drop it entirely for the dev/test profiles here.
          # (test profile inherits dev, but the workspace crates link in as
          # dev-profile deps, so both must be set.) CI-only; local dev builds
          # are unaffected.
@@ -13,13 +13,9 @@ permissions:
  contents: read
  id-token: write
  packages: write
-  attestations: write

 jobs:
  publish_cli:
-    # a tag-targeted dispatch would republish the release tags unsigned,
-    # un-verifying the release; to republish a release, re-push its tag
-    if: github.event_name == 'push' || !startsWith(github.ref, 'refs/tags/')
    runs-on: ubicloud
    steps:
      - uses: actions/checkout@v4
@@ -46,23 +42,14 @@ jobs:
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push publicly
-        id: docker_build
        uses: depot/build-push-action@v1
        with:
          file: "./docker/DockerfileCli"
          platforms: linux/amd64,linux/arm64
          push: true
-          sbom: ${{ startsWith(github.ref, 'refs/tags/v') && github.event_name == 'push' }}
          tags: |
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
            ${{ steps.meta.outputs.tags }}
          labels: |
            ${{ steps.meta.outputs.labels }}
            org.opencontainers.image.licenses=AGPLv3
-
-      - name: Sign and attest release image
-        if: startsWith(github.ref, 'refs/tags/v') && github.event_name == 'push'
-        uses: ./.github/actions/sign-attest-image
-        with:
-          image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
-          digest: ${{ steps.docker_build.outputs.digest }}
@@ -62,6 +62,7 @@ jobs:
      - name: Cargo build binary windows
        timeout-minutes: 180
        run: |
+          vcpkg.exe install openssl-windows:x64-windows
          vcpkg.exe install openssl:x64-windows-static
          vcpkg.exe integrate install
          $env:VCPKGRS_DYNAMIC=1
@@ -219,7 +219,7 @@ jobs:

      - name: Install Codex CLI
        if: steps.codex_config.outputs.enabled == 'true' && steps.pr.outputs.skip != 'true'
-        run: npm install --global @openai/codex@0.153.4
+        run: npm install --global @openai/codex@0.144.1

      - name: Configure Codex auth
        if: steps.codex_config.outputs.enabled == 'true' && steps.pr.outputs.skip != 'true'
@@ -86,13 +86,11 @@ jobs:
            type=semver,pattern={{major}}.{{minor}}

      - name: Build and push publicly
-        id: docker_build
        uses: depot/build-push-action@v1
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
-          sbom: ${{ startsWith(github.ref, 'refs/tags/v') && github.event_name == 'push' }}
          build-args: |
            features=ce
            WM_BUILD_VERSION=${{ github.sha }}
@@ -102,13 +100,6 @@ jobs:
          labels: |
            ${{ steps.meta-public.outputs.labels }}

-      - name: Sign and attest release image
-        if: startsWith(github.ref, 'refs/tags/v') && github.event_name == 'push'
-        uses: ./.github/actions/sign-attest-image
-        with:
-          image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
-          digest: ${{ steps.docker_build.outputs.digest }}
-
  build_ee:
    runs-on: ubicloud
    if: (github.event_name != 'workflow_dispatch') || github.event.inputs.ee
@@ -158,13 +149,11 @@ jobs:
          ./backend/substitute_ee_code.sh --copy --dir ./windmill-ee-private

      - name: Build and push publicly ee
-        id: docker_build
        uses: depot/build-push-action@v1
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
-          sbom: ${{ startsWith(github.ref, 'refs/tags/v') && github.event_name == 'push' }}
          build-args: |
            features=ee
            WM_BUILD_VERSION=${{ github.sha }}
@@ -175,13 +164,6 @@ jobs:
            ${{ steps.meta-ee-public.outputs.labels }}
            org.opencontainers.image.licenses=Windmill-Enterprise-License

-      - name: Sign and attest release image
-        if: startsWith(github.ref, 'refs/tags/v') && github.event_name == 'push'
-        uses: ./.github/actions/sign-attest-image
-        with:
-          image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-ee
-          digest: ${{ steps.docker_build.outputs.digest }}
-
  attach_amd64_binary_to_release:
    needs: [build, build_ee]
    runs-on: ubicloud
@@ -376,21 +358,6 @@ jobs:
          docker buildx imagetools create ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.DEV_SHA }} --tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
          docker buildx imagetools create ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.DEV_SHA }} --tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:main

-      - uses: sigstore/cosign-installer@v4.1.2
-        if: startsWith(github.ref, 'refs/tags/v')
-        with:
-          cosign-release: "v2.6.5"
-      # end-to-end release guard: the version tag pushed by this run must
-      # verify against this exact run's identity (the mutable :latest/:dev
-      # tags race with concurrent main builds, so they are not asserted here)
-      - name: Verify release image is signed
-        if: startsWith(github.ref, 'refs/tags/v')
-        run: |
-          cosign verify \
-            --certificate-oidc-issuer https://token.actions.githubusercontent.com \
-            --certificate-identity "https://github.com/windmill-labs/windmill/.github/workflows/docker-image.yml@${GITHUB_REF}" \
-            "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${GITHUB_REF_NAME#v}"
-
  tag_latest_ee:
    runs-on: ubicloud
    needs: [run_integration_test, build_ee]
@@ -412,21 +379,6 @@ jobs:
          docker buildx imagetools create ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-ee:${{ env.DEV_SHA }} --tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-ee:latest
          docker buildx imagetools create ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-ee:${{ env.DEV_SHA }} --tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-ee:main

-      - uses: sigstore/cosign-installer@v4.1.2
-        if: startsWith(github.ref, 'refs/tags/v')
-        with:
-          cosign-release: "v2.6.5"
-      # end-to-end release guard: the version tag pushed by this run must
-      # verify against this exact run's identity (the mutable :latest/:dev
-      # tags race with concurrent main builds, so they are not asserted here)
-      - name: Verify release ee image is signed
-        if: startsWith(github.ref, 'refs/tags/v')
-        run: |
-          cosign verify \
-            --certificate-oidc-issuer https://token.actions.githubusercontent.com \
-            --certificate-identity "https://github.com/windmill-labs/windmill/.github/workflows/docker-image.yml@${GITHUB_REF}" \
-            "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-ee:${GITHUB_REF_NAME#v}"
-
  verify_ee_image_vulnerabilities:
    runs-on: ubicloud
    needs: [tag_latest_ee]
@@ -541,13 +493,11 @@ jobs:
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push publicly ee
-        id: docker_build
        uses: depot/build-push-action@v1
        with:
          context: .
          platforms: linux/amd64
          push: true
-          sbom: ${{ startsWith(github.ref, 'refs/tags/v') && github.event_name == 'push' }}
          file: "./docker/DockerfileCuda"
          tags: |
            ${{ steps.meta-ee-public.outputs.tags }}
@@ -555,13 +505,6 @@ jobs:
            ${{ steps.meta-ee-public.outputs.labels }}
            org.opencontainers.image.licenses=Windmill-Enterprise-License

-      - name: Sign and attest release image
-        if: startsWith(github.ref, 'refs/tags/v') && github.event_name == 'push'
-        uses: ./.github/actions/sign-attest-image
-        with:
-          image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-ee-cuda
-          digest: ${{ steps.docker_build.outputs.digest }}
-
  build_slim:
    if: ${{ startsWith(github.ref, 'refs/tags/v') }}
    needs: [build]
@@ -594,26 +537,17 @@ jobs:
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push publicly ee
-        id: docker_build
        uses: depot/build-push-action@v1
        with:
          context: .
          platforms: linux/amd64
          push: true
-          sbom: ${{ startsWith(github.ref, 'refs/tags/v') && github.event_name == 'push' }}
          file: "./docker/DockerfileSlim"
          tags: |
            ${{ steps.meta-ee-public.outputs.tags }}
          labels: |
            ${{ steps.meta-ee-public.outputs.labels }}

-      - name: Sign and attest release image
-        if: startsWith(github.ref, 'refs/tags/v') && github.event_name == 'push'
-        uses: ./.github/actions/sign-attest-image
-        with:
-          image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-slim
-          digest: ${{ steps.docker_build.outputs.digest }}
-
  build_ee_slim:
    needs: [build_ee]
    runs-on: ubicloud
@@ -648,13 +582,11 @@ jobs:
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push publicly ee
-        id: docker_build
        uses: depot/build-push-action@v1
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
-          sbom: ${{ startsWith(github.ref, 'refs/tags/v') && github.event_name == 'push' }}
          file: "./docker/DockerfileSlimEe"
          tags: |
            ${{ steps.meta-ee-public.outputs.tags }}
@@ -662,13 +594,6 @@ jobs:
            ${{ steps.meta-ee-public.outputs.labels }}
            org.opencontainers.image.licenses=Windmill-Enterprise-License

-      - name: Sign and attest release image
-        if: startsWith(github.ref, 'refs/tags/v') && github.event_name == 'push'
-        uses: ./.github/actions/sign-attest-image
-        with:
-          image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-ee-slim
-          digest: ${{ steps.docker_build.outputs.digest }}
-
  build_full:
    if: ${{ startsWith(github.ref, 'refs/tags/v') }}
    needs: [build]
@@ -701,26 +626,17 @@ jobs:
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push publicly
-        id: docker_build
        uses: depot/build-push-action@v1
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
-          sbom: ${{ startsWith(github.ref, 'refs/tags/v') && github.event_name == 'push' }}
          file: "./docker/DockerfileFull"
          tags: |
            ${{ steps.meta-public.outputs.tags }}
          labels: |
            ${{ steps.meta-public.outputs.labels }}

-      - name: Sign and attest release image
-        if: startsWith(github.ref, 'refs/tags/v') && github.event_name == 'push'
-        uses: ./.github/actions/sign-attest-image
-        with:
-          image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-full
-          digest: ${{ steps.docker_build.outputs.digest }}
-
  build_ee_full:
    if: ${{ startsWith(github.ref, 'refs/tags/v') }}
    needs: [build_ee]
@@ -753,23 +669,14 @@ jobs:
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push publicly ee
-        id: docker_build
        uses: depot/build-push-action@v1
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
-          sbom: ${{ startsWith(github.ref, 'refs/tags/v') && github.event_name == 'push' }}
          file: "./docker/DockerfileFullEe"
          tags: |
            ${{ steps.meta-ee-public.outputs.tags }}
          labels: |
            ${{ steps.meta-ee-public.outputs.labels }}
            org.opencontainers.image.licenses=Windmill-Enterprise-License
-
-      - name: Sign and attest release image
-        if: startsWith(github.ref, 'refs/tags/v') && github.event_name == 'push'
-        uses: ./.github/actions/sign-attest-image
-        with:
-          image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-ee-full
-          digest: ${{ steps.docker_build.outputs.digest }}
@@ -9,8 +9,6 @@ on:
  push:
    paths:
      - "frontend/**"
-      # The flow chat compiles the chat SDK's source in (svelte.config.js alias).
-      - "chat-sdk/src/**"
      - ".github/workflows/frontend-check.yml"

 jobs:
@@ -9,7 +9,6 @@ on:
      - "backend/windmill-api-integration-tests/tests/git_sync*"
      - "backend/ee-repo-ref.txt"
      - "backend/windmill-common/src/workspaces.rs"
-      - "frontend/src/lib/hubPaths.json"
      - "backend/windmill-worker/src/result_processor.rs"
      - "backend/windmill-api-workspaces/**"
      - "cli/src/commands/sync/**"
@@ -23,7 +22,6 @@ on:
      - "backend/windmill-api-integration-tests/tests/git_sync*"
      - "backend/ee-repo-ref.txt"
      - "backend/windmill-common/src/workspaces.rs"
-      - "frontend/src/lib/hubPaths.json"
      - "backend/windmill-worker/src/result_processor.rs"
      - "backend/windmill-api-workspaces/**"
      - "cli/src/commands/sync/**"
@@ -61,7 +59,7 @@ jobs:
          echo "$CHANGED_FILES"

          # Direct git sync file changes — always relevant.
-          if echo "$CHANGED_FILES" | grep -qE '^(backend/windmill-git-sync/|backend/windmill-worker/src/result_processor\.rs|backend/windmill-api-workspaces/|backend/windmill-api-integration-tests/tests/git_sync|backend/windmill-common/src/workspaces\.rs|frontend/src/lib/hubPaths\.json|cli/src/commands/sync/|cli/src/utils/git\.ts|integration_tests/test/git_sync|\.github/workflows/git-sync-test\.yml)'; then
+          if echo "$CHANGED_FILES" | grep -qE '^(backend/windmill-git-sync/|backend/windmill-worker/src/result_processor\.rs|backend/windmill-api-workspaces/|backend/windmill-api-integration-tests/tests/git_sync|backend/windmill-common/src/workspaces\.rs|cli/src/commands/sync/|cli/src/utils/git\.ts|integration_tests/test/git_sync|\.github/workflows/git-sync-test\.yml)'; then
            echo "should_run=true" >> "$GITHUB_OUTPUT"
            echo "Relevant: direct git sync file changes"
            exit 0
@@ -135,7 +133,7 @@ jobs:

      - uses: oven-sh/setup-bun@v2
        with:
-          bun-version: 1.4.0
+          bun-version: 1.3.10

      - uses: denoland/setup-deno@v2
        with:
@@ -17,17 +17,6 @@ jobs:
      - run: cd typescript-client && ./publish.sh --access public && cd ..
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-  publish_chat_sdk:
-    runs-on: ubicloud-standard-8
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v3
-        with:
-          node-version: "20.x"
-          registry-url: "https://registry.npmjs.org"
-      - run: cd chat-sdk && npm ci && npm run build && npm publish --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
  publish_cli:
    runs-on: ubicloud-standard-8
    steps:
@@ -84,9 +84,6 @@ jobs:

  publish_extra:
    needs: [sleep, test_extra]
-    # a tag-targeted dispatch would republish the release tags unsigned,
-    # un-verifying the release; to republish a release, re-push its tag
-    if: github.event_name == 'push' || !startsWith(github.ref, 'refs/tags/')
    runs-on: ubicloud-standard-8
    steps:
      - uses: actions/checkout@v4
@@ -115,24 +112,15 @@ jobs:
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push publicly
-        id: docker_build
        uses: depot/build-push-action@v1
        with:
          context: .
          file: ./docker/DockerfileExtra
          platforms: linux/amd64,linux/arm64
          push: true
-          sbom: ${{ startsWith(github.ref, 'refs/tags/v') && github.event_name == 'push' }}
          tags: |
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
            ${{ steps.meta.outputs.tags }}
          labels: |
            ${{ steps.meta.outputs.labels }}
            org.opencontainers.image.licenses=AGPLv3
-
-      - name: Sign and attest release image
-        if: startsWith(github.ref, 'refs/tags/v') && github.event_name == 'push'
-        uses: ./.github/actions/sign-attest-image
-        with:
-          image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
-          digest: ${{ steps.docker_build.outputs.digest }}
@@ -51,6 +51,7 @@ jobs:
      - name: Cargo build windows
        timeout-minutes: 180
        run: |
+          vcpkg.exe install openssl-windows:x64-windows
          vcpkg.exe install openssl:x64-windows-static
          vcpkg.exe integrate install
          $env:VCPKGRS_DYNAMIC=1
@@ -32,25 +32,6 @@ jobs:
        working-directory: ./typescript-client
        run: bun test --timeout 120000 tests/

-  chat-sdk:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: latest
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20.x"
-
-      - name: Run tests
-        working-directory: ./chat-sdk
-        run: npm ci && npm run check && bun test
-
  python-client:
    runs-on: ubuntu-latest
    steps:
@@ -150,21 +150,13 @@ jobs:
          COMMENT_URL: ${{ inputs.COMMENT_URL }}
          COMMENT_IS_EDIT: ${{ inputs.COMMENT_IS_EDIT }}
        run: |
-          # 1) Find the thread by PR number. A rate-limited or unauthorized
-          # response carries no thread list at all, which under `bash -e` aborts
-          # the step (jq cannot iterate null, nor parse an HTML error page)
-          # rather than reaching the skip below. It is also not the same thing as
-          # this PR having no thread, so it is reported rather than swallowed.
+          # 1) Find the thread by PR number
          threads=$(curl -s -H "Authorization: Bot $BOT_TOKEN" \
            "https://discord.com/api/v10/guilds/${GUILD_ID}/threads/active")
-          if ! echo "$threads" | jq -e 'has("threads")' >/dev/null 2>&1; then
-            echo "::warning::Discord returned no thread list; the comment on PR #${PR_NUMBER} was not relayed: ${threads:0:200}"
-            exit 0
-          fi
          thread_id=$(echo "$threads" | jq -r \
            --arg cid "$CHANNEL_ID" \
            --arg pref "#${PR_NUMBER}:" \
-            '(.threads // [])[] | select(.parent_id == $cid and (.name | startswith($pref))) | .id')
+            '.threads[] | select(.parent_id == $cid and (.name | startswith($pref))) | .id')

          if [ -z "$thread_id" ]; then
            echo "Thread not found for PR #${PR_NUMBER}, skipping"
@@ -1,3 +1,3 @@
 {
-  ".": "1.815.0"
+  ".": "1.793.0"
 }
@@ -30,18 +30,14 @@ Open-source platform for internal tools, workflows, API integrations, background
  reaches the DB only through the API, so `Connection::Http` paths are never taken by a plain
  `cargo run`; a normal build cannot start one at all.
 - **Enterprise**: `docs/enterprise.md` — EE file conventions and PR workflow
- **Auth surface**: `docs/auth-surface.md` — credential precedence, session/cache invalidation
-  scope, which token labels email their owner at expiry, how OAuth login matches `login_type`, and
-  that every superadmin route refuses `$WM_TOKEN`. Read before designing anything that creates
-  users, tokens or sessions.
 - **Product telemetry**: `docs/feature-telemetry.md` — when to instrument a new feature with
  `feature_usage`, and the four-step recipe. An unregistered `(feature, kind)` pair is dropped
  silently, so frontend-only instrumentation records nothing.
 - **Backend patterns**: use the `rust-backend` skill when writing Rust code
 - **Frontend patterns**: use the `svelte-frontend` skill when writing Svelte code. Do NOT edit svelte files unless you have read that skill.
 - **Frontend UUIDs**: do not call `crypto.randomUUID()` in frontend code. Import `randomUUID` from `$lib/utils/uuid` instead.
- **Code review**: review the current PR or branch against the shared review policy in `REVIEW.md` (severity triage, public-surface checklist, AGENTS.md compliance, test-coverage assessment). The skill at `.agents/skills/local-review/SKILL.md` orchestrates it. All three CLIs auto-discover the same SKILL — Claude reads `.claude/skills/` (symlinked to the canonical `.agents/skills/` file), Codex and Pi read `.agents/skills/` directly. Invoke with `/local-review` in Claude Code, `$local-review` (or `/skills` selector) in Codex, or `pi --skill local-review` / `/skill:local-review` in Pi. For a Codex-driven pass that mirrors the `codex-pr-review` GitHub action against your unpushed work (committed + uncommitted) before you push, use `/local-review-codex` (`.agents/skills/local-review-codex/`) — same `REVIEW.md` policy and `xhigh` reasoning, on `gpt-6-astra` rather than the action's `gpt-5.6-sol`; requires the `codex` CLI >= 0.153.4.
- **Domain guides**: `.claude/skills/native-trigger/`
+- **Code review**: review the current PR or branch against the shared review policy in `REVIEW.md` (severity triage, public-surface checklist, AGENTS.md compliance, test-coverage assessment). The skill at `.agents/skills/local-review/SKILL.md` orchestrates it. All three CLIs auto-discover the same SKILL — Claude reads `.claude/skills/` (symlinked to the canonical `.agents/skills/` file), Codex and Pi read `.agents/skills/` directly. Invoke with `/local-review` in Claude Code, `$local-review` (or `/skills` selector) in Codex, or `pi --skill local-review` / `/skill:local-review` in Pi. For a Codex-driven pass that mirrors the `codex-pr-review` GitHub action against your unpushed work (committed + uncommitted) before you push, use `/local-review-codex` (`.agents/skills/local-review-codex/`) — same `REVIEW.md` policy, `gpt-5.6-sol`, `xhigh` reasoning; requires the `codex` CLI >= 0.144.1.
+- **Domain guides**: `.claude/skills/native-trigger/` and `frontend/tutorial-system-guide.mdc`
 - **Brand/UI guidelines**: `frontend/brand-guidelines.md`
 - **Domain vocabulary**: `CONTEXT.md` — the words this codebase uses for its own concepts (step, step setting, trigger step, …). Name things the way it does.
 - **CLI commands**: when adding/modifying/removing a command, subcommand, option, or description in `cli/src/commands/`, run `python system_prompts/generate.py` to refresh `system_prompts/auto-generated/` and `cli/src/guidance/skills.gen.ts`. The CLI docs the agents use to operate `wmill` are derived from the source — stale generated files give agents the wrong flags.
@@ -169,15 +165,6 @@ $NAV --root backend callees "X"                           # what does X call?
 - Search for existing code to reuse before writing new code
 - Follow established patterns in the codebase
 - Keep changes focused — don't refactor beyond what's asked
- **A simpler design found late is still the design.** Work already spent is not an argument
-  for a shape, and neither is a clean review round, a passing suite, or a long PR thread. The
-  signal to stop and re-derive rather than patch again is a change that keeps growing to defend
-  its own structure: each review finding fixing an assumption the previous fix broke, the same
-  class of bug reappearing somewhere new, or most of the diff being consequences of one early
-  choice rather than the thing you set out to do. When that happens, say plainly what the
-  simpler design is and what switching costs — a migration, a review cycle restarted from zero,
-  work discarded — and let the user decide. Do not keep paying down the harder one because it
-  is nearly finished, and do not present the accumulated cost as a reason to continue.
 - **Ship only the tests the PR needs.** A committed test must pin behavior a future change could plausibly break, and be the smallest setup that exercises the new logic. While developing, write as many exhaustive tests and do as much manual testing as you need to convince yourself the change works — then remove that scaffolding before marking the PR ready, keeping only the essential regression guard(s). A test that merely re-exercises pre-existing behavior, or needs elaborate fixtures to assert something trivial, is scaffolding: delete it. If nothing meaningful is left to guard, ship no test rather than a ceremonial one.
 - **Comments record constraints, not narration.** Write a comment only for what the code can't show: why a non-obvious approach is required, what breaks if it's "simplified" away. State each invariant once, at the place where someone would break it, in ≤4 lines. Don't describe what the next line does, don't repeat the same rationale at multiple sites, and don't address the PR reviewer (justifying a change belongs in the PR description, not the code). Reference nothing ephemeral — no numbered steps from your dev flow, no "the poller / the test does X" scaffolding, no transient state that won't exist for the next reader; keep only the essential, durable rationale. Describe the code as it is, never its drafting history: "we no longer do X", "unchanged behavior", "instead of the previous approach" are meaningless to a reader who never saw the earlier iteration — before finishing, reread your comments as if the current state is the only state that ever existed.
 - **Never attribute work to a specific customer, account, or "requested by a customer" in repo-tracked content** (PR descriptions, commit messages, code comments, docs). Describe changes by their technical motivation instead.
@@ -1,533 +1,5 @@
 # Changelog

