fix: fileset editor takes full height with matching header

Set fileset editor container to h-[60vh] so both navbar and editor
fill available space. Match editor filename bar height to navbar header.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.claude/hooks/resolve-symlinks.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+# Resolve _ee.rs symlinks to actual files so Claude can read them
+# This script runs before each user prompt is processed
+
+set -e
+
+PROJECT_DIR="${CLAUDE_PROJECT_DIR:-/home/farhad/windmill}"
+MANIFEST_FILE="$PROJECT_DIR/.claude/hooks/.symlink-manifest"
+
+# Find all _ee.rs symlinks and store their targets
+find "$PROJECT_DIR" -name "*_ee.rs" -type l 2>/dev/null | while read -r symlink; do
+    target=$(readlink -f "$symlink" 2>/dev/null) || continue
+
+    # Only process if target file exists
+    if [[ -f "$target" ]]; then
+        # Store symlink path and target in manifest
+        echo "$symlink|$target" >> "$MANIFEST_FILE.tmp"
+
+        # Replace symlink with actual file content
+        rm "$symlink"
+        cp "$target" "$symlink"
+    fi
+done
+
+# Atomically replace manifest
+if [[ -f "$MANIFEST_FILE.tmp" ]]; then
+    mv "$MANIFEST_FILE.tmp" "$MANIFEST_FILE"
+fi
+
+exit 0

.claude/hooks/restore-symlinks.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+# Restore _ee.rs symlinks after Claude finishes processing
+# This script runs when Claude stops
+# IMPORTANT: Copies any modifications back to the target before restoring symlinks
+
+set -e
+
+PROJECT_DIR="${CLAUDE_PROJECT_DIR:-/home/farhad/windmill}"
+MANIFEST_FILE="$PROJECT_DIR/.claude/hooks/.symlink-manifest"
+
+# Check if manifest exists
+if [[ ! -f "$MANIFEST_FILE" ]]; then
+    exit 0
+fi
+
+# Read manifest and restore symlinks
+while IFS='|' read -r symlink target; do
+    if [[ -n "$symlink" && -n "$target" ]]; then
+        # If the file exists (not a symlink) and target exists, copy changes back
+        if [[ -f "$symlink" && ! -L "$symlink" && -e "$target" ]]; then
+            # Copy the potentially modified file back to the target
+            cp "$symlink" "$target"
+        fi
+
+        # Remove the regular file (which was a copy)
+        rm -f "$symlink" 2>/dev/null || true
+
+        # Recreate the symlink
+        ln -s "$target" "$symlink" 2>/dev/null || true
+    fi
+done < "$MANIFEST_FILE"
+
+# Clean up manifest
+rm -f "$MANIFEST_FILE"
+
+exit 0

.claude/settings.json

@@ -1,8 +1,5 @@
 {
   "permissions": {
-    "additionalDirectories": [
-      "../windmill-ee-private"
-    ],
     "allow": [
       "Bash(ls:*)",
       "Bash(grep:*)",
@@ -66,6 +63,39 @@
   },
   "enableAllProjectMcpServers": true,
   "hooks": {
+    "UserPromptSubmit": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/resolve-symlinks.sh",
+            "timeout": 30
+          }
+        ]
+      }
+    ],
+    "Stop": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/restore-symlinks.sh",
+            "timeout": 30
+          }
+        ]
+      }
+    ],
+    "SessionEnd": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/restore-symlinks.sh",
+            "timeout": 30
+          }
+        ]
+      }
+    ],
     "PostToolUse": [
       {
         "matcher": "Edit|Write",

.claude/skills/svelte-frontend/SKILL.md

@@ -226,4 +226,93 @@ When generating Svelte 5 code, prioritize frontend performance by applying the f
       Hello
     </div>
     ```
-5.  **Stay Updated**: Keep Svelte and its related packages up to date to benefit from the latest features, performance improvements, and security fixes.
+5.  **Stay Updated**: Keep Svelte and its related packages up to date to benefit from the latest features, performance improvements, and security fixes.
+
+## Windmill UI Component Rules (MUST follow)
+
+Always use Windmill's own design-system components instead of raw HTML elements. Using raw HTML elements produces inconsistent styling and breaks the design language.
+
+### Icons — use `lucide-svelte`
+
+**Never** write inline SVGs. Import icons from `lucide-svelte`.
+
+```svelte
+<script>
+  import { ChevronLeft, ChevronRight, X } from 'lucide-svelte'
+</script>
+
+<ChevronLeft size={16} />
+```
+
+### Buttons — use `<Button>`
+
+**Never** use `<button>`. Import and use `Button` from `$lib/components/common`.
+
+```svelte
+<script>
+  import { Button } from '$lib/components/common'
+  import { ChevronLeft, ChevronRight } from 'lucide-svelte'
+</script>
+
+<!-- Regular button -->
+<Button variant="default" onclick={handleClick}>Label</Button>
+
+<!-- Icon-only button (no label) -->
+<Button startIcon={{ icon: ChevronLeft }} iconOnly onclick={prevMonth} />
+<Button startIcon={{ icon: ChevronRight }} iconOnly onclick={nextMonth} />
+```
+
+Key `Button` props:
+- `variant?: 'accent' | 'accent-secondary' | 'default' | 'subtle'`
+- `unifiedSize?: 'sm' | 'md' | 'lg'`
+- `startIcon?: { icon: SvelteComponent }` — renders an icon before the label
+- `iconOnly?: boolean` — renders icon with no surrounding label text
+- `disabled?: boolean`
+
+### Text inputs — use `<TextInput>`
+
+**Never** use `<input>`. Import and use `TextInput` from `$lib/components/common`.
+
+```svelte
+<script>
+  import { TextInput } from '$lib/components/common'
+  let val = $state('')
+</script>
+
+<TextInput bind:value={val} placeholder="Enter value" />
+```
+
+Key `TextInput` props:
+- `value?: string | number` (bindable)
+- `placeholder?: string`
+- `disabled?: boolean`
+- `error?: string | boolean`
+- `size?: 'sm' | 'md' | 'lg'`
+- `inputProps?` — forwarded to the underlying `<input>`
+
+### Selects — use `<Select>`
+
+**Never** use `<select>`. Import and use `Select` from `$lib/components/select/Select.svelte`.
+
+```svelte
+<script>
+  import Select from '$lib/components/select/Select.svelte'
+
+  const monthItems = [
+    { label: 'January', value: 1 },
+    { label: 'February', value: 2 },
+    // ...
+  ]
+  let selectedMonth = $state(1)
+</script>
+
+<Select items={monthItems} bind:value={selectedMonth} />
+```
+
+Key `Select` props:
+- `items?: Array<{ label?: string; value: any; subtitle?: string; disabled?: boolean }>`
+- `value` (bindable) — the currently selected `.value`
+- `placeholder?: string`
+- `clearable?: boolean`
+- `disabled?: boolean`
+- `size?: 'sm' | 'md' | 'lg'`

.gitignore

@@ -17,9 +17,6 @@ rust-client/Cargo.toml
 # Worktree-generated port isolation
 .env.local
 
-# Worktree-specific Claude Code settings (generated by scripts/worktree-env)
-.claude/settings.local.json
-
 # Symlinked cache directories (for git worktrees)
 backend/target
 frontend/node_modules

.mcp.json

@@ -3,12 +3,10 @@
     "svelte": {
       "type": "http",
       "url": "https://mcp.svelte.dev/mcp"
+    },
+    "playwright": {
+      "command": "npx",
+      "args": ["@playwright/mcp@latest"]
     }
-  },
-  "playwright": {
-    "command": "npx",
-    "args": [
-      "@playwright/mcp@latest"
-    ]
   }
 }

.workmux.yaml

@@ -46,20 +46,11 @@ pre_remove:
   - ./scripts/worktree-cleanup
 
 panes:
-  - command: >-
-      claude --append-system-prompt
-      "You are running inside a tmux session with other panes running services.\n
-      Pane layout (current window):\n
-      - Pane 0: this pane (claude agent)\n
-      - Pane 1: backend (cargo watch -x run)\n
-      - Pane 2: frontend (npm run dev)\n\n
-      To check logs, use: \`tmux capture-pane -t .1 -p -S -50\` (backend) or \`tmux capture-pane -t .2 -p -S -50\` (frontend).\n
-      When restarting backend or frontend, make sure to use the ports listed in .env.local.\n
-      Because we are running backend with cargo watch, to verify your changes, just check the logs in the backend pane. No need for cargo check."
+  - command: <agent>
     focus: true
   - command: 'ROOT="$(git rev-parse --show-toplevel)"; [ -f "$ROOT/.env.local" ] && source "$ROOT/.env.local"; cd "$ROOT/backend" && PORT=${BACKEND_PORT:-8000} cargo watch -x run'
     split: horizontal
-  - command: 'ROOT="$(git rev-parse --show-toplevel)"; [ -f "$ROOT/.env.local" ] && source "$ROOT/.env.local"; cd "$ROOT/frontend" && npm install && npm run generate-backend-client && REMOTE=${REMOTE:-http://localhost:${BACKEND_PORT:-8000}} npm run dev -- --port ${FRONTEND_PORT:-3000} --host 0.0.0.0'
+  - command: 'ROOT="$(git rev-parse --show-toplevel)"; [ -f "$ROOT/.env.local" ] && source "$ROOT/.env.local"; cd "$ROOT/frontend" && npm install && npm run generate-backend-client && REMOTE=${REMOTE:-http://localhost:${BACKEND_PORT:-8000}} npm run dev -- --port ${FRONTEND_PORT:-3000}'
     split: vertical
 
 files:
@@ -70,6 +61,3 @@ files:
 sandbox:
   enabled: false
   toolchain: off
-  # image, host_commands, and extra_mounts configured in global
-  # ~/.config/workmux/config.yaml — see README_WORKMUX_DEV.md for required
-  # extra_mounts (windmill-ee-private access in sandbox)

Dockerfile.sandbox

@@ -1,234 +0,0 @@
-FROM debian:bookworm-slim
-
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    curl \
-    ca-certificates \
-    git \
-    iptables \
-    gosu \
-    sudo \
-    unzip \
-    # Rust native build deps (for cargo check)
-    pkg-config \
-    cmake \
-    clang \
-    mold \
-    libtool \
-    libssl-dev \
-    libxml2-dev \
-    libxmlsec1-dev \
-    libxslt1-dev \
-    libffi-dev \
-    zlib1g-dev \
-    libcurl4-openssl-dev \
-    libclang-dev \
-    libkrb5-dev \
-    libsasl2-dev \
-    # PostgreSQL (for local DB during development)
-    postgresql \
-    postgresql-client \
-    # Node.js 22 (for npm run check / frontend dev)
-    && curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
-    && apt-get install -y --no-install-recommends nodejs \
-    && rm -rf /var/lib/apt/lists/* \
-    # Container runs as arbitrary UIDs (--user uid:gid). These three lines make
-    # sudo work for any UID:
-    # 1) NOPASSWD rule so sudo never prompts for a password
-    # 2) Writable passwd/group so the entrypoint can register the dynamic UID
-    # 3) Writable shadow so unix_chkpwd can validate the account (without this,
-    #    sudo fails with "account validation failure, is your account locked?")
-    && echo "ALL ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/sandbox \
-    && chmod 0440 /etc/sudoers.d/sandbox \
-    && chmod 666 /etc/passwd /etc/group /etc/shadow
-
-# ── GitHub CLI (for PR creation) ──────────────────────────────────────────────
-RUN curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
-        -o /usr/share/keyrings/githubcli-archive-keyring.gpg \
-    && echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
-        > /etc/apt/sources.list.d/github-cli.list \
-    && apt-get update && apt-get install -y --no-install-recommends gh \
-    && rm -rf /var/lib/apt/lists/*
-
-# ── Rust toolchain ────────────────────────────────────────────────────────────
-# Install under /usr/local/lib/ so bins are world-readable with default umask.
-# CARGO_HOME is overridden to /tmp/.cargo at the end for mutable runtime state.
-ENV RUSTUP_HOME=/usr/local/lib/rustup CARGO_HOME=/usr/local/lib/cargo
-RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | \
-    sh -s -- -y --default-toolchain stable --profile minimal && \
-    ln -s /usr/local/lib/cargo/bin/* /usr/local/bin/
-RUN cargo install sqlx-cli --no-default-features --features native-tls,postgres && \
-    cargo install cargo-watch && \
-    ln -sf /usr/local/lib/cargo/bin/sqlx /usr/local/bin/sqlx && \
-    ln -sf /usr/local/lib/cargo/bin/cargo-watch /usr/local/bin/cargo-watch
-
-# ── Register dynamic runtime users ───────────────────────────────────────────
-RUN cat <<'SCRIPT' > /usr/local/bin/register-dynamic-user.sh
-#!/bin/sh
-set -eu
-
-uid="${1:-}"
-gid="${2:-}"
-
-if [ -z "$uid" ] || [ -z "$gid" ]; then
-    echo "register-dynamic-user: usage: register-dynamic-user <uid> <gid>" >&2
-    exit 1
-fi
-
-if ! getent group "$gid" >/dev/null 2>&1; then
-    echo "sandbox:x:${gid}:" >> /etc/group
-fi
-
-if ! getent passwd "$uid" >/dev/null 2>&1; then
-    echo "sandbox:x:${uid}:${gid}:sandbox:/tmp:/bin/sh" >> /etc/passwd
-fi
-
-# Add a shadow entry ("*" = no password) so unix_chkpwd doesn't reject sudo.
-if ! grep -q "^sandbox:" /etc/shadow 2>/dev/null; then
-    echo "sandbox:*:19000:0:99999:7:::" >> /etc/shadow
-fi
-SCRIPT
-RUN chmod +x /usr/local/bin/register-dynamic-user.sh
-
-# ── Network init script (iptables firewall + privilege drop) ──────────────────
-RUN cat <<'SCRIPT' > /usr/local/bin/network-init.sh
-#!/bin/bash
-set -euo pipefail
-
-if [ -n "${WM_PROXY_HOST:-}" ] && [ -n "${WM_PROXY_PORT:-}" ]; then
-    # Resolve hostnames to ALL IPs (multi-A records, round-robin DNS)
-    PROXY_IPS=$(getent ahostsv4 "$WM_PROXY_HOST" | awk '{print $1}' | sort -u)
-    RPC_HOST="${WM_RPC_HOST:-$WM_PROXY_HOST}"
-    RPC_IPS=$(getent ahostsv4 "$RPC_HOST" | awk '{print $1}' | sort -u)
-
-    if [ -z "$PROXY_IPS" ] || [ -z "$RPC_IPS" ]; then
-        echo "network-init: failed to resolve proxy/RPC host" >&2
-        exit 1
-    fi
-
-    # IPv4: default deny outbound
-    iptables -P OUTPUT DROP
-    iptables -A OUTPUT -o lo -j ACCEPT
-    iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-
-    # Allow DNS (UDP/TCP 53) to configured nameservers.
-    if [ -f /etc/resolv.conf ]; then
-        grep '^nameserver' /etc/resolv.conf | awk '{print $2}' | while read -r ns; do
-            iptables -A OUTPUT -d "$ns" -p udp --dport 53 -j ACCEPT
-            iptables -A OUTPUT -d "$ns" -p tcp --dport 53 -j ACCEPT
-        done
-    fi
-
-    # Allow ALL resolved proxy IPs (handles multi-A DNS)
-    for ip in $PROXY_IPS; do
-        iptables -A OUTPUT -d "$ip" -p tcp --dport "$WM_PROXY_PORT" -j ACCEPT
-    done
-
-    # Allow ALL resolved RPC IPs
-    if [ -n "${WM_RPC_PORT:-}" ]; then
-        for ip in $RPC_IPS; do
-            iptables -A OUTPUT -d "$ip" -p tcp --dport "$WM_RPC_PORT" -j ACCEPT
-        done
-    fi
-
-    # Reject (not drop) everything else to fail fast instead of hanging
-    iptables -A OUTPUT -j REJECT
-
-    # IPv6: block entirely to prevent leaks (fail closed)
-    if ip6tables -L -n >/dev/null 2>&1; then
-        ip6tables -P OUTPUT DROP
-        ip6tables -A OUTPUT -o lo -j ACCEPT
-        ip6tables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-        ip6tables -A OUTPUT -j REJECT
-    else
-        if ! sysctl -w net.ipv6.conf.all.disable_ipv6=1 2>/dev/null; then
-            echo "network-init: failed to block IPv6 (neither ip6tables nor sysctl available)" >&2
-            exit 1
-        fi
-    fi
-fi
-
-# Add sandbox user/group so sudo works after dropping privileges.
-if [ -z "${WM_TARGET_UID:-}" ] || [ -z "${WM_TARGET_GID:-}" ]; then
-    echo "network-init: WM_TARGET_UID and WM_TARGET_GID are required" >&2
-    exit 1
-fi
-/usr/local/bin/register-dynamic-user.sh "${WM_TARGET_UID}" "${WM_TARGET_GID}"
-
-# Fix PTY ownership so the unprivileged user can read/write the terminal.
-if [ -t 0 ]; then
-    chown "${WM_TARGET_UID}:${WM_TARGET_GID}" "$(tty)"
-fi
-
-# Drop privileges and exec the user command.
-exec gosu "${WM_TARGET_UID}:${WM_TARGET_GID}" env HOME=/tmp "$@"
-SCRIPT
-RUN chmod +x /usr/local/bin/network-init.sh
-
-# ── workmux (sandbox RPC) ────────────────────────────────────────────────────
-RUN curl -fsSL https://raw.githubusercontent.com/raine/workmux/main/scripts/install.sh | bash
-
-# ── Claude Code ───────────────────────────────────────────────────────────────
-RUN curl -fsSL https://claude.ai/install.sh | bash && \
-    target="$(readlink -f /root/.local/bin/claude)" && \
-    mv /root/.local/share/claude /usr/local/lib/claude && \
-    ln -s "/usr/local/lib/claude/versions/$(basename "$target")" /usr/local/bin/claude && \
-    mkdir -p /tmp/.local/bin && \
-    ln -s /usr/local/bin/claude /tmp/.local/bin/claude
-
-# ── Codex ─────────────────────────────────────────────────────────────────────
-RUN npm i -g @openai/codex
-
-# ── Bun ───────────────────────────────────────────────────────────────────────
-ENV BUN_INSTALL=/usr/local/lib/bun
-RUN curl -fsSL https://bun.sh/install | bash && \
-    ln -s /usr/local/lib/bun/bin/bun /usr/local/bin/bun && \
-    ln -s /usr/local/lib/bun/bin/bunx /usr/local/bin/bunx
-
-# ── Playwright + Chromium (for screenshots) ──────────────────────────────────
-ENV PLAYWRIGHT_BROWSERS_PATH=/usr/local/lib/playwright-browsers
-RUN bun add -g @playwright/test \
-    && bunx playwright install chromium --with-deps \
-    && chmod -R a+rwX /usr/local/lib/playwright-browsers \
-    && rm -rf /var/lib/apt/lists/* /tmp/bunx-*
-
-# ── AWS CLI (for S3-compatible uploads to R2) ─────────────────────────────────
-RUN curl -fsSL "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o /tmp/awscliv2.zip \
-    && unzip -q /tmp/awscliv2.zip -d /tmp \
-    && /tmp/aws/install \
-    && rm -rf /tmp/aws /tmp/awscliv2.zip
-
-ENV AWS_DEFAULT_REGION=auto
-
-# ── Runtime env for arbitrary UID ─────────────────────────────────────────────
-# Mutable state goes to /tmp (writable by any UID). Toolchains stay read-only.
-ENV CARGO_HOME=/tmp/.cargo BUN_TMPDIR=/tmp
-
-# ── Entrypoint ────────────────────────────────────────────────────────────────
-RUN cat <<'ENTRY' > /usr/local/bin/entrypoint.sh
-#!/bin/sh
-/usr/local/bin/register-dynamic-user.sh "$(id -u)" "$(id -g)"
-
-# Start PostgreSQL (unix socket in /tmp, owned by postgres user)
-mkdir -p /tmp/pgdata && sudo chown postgres:postgres /tmp/pgdata
-if [ ! -f /tmp/pgdata/PG_VERSION ]; then
-    sudo -u postgres /usr/lib/postgresql/15/bin/initdb -D /tmp/pgdata --auth=trust
-fi
-sudo -u postgres /usr/lib/postgresql/15/bin/pg_ctl -D /tmp/pgdata -l /tmp/pg.log start -o "-k /tmp"
-sudo -u postgres psql -h /tmp -c "CREATE ROLE sandbox SUPERUSER LOGIN" 2>/dev/null || true
-sudo -u postgres createdb -h /tmp windmill 2>/dev/null || true
-
-# Run database migrations so sqlx compile-time checks work
-if [ -d "$PWD/backend/migrations" ]; then
-    DATABASE_URL="postgres://sandbox@localhost/windmill?host=/tmp" \
-        sqlx migrate run --source "$PWD/backend/migrations" 2>/dev/null || true
-fi
-
-# Install frontend dependencies and generate backend client
-if [ -d "$PWD/frontend" ]; then
-    (cd "$PWD/frontend" && npm install && npm run generate-backend-client) 2>/dev/null || true
-fi
-
-exec "$@"
-ENTRY
-RUN chmod +x /usr/local/bin/entrypoint.sh
-ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]

README_WORKMUX_DEV.md

@@ -172,24 +172,60 @@ The setup is defined in `.workmux.yaml` at the repo root. Key sections:
 - **`files.copy`**: Copies `backend/.env` and `scripts/` into each worktree
 - **`files.symlink`**: Symlinks `node_modules` and `.svelte-kit` to avoid reinstalling per worktree
 
-## Enterprise (EE) Code Access
+## Cursor SSH Integration (`wmc`)
 
-The enterprise source code lives in the `windmill-ee-private` repository (sibling to this repo). When you create a worktree, `scripts/worktree-env` automatically creates a matching EE worktree on the same branch and configures Claude Code's `additionalDirectories` to grant access.
+`wm-cursor` (aliased as `wmc`) gives each worktree its own Cursor SSH remote window with an independently-focused tmux session. All windows are visible in the status bar across all Cursor terminals, but each one is focused on its own worktree.
 