-## [1.815.0](https://github.com/windmill-labs/windmill/compare/v1.814.0...v1.815.0) (2026-09-18)
-
-
-### Features
-
-* add a workspace toggle that adds its admins and developers to new forks ([#11215](https://github.com/windmill-labs/windmill/issues/11215)) ([9d335de](https://github.com/windmill-labs/windmill/commit/9d335de87a4dbaa51038d55afe8d980761dcdfaf))
-* add an instance setting to refuse a token in MCP URLs ([#11162](https://github.com/windmill-labs/windmill/issues/11162)) ([37e493a](https://github.com/windmill-labs/windmill/commit/37e493ae66ed5c000ecac492d60fc0fdf4bda71f))
-* **ai-chat:** render get_run through the run tools' card ([#11204](https://github.com/windmill-labs/windmill/issues/11204)) ([6f9c4dc](https://github.com/windmill-labs/windmill/commit/6f9c4dc29455d13b0e64af05c2d6aa8bd5ff4fd6))
-* **ai-chat:** tell the chat which kind of app it is looking at ([#11208](https://github.com/windmill-labs/windmill/issues/11208)) ([c8c06d8](https://github.com/windmill-labs/windmill/commit/c8c06d8f79774abf109192e71a8b6fc37c7937ba))
-* attach files to a flow chat message ([#11185](https://github.com/windmill-labs/windmill/issues/11185)) ([c4c9677](https://github.com/windmill-labs/windmill/commit/c4c9677982b75c63d98ebf85b1904e0c341ba957))
-* **auth:** 2 h login links and a click-to-sign-in page for emailed ones ([#11203](https://github.com/windmill-labs/windmill/issues/11203)) ([5639187](https://github.com/windmill-labs/windmill/commit/5639187fec6d517a72e82df49d63d7438301127c))
-* cap user token expiration with an instance setting ([#11159](https://github.com/windmill-labs/windmill/issues/11159)) ([9320312](https://github.com/windmill-labs/windmill/commit/9320312eac56f944c4d31504601293ab4e816ccc))
-* flow chat job-backed detail, smooth streaming and answer chrome ([#11186](https://github.com/windmill-labs/windmill/issues/11186)) ([e2a91ca](https://github.com/windmill-labs/windmill/commit/e2a91ca2b141a0bee64ddfafe3cbf3ff86b6fb35))
-* put a data table's connection under Postgres roles ([#11020](https://github.com/windmill-labs/windmill/issues/11020)) ([0e807fb](https://github.com/windmill-labs/windmill/commit/0e807fb1dd80d7536ec144cd49445abc7961e504))
-* render an AI agent result as its answer, not as raw JSON ([#11051](https://github.com/windmill-labs/windmill/issues/11051)) ([a089928](https://github.com/windmill-labs/windmill/commit/a08992834d45d0211336f4fc32c3421646ca47c5))
-* support $flow_expr[...] dynamic tags on flow steps ([#11170](https://github.com/windmill-labs/windmill/issues/11170)) ([48f0025](https://github.com/windmill-labs/windmill/commit/48f00259c5e7361d3553dbcb809461e1cde96f8f))
-
-
-### Bug Fixes
-
-* **frontend:** inline only the package version, not the whole package.json ([#11191](https://github.com/windmill-labs/windmill/issues/11191)) ([813e486](https://github.com/windmill-labs/windmill/commit/813e486e166ac6215364817a7732b66f8dc1d463))
-* keep instance groups when editing auto-invite ([#11217](https://github.com/windmill-labs/windmill/issues/11217)) ([df61dea](https://github.com/windmill-labs/windmill/commit/df61dea5fa8b18d1e0044dc0db6702b053d5119f))
-* key the large root font size on screen width, not window width ([#11216](https://github.com/windmill-labs/windmill/issues/11216)) ([3b4e13d](https://github.com/windmill-labs/windmill/commit/3b4e13d1c564c6195e30b55b0671f7533e3ce408))
-* re-encrypt git sync secrets on workspace key rotation ([#11218](https://github.com/windmill-labs/windmill/issues/11218)) ([f0d66a4](https://github.com/windmill-labs/windmill/commit/f0d66a42eba27502767423af0c08b2ca1f16e8df))
-* re-point cloned fork identities that name nobody in the fork ([#11161](https://github.com/windmill-labs/windmill/issues/11161)) ([9690c44](https://github.com/windmill-labs/windmill/commit/9690c4462cf264a5577b87d07d465b5442b4e09d))
-* register the job token with the sensitive log masking system ([#10943](https://github.com/windmill-labs/windmill/issues/10943)) ([53afecd](https://github.com/windmill-labs/windmill/commit/53afecd4588247bc1812d3e68a30db1f3c3b2724))
-* show the New menu's description panel only on hover ([#11199](https://github.com/windmill-labs/windmill/issues/11199)) ([ecd0a6c](https://github.com/windmill-labs/windmill/commit/ecd0a6c77bc3a057b8072dbb0aca731e8bd3d882))
-* stop picker listing a draft twice when drafts share a friendly path ([#11214](https://github.com/windmill-labs/windmill/issues/11214)) ([72507d5](https://github.com/windmill-labs/windmill/commit/72507d52a021de8101794ee8f4a3392be1ba20c7))
-
-
-### Performance Improvements
-
-* count completed jobs on the v2_job_completed index with a timeout ([#11211](https://github.com/windmill-labs/windmill/issues/11211)) ([d1a2536](https://github.com/windmill-labs/windmill/commit/d1a25360b070994a31fb033707dbfde1fb553939))
-
-## [1.814.0](https://github.com/windmill-labs/windmill/compare/v1.813.0...v1.814.0) (2026-09-17)
-
-
-### Features
-
-* **ai-chat:** add list_workers and list_data_metrics global tools ([#11143](https://github.com/windmill-labs/windmill/issues/11143)) ([e954d33](https://github.com/windmill-labs/windmill/commit/e954d33613e4ff5027667eb8f646615d9bbd499d))
-* **ai-chat:** merge get_job_logs and get_flow_run_details into get_run ([#11172](https://github.com/windmill-labs/windmill/issues/11172)) ([5bb37ca](https://github.com/windmill-labs/windmill/commit/5bb37ca3388666fba72c55534e37f37bb3e9299e))
-* allow git sync auto-pull, promotion and PRs on Pro licenses ([#11173](https://github.com/windmill-labs/windmill/issues/11173)) ([02e47de](https://github.com/windmill-labs/windmill/commit/02e47de8b4c4f3f54753aabf8c67bc8e71ffb957))
-* badge chat-input flows on the home list ([#11164](https://github.com/windmill-labs/windmill/issues/11164)) ([3d08197](https://github.com/windmill-labs/windmill/commit/3d0819718221f885b61e73d02b43dcc853c7d02a))
-* collect flow conversations and agent memory once their last message goes ([#11178](https://github.com/windmill-labs/windmill/issues/11178)) ([23c24a9](https://github.com/windmill-labs/windmill/commit/23c24a9688d4c8c462f53221334d538280f16bca))
-* flow chat model picker on a shared model-settings component ([#11187](https://github.com/windmill-labs/windmill/issues/11187)) ([189793c](https://github.com/windmill-labs/windmill/commit/189793c2e4db7f1c853695ebcc895c1ec82ed19f))
-* keep flow inputs and seed the agent when chat mode is enabled ([#11177](https://github.com/windmill-labs/windmill/issues/11177)) ([68f2248](https://github.com/windmill-labs/windmill/commit/68f2248018fc218a090bf939e1eb22ff97d5bc22))
-* let plan mode search and read connected mcp servers ([#11205](https://github.com/windmill-labs/windmill/issues/11205)) ([5371519](https://github.com/windmill-labs/windmill/commit/5371519f0f5ce7750982dcdb374dca72115902e7))
-* let test_run_flow name the conversation of a chat-mode test run ([#11198](https://github.com/windmill-labs/windmill/issues/11198)) ([6e1ef93](https://github.com/windmill-labs/windmill/commit/6e1ef93f329cb396ffc3df3304d592e8fa0e0e71))
-* managed memory with an inherited or custom memory id per step ([#11118](https://github.com/windmill-labs/windmill/issues/11118)) ([c297ed0](https://github.com/windmill-labs/windmill/commit/c297ed0052d998fb8f063faa2a36c6eb03e327be))
-* render the flow chat through the shared session chat components ([#11175](https://github.com/windmill-labs/windmill/issues/11175)) ([a9ec0ae](https://github.com/windmill-labs/windmill/commit/a9ec0aec3ac0c6b0f7919d0eb2168816923826d7))
-* show flow step detail inside the graph tab on narrow detail layouts ([#11168](https://github.com/windmill-labs/windmill/issues/11168)) ([64dffe6](https://github.com/windmill-labs/windmill/commit/64dffe6106ad6a55b61a423c855a4b5b0cef533e))
-* store mcp tool call, result and reasoning on flow conversation rows ([#11176](https://github.com/windmill-labs/windmill/issues/11176)) ([a571117](https://github.com/windmill-labs/windmill/commit/a571117f3fd2cef14c920770645c60ee358fdfdd))
-* tell test flow conversations from deployed ones and rename a chat ([#11179](https://github.com/windmill-labs/windmill/issues/11179)) ([4eab995](https://github.com/windmill-labs/windmill/commit/4eab995cf7cf091a5e4640da4cb77e0921bb7fdf))
-
-
-### Bug Fixes
-
-* disable a schedule whose cron has no run left instead of panicking ([#11195](https://github.com/windmill-labs/windmill/issues/11195)) ([381d447](https://github.com/windmill-labs/windmill/commit/381d4470ef699ea82283742132e56556b95d2bd2))
-* skip expiry notifications for app embed and SDK tokens ([#11169](https://github.com/windmill-labs/windmill/issues/11169)) ([9d348f8](https://github.com/windmill-labs/windmill/commit/9d348f84c7830f36b6153472556fd70e3d84cd24))
-
-## [1.813.0](https://github.com/windmill-labs/windmill/compare/v1.812.0...v1.813.0) (2026-09-16)
-
-
-### Features
-
-* back AI sessions up to the workspace object storage ([#11116](https://github.com/windmill-labs/windmill/issues/11116)) ([796b6e5](https://github.com/windmill-labs/windmill/commit/796b6e5297d8cceb842ec097f33ec1c3115058bd))
-* delete a browser's copy of an AI session past its workspace retention ([#11156](https://github.com/windmill-labs/windmill/issues/11156)) ([a48ae65](https://github.com/windmill-labs/windmill/commit/a48ae656ae59d600311f81ef357d08df5226515a))
-* rename saved agents from the agent editor and flag broken links ([#11147](https://github.com/windmill-labs/windmill/issues/11147)) ([57a99f6](https://github.com/windmill-labs/windmill/commit/57a99f66a88f195cac8f583b59d69d627cc1ec1d))
-* retention for AI sessions on the object store and in the browser ([#11152](https://github.com/windmill-labs/windmill/issues/11152)) ([ee6d317](https://github.com/windmill-labs/windmill/commit/ee6d317e318fa8a1506fb18d51c45b627070627a))
-* return an ai agent step's thinking in its job result ([#11140](https://github.com/windmill-labs/windmill/issues/11140)) ([c4e878e](https://github.com/windmill-labs/windmill/commit/c4e878e8313a72a16bfbe81fbb3935ee7728ec6f))
-* stream reasoning summaries in AI agent Responses API steps ([#11124](https://github.com/windmill-labs/windmill/issues/11124)) ([b51c0ea](https://github.com/windmill-labs/windmill/commit/b51c0eabbe774c78a9cbf824a3df6528d970b8f6))
-
-
-### Bug Fixes
-
-* **apps:** re-check access in place after a password sign-in ([#11166](https://github.com/windmill-labs/windmill/issues/11166)) ([49d0310](https://github.com/windmill-labs/windmill/commit/49d0310ecc08040b6c6fa4f402584543d679e2e8))
-* **apps:** run-mode inline app component uses only pinned content ([#11135](https://github.com/windmill-labs/windmill/issues/11135)) ([781b5a5](https://github.com/windmill-labs/windmill/commit/781b5a57e81eb721d97d7b87e23dd84f23895400))
-* **cli:** keep the workspace color when settings are synced from git ([#11144](https://github.com/windmill-labs/windmill/issues/11144)) ([129c045](https://github.com/windmill-labs/windmill/commit/129c04559548cd1bcf67758ec416fb2a48e7b928))
-* **cli:** resolve lockgen imports through modules a push leaves alone ([#11160](https://github.com/windmill-labs/windmill/issues/11160)) ([54553b2](https://github.com/windmill-labs/windmill/commit/54553b2add6941395f03ca34ee24cf335a3b23c2))
-* dispatch workflow-as-code tasks from a deployed flow's inline step ([#11146](https://github.com/windmill-labs/windmill/issues/11146)) ([e8078f2](https://github.com/windmill-labs/windmill/commit/e8078f2a963166b09849650424583f5dcfd28a84))
-* keep sidebar confirmation dialogs from being confined to the rail ([#11158](https://github.com/windmill-labs/windmill/issues/11158)) ([b9b5988](https://github.com/windmill-labs/windmill/commit/b9b5988ebdf3edd75add445282977c516ef5ed51))
-* keep the instance users table's actions and header in view ([#11145](https://github.com/windmill-labs/windmill/issues/11145)) ([a9a9335](https://github.com/windmill-labs/windmill/commit/a9a9335a34a13ffd8cd2699adc92087b679548ca))
-* stop reading an array job result as wm_failure or http response ([#11154](https://github.com/windmill-labs/windmill/issues/11154)) ([9a8a9c4](https://github.com/windmill-labs/windmill/commit/9a8a9c480cf008761ec6ceaff694085a252a32ae))
-* walk the whole fork ancestry for app installations and fork conflicts ([#11151](https://github.com/windmill-labs/windmill/issues/11151)) ([73dc892](https://github.com/windmill-labs/windmill/commit/73dc892f9c9c840a5f0fb12fcbb28bbe0f38795f))
-* **worker:** bound cache transfers and import fetches in bun jobs ([#11138](https://github.com/windmill-labs/windmill/issues/11138)) ([31c4325](https://github.com/windmill-labs/windmill/commit/31c43255fdcc827c3fdf65e40238f8f3a83201cd))
-
-## [1.812.0](https://github.com/windmill-labs/windmill/compare/v1.811.1...v1.812.0) (2026-09-15)
-
-
-### Features
-
-* add per-route CORS origin allowlist for HTTP triggers ([#10833](https://github.com/windmill-labs/windmill/issues/10833)) ([d8d7332](https://github.com/windmill-labs/windmill/commit/d8d7332eb6d92f7a55b82890de5de4196039b40d))
-* **ai-sessions:** share session artifacts with the workspace by link ([#11115](https://github.com/windmill-labs/windmill/issues/11115)) ([57a134e](https://github.com/windmill-labs/windmill/commit/57a134e2de18e27b3c1d3066a60b892af1089b30))
-* **cli:** list, get and restore trashed items with wmill trash ([#11125](https://github.com/windmill-labs/windmill/issues/11125)) ([a95e950](https://github.com/windmill-labs/windmill/commit/a95e950529f6f01a220e09d322d5a4fb507ea694))
-* dynamic AI agent toolsets ([#11050](https://github.com/windmill-labs/windmill/issues/11050)) ([a78beff](https://github.com/windmill-labs/windmill/commit/a78beff743f6bb289805c263a8d32515bea9688f))
-* **git-sync:** gate GitHub PRs on Windmill CI test results (WIN-2051) ([#10096](https://github.com/windmill-labs/windmill/issues/10096)) ([80eba80](https://github.com/windmill-labs/windmill/commit/80eba80d6ed51753cfaa67310f1a0f5dd5ce0484))
-* pre-approved cloud accounts: login links, OAuth adoption, setup, and the trial bridge ([#10875](https://github.com/windmill-labs/windmill/issues/10875)) ([91e6dc3](https://github.com/windmill-labs/windmill/commit/91e6dc39ce795fafc2bed0d799b62c9880fd6430))
-* run a flow step test through the chat's argument form ([#11114](https://github.com/windmill-labs/windmill/issues/11114)) ([5d32b61](https://github.com/windmill-labs/windmill/commit/5d32b6106788b665e4752fcac63ff1ef457d604e))
-* store resource type display names and label hub integrations ([#11113](https://github.com/windmill-labs/windmill/issues/11113)) ([42f4896](https://github.com/windmill-labs/windmill/commit/42f489685bc87a8479818175c87b5a21b0c17998))
-* windmill-chat sdk for chat-mode flows in external frontends and raw apps ([#11117](https://github.com/windmill-labs/windmill/issues/11117)) ([e8c02c0](https://github.com/windmill-labs/windmill/commit/e8c02c04cdb1a3f199f3f0a8b53a839a53d4a1d9))
-
-
-### Bug Fixes
-
-* **ai-chat:** hide other users' MCP servers from the chat unless shared ([#11112](https://github.com/windmill-labs/windmill/issues/11112)) ([244ec13](https://github.com/windmill-labs/windmill/commit/244ec132914a6e689d7d79da9cf2cb39f920aaef))
-* **cli:** say where a sync push deleted variable or resource went ([#10851](https://github.com/windmill-labs/windmill/issues/10851)) ([d54a66f](https://github.com/windmill-labs/windmill/commit/d54a66f15c09c34f7a2b45c2e6e9649807a19265))
-* **cli:** stage a rewritten shared lockfile on git-sync deploy push ([#11126](https://github.com/windmill-labs/windmill/issues/11126)) ([75ee497](https://github.com/windmill-labs/windmill/commit/75ee497011dca076de0923ded9da8e23e08bfb84))
-* **flows:** stop re-evaluating skip_if once a loop is in progress ([#11008](https://github.com/windmill-labs/windmill/issues/11008)) ([56e21bc](https://github.com/windmill-labs/windmill/commit/56e21bce832182528562688acd13ec416e01ebfc))
-* **git-sync:** run auto-pull as the admin who enabled it ([#11121](https://github.com/windmill-labs/windmill/issues/11121)) ([69e6efd](https://github.com/windmill-labs/windmill/commit/69e6efd875e020779ea115c096331da8eae2ffe7))
-* keep a script draft's password marking through the chat's run form ([#11110](https://github.com/windmill-labs/windmill/issues/11110)) ([56dd940](https://github.com/windmill-labs/windmill/commit/56dd940e34b146c3ca25de7959b4fb618308eb86))
-* **python:** parse wheel RECORD paths as RFC 4180 csv fields ([#11133](https://github.com/windmill-labs/windmill/issues/11133)) ([9696308](https://github.com/windmill-labs/windmill/commit/96963080f1711192fe1d9bc4142c1710511504d4))
-* re-attach flow chat to the same job on SSE timeout instead of re-running it ([#11122](https://github.com/windmill-labs/windmill/issues/11122)) ([94c548c](https://github.com/windmill-labs/windmill/commit/94c548cd5dc43131e0471b0edabe496dff245862))
-* set the enclosing span's trace context on exported log records ([#11123](https://github.com/windmill-labs/windmill/issues/11123)) ([d0cac08](https://github.com/windmill-labs/windmill/commit/d0cac0807f1b6f4fc76d6e5f7e27e03d30abec8d))
-* skip instance group members that are not email addresses ([#11128](https://github.com/windmill-labs/windmill/issues/11128)) ([e3e638f](https://github.com/windmill-labs/windmill/commit/e3e638f7f587f0ee090d06436575b65a0860a855))
-* wake a WAC parent from every path that completes its child ([#11119](https://github.com/windmill-labs/windmill/issues/11119)) ([0b1e9c0](https://github.com/windmill-labs/windmill/commit/0b1e9c0dda2ae55c56b1e0de5c0419b4511b973f))
-
-## [1.811.1](https://github.com/windmill-labs/windmill/compare/v1.811.0...v1.811.1) (2026-09-13)
-
-
-### Bug Fixes
-
-* check kafka trigger topics against a set, not a one-pass iterator ([#11108](https://github.com/windmill-labs/windmill/issues/11108)) ([bf4fa2b](https://github.com/windmill-labs/windmill/commit/bf4fa2b174b8d4a5897b2aa0d108480442bd0e18))
-* let the hub_sync job read the uid and hub_base_url settings ([#11106](https://github.com/windmill-labs/windmill/issues/11106)) ([45102c8](https://github.com/windmill-labs/windmill/commit/45102c82659d86ca5ec6fd3aee57232f2348736c))
-
-## [1.811.0](https://github.com/windmill-labs/windmill/compare/v1.810.0...v1.811.0) (2026-09-12)
-
-
-### Features
-
-* make snowflake_oauth work as a dbt warehouse on every engine ([#11095](https://github.com/windmill-labs/windmill/issues/11095)) ([9fc50a2](https://github.com/windmill-labs/windmill/commit/9fc50a23fb75cb541c481247b7b25c206fb06d36))
-
-
-### Bug Fixes
-
-* accept any hub version of the git sync script in the token check ([#11099](https://github.com/windmill-labs/windmill/issues/11099)) ([670628b](https://github.com/windmill-labs/windmill/commit/670628b300ab119363adb5496ebfe3c6ccd80063))
-* bring back Publish to Hub for scripts ([#11097](https://github.com/windmill-labs/windmill/issues/11097)) ([864e5f0](https://github.com/windmill-labs/windmill/commit/864e5f02ec1c2dd16c74524f551f44485df10a20))
-* bundle deployed bun scripts whose only pin is on a dynamic import ([#11096](https://github.com/windmill-labs/windmill/issues/11096)) ([4afb9aa](https://github.com/windmill-labs/windmill/commit/4afb9aa677ac11d22e22e54bb6fd7881378b7005))
-* clear a stale git auto-pull failure and show the status time ([#11100](https://github.com/windmill-labs/windmill/issues/11100)) ([e877b5f](https://github.com/windmill-labs/windmill/commit/e877b5f2e81b1741aee90e843c8cccc22f9eef24))
-* stop a resource delete from taking variables it does not own ([#11102](https://github.com/windmill-labs/windmill/issues/11102)) ([2a21efa](https://github.com/windmill-labs/windmill/commit/2a21efa11b8307b331a8c20720028444dd3c62ff))
-
-## [1.810.0](https://github.com/windmill-labs/windmill/compare/v1.809.0...v1.810.0) (2026-09-11)
-
-
-### Features
-
-* **ai-sessions:** turn skills on by default, and group them by folder ([#11058](https://github.com/windmill-labs/windmill/issues/11058)) ([d8b9174](https://github.com/windmill-labs/windmill/commit/d8b9174235b97d0b4ef9f281e20e5704182d8dcb))
-* background and wait_seconds for run_script, skip preprocessor ([#11092](https://github.com/windmill-labs/windmill/issues/11092)) ([2939c2d](https://github.com/windmill-labs/windmill/commit/2939c2dd4b129640d87ef45c7a24c6f215a3239a))
-* give the chat the full MCP tool schema, and mark calls with the provider icon ([#11086](https://github.com/windmill-labs/windmill/issues/11086)) ([e7c6f85](https://github.com/windmill-labs/windmill/commit/e7c6f85553bd8efb0f7af0f488f615ac93c496ae))
-* let apps hide the viewer login status on public urls ([#11089](https://github.com/windmill-labs/windmill/issues/11089)) ([6056ec7](https://github.com/windmill-labs/windmill/commit/6056ec7148bce9f8ed171dd29f544696c335de7d))
-* remove the viewer login status badge from public apps ([#11090](https://github.com/windmill-labs/windmill/issues/11090)) ([75d7bee](https://github.com/windmill-labs/windmill/commit/75d7bee178886461fe49090d606a708f25c02d1a))
-* run a deployed flow through the chat's argument form ([#11085](https://github.com/windmill-labs/windmill/issues/11085)) ([b50de89](https://github.com/windmill-labs/windmill/commit/b50de8947908f1a5a4e9472afe6c0ecd25892e93))
-* run a flow test through the chat's argument form ([#11069](https://github.com/windmill-labs/windmill/issues/11069)) ([172d6c2](https://github.com/windmill-labs/windmill/commit/172d6c275b92b39d13848b543df9db10148e94ef))
-
-
-### Bug Fixes
-
-* attach TLS to gRPC OTLP exporters for https endpoints ([#11078](https://github.com/windmill-labs/windmill/issues/11078)) ([f915ed6](https://github.com/windmill-labs/windmill/commit/f915ed6a46e14341ddb213e869090edb68763032))
-* **dbt:** stop dbt sending anonymous usage stats from workers ([#11091](https://github.com/windmill-labs/windmill/issues/11091)) ([d539e86](https://github.com/windmill-labs/windmill/commit/d539e8674f2bf92d6c10b182ed4a1073714062c0))
-* keep pinned import versions of imported scripts in bun lockfiles ([#11082](https://github.com/windmill-labs/windmill/issues/11082)) ([57f8b08](https://github.com/windmill-labs/windmill/commit/57f8b0826ad61cb118d0cafbbc9203327d858940))
-* let admins and background sync reach private git hosts ([#11084](https://github.com/windmill-labs/windmill/issues/11084)) ([fa53099](https://github.com/windmill-labs/windmill/commit/fa53099e2b87a8676c5d6a18e77844e17ff45efd))
-* serve instance env settings at the documented /settings/local path ([#11075](https://github.com/windmill-labs/windmill/issues/11075)) ([f8f7c00](https://github.com/windmill-labs/windmill/commit/f8f7c0009f32c1440566420725b12e78ca804b03))
-* show symlinked files in the git repo viewer ([#11081](https://github.com/windmill-labs/windmill/issues/11081)) ([e6d4f44](https://github.com/windmill-labs/windmill/commit/e6d4f44a6122dab47fbee2a2a2b4330a62841bed))
-* support gzip and zstd compression for OTLP export over gRPC ([#11077](https://github.com/windmill-labs/windmill/issues/11077)) ([b156778](https://github.com/windmill-labs/windmill/commit/b156778da24e3827f723e503f80df68de87ddf7e))
-* unpin only the specifiers in the bundle a bun modules run executes ([#11083](https://github.com/windmill-labs/windmill/issues/11083)) ([30ffdbe](https://github.com/windmill-labs/windmill/commit/30ffdbecc15270562ceed3030c50a1cf81b1195c))
-
-
-### Performance Improvements
-
-* lazy-load the low-code runtime on public app pages ([#11087](https://github.com/windmill-labs/windmill/issues/11087)) ([e651b4c](https://github.com/windmill-labs/windmill/commit/e651b4cd63c3bd64a8739c9f60c6dfa437f19b4b))
-
-## [1.809.0](https://github.com/windmill-labs/windmill/compare/v1.808.0...v1.809.0) (2026-09-10)
-
-
-### Features
-
-* add a minimal skin for the approval page and slack/teams ([#11061](https://github.com/windmill-labs/windmill/issues/11061)) ([63cb46d](https://github.com/windmill-labs/windmill/commit/63cb46d7bb9db1d996aa38e06bd3afebc60111bd))
-* live queue status per tag and bounded queue metric charts ([#11067](https://github.com/windmill-labs/windmill/issues/11067)) ([569adb8](https://github.com/windmill-labs/windmill/commit/569adb85c1885d289e80a70a166f0f74e6d5ba83))
-* **otel:** read the OTLP metrics temporality preference ([#11064](https://github.com/windmill-labs/windmill/issues/11064)) ([2f88769](https://github.com/windmill-labs/windmill/commit/2f8876908719b3640d7cfc9364a7b0f7145fc356))
-* **otel:** support standard OTEL resource attribute env vars ([#10974](https://github.com/windmill-labs/windmill/issues/10974)) ([0a40eea](https://github.com/windmill-labs/windmill/commit/0a40eea37a7dbde5fc4760d6333d81186dfee255))
-* report script metadata with no content file in wmill lint ([#11053](https://github.com/windmill-labs/windmill/issues/11053)) ([8820b9f](https://github.com/windmill-labs/windmill/commit/8820b9fc644c6620c50517cd0d902015e2e670e2))
-* show the workspace an operator is in, and let them switch ([#11059](https://github.com/windmill-labs/windmill/issues/11059)) ([385086f](https://github.com/windmill-labs/windmill/commit/385086ffc21c72cd07624584932a4a301c23a732))
-* tuck other users' spaces into a collapsible home tree row ([#11073](https://github.com/windmill-labs/windmill/issues/11073)) ([d87f089](https://github.com/windmill-labs/windmill/commit/d87f089288996af9ea7e3b017a5ef35d4ded880d))
-
-
-### Bug Fixes
-
-* **ai-chat:** test_run_flow could test a different flow than the one asked ([#11066](https://github.com/windmill-labs/windmill/issues/11066)) ([fa73539](https://github.com/windmill-labs/windmill/commit/fa73539839071491fb2cbad9242f52ad22b975bf))
-* bound list_jobs runtime and paginate runs on the sorted column ([#11072](https://github.com/windmill-labs/windmill/issues/11072)) ([f517402](https://github.com/windmill-labs/windmill/commit/f51740253871960b55ab2aa8989e8df3fbde0351))
-* **frontend:** clear the flow graph selection through xyflow's store ([#11056](https://github.com/windmill-labs/windmill/issues/11056)) ([b4be8bc](https://github.com/windmill-labs/windmill/commit/b4be8bc5354fbd3a47c267c331aaf603c0f90e6e))
-* **frontend:** recompute dataflow edges when selecting a step ([#11070](https://github.com/windmill-labs/windmill/issues/11070)) ([08d876a](https://github.com/windmill-labs/windmill/commit/08d876aebf32ebb995a8c1839aa87794c0176bed))
-* **frontend:** restore heading sizes in note markdown and keep group notes on id change ([#11047](https://github.com/windmill-labs/windmill/issues/11047)) ([e63072c](https://github.com/windmill-labs/windmill/commit/e63072c216383700a23504be89782f4c69657174))
-* give every table a primary key so the db can be logically replicated ([#11036](https://github.com/windmill-labs/windmill/issues/11036)) ([e62bfdc](https://github.com/windmill-labs/windmill/commit/e62bfdcd8c6f1389601ccd2b5809c5eff0ff262e))
-* keep an app's deployed policy on wmill push ([#11049](https://github.com/windmill-labs/windmill/issues/11049)) ([0af7675](https://github.com/windmill-labs/windmill/commit/0af7675588300863883a99c7f14bc53cafec8a7e))
-* refuse cross-site GET requests that run Hub scripts ([#11054](https://github.com/windmill-labs/windmill/issues/11054)) ([ab9efc8](https://github.com/windmill-labs/windmill/commit/ab9efc897cc94d61a67263772806b15e9225cece))
-* skip the deploy PR when the git sync push committed nothing ([#11076](https://github.com/windmill-labs/windmill/issues/11076)) ([8ecbd33](https://github.com/windmill-labs/windmill/commit/8ecbd339eef7314a93d599fcea4377299d4c493d))
-* space the trailing AI settings cards ([#11044](https://github.com/windmill-labs/windmill/issues/11044)) ([5d7eed1](https://github.com/windmill-labs/windmill/commit/5d7eed1c02b0966289cc8cca00a15d76dad187a5))
-* stop uv pip compile emitting lockfile annotations ([#11042](https://github.com/windmill-labs/windmill/issues/11042)) ([8aa8b7e](https://github.com/windmill-labs/windmill/commit/8aa8b7ee6c23f859f169637c0bfd3f8d964509e9))
-* surface why a private or untrusted git host is unreachable ([#11068](https://github.com/windmill-labs/windmill/issues/11068)) ([c57b18e](https://github.com/windmill-labs/windmill/commit/c57b18e46fcdd319213fe0a537cb18de418ca688))
-
-
-### Performance Improvements
-
-* index the FK columns that cascade on workspace delete ([#11052](https://github.com/windmill-labs/windmill/issues/11052)) ([9a563f6](https://github.com/windmill-labs/windmill/commit/9a563f6d72da28fe09b785cd0683e9698df72bba))
-* only write queue metrics when a tag's backlog changes ([#11055](https://github.com/windmill-labs/windmill/issues/11055)) ([9d75929](https://github.com/windmill-labs/windmill/commit/9d75929247ea2ec39286971fcbebf95d886194f3))
-
-## [1.808.0](https://github.com/windmill-labs/windmill/compare/v1.807.0...v1.808.0) (2026-09-09)
-
-
-### Features
-
-* run and test scripts from the AI chat through an argument form ([#11001](https://github.com/windmill-labs/windmill/issues/11001)) ([a6abf2c](https://github.com/windmill-labs/windmill/commit/a6abf2c8a744e9ee6acf4830cdfbb84f2f95cb36))
-
-## [1.807.0](https://github.com/windmill-labs/windmill/compare/v1.806.0...v1.807.0) (2026-09-09)
-
-
-### Features
-
-* add a dismissible instance-wide announcement banner ([#11037](https://github.com/windmill-labs/windmill/issues/11037)) ([abf4c6c](https://github.com/windmill-labs/windmill/commit/abf4c6c2348014ea4401b9be62b5b15e5800e879))
-* batch chained DDL statements into a single migration ([#11038](https://github.com/windmill-labs/windmill/issues/11038)) ([656e609](https://github.com/windmill-labs/windmill/commit/656e609595833bc854f845d35cf43157e76d732f))
-* create the cloud workspace in onboarding, and teach the empty home ([#10959](https://github.com/windmill-labs/windmill/issues/10959)) ([fd35b47](https://github.com/windmill-labs/windmill/commit/fd35b4765843879cb2254f402c142fd7510f1916))
-* link from the public run view to the authenticated run page ([#11041](https://github.com/windmill-labs/windmill/issues/11041)) ([09b81a9](https://github.com/windmill-labs/windmill/commit/09b81a9294bed2795a1a7b688d0b02e0a61957ea))
-* make guest access unavailable on the shared cloud ([#11040](https://github.com/windmill-labs/windmill/issues/11040)) ([0b63e0a](https://github.com/windmill-labs/windmill/commit/0b63e0a6929088ff25def4fd6547cf61668251a5))
-
-
-### Bug Fixes
-
-* ignore comments and continuations in python lockfiles ([#11035](https://github.com/windmill-labs/windmill/issues/11035)) ([90c4e10](https://github.com/windmill-labs/windmill/commit/90c4e1020a2ff896977648dd68b572413cea7709))
-* refetch an unparseable hub script cache entry instead of panicking ([#11033](https://github.com/windmill-labs/windmill/issues/11033)) ([88c3ebd](https://github.com/windmill-labs/windmill/commit/88c3ebdfc1325ffbea4521d854e71d231a6409c4))
-* stop a new AI session adopting a legacy sidebar chat ([#11039](https://github.com/windmill-labs/windmill/issues/11039)) ([1076b63](https://github.com/windmill-labs/windmill/commit/1076b638d987ba99c5c27e5478ca580534b9d572))
-
-## [1.806.0](https://github.com/windmill-labs/windmill/compare/v1.805.0...v1.806.0) (2026-09-08)
-
-
-### Features
-
-* bring gitlab repositories to parity for git sync ([#10938](https://github.com/windmill-labs/windmill/issues/10938)) ([9444049](https://github.com/windmill-labs/windmill/commit/9444049d6013c77a5f25f01a736eb5cd741fb3e6))
-* draw a dbt column trace, across projects and the pipeline boundary ([#11014](https://github.com/windmill-labs/windmill/issues/11014)) ([33f9828](https://github.com/windmill-labs/windmill/commit/33f9828c3ed15fe63fccedc1550584f15c0490ab))
-* durable dbt state per environment, and `--defer` onto it ([#10975](https://github.com/windmill-labs/windmill/issues/10975)) ([621fac5](https://github.com/windmill-labs/windmill/commit/621fac55abcd1859e8c8c06e5f4412e61bb85d59))
-* ingest dbt column lineage and real column schemas from the engine's parquet index ([#10977](https://github.com/windmill-labs/windmill/issues/10977)) ([0139467](https://github.com/windmill-labs/windmill/commit/0139467b01b82e4b3d474ca3f205358fa607d19a))
-* let a worker group override the dependency cache object store ([#11019](https://github.com/windmill-labs/windmill/issues/11019)) ([de98adf](https://github.com/windmill-labs/windmill/commit/de98adf055835ab7c4d6305e7d5d3bdab915876b))
-* **nativets:** bound fetch on a peer that never answers ([#11026](https://github.com/windmill-labs/windmill/issues/11026)) ([785277e](https://github.com/windmill-labs/windmill/commit/785277e0bb2ea77b71a89dd4d389d439dfcf9e03))
-* recognize `// volume:` mounts in PHP scripts ([#11018](https://github.com/windmill-labs/windmill/issues/11018)) ([f081fb1](https://github.com/windmill-labs/windmill/commit/f081fb10705cadf99e99dfa786d1cc2ebf0447db))
-* report a WAC task failure the workflow body never awaited ([#11017](https://github.com/windmill-labs/windmill/issues/11017)) ([3e3a41d](https://github.com/windmill-labs/windmill/commit/3e3a41d418d4ee3fe060bd3acf3324f311d89c8a))
-* retry a workflow-as-code task from its task options ([#11013](https://github.com/windmill-labs/windmill/issues/11013)) ([d3f305d](https://github.com/windmill-labs/windmill/commit/d3f305db982b7c5dc49babf9bec8b62adcd2557d))
-
-
-### Bug Fixes
-
-* chain redeploys onto a retired path's version history ([#11029](https://github.com/windmill-labs/windmill/issues/11029)) ([0b37226](https://github.com/windmill-labs/windmill/commit/0b372260787edb7e9627ad4fb6637ad5f1024e0a))
-* make the native trigger disable/enable toggle actually save ([#11024](https://github.com/windmill-labs/windmill/issues/11024)) ([448fce9](https://github.com/windmill-labs/windmill/commit/448fce93f743d5b2ef2a2d4496eb2ec238594a0a))
-* offload php signature parsing from async workers ([#11027](https://github.com/windmill-labs/windmill/issues/11027)) ([2cb02e3](https://github.com/windmill-labs/windmill/commit/2cb02e3b3398db49f16377dd79dde2dd6fb5cc02))
-* reduce php parser stack use in debug workers ([#11025](https://github.com/windmill-labs/windmill/issues/11025)) ([2ae8509](https://github.com/windmill-labs/windmill/commit/2ae8509b14f112c9ef5b71321e8fd52596a16c10))
-
-
-### Performance Improvements
-
-* reduce shared worker debug polling frames ([#11028](https://github.com/windmill-labs/windmill/issues/11028)) ([946756a](https://github.com/windmill-labs/windmill/commit/946756ae83deb4e7a93111edddbd4d98c596d5a9))
-
-## [1.805.0](https://github.com/windmill-labs/windmill/compare/v1.804.0...v1.805.0) (2026-09-07)
-
-
-### Features
-
-* **git-sync:** sync extra_perms for variables ([#11004](https://github.com/windmill-labs/windmill/issues/11004)) ([ee9e550](https://github.com/windmill-labs/windmill/commit/ee9e550a484fda286eeab43b7db5f314b8b2d0d9))
-* go to referenced row from foreign-keyed cells in the database manager ([#10998](https://github.com/windmill-labs/windmill/issues/10998)) ([e2b63d1](https://github.com/windmill-labs/windmill/commit/e2b63d177ae4e5c980cb5da34154540c90771b63))
-* let `// materialize` declare a `dbt://` warehouse-relation write ([#10978](https://github.com/windmill-labs/windmill/issues/10978)) ([c6e0302](https://github.com/windmill-labs/windmill/commit/c6e0302d7c1c60147f19d55a3923be8b1aa99c9c))
-* report resource type picks to the hub and rank pickers by popularity ([#10982](https://github.com/windmill-labs/windmill/issues/10982)) ([48a5615](https://github.com/windmill-labs/windmill/commit/48a56158c135c3b13a02f73b7b8438bc691f85b4))
-* run a linked AI agent's draft when testing a flow, and offer to deploy it ([#10993](https://github.com/windmill-labs/windmill/issues/10993)) ([7feaf61](https://github.com/windmill-labs/windmill/commit/7feaf619cf0ec021d66be14ef535cf2149bec58a))
-* show the new-tab icon on a chat path pill while the modifier is held ([#10976](https://github.com/windmill-labs/windmill/issues/10976)) ([5da4ea4](https://github.com/windmill-labs/windmill/commit/5da4ea43fbd01e43aa14e75dc597d7ce5d8797ab))
-
-
-### Bug Fixes
-
-* **cli:** keep permissioned_as on single-item push, as sync push does ([#11000](https://github.com/windmill-labs/windmill/issues/11000)) ([5f3f99b](https://github.com/windmill-labs/windmill/commit/5f3f99ba6915b7c5df663a30b35f4cd02050e728))
-* **cli:** say which workspace id is targeted, and when wmill.yaml is bypassed ([#11006](https://github.com/windmill-labs/windmill/issues/11006)) ([7643e9b](https://github.com/windmill-labs/windmill/commit/7643e9bd77c56f72596b8dca50801baf58984198))
-* **frontend:** no phantom draft when opening a CLI-pushed script ([#10997](https://github.com/windmill-labs/windmill/issues/10997)) ([1be390a](https://github.com/windmill-labs/windmill/commit/1be390aa878e15a58f530f3a878e8f9caeb89c43))
-* **frontend:** stop hover flicker on asset nodes shared with an overflow popover ([#10996](https://github.com/windmill-labs/windmill/issues/10996)) ([519a5c8](https://github.com/windmill-labs/windmill/commit/519a5c8bc70b44a7417e83c26c7b9c58b2c4fb9c))
-* let a draft-only schedule, trigger or resource be deleted ([#11010](https://github.com/windmill-labs/windmill/issues/11010)) ([8d0f475](https://github.com/windmill-labs/windmill/commit/8d0f4754e4e0c78696ee0c97ff2de3016ece3bac))
-* point the app viewer's edit button at the editor for the app's kind ([#11009](https://github.com/windmill-labs/windmill/issues/11009)) ([8f553ea](https://github.com/windmill-labs/windmill/commit/8f553eab353103fd8a28a00532e1766f133590de))
-* seed runs page filter defaults through the url so they survive sync ([#11005](https://github.com/windmill-labs/windmill/issues/11005)) ([f381acd](https://github.com/windmill-labs/windmill/commit/f381acdb37f66f5e272bc37938e69f734987d53f))
-* stop an untouched item's form from saving a draft nobody wrote ([#10964](https://github.com/windmill-labs/windmill/issues/10964)) ([c3f7f8a](https://github.com/windmill-labs/windmill/commit/c3f7f8a45830fb548aa628ebf6e2b6c95c6de67f))
-* write and read python job files as utf-8, not the platform locale ([#10994](https://github.com/windmill-labs/windmill/issues/10994)) ([670404f](https://github.com/windmill-labs/windmill/commit/670404ffe27fedc3858b46b0c6b3312fbe175e13))
-
-## [1.804.0](https://github.com/windmill-labs/windmill/compare/v1.803.0...v1.804.0) (2026-09-05)
-
-
-### Features
-
-* **ai-sessions:** replace the context panel with an assistant settings modal ([#10919](https://github.com/windmill-labs/windmill/issues/10919)) ([fda7b3f](https://github.com/windmill-labs/windmill/commit/fda7b3f086619e3716e5894c07be127104174f1d))
-* **frontend:** group the agent form and edit saved agents as drafts ([#10880](https://github.com/windmill-labs/windmill/issues/10880)) ([f037c73](https://github.com/windmill-labs/windmill/commit/f037c73d104fffe7bb2640a5b1f2a92154c85e06))
-* guest app execution mode, a role that takes no seat ([#10929](https://github.com/windmill-labs/windmill/issues/10929)) ([fce635d](https://github.com/windmill-labs/windmill/commit/fce635d3c4c8962f448140ceb55a00fb99012701))
-* guest JWT entry for embedded apps ([#10954](https://github.com/windmill-labs/windmill/issues/10954)) ([8aab503](https://github.com/windmill-labs/windmill/commit/8aab5034a68a4aafb264b0e86d000ef58f4a8511))
-* instrument sandbox isolation, data tables and in-flow script edits ([#10981](https://github.com/windmill-labs/windmill/issues/10981)) ([130a2f7](https://github.com/windmill-labs/windmill/commit/130a2f74083ba1bd308beeb86e2cbbaa41fd3345))
-* make S3 permission rules reorderable by drag and drop ([#10958](https://github.com/windmill-labs/windmill/issues/10958)) ([2257b05](https://github.com/windmill-labs/windmill/commit/2257b05b2857c7ae2b5ae0b4f9004e2d4e757925))
-* reconcile IdP instance groups from the SSO groups claim ([#10957](https://github.com/windmill-labs/windmill/issues/10957)) ([79426a1](https://github.com/windmill-labs/windmill/commit/79426a1a68a6b19e12af4633b8a79d07a103a106))
-
-
-### Bug Fixes
-
-* deploy a relocked script version only when its lock changed ([#10966](https://github.com/windmill-labs/windmill/issues/10966)) ([1113828](https://github.com/windmill-labs/windmill/commit/11138284acc4c1d8673e86823c7f74c9e1f419e6))
-* **frontend:** render ordered lists in markdown descriptions ([#10973](https://github.com/windmill-labs/windmill/issues/10973)) ([a0295b2](https://github.com/windmill-labs/windmill/commit/a0295b20c436fd3f2bd6a6d294ae3cee005391e8))
-* keep braces inside string tool arguments out of JSON depth count ([#10965](https://github.com/windmill-labs/windmill/issues/10965)) ([3e3d2a6](https://github.com/windmill-labs/windmill/commit/3e3d2a636334146014926841949372083e6e8516))
-* keep the instance user editor popover inside the viewport ([#10979](https://github.com/windmill-labs/windmill/issues/10979)) ([1901d31](https://github.com/windmill-labs/windmill/commit/1901d3193bfc6a9e29d0b7c5389fef44ff9d3687))
-* meter WAC compute per segment, not the whole sleep ([#10985](https://github.com/windmill-labs/windmill/issues/10985)) ([5428710](https://github.com/windmill-labs/windmill/commit/54287102b22dd17903cdd4b48c5828875e5b9be4))
-* name the extension to load when duckdb autoload hits the fence ([#10972](https://github.com/windmill-labs/windmill/issues/10972)) ([64b6798](https://github.com/windmill-labs/windmill/commit/64b679879936e2ddf4dbc2f90edbd56e3893bd83))
-* **oauth:** show the account chooser on an explicit Google/Microsoft login ([#10961](https://github.com/windmill-labs/windmill/issues/10961)) ([9f7908e](https://github.com/windmill-labs/windmill/commit/9f7908e2622647388768b574083cc48a6e1990f1))
-* patch critical CVEs in the worker image ([#10962](https://github.com/windmill-labs/windmill/issues/10962)) ([b100606](https://github.com/windmill-labs/windmill/commit/b100606da6a61f2dbcb24516363f43643bc917e3))
-* render the MCP OAuth consent page without a workspace ([#10988](https://github.com/windmill-labs/windmill/issues/10988)) ([ebfac29](https://github.com/windmill-labs/windmill/commit/ebfac29096f12c4da2df45d5d82db83d352f3426))
-* stand the WAC park down for a cancel that beat it to the row ([#10990](https://github.com/windmill-labs/windmill/issues/10990)) ([f977f5b](https://github.com/windmill-labs/windmill/commit/f977f5bf8b1ac70d3afbdc8ad6fcbe072cc51ebc))
-
-## [1.803.0](https://github.com/windmill-labs/windmill/compare/v1.802.0...v1.803.0) (2026-09-03)
-
-
-### Features
-
-* expose request headers to scripts invoked via MCP ([#10903](https://github.com/windmill-labs/windmill/issues/10903)) ([e474e88](https://github.com/windmill-labs/windmill/commit/e474e8803ce2ff5c2df09a58dab51d45f5c922ca))
-* reuse an existing workspace resource in the project import wizard ([#10935](https://github.com/windmill-labs/windmill/issues/10935)) ([582761e](https://github.com/windmill-labs/windmill/commit/582761e37c776e92dc1c6ebfee8c4efe7c35d822))
-
-
-### Bug Fixes
-
-* bump git sync hub scripts to cli 1.802.1, test the fork ui pull ([#10955](https://github.com/windmill-labs/windmill/issues/10955)) ([ca88009](https://github.com/windmill-labs/windmill/commit/ca8800959aa6a0017cc29bad187c9f49e0d13cc4))
-* **cli:** make a sync push into a fork converge on schedules and inline names ([#10951](https://github.com/windmill-labs/windmill/issues/10951)) ([0f5a1db](https://github.com/windmill-labs/windmill/commit/0f5a1db2abba8df30a2f975f4498e269f13cf93d))
-* fade the home Build with AI placeholder every 10s instead of typing it ([#10953](https://github.com/windmill-labs/windmill/issues/10953)) ([3d089b5](https://github.com/windmill-labs/windmill/commit/3d089b57344f5814086e6176301c5031dc519674))
-* let operators use wmill.datatable() from within running jobs ([#10931](https://github.com/windmill-labs/windmill/issues/10931)) ([9b64a89](https://github.com/windmill-labs/windmill/commit/9b64a89cd46ae718d6c58fa12f925fa041fb1032))
-
-## [1.802.0](https://github.com/windmill-labs/windmill/compare/v1.801.0...v1.802.0) (2026-09-02)
-
-
-### Features
-
-* add retention cleanup for the otel_traces table ([#10949](https://github.com/windmill-labs/windmill/issues/10949)) ([d472193](https://github.com/windmill-labs/windmill/commit/d472193e5bf5f6428e0096a402eb2c9299634fb2))
-* open path links from chat messages in the session preview panel ([#10881](https://github.com/windmill-labs/windmill/issues/10881)) ([f10ac6c](https://github.com/windmill-labs/windmill/commit/f10ac6c2b3644fb16697e650efbc4f7cd3c6944c))
-* restore owner and label filter chips on the homepage ([#10942](https://github.com/windmill-labs/windmill/issues/10942)) ([ccf8476](https://github.com/windmill-labs/windmill/commit/ccf84761dd664b9228dfe2f65867e8c32cd20c21))
-* **sessions:** offer the item you came from when starting a new session ([#10940](https://github.com/windmill-labs/windmill/issues/10940)) ([d3747d6](https://github.com/windmill-labs/windmill/commit/d3747d62555ebcb09c78cfabcaa3b6177758d6ea))
-* workspace setting to hide the AI assistant, agent steps unaffected ([#10941](https://github.com/windmill-labs/windmill/issues/10941)) ([fdd3b36](https://github.com/windmill-labs/windmill/commit/fdd3b36423344a2e1a464674179406581074e926))
-
-
-### Bug Fixes
-
-* apply object-storage test SSRF validation to all non-super-admins ([#10933](https://github.com/windmill-labs/windmill/issues/10933)) ([4fef119](https://github.com/windmill-labs/windmill/commit/4fef1195adaa9fa036a219884bd6c996460ca37f))
-* connect to dev server instead of localhost ([#10912](https://github.com/windmill-labs/windmill/issues/10912)) ([337154b](https://github.com/windmill-labs/windmill/commit/337154b8304a5969f35216add627b5c1153c0f6c))
-* preselect first row of AI agent and AI sandbox insert panes ([#10937](https://github.com/windmill-labs/windmill/issues/10937)) ([95b6bbd](https://github.com/windmill-labs/windmill/commit/95b6bbd46ada11d96a914ae5b0e92aba4dd02530))
-* record supplied script lock hashes so importers can skip relocking ([#10915](https://github.com/windmill-labs/windmill/issues/10915)) ([17ba521](https://github.com/windmill-labs/windmill/commit/17ba521c352aec65a8270893752bbadd7f3d6eaa))
-* sandbox script-controlled content types in result_to_response ([#10932](https://github.com/windmill-labs/windmill/issues/10932)) ([419741e](https://github.com/windmill-labs/windmill/commit/419741e5d226c67c51429094fb6ded9474afed99))
-
-## [1.801.0](https://github.com/windmill-labs/windmill/compare/v1.800.1...v1.801.0) (2026-09-01)
-
-
-### Features
-
-* **ai-chat:** make reusable skills ai_skill resources you select per workspace ([#10914](https://github.com/windmill-labs/windmill/issues/10914)) ([cfcfe29](https://github.com/windmill-labs/windmill/commit/cfcfe298dd9ab50196bd64926ef78c4563f58c2c))
-* **ai-sessions:** show a running session across tabs and reload finished turns ([#10916](https://github.com/windmill-labs/windmill/issues/10916)) ([816dc9d](https://github.com/windmill-labs/windmill/commit/816dc9dcd2c310e499d2d210a0abcd403469f29c))
-* edit folders and groups in a drawer that saves once ([#10873](https://github.com/windmill-labs/windmill/issues/10873)) ([5d5ad4e](https://github.com/windmill-labs/windmill/commit/5d5ad4e8974e076ef53a26a5584e4209255a2248))
-* make the home Build with AI composer dismissible, quiet the rest of the home page ([#10930](https://github.com/windmill-labs/windmill/issues/10930)) ([772fafe](https://github.com/windmill-labs/windmill/commit/772fafec8316a1e0c0e76b9a0737cc41d40a9a8c))
-
-
-### Bug Fixes
-
-* let a principal without a login account own a draft ([#10925](https://github.com/windmill-labs/windmill/issues/10925)) ([94af8d0](https://github.com/windmill-labs/windmill/commit/94af8d0fb5aceebe83936fd6761c6c1c02c75323))
-* resolve chat path links against the session's operating workspace ([#10924](https://github.com/windmill-labs/windmill/issues/10924)) ([9074de2](https://github.com/windmill-labs/windmill/commit/9074de25ea730ca02653c9a2e2b8b99eda6f3137))
-* tolerate string app_id in GHES app config deserialization ([#10923](https://github.com/windmill-labs/windmill/issues/10923)) ([af8ff38](https://github.com/windmill-labs/windmill/commit/af8ff3868748412cb658c803ebc8a71edc3cd8fb))
-
-## [1.800.1](https://github.com/windmill-labs/windmill/compare/v1.800.0...v1.800.1) (2026-09-01)
-
-
-### Bug Fixes
-
-* add top margin to the home Build with AI section ([#10909](https://github.com/windmill-labs/windmill/issues/10909)) ([bedf5ae](https://github.com/windmill-labs/windmill/commit/bedf5ae57445025729e94e16f1b5f13f6ff38ffa))
-* **ai-chat:** consume an @ mention with the message that carried it ([#10907](https://github.com/windmill-labs/windmill/issues/10907)) ([c512110](https://github.com/windmill-labs/windmill/commit/c512110a1f8d0d3437c20048f6446ef62b10222c))
-* keep a local dbt descriptor under sync pull --keep-deleted ([#10911](https://github.com/windmill-labs/windmill/issues/10911)) ([4b5be38](https://github.com/windmill-labs/windmill/commit/4b5be386ce0f851a087f43c0b0ac6e4b1b055a47))
-* keep windmill-indexer out of builds without tantivy ([#10908](https://github.com/windmill-labs/windmill/issues/10908)) ([db0f004](https://github.com/windmill-labs/windmill/commit/db0f004613e3f90428fea4c824cc53f1b2fc03b0))
-
-## [1.800.0](https://github.com/windmill-labs/windmill/compare/v1.799.0...v1.800.0) (2026-08-31)
-
-
-### Features
-
-* add --keep-deleted flag to wmill sync pull and push ([#10878](https://github.com/windmill-labs/windmill/issues/10878)) ([66123f3](https://github.com/windmill-labs/windmill/commit/66123f3a9b8978c0084b02f50b44cffba125a13a))
-* day-partition the service log index and expire whole chunks ([#10893](https://github.com/windmill-labs/windmill/issues/10893)) ([d91ee46](https://github.com/windmill-labs/windmill/commit/d91ee4614a70f20a194f47e190327129f499ec63))
-* free AI tokens + home search/filter revamp ([#10020](https://github.com/windmill-labs/windmill/issues/10020)) ([716ce2e](https://github.com/windmill-labs/windmill/commit/716ce2ece00cd5cfb8641afc6432636bc4aa46e9))
-* make the service log retention period an instance setting ([#10889](https://github.com/windmill-labs/windmill/issues/10889)) ([815de49](https://github.com/windmill-labs/windmill/commit/815de49e2322f85ca92b1e41a2bcd22591ebe93f))
-* rework the evals dataset drawer and run navigation ([#10884](https://github.com/windmill-labs/windmill/issues/10884)) ([1462f17](https://github.com/windmill-labs/windmill/commit/1462f17643302127b4bd76bacfde80cc03f9d606))
-* serve service log context from parquet and retire the raw log files ([#10892](https://github.com/windmill-labs/windmill/issues/10892)) ([338d75c](https://github.com/windmill-labs/windmill/commit/338d75cc5227e352cb84828c99bfd3b984cf0fa5))
-* serve service log retrieval from a columnar parquet store ([#10886](https://github.com/windmill-labs/windmill/issues/10886)) ([7c1a785](https://github.com/windmill-labs/windmill/commit/7c1a785f756ed27e4425f6534709b19971a73a97))
-
-
-### Bug Fixes
-
-* correct the service log ingest flush boundary ([#10898](https://github.com/windmill-labs/windmill/issues/10898)) ([ac56586](https://github.com/windmill-labs/windmill/commit/ac56586c0e56d4022761d3c80306a03d57f8bfcb))
-* harden the service log indexer's recovery and read paths ([#10904](https://github.com/windmill-labs/windmill/issues/10904)) ([831370c](https://github.com/windmill-labs/windmill/commit/831370cdde8e06f4298b17baa1a0041bacdd98c7))
-* keep raw-app editor selection consistent across sidebar and tabs ([#10885](https://github.com/windmill-labs/windmill/issues/10885)) ([b57e231](https://github.com/windmill-labs/windmill/commit/b57e231c2bf5e5fe007f0aa7b958a51e32b47141))
-* register every rotated service log file exactly once ([#10891](https://github.com/windmill-labs/windmill/issues/10891)) ([c817248](https://github.com/windmill-labs/windmill/commit/c8172480b0b1be6c57210212afc71d6ec8711235))
-* show a loading indicator while the initial data table migration is generated ([#10900](https://github.com/windmill-labs/windmill/issues/10900)) ([b998267](https://github.com/windmill-labs/windmill/commit/b998267c91b9dcf02787768f6205cc5aeda494fb))
-* track outstanding service log files on the rows themselves ([#10894](https://github.com/windmill-labs/windmill/issues/10894)) ([aa4a6ff](https://github.com/windmill-labs/windmill/commit/aa4a6ffd66813010a79c07741b01a984ed4e7df6))
-
-
-### Performance Improvements
-
-* add service log documents to the index one batch at a time ([#10906](https://github.com/windmill-labs/windmill/issues/10906)) ([0c2eb0a](https://github.com/windmill-labs/windmill/commit/0c2eb0ae3d18f49c21370131d15011e8dd103746))
-
-## [1.799.0](https://github.com/windmill-labs/windmill/compare/v1.798.1...v1.799.0) (2026-08-28)
-
-
-### Features
-
-* enable Anthropic prompt caching on Vertex AI agent steps ([#10876](https://github.com/windmill-labs/windmill/issues/10876)) ([320f400](https://github.com/windmill-labs/windmill/commit/320f4005124202852e6e9c70b394e7f87231d278))
-* instrument AI fill/fix, evals, agents and the debugger ([#10853](https://github.com/windmill-labs/windmill/issues/10853)) ([0bbd559](https://github.com/windmill-labs/windmill/commit/0bbd559ac8a35dba04ba5e8d6f2fd8d1d1124891))
-
-
-### Bug Fixes
-
-* **datatables:** stop a fork's pg_dump restore from failing silently ([#10830](https://github.com/windmill-labs/windmill/issues/10830)) ([3ce9bbc](https://github.com/windmill-labs/windmill/commit/3ce9bbc7168b837cb2111aabd533bb67803502b8))
-* key build artifact caches on a runnable's inline modules ([#10819](https://github.com/windmill-labs/windmill/issues/10819)) ([b72ccc3](https://github.com/windmill-labs/windmill/commit/b72ccc35934165b4bad112b947ca5af064aab26f))
-* nested template literals in step inputs, and unresolvable $args tags ([#10856](https://github.com/windmill-labs/windmill/issues/10856)) ([8f349c0](https://github.com/windmill-labs/windmill/commit/8f349c032a0d75fc3350292075e5050a030f6166))
-* pre-fill the test panel JSON args editor and align its placeholder ([#10871](https://github.com/windmill-labs/windmill/issues/10871)) ([fb82f36](https://github.com/windmill-labs/windmill/commit/fb82f36e6d6492dd0740984d8d78ea4eaa30361e))
-* reject a prefixed error_handler_path on triggers ([#10847](https://github.com/windmill-labs/windmill/issues/10847)) ([d334831](https://github.com/windmill-labs/windmill/commit/d33483173526a3b352d2829ac8a2e1e229cc1127))
-* unify billable seat counting and prevent fork subscriptions ([#10818](https://github.com/windmill-labs/windmill/issues/10818)) ([7dd88c4](https://github.com/windmill-labs/windmill/commit/7dd88c470caee5f095dc240667aa7550c55696bc))
-
-## [1.798.1](https://github.com/windmill-labs/windmill/compare/v1.798.0...v1.798.1) (2026-08-27)
-
-
-### Bug Fixes
-
-* allow job tokens to read the automate_username_creation setting ([#10869](https://github.com/windmill-labs/windmill/issues/10869)) ([c2279db](https://github.com/windmill-labs/windmill/commit/c2279db8a96ac76382eafe254627dafd24d173fd))
-
-## [1.798.0](https://github.com/windmill-labs/windmill/compare/v1.797.0...v1.798.0) (2026-08-27)
-
-
-### Features
-
-* a wizard for importing a hub project, and finishing what the import cannot ([#10729](https://github.com/windmill-labs/windmill/issues/10729)) ([2913339](https://github.com/windmill-labs/windmill/commit/29133398f99cd2dd5b33057ee9df4492d82e067a))
-
-## [1.797.0](https://github.com/windmill-labs/windmill/compare/v1.796.0...v1.797.0) (2026-08-26)
-
-
-### Features
-
-* configurable expiry for presigned s3 public url signatures ([#10835](https://github.com/windmill-labs/windmill/issues/10835)) ([8a6dc27](https://github.com/windmill-labs/windmill/commit/8a6dc27236aca67f0efe941d9606b787c2305ea8))
-* **frontend:** flag the fork-compare datatable schema diff as legacy ([#10829](https://github.com/windmill-labs/windmill/issues/10829)) ([07c77ea](https://github.com/windmill-labs/windmill/commit/07c77ead7425f1877372d358d867445a4c525c96))
-* keep a Hub project live while an update is under review ([#10814](https://github.com/windmill-labs/windmill/issues/10814)) ([c04b570](https://github.com/windmill-labs/windmill/commit/c04b5705745c36ecbb3a551ac59459218d2e3807))
-
-
-### Bug Fixes
-
-* **cli:** keep svelte component styles in the raw-app bundle ([#10838](https://github.com/windmill-labs/windmill/issues/10838)) ([b8bf539](https://github.com/windmill-labs/windmill/commit/b8bf539c3fe2b4db9c74dd73f04b3029287acdc6))
-* **debugger:** parse bun 1.4's UUID inspector token ([#10828](https://github.com/windmill-labs/windmill/issues/10828)) ([4658224](https://github.com/windmill-labs/windmill/commit/46582245926a7f8ea961bcd125a58fbfba3530cf))
-* force HTTP router rebuild on trigger-change notification ([#10849](https://github.com/windmill-labs/windmill/issues/10849)) ([ffdf17e](https://github.com/windmill-labs/windmill/commit/ffdf17ef8dc5575dd92d62d0d0ba887c1e378576))
-* **frontend:** follow the operating workspace in step input forms ([#10834](https://github.com/windmill-labs/windmill/issues/10834)) ([6b73145](https://github.com/windmill-labs/windmill/commit/6b73145e7220232601538b801ebc9dc73fe79bbb))
-* **frontend:** key the GitHub App installation selector on installation_id ([#10831](https://github.com/windmill-labs/windmill/issues/10831)) ([78331fd](https://github.com/windmill-labs/windmill/commit/78331fda8b290a2d9a5dd92b8362ff32c8b39432))
-* **frontend:** operator menu opens on hover, pins on click ([#10824](https://github.com/windmill-labs/windmill/issues/10824)) ([665f83e](https://github.com/windmill-labs/windmill/commit/665f83e1f438e34d006429889d51a5fb6a6b6176))
-* keep connection string query parameters under token auth ([#10859](https://github.com/windmill-labs/windmill/issues/10859)) ([f131c39](https://github.com/windmill-labs/windmill/commit/f131c3920f50f9fa18cd637eac39609495999aef))
-* migrate slack resource-connect oauth to v2 ([#10836](https://github.com/windmill-labs/windmill/issues/10836)) ([9fa8159](https://github.com/windmill-labs/windmill/commit/9fa8159ad16204cab52fd18a34a48ebf13f800f6))
-* recover from unresolvable AI session links instead of a dead end ([#10854](https://github.com/windmill-labs/windmill/issues/10854)) ([e38c449](https://github.com/windmill-labs/windmill/commit/e38c449007f27b952808cba5aa812441f2ce5946))
-* require admin on workspace tarball settings export ([#10817](https://github.com/windmill-labs/windmill/issues/10817)) ([46c363f](https://github.com/windmill-labs/windmill/commit/46c363ffa4bc72bef6b367ece4bdbeef5e0eadc9))
-* restrict filesystem workspace storage to debug builds ([#10864](https://github.com/windmill-labs/windmill/issues/10864)) ([8b80b09](https://github.com/windmill-labs/windmill/commit/8b80b09f33d311f0881678577ca6004c12d97c22))
-
-
-### Performance Improvements
-
-* index the suspended-job resume test instead of filtering it ([#10863](https://github.com/windmill-labs/windmill/issues/10863)) ([69320b2](https://github.com/windmill-labs/windmill/commit/69320b28f615b897a92f580bd5961c41e5c29951))
-
-## [1.796.0](https://github.com/windmill-labs/windmill/compare/v1.795.0...v1.796.0) (2026-08-24)
-
-
-### Features
-
-* add instance setting to mute zombie job restart alerts ([#10813](https://github.com/windmill-labs/windmill/issues/10813)) ([2906504](https://github.com/windmill-labs/windmill/commit/2906504125136afa280884b55e2f877a29a466a9))
-* AI agent evals: datasets, scored runs and comparison ([#10633](https://github.com/windmill-labs/windmill/issues/10633)) ([9c55785](https://github.com/windmill-labs/windmill/commit/9c557859c5ffede921690cd3d224239b9305c9b8))
-* **datatables:** add a down migration from the migration viewer ([#10812](https://github.com/windmill-labs/windmill/issues/10812)) ([3b2a6d7](https://github.com/windmill-labs/windmill/commit/3b2a6d76045cf5ae48ddfb76b871e24fd889298a))
-* **frontend:** warn when COEP blocks cross-origin resources in raw app editor preview ([#10328](https://github.com/windmill-labs/windmill/issues/10328)) ([7751d3e](https://github.com/windmill-labs/windmill/commit/7751d3e43ee1abbba9a6cca026be78504f0c5dff))
-* track token cost in AI sessions and chats ([#10688](https://github.com/windmill-labs/windmill/issues/10688)) ([b6e0591](https://github.com/windmill-labs/windmill/commit/b6e059116aa55fa5aa1226f5b3300bb2c8683f1a))
-
-
-### Bug Fixes
-
-* **ai-chat:** keep the composer usable while a question is pending ([#10816](https://github.com/windmill-labs/windmill/issues/10816)) ([25a3e6e](https://github.com/windmill-labs/windmill/commit/25a3e6ea7a7efb29ea3868ac0d1453d074325717))
-* **frontend:** mint string password secrets in the operating workspace ([#10815](https://github.com/windmill-labs/windmill/issues/10815)) ([93081e2](https://github.com/windmill-labs/windmill/commit/93081e255f06386c3e21a838a752e5302ad6e6fe))
-* keep ai chat messages when leaving the page mid-generation ([#10809](https://github.com/windmill-labs/windmill/issues/10809)) ([541b6c8](https://github.com/windmill-labs/windmill/commit/541b6c849657d13fed3580407a00a996e891ad9e))
-* patch sqlx so a cancelled BEGIN cannot poison a pooled connection ([#10823](https://github.com/windmill-labs/windmill/issues/10823)) ([8dbd12e](https://github.com/windmill-labs/windmill/commit/8dbd12ecc1a8d0c03ba32b797c5a8cd9ee2d57b4))
-* qualify foreign key targets in generated datatable migrations ([#10821](https://github.com/windmill-labs/windmill/issues/10821)) ([29c311a](https://github.com/windmill-labs/windmill/commit/29c311ab318f7e443d696baf871b8a0558fa8524))
-
-## [1.795.0](https://github.com/windmill-labs/windmill/compare/v1.794.1...v1.795.0) (2026-08-22)
-
-
-### Features
-
-* show the date on the runs dashboard chart axes ([#10808](https://github.com/windmill-labs/windmill/issues/10808)) ([a350f7c](https://github.com/windmill-labs/windmill/commit/a350f7c68e14909746427e716c5fdc3144d1df71))
-
-
-### Bug Fixes
-
-* keep raw-app files within their app folder on sync pull ([#10796](https://github.com/windmill-labs/windmill/issues/10796)) ([5b885ae](https://github.com/windmill-labs/windmill/commit/5b885ae311f079a7852e0ecd8fb94e57e79c707f))
-* keep workflow-as-code scripts off dedicated workers ([#10805](https://github.com/windmill-labs/windmill/issues/10805)) ([01891cd](https://github.com/windmill-labs/windmill/commit/01891cd73207e290a614cf7da506909fc4993646))
-* name the requested storage when a workspace storage lookup finds nothing ([#10803](https://github.com/windmill-labs/windmill/issues/10803)) ([01fc4f1](https://github.com/windmill-labs/windmill/commit/01fc4f1568c2010af7c23929ff50108b5e1fb635))
-* require an unscoped token to reach the workspace encryption key ([#10798](https://github.com/windmill-labs/windmill/issues/10798)) ([25d9a20](https://github.com/windmill-labs/windmill/commit/25d9a206304268326505ceef8c20cdb7941b6558))
-* require item read scope on workspace tarball export ([#10797](https://github.com/windmill-labs/windmill/issues/10797)) ([dc27db6](https://github.com/windmill-labs/windmill/commit/dc27db68de21c4d13033222cdaadbc4e2e732fe8))
-* scope capture deletion to the workspace in the request path ([#10795](https://github.com/windmill-labs/windmill/issues/10795)) ([40f0cab](https://github.com/windmill-labs/windmill/commit/40f0cab2adbdfbf1bfb12b7fbc3e419951fc8179))
-* size the ephemeral job token to the job timeout it must serve ([#10804](https://github.com/windmill-labs/windmill/issues/10804)) ([4b406e3](https://github.com/windmill-labs/windmill/commit/4b406e37c05a63ae89bc007ac0e6e669e7f84125))
-
-## [1.794.1](https://github.com/windmill-labs/windmill/compare/v1.794.0...v1.794.1) (2026-08-21)
-
-
-### Bug Fixes
-
-* **ci:** unbreak the windows test jobs and the discord comment relay ([#10799](https://github.com/windmill-labs/windmill/issues/10799)) ([5088e13](https://github.com/windmill-labs/windmill/commit/5088e1370537641a83ad86959c586945f6033414))
-* keep every value of a repeated multipart field ([#10800](https://github.com/windmill-labs/windmill/issues/10800)) ([e0510fe](https://github.com/windmill-labs/windmill/commit/e0510fea21006a06eee7eecd4587161970d7f4d5))
-
-## [1.794.0](https://github.com/windmill-labs/windmill/compare/v1.793.0...v1.794.0) (2026-08-21)
-
-
-### Features
-
-* inline login errors and a narrower single-column login card ([#10777](https://github.com/windmill-labs/windmill/issues/10777)) ([28b2ca6](https://github.com/windmill-labs/windmill/commit/28b2ca63672c916e07bd028eab07728d1aa4f0fe))
-* support application default credentials for gcp pub/sub triggers ([#10778](https://github.com/windmill-labs/windmill/issues/10778)) ([8e508ea](https://github.com/windmill-labs/windmill/commit/8e508ea01a1b41bd48b2ec3db29123430938f444))
-* upgrade bun to 1.4.0 and demote deno in the language picker ([#10784](https://github.com/windmill-labs/windmill/issues/10784)) ([d85050f](https://github.com/windmill-labs/windmill/commit/d85050f505b3ddc3f3c82f43dd3a9e4c32a1ee34))
-
-
-### Bug Fixes
-
-* apply the first script kind selection in the script editor ([#10789](https://github.com/windmill-labs/windmill/issues/10789)) ([75d0c29](https://github.com/windmill-labs/windmill/commit/75d0c29586a617f2cbfbf66720bdd0e47d6f92b4))
-* build the global chat's prompt identity from the operating workspace ([#10793](https://github.com/windmill-labs/windmill/issues/10793)) ([0b3dc3e](https://github.com/windmill-labs/windmill/commit/0b3dc3e5c9dd45847a26969f24ad33825445ea6a))
-* confine job tokens to workspace-scoped API routes ([#10631](https://github.com/windmill-labs/windmill/issues/10631)) ([9022dc9](https://github.com/windmill-labs/windmill/commit/9022dc9d440b95a4c45d22675f009acaf78daab7))
-* ground the chat's AI agent provider in the workspace's models ([#10774](https://github.com/windmill-labs/windmill/issues/10774)) ([449b1a6](https://github.com/windmill-labs/windmill/commit/449b1a69338479fb654308c83273613929a74fda))
-* make workspace preprocessor scripts selectable in flow preprocessor steps ([#10786](https://github.com/windmill-labs/windmill/issues/10786)) ([a9112b7](https://github.com/windmill-labs/windmill/commit/a9112b72a527af06a204827fbdff5ff9cb451f5d))
-* resolve a script path to its new version as soon as the lock lands ([#10794](https://github.com/windmill-labs/windmill/issues/10794)) ([3c8e4b4](https://github.com/windmill-labs/windmill/commit/3c8e4b43fd005db405f60794afca0e389445e350))
-* split the MCP script tools into createScript and updateScript ([#10783](https://github.com/windmill-labs/windmill/issues/10783)) ([92a454b](https://github.com/windmill-labs/windmill/commit/92a454b7a81cb1ecb98954387cbb8a361932775d))
-
 ## [1.793.0](https://github.com/windmill-labs/windmill/compare/v1.792.2...v1.793.0) (2026-08-20)


@@ -36,41 +36,3 @@ _Avoid_: argument field, param
 **Expression input**:
 Any other place a property can be picked into: the loop iterator, skip and early-stop predicates, the retry condition, a branch predicate, timeout. Its prop picker opens in a popover from the connect button rather than taking a pane.
 _Avoid_: JS field, code input
-
-### Flow chat
-
-**Conversation**:
-One thread of messages against one chat-enabled flow, with its own agent memory. A flow has
-many; the chat shows one at a time.
-_Avoid_: thread, session (that names an AI session, a different thing), chat (that names the surface)
-
-**Turn**:
-One question and the answer to it: the run the question started, the handle that stops it,
-and the rows it is writing. At most one per conversation, and the chat is held for its whole
-length — from the moment the question takes the chat, before it has a job, until it is ended.
-_Avoid_: request, exchange, message round
-
-**Transcript**:
-The rows a conversation's chat holds. Not the conversation: it is the newest page plus
-whatever older pages the reader has scrolled back through, so a question it cannot answer
-from what it holds is one to ask the server rather than to guess at.
-_Avoid_: history, messages (too easily read as "all of them")
-
-### Permissions
-
-**Member**:
-A user or group granted a role on a folder, a group, or an item's extra ACL. The list of them is
-"Members (n)" everywhere it is shown, and one is added with "Add member".
-_Avoid_: participant, collaborator, owner, ACL entry, permission (that names the concept, not the people)
-
-**Role**:
-The access level a member holds: viewer, writer or admin on a folder; member or admin on a group.
-Viewers read, writers also edit, admins also manage the members. A group role of **manager** —
-manages the group without belonging to it — is a legacy state the UI shows and can leave, but
-offers no way to enter.
-_Avoid_: permission level, access level, rank
-
-**Owner**:
-Reserved for the path prefix that says where an item lives — `u/alice` or `f/team`. A folder's
-`owners` column in the database is its admin members; call those admins, never owners, in the UI.
-_Avoid_: using "owner" for a folder admin
@@ -73,8 +73,6 @@ COPY /backend/oauth_connect.json /backend/oauth_connect.json
 COPY /openflow.openapi.yaml /openflow.openapi.yaml
 COPY /backend/windmill-api/build_openapi.sh /backend/windmill-api/build_openapi.sh
 COPY /system_prompts/auto-generated /system_prompts/auto-generated
-# The flow chat imports the chat SDK's source (svelte.config.js alias `windmill-chat`).
-COPY /chat-sdk/src /chat-sdk/src