-### Sandbox setup
+This uses **grouped tmux sessions** — multiple sessions that share the same window list but track focus independently:
 
-When using sandbox mode, the container needs explicit mounts to access the EE repo. Add the following to your global workmux config (`~/.config/workmux/config.yaml`):
-
-```yaml
-sandbox:
-  extra_mounts:
-    - host_path: ~/windmill-ee-private
-      writable: true
-    - host_path: ~/windmill-ee-private__worktrees
-      writable: true
+```
+tmux session: main          <-- your main Cursor terminal
+tmux session: cursor-feat-a <-- Cursor window for feat-a (focused on wm-feat-a)
+tmux session: cursor-feat-b <-- Cursor window for feat-b (focused on wm-feat-b)
+    \__ all three share the same windows in the status bar
 ```
 
-This mounts both the main EE repo (used by the main worktree) and the EE worktrees directory (used by feature worktrees) into every sandbox container.
+### Setup
+
+Run once from inside tmux on the remote:
+
+```bash
+./scripts/wm-cursor setup /home/hugo/projects/windmill
+```
+
+This:
+
+1. **Merges `.vscode/settings.json`** — adds the `wm-tmux` terminal profile (auto-attaches to the `main` tmux session), disables auto port forwarding, configures forwarding for ports 8000/3000/5432, and stops rust-analyzer from auto-starting. Existing settings are preserved.
+2. **Creates `.vscode/tasks.json`** — auto-starts the dev database (`start-dev-db.sh`) when the folder opens.
+3. **Adds `wmc` alias to `~/.zshrc`** — so you can use `wmc` from any tmux window.
+
+After setup, reopen Cursor's terminal to pick up the new profile.
+
+### Usage
+
+All commands run from inside a tmux session (i.e., from Cursor's integrated terminal after setup).
+
+**Create a new worktree + open Cursor:**
+
+```bash
+wmc add -A -p "implement feature X"
+```
+
+This runs `workmux add`, creates a grouped tmux session, writes `.vscode/settings.json` in the worktree (with port forwarding matching the worktree's assigned ports), and opens a new Cursor window.
+
+**Open Cursor for an existing worktree:**
+
+```bash
+wmc open my-feature
+```
+
+**Close a worktree's Cursor window and tmux window (keeps the worktree):**
+
+```bash
+wmc close my-feature
+```
+
+This kills the grouped tmux session and calls `workmux close` to close the tmux window. The worktree and branch are preserved. Grouped sessions are also automatically cleaned up when you `workmux rm` a worktree (via `scripts/worktree-cleanup`).
 
 ## Login
 

backend/.sqlx/query-03d63d2e64b012f624d2731b5bcb8849c74a9474777be61edf0ed43ddda07ef3.json

@@ -37,6 +37,11 @@
         "ordinal": 6,
         "name": "format_extension",
         "type_info": "Varchar"
+      },
+      {
+        "ordinal": 7,
+        "name": "is_fileset",
+        "type_info": "Bool"
       }
     ],
     "parameters": {
@@ -52,7 +57,8 @@
       true,
       true,
       true,
-      true
+      true,
+      false
     ]
   },
   "hash": "03d63d2e64b012f624d2731b5bcb8849c74a9474777be61edf0ed43ddda07ef3"

backend/.sqlx/query-14276a040cb4db88d71fccdc3579e8c0bb132b70668301b535872d1632753e30.json

@@ -43,8 +43,7 @@
                 "aiagent",
                 "unassigned_script",
                 "unassigned_flow",
-                "unassigned_singlestepflow",
-                "snapshotbuild"
+                "unassigned_singlestepflow"
               ]
             }
           }

backend/.sqlx/query-1c2157ce14e90f0751d7f0a9f2dbb3c5a5789a32423e75260098a5300a4af986.json

@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO resource_type (workspace_id, name, schema, description, edited_at, created_by, format_extension, is_fileset)\n         SELECT $2, name, schema, description, edited_at, created_by, format_extension, is_fileset\n         FROM resource_type\n         WHERE workspace_id = $1",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Varchar"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "1c2157ce14e90f0751d7f0a9f2dbb3c5a5789a32423e75260098a5300a4af986"
+}

backend/.sqlx/query-2768622b76ad92c05f4f44d997aff285707e1a43ce85e5bb8e87849d78a0637f.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT schema, description, format_extension\n         FROM resource_type\n         WHERE workspace_id = $1 AND name = $2",
+  "query": "SELECT schema, description, format_extension, is_fileset\n         FROM resource_type\n         WHERE workspace_id = $1 AND name = $2",
   "describe": {
     "columns": [
       {
@@ -17,6 +17,11 @@
         "ordinal": 2,
         "name": "format_extension",
         "type_info": "Varchar"
+      },
+      {
+        "ordinal": 3,
+        "name": "is_fileset",
+        "type_info": "Bool"
       }
     ],
     "parameters": {
@@ -28,8 +33,9 @@
     "nullable": [
       true,
       true,
-      true
+      true,
+      false
     ]
   },
-  "hash": "7bc9fc05dbd162866bef1fdd3e7faeb50429881ed1bc962903f06e4b3d5f8d44"
+  "hash": "2768622b76ad92c05f4f44d997aff285707e1a43ce85e5bb8e87849d78a0637f"
 }

backend/.sqlx/query-48a41e1ad0ad8fc51624af4de34964c72fe4b3cf2497644d514c5c00d6d71bf3.json

@@ -42,8 +42,7 @@
                 "aiagent",
                 "unassigned_script",
                 "unassigned_flow",
-                "unassigned_singlestepflow",
-                "snapshotbuild"
+                "unassigned_singlestepflow"
               ]
             }
           }

backend/.sqlx/query-50f81c128d644c60837e603099e169fbc7a500c11e79d2c78d6eccccf6491aec.json

@@ -38,8 +38,7 @@
                 "aiagent",
                 "unassigned_script",
                 "unassigned_flow",
-                "unassigned_singlestepflow",
-                "snapshotbuild"
+                "unassigned_singlestepflow"
               ]
             }
           }

backend/.sqlx/query-5899c7614f195fdd23e38389e52b004f957aafa2201b80638b5f87a625373f00.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "INSERT INTO resource_type\n            (workspace_id, name, schema, description, created_by, format_extension, edited_at)\n            VALUES ($1, $2, $3, $4, $5, $6, now())",
+  "query": "INSERT INTO resource_type\n            (workspace_id, name, schema, description, created_by, format_extension, is_fileset, edited_at)\n            VALUES ($1, $2, $3, $4, $5, $6, $7, now())",
   "describe": {
     "columns": [],
     "parameters": {
@@ -10,10 +10,11 @@
         "Jsonb",
         "Text",
         "Varchar",
-        "Varchar"
+        "Varchar",
+        "Bool"
       ]
     },
     "nullable": []
   },
-  "hash": "ffedbb3a2676a6d7b71f81f89109a02a8dba90d40144e942527f8a3fc36dfbc1"
+  "hash": "5899c7614f195fdd23e38389e52b004f957aafa2201b80638b5f87a625373f00"
 }

backend/.sqlx/query-5bf200f2c8db25ddf231b564503c6c70f7f3958564a79bb0c6b3863b1ebb0cbf.json

@@ -77,8 +77,7 @@
                 "aiagent",
                 "unassigned_script",
                 "unassigned_flow",
-                "unassigned_singlestepflow",
-                "snapshotbuild"
+                "unassigned_singlestepflow"
               ]
             }
           }

backend/.sqlx/query-61b37cb4db6e60c2d35f7d23db5afbe04e040a8dcd1d93afaaaa320665c8779a.json

@@ -1,16 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n            WITH prev_sd AS (\n                DELETE FROM debounce_stale_data WHERE job_id = $1 RETURNING to_relock\n            ) INSERT INTO debounce_stale_data (job_id, to_relock)\n                VALUES ($2, array_cat((SELECT to_relock FROM prev_sd), $3))\n                ON CONFLICT (job_id) DO UPDATE SET to_relock = EXCLUDED.to_relock\n            ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Uuid",
-        "Uuid",
-        "TextArray"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "61b37cb4db6e60c2d35f7d23db5afbe04e040a8dcd1d93afaaaa320665c8779a"
-}

backend/.sqlx/query-7aaa5b0bd873c2029e2201d287ea0aaae04678ac105374bbe387e534a6cb6333.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT runnable_id as \"runnable_id: ScriptHash\", raw_flow as \"raw_flow: _\", kind as \"kind: _\" FROM v2_job WHERE id = $1",
+  "query": "SELECT runnable_id as \"runnable_id: ScriptHash\", raw_flow as \"raw_flow: _\", kind as \"kind: _\", parent_job, flow_step_id FROM v2_job WHERE id = $1",
   "describe": {
     "columns": [
       {
@@ -42,12 +42,21 @@
                 "aiagent",
                 "unassigned_script",
                 "unassigned_flow",
-                "unassigned_singlestepflow",
-                "snapshotbuild"
+                "unassigned_singlestepflow"
               ]
             }
           }
         }
+      },
+      {
+        "ordinal": 3,
+        "name": "parent_job",
+        "type_info": "Uuid"
+      },
+      {
+        "ordinal": 4,
+        "name": "flow_step_id",
+        "type_info": "Varchar"
       }
     ],
     "parameters": {
@@ -58,8 +67,10 @@
     "nullable": [
       true,
       true,
-      false
+      false,
+      true,
+      true
     ]
   },
-  "hash": "805d633de90fee335f1726284eda0dbc200d45960fb8dea867492c8c7dd096d5"
+  "hash": "7aaa5b0bd873c2029e2201d287ea0aaae04678ac105374bbe387e534a6cb6333"
 }

backend/.sqlx/query-7abd579d3ec97853ac36cc8dad29013eb133a28cd848bf8fdf9571b2ee402a3e.json

@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO resource_type (workspace_id, name, schema, description, edited_at, created_by, format_extension)\n         SELECT $2, name, schema, description, edited_at, created_by, format_extension\n         FROM resource_type\n         WHERE workspace_id = $1",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Varchar"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "7abd579d3ec97853ac36cc8dad29013eb133a28cd848bf8fdf9571b2ee402a3e"
-}

backend/.sqlx/query-7b1239ad6460e8f5fb41bfe12f662a779528784ec8cf3f6dcce5545ab90bf234.json

@@ -37,6 +37,11 @@
         "ordinal": 6,
         "name": "format_extension",
         "type_info": "Varchar"
+      },
+      {
+        "ordinal": 7,
+        "name": "is_fileset",
+        "type_info": "Bool"
       }
     ],
     "parameters": {
@@ -51,7 +56,8 @@
       true,
       true,
       true,
-      true
+      true,
+      false
     ]
   },
   "hash": "7b1239ad6460e8f5fb41bfe12f662a779528784ec8cf3f6dcce5545ab90bf234"

backend/.sqlx/query-7bb8ff3426ec73672fb572cd1ce36f495a84e0ad7d60fd39eddcccbc129d43c8.json

@@ -44,8 +44,7 @@
                 "aiagent",
                 "unassigned_script",
                 "unassigned_flow",
-                "unassigned_singlestepflow",
-                "snapshotbuild"
+                "unassigned_singlestepflow"
               ]
             }
           }

backend/.sqlx/query-842775bcf91d747abb11ffe9c98fa1208595e012590606ef6667ea3a78105883.json

@@ -0,0 +1,34 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        SELECT name, format_extension, is_fileset FROM resource_type WHERE (format_extension IS NOT NULL OR is_fileset = true) AND (workspace_id = $1 OR workspace_id = 'admins')",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "name",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "format_extension",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "is_fileset",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      true,
+      false
+    ]
+  },
+  "hash": "842775bcf91d747abb11ffe9c98fa1208595e012590606ef6667ea3a78105883"
+}

backend/.sqlx/query-8d444380516faf56369cdbff645904e20477aa597e30891926af42eee56ab081.json

@@ -102,8 +102,7 @@
                 "aiagent",
                 "unassigned_script",
                 "unassigned_flow",
-                "unassigned_singlestepflow",
-                "snapshotbuild"
+                "unassigned_singlestepflow"
               ]
             }
           }

backend/.sqlx/query-92c7c961198e506426bf3f97a8ddbb34af450041c675b30b708fed3ef9e01d2d.json

@@ -32,8 +32,7 @@
                 "aiagent",
                 "unassigned_script",
                 "unassigned_flow",
-                "unassigned_singlestepflow",
-                "snapshotbuild"
+                "unassigned_singlestepflow"
               ]
             }
           }

backend/.sqlx/query-a1745a4f525b251d2f5a602ab2b2ede46b4471e21b11f607573a844013911abe.json

@@ -72,8 +72,7 @@
                 "aiagent",
                 "unassigned_script",
                 "unassigned_flow",
-                "unassigned_singlestepflow",
-                "snapshotbuild"
+                "unassigned_singlestepflow"
               ]
             }
           }

backend/.sqlx/query-a4b6371d33206010b2f3ffd2b09e33244fe8ab9a803248fc23f334034d24aad4.json

@@ -77,8 +77,7 @@
                 "aiagent",
                 "unassigned_script",
                 "unassigned_flow",
-                "unassigned_singlestepflow",
-                "snapshotbuild"
+                "unassigned_singlestepflow"
               ]
             }
           }

backend/.sqlx/query-b23784ed2737c01aaf05efe42bcdcfc9579aa203005ead60322fb71fd33b15b0.json

@@ -102,8 +102,7 @@
                 "aiagent",
                 "unassigned_script",
                 "unassigned_flow",
-                "unassigned_singlestepflow",
-                "snapshotbuild"
+                "unassigned_singlestepflow"
               ]
             }
           }

backend/.sqlx/query-b3771b690c5966272b1f42c9965bb6a8f961c119516e4c33dc928cd3b4f4edbc.json

@@ -72,8 +72,7 @@
                 "aiagent",
                 "unassigned_script",
                 "unassigned_flow",
-                "unassigned_singlestepflow",
-                "snapshotbuild"
+                "unassigned_singlestepflow"
               ]
             }
           }

backend/.sqlx/query-b8d392ccfcccafe0c19511b3567bc11779b1052b0948c410468a8aeba1d26d33.json

@@ -37,6 +37,11 @@
         "ordinal": 6,
         "name": "format_extension",
         "type_info": "Varchar"
+      },
+      {
+        "ordinal": 7,
+        "name": "is_fileset",
+        "type_info": "Bool"
       }
     ],
     "parameters": {
@@ -51,7 +56,8 @@
       true,
       true,
       true,
-      true
+      true,
+      false
     ]
   },
   "hash": "b8d392ccfcccafe0c19511b3567bc11779b1052b0948c410468a8aeba1d26d33"

backend/.sqlx/query-be6d2c92a62b7b284651c45af809746147aa9b8d0a81642a7b7cb4738a0cad66.json

@@ -41,8 +41,7 @@
                 "aiagent",
                 "unassigned_script",
                 "unassigned_flow",
-                "unassigned_singlestepflow",
-                "snapshotbuild"
+                "unassigned_singlestepflow"
               ]
             }
           }

backend/.sqlx/query-cf1cef7e0fe2e7e3db96b0ec005360361b9eec023a6fc2a4a7a917f59d86af4d.json

@@ -1,28 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        SELECT name, format_extension FROM resource_type WHERE format_extension IS NOT NULL AND (workspace_id = $1 OR workspace_id = 'admins')",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "name",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 1,
-        "name": "format_extension",
-        "type_info": "Varchar"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      false,
-      true
-    ]
-  },
-  "hash": "cf1cef7e0fe2e7e3db96b0ec005360361b9eec023a6fc2a4a7a917f59d86af4d"
-}

backend/.sqlx/query-d41ea93fd58381b89e151c965eae1ea2fe96a1b94f5a92953fb1c1642d15c016.json

@@ -41,8 +41,7 @@
                 "aiagent",
                 "unassigned_script",
                 "unassigned_flow",
-                "unassigned_singlestepflow",
-                "snapshotbuild"
+                "unassigned_singlestepflow"
               ]
             }
           }

backend/.sqlx/query-e1f10f940d7ba6b1652e3d6505e12b16394f9632fd535febb008ebfe9fe0b7c8.json

@@ -31,8 +31,7 @@
                 "aiagent",
                 "unassigned_script",
                 "unassigned_flow",
-                "unassigned_singlestepflow",
-                "snapshotbuild"
+                "unassigned_singlestepflow"
               ]
             }
           }

backend/.sqlx/query-e2905bca184696a80357d8e4126832a902b3088d91fbbb858f6c0aa9de8a5ff7.json

@@ -37,8 +37,7 @@
                 "aiagent",
                 "unassigned_script",
                 "unassigned_flow",
-                "unassigned_singlestepflow",
-                "snapshotbuild"
+                "unassigned_singlestepflow"
               ]
             }
           }

backend/.sqlx/query-e4d71278fb80126a7a9da73f1889352d4d1e3cb3a8a08f1c9c03055a1cab1235.json

@@ -77,8 +77,7 @@
                 "aiagent",
                 "unassigned_script",
                 "unassigned_flow",
-                "unassigned_singlestepflow",
-                "snapshotbuild"
+                "unassigned_singlestepflow"
               ]
             }
           }

backend/.sqlx/query-eb1f7f01461f5a7540c273b37e5d578c31cf151ab3ef813f7aada76533761e12.json

@@ -37,6 +37,11 @@
         "ordinal": 6,
         "name": "format_extension",
         "type_info": "Varchar"
+      },
+      {
+        "ordinal": 7,
+        "name": "is_fileset",
+        "type_info": "Bool"
       }
     ],
     "parameters": {
@@ -49,7 +54,8 @@
       true,
       true,
       true,
-      true
+      true,
+      false
     ]
   },
   "hash": "eb1f7f01461f5a7540c273b37e5d578c31cf151ab3ef813f7aada76533761e12"

backend/.sqlx/query-fbd38c9c4f4ecba2d3e3d79433327fd4280466eec443aff4f1e8c1ab810cca7e.json

@@ -32,8 +32,7 @@
                 "aiagent",
                 "unassigned_script",
                 "unassigned_flow",
-                "unassigned_singlestepflow",
-                "snapshotbuild"
+                "unassigned_singlestepflow"
               ]
             }
           }

backend/migrations/20260223000000_resource_type_is_fileset.down.sql

@@ -0,0 +1 @@
+ALTER TABLE resource_type DROP COLUMN is_fileset;

backend/migrations/20260223000000_resource_type_is_fileset.up.sql

@@ -0,0 +1 @@
+ALTER TABLE resource_type ADD COLUMN is_fileset BOOLEAN NOT NULL DEFAULT FALSE;

backend/summarized_schema.txt

@@ -137,7 +137,7 @@ raw_app: path(char), version(int), workspace_id(char), summary(char), edited_at(
   FK: (workspace_id) -> workspace(id)
 resource: workspace_id(char), path(char), value(jsonb), description(text), resource_type(char), extra_perms(jsonb), edited_at(ts), created_by(char)
   FK: (workspace_id) -> workspace(id)
-resource_type: workspace_id(char), name(char), schema(jsonb), description(text), edited_at(ts), created_by(char), format_extension(char)
+resource_type: workspace_id(char), name(char), schema(jsonb), description(text), edited_at(ts), created_by(char), format_extension(char), is_fileset(bool)
   FK: (workspace_id) -> workspace(id)
 resume_job: id(uuid), job(uuid), flow(uuid), created_at(ts), value(jsonb), approver(char), resume_id(int), approved(bool)
   FK: (flow) -> v2_job_queue(id)

backend/windmill-api-assets/src/lib.rs

@@ -27,9 +27,13 @@ struct ListAssetsQuery {
     per_page: i64,
     cursor_created_at: Option<chrono::DateTime<chrono::Utc>>,
     cursor_id: Option<i64>,
-    asset_path: Option<String>,
-    usage_path: Option<String>,
-    asset_kinds: Option<String>,
+    pub asset_path: Option<String>,
+    pub usage_path: Option<String>,
+    pub asset_kinds: Option<String>,
+    // Exact path match filter
+    pub path: Option<String>,
+    // Filter by matching a subset of the columns using base64 encoded json subset
+    pub columns: Option<String>,
 }
 
 fn default_per_page() -> i64 {
@@ -75,12 +79,24 @@ async fn list_assets(
 
     let mut param_count = 2; // $1 = workspace_id, $2 = limit
 
-    // Asset path filter
+    // Asset path filter (ILIKE pattern match)
     if query.asset_path.is_some() {
         param_count += 1;
         asset_summary_filters.push(format!("asset.path ILIKE ${}", param_count));
     }
 
+    // Exact path filter
+    if query.path.is_some() {
+        param_count += 1;