 RUN cd /backend/windmill-api && . ./build_openapi.sh
 COPY /backend/parsers/windmill-parser-wasm/pkg/ /backend/parsers/windmill-parser-wasm/pkg/
@@ -143,9 +141,9 @@ FROM ${DEBIAN_IMAGE}
 ARG TARGETPLATFORM
 ARG POWERSHELL_VERSION=7.5.0
 ARG KUBECTL_VERSION=1.36.2
-ARG HELM_VERSION=3.21.4
+ARG HELM_VERSION=3.21.2
 # NOTE: If changing, also change go version in workspace dependencies template at WorkspaceDependenciesEditor.svelte
-ARG GO_VERSION=1.26.8
+ARG GO_VERSION=1.26.0
 ARG APP=/usr/src/app
 ARG WITH_POWERSHELL=true
 ARG WITH_KUBECTL=true
@@ -252,8 +250,8 @@ RUN UV_CACHE_DIR=/tmp/build_cache/uv UV_PYTHON_INSTALL_DIR=/tmp/build_cache/py_r
 RUN UV_CACHE_DIR=/tmp/build_cache/uv UV_PYTHON_INSTALL_DIR=/tmp/build_cache/py_runtime uv python install $LATEST_STABLE_PY --compile-bytecode


-RUN curl -sL https://deb.nodesource.com/setup_24.x | bash -
-RUN apt-get -y update && apt-get install -y --no-install-recommends curl procps nodejs awscli && apt-get clean \
+RUN curl -sL https://deb.nodesource.com/setup_20.x | bash -
+RUN apt-get -y update && apt-get install -y curl procps nodejs awscli && apt-get clean \
    && rm -rf /var/lib/apt/lists/*

 # go build is slower the first time it is ran, so we prewarm it in the build
@@ -289,7 +287,7 @@ COPY --from=windmill_duckdb_ffi_internal_builder /windmill-duckdb-ffi-internal/t

 COPY --from=denoland/deno:2.2.1 --chmod=755 /usr/bin/deno /usr/bin/deno

-COPY --from=oven/bun:1.4.0 /usr/local/bin/bun /usr/bin/bun
+COPY --from=oven/bun:1.3.10 /usr/local/bin/bun /usr/bin/bun

 # Install windmill CLI
 RUN bun install -g windmill-cli \
@@ -301,7 +299,7 @@ RUN bun install -g windmill-cli \
 RUN curl -fsSL https://claude.ai/install.sh | bash \
    && cp /root/.local/share/claude/versions/* /usr/bin/claude

-COPY --from=php:8.3.33-cli-trixie /usr/local/bin/php /usr/bin/php
+COPY --from=php:8.3.30-cli-trixie /usr/local/bin/php /usr/bin/php
 COPY --from=composer:2.9.5 /usr/bin/composer /usr/bin/composer

 # add the docker client to call docker from a worker if enabled
@@ -285,7 +285,6 @@ On self-hosted instances, you might want to import all the approved resource typ
 | MIN_FREE_DISK_SPACE_MB              | 15000                            | Minimum amount of free space on worker. Sends critical alert if worker has less free space.                                                                                                        | Worker                |
 | RUN_UPDATE_CA_CERTIFICATE_AT_START  | false                            | If true, runs CA certificate update command at startup before other initialization                                                                                                                 | All                   |
 | RUN_UPDATE_CA_CERTIFICATE_PATH      | /usr/sbin/update-ca-certificates | Path to the CA certificate update command/script to run when RUN_UPDATE_CA_CERTIFICATE_AT_START is true                                                                                            | All                   |
-| GOOGLE_APPLICATION_CREDENTIALS      | None                             | (ee only) Credentials file for GCP Pub/Sub triggers that authenticate as the instance rather than through a `gcloud` resource (workspace admins only). Application default credentials also resolve the gcloud well-known file and the GCE metadata server. Workload Identity Federation files work with the `file`, `url` and `aws` credential sources; the `executable` source is not supported. | Server                |

 ## Run a local dev setup

@@ -175,10 +175,6 @@ the decrypted value, exactly as against a real backend. The chat's read path pas
 Seed a recognizable secret (the existing fixture uses `sk_live_do_not_leak_me`) and
 assert it via `valueExcludes` to catch a leak.

-`toolExpect.toolCallArgs` entries support `sharedByAtLeast: <n>`: at least `n` recorded
-calls to that tool must carry the same non-blank string in the field. Use it for calls that
-have to share an identifier, like two test runs of one chat conversation.
-
 `toolExpect.toolCallArgs` entries additionally support `fieldMustBeAbsent: true`: no
 recorded call to that tool may pass the field at all (an explicit `null` counts as
 passing it). Use it for partial-update tools, where supplying a field the model could
@@ -1,36 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import {
-	handleBenchmarkApiFetch,
-	hasBenchmarkApiHandler,
-	registerBenchmarkWorkspaceRunnables,
-	unregisterBenchmarkWorkspace
-} from './mockBackend'
-
-// A global eval run registers its workspace under a mkdtemp path, so the workspace id the
-// frontend interpolates into the models URL carries slashes. A handler that assumed a single
-// path segment silently fell through to the network, and every run took the offline fallback.
-const WORKSPACE = '/tmp/wmill-frontend-global-benchmark-abc123'
-const RESOURCE = 'f/evals/global/anthropic_main'
-const URL_FOR = (workspace: string) =>
-	`http://benchmark.local/api/w/${workspace}/ai/proxy/models`
-
-describe('benchmark /ai/proxy/models', () => {
-	it('serves the seeded listing for a workspace id that is a path', async () => {
-		registerBenchmarkWorkspaceRunnables(WORKSPACE, {
-			aiProviders: [
-				{ path: RESOURCE, kind: 'anthropic', models: ['claude-sonnet-5', 'claude-opus-5'] }
-			]
-		})
-		try {
-			expect(hasBenchmarkApiHandler(URL_FOR(WORKSPACE))).toBe(true)
-			const response = handleBenchmarkApiFetch(URL_FOR(WORKSPACE), {
-				headers: { 'X-Resource-Path': RESOURCE, 'X-Provider': 'anthropic' }
-			})
-			await expect(response.json()).resolves.toEqual({
-				data: [{ id: 'claude-sonnet-5' }, { id: 'claude-opus-5' }]
-			})
-		} finally {
-			unregisterBenchmarkWorkspace(WORKSPACE)
-		}
-	})
-})
@@ -1,5 +1,5 @@
+import { randomUUID } from 'node:crypto'
 import type { BackendValidationSettings } from '../../core/backendValidation'
-import { buildWorkspaceId } from './workspaceId'

 interface CompletedJobResultMaybe {
 	completed: boolean
@@ -24,6 +24,7 @@ export interface CompletedPreviewJob {
 const tokenCache = new Map<string, Promise<string>>()
 const sharedWorkspaceQueue = new Map<string, Promise<void>>()
 const managedSharedWorkspacePrefixes = ['f/evals/']
+const DEFAULT_WORKSPACE_PREFIX = 'ai-evals'

 export class BackendPreviewClient {
 	constructor(private readonly settings: BackendValidationSettings) {}
@@ -440,6 +441,16 @@ async function withSharedWorkspaceLock<T>(workspaceId: string, body: () => Promi
 	}
 }

+function buildWorkspaceId(caseId: string, attempt: number): string {
+	const caseSlug = caseId
+		.toLowerCase()
+		.replace(/[^a-z0-9-]+/g, '-')
+		.replace(/^-+|-+$/g, '')
+		.slice(0, 30)
+	const suffix = randomUUID().slice(0, 8)
+	return `${DEFAULT_WORKSPACE_PREFIX}-${caseSlug || 'case'}-a${attempt}-${suffix}`
+}
+
 function extractFolderName(path: string): string | null {
 	if (!path.startsWith('f/')) {
 		return null
@@ -132,10 +132,6 @@ export async function runEval<THelpers, TOutput>(
    setToolStatus: () => {},
    removeToolStatus: () => {},
    isPlanModeActive,
-    // Accepts the run form exactly as the model prefilled it: there is nobody here to
-    // edit the arguments, so a case can assert what the model proposed but never how
-    // it reacts to the user changing something.
-    requestRunArgs: async (_toolId, form) => form.args,
    onNewToken: (token: string) => {
      if (shouldEmitMessageStart) {
        onAssistantMessageStart?.();
@@ -5,13 +5,10 @@ import type {
 	Flow,
 	Job,
 	ListableApp,
-	ListableResource,
 	ListableVariable,
-	Resource,
 	Script
 } from '../../../frontend/src/lib/gen'
 import type {
-	DataMetric,
 	DataTableTables,
 	DataTableTableSchema,
 	EndpointTool,
@@ -49,16 +46,12 @@ export interface BenchmarkWorkspaceFlow {
 export interface BenchmarkWorkspaceApp {
 	path: string
 	summary: string
-	/** Defaults to true. Set false for a drag-and-drop app, which the chat can list
-	 * and read but has no tool to edit — its value is a grid, not files. */
-	rawApp?: boolean
 	value: {
-		files?: Record<string, string>
-		runnables?: Record<string, unknown>
+		files: Record<string, string>
+		runnables: Record<string, unknown>
 		data?: unknown
 		policy?: unknown
 		custom_path?: unknown
-		[key: string]: unknown
 	}
 }

@@ -71,33 +64,8 @@ export interface BenchmarkWorkspaceVariable {
 	ws_specific?: boolean
 }

-/** An AI provider resource of the benchmark workspace, as an AI agent step would reference it.
- * `models` stands in for the provider's model listing, which no eval run can reach. */
-export interface BenchmarkWorkspaceAiProvider {
-	path: string
-	/** Resource type, which for AI resources is the provider kind (`anthropic`, `openai`, ...). */
-	kind: string
-	/** What this resource's `/ai/proxy/models` listing returns. */
-	models?: string[]
-	/** Set to point the resource at a gateway rather than the provider's own API. */
-	base_url?: string
-	/** Models the workspace AI settings selected for this provider. */
-	configuredModels?: string[]
-	/** Marks this provider's first configured model as the workspace default. */
-	isDefault?: boolean
-}
-
-/** A plain (non-AI) resource of the benchmark workspace, for cases about referencing a
- * credential — passing one as a run argument, say. `value` is what `get_resource` returns. */
-export interface BenchmarkWorkspaceResource {
-	path: string
-	resource_type: string
-	value?: Record<string, unknown>
-	description?: string
-}
-
 export interface BenchmarkWorkspaceJob {
-	/** Stable id so a case prompt can reference a specific run (e.g. for get_run). */
+	/** Stable id so a case prompt can reference a specific run (e.g. for get_job_logs). */
 	id?: string
 	jobKind?: CompletedJob['job_kind']
 	scriptPath?: string
@@ -105,8 +73,6 @@ export interface BenchmarkWorkspaceJob {
 	label?: string
 	success?: boolean
 	logs?: string
-	args?: Record<string, unknown>
-	result?: unknown
 }

 export interface BenchmarkWorkspaceRunnables {
@@ -114,12 +80,7 @@ export interface BenchmarkWorkspaceRunnables {
 	flows?: BenchmarkWorkspaceFlow[]
 	apps?: BenchmarkWorkspaceApp[]
 	variables?: BenchmarkWorkspaceVariable[]
-	aiProviders?: BenchmarkWorkspaceAiProvider[]
-	resources?: BenchmarkWorkspaceResource[]
 	datatables?: BenchmarkDatatableSeed[]
-	/** DuckLake catalog names, as `list_ducklakes` reports them. */
-	ducklakes?: string[]
-	dataMetrics?: DataMetric[]
 	jobs?: BenchmarkWorkspaceJob[]
 }

@@ -166,7 +127,7 @@ export function registerBenchmarkWorkspaceRunnables(
 		...runnables,
 		datatables: runnables.datatables ? structuredClone(runnables.datatables) : undefined
 	})
-	// Seed any fixture jobs so list_runs / get_run have data to return.
+	// Seed any fixture jobs so list_runs / get_job_logs have data to return.
 	for (const seed of runnables.jobs ?? []) {
 		createBenchmarkCompletedJob({
 			workspace,
@@ -176,9 +137,7 @@ export function registerBenchmarkWorkspaceRunnables(
 			scriptPath: seed.scriptPath,
 			createdBy: seed.createdBy,
 			label: seed.label,
-			logs: seed.logs,
-			args: seed.args,
-			result: seed.result
+			logs: seed.logs
 		})
 	}
 }
@@ -287,115 +246,6 @@ export function listBenchmarkVariables(workspace: string): ListableVariable[] |
 	return (runnables.variables ?? []).map((seed) => buildBenchmarkVariable(workspace, seed, false))
 }

-/** AI provider resources of a benchmark workspace, shaped like `ResourceService.listResource`
- * rows (which carry no value). Null when the workspace is not a benchmark one. */
-export function listBenchmarkAiProviderResources(workspace: string): ListableResource[] | null {
-	const runnables = benchmarkWorkspaceRunnables.get(workspace)
-	if (!runnables) {
-		return null
-	}
-	return (runnables.aiProviders ?? []).map((seed) => ({
-		workspace_id: workspace,
-		path: seed.path,
-		resource_type: seed.kind,
-		value: null,
-		is_oauth: false,
-		is_linked: false,
-		is_refreshed: false,
-		extra_perms: {},
-		edited_at: BENCHMARK_TIMESTAMP
-	}))
-}
-
-/** Plain seeded resources of a benchmark workspace, shaped like `ResourceService.listResource`
- * rows. Null when the workspace is not a benchmark one. */
-export function listBenchmarkPlainResources(workspace: string): ListableResource[] | null {
-	const runnables = benchmarkWorkspaceRunnables.get(workspace)
-	if (!runnables) {
-		return null
-	}
-	return (runnables.resources ?? []).map((seed) => ({
-		workspace_id: workspace,
-		path: seed.path,
-		resource_type: seed.resource_type,
-		description: seed.description,
-		value: null,
-		is_oauth: false,
-		is_linked: false,
-		is_refreshed: false,
-		extra_perms: {},
-		edited_at: BENCHMARK_TIMESTAMP
-	}))
-}
-
-/** A seeded resource with its value, as `ResourceService.getResource` returns it. Covers both
- * seed kinds, so it agrees with `existsResource` and `listResource` — both of those report AI
- * providers too, and a case that lists resources and then reads one by path would otherwise get
- * a row it cannot fetch. */
-export function getBenchmarkResource(workspace: string, path: string): Resource | null {
-	const runnables = benchmarkWorkspaceRunnables.get(workspace)
-	const seed = runnables?.resources?.find((entry) => entry.path === path)
-	if (seed) {
-		return {
-			workspace_id: workspace,
-			path: seed.path,
-			resource_type: seed.resource_type,
-			description: seed.description,
-			value: seed.value ?? {},
-			is_oauth: false,
-			extra_perms: {}
-		} as Resource
-	}
-	const provider = runnables?.aiProviders?.find((entry) => entry.path === path)
-	if (!provider) {
-		return null
-	}
-	return {
-		workspace_id: workspace,
-		path: provider.path,
-		resource_type: provider.kind,
-		value: getBenchmarkResourceValue(workspace, path) ?? {},
-		is_oauth: false,
-		extra_perms: {}
-	} as Resource
-}
-
-/** The value of a seeded resource. For an AI provider only the endpoint fields are modelled — a
- * key is never needed, because no eval run calls the provider through this resource. */
-export function getBenchmarkResourceValue(
-	workspace: string,
-	path: string
-): Record<string, unknown> | null {
-	const runnables = benchmarkWorkspaceRunnables.get(workspace)
-	const plain = runnables?.resources?.find((entry) => entry.path === path)
-	if (plain) {
-		return plain.value ?? {}
-	}
-	const seed = runnables?.aiProviders?.find((entry) => entry.path === path)
-	if (!seed) {
-		return null
-	}
-	return seed.base_url ? { base_url: seed.base_url } : {}
-}
-
-/** The AI settings of a benchmark workspace, as `WorkspaceService.getCopilotInfo` returns them. */
-export function getBenchmarkAiConfig(workspace: string): Record<string, unknown> | null {
-	const seeds = benchmarkWorkspaceRunnables.get(workspace)?.aiProviders
-	if (!seeds) {
-		return null
-	}
-	const providers: Record<string, unknown> = {}
-	let defaultModel: { model: string; provider: string } | undefined
-	for (const seed of seeds) {
-		const models = seed.configuredModels ?? seed.models ?? []
-		providers[seed.kind] = { resource_path: seed.path, models }
-		if (seed.isDefault && models[0]) {
-			defaultModel = { model: models[0], provider: seed.kind }
-		}
-	}
-	return { providers, ...(defaultModel ? { default_model: defaultModel } : {}) }
-}
-
 export function getBenchmarkVariableByPath(
 	workspace: string,
 	path: string,
@@ -493,33 +343,6 @@ export function getBenchmarkJobLogs(workspace: string, jobId: string): string {
 	return job.logs ?? ''
 }

-/**
- * Mirror `JobService.getFlowAllResults`, which get_run calls for the execution
- * tree. Fixture jobs are single runs with no steps, so only the root entry.
- */
-export function getBenchmarkFlowAllResults(workspace: string, jobId: string) {
-	const job = getBenchmarkCompletedJob(workspace, jobId)
-	if (!job) {
-		throw new Error(`Job "${jobId}" not found in benchmark workspace`)
-	}
-	return {
-		entries: [
-			{
-				job_id: jobId,
-				label: 'Flow',
-				kind: job.job_kind ?? 'script',
-				depth: 0,
-				sibling_index: 1,
-				sibling_count: 1,
-				status: job.success ? 'success' : 'failure',
-				success: job.success
-			}
-		],
-		truncated: false,
-		scope_filtered: false
-	}
-}
-
 // ============= Drafts (per-user, DB-backed in production) =============

 /**
@@ -681,27 +504,6 @@ export function listBenchmarkDatatables(workspace: string): DataTableTables[] |
 	}))
 }

-// ============= DuckLake catalogs and declared metrics =============
-
-/** Seeded DuckLake names, or `null` for a non-benchmark workspace. */
-export function listBenchmarkDucklakes(workspace: string): string[] | null {
-	const runnables = benchmarkWorkspaceRunnables.get(workspace)
-	return runnables ? (runnables.ducklakes ?? []) : null
-}
-
-/**
- * Seeded metric declarations, or `null` for a non-benchmark workspace.
- *
- * The `table` / `path_prefix` filters are ignored: which rows a filter selects is
- * `canonical_table_path`'s business and is pinned by `ducklakeTools.test.ts`.
- * Re-deriving it here would give the eval its own copy of that spec to drift from,
- * and the case this serves measures whether the model reaches for the tool at all.
- */
-export function listBenchmarkDataMetrics(workspace: string): DataMetric[] | null {
-	const runnables = benchmarkWorkspaceRunnables.get(workspace)
-	return runnables ? (runnables.dataMetrics ?? []) : null
-}
-
 export function getBenchmarkDatatableSchema(input: {
 	workspace: string
 	datatableName: string
@@ -869,29 +671,6 @@ export function runBenchmarkFlowByPath(input: {
 	})
 }

-/**
- * Mirror `JobService.runFlowPreview` for benchmark workspaces, including the server's
- * refusal of a chat-enabled flow run that names no conversation (`memory_id`).
- */
-export function runBenchmarkFlowPreview(input: {
-	workspace: string
-	memoryId?: string
-	requestBody?: { path?: string; value?: { chat_input_enabled?: boolean }; args?: unknown }
-}): string {
-	if (input.requestBody?.value?.chat_input_enabled && !input.memoryId) {
-		throw new Error('Bad request: memory_id is required for chat-enabled flows')
-	}
-	const args = (input.requestBody?.args ?? {}) as Record<string, unknown>
-	return createBenchmarkCompletedJob({
-		workspace: input.workspace,
-		jobKind: 'flowpreview',
-		success: true,
-		args,
-		result: { path: input.requestBody?.path, args, mocked: true },
-		logs: 'Mock benchmark flow preview completed successfully.'
-	})
-}
-
 export function previewBenchmarkSchedule(input: {
 	requestBody?: Record<string, unknown>
 }): Record<string, unknown> {
@@ -998,7 +777,7 @@ function buildBenchmarkListableApp(app: BenchmarkWorkspaceApp): ListableApp {
 		extra_perms: {},
 		edited_at: BENCHMARK_TIMESTAMP,
 		execution_mode: 'viewer',
-		raw_app: app.rawApp ?? true
+		raw_app: true
 	}
 }

@@ -1016,7 +795,7 @@ function buildBenchmarkApp(app: BenchmarkWorkspaceApp): AppWithLastVersion {
 		execution_mode: 'viewer',
 		extra_perms: {},
 		custom_path: app.value.custom_path as string | undefined,
-		raw_app: app.rawApp ?? true
+		raw_app: true
 	}
 }

@@ -1315,10 +1094,6 @@ function parseBenchmarkRequestBody(
 /** True when `handleBenchmarkApiFetch` has an answer for this `/api/...` url.
 * Any other relative fetch must keep its normal (non-benchmark) behavior —
 * intercepting it with a synthetic 404 sends the model into retry loops. */
-// Not anchored: the frontend builds this URL from location.origin, so it arrives absolute. The
-// workspace id is greedy because an eval workspace is a temp directory path, slashes and all.
-const BENCHMARK_AI_MODELS_PATH = /\/api\/w\/(.+)\/ai\/proxy\/models$/
-
 export function hasBenchmarkApiHandler(url: string): boolean {
 	const path = url.split('?')[0]
 	return (
@@ -1327,8 +1102,7 @@ export function hasBenchmarkApiHandler(url: string): boolean {
 		BENCHMARK_RUN_BY_PATH.test(path) ||
 		/^\/api\/w\/[^/]+\/jobs\/queue\/list$/.test(path) ||
 		path === '/api/embeddings/query_hub_scripts' ||
-		path.startsWith('/api/scripts/hub/get_full/') ||
-		BENCHMARK_AI_MODELS_PATH.test(path)
+		path.startsWith('/api/scripts/hub/get_full/')
 	)
 }

@@ -1339,17 +1113,6 @@ export function handleBenchmarkApiFetch(url: string, init?: RequestInit): Respon
 	if (path === '/api/workers/list') {
 		return Response.json(BENCHMARK_WORKERS)
 	}
-	// The provider's own model listing, which grounds an AI agent step's model id. Keyed by the
-	// resource the caller names, so two seeded providers can serve different models.
-	const aiModels = BENCHMARK_AI_MODELS_PATH.exec(path)
-	if (aiModels) {
-		const headers = new Headers(init?.headers)
-		const resourcePath = headers.get('X-Resource-Path') ?? ''
-		const seed = benchmarkWorkspaceRunnables
-			.get(decodeURIComponent(aiModels[1]))
-			?.aiProviders?.find((entry) => entry.path === resourcePath)
-		return Response.json({ data: (seed?.models ?? []).map((id) => ({ id })) })
-	}
 	if (/^\/api\/w\/[^/]+\/jobs\/queue\/list$/.test(path)) {
 		return Response.json([])
 	}
@@ -9,15 +9,6 @@ import { handleBenchmarkApiFetch, hasBenchmarkApiHandler } from './mockBackend'
 // no meaning in the vitest environment — serve the ones the benchmark handles.
 // Every other relative fetch keeps its normal behavior (it fails the same way
 // it does without this stub) so unrelated tools see an unchanged environment.
-// The frontend builds API URLs from location.origin (fetchAvailableModels does), and node has no
-// location — without one those calls throw before the stub below ever sees them.
-if (typeof (globalThis as { location?: unknown }).location === 'undefined') {
-	Object.defineProperty(globalThis, 'location', {
-		value: new URL('http://benchmark.local/'),
-		configurable: true
-	})
-}
-
 const ORIGINAL_FETCH = globalThis.fetch
 globalThis.fetch = (async (input: unknown, init?: RequestInit) => {
 	const url = typeof input === 'string' ? input : ((input as Request | URL | null)?.url ?? '')
@@ -62,23 +53,15 @@ vi.mock('$lib/gen', async () => {
 		getBenchmarkDatatableSchema,
 		getBenchmarkDraftForUser,
 		getBenchmarkFlowByPath,
-		getBenchmarkFlowAllResults,
 		getBenchmarkJobLogs,
 		getBenchmarkOwnDraft,
 		getBenchmarkScriptByHash,
 		getBenchmarkScriptByPath,
-		getBenchmarkAiConfig,
-		getBenchmarkResourceValue,
 		getBenchmarkVariableByPath,
 		hasBenchmarkWorkspace,
-		getBenchmarkResource,
-		listBenchmarkAiProviderResources,
-		listBenchmarkPlainResources,
 		listBenchmarkApps,
 		listBenchmarkDatatables,
-		listBenchmarkDataMetrics,
 		listBenchmarkDrafts,
-		listBenchmarkDucklakes,
 		listBenchmarkFlows,
 		listBenchmarkJobs,
 		listBenchmarkScripts,
@@ -89,8 +72,6 @@ vi.mock('$lib/gen', async () => {
 		previewBenchmarkSchedule,
 		runBenchmarkDatatableSql,
 		runBenchmarkFlowByPath,
-		runBenchmarkFlowPreview,
-		runBenchmarkScriptByPath,
 		runBenchmarkScriptPreview,
 		updateBenchmarkDraft,
 		listBenchmarkMcpTools
@@ -284,26 +265,6 @@ vi.mock('$lib/gen', async () => {
 				}
 				return runBenchmarkScriptPreview({ workspace: data.workspace, requestBody })
 			},
-			runScriptByPath: async (data: {
-				workspace: string
-				path: string
-				requestBody?: Record<string, unknown>
-			}) =>
-				hasBenchmarkWorkspace(data.workspace)
-					? runBenchmarkScriptByPath({
-							workspace: data.workspace,
-							path: data.path,
-							args: data.requestBody
-						})
-					: actual.JobService.runScriptByPath(data),
-			runFlowPreview: async (data: {
-				workspace: string
-				memoryId?: string
-				requestBody?: { path?: string; value?: { chat_input_enabled?: boolean }; args?: unknown }
-			}) =>
-				hasBenchmarkWorkspace(data.workspace)
-					? runBenchmarkFlowPreview(data)
-					: actual.JobService.runFlowPreview(data as any),
 			runFlowByPath: async (data: {
 				workspace: string
 				path: string
@@ -337,25 +298,13 @@ vi.mock('$lib/gen', async () => {
 			getJobLogs: async (data: { workspace: string; id: string }) =>
 				hasBenchmarkWorkspace(data.workspace)
 					? getBenchmarkJobLogs(data.workspace, data.id)
-					: actual.JobService.getJobLogs(data),
-			getFlowAllResults: async (data: { workspace: string; id: string }) =>
-				hasBenchmarkWorkspace(data.workspace)
-					? getBenchmarkFlowAllResults(data.workspace, data.id)
-					: actual.JobService.getFlowAllResults(data)
+					: actual.JobService.getJobLogs(data)
 		}),
 		WorkspaceService: wrapService(actual.WorkspaceService, {
-			getCopilotInfo: async (data: { workspace: string }) =>
-				hasBenchmarkWorkspace(data.workspace)
-					? (getBenchmarkAiConfig(data.workspace) ?? {})
-					: actual.WorkspaceService.getCopilotInfo(data),
 			listDataTableTables: async (data: { workspace: string }) =>
 				hasBenchmarkWorkspace(data.workspace)
 					? (listBenchmarkDatatables(data.workspace) ?? [])
 					: actual.WorkspaceService.listDataTableTables(data),
-			listDucklakes: async (data: { workspace: string }) =>
-				hasBenchmarkWorkspace(data.workspace)
-					? (listBenchmarkDucklakes(data.workspace) ?? [])
-					: actual.WorkspaceService.listDucklakes(data),
 			getDataTableTableSchema: async (data: {
 				workspace: string
 				datatableName: string
@@ -371,12 +320,6 @@ vi.mock('$lib/gen', async () => {
 						})
 					: actual.WorkspaceService.getDataTableTableSchema(data)
 		}),
-		DataMetricService: wrapService(actual.DataMetricService, {
-			listDataMetrics: async (data: { workspace: string }) =>
-				hasBenchmarkWorkspace(data.workspace)
-					? { metrics: listBenchmarkDataMetrics(data.workspace) ?? [] }
-					: actual.DataMetricService.listDataMetrics(data)
-		}),
 		ScheduleService: wrapService(actual.ScheduleService, {
 			existsSchedule: async (data: { workspace: string; path: string }) =>
 				hasBenchmarkWorkspace(data.workspace) ? false : actual.ScheduleService.existsSchedule(data),
@@ -397,39 +340,14 @@ vi.mock('$lib/gen', async () => {
 		}),
 		ResourceService: wrapService(actual.ResourceService, {
 			existsResource: async (data: { workspace: string; path: string }) =>
-				hasBenchmarkWorkspace(data.workspace)
-					? Boolean(getBenchmarkResourceValue(data.workspace, data.path))
-					: actual.ResourceService.existsResource(data),
-			listResource: async (data: { workspace: string; resourceType?: string }) => {
-				if (!hasBenchmarkWorkspace(data.workspace)) {
-					return actual.ResourceService.listResource(data)
-				}
-				const seeded = [
-					...(listBenchmarkAiProviderResources(data.workspace) ?? []),
-					...(listBenchmarkPlainResources(data.workspace) ?? [])
-				]
-				const wanted = data.resourceType?.split(',')
-				return wanted ? seeded.filter((r) => wanted.includes(r.resource_type)) : seeded
-			},
+				hasBenchmarkWorkspace(data.workspace) ? false : actual.ResourceService.existsResource(data),
+			listResource: async (data: { workspace: string }) =>
+				hasBenchmarkWorkspace(data.workspace) ? [] : actual.ResourceService.listResource(data),
 			getResource: async (data: { workspace: string; path: string }) => {
 				if (hasBenchmarkWorkspace(data.workspace)) {
-					const resource = getBenchmarkResource(data.workspace, data.path)
-					if (!resource) {
-						throw new Error(`Resource "${data.path}" not found in benchmark workspace`)
-					}
-					return resource
-				}
-				return actual.ResourceService.getResource(data)
-			},
-			getResourceValue: async (data: { workspace: string; path: string }) => {
-				if (!hasBenchmarkWorkspace(data.workspace)) {
-					return actual.ResourceService.getResourceValue(data)
-				}
-				const value = getBenchmarkResourceValue(data.workspace, data.path)
-				if (!value) {
 					throw new Error(`Resource "${data.path}" not found in benchmark workspace`)
 				}
-				return value
+				return actual.ResourceService.getResource(data)
 			},
 			queryResourceTypes: async (data: { workspace: string }) =>
 				hasBenchmarkWorkspace(data.workspace) ? [] : actual.ResourceService.queryResourceTypes(data)
@@ -1,8 +1,9 @@
+import { randomUUID } from "node:crypto";
 import type { WindmillBackendSettings } from "../../core/windmillBackendSettings";
-import { buildWorkspaceId } from "./workspaceId";

 const tokenCache = new Map<string, Promise<string>>();
 const sharedWorkspaceQueue = new Map<string, Promise<void>>();
+const DEFAULT_WORKSPACE_PREFIX = "ai-evals";

 export class WindmillBackendClient {
  constructor(private readonly settings: WindmillBackendSettings) {}
@@ -178,6 +179,16 @@ async function withSharedWorkspaceLock<T>(
  }
 }