+        asset_summary_filters.push(format!("asset.path = ${}", param_count));
+    }
+
+    // Columns filter (check if JSONB has all specified keys)
+    if query.columns.is_some() {
+        param_count += 1;
+        asset_summary_filters.push(format!("asset.columns ?& ${}", param_count));
+    }
+
     // Usage path filter - for jobs, also check runnable_path
     let needs_job_join_in_cte = query.usage_path.is_some();
     if query.usage_path.is_some() {
@@ -211,6 +227,20 @@ async fn list_assets(
         query_builder = query_builder.bind(format!("%{}%", asset_path));
     }
 
+    if let Some(ref path) = query.path {
+        query_builder = query_builder.bind(path);
+    }
+
+    if let Some(ref columns) = query.columns {
+        // Columns is a comma-separated string, split into array for ?& operator
+        let columns_array: Vec<String> = columns
+            .split(',')
+            .map(|s| s.trim().to_string())
+            .filter(|s| !s.is_empty())
+            .collect();
+        query_builder = query_builder.bind(columns_array);
+    }
+
     if let Some(ref usage_path) = query.usage_path {
         query_builder = query_builder.bind(format!("%{}%", usage_path));
     }

backend/windmill-api-integration-tests/tests/fixtures/resources_test.sql

@@ -54,6 +54,21 @@ INSERT INTO resource (workspace_id, path, value, description, resource_type, ext
 VALUES ('test-workspace', 'u/test-user/scalar_var_resource', '"$var:u/test-user/db_password"',
         'Scalar var ref', 'string', '{}', 'test-user');
 
+-- === fileset resource type test data ===
+
+INSERT INTO resource_type (workspace_id, name, schema, description, created_by, is_fileset)
+VALUES ('test-workspace', 'test_fileset', '{}',
+        'Test fileset type', 'test-user', true);
+
+INSERT INTO resource_type (workspace_id, name, schema, description, created_by, format_extension)
+VALUES ('test-workspace', 'test_file', '{"type": "object", "properties": {"content": {"type": "string"}}}',
+        'Test file type', 'test-user', 'txt');
+
+INSERT INTO resource (workspace_id, path, value, description, resource_type, extra_perms, created_by)
+VALUES ('test-workspace', 'u/test-user/fileset_resource',
+        '{"config.yaml": "key: value", "data/input.json": "{\"items\": []}"}',
+        'A fileset resource', 'test_fileset', '{}', 'test-user');
+
 -- === mcp_tools test data ===
 
 INSERT INTO resource (workspace_id, path, value, description, resource_type, extra_perms, created_by)

backend/windmill-api-integration-tests/tests/resources.rs

@@ -69,8 +69,12 @@ async fn test_resource_endpoints(db: Pool<Postgres>) -> anyhow::Result<()> {
     assert_eq!(resp.status(), 404);
 
     // --- get_value_interpolated ---
-    let resp =
-        authed_get(port, "get_value_interpolated", "u/test-user/simple_resource").await;
+    let resp = authed_get(
+        port,
+        "get_value_interpolated",
+        "u/test-user/simple_resource",
+    )
+    .await;
     assert_eq!(resp.status(), 200);
     assert_eq!(
         resp.json::<serde_json::Value>().await?,
@@ -78,8 +82,12 @@ async fn test_resource_endpoints(db: Pool<Postgres>) -> anyhow::Result<()> {
     );
 
     // $var: interpolation
-    let resp =
-        authed_get(port, "get_value_interpolated", "u/test-user/resource_with_var").await;
+    let resp = authed_get(
+        port,
+        "get_value_interpolated",
+        "u/test-user/resource_with_var",
+    )
+    .await;
     assert_eq!(resp.status(), 200);
     assert_eq!(
         resp.json::<serde_json::Value>().await?,
@@ -87,8 +95,12 @@ async fn test_resource_endpoints(db: Pool<Postgres>) -> anyhow::Result<()> {
     );
 
     // $res: interpolation
-    let resp =
-        authed_get(port, "get_value_interpolated", "u/test-user/resource_with_res").await;
+    let resp = authed_get(
+        port,
+        "get_value_interpolated",
+        "u/test-user/resource_with_res",
+    )
+    .await;
     assert_eq!(resp.status(), 200);
     assert_eq!(
         resp.json::<serde_json::Value>().await?,
@@ -96,8 +108,7 @@ async fn test_resource_endpoints(db: Pool<Postgres>) -> anyhow::Result<()> {
     );
 
     // mixed $var: and $res: refs
-    let resp =
-        authed_get(port, "get_value_interpolated", "u/test-user/resource_mixed").await;
+    let resp = authed_get(port, "get_value_interpolated", "u/test-user/resource_mixed").await;
     assert_eq!(resp.status(), 200);
     assert_eq!(
         resp.json::<serde_json::Value>().await?,
@@ -105,8 +116,12 @@ async fn test_resource_endpoints(db: Pool<Postgres>) -> anyhow::Result<()> {
     );
 
     // chained $res: -> $var:
-    let resp =
-        authed_get(port, "get_value_interpolated", "u/test-user/chained_resource").await;
+    let resp = authed_get(
+        port,
+        "get_value_interpolated",
+        "u/test-user/chained_resource",
+    )
+    .await;
     assert_eq!(resp.status(), 200);
     assert_eq!(
         resp.json::<serde_json::Value>().await?,
@@ -114,8 +129,7 @@ async fn test_resource_endpoints(db: Pool<Postgres>) -> anyhow::Result<()> {
     );
 
     // null value
-    let resp =
-        authed_get(port, "get_value_interpolated", "u/test-user/null_resource").await;
+    let resp = authed_get(port, "get_value_interpolated", "u/test-user/null_resource").await;
     assert_eq!(resp.status(), 200);
     assert_eq!(
         resp.json::<serde_json::Value>().await?,
@@ -123,8 +137,7 @@ async fn test_resource_endpoints(db: Pool<Postgres>) -> anyhow::Result<()> {
     );
 
     // not found
-    let resp =
-        authed_get(port, "get_value_interpolated", "u/test-user/nonexistent").await;
+    let resp = authed_get(port, "get_value_interpolated", "u/test-user/nonexistent").await;
     assert_eq!(resp.status(), 404);
 
     // array passthrough
@@ -162,7 +175,9 @@ async fn test_resource_endpoints(db: Pool<Postgres>) -> anyhow::Result<()> {
         "expected at least 10 resources from fixture, got {}",
         list.len()
     );
-    assert!(list.iter().any(|r| r["path"] == "u/test-user/simple_resource"));
+    assert!(list
+        .iter()
+        .any(|r| r["path"] == "u/test-user/simple_resource"));
 
     // list with resource_type filter
     let resp = authed(client().get(format!("{base}/list?resource_type=mcp_server")))
@@ -259,9 +274,11 @@ async fn test_resource_endpoints(db: Pool<Postgres>) -> anyhow::Result<()> {
     assert_eq!(body["description"], "Updated description");
 
     // --- update_value ---
-    let resp = authed(
-        client().post(resource_url(port, "update_value", "u/test-user/new_resource")),
-    )
+    let resp = authed(client().post(resource_url(
+        port,
+        "update_value",
+        "u/test-user/new_resource",
+    )))
     .json(&json!({"value": {"url": "https://final.com"}}))
     .send()
     .await
@@ -275,35 +292,44 @@ async fn test_resource_endpoints(db: Pool<Postgres>) -> anyhow::Result<()> {
     );
 
     // --- delete ---
-    let resp = authed(
-        client().delete(resource_url(port, "delete", "u/test-user/new_resource")),
-    )
-    .send()
-    .await
-    .unwrap();
+    let resp = authed(client().delete(resource_url(port, "delete", "u/test-user/new_resource")))
+        .send()
+        .await
+        .unwrap();
     assert_eq!(resp.status(), 200);
 
     let resp = authed_get(port, "exists", "u/test-user/new_resource").await;
     assert_eq!(resp.json::<bool>().await?, false);
 
     // delete nonexistent -> 404
-    let resp = authed(
-        client().delete(resource_url(port, "delete", "u/test-user/new_resource")),
-    )
-    .send()
-    .await
-    .unwrap();
+    let resp = authed(client().delete(resource_url(port, "delete", "u/test-user/new_resource")))
+        .send()
+        .await
+        .unwrap();
     assert_eq!(resp.status(), 404);
 
     // --- file_resource_type_to_file_ext_map ---
-    let resp = authed(client().get(format!(
-        "{base}/file_resource_type_to_file_ext_map"
-    )))
-    .send()
-    .await
-    .unwrap();
+    let resp = authed(client().get(format!("{base}/file_resource_type_to_file_ext_map")))
+        .send()
+        .await
+        .unwrap();
     assert_eq!(resp.status(), 200);
-    resp.json::<serde_json::Value>().await?;
+    let ext_map = resp.json::<serde_json::Value>().await?;
+    // Verify the map includes fileset type info with is_fileset flag (no format_extension)
+    let fileset_info = &ext_map["test_fileset"];
+    assert_eq!(fileset_info["format_extension"], serde_json::Value::Null);
+    assert_eq!(fileset_info["is_fileset"], true);
+    // Verify non-fileset file type
+    let file_info = &ext_map["test_file"];
+    assert_eq!(file_info["format_extension"], "txt");
+    assert_eq!(file_info["is_fileset"], false);
+
+    // --- fileset resource value ---
+    let resp = authed_get(port, "get_value", "u/test-user/fileset_resource").await;
+    assert_eq!(resp.status(), 200);
+    let fileset_val = resp.json::<serde_json::Value>().await?;
+    assert_eq!(fileset_val["config.yaml"], "key: value");
+    assert_eq!(fileset_val["data/input.json"], "{\"items\": []}");
 
     // --- resource types ---
 
@@ -384,17 +410,68 @@ async fn test_resource_endpoints(db: Pool<Postgres>) -> anyhow::Result<()> {
     assert_eq!(body["description"], "Updated type desc");
 
     // type/delete
-    let resp = authed(
-        client().delete(resource_url(port, "type/delete", "new_test_type")),
-    )
-    .send()
-    .await
-    .unwrap();
+    let resp = authed(client().delete(resource_url(port, "type/delete", "new_test_type")))
+        .send()
+        .await
+        .unwrap();
     assert_eq!(resp.status(), 200);
 
     let resp = authed_get(port, "type/exists", "new_test_type").await;
     assert_eq!(resp.json::<bool>().await?, false);
 
+    // --- fileset resource type CRUD ---
+
+    // type/get for fileset type - verify is_fileset is returned
+    let resp = authed_get(port, "type/get", "test_fileset").await;
+    assert_eq!(resp.status(), 200);
+    let body = resp.json::<serde_json::Value>().await?;
+    assert_eq!(body["name"], "test_fileset");
+    assert_eq!(body["is_fileset"], true);
+    assert_eq!(body["format_extension"], serde_json::Value::Null);
+
+    // type/get for non-fileset type - verify is_fileset is false
+    let resp = authed_get(port, "type/get", "test_db").await;
+    assert_eq!(resp.status(), 200);
+    let body = resp.json::<serde_json::Value>().await?;
+    assert_eq!(body["is_fileset"], false);
+
+    // type/create fileset type (no format_extension needed)
+    let resp = authed(client().post(format!("{base}/type/create")))
+        .json(&json!({
+            "name": "new_fileset_type",
+            "description": "A fileset type",
+            "schema": {},
+            "is_fileset": true
+        }))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 201);
+
+    let resp = authed_get(port, "type/get", "new_fileset_type").await;
+    let body = resp.json::<serde_json::Value>().await?;
+    assert_eq!(body["is_fileset"], true);
+    assert_eq!(body["format_extension"], serde_json::Value::Null);
+
+    // type/update - set is_fileset on existing type
+    let resp = authed(client().post(resource_url(port, "type/update", "new_fileset_type")))
+        .json(&json!({"is_fileset": false}))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 200);
+
+    let resp = authed_get(port, "type/get", "new_fileset_type").await;
+    let body = resp.json::<serde_json::Value>().await?;
+    assert_eq!(body["is_fileset"], false);
+
+    // cleanup
+    let resp = authed(client().delete(resource_url(port, "type/delete", "new_fileset_type")))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 200);
+
     Ok(())
 }
 

backend/windmill-api-jobs/src/lib.rs

@@ -10,9 +10,11 @@ pub mod concurrency_groups;
 pub mod execution;
 pub mod job_metrics;
 pub mod jobs_export;
+pub mod negated_filter;
 pub mod query;
 pub mod types;
 
 pub use execution::*;
+pub use negated_filter::{NegatedFilter, NegatedListFilter};
 pub use query::*;
 pub use types::*;

backend/windmill-api-jobs/src/negated_filter.rs

@@ -0,0 +1,126 @@
+/*
+ * Author: Windmill Labs, Inc
+ * Copyright: Windmill Labs, Inc 2024
+ * This file and its contents are licensed under the AGPLv3 License.
+ * Please see the included NOTICE for copyright information and
+ * LICENSE-AGPL for a copy of the license.
+ */
+
+//! Filter wrappers that support an optional `!` negation prefix.
+//!
+//! - [`NegatedFilter<T>`] — a single value, e.g. `"schedule"` or `"!schedule"`.
+//! - [`NegatedListFilter<T>`] — comma-separated values, e.g. `"!schedule,!email"` or `"http,webhook"`.
+//!   Every item in the list shares the same negated/non-negated sense; mixing is not supported
+
+use serde::{
+    de::{self, DeserializeOwned},
+    Deserializer,
+};
+use std::{fmt, marker::PhantomData};
+
+// ── NegatedFilter<T> ──────────────────────────────────────────────────────────
+
+/// A single filter value optionally prefixed with `!` to indicate negation.
+///
+/// Deserializes `"schedule"` → `NegatedFilter { value: Schedule, negated: false }`
+/// Deserializes `"!schedule"` → `NegatedFilter { value: Schedule, negated: true }`
+#[derive(Debug, Clone)]
+pub struct NegatedFilter<T> {
+    pub value: T,
+    pub negated: bool,
+}
+
+impl<T> NegatedFilter<T> {
+    pub fn positive(value: T) -> Self {
+        Self { value, negated: false }
+    }
+
+    pub fn negated(value: T) -> Self {
+        Self { value, negated: true }
+    }
+}
+
+struct NegatedFilterVisitor<T>(PhantomData<T>);
+
+impl<'de, T: DeserializeOwned> de::Visitor<'de> for NegatedFilterVisitor<T> {
+    type Value = NegatedFilter<T>;
+
+    fn expecting(&self, f: &mut fmt::Formatter) -> fmt::Result {
+        write!(f, "a string optionally prefixed with '!'")
+    }
+
+    fn visit_str<E: de::Error>(self, s: &str) -> Result<Self::Value, E> {
+        let (negated, raw) = match s.strip_prefix('!') {
+            Some(rest) => (true, rest),
+            None => (false, s),
+        };
+        let value = serde_json::from_value(serde_json::Value::String(raw.to_owned()))
+            .map_err(|e| E::custom(format!("invalid filter value {:?}: {}", raw, e)))?;
+        Ok(NegatedFilter { value, negated })
+    }
+}
+
+impl<'de, T: DeserializeOwned> de::Deserialize<'de> for NegatedFilter<T> {
+    fn deserialize<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
+        deserializer.deserialize_str(NegatedFilterVisitor(PhantomData))
+    }
+}
+
+// ── NegatedListFilter<T> ──────────────────────────────────────────────────────
+
+/// A comma-separated list of filter values, all sharing the same negation sense.
+///
+/// Deserializes `"schedule,email"` → `NegatedListFilter { values: [Schedule, Email], negated: false }`
+/// Deserializes `"!schedule,!email"` → `NegatedListFilter { values: [Schedule, Email], negated: true }`
+///
+/// The `!` is read from the **first** item only; subsequent items may or may not carry
+/// `!` and it is stripped regardless, keeping the API forgiving.
+#[derive(Debug, Clone)]
+pub struct NegatedListFilter<T> {
+    pub values: Vec<T>,
+    pub negated: bool,
+}
+
+impl<T> NegatedListFilter<T> {
+    pub fn positive(values: Vec<T>) -> Self {
+        Self { values, negated: false }
+    }
+}
+
+struct NegatedListFilterVisitor<T>(PhantomData<T>);
+
+impl<'de, T: DeserializeOwned> de::Visitor<'de> for NegatedListFilterVisitor<T> {
+    type Value = NegatedListFilter<T>;
+
+    fn expecting(&self, f: &mut fmt::Formatter) -> fmt::Result {
+        write!(f, "a comma-separated string optionally prefixed with '!'")
+    }
+
+    fn visit_str<E: de::Error>(self, s: &str) -> Result<Self::Value, E> {
+        let mut negated = false;
+        let values = s
+            .split(',')
+            .enumerate()
+            .map(|(i, item)| {
+                let raw = match item.strip_prefix('!') {
+                    Some(rest) => {
+                        if i == 0 {
+                            negated = true;
+                        }
+                        rest
+                    }
+                    None => item,
+                };
+                serde_json::from_value::<T>(serde_json::Value::String(raw.to_owned()))
+                    .map_err(|e| E::custom(format!("invalid filter value {:?}: {}", raw, e)))
+            })
+            .collect::<Result<Vec<T>, E>>()?;
+        Ok(NegatedListFilter { values, negated })
+    }
+}
+
+impl<'de, T: DeserializeOwned> de::Deserialize<'de> for NegatedListFilter<T> {
+    fn deserialize<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
+        deserializer.deserialize_str(NegatedListFilterVisitor(PhantomData))
+    }
+}

backend/windmill-api-jobs/src/query.rs

@@ -14,6 +14,17 @@ use windmill_common::utils::{paginate_without_limits, Pagination};
 
 use crate::types::{ListCompletedQuery, ListQueueQuery};
 
+/// Build a `NOT IN (...)` clause that also includes `OR col IS NULL`, so that
+/// rows where the nullable column is NULL are not silently excluded.
+fn not_in_nullable(col: &str, quoted: &[String]) -> String {
+    format!(
+        "({} IS NULL OR {} NOT IN ({}))",
+        col,
+        col,
+        quoted.join(", ")
+    )
+}
+
 pub fn filter_list_queue_query(
     mut sqlb: SqlBuilder,
     lq: &ListQueueQuery,
@@ -33,18 +44,62 @@ pub fn filter_list_queue_query(
     }
 
     if let Some(w) = &lq.worker {
+        let quoted: Vec<_> = w.values.iter().map(|v| quote(v)).collect();
         if lq.allow_wildcards.unwrap_or(false) {
-            sqlb.and_where_like_left("v2_job_queue.worker", w.replace("*", "%"));
+            let clauses: Vec<_> = w
+                .values
+                .iter()
+                .map(|v| {
+                    let p = v.replace("*", "%").replace("'", "''");
+                    if w.negated {
+                        format!("v2_job_queue.worker NOT LIKE '{p}'")
+                    } else {
+                        format!("v2_job_queue.worker LIKE '{p}'")
+                    }
+                })
+                .collect();
+            let sep = if w.negated { " AND " } else { " OR " };
+            let inner = clauses.join(sep);
+            if w.negated {
+                sqlb.and_where(format!("(v2_job_queue.worker IS NULL OR ({inner}))"));
+            } else {
+                sqlb.and_where(format!("({inner})"));
+            }
+        } else if w.negated {
+            sqlb.and_where(not_in_nullable("v2_job_queue.worker", &quoted));
         } else {
-            sqlb.and_where_eq("v2_job_queue.worker", "?".bind(w));
+            sqlb.and_where_in("v2_job_queue.worker", &quoted);
         }
     }
 
     if let Some(ps) = &lq.script_path_start {
-        sqlb.and_where_like_left("runnable_path", ps);
+        let clauses: Vec<_> = ps
+            .values
+            .iter()
+            .map(|v| {
+                let e = v.replace("'", "''");
+                if ps.negated {
+                    format!("runnable_path NOT LIKE '{e}%'")
+                } else {
+                    format!("runnable_path LIKE '{e}%'")
+                }
+            })
+            .collect();
+        let sep = if ps.negated { " AND " } else { " OR " };
+        let inner = clauses.join(sep);
+        if ps.negated {
+            sqlb.and_where(format!("(runnable_path IS NULL OR ({inner}))"));
+        } else {
+            sqlb.and_where(format!("({inner})"));
+        }
     }
     if let Some(p) = &lq.script_path_exact {
-        sqlb.and_where_eq("runnable_path", "?".bind(p));
+        let quoted: Vec<_> = p.values.iter().map(|v| quote(v)).collect();
+        if p.negated {
+            sqlb.and_where(not_in_nullable("runnable_path", &quoted));
+        } else {
+            sqlb.and_where_in("runnable_path", &quoted);
+        }
     }
     if let Some(p) = &lq.schedule_path {
         sqlb.and_where_eq("trigger", "?".bind(p));
@@ -54,13 +109,34 @@ pub fn filter_list_queue_query(
         sqlb.and_where_eq("runnable_id", "?".bind(h));
     }
     if let Some(cb) = &lq.created_by {
-        sqlb.and_where_eq("created_by", "?".bind(cb));
+        let quoted: Vec<_> = cb.values.iter().map(|v| quote(v)).collect();
+        if cb.negated {
+            sqlb.and_where_not_in("created_by", &quoted);
+        } else {
+            sqlb.and_where_in("created_by", &quoted);
+        }
     }
     if let Some(t) = &lq.tag {
+        let quoted: Vec<_> = t.values.iter().map(|v| quote(v)).collect();
         if lq.allow_wildcards.unwrap_or(false) {
-            sqlb.and_where_like_left("v2_job.tag", t.replace("*", "%"));
+            let clauses: Vec<_> = t
+                .values
+                .iter()
+                .map(|v| {
+                    let p = v.replace("*", "%").replace("'", "''");
+                    if t.negated {
+                        format!("v2_job.tag NOT LIKE '{p}'")
+                    } else {
+                        format!("v2_job.tag LIKE '{p}'")
+                    }
+                })
+                .collect();
+            let sep = if t.negated { " AND " } else { " OR " };
+            sqlb.and_where(format!("({})", clauses.join(sep)));
+        } else if t.negated {
+            sqlb.and_where_not_in("v2_job.tag", &quoted);
         } else {
-            sqlb.and_where_eq("v2_job.tag", "?".bind(t));
+            sqlb.and_where_in("v2_job.tag", &quoted);
         }
     }
 
@@ -115,10 +191,12 @@ pub fn filter_list_queue_query(
     }
 
     if let Some(jk) = &lq.job_kinds {
-        sqlb.and_where_in(
-            "kind",
-            &jk.split(',').into_iter().map(quote).collect::<Vec<_>>(),
-        );
+        let quoted: Vec<_> = jk.values.iter().map(|v| quote(v)).collect();
+        if jk.negated {
+            sqlb.and_where_not_in("kind", &quoted);
+        } else {
+            sqlb.and_where_in("kind", &quoted);
+        }
     }
 
     if let Some(args) = &lq.args {
@@ -134,11 +212,21 @@ pub fn filter_list_queue_query(
     }
 
     if let Some(tk) = &lq.trigger_kind {
-        sqlb.and_where_eq("trigger_kind", "?".bind(&format!("{}", tk)));
+        let quoted: Vec<_> = tk.values.iter().map(|v| quote(&format!("{}", v))).collect();
+        if tk.negated {
+            sqlb.and_where(not_in_nullable("trigger_kind", &quoted));
+        } else {
+            sqlb.and_where_in("trigger_kind", &quoted);
+        }
     }
 
     if let Some(tp) = &lq.trigger_path {
-        sqlb.and_where_eq("trigger", "?".bind(tp));
+        let quoted: Vec<_> = tp.values.iter().map(|v| quote(v)).collect();
+        if tp.negated {
+            sqlb.and_where(not_in_nullable("trigger", &quoted));
+        } else {
+            sqlb.and_where_in("trigger", &quoted);
+        }
     }
 
     sqlb
@@ -187,25 +275,71 @@ pub fn filter_list_completed_query(
 
     if let Some(label) = &lq.label {
         if lq.allow_wildcards.unwrap_or(false) {
-            let wh = format!(
-                    "EXISTS (SELECT 1 FROM jsonb_array_elements_text(result->'wm_labels') label WHERE jsonb_typeof(result->'wm_labels') = 'array' AND label LIKE '{}')",
-                    &label.replace("*", "%").replace("'", "''")
-                );
-            sqlb.and_where("result ? 'wm_labels'");
-            sqlb.and_where(&wh);
+            let clauses: Vec<_> = label
+                .values
+                .iter()
+                .map(|v| {
+                    let p = v.replace("*", "%").replace("'", "''");
+                    if label.negated {
+                        format!(
+                            "NOT EXISTS (SELECT 1 FROM jsonb_array_elements_text(result->'wm_labels') lbl WHERE jsonb_typeof(result->'wm_labels') = 'array' AND lbl LIKE '{p}')"
+                        )
+                    } else {
+                        format!(
+                            "EXISTS (SELECT 1 FROM jsonb_array_elements_text(result->'wm_labels') lbl WHERE jsonb_typeof(result->'wm_labels') = 'array' AND lbl LIKE '{p}')"
+                        )
+                    }
+                })
+                .collect();
+            let sep = if label.negated { " AND " } else { " OR " };
+            if !label.negated {
+                sqlb.and_where("result ? 'wm_labels'");
+            }
+            sqlb.and_where(format!("({})", clauses.join(sep)));
+        } else if label.negated {
+            let clauses: Vec<_> = label
+                .values
+                .iter()
+                .map(|v| format!("NOT (result->'wm_labels' ? '{}')", v.replace("'", "''")))
+                .collect();
+            sqlb.and_where(format!("({})", clauses.join(" AND ")));
         } else {
-            let mut wh = format!("result->'wm_labels' ? ");
-            wh.push_str(&format!("'{}'", &label.replace("'", "''")));
+            let clauses: Vec<_> = label
+                .values
+                .iter()
+                .map(|v| format!("result->'wm_labels' ? '{}'", v.replace("'", "''")))
+                .collect();
             sqlb.and_where("result ? 'wm_labels'");
-            sqlb.and_where(&wh);
+            sqlb.and_where(format!("({})", clauses.join(" OR ")));
         }
     }
 
     if let Some(worker) = &lq.worker {
+        let quoted: Vec<_> = worker.values.iter().map(|v| quote(v)).collect();
         if lq.allow_wildcards.unwrap_or(false) {
-            sqlb.and_where_like_left("v2_job_completed.worker", worker.replace("*", "%"));
+            let clauses: Vec<_> = worker
+                .values
+                .iter()
+                .map(|v| {
+                    let p = v.replace("*", "%").replace("'", "''");
+                    if worker.negated {
+                        format!("v2_job_completed.worker NOT LIKE '{p}'")
+                    } else {
+                        format!("v2_job_completed.worker LIKE '{p}'")
+                    }
+                })
+                .collect();
+            let sep = if worker.negated { " AND " } else { " OR " };
+            let inner = clauses.join(sep);
+            if worker.negated {
+                sqlb.and_where(format!("(v2_job_completed.worker IS NULL OR ({inner}))"));
+            } else {
+                sqlb.and_where(format!("({inner})"));
+            }
+        } else if worker.negated {
+            sqlb.and_where(not_in_nullable("v2_job_completed.worker", &quoted));
         } else {
-            sqlb.and_where_eq("v2_job_completed.worker", "?".bind(worker));
+            sqlb.and_where_in("v2_job_completed.worker", &quoted);
         }
     }
 
@@ -220,24 +354,68 @@ pub fn filter_list_completed_query(
     }
 
     if let Some(ps) = &lq.script_path_start {
-        sqlb.and_where_like_left("runnable_path", ps);
+        let clauses: Vec<_> = ps
+            .values
+            .iter()
+            .map(|v| {
+                let e = v.replace("'", "''");
+                if ps.negated {
+                    format!("runnable_path NOT LIKE '{e}%'")
+                } else {
+                    format!("runnable_path LIKE '{e}%'")
+                }
+            })
+            .collect();
+        let sep = if ps.negated { " AND " } else { " OR " };
+        let inner = clauses.join(sep);
+        if ps.negated {
+            sqlb.and_where(format!("(runnable_path IS NULL OR ({inner}))"));
+        } else {
+            sqlb.and_where(format!("({inner})"));
+        }
     }
     if let Some(p) = &lq.script_path_exact {
-        sqlb.and_where_eq("runnable_path", "?".bind(p));
+        let quoted: Vec<_> = p.values.iter().map(|v| quote(v)).collect();
+        if p.negated {
+            sqlb.and_where(not_in_nullable("runnable_path", &quoted));
+        } else {
+            sqlb.and_where_in("runnable_path", &quoted);
+        }
     }
     if let Some(h) = &lq.script_hash {
         sqlb.and_where_eq("runnable_id", "?".bind(h));
     }
     if let Some(t) = &lq.tag {
+        let quoted: Vec<_> = t.values.iter().map(|v| quote(v)).collect();
         if lq.allow_wildcards.unwrap_or(false) {
-            sqlb.and_where_like_left("v2_job.tag", t.replace("*", "%"));
+            let clauses: Vec<_> = t
+                .values
+                .iter()
+                .map(|v| {
+                    let p = v.replace("*", "%").replace("'", "''");
+                    if t.negated {
+                        format!("v2_job.tag NOT LIKE '{p}'")
+                    } else {
+                        format!("v2_job.tag LIKE '{p}'")
+                    }
+                })
+                .collect();
+            let sep = if t.negated { " AND " } else { " OR " };
+            sqlb.and_where(format!("({})", clauses.join(sep)));
+        } else if t.negated {
+            sqlb.and_where_not_in("v2_job.tag", &quoted);
         } else {
-            sqlb.and_where_eq("v2_job.tag", "?".bind(t));
+            sqlb.and_where_in("v2_job.tag", &quoted);
         }
     }
 
     if let Some(cb) = &lq.created_by {
-        sqlb.and_where_eq("created_by", "?".bind(cb));
+        let quoted: Vec<_> = cb.values.iter().map(|v| quote(v)).collect();
+        if cb.negated {
+            sqlb.and_where_not_in("created_by", &quoted);
+        } else {
+            sqlb.and_where_in("created_by", &quoted);
+        }
     }
     if let Some(r) = &lq.success {
         if *r {
@@ -308,10 +486,12 @@ pub fn filter_list_completed_query(
         }
     }
     if let Some(jk) = &lq.job_kinds {
-        sqlb.and_where_in(
-            "kind",
-            &jk.split(',').into_iter().map(quote).collect::<Vec<_>>(),
-        );
+        let quoted: Vec<_> = jk.values.iter().map(|v| quote(v)).collect();
+        if jk.negated {
+            sqlb.and_where_not_in("kind", &quoted);
+        } else {
+            sqlb.and_where_in("kind", &quoted);
+        }
     }
 
     if let Some(args) = &lq.args {
@@ -327,11 +507,21 @@ pub fn filter_list_completed_query(
     }
 
     if let Some(tk) = &lq.trigger_kind {
-        sqlb.and_where_eq("trigger_kind", "?".bind(&format!("{}", tk)));
+        let quoted: Vec<_> = tk.values.iter().map(|v| quote(&format!("{}", v))).collect();
+        if tk.negated {
+            sqlb.and_where(not_in_nullable("trigger_kind", &quoted));
+        } else {
+            sqlb.and_where_in("trigger_kind", &quoted);
+        }
     }
 
     if let Some(tp) = &lq.trigger_path {
-        sqlb.and_where_eq("trigger", "?".bind(tp));
+        let quoted: Vec<_> = tp.values.iter().map(|v| quote(v)).collect();
+        if tp.negated {
+            sqlb.and_where(not_in_nullable("trigger", &quoted));
+        } else {
+            sqlb.and_where_in("trigger", &quoted);
+        }
     }
 
     sqlb
@@ -375,6 +565,7 @@ pub fn list_completed_jobs_query(
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::negated_filter::NegatedListFilter;
 
     fn empty_queue_query() -> ListQueueQuery {
         ListQueueQuery {
@@ -478,7 +669,7 @@ mod tests {
     #[test]
     fn test_queue_filter_script_path_start() {
         let lq = ListQueueQuery {
-            script_path_start: Some("f/test".to_string()),
+            script_path_start: Some(NegatedListFilter::positive(vec!["f/test".to_string()])),
             ..empty_queue_query()
         };
         let sqlb = filter_list_queue_query(
@@ -495,7 +686,9 @@ mod tests {
     #[test]
     fn test_queue_filter_script_path_exact() {
         let lq = ListQueueQuery {
-            script_path_exact: Some("f/test/script".to_string()),
+            script_path_exact: Some(NegatedListFilter::positive(vec![
+                "f/test/script".to_string()
+            ])),
             ..empty_queue_query()
         };
         let sqlb = filter_list_queue_query(
@@ -510,10 +703,7 @@ mod tests {
 
     #[test]
     fn test_queue_filter_running() {
-        let lq = ListQueueQuery {
-            running: Some(true),
-            ..empty_queue_query()
-        };
+        let lq = ListQueueQuery { running: Some(true), ..empty_queue_query() };
         let sqlb = filter_list_queue_query(
             SqlBuilder::select_from("v2_job_queue").clone(),
             &lq,
@@ -527,7 +717,10 @@ mod tests {
     #[test]
     fn test_queue_filter_job_kinds() {
         let lq = ListQueueQuery {
-            job_kinds: Some("script,flow".to_string()),
+            job_kinds: Some(NegatedListFilter::positive(vec![
+                "script".to_string(),
+                "flow".to_string(),
+            ])),
             ..empty_queue_query()
         };
         let sqlb = filter_list_queue_query(
@@ -543,10 +736,7 @@ mod tests {
 
     #[test]
     fn test_queue_filter_suspended() {
-        let lq = ListQueueQuery {
-            suspended: Some(true),
-            ..empty_queue_query()
-        };
+        let lq = ListQueueQuery { suspended: Some(true), ..empty_queue_query() };
         let sqlb = filter_list_queue_query(
             SqlBuilder::select_from("v2_job_queue").clone(),
             &lq,
@@ -559,10 +749,7 @@ mod tests {
 
     #[test]
     fn test_queue_filter_is_not_schedule() {
-        let lq = ListQueueQuery {
-            is_not_schedule: Some(true),
-            ..empty_queue_query()
-        };
+        let lq = ListQueueQuery { is_not_schedule: Some(true), ..empty_queue_query() };
         let sqlb = filter_list_queue_query(
             SqlBuilder::select_from("v2_job_queue").clone(),
             &lq,
@@ -575,10 +762,7 @@ mod tests {
 
     #[test]
     fn test_queue_filter_has_null_parent() {
-        let lq = ListQueueQuery {
-            has_null_parent: Some(true),
-            ..empty_queue_query()
-        };
+        let lq = ListQueueQuery { has_null_parent: Some(true), ..empty_queue_query() };
         let sqlb = filter_list_queue_query(
             SqlBuilder::select_from("v2_job_queue").clone(),
             &lq,
@@ -591,10 +775,7 @@ mod tests {
 
     #[test]
     fn test_queue_filter_is_flow_step_true() {
-        let lq = ListQueueQuery {
-            is_flow_step: Some(true),
-            ..empty_queue_query()
-        };
+        let lq = ListQueueQuery { is_flow_step: Some(true), ..empty_queue_query() };
         let sqlb = filter_list_queue_query(
             SqlBuilder::select_from("v2_job_queue").clone(),
             &lq,
@@ -607,10 +788,7 @@ mod tests {
 
     #[test]
     fn test_queue_filter_is_flow_step_false() {
-        let lq = ListQueueQuery {
-            is_flow_step: Some(false),
-            ..empty_queue_query()
-        };
+        let lq = ListQueueQuery { is_flow_step: Some(false), ..empty_queue_query() };
         let sqlb = filter_list_queue_query(
             SqlBuilder::select_from("v2_job_queue").clone(),
             &lq,
@@ -623,10 +801,7 @@ mod tests {
 
     #[test]
     fn test_queue_admins_all_workspaces() {
-        let lq = ListQueueQuery {
-            all_workspaces: Some(true),
-            ..empty_queue_query()
-        };
+        let lq = ListQueueQuery { all_workspaces: Some(true), ..empty_queue_query() };
         let sqlb = filter_list_queue_query(
             SqlBuilder::select_from("v2_job_queue").clone(),
             &lq,
@@ -639,10 +814,7 @@ mod tests {
 
     #[test]
     fn test_queue_non_admins_ignores_all_workspaces() {
-        let lq = ListQueueQuery {
-            all_workspaces: Some(true),
-            ..empty_queue_query()
-        };
+        let lq = ListQueueQuery { all_workspaces: Some(true), ..empty_queue_query() };
         let sqlb = filter_list_queue_query(
             SqlBuilder::select_from("v2_job_queue").clone(),
             &lq,
@@ -695,10 +867,7 @@ mod tests {
 
     #[test]
     fn test_completed_filter_success_true() {
-        let lq = ListCompletedQuery {
-            success: Some(true),
-            ..empty_completed_query()
-        };
+        let lq = ListCompletedQuery { success: Some(true), ..empty_completed_query() };
         let sqlb = filter_list_completed_query(
             SqlBuilder::select_from("v2_job_completed").clone(),
             &lq,
@@ -711,10 +880,7 @@ mod tests {
 
     #[test]
     fn test_completed_filter_success_false() {
-        let lq = ListCompletedQuery {
-            success: Some(false),
-            ..empty_completed_query()
-        };
+        let lq = ListCompletedQuery { success: Some(false), ..empty_completed_query() };
         let sqlb = filter_list_completed_query(
             SqlBuilder::select_from("v2_job_completed").clone(),
             &lq,
@@ -739,7 +905,7 @@ mod tests {
     #[test]
     fn test_completed_filter_label() {
         let lq = ListCompletedQuery {
-            label: Some("deploy".to_string()),
+            label: Some(NegatedListFilter::positive(vec!["deploy".to_string()])),
             ..empty_completed_query()
         };
         let sqlb = filter_list_completed_query(
@@ -754,10 +920,7 @@ mod tests {
 
     #[test]
     fn test_completed_filter_is_skipped() {
-        let lq = ListCompletedQuery {
-            is_skipped: Some(true),
-            ..empty_completed_query()
-        };
+        let lq = ListCompletedQuery { is_skipped: Some(true), ..empty_completed_query() };
         let sqlb = filter_list_completed_query(
             SqlBuilder::select_from("v2_job_completed").clone(),
             &lq,

backend/windmill-api-jobs/src/types.rs

@@ -27,6 +27,8 @@ use windmill_common::{
 
 use windmill_api_sse::{Job, JobExtended};
 
+use crate::negated_filter::NegatedListFilter;
+
 // ------------ RunJobQuery ------------
 
 #[derive(Debug, Deserialize, Clone, Default)]
@@ -89,10 +91,10 @@ impl RunJobQuery {
 
 #[derive(Deserialize, Clone)]
 pub struct ListQueueQuery {
-    pub script_path_start: Option<String>,
-    pub script_path_exact: Option<String>,
+    pub script_path_start: Option<NegatedListFilter<String>>,
+    pub script_path_exact: Option<NegatedListFilter<String>>,
     pub script_hash: Option<String>,
-    pub created_by: Option<String>,
+    pub created_by: Option<NegatedListFilter<String>>,
     pub started_before: Option<chrono::DateTime<chrono::Utc>>,
     pub started_after: Option<chrono::DateTime<chrono::Utc>>,
     pub created_before: Option<chrono::DateTime<chrono::Utc>>,
@@ -103,12 +105,12 @@ pub struct ListQueueQuery {
     pub schedule_path: Option<String>,
     pub parent_job: Option<String>,
     pub order_desc: Option<bool>,
-    pub job_kinds: Option<String>,
+    pub job_kinds: Option<NegatedListFilter<String>>,
     pub suspended: Option<bool>,
-    pub worker: Option<String>,
+    pub worker: Option<NegatedListFilter<String>>,
     // filter by matching a subset of the args using base64 encoded json subset
     pub args: Option<String>,
-    pub tag: Option<String>,
+    pub tag: Option<NegatedListFilter<String>>,
     pub scheduled_for_before_now: Option<bool>,
     pub all_workspaces: Option<bool>,
     pub is_flow_step: Option<bool>,
@@ -116,17 +118,17 @@ pub struct ListQueueQuery {
     pub is_not_schedule: Option<bool>,
     pub concurrency_key: Option<String>,
     pub allow_wildcards: Option<bool>,
-    pub trigger_kind: Option<JobTriggerKind>,
-    pub trigger_path: Option<String>,
+    pub trigger_kind: Option<NegatedListFilter<JobTriggerKind>>,
+    pub trigger_path: Option<NegatedListFilter<String>>,
     pub include_args: Option<bool>,
 }
 
 #[derive(Deserialize, Clone)]
 pub struct ListCompletedQuery {
-    pub script_path_start: Option<String>,
-    pub script_path_exact: Option<String>,
+    pub script_path_start: Option<NegatedListFilter<String>>,
+    pub script_path_exact: Option<NegatedListFilter<String>>,