+function buildWorkspaceId(caseId: string, attempt: number): string {
+  const caseSlug = caseId
+    .toLowerCase()
+    .replace(/[^a-z0-9-]+/g, "-")
+    .replace(/^-+|-+$/g, "")
+    .slice(0, 30);
+  const suffix = randomUUID().slice(0, 8);
+  return `${DEFAULT_WORKSPACE_PREFIX}-${caseSlug || "case"}-a${attempt}-${suffix}`;
+}
+
 async function expectOk(response: Response, context: string): Promise<void> {
  if (response.ok) {
    return;
@@ -1,21 +0,0 @@
-import { describe, expect, it } from "bun:test";
-import { buildWorkspaceId } from "./workspaceId";
-
-describe("buildWorkspaceId", () => {
-  // `workspace.proper_id` rejects `--`, which a case id can carry itself and
-  // which truncating a slug on a hyphen produces once the suffix adds its own.
-  // One id per shape: cut landing on a hyphen, cut landing mid-word, no cut, and
-  // a doubled hyphen no cut ever reaches.
-  it("stays within the id length cap and the proper_id format", () => {
-    for (const caseId of [
-      "global-test6-secret-variable-draft",
-      "global-test23-datatable-query-select",
-      "short",
-      "global--test-foo",
-    ]) {
-      const id = buildWorkspaceId(caseId, 1);
-      expect(id.length).toBeLessThanOrEqual(50);
-      expect(id).toMatch(/^\w+(-\w+)*$/);
-    }
-  });
-});
@@ -1,22 +0,0 @@
-import { randomUUID } from "node:crypto";
-
-const DEFAULT_WORKSPACE_PREFIX = "ai-evals";
-
-// A workspace id must be at most 50 characters AND match `^\w+(-\w+)*$`
-// (`workspace.proper_id`), so the case slug yields to the random suffix that
-// makes the id unique, and no hyphen may end up doubled — neither one already in
-// the case id nor one a truncation leaves for the suffix to follow.
-const MAX_WORKSPACE_ID_LENGTH = 50;
-
-export function buildWorkspaceId(caseId: string, attempt: number): string {
-  const caseSlug = caseId
-    .toLowerCase()
-    .replace(/[^a-z0-9-]+/g, "-")
-    .replace(/-{2,}/g, "-")
-    .replace(/^-+|-+$/g, "");
-  const suffix = `-a${attempt}-${randomUUID().slice(0, 8)}`;
-  const head = `${DEFAULT_WORKSPACE_PREFIX}-${caseSlug || "case"}`;
-  return `${head
-    .slice(0, MAX_WORKSPACE_ID_LENGTH - suffix.length)
-    .replace(/-+$/, "")}${suffix}`;
-}
@@ -889,13 +889,13 @@
    draftCountExactly: 0
  toolExpect:
    requiredToolsUsed:
-      - get_run
+      - get_job_logs
    forbiddenToolsUsed:
      - deploy_workspace_item
      - delete_workspace_item
      - write_script
    toolCallArgs:
-      - tool: get_run
+      - tool: get_job_logs
        field: id
        stringIncludesAnyOf:
          - 01920000-0000-7000-8000-0000000000f1
@@ -906,34 +906,6 @@
    - fetches the logs for the requested job id
    - explains the failure from the returned logs (connection refused to the upstream API)

- id: global-run-args-and-result
-  prompt: |-
-    What was the run 01920000-0000-7000-8000-0000000000f2 called with, and what did it return?
-  initial: ai_evals/fixtures/frontend/global/initial/jobs_seed.json
-  runtime:
-    maxTurns: 6
-  validate:
-    draftCountExactly: 0
-  toolExpect:
-    requiredToolsUsed:
-      - get_run
-    forbiddenToolsUsed:
-      - test_run_script
-      - run_script
-      - deploy_workspace_item
-    toolCallArgs:
-      - tool: get_run
-        field: id
-        stringIncludesAnyOf:
-          - 01920000-0000-7000-8000-0000000000f2
-  # Read-only, so no draft for the global judge to score — validated on tool use
-  # and the deterministic argument check, like the neighbouring run cases.
-  skipJudge: true
-  judgeChecklist:
-    - reports the arguments the run was called with (region emea, 12 recipients)
-    - reports what the run returned (12 sent, 3 skipped)
-    - does not start a new run to find out
-
 # --- Page navigation (open_page) ---
 # The assistant should take the user to a Windmill page (Runs/Schedules) with the
 # right filters via open_page, rather than describing where to click or dumping the
@@ -1919,11 +1891,10 @@
    - when the lookup fails, tells the user instead of inventing table names
    - does not write scripts or resources to answer a read-only question

-# --- Dedicated tools preferred over the API catalog ---
-# The harness serves worker/queue reads itself (benchmark fetch handlers in
-# adapters/frontend), so these cases do not require an mcp-enabled eval backend.
-# The stale `api-catalog` in the id below is kept so results stay comparable
-# across benchmark runs.
+# --- API catalog (search_api_endpoints / call_api_get / call_api_endpoint) ---
+# The harness serves the catalog and the executed calls itself (mock
+# listMcpTools + benchmark fetch handlers in adapters/frontend), so these cases
+# do not require an mcp-enabled eval backend.

 - id: global-test30-api-catalog-workers
  prompt: |-
@@ -1935,42 +1906,23 @@
    draftCountExactly: 0
  toolExpect:
    requiredToolsUsed:
-      - list_workers
-    forbiddenToolsUsed:
+      - search_api_endpoints
      - call_api_get
+    forbiddenToolsUsed:
      - call_api_endpoint
      - write_script
      - deploy_workspace_item
+    toolCallArgs:
+      - tool: call_api_get
+        field: name
+        stringIncludesAnyOf:
+          - listWorkers
  # Read-only workspace inspection produces no draft; validate via tool use.
  skipJudge: true
  judgeChecklist:
-    - reads worker state through list_workers instead of guessing or fabricating
+    - discovers the workers endpoint through the API catalog instead of guessing or fabricating
    - reports worker status from the returned data

- id: global-test37-ducklake-declared-measure
-  prompt: |-
-    We track orders in the main ducklake. Write me a duckdb script that reports total
-    revenue by month. Keep it as a draft, don't deploy it.
-  initial: ai_evals/fixtures/frontend/global/initial/ducklake_orders_metrics.json
-  runtime:
-    maxTurns: 8
-  validate:
-    draftCountExactly: 1
-  toolExpect:
-    requiredToolsUsed:
-      - list_data_metrics
-    forbiddenToolsUsed:
-      - deploy_workspace_item
-      - delete_workspace_item
-  # The judge runs: the point is not that the tool was called but that the number it
-  # describes is the declared one. `revenue` excludes test rows, so an aggregate that
-  # reproduces it without the filter is plausible, runnable and wrong.
-  judgeChecklist:
-    - totals revenue with the declared sum over the amount column rather than an invented aggregate over a guessed column
-    - excludes test orders from the total, as the declared revenue measure does
-    - groups by month using the declared order_month expression over order_date
-    - does not introduce column names absent from the declarations
-
 - id: global-test31-draft-test-run-not-deployed
  prompt: |-
    Update `f/evals/global/format_greeting` so the provided name is uppercased in the greeting, then run it with name "ada" to check it works.
@@ -2022,170 +1974,6 @@
  judgeChecklist:
    - deletes the deployed script via delete_workspace_item rather than a raw API endpoint

- id: global-test33-run-deployed-script-with-form
-  prompt: |-
-    Run the deployed script `f/evals/global/format_greeting` for me with the name "ada".
-  initial: ai_evals/fixtures/frontend/global/initial/format_greeting_script.json
-  runtime:
-    maxTurns: 8
-    # A session chat is where the run card has a preview pane beside it; run_script
-    # itself is offered in every chat.
-    sessionChat: true
-  validate:
-    draftCountExactly: 0
-  toolExpect:
-    requiredToolsUsed:
-      - run_script
-      # A draft may declare different arguments than the deployed version being run, so
-      # the names to prefill have to come from the deployed schema.
-      - read_workspace_item
-    forbiddenToolsUsed:
-      - test_run_script
-      - call_api_endpoint
-      - write_script
-      - deploy_workspace_item
-    # An empty form pushes the work back onto the user, so the prefill is part of
-    # what the tool is for.
-    toolCallArgs:
-      - tool: run_script
-        field: args.name
-        stringIncludesAnyOf:
-          - ada
-  # Running produces no draft, and the judge cannot observe runs; validate via tool use.
-  skipJudge: true
-  judgeChecklist:
-    - runs the deployed script through run_script rather than a preview test run or a raw API endpoint
-    - passes the name "ada" so the confirmation form comes up prefilled
-
- id: global-test34-run-with-secret-from-variable
-  prompt: |-
-    Run the deployed `f/evals/global/billing_sync` for the account `acme` — use the billing
-    API token we already keep in the workspace.
-  initial: ai_evals/fixtures/frontend/global/initial/billing_sync_with_secret_arg.json
-  runtime:
-    maxTurns: 10
-    # A session chat is where the run card has a preview pane beside it; run_script
-    # itself is offered in every chat.
-    sessionChat: true
-  validate:
-    draftCountExactly: 0
-  toolExpect:
-    requiredToolsUsed:
-      - run_script
-    forbiddenToolsUsed:
-      - write_script
-      - deploy_workspace_item
-    # A secret argument is filled by naming the variable that holds it: the value stays in
-    # the variable and only its path travels. A literal reaches the job as a reference too,
-    # minted on the way in, but it stays in the tool call the model emitted.
-    toolCallArgs:
-      - tool: run_script
-        field: args.api_token
-        stringIncludesAnyOf:
-          - "$var:f/evals/global/stripe_api_token"
-      - tool: run_script
-        field: args.account
-        stringIncludesAnyOf:
-          - acme
-  # Running produces no draft, and the judge cannot observe runs; validate via tool use.
-  skipJudge: true
-  judgeChecklist:
-    - fills the secret argument with a reference to the existing workspace variable rather than a literal token
-    - passes the account "acme"
-    - does not invent or guess the token's value
-
- id: global-test35-run-deployed-flow-with-form
-  prompt: |-
-    Run the deployed flow `f/evals/global/notify_customer` for me — the customer is `acme`.
-  initial: ai_evals/fixtures/frontend/global/initial/notify_customer_flow.json
-  runtime:
-    maxTurns: 8
-    # A session chat is where the run card has a preview pane beside it; run_flow
-    # itself is offered in every chat.
-    sessionChat: true
-  validate:
-    draftCountExactly: 0
-  toolExpect:
-    requiredToolsUsed:
-      - run_flow
-      # A draft may declare different arguments than the deployed version being run, so
-      # the names to prefill have to come from the deployed schema.
-      - read_workspace_item
-    forbiddenToolsUsed:
-      - test_run_flow
-      - call_api_endpoint
-      - write_flow
-      - deploy_workspace_item
-    # An empty form pushes the work back onto the user, so the prefill is part of
-    # what the tool is for.
-    toolCallArgs:
-      - tool: run_flow
-        field: args.customer
-        stringIncludesAnyOf:
-          - acme
-  # Running produces no draft, and the judge cannot observe runs; validate via tool use.
-  skipJudge: true
-  judgeChecklist:
-    - runs the deployed flow through run_flow rather than a preview test run or a raw API endpoint
-    - passes the customer "acme" so the confirmation form comes up prefilled
-
- id: global-test36-draft-flow-test-run-not-deployed
-  prompt: |-
-    Update the `calculate_total` step of `f/evals/global/process_invoice` so it applies 8% tax and
-    returns `subtotal`, `tax` and `total`, then run it to check it works.
-    Keep it as an AI draft only; do not deploy or save it.
-  initial: ai_evals/fixtures/frontend/global/initial/process_invoice_flow.json
-  runtime:
-    maxTurns: 10
-  validate:
-    draftCountExactly: 1
-    requiredDrafts:
-      - type: flow
-        path: f/evals/global/process_invoice
-  toolExpect:
-    # A one-step flow is as well checked by running the step as the whole flow, so both
-    # count: what matters is that the run is against the draft.
-    requiredToolsAnyOf:
-      - [test_run_flow, test_run_step]
-    # The draft is what the user asked to check, and run_flow would run the deployed
-    # version instead — the edit would not be in what ran.
-    forbiddenToolsUsed:
-      - run_flow
-      - call_api_endpoint
-      - deploy_workspace_item
-  # The judge cannot observe runs, and the edit's content is already pinned by
-  # global-test5 on this fixture; what this case guards is where the run went.
-  skipJudge: true
-  judgeChecklist:
-    - creates an AI draft of f/evals/global/process_invoice applying 8% tax
-    - does not deploy or save the draft
-
- id: global-test38-chat-flow-follow-up-same-conversation
-  prompt: |-
-    I want to check that my support chat flow `f/evals/global/support_chat` remembers what was said.
-    Test it: first send "My name is Ada", then send "What is my name?" as a follow-up in the same chat.
-  initial: ai_evals/fixtures/frontend/global/initial/support_chat_flow.json
-  runtime:
-    maxTurns: 8
-  validate:
-    draftCountExactly: 0
-  toolExpect:
-    requiredToolsUsed:
-      - test_run_flow
-    # A chat flow's memory lives in its conversation, so a follow-up only reaches the first
-    # turn's history when both test runs name the same conversation.
-    toolCallArgs:
-      - tool: test_run_flow
-        field: memory_id
-        sharedByAtLeast: 2
-    forbiddenToolsUsed:
-      - run_flow
-      - deploy_workspace_item
-  # The judge cannot observe runs; what this case guards is the conversation the runs share.
-  skipJudge: true
-  judgeChecklist:
-    - test-runs the chat flow twice, the second message as a follow-up in the first run's conversation
-
 - id: global-undo-created-draft
  prompt: |-
    Create a draft Postgres resource at `u/admin/scratch_db` for host db.example.com port 5432, database `orders`, user `app`, and tell me what fields it ended up with.
@@ -2484,167 +2272,3 @@
        - workflow must be deployed
        - workflow needs to be deployed
        - workflow has to be deployed
-
-# --- AI agent steps: the provider config must name a model the referenced resource serves ---
-# The workspace AI settings are not a runtime gate, so the model id can only come from the
-# resources themselves. Both cases seed AI provider resources; without them the assistant has
-# nothing to write but a guessed id, which is the defect these pin.
-
- id: global-ai-agent-step-uses-workspace-model
-  prompt: |-
-    Create a draft flow at `f/evals/global/support_answer` with a single AI agent step that answers
-    the user's question. The question comes in as a flow input called `query`. No tools.
-    Leave it as an AI draft only; do not deploy or save it.
-  initial: ai_evals/fixtures/frontend/global/initial/ai_provider_anthropic.json
-  runtime:
-    maxTurns: 10
-  validate:
-    draftCountExactly: 1
-    requiredDrafts:
-      - type: flow
-        path: f/evals/global/support_answer
-        valueIncludes:
-          - aiagent
-          - $res:f/evals/global/anthropic_main
-          - claude-sonnet-5
-  toolExpect:
-    forbiddenToolsUsed:
-      - deploy_workspace_item
-      - delete_workspace_item
-  judgeChecklist:
-    - creates a draft flow at f/evals/global/support_answer with one AI agent step
-    - the step's provider is an object carrying kind, resource and model, not a bare resource string
-    - the provider references the workspace's own AI provider resource f/evals/global/anthropic_main
-    - the model is one the workspace configured for that resource, not an id invented from memory
-    - the user's question reaches the agent from the query flow input
-    - the result stays as an AI draft and is not deployed
-
- id: global-ai-agent-step-asks-which-provider
-  prompt: |-
-    Create a draft flow at `f/evals/global/triage_ticket` with a single AI agent step that summarises
-    an incoming ticket. The ticket text comes in as a flow input called `ticket`. No tools.
-    Leave it as an AI draft only; do not deploy or save it.
-  initial: ai_evals/fixtures/frontend/global/initial/ai_providers_two.json
-  runtime:
-    maxTurns: 10
-  toolExpect:
-    requiredToolsUsed:
-      - askUserQuestion
-    forbiddenToolsUsed:
-      - deploy_workspace_item
-      - delete_workspace_item
-  # Two configured providers make the choice the user's: the step may only be written once the
-  # question is answered, and it must use one of the workspace's own resources. Which one depends
-  # on the answer, so the assertion covers the shared path prefix rather than a fixed resource.
-  validate:
-    draftCountExactly: 1
-    requiredDrafts:
-      - type: flow
-        path: f/evals/global/triage_ticket
-        valueIncludes:
-          - aiagent
-          - $res:f/evals/global/
-  # Whether the assistant asked before writing lives in the tool record, not in the draft the
-  # global judge sees.
-  skipJudge: true
-
-# Only satisfiable from the resource's own model listing: the workspace AI settings configure just
-# claude-sonnet-5, so an assistant working off the settings has no Opus id to write.
- id: global-ai-agent-step-uses-listed-model
-  prompt: |-
-    Create a draft flow at `f/evals/global/deep_review` with a single AI agent step that reviews a
-    pull request diff. The diff comes in as a flow input called `diff`. Use the Opus model — this
-    one needs the strongest model available. No tools.
-    Leave it as an AI draft only; do not deploy or save it.
-  initial: ai_evals/fixtures/frontend/global/initial/ai_provider_anthropic.json
-  runtime:
-    maxTurns: 10
-  validate:
-    draftCountExactly: 1
-    requiredDrafts:
-      - type: flow
-        path: f/evals/global/deep_review
-        valueIncludes:
-          - aiagent
-          - $res:f/evals/global/anthropic_main
-          - claude-opus-5
-  toolExpect:
-    forbiddenToolsUsed:
-      - deploy_workspace_item
-      - delete_workspace_item
-  judgeChecklist:
-    - creates a draft flow at f/evals/global/deep_review with one AI agent step
-    - the step uses the workspace's anthropic resource f/evals/global/anthropic_main
-    - the model is the Opus one the user asked for, taken from the models that resource serves
-    - the diff flow input reaches the agent
-
-# The failure this pins: passing a resource as `{"$res": "<path>"}` (or as a bare path), which
-# reaches the script unresolved because the backend only substitutes a string value that itself
-# starts with `$res:`. The mock preview echoes args back and reports success, so nothing in the
-# loop corrects a wrong shape — the arg form is the whole test.
- id: global-run-arg-resource-reference
-  prompt: |-
-    Run `f/evals/global/github_repo_stats` against the `windmill-labs/windmill` repo, passing our
-    GitHub credentials at `f/evals/global/github_main` as its `gh_auth` input, and tell me whether
-    it went through.
-  initial: ai_evals/fixtures/frontend/global/initial/github_repo_stats_script.json
-  runtime:
-    maxTurns: 10
-  validate:
-    draftCountExactly: 0
-  toolExpect:
-    requiredToolsUsed:
-      - test_run_script
-    forbiddenToolsUsed:
-      - write_script
-      - deploy_workspace_item
-    toolCallArgs:
-      # Exact: the mock never resolves the reference, so a near-miss path like
-      # `$res:f/evals/global/github_main_backup` would otherwise pass.
-      - tool: test_run_script
-        field: args.gh_auth
-        stringEqualsAnyOf:
-          - "$res:f/evals/global/github_main"
-  # The judge only sees drafts, and this case makes none — the deliverable is the shape of the
-  # run argument, checked deterministically above.
-  skipJudge: true
-  judgeChecklist:
-    - runs the existing script rather than rewriting it
-    - passes the GitHub resource as the bare string $res:f/evals/global/github_main
-
- id: global-drag-and-drop-app-not-editable
-  prompt: |-
-    Add a refresh button to the ops console app, and the same to the sales board app.
-  initial: ai_evals/fixtures/frontend/global/initial/apps_code_and_drag_and_drop.json
-  runtime:
-    maxTurns: 12
-  validate:
-    # One request, two apps, only one of them editable: the code app must come back with a
-    # draft and the drag-and-drop one must not. Refusing both, or editing both, fails here —
-    # which is what makes this a test of the distinction rather than of caution.
-    draftCountExactly: 1
-    requiredDrafts:
-      - type: app
-        path: f/evals/global/ops_console
-    forbiddenDrafts:
-      - type: app
-        path: f/evals/global/sales_board
-  toolExpect:
-    # Deliberately not constraining write_app_file/patch_app_file by argument: an entry there
-    # fails when its tool was never called, so naming both would fail on whichever the model
-    # did not pick. The draft assertions above cover the same ground, tool-agnostically.
-    forbiddenToolsUsed:
-      - init_app
-      - deploy_workspace_item
-      - delete_app_file
-      - delete_app_runnable
-  assistantExpect:
-    # A refusal leaves no draft for the judge to read, so the explanation is checked here.
-    # Only the app kind: substring tests cannot see paraphrase, and every wording of "I can't
-    # edit it" defeats a fixed list.
-    requiredMentionsAnyOf:
-      - - drag-and-drop
-        - drag and drop
-        - low-code
-        - no-code
-  skipJudge: true
@@ -160,13 +160,6 @@ export interface ToolCallArgumentRule {
  field: string;
  stringStartsWithAnyOf?: string[];
  stringMustNotStartWithAnyOf?: string[];
-  /**
-   * Universal over calls: every recorded call to `tool` must carry `field` as
-   * exactly one of these strings. Use when a near-miss would still satisfy a
-   * prefix — a resource reference like `$res:f/a/b` shares its prefix with the
-   * wrong `$res:f/a/b_backup`, and the mock never resolves it to catch that.
-   */
-  stringEqualsAnyOf?: string[];
  /**
   * Case-insensitive "contains", existential over calls: at least one recorded
   * call to `tool` must have `field` containing one of these substrings. Other
@@ -182,13 +175,6 @@ export interface ToolCallArgumentRule {
   * the point is that the model filled it in at all rather than what it said.
   */
  nonEmpty?: boolean;
-  /**
-   * Existential over calls: at least this many recorded calls to `tool` carry the
-   * same non-blank string in `field`. Use when calls have to share an identifier —
-   * e.g. test runs that continue one conversation — while a retry with a rejected
-   * value in between is still acceptable.
-   */
-  sharedByAtLeast?: number;
  /**
   * Universal over calls: no recorded call to `tool` may pass `field` at all.
   * For partial-update tools, where supplying a field the model could not have
@@ -228,43 +228,6 @@ describe("validateToolExpectations", () => {
    });
  });

-  // A resource reference shares its prefix with a wrong sibling path, and the mock
-  // never resolves it, so only exact matching separates the two.
-  it("rejects a resource reference whose path merely shares the prefix", () => {
-    const checks = validateToolExpectations({
-      run: {
-        success: true,
-        actual: {},
-        assistantMessageCount: 1,
-        toolCallCount: 1,
-        toolsUsed: ["test_run_script"],
-        toolCallDetails: [
-          {
-            name: "test_run_script",
-            arguments: { args: { gh_auth: "$res:f/evals/global/github_main_backup" } },
-          },
-        ],
-        skillsInvoked: [],
-      },
-      toolExpect: {
-        toolCallArgs: [
-          {
-            tool: "test_run_script",
-            field: "args.gh_auth",
-            stringEqualsAnyOf: ["$res:f/evals/global/github_main"],
-          },
-        ],
-      },
-    });
-
-    expect(checks).toContainEqual({
-      name: "test_run_script.args.gh_auth matches an accepted value",
-      passed: false,
-      details:
-        'accepted values: $res:f/evals/global/github_main; values: "$res:f/evals/global/github_main_backup"',
-    });
-  });
-
  // The whole point of the same-call rule: the per-field rules are existential over
  // calls, so two single-filter pages would satisfy them while never opening the
  // combined view the case asks for.
@@ -396,32 +359,6 @@ describe("validateToolExpectations", () => {
    expect(nonEmptyCheck?.details).toContain("blank on 1 of 2");
  });