     pub script_hash: Option<String>,
-    pub created_by: Option<String>,
+    pub created_by: Option<NegatedListFilter<String>>,
     pub started_before: Option<chrono::DateTime<chrono::Utc>>,
     pub started_after: Option<chrono::DateTime<chrono::Utc>>,
     pub created_before: Option<chrono::DateTime<chrono::Utc>>,
@@ -142,7 +144,7 @@ pub struct ListCompletedQuery {
     pub running: Option<bool>,
     pub parent_job: Option<String>,
     pub order_desc: Option<bool>,
-    pub job_kinds: Option<String>,
+    pub job_kinds: Option<NegatedListFilter<String>>,
     pub is_skipped: Option<bool>,
     pub is_flow_step: Option<bool>,
     pub suspended: Option<bool>,
@@ -151,17 +153,17 @@ pub struct ListCompletedQuery {
     pub args: Option<String>,
     // filter by matching a subset of the result using base64 encoded json subset
     pub result: Option<String>,
-    pub tag: Option<String>,
+    pub tag: Option<NegatedListFilter<String>>,
     pub scheduled_for_before_now: Option<bool>,
     pub all_workspaces: Option<bool>,
     pub has_null_parent: Option<bool>,
-    pub label: Option<String>,
+    pub label: Option<NegatedListFilter<String>>,
     pub is_not_schedule: Option<bool>,
     pub concurrency_key: Option<String>,
-    pub worker: Option<String>,
+    pub worker: Option<NegatedListFilter<String>>,
     pub allow_wildcards: Option<bool>,
-    pub trigger_kind: Option<JobTriggerKind>,
-    pub trigger_path: Option<String>,
+    pub trigger_kind: Option<NegatedListFilter<JobTriggerKind>>,
+    pub trigger_path: Option<NegatedListFilter<String>>,
     pub include_args: Option<bool>,
 }
 
@@ -578,8 +580,7 @@ mod tests {
 
     #[test]
     fn test_decode_payload_valid() {
-        let payload = base64::engine::general_purpose::STANDARD
-            .encode(r#"{"key": "value"}"#);
+        let payload = base64::engine::general_purpose::STANDARD.encode(r#"{"key": "value"}"#);
         let result: HashMap<String, serde_json::Value> = decode_payload(payload).unwrap();
         assert_eq!(result["key"], json!("value"));
     }
@@ -644,22 +645,15 @@ mod tests {
 
     #[test]
     fn test_run_job_query_payload_as_args_valid() {
-        let encoded = base64::engine::general_purpose::STANDARD
-            .encode(r#"{"x": 42}"#);
-        let q = RunJobQuery {
-            payload: Some(encoded),
-            ..Default::default()
-        };
+        let encoded = base64::engine::general_purpose::STANDARD.encode(r#"{"x": 42}"#);
+        let q = RunJobQuery { payload: Some(encoded), ..Default::default() };
         let result = q.payload_as_args().unwrap();
         assert!(result.contains_key("x"));
     }
 
     #[test]
     fn test_run_job_query_payload_as_args_invalid() {
-        let q = RunJobQuery {
-            payload: Some("invalid!!!".to_string()),
-            ..Default::default()
-        };
+        let q = RunJobQuery { payload: Some("invalid!!!".to_string()), ..Default::default() };
         assert!(q.payload_as_args().is_err());
     }
 
@@ -668,10 +662,10 @@ mod tests {
     #[test]
     fn test_list_completed_to_queue_query_conversion() {
         let lcq = ListCompletedQuery {
-            script_path_start: Some("f/test".to_string()),
+            script_path_start: Some(NegatedListFilter::positive(vec!["f/test".to_string()])),
             script_path_exact: None,
             script_hash: None,
-            created_by: Some("admin".to_string()),
+            created_by: Some(NegatedListFilter::positive(vec!["admin".to_string()])),
             started_before: None,
             started_after: None,
             created_before: Some(chrono::Utc::now()),
@@ -687,14 +681,17 @@ mod tests {
             running: Some(true),
             parent_job: None,
             order_desc: Some(true),
-            job_kinds: Some("script,flow".to_string()),
+            job_kinds: Some(NegatedListFilter::positive(vec![
+                "script".to_string(),
+                "flow".to_string(),
+            ])),
             is_skipped: None,
             is_flow_step: None,
             suspended: None,
             schedule_path: None,
             args: None,
             result: None,
-            tag: Some("custom".to_string()),
+            tag: Some(NegatedListFilter::positive(vec!["custom".to_string()])),
             scheduled_for_before_now: None,
             all_workspaces: None,
             has_null_parent: None,
@@ -709,11 +706,24 @@ mod tests {
         };
 
         let lqq: ListQueueQuery = lcq.into();
-        assert_eq!(lqq.script_path_start, Some("f/test".to_string()));
-        assert_eq!(lqq.created_by, Some("admin".to_string()));
+        assert_eq!(
+            lqq.script_path_start
+                .as_ref()
+                .and_then(|f| f.values.first().cloned()),
+            Some("f/test".to_string())
+        );
+        assert_eq!(
+            lqq.created_by
+                .as_ref()
+                .and_then(|f| f.values.first().cloned()),
+            Some("admin".to_string())
+        );
         assert_eq!(lqq.running, Some(true));
-        assert_eq!(lqq.job_kinds, Some("script,flow".to_string()));
-        assert_eq!(lqq.tag, Some("custom".to_string()));
+        assert_eq!(lqq.job_kinds.as_ref().map(|f| f.values.len()), Some(2));
+        assert_eq!(
+            lqq.tag.as_ref().and_then(|f| f.values.first().cloned()),
+            Some("custom".to_string())
+        );
     }
 
     #[test]

backend/windmill-api-schedule/src/lib.rs

@@ -6,8 +6,6 @@
  * LICENSE-AGPL for a copy of the license.
  */
 
-use windmill_api_auth::{check_scopes, maybe_refresh_folders, require_super_admin, ApiAuthed};
-use windmill_common::DB;
 use axum::{
     extract::{Extension, Path, Query},
     routing::{delete, get, post},
@@ -18,8 +16,10 @@ use serde::{Deserialize, Serialize};
 use sql_builder::{prelude::Bind, SqlBuilder};
 use sqlx::{Postgres, Transaction};
 use std::str::FromStr;
+use windmill_api_auth::{check_scopes, maybe_refresh_folders, require_super_admin, ApiAuthed};
 use windmill_audit::audit_oss::audit_log;
 use windmill_audit::ActionKind;
+use windmill_common::DB;
 use windmill_common::{
     db::UserDB,
     error::{Error, JsonResult, Result},
@@ -486,8 +486,15 @@ pub struct ListScheduleQuery {
     pub per_page: Option<usize>,
     pub path: Option<String>,
     pub is_flow: Option<bool>,
+    // filter by matching a subset of the args using base64 encoded json subset
     pub args: Option<String>,
     pub path_start: Option<String>,
+    // exact match on schedule path
+    pub schedule_path: Option<String>,
+    // filter on description (pattern match)
+    pub description: Option<String>,
+    // filter on summary (pattern match)
+    pub summary: Option<String>,
 }
 
 #[derive(sqlx::FromRow, Serialize, Deserialize, Debug, Clone)]
@@ -543,6 +550,18 @@ async fn list_schedule(
     if let Some(path_start) = &lsq.path_start {
         sqlb.and_where_like_left("path", path_start);
     }
+    if let Some(schedule_path) = &lsq.schedule_path {
+        sqlb.and_where_eq("path", "?".bind(schedule_path));
+    }
+    if let Some(description) = &lsq.description {
+        sqlb.and_where(&format!(
+            "description ILIKE '%{}%'",
+            description.replace("'", "''")
+        ));
+    }
+    if let Some(summary) = &lsq.summary {
+        sqlb.and_where(&format!("summary ILIKE '%{}%'", summary.replace("'", "''")));
+    }
     let sql = sqlb.sql().map_err(|e| Error::internal_err(e.to_string()))?;
     let rows = sqlx::query_as::<_, ScheduleLight>(&sql)
         .fetch_all(&mut *tx)

backend/windmill-api-workspaces/src/workspaces.rs

@@ -30,7 +30,6 @@ use uuid::Uuid;
 use windmill_audit::audit_oss::{audit_log, AuditAuthorable};
 use windmill_audit::ActionKind;
 use windmill_common::db::UserDB;
-use windmill_types::s3::LargeFileStorage;
 use windmill_common::users::username_to_permissioned_as;
 use windmill_common::variables::{build_crypt, decrypt, encrypt, WORKSPACE_CRYPT_CACHE};
 use windmill_common::worker::{to_raw_value, CLOUD_HOSTED};
@@ -55,6 +54,7 @@ use windmill_dep_map::scoped_dependency_map::{
     DependencyDependent, DependencyMap, ScopedDependencyMap,
 };
 use windmill_git_sync::{handle_deployment_metadata, handle_fork_branch_creation, DeployedObject};
+use windmill_types::s3::LargeFileStorage;
 
 use hyper::StatusCode;
 use serde::{Deserialize, Serialize};
@@ -3010,8 +3010,8 @@ async fn clone_resource_types(
     target_workspace_id: &str,
 ) -> Result<()> {
     sqlx::query!(
-        "INSERT INTO resource_type (workspace_id, name, schema, description, edited_at, created_by, format_extension)
-         SELECT $2, name, schema, description, edited_at, created_by, format_extension
+        "INSERT INTO resource_type (workspace_id, name, schema, description, edited_at, created_by, format_extension, is_fileset)
+         SELECT $2, name, schema, description, edited_at, created_by, format_extension, is_fileset
          FROM resource_type
          WHERE workspace_id = $1",
         source_workspace_id,
@@ -5254,7 +5254,7 @@ async fn compare_two_resource_types(
 ) -> Result<ItemComparison> {
     // Get resource type from each workspace
     let source_resource_type = sqlx::query!(
-        "SELECT schema, description, format_extension
+        "SELECT schema, description, format_extension, is_fileset
          FROM resource_type
          WHERE workspace_id = $1 AND name = $2",
         source_workspace_id,
@@ -5264,7 +5264,7 @@ async fn compare_two_resource_types(
     .await?;
 
     let target_resource_type = sqlx::query!(
-        "SELECT schema, description, format_extension
+        "SELECT schema, description, format_extension, is_fileset
          FROM resource_type
          WHERE workspace_id = $1 AND name = $2",
         fork_workspace_id,
@@ -5280,6 +5280,7 @@ async fn compare_two_resource_types(
         if source.schema != target.schema
             || source.description != target.description
             || source.format_extension != target.format_extension
+            || source.is_fileset != target.is_fileset
         {
             has_changes = true;
         }

backend/windmill-api/openapi.yaml

@@ -4091,6 +4091,21 @@ paths:
           in: query
           schema:
             type: string
+        - name: path
+          description: exact path match filter
+          in: query
+          schema:
+            type: string
+        - name: description
+          description: pattern match filter for description field (case-insensitive)
+          in: query
+          schema:
+            type: string
+        - name: value
+          description: pattern match filter for non-secret variable values (case-insensitive)
+          in: query
+          schema:
+            type: string
         - $ref: "#/components/parameters/Page"
         - $ref: "#/components/parameters/PerPage"
       responses:
@@ -5090,6 +5105,21 @@ paths:
           in: query
           schema:
             type: string
+        - name: path
+          description: exact path match filter
+          in: query
+          schema:
+            type: string
+        - name: description
+          description: pattern match filter for description field (case-insensitive)
+          in: query
+          schema:
+            type: string
+        - name: value
+          description: JSONB subset match filter using base64 encoded JSON
+          in: query
+          schema:
+            type: string
       responses:
         "200":
           description: resource list
@@ -5214,10 +5244,19 @@ paths:
         - $ref: "#/components/parameters/WorkspaceId"
       responses:
         "200":
-          description: map from resource type to file ext
+          description: map from resource type to file resource info
           content:
             application/json:
-              schema: {}
+              schema:
+                type: object
+                additionalProperties:
+                  type: object
+                  properties:
+                    format_extension:
+                      type: string
+                      nullable: true
+                    is_fileset:
+                      type: boolean
 
   /w/{workspace}/resources/type/delete/{path}:
     delete:
@@ -11120,7 +11159,7 @@ paths:
         - $ref: "#/components/parameters/PerPage"
         - $ref: "#/components/parameters/ArgsFilter"
         - name: path
-          description: filter by path
+          description: filter by path (script path)
           in: query
           schema:
             type: string
@@ -11134,6 +11173,21 @@ paths:
           in: query
           schema:
             type: string
+        - name: schedule_path
+          description: exact match on the schedule's path
+          in: query
+          schema:
+            type: string
+        - name: description
+          description: pattern match filter for description field (case-insensitive)
+          in: query
+          schema:
+            type: string
+        - name: summary
+          description: pattern match filter for summary field (case-insensitive)
+          in: query
+          schema:
+            type: string
       responses:
         "200":
           description: schedule list
@@ -16885,6 +16939,16 @@ paths:
           description: Filter by asset kinds (multiple values allowed)
           schema:
             type: string
+        - name: path
+          in: query
+          description: exact path match filter
+          schema:
+            type: string
+        - name: columns
+          in: query
+          description: JSONB subset match filter for columns using base64 encoded JSON
+          schema:
+            type: string
       responses:
         "200":
           description: paginated assets in the workspace
@@ -17258,10 +17322,10 @@ components:
         type: integer
     JobTriggerKind:
       name: trigger_kind
-      description: trigger kind (schedule, http, websocket...)
+      description: "filter by trigger kind. Supports comma-separated list (e.g. 'schedule,webhook') and negation by prefixing all values with '!' (e.g. '!schedule,!webhook')"
       in: query
       schema:
-        $ref: "#/components/schemas/JobTriggerKind"
+        type: string
     OrderDesc:
       name: order_desc
       description: order by desc order (default true)
@@ -17270,19 +17334,19 @@ components:
         type: boolean
     CreatedBy:
       name: created_by
-      description: mask to filter exact matching user creator
+      description: "filter by exact matching user creator. Supports comma-separated list (e.g. 'alice,bob') and negation by prefixing all values with '!' (e.g. '!alice,!bob')"
       in: query
       schema:
         type: string
     Label:
       name: label
-      description: mask to filter exact matching job's label (job labels are completed jobs with as a result an object containing a string in the array at key 'wm_labels')
+      description: "filter by exact matching job label. Supports comma-separated list (e.g. 'deploy,release') and negation by prefixing all values with '!' (e.g. '!deploy,!release')"
       in: query
       schema:
         type: string
     Worker:
       name: worker
-      description: worker this job was ran on
+      description: "filter by worker this job ran on. Supports comma-separated list (e.g. 'worker-1,worker-2') and negation by prefixing all values with '!' (e.g. '!worker-1,!worker-2')"
       in: query
       schema:
         type: string
@@ -17348,7 +17412,7 @@ components:
         type: string
     ScriptStartPath:
       name: script_path_start
-      description: mask to filter matching starting path
+      description: "filter by script path prefix. Supports comma-separated list (e.g. 'f/folder1,f/folder2') and negation by prefixing all values with '!' (e.g. '!f/folder1,!f/folder2')"
       in: query
       schema:
         type: string
@@ -17360,13 +17424,13 @@ components:
         type: string
     TriggerPath:
       name: trigger_path
-      description: mask to filter by trigger path
+      description: "filter by trigger path. Supports comma-separated list (e.g. 'f/trigger1,f/trigger2') and negation by prefixing all values with '!' (e.g. '!f/trigger1,!f/trigger2')"
       in: query
       schema:
         type: string
     ScriptExactPath:
       name: script_path_exact
-      description: mask to filter exact matching path
+      description: "filter by exact matching script path. Supports comma-separated list (e.g. 'f/script1,f/script2') and negation by prefixing all values with '!' (e.g. '!f/script1,!f/script2')"
       in: query
       schema:
         type: string
@@ -17481,7 +17545,7 @@ components:
         type: string
     Tag:
       name: tag
-      description: filter on jobs with a given tag/worker group
+      description: "filter by tag/worker group. Supports comma-separated list (e.g. 'gpu,highmem') and negation by prefixing all values with '!' (e.g. '!gpu,!highmem')"
       in: query
       schema:
         type: string
@@ -17525,9 +17589,7 @@ components:
         enum: [Create, Update, Delete, Execute]
     JobKinds:
       name: job_kinds
-      description:
-        filter on job kind (values 'preview', 'script', 'dependencies', 'flow')
-        separated by,
+      description: "filter by job kind. Supports comma-separated list of values ('preview', 'script', 'dependencies', 'flow') and negation by prefixing all values with '!' (e.g. '!preview,!dependencies')"
       in: query
       schema:
         type: string
@@ -19832,6 +19894,8 @@ components:
           format: date-time
         format_extension:
           type: string
+        is_fileset:
+          type: boolean
       required:
         - name
 
@@ -19841,6 +19905,8 @@ components:
         schema: {}
         description:
           type: string
+        is_fileset:
+          type: boolean
 
     Schedule:
       type: object

backend/windmill-store/src/resources.rs

@@ -98,6 +98,7 @@ pub struct ResourceType {
     pub created_by: Option<String>,
     pub edited_at: Option<chrono::DateTime<chrono::Utc>>,
     pub format_extension: Option<String>,
+    pub is_fileset: bool,
 }
 
 #[derive(Deserialize)]
@@ -106,12 +107,14 @@ pub struct CreateResourceType {
     pub schema: Option<serde_json::Value>,
     pub description: Option<String>,
     pub format_extension: Option<String>,
+    pub is_fileset: Option<bool>,
 }
 
 #[derive(Deserialize)]
 pub struct EditResourceType {
     pub schema: Option<serde_json::Value>,
     pub description: Option<String>,
+    pub is_fileset: Option<bool>,
 }
 
 #[derive(FromRow, Serialize, Deserialize)]
@@ -160,9 +163,13 @@ struct EditResource {
 
 #[derive(Deserialize)]
 pub struct ListResourceQuery {
-    resource_type: Option<String>,
-    resource_type_exclude: Option<String>,
-    path_start: Option<String>,
+    pub resource_type: Option<String>,
+    pub resource_type_exclude: Option<String>,
+    pub path_start: Option<String>,
+    pub path: Option<String>,
+    pub description: Option<String>,
+    // filter by matching a subset of the value using base64 encoded json subset
+    pub value: Option<String>,
 }
 
 #[derive(Serialize, FromRow)]
@@ -282,6 +289,18 @@ async fn list_resources(
         sqlb.and_where_like_left("resource.path", path_start);
     }
 
+    if let Some(path) = &lq.path {
+        sqlb.and_where_eq("resource.path", "?".bind(path));
+    }
+
+    if let Some(description) = &lq.description {
+        sqlb.and_where("resource.description ILIKE ?".bind(&format!("%{}%", description)));
+    }
+
+    if let Some(value) = &lq.value {
+        sqlb.and_where("resource.value @> ?".bind(&value.replace("'", "''")));
+    }
+
     let sql = sqlb.sql().map_err(|e| Error::internal_err(e.to_string()))?;
     let mut tx = user_db.begin(&authed).await?;
     let rows = sqlx::query_as::<_, ListableResource>(&sql)
@@ -1193,29 +1212,38 @@ async fn update_resource_value(
     Ok(format!("value of resource {} updated", path))
 }
 
+#[derive(Serialize)]
+pub struct FileResourceTypeInfo {
+    pub format_extension: Option<String>,
+    pub is_fileset: bool,
+}
+
 async fn file_resource_ext_to_resource_type(
     Extension(db): Extension<DB>,
     Path(w_id): Path<String>,
-) -> JsonResult<HashMap<String, String>> {
-    #[derive(Serialize, sqlx::FromRow)]
+) -> JsonResult<HashMap<String, FileResourceTypeInfo>> {
+    #[derive(sqlx::FromRow)]
     struct LocalFileResourceExtension {
         name: String,
         format_extension: Option<String>,
+        is_fileset: bool,
     }
 
     let r = sqlx::query_as!(LocalFileResourceExtension, "
-        SELECT name, format_extension FROM resource_type WHERE format_extension IS NOT NULL AND (workspace_id = $1 OR workspace_id = 'admins')", w_id)
+        SELECT name, format_extension, is_fileset FROM resource_type WHERE (format_extension IS NOT NULL OR is_fileset = true) AND (workspace_id = $1 OR workspace_id = 'admins')", w_id)
         .fetch_all(&db)
         .await?;
 
-    let hashmap: HashMap<String, String> = r
+    let hashmap: HashMap<String, FileResourceTypeInfo> = r
         .into_iter()
-        .filter_map(|entry| {
-            if let Some(format_extension) = entry.format_extension {
-                Some((entry.name, format_extension))
-            } else {
-                None
-            }
+        .map(|entry| {
+            (
+                entry.name,
+                FileResourceTypeInfo {
+                    format_extension: entry.format_extension,
+                    is_fileset: entry.is_fileset,
+                },
+            )
         })
         .collect();
 
@@ -1315,16 +1343,25 @@ async fn create_resource_type(
 
     check_rt_path_conflict(&mut tx, &w_id, &resource_type.name).await?;
 
+    let is_fileset = resource_type.is_fileset.unwrap_or(false);
+
+    if is_fileset && resource_type.format_extension.is_some() {
+        return Err(Error::BadRequest(
+            "A fileset resource type cannot have a format_extension".to_string(),
+        ));
+    }
+
     sqlx::query!(
         "INSERT INTO resource_type
-            (workspace_id, name, schema, description, created_by, format_extension, edited_at)
-            VALUES ($1, $2, $3, $4, $5, $6, now())",
+            (workspace_id, name, schema, description, created_by, format_extension, is_fileset, edited_at)
+            VALUES ($1, $2, $3, $4, $5, $6, $7, now())",
         w_id,
         resource_type.name,
         resource_type.schema,
         resource_type.description,
         authed.username,
         resource_type.format_extension,
+        is_fileset,
     )
     .execute(&mut *tx)
     .await?;
@@ -1485,6 +1522,9 @@ async fn update_resource_type(
     if let Some(ndesc) = ns.description {
         sqlb.set_str("description", ndesc);
     }
+    if let Some(is_fileset) = ns.is_fileset {
+        sqlb.set("is_fileset", if is_fileset { "TRUE" } else { "FALSE" });
+    }
     sqlb.set_str("edited_at", "now()");
     let sql = sqlb.sql().map_err(|e| Error::internal_err(e.to_string()))?;
     let mut tx = user_db.begin(&authed).await?;

backend/windmill-store/src/variables.rs

@@ -96,7 +96,11 @@ async fn list_contextual_variables(
 
 #[derive(Deserialize)]
 struct ListVariableQuery {
-    path_start: Option<String>,
+    pub path_start: Option<String>,
+    pub path: Option<String>,
+    pub description: Option<String>,
+    // filter by matching the non-encrypted value (for non-secrets only)
+    pub value: Option<String>,
 }
 
 async fn list_variables(
@@ -106,33 +110,76 @@ async fn list_variables(
     Query(lq): Query<ListVariableQuery>,
     Query(pagination): Query<Pagination>,
 ) -> JsonResult<Vec<ListableVariable>> {
+    use sql_builder::{bind::Bind, SqlBuilder};
+
     let (per_page, offset) = paginate(pagination);
 
-    let mut tx = user_db.begin(&authed).await?;
+    let mut sqlb = SqlBuilder::select_from("variable")
+        .fields(&[
+            "variable.workspace_id",
+            "variable.path",
+            "CASE WHEN is_secret IS TRUE THEN null ELSE variable.value::text END as value",
+            "is_secret",
+            "variable.description",
+            "variable.extra_perms",
+            "account",
+            "is_oauth",
+            "(now() > account.expires_at) as is_expired",
+            "account.refresh_error",
+            "resource.path IS NOT NULL as is_linked",
+            "account.refresh_token != '' as is_refreshed",
+            "variable.expires_at",
+        ])
+        .left()
+        .join("account")
+        .on(&format!(
+            "variable.account = account.id AND account.workspace_id = '{}'",
+            w_id
+        ))
+        .left()
+        .join("resource")
+        .on(&format!(
+            "resource.path = variable.path AND resource.workspace_id = '{}'",
+            w_id
+        ))
+        .and_where("variable.workspace_id = ?".bind(&w_id))
+        .and_where(&format!(
+            "variable.path NOT LIKE 'u/' || '{}' || '/secret_arg/%'",
+            authed.username
+        ))
+        .order_by("path", false)
+        .limit(per_page)
+        .offset(offset)
+        .clone();
 
-    let rows = sqlx::query_as::<_, ListableVariable>(
-        "SELECT variable.workspace_id, variable.path, CASE WHEN is_secret IS TRUE THEN null ELSE variable.value::text END as value,
-         is_secret, variable.description, variable.extra_perms, account, is_oauth, (now() > account.expires_at) as is_expired,
-         account.refresh_error,
-         resource.path IS NOT NULL as is_linked,
-         account.refresh_token != '' as is_refreshed,
-         variable.expires_at
-         from variable
-         LEFT JOIN account ON variable.account = account.id AND account.workspace_id = $1
-         LEFT JOIN resource ON resource.path = variable.path AND resource.workspace_id = $1
-         WHERE variable.workspace_id = $1 AND variable.path NOT LIKE 'u/' || $2 || '/secret_arg/%'
-            AND variable.path LIKE $3 || '%'
-         ORDER BY path
-         LIMIT $4 OFFSET $5
-",
-    )
-    .bind(&w_id)
-    .bind(&authed.username)
-    .bind(&lq.path_start.unwrap_or_default())
-    .bind(per_page as i32)
-    .bind(offset as i32)
-    .fetch_all(&mut *tx)
-    .await?;
+    if let Some(path_start) = &lq.path_start {
+        sqlb.and_where_like_left("variable.path", path_start);
+    }
+
+    if let Some(path) = &lq.path {
+        sqlb.and_where_eq("variable.path", "?".bind(path));
+    }
+
+    if let Some(description) = &lq.description {
+        sqlb.and_where(&format!(
+            "variable.description ILIKE '%{}%'",
+            description.replace("'", "''")
+        ));
+    }
+
+    if let Some(value) = &lq.value {
+        // Only filter on non-secret variables' value
+        sqlb.and_where(&format!(
+            "(is_secret = FALSE AND variable.value ILIKE '%{}%')",
+            value.replace("'", "''")
+        ));
+    }
+
+    let sql = sqlb.sql().map_err(|e| Error::internal_err(e.to_string()))?;
+    let mut tx = user_db.begin(&authed).await?;
+    let rows = sqlx::query_as::<_, ListableVariable>(&sql)
+        .fetch_all(&mut *tx)
+        .await?;
 
     tx.commit().await?;
     Ok(Json(rows))

backend/windmill-types/src/flows.rs

@@ -540,53 +540,48 @@ impl FlowModule {
     ) -> anyhow::Result<()> {
         for module in modules {
             cb(module)?;
-            match module
+            let module_value = module
                 .get_value()
-                .map_err(|e| anyhow::anyhow!("Module '{}': {}", module.id, e))?
-            {
-                FlowModuleValue::ForloopFlow { modules, .. }
-                | FlowModuleValue::WhileloopFlow { modules, .. } => {
-                    Self::traverse_modules(&modules, cb)?;
-                }
-                FlowModuleValue::BranchOne { branches, default, .. } => {
-                    for branch in branches {
-                        Self::traverse_modules(&branch.modules, cb)?;
-                    }
-                    Self::traverse_modules(&default, cb)?;
-                }
-                FlowModuleValue::BranchAll { branches, .. } => {
-                    for branch in branches {
-                        Self::traverse_modules(&branch.modules, cb)?;
-                    }
-                }
-                FlowModuleValue::AIAgent { tools, .. } => {
-                    for tool in tools {
-                        match &tool.value {
-                            ToolValue::FlowModule(module_value) => match module_value {
-                                FlowModuleValue::ForloopFlow { modules, .. }
-                                | FlowModuleValue::WhileloopFlow { modules, .. } => {
-                                    Self::traverse_modules(&modules, cb)?;
-                                }
-                                FlowModuleValue::BranchOne { branches, default, .. } => {
-                                    for branch in branches {
-                                        Self::traverse_modules(&branch.modules, cb)?;
-                                    }
-                                    Self::traverse_modules(&default, cb)?;
-                                }
-                                FlowModuleValue::BranchAll { branches, .. } => {
-                                    for branch in branches {
-                                        Self::traverse_modules(&branch.modules, cb)?;
-                                    }
-                                }
-                                _ => {}
-                            },
-                            ToolValue::Mcp(_) => {}
-                            ToolValue::Websearch(_) => {}
-                        }
-                    }
-                }
-                _ => {}
+                .map_err(|e| anyhow::anyhow!("Module '{}': {}", module.id, e))?;
+            Self::traverse_module_value(&module_value, cb)?;
+        }
+        Ok(())
+    }
+
+    fn traverse_module_value<C: FnMut(&FlowModule) -> anyhow::Result<()>>(
+        module_value: &FlowModuleValue,
+        cb: &mut C,
+    ) -> anyhow::Result<()> {
+        match module_value {
+            FlowModuleValue::ForloopFlow { modules, .. }
+            | FlowModuleValue::WhileloopFlow { modules, .. } => {
+                Self::traverse_modules(modules, cb)?;
             }
+            FlowModuleValue::BranchOne { branches, default, .. } => {
+                for branch in branches {
+                    Self::traverse_modules(&branch.modules, cb)?;
+                }
+                Self::traverse_modules(default, cb)?;
+            }
+            FlowModuleValue::BranchAll { branches, .. } => {
+                for branch in branches {
+                    Self::traverse_modules(&branch.modules, cb)?;
+                }
+            }
+            FlowModuleValue::AIAgent { tools, .. } => {
+                for tool in tools {
+                    let Some(tool_module) = Option::<FlowModule>::from(tool) else {
+                        continue;
+                    };
+
+                    cb(&tool_module)?;
+                    let tool_value = tool_module
+                        .get_value()
+                        .map_err(|e| anyhow::anyhow!("Tool module '{}': {}", tool_module.id, e))?;
+                    Self::traverse_module_value(&tool_value, cb)?;
+                }
+            }
+            _ => {}
         }
         Ok(())
     }
@@ -1071,7 +1066,10 @@ impl Into<Box<RawValue>> for FlowModuleValue {
     }
 }
 
-pub fn ordered_map<S>(value: &HashMap<String, InputTransform>, serializer: S) -> Result<S::Ok, S::Error>
+pub fn ordered_map<S>(
+    value: &HashMap<String, InputTransform>,
+    serializer: S,
+) -> Result<S::Ok, S::Error>
 where
     S: Serializer,
 {

backend/windmill-worker/src/ai/tools.rs

@@ -3,8 +3,8 @@ use crate::ai::types::McpToolSource;
 use crate::ai::types::*;
 use crate::ai::utils::{
     add_message_to_conversation, execute_mcp_tool, get_step_name_from_flow,
-    update_flow_status_module_with_actions, update_flow_status_module_with_actions_success,
-    FlowContext,
+    is_completed_input_transform, update_flow_status_module_with_actions,
+    update_flow_status_module_with_actions_success, FlowContext,
 };
 use crate::common::OccupancyMetrics;
 use crate::result_processor::handle_non_flow_job_error;
@@ -21,7 +21,6 @@ use serde_json::value::RawValue;
 use std::{collections::HashMap, sync::Arc};
 use uuid::Uuid;
 use windmill_common::ai_types::OpenAIToolCall;
-use windmill_common::flows::InputTransform;
 use windmill_common::jobs::JobPayload;
 
 #[cfg(feature = "mcp")]
@@ -35,15 +34,15 @@ type McpClient = McpClientStub;
 use windmill_common::{
     client::AuthedClient,
     db::DB,
-    error::{to_anyhow, Error},
+    error::Error,
     flow_conversations::MessageType,
     flow_status::AgentAction,
     flows::FlowModuleValue,
     worker::{to_raw_value, Connection},
 };
 use windmill_queue::{
-    get_mini_pulled_job, push, JobCompleted, MiniCompletedJob, MiniPulledJob, PushArgs,
-    PushIsolationLevel,
+    add_completed_job, add_completed_job_error, get_mini_pulled_job, push, MiniCompletedJob,
+    MiniPulledJob, PushArgs, PushIsolationLevel,
 };
 
 /// Context for tool execution containing all required references and state
@@ -54,8 +53,9 @@ pub struct ToolExecutionContext<'a> {
 
     // Job context
     pub job: &'a MiniPulledJob,
-    pub parent_job: &'a Uuid,
+    pub parent_job: Option<&'a Uuid>,
     pub summary: &'a Option<&'a str>,
+    pub flow_step_id_override: Option<&'a str>,
 
     // Execution parameters
     pub client: &'a AuthedClient,
@@ -66,7 +66,6 @@ pub struct ToolExecutionContext<'a> {
 
     // Runtime state
     pub occupancy_metrics: &'a mut OccupancyMetrics,
-    pub job_completed_tx: &'a JobCompletedSender,
     pub killpill_rx: &'a mut tokio::sync::broadcast::Receiver<()>,
 
     // Optional streaming & chat
@@ -283,7 +282,9 @@ async fn execute_windmill_tool(
         module_id: tool_module.id.clone(),
     });
 
-    update_flow_status_module_with_actions(ctx.db, ctx.parent_job, actions).await?;
+    if let Some(parent_job) = ctx.parent_job {
+        update_flow_status_module_with_actions(ctx.db, parent_job, actions).await?;
+    }
 
     let raw_tool_call_args = if tool_call.function.arguments.is_empty() {
         "{}".to_string()
@@ -301,11 +302,14 @@ async fn execute_windmill_tool(
         )
     })?;
 
+    let tool_value = tool_module.get_value()?;
+
     // Get input transforms given by the user and merge them with AI given args
-    let input_transforms = match tool_module.get_value()? {
-        FlowModuleValue::Script { input_transforms, .. } => input_transforms,
-        FlowModuleValue::RawScript { input_transforms, .. } => input_transforms,
-        FlowModuleValue::FlowScript { input_transforms, .. } => input_transforms,
+    let input_transforms = match &tool_value {
+        FlowModuleValue::Script { input_transforms, .. }
+        | FlowModuleValue::RawScript { input_transforms, .. }
+        | FlowModuleValue::FlowScript { input_transforms, .. }
+        | FlowModuleValue::AIAgent { input_transforms, .. } => input_transforms,
         _ => {
             return Err(Error::internal_err(format!(
                 "Unsupported tool: {}",
@@ -331,17 +335,8 @@ async fn execute_windmill_tool(
     // Evaluate each input transform and merge with AI-provided args
     for (key, transform) in input_transforms.iter() {
         // We skip static empty / null values, those are the one the AI will fill in
-        match transform {
-            InputTransform::Static { value } => {
-                let val = value.get().trim();
-                if val.is_empty() || val == "null" {
-                    continue;
-                }
-            }
-            InputTransform::Ai => {
-                continue;
-            }
-            _ => (),
+        if !is_completed_input_transform(transform) {
+            continue;
         }
         let result = evaluate_input_transform::<Box<RawValue>>(
             transform,
@@ -356,7 +351,7 @@ async fn execute_windmill_tool(
         tool_call_args.insert(key.clone(), result);
     }
 
-    let job_payload = match tool_module.get_value()? {
+    let job_payload = match tool_value {
         FlowModuleValue::Script { path: script_path, hash: script_hash, tag_override, .. } => {
             script_to_payload(
                 script_hash,
@@ -380,7 +375,6 @@ async fn execute_windmill_tool(
         } => {
             let path = path
                 .unwrap_or_else(|| format!("{}/tools/{}", ctx.job.runnable_path(), tool_module.id));
-
             raw_script_to_payload(
                 path,
                 content,
@@ -394,8 +388,7 @@ async fn execute_windmill_tool(
         }
         FlowModuleValue::FlowScript { id, language, concurrency_settings, tag, .. } => {
             let path = format!("{}/tools/{}", ctx.job.runnable_path(), tool_module.id);
-
-            let payload = JobPayloadWithTag {
+            JobPayloadWithTag {
                 payload: JobPayload::FlowScript {
                     id,
                     language,
@@ -409,8 +402,29 @@ async fn execute_windmill_tool(
                 delete_after_use: tool_module.delete_after_use.unwrap_or(false),
                 timeout: None,
                 on_behalf_of: None,
-            };
-            payload
+            }
+        }
+        FlowModuleValue::AIAgent { tools: sub_tools, .. } => {
+            let has_nested_agent_tools = sub_tools.iter().any(|t| {
+                matches!(
+                    t.value,
+                    windmill_common::flows::ToolValue::FlowModule(FlowModuleValue::AIAgent { .. })
+                )
+            });
+            if has_nested_agent_tools {
+                return Err(Error::internal_err(
+                    "AI agent tools cannot be nested beyond 2 levels. The nested agent tool contains \
+                     AIAgent sub-tools, which would exceed the maximum nesting depth.".to_string()
+                ));
+            }
+            let path = format!("{}/tools/{}", ctx.job.runnable_path(), tool_module.id);
+            JobPayloadWithTag {
+                payload: JobPayload::AIAgent { path },
+                tag: None,
+                delete_after_use: tool_module.delete_after_use.unwrap_or(false),
+                timeout: None,
+                on_behalf_of: None,
+            }
         }
         _ => {
             return Err(Error::internal_err(format!(
@@ -452,8 +466,8 @@ async fn execute_windmill_tool(
         None,
         ctx.job.schedule_path(),
         Some(ctx.job.id),
-        None,
-        None,
+        ctx.job.root_job.or(Some(ctx.job.id)),
+        ctx.job.flow_innermost_root_job.or(Some(ctx.job.id)),
         Some(job_id),
         false,
         false,
@@ -544,7 +558,6 @@ async fn execute_windmill_tool(
     ctx.occupancy_metrics.total_duration_of_running_jobs =
         updated_occupancy.total_duration_of_running_jobs;
 
-    // Continue with match on handle_result
     match handle_result {
         Err(err) => {
             handle_tool_execution_error(
@@ -627,7 +640,9 @@ async fn handle_tool_execution_error(
             .await?;
     }
 
-    update_flow_status_module_with_actions_success(ctx.db, ctx.parent_job, false).await?;
+    if let Some(parent_job) = ctx.parent_job {