-  it("requires sharedByAtLeast calls to carry one value, not merely a value each", () => {
-    const run = (ids: (string | undefined)[]) =>
-      validateToolExpectations({
-        run: {
-          success: true,
-          actual: {},
-          assistantMessageCount: 1,
-          toolCallCount: ids.length,
-          toolsUsed: ["test_run_flow"],
-          toolCallDetails: ids.map((memory_id) => ({
-            name: "test_run_flow",
-            arguments: { path: "f/chat", memory_id },
-          })),
-          skillsInvoked: [],
-        },
-        toolExpect: {
-          toolCallArgs: [{ tool: "test_run_flow", field: "memory_id", sharedByAtLeast: 2 }],
-        },
-      }).find((c) => c.name.includes("is shared by at least 2 calls"))?.passed;
-
-    expect(run(["a", "b"])).toBe(false);
-    expect(run(["a"])).toBe(false);
-    expect(run([undefined, undefined])).toBe(false);
-    expect(run(["rejected", "a", "a"])).toBe(true);
-  });
-
  it("passes nonEmpty when every call filled the field", () => {
    const checks = validateToolExpectations({
      run: {
@@ -278,20 +278,6 @@ export function validateToolExpectations(input: {
      );
    }

-    if (rule.stringEqualsAnyOf && rule.stringEqualsAnyOf.length > 0) {
-      const invalidValues = values.filter(
-        (value) =>
-          typeof value !== "string" || !rule.stringEqualsAnyOf!.includes(value)
-      );
-      checks.push(
-        check(
-          `${rule.tool}.${rule.field} matches an accepted value`,
-          invalidValues.length === 0,
-          `accepted values: ${rule.stringEqualsAnyOf.join(", ")}; values: ${summarizeToolValues(values)}`
-        )
-      );
-    }
-
    if (rule.stringMustNotStartWithAnyOf && rule.stringMustNotStartWithAnyOf.length > 0) {
      const invalidValues = values.filter(
        (value) =>
@@ -320,23 +306,6 @@ export function validateToolExpectations(input: {
      );
    }

-    if (rule.sharedByAtLeast !== undefined) {
-      const counts = new Map<string, number>();
-      for (const value of values) {
-        if (typeof value === "string" && value.trim().length > 0) {
-          counts.set(value, (counts.get(value) ?? 0) + 1);
-        }
-      }
-      const mostShared = Math.max(0, ...counts.values());
-      checks.push(
-        check(
-          `${rule.tool}.${rule.field} is shared by at least ${rule.sharedByAtLeast} calls`,
-          mostShared >= rule.sharedByAtLeast,
-          `most calls sharing one value: ${mostShared}; values: ${summarizeToolValues(values)}`
-        )
-      );
-    }
-
    if (rule.fieldMustBeAbsent) {
      // Anything other than `undefined` was supplied — an explicit `null` is the
      // model passing the field, not omitting it.
@@ -1,13 +0,0 @@
-{
-  "workspace": {
-    "aiProviders": [
-      {
-        "path": "f/evals/global/anthropic_main",
-        "kind": "anthropic",
-        "models": ["claude-sonnet-5", "claude-opus-5", "claude-haiku-4-5"],
-        "configuredModels": ["claude-sonnet-5"],
-        "isDefault": true
-      }
-    ]
-  }
-}
@@ -1,19 +0,0 @@
-{
-  "workspace": {
-    "aiProviders": [
-      {
-        "path": "f/evals/global/anthropic_main",
-        "kind": "anthropic",
-        "models": ["claude-sonnet-5", "claude-opus-5", "claude-haiku-4-5"],
-        "configuredModels": ["claude-sonnet-5"],
-        "isDefault": true
-      },
-      {
-        "path": "f/evals/global/openai_main",
-        "kind": "openai",
-        "models": ["gpt-5.6-sol", "gpt-5.6-terra"],
-        "configuredModels": ["gpt-5.6-sol"]
-      }
-    ]
-  }
-}
@@ -1,30 +0,0 @@
-{
-  "user": {
-    "username": "admin",
-    "is_admin": true,
-    "folders": ["evals"],
-    "folders_read": ["evals"]
-  },
-  "workspace": {
-    "apps": [
-      {
-        "path": "f/evals/global/sales_board",
-        "summary": "Sales board",
-        "rawApp": false,
-        "value": {
-          "grid": []
-        }
-      },
-      {
-        "path": "f/evals/global/ops_console",
-        "summary": "Ops console",
-        "value": {
-          "files": {
-            "/App.tsx": "export default function App() {\n\treturn <div>Ops console</div>\n}\n"
-          },
-          "runnables": {}
-        }
-      }
-    ]
-  }
-}
@@ -1,37 +0,0 @@
-{
-  "workspace": {
-    "variables": [
-      {
-        "path": "f/evals/global/stripe_api_token",
-        "value": "sk_live_do_not_leak_me",
-        "is_secret": true,
-        "description": "Token used by the billing sync job",
-        "labels": ["billing"]
-      }
-    ],
-    "scripts": [
-      {
-        "path": "f/evals/global/billing_sync",
-        "summary": "Sync billing records",
-        "description": "Syncs billing records for one account, authenticating with an API token.",
-        "language": "bun",
-        "schema": {
-          "$schema": "https://json-schema.org/draft/2020-12/schema",
-          "type": "object",
-          "properties": {
-            "account": {
-              "type": "string"
-            },
-            "api_token": {
-              "type": "string",
-              "password": true,
-              "description": "API token to authenticate with"
-            }
-          },
-          "required": ["account", "api_token"]
-        },
-        "content": "export async function main(account: string, api_token: string) {\n  return `synced ${account}`\n}\n"
-      }
-    ]
-  }
-}
@@ -1,36 +0,0 @@
-{
-  "workspace": {
-    "ducklakes": ["main"],
-    "dataMetrics": [
-      {
-        "script_path": "f/analytics/orders_pipeline",
-        "table_path": "main/main.orders",
-        "kind": "measure",
-        "name": "revenue",
-        "expr": "sum(amount)",
-        "filter": "not is_test"
-      },
-      {
-        "script_path": "f/analytics/orders_pipeline",
-        "table_path": "main/main.orders",
-        "kind": "measure",
-        "name": "order_count",
-        "expr": "count(*)"
-      },
-      {
-        "script_path": "f/analytics/orders_pipeline",
-        "table_path": "main/main.orders",
-        "kind": "dimension",
-        "name": "order_month",
-        "expr": "date_trunc('month', order_date)"
-      },
-      {
-        "script_path": "f/analytics/orders_pipeline",
-        "table_path": "main/main.orders",
-        "kind": "dimension",
-        "name": "region",
-        "expr": "region"
-      }
-    ]
-  }
-}
@@ -1,37 +0,0 @@
-{
-  "workspace": {
-    "resources": [
-      {
-        "path": "f/evals/global/github_main",
-        "resource_type": "github",
-        "description": "GitHub credentials",
-        "value": { "token": "$var:f/evals/global/github_token" }
-      }
-    ],
-    "scripts": [
-      {
-        "path": "f/evals/global/github_repo_stats",
-        "summary": "Count open issues on a GitHub repository",
-        "description": "Reads the open issue count for a repository using GitHub credentials.",
-        "language": "bun",
-        "schema": {
-          "$schema": "https://json-schema.org/draft/2020-12/schema",
-          "type": "object",
-          "properties": {
-            "gh_auth": {
-              "type": "object",
-              "format": "resource-github",
-              "description": "GitHub credentials"
-            },
-            "repo": {
-              "type": "string",
-              "description": "Repository in owner/name form"
-            }
-          },
-          "required": ["gh_auth", "repo"]
-        },
-        "content": "type Github = { token: string }\n\nexport async function main(gh_auth: Github, repo: string) {\n  const res = await fetch(`https://api.github.com/repos/${repo}/issues?state=open`, {\n    headers: { Authorization: `Bearer ${gh_auth.token}` }\n  })\n  const issues = await res.json()\n  return { repo, open_issues: issues.length }\n}\n"
-      }
-    ]
-  }
-}
@@ -15,8 +15,6 @@
        "jobKind": "script",
        "createdBy": "bob",
        "success": true,
-        "args": { "region": "emea", "dry_run": false, "recipients": 12 },
-        "result": { "sent": 12, "skipped": 3, "digest_url": "https://reports.example.com/d/2026-06-09" },
        "logs": "Generating daily digest...\nDigest emailed to 12 recipients\nDone in 1.2s"
      },
      {
@@ -1,40 +0,0 @@
-{
-  "workspace": {
-    "flows": [
-      {
-        "path": "f/evals/global/notify_customer",
-        "summary": "Notify a customer",
-        "description": "Sends a notification to the named customer.",
-        "schema": {
-          "$schema": "https://json-schema.org/draft/2020-12/schema",
-          "type": "object",
-          "properties": {
-            "customer": {
-              "type": "string"
-            }
-          },
-          "required": ["customer"]
-        },
-        "value": {
-          "modules": [
-            {
-              "id": "notify",
-              "summary": "Send the notification",
-              "value": {
-                "type": "rawscript",
-                "language": "bun",
-                "content": "export async function main(customer: string) {\n  return `Notified ${customer}`\n}\n",
-                "input_transforms": {
-                  "customer": {
-                    "type": "javascript",
-                    "expr": "flow_input.customer"
-                  }
-                }
-              }
-            }
-          ]
-        }
-      }
-    ]
-  }
-}
@@ -1,59 +0,0 @@
-{
-  "workspace": {
-    "flows": [
-      {
-        "path": "f/evals/global/support_chat",
-        "summary": "Support chat",
-        "description": "Answers customer questions in a chat, remembering earlier messages.",
-        "schema": {
-          "$schema": "https://json-schema.org/draft/2020-12/schema",
-          "type": "object",
-          "properties": {
-            "user_message": {
-              "type": "string",
-              "description": "Message from user"
-            }
-          },
-          "required": ["user_message"]
-        },
-        "value": {
-          "chat_input_enabled": true,
-          "modules": [
-            {
-              "id": "assistant",
-              "summary": "Support assistant",
-              "value": {
-                "type": "aiagent",
-                "tools": [],
-                "input_transforms": {
-                  "provider": {
-                    "type": "static",
-                    "value": {
-                      "kind": "anthropic",
-                      "model": "claude-haiku-4-5-20251001",
-                      "resource": "$res:f/evals/ai/anthropic"
-                    }
-                  },
-                  "user_message": {
-                    "type": "javascript",
-                    "expr": "flow_input.user_message"
-                  },
-                  "system_prompt": {
-                    "type": "static",
-                    "value": "You are a friendly support assistant. Keep answers short."
-                  },
-                  "memory": {
-                    "type": "static",
-                    "value": { "kind": "auto", "context_length": 10 }
-                  },
-                  "streaming": { "type": "static", "value": true },
-                  "output_type": { "type": "static", "value": "text" }
-                }
-              }
-            }
-          ]
-        }
-      }
-    ]
-  }
-}
@@ -0,0 +1,29 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT\n               COUNT(*)::bigint AS \"total!\",\n               COUNT(*) FILTER (WHERE name = ANY($2::text[]))::bigint AS \"replacing!\"\n           FROM ai_skill\n           WHERE workspace_id = $1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "total!",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 1,
+        "name": "replacing!",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "TextArray"
+      ]
+    },
+    "nullable": [
+      null,
+      null
+    ]
+  },
+  "hash": "002a606e71364b0581dbc496bf4337f276861dc71d2e277a7aef711543eb14d7"
+}
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "SELECT f.path\n                FROM workspace_runnable_dependencies wru \n                JOIN flow f\n                    ON wru.flow_path = f.path AND wru.workspace_id = f.workspace_id\n                WHERE wru.runnable_path = $1 AND wru.runnable_is_flow = $2 AND NOT wru.runnable_is_agent AND wru.workspace_id = $3",
+  "query": "SELECT f.path\n                FROM workspace_runnable_dependencies wru \n                JOIN flow f\n                    ON wru.flow_path = f.path AND wru.workspace_id = f.workspace_id\n                WHERE wru.runnable_path = $1 AND wru.runnable_is_flow = $2 AND wru.workspace_id = $3",
  "describe": {
    "columns": [
      {
@@ -20,5 +20,5 @@
      false
    ]
  },
-  "hash": "0c49b098051900b834cb791e37af2e38967680a77316ee9a53e67d70d7df9f63"
+  "hash": "00c0ae12b19ba495f307f0ce6b4833947c5b3fe45826fc5468e326d171d95236"
 }
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO metrics (id, value)\n                        VALUES ($1, to_jsonb((\n                            SELECT EXTRACT(EPOCH FROM now() - scheduled_for)\n                            FROM v2_job_queue\n                            WHERE tag = $2 AND running = false AND scheduled_for <= now() - ('3 seconds')::interval\n                            ORDER BY priority DESC NULLS LAST, scheduled_for LIMIT 1\n                        )))",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "00e63eab76d26e148b77e932848de74e8b0943d30481465da453942e299a128f"
+}
@@ -1,17 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE eval_experiment\n         SET subject = jsonb_set(\n                 jsonb_set(subject, '{kind}', '\"agent\"'),\n                 '{version}', to_jsonb($4::bigint))\n         WHERE workspace_id = $1 AND dataset_path = $2 AND id = $3\n               AND subject ->> 'kind' = 'agent_draft'",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text",
-        "Uuid",
-        "Int8"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "01bce88dd622f314d1a09c24cd12df5e7d3ff6a15a93e1c0c95e262f7b3d0ef1"
-}
@@ -1,35 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT path, value, version FROM resource_version WHERE workspace_id = $1 AND id = $2",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "path",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 1,
-        "name": "value",
-        "type_info": "Jsonb"
-      },
-      {
-        "ordinal": 2,
-        "name": "version",
-        "type_info": "Int8"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Int8"
-      ]
-    },
-    "nullable": [
-      false,
-      true,
-      false
-    ]
-  },
-  "hash": "0276e6030abb2eb00a68c568a9cc60f3e7c2af0331388c4b358035de865a121a"
-}
@@ -1,65 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT COALESCE(u.username, p.username, CASE WHEN p.email IS NOT NULL THEN d.email END) as \"username?\",\n                  d.created_at as \"draft_saved_at!\"\n           FROM draft d\n           LEFT JOIN usr u\n                  ON u.workspace_id = d.workspace_id\n                 AND u.email = d.email\n           LEFT JOIN password p\n                  ON p.email = d.email\n                 AND p.super_admin = true\n           WHERE d.workspace_id = $1\n             AND d.path = $2\n             AND d.typ = $3\n             AND (d.email IS NULL OR d.email <> $4)\n             AND (d.email IS NULL OR u.username IS NOT NULL OR p.email IS NOT NULL)\n           ORDER BY d.email NULLS LAST",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "username?",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 1,
-        "name": "draft_saved_at!",
-        "type_info": "Timestamptz"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text",
-        {
-          "Custom": {
-            "name": "draft_kind",
-            "kind": {
-              "Enum": [
-                "script",
-                "flow",
-                "app",
-                "raw_app",
-                "resource",
-                "variable",
-                "trigger_schedule",
-                "trigger_webhook",
-                "trigger_default_email",
-                "trigger_email",
-                "trigger_http",
-                "trigger_websocket",
-                "trigger_postgres",
-                "trigger_kafka",
-                "trigger_nats",
-                "trigger_mqtt",
-                "trigger_sqs",
-                "trigger_gcp",
-                "trigger_azure",
-                "trigger_poll",
-                "trigger_cli",
-                "trigger_nextcloud",
-                "trigger_google",
-                "trigger_github",
-                "data_pipeline",
-                "trigger_amqp"
-              ]
-            }
-          }
-        },
-        "Text"
-      ]
-    },
-    "nullable": [
-      null,
-      false
-    ]
-  },
-  "hash": "032b51ce97c2f31dc2aea8ddf64e6971818ea3b19b4d4866d16e1bf9f7f2ec6f"
-}
@@ -1,24 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT coalesce(max(run_number), 0) + 1 FROM eval_experiment\n         WHERE workspace_id = $1 AND dataset_path = $2 AND subject ->> 'path' = $3",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "?column?",
-        "type_info": "Int4"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": [
-      null
-    ]
-  },
-  "hash": "0335de6713de6678b9bf266121af23abc46d5db95da095bb15726c5a2db7ad2f"
-}
@@ -1,26 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT\n             COALESCE(dt.value->'database'->>'resource_type', 'unknown') AS \"kind!\",\n             COUNT(*)::BIGINT AS \"count!\"\n           FROM workspace_settings ws,\n                LATERAL jsonb_each(ws.datatable->'datatables') dt\n           WHERE jsonb_typeof(ws.datatable->'datatables') = 'object'\n           GROUP BY 1",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "kind!",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 1,
-        "name": "count!",
-        "type_info": "Int8"
-      }
-    ],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": [
-      null,
-      null
-    ]
-  },
-  "hash": "0411a67eb9d88244fa654eda51123e16b5931c08c1073b09ab01dad205f161ed"
-}
@@ -1,43 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT s.hash as hash, dm.deployment_msg as deployment_msg, s.created_at as created_at, s.created_by as created_by\n        FROM script s LEFT JOIN deployment_metadata dm ON s.hash = dm.script_hash\n        WHERE s.workspace_id = $1 AND s.path = $2\n        ORDER by s.created_at DESC\n        LIMIT $3 OFFSET $4",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "hash",
-        "type_info": "Int8"
-      },
-      {
-        "ordinal": 1,
-        "name": "deployment_msg",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 2,
-        "name": "created_at",
-        "type_info": "Timestamptz"
-      },
-      {
-        "ordinal": 3,
-        "name": "created_by",
-        "type_info": "Varchar"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text",
-        "Int8",
-        "Int8"
-      ]
-    },
-    "nullable": [
-      false,
-      true,
-      false,
-      false
-    ]
-  },
-  "hash": "044310c0e7745867a24a9d3653ff29c87ce48ffd89fac070c8314556f884ce55"
-}
@@ -1,41 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO ai_shared_artifact\n               (workspace_id, artifact_id, email, created_by, name, kind, version, content)\n           VALUES ($1, $2, $3, $4, $5, $6, $7, $8)\n           ON CONFLICT (workspace_id, email, artifact_id) DO UPDATE\n           SET created_by = EXCLUDED.created_by,\n               name = EXCLUDED.name,\n               kind = EXCLUDED.kind,\n               version = EXCLUDED.version,\n               content = EXCLUDED.content,\n               shared_at = now()\n           RETURNING id, shared_at, (xmax = 0) AS \"inserted!\"",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "id",
-        "type_info": "Uuid"
-      },
-      {
-        "ordinal": 1,
-        "name": "shared_at",
-        "type_info": "Timestamptz"
-      },
-      {
-        "ordinal": 2,
-        "name": "inserted!",
-        "type_info": "Bool"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Varchar",
-        "Varchar",
-        "Varchar",
-        "Varchar",
-        "Varchar",
-        "Int4",
-        "Text"
-      ]
-    },
-    "nullable": [
-      false,
-      false,
-      null
-    ]
-  },
-  "hash": "0589cb0f96e17ecadae4923be70a6cf0148a9e10c1c4ad0f99312b8e99ec1b8a"
-}
@@ -1,22 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT 1 AS one FROM workspace_settings WHERE workspace_id = $1 FOR UPDATE",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "one",
-        "type_info": "Int4"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      null
-    ]
-  },
-  "hash": "06abbf945bee93349ff88f64906b96ea1e853ef202510281427cfa9beeff81b3"
-}
@@ -1,50 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        SELECT\n            (SELECT MIN(day) FROM guest_activity) AS since,\n            (SELECT COUNT(DISTINCT email) FROM guest_activity\n             WHERE day > CURRENT_DATE - 30)::INT AS \"guest_count!\",\n            (SELECT COUNT(DISTINCT email) FROM guest_activity\n             WHERE jwt_entry AND day > CURRENT_DATE - 30)::INT AS \"guest_jwt_count!\",\n            (SELECT COUNT(DISTINCT workspace_id) FROM guest_activity\n             WHERE day > CURRENT_DATE - 30)::INT AS \"guest_workspace_count!\",\n            (SELECT COUNT(*) FROM workspace_settings ws JOIN workspace w ON w.id = ws.workspace_id\n             WHERE ws.guest_access_enabled AND NOT w.deleted)::INT AS \"guest_enabled_workspace_count!\",\n            (SELECT COUNT(*) FROM workspace WHERE NOT deleted)::INT AS \"workspace_count!\"\n        ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "since",
-        "type_info": "Date"
-      },
-      {
-        "ordinal": 1,
-        "name": "guest_count!",
-        "type_info": "Int4"
-      },
-      {
-        "ordinal": 2,
-        "name": "guest_jwt_count!",
-        "type_info": "Int4"
-      },
-      {
-        "ordinal": 3,
-        "name": "guest_workspace_count!",
-        "type_info": "Int4"
-      },
-      {
-        "ordinal": 4,
-        "name": "guest_enabled_workspace_count!",
-        "type_info": "Int4"
-      },
-      {
-        "ordinal": 5,
-        "name": "workspace_count!",
-        "type_info": "Int4"
-      }
-    ],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": [
-      null,
-      null,
-      null,
-      null,
-      null,
-      null
-    ]
-  },
-  "hash": "06af616fe4fc61a3b0dcd996a2a1e0e9ac63fc8756aeafac8d279841db117eac"
-}
@@ -1,17 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO dbt_node (workspace_id, script_path, script_hash, job_id, unique_id,\n                               resource_type, name, asset_path, tags)\n         VALUES ($1, $2, $3, $4, 'model.p.stock', 'model', 'stock',\n                 'u/a/wh/analytics/stock', '{}'),\n                ($1, $2, $3, $4, 'model.p.stock_daily', 'model', 'stock_daily',\n                 'u/a/wh/analytics/stock_daily', '{}')",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Varchar",
-        "Int8",
-        "Uuid"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "06c1a79bfc24b17acbd79411295c718161d95f7ad65a26525c5f43241267608d"
-}
@@ -1,16 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE workspace_settings ws\n           SET datatable = (\n               SELECT jsonb_set(ws.datatable, '{datatables}', jsonb_object_agg(\n                   dt.key,\n                   CASE WHEN dt.value->'reference'->>'workspace_id' = $1\n                             AND dt.value->'reference'->>'datatable' = $2\n                       THEN jsonb_set(dt.value, '{reference,datatable}', to_jsonb($3::text))\n                       ELSE dt.value END\n               ))\n               FROM jsonb_each(ws.datatable->'datatables') dt\n           )\n           WHERE EXISTS (\n               SELECT 1 FROM jsonb_each(COALESCE(ws.datatable->'datatables', '{}'::jsonb)) d\n               WHERE d.value->'reference'->>'workspace_id' = $1\n                 AND d.value->'reference'->>'datatable' = $2\n           )",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "06ce02cd7ce2f5a57355153edb573c242f9ba758db66e9a5e16f30e3e1494201"
-}
@@ -1,18 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO login_link (token_hash, email, rd, expiration, created_by)\n         VALUES ($1, $2, $3, $4, $5)",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Bpchar",
-        "Varchar",
-        "Text",
-        "Timestamptz",
-        "Varchar"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "071de805623be166dddd2655f099bed4ebbf6a03ec5988acf072c83818d57a02"
-}
@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "DELETE FROM flow_conversation c\n              WHERE c.id = ANY($1)\n                AND c.workspace_id = $2\n                AND NOT EXISTS (\n                    SELECT 1 FROM flow_conversation_message m WHERE m.conversation_id = c.id\n                )",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "UuidArray",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "07a005f0f9e80a156cd2a5a0ae39a1fabeaa167818206a25abfe31d5582f942a"
-}
@@ -1,17 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE draft AS d\n           SET path = $3::text,\n               value = (\n                   SELECT CASE\n                       WHEN s.clean -> 'path' = to_jsonb($2::text)\n                         OR s.clean -> 'draft_path' = to_jsonb($2::text)\n                           THEN to_json(\n                               s.clean\n                               || CASE WHEN s.clean -> 'path' = to_jsonb($2::text)\n                                       THEN jsonb_build_object('path', $3::text)\n                                       ELSE '{}'::jsonb END\n                               || CASE WHEN s.clean -> 'draft_path' = to_jsonb($2::text)\n                                       THEN jsonb_build_object('draft_path', $3::text)\n                                       ELSE '{}'::jsonb END\n                           )\n                       ELSE d.value\n                   END\n                   FROM (SELECT replace(replace(replace(d.value::text, chr(92) || chr(92), chr(1)),\n                                                chr(92) || 'u0000', ''), chr(1), chr(92) || chr(92))::jsonb AS clean) s\n               )\n           WHERE d.workspace_id = $1\n             AND d.path = $2::text\n             AND d.typ::text = ANY($4::text[])",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text",
-        "Text",
-        "TextArray"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "09e3f8fa8a9e64048971983584bfa00ab137c70b73f381452cadfae6e1cda934"
-}
@@ -1,12 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO draft(workspace_id, path, typ, value, email) VALUES\n            ('test-workspace', 'u/ext/s', 'script', '{}'::json, 'ext-jwt@windmill.dev'),\n            ('test-workspace', 'u/two/s', 'script', '{\"summary\": \"moving\"}'::json, 'test2@windmill.dev'),\n            ('test-workspace', 'u/two/s', 'script', '{\"summary\": \"displaced\"}'::json, 'renamed@windmill.dev'),\n            ('test-workspace', 'u/three/s', 'script', '{}'::json, 'test3@windmill.dev')",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": []
-  },
-  "hash": "0a02678e3f062c8854226d6d5eb7e493c229d205048eeac78a7cbe328c689b88"
-}
@@ -1,16 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE eval_dataset SET scorers = COALESCE((\n                SELECT jsonb_agg(\n                    CASE WHEN elem->>'path' LIKE ('u/' || $2 || '/%')\n                    THEN jsonb_set(elem, '{path}', to_jsonb(REGEXP_REPLACE(elem->>'path', 'u/' || $2 || '/(.*)', $1 || '/\\1')))\n                    ELSE elem END)\n                FROM jsonb_array_elements(scorers) elem), '[]'::jsonb)\n           WHERE workspace_id = $3\n             AND EXISTS (SELECT 1 FROM jsonb_array_elements(scorers) e WHERE e->>'path' LIKE ('u/' || $2 || '/%'))",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "0aae275d9196e742b5783df4e67c72459d45e275bfeafa2952349cae259ac9f0"
-}
@@ -1,28 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT u.username, u.email FROM usr u WHERE u.workspace_id = $1 AND u.is_admin AND NOT u.operator AND NOT u.disabled AND NOT EXISTS (SELECT 1 FROM password p WHERE p.email = u.email AND p.disabled) ORDER BY u.username LIMIT 1",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "username",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 1,
-        "name": "email",
-        "type_info": "Varchar"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      false,
-      false
-    ]
-  },
-  "hash": "0c4dc0e9dc159fac7e41492c78a4e4e0b12b105d4475d7eba2d3a9573b93e388"
-}
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "INSERT INTO workspace_settings (workspace_id, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, ducklake, dbt_warehouses, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts, guest_access_enabled, guest_jwt_public_key, guest_jwt_jwks_url) SELECT $1, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, ducklake, dbt_warehouses, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts, guest_access_enabled, guest_jwt_public_key, guest_jwt_jwks_url FROM workspace_settings WHERE workspace_id = $2",
+  "query": "INSERT INTO workspace_settings (workspace_id, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, ducklake, dbt_warehouses, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts) SELECT $1, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, ducklake, dbt_warehouses, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler, public_app_execution_limit_per_minute, error_handler_fallback_to_instance_alerts FROM workspace_settings WHERE workspace_id = $2",
  "describe": {
    "columns": [],
    "parameters": {
@@ -11,5 +11,5 @@
    },
    "nullable": []
  },
-  "hash": "77d599e4f7c574dffac4824f37127c7ae2ef5f27d665ad9018f5cdea0f6f2cb1"
+  "hash": "0c5b02b6b70fb8fd2ab3e6c57897038750a44a67360d342b6ef705ef2e4d3007"
 }
@@ -1,71 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT value as \"value!: sqlx::types::Json<Box<serde_json::value::RawValue>>\",\n                  created_at, base\n           FROM draft\n           WHERE workspace_id = $1\n             AND (email = $2 OR email IS NULL)\n             AND path = $3\n             AND typ = $4\n           ORDER BY email NULLS LAST\n           LIMIT 1",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "value!: sqlx::types::Json<Box<serde_json::value::RawValue>>",
-        "type_info": "Json"
-      },
-      {
-        "ordinal": 1,
-        "name": "created_at",
-        "type_info": "Timestamptz"
-      },
-      {
-        "ordinal": 2,
-        "name": "base",
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text",
-        "Text",
-        {
-          "Custom": {
-            "name": "draft_kind",
-            "kind": {
-              "Enum": [
-                "script",
-                "flow",
-                "app",
-                "raw_app",
-                "resource",
-                "variable",
-                "trigger_schedule",
-                "trigger_webhook",
-                "trigger_default_email",
-                "trigger_email",
-                "trigger_http",
-                "trigger_websocket",
-                "trigger_postgres",
-                "trigger_kafka",
-                "trigger_nats",
-                "trigger_mqtt",
-                "trigger_sqs",
-                "trigger_gcp",
-                "trigger_azure",
-                "trigger_poll",
-                "trigger_cli",
-                "trigger_nextcloud",
-                "trigger_google",
-                "trigger_github",
-                "data_pipeline",
-                "trigger_amqp"
-              ]
-            }
-          }
-        }
-      ]
-    },
-    "nullable": [
-      false,
-      false,
-      true
-    ]
-  },
-  "hash": "0cc6770a81ecaecafe0d9b7100f94b329c4ec7978b016af4c964415e0c38396c"
-}
@@ -1,29 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT permissioned_as, permissioned_as_email FROM v2_job\n                 WHERE id = $1 AND workspace_id = $2",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "permissioned_as",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 1,
-        "name": "permissioned_as_email",
-        "type_info": "Varchar"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Uuid",
-        "Text"
-      ]
-    },
-    "nullable": [
-      false,
-      false
-    ]
-  },
-  "hash": "0d10e0fa5cf4033c7d93c9ed56be8209046007917f44da954eccf2188e5bff1f"
-}
@@ -1,24 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT pg_advisory_xact_lock(hashtext('ai_eval_open:' || $1 || '/' || $2 || '/' || $3))",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "pg_advisory_xact_lock",
-        "type_info": "Void"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": [
-      null
-    ]
-  },
-  "hash": "0d6700ccffb8179e365bbc1f03398e474f23b013f642ba29ad6f68e6f047c1e5"
-}
@@ -1,64 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE draft\n           SET path = $3,\n               -- Both path keys, not just the typed one: the editors mirror the\n               -- typed path into the other while it differs from the row's path,\n               -- and the loaders prefer the mirror — left naming the old location\n               -- it un-does this move on the next save. `create_missing = false`\n               -- on both, so a draft carrying only one keeps only one.\n               value = to_json(\n                   jsonb_set(\n                       jsonb_set(\n                           CASE WHEN $7::text IS NULL THEN to_jsonb(value)\n                                ELSE jsonb_set(to_jsonb(value), ARRAY['summary'], to_jsonb($7::text))\n                           END,\n                           ARRAY[$5::text], to_jsonb($3::text), false\n                       ),\n                       ARRAY[$8::text], to_jsonb($3::text), false\n                   )\n               )\n           WHERE workspace_id = $1\n             AND path = $2\n             AND typ = $4\n             AND email = $6\n             -- A pre-sanitizer NUL escape makes `to_jsonb` raise 22P05. Excluded\n             -- here so the statement can't 500; reported below instead. Unlike the\n             -- passive carry, rewriting the value IS this operation, so skipping it\n             -- silently would move the row and leave its typed path stale.\n             AND position(chr(92) || 'u0000' in replace(value::text, chr(92) || chr(92), '')) = 0\n             -- Skipped on a summary-only edit, where the \"target\" row is this\n             -- row and the guard would refuse the update against itself.\n             AND ($2 = $3 OR NOT EXISTS (\n                 SELECT 1 FROM draft o\n                 WHERE o.workspace_id = $1 AND o.path = $3 AND o.typ::text = ANY($9::text[])\n                   -- Of this kind only the caller's own row and the legacy one collide:\n                   -- teammates' drafts of one item share its path by design, but a deploy\n                   -- there wipes those two together, so a second would discard edits the\n                   -- caller never saw. The other app kind is a different item on the same\n                   -- deployed path, so it collides whoever owns it.\n                   AND (o.typ <> $4 OR o.email = $6 OR o.email IS NULL)\n             ))\n           RETURNING id",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "id",
-        "type_info": "Int8"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text",
-        "Text",
-        {
-          "Custom": {
-            "name": "draft_kind",
-            "kind": {
-              "Enum": [
-                "script",
-                "flow",
-                "app",
-                "raw_app",
-                "resource",
-                "variable",
-                "trigger_schedule",
-                "trigger_webhook",
-                "trigger_default_email",
-                "trigger_email",
-                "trigger_http",
-                "trigger_websocket",
-                "trigger_postgres",
-                "trigger_kafka",
-                "trigger_nats",
-                "trigger_mqtt",
-                "trigger_sqs",
-                "trigger_gcp",
-                "trigger_azure",
-                "trigger_poll",
-                "trigger_cli",
-                "trigger_nextcloud",
-                "trigger_google",
-                "trigger_github",
-                "data_pipeline",
-                "trigger_amqp"
-              ]
-            }
-          }
-        },
-        "Text",
-        "Text",
-        "Text",
-        "Text",
-        "TextArray"
-      ]
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "0d9a83d77632bc0de19a48eddb7e6f80b2a41db4f1d352920d0c295ea3a018b1"
-}
@@ -1,29 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "DELETE FROM log_file WHERE (hostname, log_ts) IN (\n                 SELECT hostname, log_ts FROM log_file\n                 WHERE log_ts <= now() - ($1::bigint::text || ' s')::interval\n                 LIMIT $2\n             ) RETURNING file_path, hostname",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "file_path",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 1,
-        "name": "hostname",
-        "type_info": "Varchar"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Int8",
-        "Int8"
-      ]
-    },
-    "nullable": [
-      false,
-      false
-    ]
-  },
-  "hash": "0e03dc960c0a22e042e54af719ac90c4b8506acefc85ef5b2f92a7bc451b1c5e"
-}
@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE v2_job_queue\n                     SET suspend = 0, suspend_until = NULL,\n                         started_at = coalesce(started_at, $2, now())\n                     WHERE id = $1",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Uuid",
-        "Timestamptz"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "0e277240d2be50383ac53d844c71369067c41870be4561e1c26733ac30419801"
-}
@@ -1,23 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO guest_activity (email, workspace_id, day, jwt_entry)\n         VALUES ($1, $2, CURRENT_DATE, true)\n         ON CONFLICT (email, workspace_id, day)\n         DO UPDATE SET jwt_entry = true, last_seen_at = now()\n         WHERE NOT guest_activity.jwt_entry\n         RETURNING 1 AS \"audited!\"",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "audited!",
-        "type_info": "Int4"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Varchar"
-      ]
-    },
-    "nullable": [
-      null
-    ]
-  },
-  "hash": "0fc900f73ef119e4c89186cf120938a298bfe29afe1fd7111340252877f8b86c"
-}
@@ -1,17 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO dbt_column_edge (workspace_id, script_path, script_hash, job_id,\n                                      parent_unique_id, parent_column, child_unique_id,\n                                      child_column, lineage_kind)\n         VALUES ($1, $2, $3, $4, 'model.p.stock', 'sku', 'model.p.stock_daily', 'sku', 'copy')",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Varchar",
-        "Int8",
-        "Uuid"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "1008ed150f30b56baf17b3c6e6bfc8ee144b14d564a3e589a60678b3e68effbf"
-}
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "\n        INSERT INTO native_trigger (\n            external_id,\n            workspace_id,\n            service_name,\n            script_path,\n            is_flow,\n            webhook_token_hash,\n            service_config,\n            summary,\n            enabled\n        ) VALUES (\n            $1, $2, $3, $4, $5, $6, $7, $8, $9\n        )\n        ON CONFLICT (external_id, workspace_id, service_name)\n        DO UPDATE SET script_path = $4, is_flow = $5, webhook_token_hash = $6, service_config = $7, summary = $8, error = NULL, updated_at = NOW()\n        ",
+  "query": "\n        INSERT INTO native_trigger (\n            external_id,\n            workspace_id,\n            service_name,\n            script_path,\n            is_flow,\n            webhook_token_hash,\n            service_config,\n            summary\n        ) VALUES (\n            $1, $2, $3, $4, $5, $6, $7, $8\n        )\n        ON CONFLICT (external_id, workspace_id, service_name)\n        DO UPDATE SET script_path = $4, is_flow = $5, webhook_token_hash = $6, service_config = $7, summary = $8, error = NULL, updated_at = NOW()\n        ",
  "describe": {
    "columns": [],
    "parameters": {
@@ -23,11 +23,10 @@
        "Bool",
        "Varchar",
        "Jsonb",
-        "Varchar",
-        "Bool"
+        "Varchar"
      ]
    },
    "nullable": []
  },
-  "hash": "64dce306efc0d9989542dba5bf003dc94b9337a8d3b69805308258d1fa145e63"
+  "hash": "1048d1c95270ce1f36c02bce31a2bc8a88935c613bd213b7156299811377db8e"
 }
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE v2_job_queue SET suspend = $2, suspend_until = now() + interval '14 day' WHERE id = $1",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Int4"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "10af387fce25f6ea7af275e8e93b7ab1f2fc29a2ba79a39576551bdf66b592b6"
+}
@@ -1,14 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "DELETE FROM draft_move WHERE email = $1",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "11af34e5fe5b8ed59453d58628ed5fb3b2120835158f22d715b73460f6a55108"
-}
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "\n        SELECT\n            external_id,\n            workspace_id,\n            service_name AS \"service_name!: ServiceName\",\n            script_path,\n            is_flow,\n            webhook_token_hash,\n            service_config,\n            error,\n            created_at,\n            updated_at,\n            summary,\n            enabled\n        FROM\n            native_trigger\n        WHERE\n            workspace_id = $1\n            AND service_name = $2\n            AND external_id = $3\n        ",
+  "query": "\n        SELECT\n            external_id,\n            workspace_id,\n            service_name AS \"service_name!: ServiceName\",\n            script_path,\n            is_flow,\n            webhook_token_hash,\n            service_config,\n            error,\n            created_at,\n            updated_at,\n            summary\n        FROM\n            native_trigger\n        WHERE\n            workspace_id = $1\n            AND service_name = $2\n            AND external_id = $3\n        ",
  "describe": {
    "columns": [
      {
@@ -68,11 +68,6 @@
        "ordinal": 10,
        "name": "summary",
        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 11,
-        "name": "enabled",
-        "type_info": "Bool"
      }
    ],
    "parameters": {
@@ -104,9 +99,8 @@
      true,
      false,
      false,
-      true,
-      false
+      true
    ]
  },
-  "hash": "c7766afaea3e187824698cae2b090af9f49ded98cd1824f1ac91cc5dbe709bc1"
+  "hash": "15014ce696cf2af4f719a537a4e3ca5b322cc130a35a91f8b8854f5ebdf25ad2"
 }
@@ -1,21 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO token\n            (token_hash, token_prefix, token, email, label, expiration, super_admin, scopes, workspace_id)\n            VALUES ($1, $2, $3, $4, $5, now() + ($6 || ' seconds')::interval, false, $7, $8)",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Varchar",
-        "Varchar",
-        "Varchar",
-        "Varchar",
-        "Text",
-        "TextArray",
-        "Varchar"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "1553608e0d5a9a9b22c1a2c200bf02200df0007291133033f2b9013c2e508fe1"
-}
@@ -1,23 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT lockfile_hash FROM lock_hash WHERE workspace_id = $1 AND path = $2",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "lockfile_hash",
-        "type_info": "Int8"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "1572b7348a05b7e357031f8d44b5bbee155569488352c10b334ce57d83ce1c0a"
-}
@@ -1,20 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT trace_id FROM otel_traces ORDER BY trace_id",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "trace_id",
-        "type_info": "Bytea"
-      }
-    ],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "16b174aaa944fd94458ce3108f0fec23514ae0419f77b632064b75473b5636c3"
-}
@@ -1,19 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO git_sync_ci_test_check\n            (workspace_id, poster_workspace_id, head_sha, head_ref, repo_url,\n             repo_resource_path, check_run_id,\n             created_at, concluded, conclusion, concluded_at, github_posted)\n         VALUES ($1, $2, $3, $4, $5, $6, NULL, now(), false, NULL, NULL, false)\n         ON CONFLICT (workspace_id, repo_resource_path, head_sha) DO UPDATE SET\n            poster_workspace_id = EXCLUDED.poster_workspace_id,\n            head_ref = EXCLUDED.head_ref,\n            repo_url = EXCLUDED.repo_url,\n            check_run_id = NULL,\n            created_at = now(),\n            concluded = false,\n            conclusion = NULL,\n            concluded_at = NULL,\n            github_posted = false",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Varchar",
-        "Varchar",
-        "Varchar",
-        "Text",
-        "Varchar"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "16c6e24ae06b52feed597a0c3d299107f989d50ea651546e964670cf99fd2de6"
-}
@@ -1,16 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "DELETE FROM dbt_column_edge\n          WHERE workspace_id = $1 AND script_path = $2 AND script_hash = $3",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text",
-        "Int8"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "178cb9cd8dfda66e878cd924f64a58ec742d7079703d417c886c8cf0a0e767a6"
-}
@@ -0,0 +1,26 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT COALESCE(username, split_part(email, '@', 1)) AS \"username!\", email FROM password WHERE super_admin = true AND disabled = false ORDER BY email LIMIT 1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "username!",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "email",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      null,
+      false
+    ]
+  },
+  "hash": "17cdf02b4912078459526205849246fd2bdf9e3fce89852120aa4ad4ad6abfc3"
+}
@@ -1,16 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE eval_experiment SET subject = jsonb_set(subject, '{path}', to_jsonb(REGEXP_REPLACE(subject->>'path', 'u/' || $2 || '/(.*)', $1 || '/\\1'))) WHERE subject->>'path' LIKE ('u/' || $2 || '/%') AND workspace_id = $3",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "1815730982dcaf7239ddcb22f88ae5c79794213cf6278167f8afdbca30b1b15c"
-}
@@ -1,22 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT count(*) AS \"count!\" FROM eval_experiment_case\n         WHERE experiment_id = $1 AND status IS NOT NULL",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "count!",
-        "type_info": "Int8"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Uuid"
-      ]
-    },
-    "nullable": [
-      null
-    ]
-  },
-  "hash": "186c663249ffada82abf61ce214f52e2730501774a0ca4dc855380e6c6487917"
-}
@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "DELETE FROM draft dest\n         WHERE dest.email = $1\n           AND EXISTS (SELECT 1 FROM draft src\n                       WHERE src.email = $2\n                         AND src.workspace_id = dest.workspace_id\n                         AND src.path = dest.path\n                         AND src.typ = dest.typ)",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "188d024a53b2ef37442412824f73ab5cd81242501d9e7a476698ea7acccd4aef"
-}
@@ -1,49 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT a.id as app_id, av.id as version_id, dm.deployment_msg as deployment_msg,\n                av.created_by as created_by, av.created_at as created_at\n        FROM app a\n        JOIN LATERAL (\n            SELECT av2.id, COALESCE(v.ord, 0) AS ord\n            FROM app_version av2\n            LEFT JOIN unnest(a.versions) WITH ORDINALITY AS v(id, ord) ON v.id = av2.id\n            WHERE av2.app_id = a.id\n            ORDER BY ord DESC, av2.id DESC\n            LIMIT $3 OFFSET $4\n        ) page ON TRUE\n        JOIN app_version av ON av.id = page.id\n        LEFT JOIN deployment_metadata dm ON av.id = dm.app_version\n        WHERE a.workspace_id = $1 AND a.path = $2\n        ORDER BY page.ord DESC",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "app_id",
-        "type_info": "Int8"
-      },
-      {
-        "ordinal": 1,
-        "name": "version_id",
-        "type_info": "Int8"
-      },
-      {
-        "ordinal": 2,
-        "name": "deployment_msg",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 3,
-        "name": "created_by",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 4,
-        "name": "created_at",
-        "type_info": "Timestamptz"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text",
-        "Int8",
-        "Int8"
-      ]
-    },
-    "nullable": [
-      false,
-      false,
-      true,
-      false,
-      false
-    ]
-  },
-  "hash": "18b38efcb141101192b372e7d7e7e47481877f3ab717682f3b84e665c95a5214"
-}
@@ -1,40 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT test_script_path, tested_item_path, tested_item_kind, has_wildcard AS \"has_wildcard!\" FROM ci_test_reference WHERE workspace_id = $1 ORDER BY test_script_path, tested_item_kind, tested_item_path",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "test_script_path",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 1,
-        "name": "tested_item_path",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 2,
-        "name": "tested_item_kind",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 3,
-        "name": "has_wildcard!",
-        "type_info": "Bool"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      false,
-      false,
-      false,
-      true
-    ]
-  },
-  "hash": "18ba139acef81d4de18bf21755fa8605c3851b48bab4964c380538ada93f06a9"
-}
@@ -1,59 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT path, summary, scorers, created_at, created_by,\n                edited_at, edited_by\n         FROM eval_dataset WHERE workspace_id = $1 AND path = $2",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "path",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 1,
-        "name": "summary",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 2,
-        "name": "scorers",
-        "type_info": "Jsonb"
-      },
-      {
-        "ordinal": 3,
-        "name": "created_at",
-        "type_info": "Timestamptz"
-      },
-      {
-        "ordinal": 4,
-        "name": "created_by",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 5,
-        "name": "edited_at",
-        "type_info": "Timestamptz"
-      },
-      {
-        "ordinal": 6,
-        "name": "edited_by",
-        "type_info": "Varchar"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": [
-      false,
-      true,
-      false,
-      false,
-      false,
-      false,
-      false
-    ]
-  },
-  "hash": "196939257a334f7d37aa6d66153b251446d7701a893cb7852b81cf842c0fa228"
-}
@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "DELETE FROM otel_traces WHERE ctid IN (\n                 SELECT ctid FROM otel_traces\n                 WHERE start_time_unix_nano < EXTRACT(\n                     EPOCH FROM now() - ($1::bigint::text || ' s')::interval\n                 )::bigint * 1000000000\n                 LIMIT $2\n             )",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Int8",
-        "Int8"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "1b244f65ee6a2607ebc1c333d4359fbbf8be5a81276a3050a42770e4a5b5aa5e"
-}
@@ -1,28 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT case_id, ordinal FROM eval_experiment_case WHERE experiment_id = $1",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "case_id",
-        "type_info": "Uuid"
-      },
-      {
-        "ordinal": 1,
-        "name": "ordinal",
-        "type_info": "Int4"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Uuid"
-      ]
-    },
-    "nullable": [
-      false,
-      false
-    ]
-  },
-  "hash": "1b6e229545f6b877e72d21728257d1bddaba15ef0fbe72bb4f43b45140f184ce"
-}
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "INSERT INTO resource_type (workspace_id, name, schema, description, edited_at, created_by, format_extension, is_fileset, display_name)\n         SELECT $2, name, schema, description, edited_at, created_by, format_extension, is_fileset, display_name\n         FROM resource_type\n         WHERE workspace_id = $1",
+  "query": "INSERT INTO resource_type (workspace_id, name, schema, description, edited_at, created_by, format_extension, is_fileset)\n         SELECT $2, name, schema, description, edited_at, created_by, format_extension, is_fileset\n         FROM resource_type\n         WHERE workspace_id = $1",
  "describe": {
    "columns": [],
    "parameters": {
@@ -11,5 +11,5 @@
    },
    "nullable": []
  },
-  "hash": "86ad1e7ebe659f97877cc142c09676488dc6c80428e13e5db3c016e37072cfe4"
+  "hash": "1c2157ce14e90f0751d7f0a9f2dbb3c5a5789a32423e75260098a5300a4af986"
 }
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "SELECT id, conversation_id, message_type as \"message_type: MessageType\", content, job_id, created_at, created_seq, step_name, success, tool_arguments, tool_result, reasoning, attachments\n             FROM flow_conversation_message\n             WHERE conversation_id = $1\n               AND created_seq > $2\n             ORDER BY created_seq ASC\n             LIMIT $3\n             ",
+  "query": "SELECT id, conversation_id, message_type as \"message_type: MessageType\", content, job_id, created_at, created_seq, step_name, success\n             FROM (\n                SELECT id, conversation_id, message_type, content, job_id, created_at, created_seq, step_name, success\n                FROM flow_conversation_message\n                WHERE conversation_id = $1\n                ORDER BY created_seq DESC\n                LIMIT $2 OFFSET $3\n             ) AS messages\n             ORDER BY created_seq ASC\n             ",
  "describe": {
    "columns": [
      {
@@ -58,26 +58,6 @@
        "ordinal": 8,
        "name": "success",
        "type_info": "Bool"
-      },
-      {
-        "ordinal": 9,
-        "name": "tool_arguments",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 10,
-        "name": "tool_result",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 11,
-        "name": "reasoning",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 12,
-        "name": "attachments",
-        "type_info": "Jsonb"
      }
    ],
    "parameters": {
@@ -96,12 +76,8 @@
      false,
      false,
      true,
-      false,
-      true,
-      true,
-      true,
-      true
+      false
    ]
  },
-  "hash": "d6fa78c43b6c5f8040d7bccb29ad8627be1dac6fbe0097735a52f47c173f51c9"
+  "hash": "1c3473a0f9f6b6148b2c975f9f05bdefedf8a51c4e6ddf0eca367b9cc778d051"
 }
@@ -1,12 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE workspace_settings\n              SET dbt_warehouses = '{\"main\": {\"resource_path\": \"u/test-user/wh\"}}'::jsonb\n            WHERE workspace_id = 'test-workspace'",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": []
-  },
-  "hash": "1d8effff5dd1e4a177efed7366e84411c125cbfada861992e3d6032de635bad6"
-}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Ruben FiszelandClaude Opus 5	8de64d4c4a	fix: leave JSON and other non-CommonJS module formats out of the //nodejs rewrite Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014bq66fSmaPvLtjnDPfMYcj	2026-08-21 10:36:35 +00:00
Ruben FiszelandClaude Opus 5	b0152ef9d8	fix: take an extensionless entry's format from its package scope Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014bq66fSmaPvLtjnDPfMYcj	2026-08-21 10:17:10 +00:00
Ruben FiszelandClaude Opus 5	35c6f2fda0	fix: fall back to bun resolution on a node without import.meta.resolve Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014bq66fSmaPvLtjnDPfMYcj	2026-08-21 09:17:19 +00:00
Ruben FiszelandClaude Opus 5	1b4083ffdb	fix: skip node builtins when classifying //nodejs interop targets Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014bq66fSmaPvLtjnDPfMYcj	2026-08-21 09:01:36 +00:00
Ruben FiszelandClaude Opus 5	1a150736e2	fix: classify //nodejs interop targets with node's resolver and merge namespace keys Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014bq66fSmaPvLtjnDPfMYcj	2026-08-21 08:58:12 +00:00
Ruben FiszelandClaude Opus 5	26102edd89	fix: fail fast on a missing export and keep import attributes in the //nodejs rewrite Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014bq66fSmaPvLtjnDPfMYcj	2026-08-21 08:52:35 +00:00
Ruben FiszelandClaude Opus 5	6fe1dfbbc2	fix: keep the //nodejs interop rewrite to CommonJS packages only Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014bq66fSmaPvLtjnDPfMYcj	2026-08-20 21:33:55 +00:00
Ruben FiszelandClaude Opus 5	0612abd21d	fix: make named and namespace npm imports work under //nodejs Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014bq66fSmaPvLtjnDPfMYcj	2026-08-20 21:21:20 +00:00