+        update_flow_status_module_with_actions_success(ctx.db, parent_job, false).await?;
+    }
 
     // Add tool message to conversation if chat_input_enabled (error case)
     add_tool_message_to_chat(ctx, Some(job_id), &error_message, false).await;
@@ -649,23 +664,50 @@ async fn handle_tool_execution_success(
     let send_result = inner_job_completed_rx.bounded_rx.try_recv().ok();
 
     let result = if let Some(SendResult {
-        result: SendResultPayload::JobCompleted(JobCompleted { result, .. }),
-        ..
-    }) = send_result.as_ref()
+        result: SendResultPayload::JobCompleted(ref jc), ..
+    }) = send_result
     {
-        let result = result.clone();
-        ctx.job_completed_tx
-            .send(send_result.unwrap().result, true)
+        let result = jc.result.clone();
+        // Write tool completion to the DB inline instead of forwarding through
+        // the parent channel. Forwarding would deadlock for nested agents: the
+        // sub-tool result would fill the parent's bounded(1) channel, leaving
+        // no room for the agent's own completion from process_result.
+        if jc.success {
+            add_completed_job(
+                ctx.db,
+                &jc.job,
+                true,
+                false,
+                sqlx::types::Json(&*jc.result),
+                jc.result_columns.clone(),
+                jc.mem_peak,
+                jc.canceled_by.clone(),
+                false,
+                jc.duration,
+                jc.from_cache.unwrap_or(false),
+            )
             .await
-            .map_err(to_anyhow)?;
+            .map_err(|e| Error::internal_err(format!("Failed to add completed job: {e}")))?;
+        } else {
+            let error_value: serde_json::Value =
+                serde_json::from_str(jc.result.get()).unwrap_or_else(|_| {
+                    serde_json::json!({ "message": format!("Non serializable error: {}", jc.result.get()) })
+                });
+            add_completed_job_error(
+                ctx.db,
+                &jc.job,
+                jc.mem_peak,
+                jc.canceled_by.clone(),
+                error_value,
+                ctx.worker_name,
+                false,
+                jc.duration,
+            )
+            .await
+            .map_err(|e| Error::internal_err(format!("Failed to add completed job error: {e}")))?;
+        }
         result
     } else {
-        if let Some(send_result) = send_result {
-            ctx.job_completed_tx
-                .send(send_result.result, true)
-                .await
-                .map_err(to_anyhow)?;
-        }
         return Err(Error::internal_err(
             "Tool job completed but no result".to_string(),
         ));
@@ -696,7 +738,9 @@ async fn handle_tool_execution_success(
             .await?;
     }
 
-    update_flow_status_module_with_actions_success(ctx.db, ctx.parent_job, success).await?;
+    if let Some(parent_job) = ctx.parent_job {
+        update_flow_status_module_with_actions_success(ctx.db, parent_job, success).await?;
+    }
 
     // Add tool message to conversation if chat_input_enabled
     let content = if success {
@@ -731,8 +775,10 @@ async fn add_tool_message_to_chat(
             .and_then(|fs| fs.memory_id)
         {
             let db_clone = ctx.db.clone();
-            let step_name =
-                get_step_name_from_flow(ctx.summary.as_deref(), ctx.job.flow_step_id.as_deref());
+            let effective_step_id = ctx
+                .flow_step_id_override
+                .or(ctx.job.flow_step_id.as_deref());
+            let step_name = get_step_name_from_flow(ctx.summary.as_deref(), effective_step_id);
             let content = content.to_string();
 
             // Spawn task because we do not need to wait for the result

backend/windmill-worker/src/ai/utils.rs

@@ -62,6 +62,17 @@ pub fn parse_raw_script_schema(
     Ok(to_raw_value(&schema))
 }
 
+pub fn is_completed_input_transform(transform: &InputTransform) -> bool {
+    match transform {
+        InputTransform::Static { value } => {
+            let val = value.get().trim();
+            !val.is_empty() && val != "null"
+        }
+        InputTransform::Javascript { expr } => !expr.trim().is_empty(),
+        InputTransform::Ai => false,
+    }
+}
+
 /// Filters out properties from a JSON schema that have completed input transforms.
 /// This allows AI agents to only see and fill parameters that don't have user-configured values.
 pub fn filter_schema_by_input_transforms(
@@ -77,14 +88,7 @@ pub fn filter_schema_by_input_transforms(
     let keys_to_remove: HashSet<String> = input_transforms
         .iter()
         .filter_map(|(key, transform)| {
-            let is_completed = match transform {
-                InputTransform::Static { value } => {
-                    let val = value.get().trim();
-                    !val.is_empty() && val != "null"
-                }
-                InputTransform::Javascript { expr } => !expr.trim().is_empty(),
-                InputTransform::Ai => false,
-            };
+            let is_completed = is_completed_input_transform(transform);
             if is_completed {
                 Some(key.clone())
             } else {
@@ -123,10 +127,13 @@ pub fn filter_schema_by_input_transforms(
     Ok(to_raw_value(&schema_value))
 }
 
+#[derive(Clone)]
 pub struct FlowJobRunnableIdAndRawFlow {
     pub runnable_id: Option<ScriptHash>,
     pub raw_flow: Option<sqlx::types::Json<Box<RawValue>>>,
     pub kind: JobKind,
+    pub parent_job: Option<Uuid>,
+    pub flow_step_id: Option<String>,
 }
 
 pub async fn get_flow_job_runnable_and_raw_flow(
@@ -135,7 +142,7 @@ pub async fn get_flow_job_runnable_and_raw_flow(
 ) -> windmill_common::error::Result<FlowJobRunnableIdAndRawFlow> {
     let job = sqlx::query_as!(
         FlowJobRunnableIdAndRawFlow,
-        "SELECT runnable_id as \"runnable_id: ScriptHash\", raw_flow as \"raw_flow: _\", kind as \"kind: _\" FROM v2_job WHERE id = $1",
+        "SELECT runnable_id as \"runnable_id: ScriptHash\", raw_flow as \"raw_flow: _\", kind as \"kind: _\", parent_job, flow_step_id FROM v2_job WHERE id = $1",
         job_id
     )
     .fetch_one(db)
@@ -690,6 +697,7 @@ pub fn any_tool_needs_previous_result(tools: &[Tool]) -> bool {
                     FlowModuleValue::Script { input_transforms, .. } => input_transforms,
                     FlowModuleValue::RawScript { input_transforms, .. } => input_transforms,
                     FlowModuleValue::FlowScript { input_transforms, .. } => input_transforms,
+                    FlowModuleValue::AIAgent { input_transforms, .. } => input_transforms,
                     _ => return false,
                 };
 

backend/windmill-worker/src/ai_executor.rs

@@ -47,7 +47,6 @@ use crate::{
     },
     common::{build_args_map, resolve_job_timeout, OccupancyMetrics, StreamNotifier},
     handle_child::run_future_with_polling_update_job_poller,
-    JobCompletedSender,
 };
 
 lazy_static::lazy_static! {
@@ -79,11 +78,57 @@ lazy_static::lazy_static! {
             })
             .unwrap_or_default()
     };
+
+    static ref AI_AGENT_TOOL_SCHEMA: Box<RawValue> = to_raw_value(&serde_json::json!({
+        "type": "object",
+        "properties": {
+            "user_message": { "type": "string" },
+        },
+        "required": ["user_message"],
+        "additionalProperties": false,
+    }));
 }
 
 const DEFAULT_MAX_AGENT_ITERATIONS: usize = 10;
 const HARD_MAX_AGENT_ITERATIONS: usize = 1000;
 
+fn find_module_by_id(
+    modules: &Vec<FlowModule>,
+    target_id: &str,
+) -> Result<Option<FlowModule>, Error> {
+    let mut found: Option<FlowModule> = None;
+    FlowModule::traverse_modules(modules, &mut |module| {
+        if found.is_none() && module.id == target_id {
+            found = Some(module.clone());
+        }
+        Ok(())
+    })
+    .map_err(|e| Error::internal_err(format!("Failed to traverse flow modules: {e}")))?;
+    Ok(found)
+}
+
+fn find_ai_agent_tool_module_in_parent_agent(
+    modules: &Vec<FlowModule>,
+    parent_agent_step_id: &str,
+    tool_module_id: &str,
+) -> Result<Option<FlowModule>, Error> {
+    let Some(parent_agent_module) = find_module_by_id(modules, parent_agent_step_id)? else {
+        return Ok(None);
+    };
+
+    let FlowModuleValue::AIAgent { tools, .. } = parent_agent_module.get_value()? else {
+        return Ok(None);
+    };
+
+    for tool in tools {
+        if tool.id == tool_module_id {
+            return Ok(Option::<FlowModule>::from(&tool));
+        }
+    }
+
+    Ok(None)
+}
+
 pub async fn handle_ai_agent_job(
     // connection
     conn: &Connection,
@@ -97,7 +142,6 @@ pub async fn handle_ai_agent_job(
     canceled_by: &mut Option<CanceledBy>,
     mem_peak: &mut i32,
     occupancy_metrics: &mut OccupancyMetrics,
-    job_completed_tx: &JobCompletedSender,
     worker_dir: &str,
     base_internal_url: &str,
     worker_name: &str,
@@ -117,26 +161,57 @@ pub async fn handle_ai_agent_job(
         return handle_credentials_check(&args.provider).await;
     }
 
-    let Some(flow_step_id) = &job.flow_step_id else {
-        return Err(Error::internal_err(
-            "AI agent job has no flow step id".to_string(),
-        ));
-    };
+    // flow_step_id is set by the flow executor for top-level AI agents.
+    // For nested AI agent tools, it's not set (to avoid triggering flow step
+    // machinery on a parent that has no v2_job_status row), so we extract the
+    // tool module ID from the runnable_path which has the form ".../tools/{id}".
+    let flow_step_id = job
+        .flow_step_id
+        .as_deref()
+        .or_else(|| job.runnable_path().rsplit_once("/tools/").map(|(_, id)| id))
+        .ok_or_else(|| Error::internal_err("AI agent job has no flow step id".to_string()))?
+        .to_string();
+    let flow_step_id = &flow_step_id;
 
-    let Some(parent_job) = &job.parent_job else {
+    let Some(immediate_parent_job) = &job.parent_job else {
         return Err(Error::internal_err(
             "AI agent job has no parent job".to_string(),
         ));
     };
 
-    let flow_job = get_flow_job_runnable_and_raw_flow(db, &parent_job).await?;
+    let mut flow_job_id = *immediate_parent_job;
+    let mut flow_job = get_flow_job_runnable_and_raw_flow(db, &flow_job_id).await?;
+    let direct_parent_job_kind = flow_job.kind;
+    let direct_parent_job_flow_step_id = flow_job.flow_step_id.clone();
+
+    // If the direct parent is an AI agent (nested tool case), go one level up to the flow.
+    if flow_job.kind == JobKind::AIAgent {
+        let Some(parent_job_id) = flow_job.parent_job else {
+            return Err(Error::internal_err(
+                "AI agent parent has no parent job".to_string(),
+            ));
+        };
+        flow_job_id = parent_job_id;
+        flow_job = get_flow_job_runnable_and_raw_flow(db, &flow_job_id).await?;
+
+        if !matches!(
+            flow_job.kind,
+            JobKind::Flow | JobKind::FlowNode | JobKind::FlowPreview
+        ) {
+            return Err(Error::internal_err(
+                "AI agent nesting beyond 2 levels is not supported. \
+                 Only flow → agent → nested agent tool is allowed."
+                    .to_string(),
+            ));
+        }
+    }
 
     let flow_data = match flow_job.kind {
         JobKind::Flow | JobKind::FlowNode => {
             cache::job::fetch_flow(db, &flow_job.kind, flow_job.runnable_id).await?
         }
         JobKind::FlowPreview => {
-            cache::job::fetch_preview_flow(db, &parent_job, flow_job.raw_flow).await?
+            cache::job::fetch_preview_flow(db, &flow_job_id, flow_job.raw_flow).await?
         }
         _ => {
             return Err(Error::internal_err(
@@ -147,8 +222,18 @@ pub async fn handle_ai_agent_job(
 
     let value = flow_data.value();
 
-    let module = value.modules.iter().find(|m| m.id == *flow_step_id);
-    let summary = module.as_ref().and_then(|m| m.summary.clone());
+    let module = if direct_parent_job_kind == JobKind::AIAgent {
+        let parent_agent_step_id = direct_parent_job_flow_step_id.as_deref().ok_or_else(|| {
+            Error::internal_err("Parent AI agent job has no flow_step_id".to_string())
+        })?;
+        find_ai_agent_tool_module_in_parent_agent(
+            &value.modules,
+            parent_agent_step_id,
+            flow_step_id,
+        )?
+    } else {
+        find_module_by_id(&value.modules, flow_step_id)?
+    };
 
     let Some(module) = module else {
         return Err(Error::internal_err(
@@ -156,6 +241,8 @@ pub async fn handle_ai_agent_job(
         ));
     };
 
+    let summary = module.summary.clone();
+
     let FlowModuleValue::AIAgent { tools, .. } = module.get_value()? else {
         return Err(Error::internal_err(
             "AI agent module is not an AI agent".to_string(),
@@ -285,6 +372,16 @@ pub async fn handle_ai_agent_job(
                     let schema = Some(parse_raw_script_schema(&content, &language)?);
                     (schema, input_transforms)
                 }
+                FlowModuleValue::AIAgent { input_transforms, .. } => {
+                    // By convention for AIAgent tools, only user_message is expected to be AI-filled.
+                    (
+                        Some(
+                            RawValue::from_string(AI_AGENT_TOOL_SCHEMA.get().to_string())
+                                .expect("AI_AGENT_TOOL_SCHEMA should always be valid JSON"),
+                        ),
+                        input_transforms,
+                    )
+                }
                 _ => {
                     return Err(Error::internal_err(format!(
                         "Unsupported tool: {}",
@@ -342,18 +439,24 @@ pub async fn handle_ai_agent_job(
         stream_notifier.update_flow_status_with_stream_job();
     }
 
+    let flow_status_job = if direct_parent_job_kind == JobKind::AIAgent {
+        None
+    } else {
+        Some(flow_job_id)
+    };
+
     let agent_fut = run_agent(
         db,
         conn,
         job,
-        parent_job,
+        flow_status_job.as_ref(),
+        Some(flow_step_id.as_str()),
         &args,
         &tools,
         &mcp_clients,
         summary.as_deref(),
         client,
         &mut inner_occupancy_metrics,
-        job_completed_tx,
         worker_dir,
         base_internal_url,
         worker_name,
@@ -391,7 +494,8 @@ pub async fn run_agent(
 
     // agent job and flow data
     job: &MiniPulledJob,
-    parent_job: &Uuid,
+    parent_job: Option<&Uuid>,
+    flow_step_id_override: Option<&str>,
     args: &AIAgentArgs,
     tools: &[Tool],
     mcp_clients: &HashMap<String, Arc<McpClient>>,
@@ -400,7 +504,6 @@ pub async fn run_agent(
     // job execution context
     client: &AuthedClient,
     occupancy_metrics: &mut OccupancyMetrics,
-    job_completed_tx: &JobCompletedSender,
     worker_dir: &str,
     base_internal_url: &str,
     worker_name: &str,
@@ -433,6 +536,10 @@ pub async fn run_agent(
             vec![]
         };
 
+    // Effective flow_step_id: override for nested agents, otherwise from job
+    let effective_flow_step_id: Option<&str> =
+        flow_step_id_override.or(job.flow_step_id.as_deref());
+
     // Fetch flow context for input transforms context, chat and memory
     let mut flow_context = get_flow_context(db, job).await;
 
@@ -479,7 +586,7 @@ pub async fn run_agent(
             }
             Some(Memory::Auto { context_length, .. }) => {
                 // Auto mode: load from memory
-                if let Some(step_id) = job.flow_step_id.as_deref() {
+                if let Some(step_id) = effective_flow_step_id {
                     if let Some(memory_id) = memory_id {
                         // Read messages from memory
                         match read_from_memory(db, &job.workspace_id, memory_id, step_id).await {
@@ -534,9 +641,8 @@ pub async fn run_agent(
     let id_context = {
         if let Some(ref flow_status) = flow_context.flow_status {
             // Get the step ID from the AI agent's flow step
-            let previous_id = job
-                .flow_step_id
-                .clone()
+            let previous_id = effective_flow_step_id
+                .map(str::to_string)
                 .unwrap_or_else(|| "unknown".to_string());
 
             Some(get_transform_context(job, &previous_id, flow_status))
@@ -649,7 +755,7 @@ pub async fn run_agent(
         .and_then(|fs| fs.chat_input_enabled)
         .unwrap_or(false);
 
-    let step_name = get_step_name_from_flow(summary.as_deref(), job.flow_step_id.as_deref());
+    let step_name = get_step_name_from_flow(summary.as_deref(), effective_flow_step_id);
 
     let max_iterations = args
         .max_iterations
@@ -881,8 +987,11 @@ pub async fn run_agent(
                         ..Default::default()
                     });
 
-                    update_flow_status_module_with_actions(db, parent_job, &actions).await?;
-                    update_flow_status_module_with_actions_success(db, parent_job, true).await?;
+                    if let Some(parent_job) = parent_job {
+                        update_flow_status_module_with_actions(db, parent_job, &actions).await?;
+                        update_flow_status_module_with_actions_success(db, parent_job, true)
+                            .await?;
+                    }
 
                     content = Some(OpenAIContent::Text(response_content.clone()));
 
@@ -940,13 +1049,13 @@ pub async fn run_agent(
                     job,
                     parent_job,
                     summary: &summary,
+                    flow_step_id_override,
                     client,
                     worker_dir,
                     base_internal_url,
                     worker_name,
                     hostname,
                     occupancy_metrics,
-                    job_completed_tx,
                     killpill_rx,
                     stream_event_processor: stream_event_processor.as_ref(),
                     flow_context: &mut flow_context,
@@ -1071,7 +1180,7 @@ pub async fn run_agent(
     // final_messages contains the complete history (old messages + new ones)
     if matches!(output_type, OutputType::Text) && !use_manual_messages {
         if let Some(Memory::Auto { context_length, .. }) = &args.memory {
-            if let Some(step_id) = job.flow_step_id.as_deref() {
+            if let Some(step_id) = effective_flow_step_id {
                 // Extract OpenAIMessages from final_messages
                 let all_messages: Vec<OpenAIMessage> =
                     final_messages.iter().map(|m| m.message.clone()).collect();

backend/windmill-worker/src/worker.rs

@@ -3398,7 +3398,6 @@ pub async fn handle_queued_job(
                         &mut canceled_by,
                         &mut mem_peak,
                         &mut *occupancy_metrics,
-                        &job_completed_tx,
                         worker_dir,
                         base_internal_url,
                         worker_name,

cli/package-lock.json

@@ -6,16 +6,11 @@
     "": {
       "name": "wmill-dev",
       "dependencies": {
-        "@ayonli/jsext": "^1.9.0",
         "@cliffy/ansi": "npm:@jsr/cliffy__ansi@1.0.0",
         "@cliffy/command": "npm:@jsr/cliffy__command@1.0.0",
         "@cliffy/prompt": "npm:@jsr/cliffy__prompt@1.0.0",
         "@cliffy/table": "npm:@jsr/cliffy__table@1.0.0",
-        "@std/encoding": "npm:@jsr/std__encoding@1.0.10",
-        "@std/log": "npm:@jsr/std__log@0.224.14",
-        "@std/path": "npm:@jsr/std__path@1.1.4",
-        "@std/yaml": "npm:@jsr/std__yaml@1.0.10",
-        "@windmill-labs/shared-utils": "npm:@jsr/windmill-labs__shared-utils@1.0.12",
+        "@windmill-labs/shared-utils": "^1.0.12",
         "diff": "^5.2.0",
         "esbuild": "0.24.2",
         "get-port": "7.1.0",
@@ -23,6 +18,7 @@
         "minimatch": "^10.0.0",
         "open": "^10.0.0",
         "svelte": "^5.45.2",
+        "tar-stream": "^3.1.7",
         "windmill-parser-wasm-csharp": "*",
         "windmill-parser-wasm-go": "*",
         "windmill-parser-wasm-java": "*",
@@ -44,25 +40,11 @@
       "devDependencies": {
         "@types/diff": "^5.2.3",
         "@types/node": "^22.0.0",
+        "@types/tar-stream": "^3.1.4",
         "@types/ws": "^8.5.0",
         "typescript": "^5.7.0"
       }
     },
-    "node_modules/@ayonli/jsext": {
-      "version": "1.9.0",
-      "resolved": "https://registry.npmjs.org/@ayonli/jsext/-/jsext-1.9.0.tgz",
-      "integrity": "sha512-hIu6lQhoLr5e26lmt+vzopuZffaAyb623r4+8HlN/rhXgm2ywHslzk7UHiATdfDbfPjBARkB6cfXjVEi3aav6g==",
-      "license": "MIT",
-      "dependencies": {
-        "iconv-lite": "^0.6.3",
-        "sudo-prompt": "^9.2.1",
-        "ws": "^8.17.0",
-        "zod": "^3.23.8"
-      },
-      "engines": {
-        "node": ">=14.18"
-      }
-    },
     "node_modules/@cliffy/ansi": {
       "name": "@jsr/cliffy__ansi",
       "version": "1.0.0",
@@ -623,15 +605,6 @@
       "resolved": "https://npm.jsr.io/~/11/@jsr/std__fmt/1.0.9.tgz",
       "integrity": "sha512-YFJJMozmORj2K91c5J9opWeh0VUwrd+Mwb7Pr0FkVCAKVLu2UhT4LyvJqWiyUT+eF+MdfqQ9F7RtQj4bXn9Smw=="
     },
-    "node_modules/@jsr/std__fs": {
-      "version": "1.0.23",
-      "resolved": "https://npm.jsr.io/~/11/@jsr/std__fs/1.0.23.tgz",
-      "integrity": "sha512-e8jspB3M44E5YhWiLCTqibBBTwVmxQaHN06WvFa/elAKm5E/LfAe8Hj5XGNC8P7a0MIPASlNJsnF1bgO/g+aqg==",
-      "dependencies": {
-        "@jsr/std__internal": "^1.0.12",
-        "@jsr/std__path": "^1.1.4"
-      }
-    },
     "node_modules/@jsr/std__internal": {
       "version": "1.0.12",
       "resolved": "https://npm.jsr.io/~/11/@jsr/std__internal/1.0.12.tgz",
@@ -671,38 +644,6 @@
         "@jsr/std__regexp": "^1.0.1"
       }
     },
-    "node_modules/@std/encoding": {
-      "name": "@jsr/std__encoding",
-      "version": "1.0.10",
-      "resolved": "https://npm.jsr.io/~/11/@jsr/std__encoding/1.0.10.tgz",
-      "integrity": "sha512-WK2njnDTyKefroRNk2Ooq7GStp6Y0ccAvr4To+Z/zecRAGe7+OSvH9DbiaHpAKwEi2KQbmpWMOYsdNt+TsdmSw=="
-    },
-    "node_modules/@std/log": {
-      "name": "@jsr/std__log",
-      "version": "0.224.14",
-      "resolved": "https://npm.jsr.io/~/11/@jsr/std__log/0.224.14.tgz",
-      "integrity": "sha512-EHT7E0plakyzk/gxMrwqUf3YGCCxN3Is25QrEh7toYA7qwj46R4qY7cIaDEKy8QqI5JHOFHwWXOClcPK6goIoQ==",
-      "dependencies": {
-        "@jsr/std__fmt": "^1.0.5",
-        "@jsr/std__fs": "^1.0.11",
-        "@jsr/std__io": "^0.225.2"
-      }
-    },
-    "node_modules/@std/path": {
-      "name": "@jsr/std__path",
-      "version": "1.1.4",
-      "resolved": "https://npm.jsr.io/~/11/@jsr/std__path/1.1.4.tgz",
-      "integrity": "sha512-SK4u9H6NVTfolhPdlvdYXfNFefy1W04AEHWJydryYbk+xqzNiVmr5o7TLJLJFqwHXuwMRhwrn+mcYeUfS0YFaA==",
-      "dependencies": {
-        "@jsr/std__internal": "^1.0.12"
-      }
-    },
-    "node_modules/@std/yaml": {
-      "name": "@jsr/std__yaml",
-      "version": "1.0.10",
-      "resolved": "https://npm.jsr.io/~/11/@jsr/std__yaml/1.0.10.tgz",
-      "integrity": "sha512-1WIM023Kvi48pvPE3UO5YcieambLgywUooLhAkkaObIcMB77F/YP2ILdl+vNfik+vElkl9znmuST9AZo8mbCpA=="
-    },
     "node_modules/@stoplight/ordered-object-literal": {
       "version": "1.0.5",
       "resolved": "https://registry.npmjs.org/@stoplight/ordered-object-literal/-/ordered-object-literal-1.0.5.tgz",
@@ -784,6 +725,16 @@
         "undici-types": "~6.21.0"
       }
     },
+    "node_modules/@types/tar-stream": {
+      "version": "3.1.4",
+      "resolved": "https://registry.npmjs.org/@types/tar-stream/-/tar-stream-3.1.4.tgz",
+      "integrity": "sha512-921gW0+g29mCJX0fRvqeHzBlE/XclDaAG0Ousy1LCghsOhvaKacDeRGEVzQP9IPfKn8Vysy7FEXAIxycpc/CMg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/node": "*"
+      }
+    },
     "node_modules/@types/trusted-types": {
       "version": "2.0.7",
       "resolved": "https://registry.npmjs.org/@types/trusted-types/-/trusted-types-2.0.7.tgz",
@@ -852,6 +803,20 @@
         "node": ">= 0.4"
       }
     },
+    "node_modules/b4a": {
+      "version": "1.8.0",
+      "resolved": "https://registry.npmjs.org/b4a/-/b4a-1.8.0.tgz",
+      "integrity": "sha512-qRuSmNSkGQaHwNbM7J78Wwy+ghLEYF1zNrSeMxj4Kgw6y33O3mXcQ6Ie9fRvfU/YnxWkOchPXbaLb73TkIsfdg==",
+      "license": "Apache-2.0",
+      "peerDependencies": {
+        "react-native-b4a": "*"
+      },
+      "peerDependenciesMeta": {
+        "react-native-b4a": {
+          "optional": true
+        }
+      }
+    },
     "node_modules/balanced-match": {
       "version": "4.0.3",
       "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.3.tgz",
@@ -861,6 +826,20 @@
         "node": "20 || >=22"
       }
     },
+    "node_modules/bare-events": {
+      "version": "2.8.2",
+      "resolved": "https://registry.npmjs.org/bare-events/-/bare-events-2.8.2.tgz",
+      "integrity": "sha512-riJjyv1/mHLIPX4RwiK+oW9/4c3TEUeORHKefKAKnZ5kyslbN+HXowtbaVEqt4IMUB7OXlfixcs6gsFeo/jhiQ==",
+      "license": "Apache-2.0",
+      "peerDependencies": {
+        "bare-abort-controller": "*"
+      },
+      "peerDependenciesMeta": {
+        "bare-abort-controller": {
+          "optional": true
+        }
+      }
+    },
     "node_modules/brace-expansion": {
       "version": "5.0.2",
       "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.2.tgz",
@@ -1013,12 +992,27 @@
         "@jridgewell/sourcemap-codec": "^1.4.15"
       }
     },
+    "node_modules/events-universal": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/events-universal/-/events-universal-1.0.1.tgz",
+      "integrity": "sha512-LUd5euvbMLpwOF8m6ivPCbhQeSiYVNb8Vs0fQ8QjXo0JTkEHpz8pxdQf0gStltaPpw0Cca8b39KxvK9cfKRiAw==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "bare-events": "^2.7.0"
+      }
+    },
     "node_modules/fast-deep-equal": {
       "version": "3.1.3",
       "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
       "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==",
       "license": "MIT"
     },
+    "node_modules/fast-fifo": {
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/fast-fifo/-/fast-fifo-1.3.2.tgz",
+      "integrity": "sha512-/d9sfos4yxzpwkDkuN7k2SqFKtYNmCTzgfEpz82x34IM9/zc8KGxQoXg1liNC/izpRM/MBdt44Nmx41ZWqk+FQ==",
+      "license": "MIT"
+    },
     "node_modules/fast-uri": {
       "version": "3.1.0",
       "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.0.tgz",
@@ -1047,18 +1041,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/iconv-lite": {
-      "version": "0.6.3",
-      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.6.3.tgz",
-      "integrity": "sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==",
-      "license": "MIT",
-      "dependencies": {
-        "safer-buffer": ">= 2.1.2 < 3.0.0"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
     "node_modules/immediate": {
       "version": "3.0.6",
       "resolved": "https://registry.npmjs.org/immediate/-/immediate-3.0.6.tgz",
@@ -1263,12 +1245,6 @@
       "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g==",
       "license": "MIT"
     },
-    "node_modules/safer-buffer": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
-      "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==",
-      "license": "MIT"
-    },
     "node_modules/set-immediate-shim": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/set-immediate-shim/-/set-immediate-shim-1.0.1.tgz",
@@ -1278,6 +1254,17 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/streamx": {
+      "version": "2.23.0",
+      "resolved": "https://registry.npmjs.org/streamx/-/streamx-2.23.0.tgz",
+      "integrity": "sha512-kn+e44esVfn2Fa/O0CPFcex27fjIL6MkVae0Mm6q+E6f0hWv578YCERbv+4m02cjxvDsPKLnmxral/rR6lBMAg==",
+      "license": "MIT",
+      "dependencies": {
+        "events-universal": "^1.0.0",
+        "fast-fifo": "^1.3.2",
+        "text-decoder": "^1.1.0"
+      }
+    },
     "node_modules/string_decoder": {
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.1.1.tgz",
@@ -1287,13 +1274,6 @@
         "safe-buffer": "~5.1.0"
       }
     },
-    "node_modules/sudo-prompt": {
-      "version": "9.2.1",
-      "resolved": "https://registry.npmjs.org/sudo-prompt/-/sudo-prompt-9.2.1.tgz",
-      "integrity": "sha512-Mu7R0g4ig9TUuGSxJavny5Rv0egCEtpZRNMrZaYS1vxkiIxGiGUwoezU3LazIQ+KE04hTrTfNPgxU5gzi7F5Pw==",
-      "deprecated": "Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.",
-      "license": "MIT"
-    },
     "node_modules/svelte": {
       "version": "5.53.2",
       "resolved": "https://registry.npmjs.org/svelte/-/svelte-5.53.2.tgz",
@@ -1321,6 +1301,26 @@
         "node": ">=18"
       }
     },
+    "node_modules/tar-stream": {
+      "version": "3.1.7",
+      "resolved": "https://registry.npmjs.org/tar-stream/-/tar-stream-3.1.7.tgz",
+      "integrity": "sha512-qJj60CXt7IU1Ffyc3NJMjh6EkuCFej46zUqJ4J7pqYlThyd9bO0XBTmcOIhSzZJVWfsLks0+nle/j538YAW9RQ==",
+      "license": "MIT",
+      "dependencies": {
+        "b4a": "^1.6.4",
+        "fast-fifo": "^1.2.0",
+        "streamx": "^2.15.0"
+      }
+    },
+    "node_modules/text-decoder": {
+      "version": "1.2.7",
+      "resolved": "https://registry.npmjs.org/text-decoder/-/text-decoder-1.2.7.tgz",
+      "integrity": "sha512-vlLytXkeP4xvEq2otHeJfSQIRyWxo/oZGEbXrtEEF9Hnmrdly59sUbzZ/QgyWuLYHctCHxFF4tRQZNQ9k60ExQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "b4a": "^1.6.4"
+      }
+    },
     "node_modules/tslib": {
       "version": "2.8.1",
       "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
@@ -1484,15 +1484,6 @@
       "resolved": "https://registry.npmjs.org/zimmerframe/-/zimmerframe-1.1.4.tgz",
       "integrity": "sha512-B58NGBEoc8Y9MWWCQGl/gq9xBCe4IiKM0a2x7GZdQKOW5Exr8S1W24J6OgM1njK8xCRGvAJIL/MxXHf6SkmQKQ==",
       "license": "MIT"
-    },
-    "node_modules/zod": {
-      "version": "3.25.76",
-      "resolved": "https://registry.npmjs.org/zod/-/zod-3.25.76.tgz",
-      "integrity": "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ==",
-      "license": "MIT",
-      "funding": {
-        "url": "https://github.com/sponsors/colinhacks"
-      }
     }
   }
 }

cli/src/commands/resource/resource.ts

@@ -1,5 +1,6 @@
-import { stat, writeFile } from "node:fs/promises";
+import { stat, writeFile, readdir, readFile } from "node:fs/promises";
 import { stringify as yamlStringify } from "yaml";
+import nodePath from "node:path";
 
 import {
   GlobalOptions,
@@ -27,6 +28,24 @@ export interface ResourceFile {
   is_oauth?: boolean; // deprecated
 }
 
+async function readFilesetDirectory(dirPath: string): Promise<Record<string, string>> {
+  const result: Record<string, string> = {};
+  async function walk(currentPath: string, prefix: string) {
+    const entries = await readdir(currentPath, { withFileTypes: true });
+    for (const entry of entries) {
+      const entryPath = nodePath.join(currentPath, entry.name);
+      const relPath = prefix ? prefix + "/" + entry.name : entry.name;
+      if (entry.isDirectory()) {
+        await walk(entryPath, relPath);
+      } else if (entry.isFile()) {
+        result[relPath] = await readFile(entryPath, "utf-8");
+      }
+    }
+  }
+  await walk(dirPath, "");
+  return result;
+}
+
 export async function pushResource(
   workspace: string,
   remotePath: string,
@@ -46,7 +65,10 @@ export async function pushResource(
 
   // Helper function to resolve inline content
   const resolveInlineContent = async () => {
-    if (localResource.value["content"]?.startsWith("!inline ")) {
+    if (typeof localResource.value === "string" && localResource.value.startsWith("!inline_fileset ")) {
+      const dirPath = localResource.value.split(" ")[1];
+      localResource.value = await readFilesetDirectory(dirPath.replaceAll("/", SEP));
+    } else if (localResource.value["content"]?.startsWith("!inline ")) {
       const basePath = localResource.value["content"].split(" ")[1];
 
       // If we're processing a branch-specific metadata file, read from branch-specific resource file

cli/src/commands/sync/sync.ts

@@ -38,6 +38,7 @@ import {
   deepEqual,
   fetchRemoteVersion,
   isFileResource,
+  isFilesetResource,
   isRawAppFile,
   isWorkspaceDependencies,
 } from "../../utils/utils.ts";
@@ -484,11 +485,53 @@ export function extractInlineScriptsForApps(
   return [];
 }
 
+type FileResourceTypeInfo = { format_extension: string | null; is_fileset: boolean };
+
+function parseFileResourceTypeMap(
+  raw: Record<string, string | FileResourceTypeInfo>,
+): { formatExtMap: Record<string, string>; filesetMap: Record<string, boolean> } {
+  const formatExtMap: Record<string, string> = {};
+  const filesetMap: Record<string, boolean> = {};
+  for (const [k, v] of Object.entries(raw)) {
+    if (typeof v === "string") {
+      formatExtMap[k] = v;
+      filesetMap[k] = false;
+    } else {
+      if (v.format_extension) {
+        formatExtMap[k] = v.format_extension;
+      }
+      filesetMap[k] = v.is_fileset ?? false;
+    }
+  }
+  return { formatExtMap, filesetMap };
+}
+
+async function findFilesetResourceFile(changePath: string): Promise<string> {
+  // Extract the base path before .fileset/
+  const filesetIdx = changePath.indexOf(".fileset" + SEP);
+  if (filesetIdx === -1) {
+    throw new Error(`Not a fileset resource path: ${changePath}`);
+  }
+  const basePath = changePath.substring(0, filesetIdx);
+  const candidates = [basePath + ".resource.json", basePath + ".resource.yaml"];
+
+  for (const candidate of candidates) {
+    try {
+      const s = await stat(candidate);
+      if (s.isFile()) return candidate;
+    } catch {
+      // not found, try next
+    }
+  }
+  throw new Error(`No resource metadata file found for fileset resource: ${changePath}`);
+}
+
 function ZipFSElement(
   zip: JSZip,
   useYaml: boolean,
   defaultTs: "bun" | "deno",
   resourceTypeToFormatExtension: Record<string, string>,
+  resourceTypeToIsFileset: Record<string, boolean>,
   ignoreCodebaseChanges: boolean,
 ): DynFSElement {
   async function _internal_file(
@@ -860,10 +903,17 @@ function ZipFSElement(
               log.error(`Failed to parse resource.yaml at path: ${p}`);
               throw error;
             }
+            const resourceType = parsed["resource_type"];
             const formatExtension =
-              resourceTypeToFormatExtension[parsed["resource_type"]];
+              resourceTypeToFormatExtension[resourceType];
+            const isFileset = resourceTypeToIsFileset[resourceType] ?? false;
 
-            if (formatExtension) {
+            if (isFileset) {
+              parsed["value"] =
+                "!inline_fileset " +
+                removeSuffix(p.replaceAll(SEP, "/"), ".resource.json") +
+                ".fileset";
+            } else if (formatExtension) {
               parsed["value"]["content"] =
                 "!inline " +
                 removeSuffix(p.replaceAll(SEP, "/"), ".resource.json") +
@@ -918,10 +968,37 @@ function ZipFSElement(
         log.error(`Failed to parse resource file content at path: ${p}`);
         throw error;
       }
+      const resourceType = parsed["resource_type"];
       const formatExtension =
-        resourceTypeToFormatExtension[parsed["resource_type"]];
+        resourceTypeToFormatExtension[resourceType];
+      const isFileset = resourceTypeToIsFileset[resourceType] ?? false;
 
-      if (formatExtension) {
+      if (isFileset && typeof parsed["value"] === "object" && parsed["value"] !== null) {
+        const filesetBasePath =
+          removeSuffix(finalPath, ".resource.json") + ".fileset";
+        // Push directory entry for the fileset
+        r.push({
+          isDirectory: true,
+          path: filesetBasePath,
+          async *getChildren() {
+            for (const [relPath, fileContent] of Object.entries(parsed["value"])) {
+              if (typeof fileContent === "string") {
+                yield {
+                  isDirectory: false,
+                  path: path.join(filesetBasePath, relPath),
+                  async *getChildren() {},
+                  async getContentText() {
+                    return fileContent;
+                  },
+                };
+              }
+            }
+          },
+          async getContentText() {
+            throw new Error("Cannot get content of directory");
+          },
+        });
+      } else if (formatExtension) {
         const fileContent: string = parsed["value"]["content"];
         if (typeof fileContent === "string") {
           r.push({
@@ -1058,6 +1135,7 @@ export async function elementsToMap(
     const path = entry.path;
     if (
       !isFileResource(path) &&
+      !isFilesetResource(path) &&
       !isRawAppFile(path) &&
       !isWorkspaceDependencies(path)
     ) {
@@ -1103,7 +1181,7 @@ export async function elementsToMap(
       }
     }
 
-    if (skips.skipResources && isFileResource(path)) continue;
+    if (skips.skipResources && (isFileResource(path) || isFilesetResource(path))) continue;
 
     const ext = json ? ".json" : ".yaml";
     if (!skips.includeSchedules && path.endsWith(".schedule" + ext)) continue;
@@ -1715,10 +1793,14 @@ export async function pull(
   );
 
   let resourceTypeToFormatExtension: Record<string, string> = {};
+  let resourceTypeToIsFileset: Record<string, boolean> = {};
   try {
-    resourceTypeToFormatExtension = (await wmill.fileResourceTypeToFileExtMap({
+    const raw = (await wmill.fileResourceTypeToFileExtMap({
       workspace: workspace.workspaceId,
-    })) as Record<string, string>;
+    })) as Record<string, string | FileResourceTypeInfo>;
+    const parsed = parseFileResourceTypeMap(raw);
+    resourceTypeToFormatExtension = parsed.formatExtMap;
+    resourceTypeToIsFileset = parsed.filesetMap;
   } catch {
     // ignore
   }
@@ -1745,6 +1827,7 @@ export async function pull(
     !opts.json,
     opts.defaultTs ?? "bun",
     resourceTypeToFormatExtension,
+    resourceTypeToIsFileset,
     true,
   );
 
@@ -2241,10 +2324,14 @@ export async function push(
     ),
   );
   let resourceTypeToFormatExtension: Record<string, string> = {};
+  let resourceTypeToIsFileset: Record<string, boolean> = {};
   try {
-    resourceTypeToFormatExtension = (await wmill.fileResourceTypeToFileExtMap({
+    const raw = (await wmill.fileResourceTypeToFileExtMap({
       workspace: workspace.workspaceId,
-    })) as Record<string, string>;
+    })) as Record<string, string | FileResourceTypeInfo>;
+    const parsed = parseFileResourceTypeMap(raw);
+    resourceTypeToFormatExtension = parsed.formatExtMap;
+    resourceTypeToIsFileset = parsed.filesetMap;
   } catch {
     // ignore
   }
@@ -2269,6 +2356,7 @@ export async function push(
     !opts.json,
     opts.defaultTs ?? "bun",
     resourceTypeToFormatExtension,
+    resourceTypeToIsFileset,
     false,
   );
 
@@ -2587,6 +2675,39 @@ export async function push(
                   continue;
                 }
               }
+              if (isFilesetResource(change.path)) {
+                const resourceFilePath = await findFilesetResourceFile(change.path);
+                if (!alreadySynced.includes(resourceFilePath)) {
+                  alreadySynced.push(resourceFilePath);
+
+                  const newObj = parseFromPath(
+                    resourceFilePath,
+                    await readFile(resourceFilePath, "utf-8"),
+                  );
+
+                  let serverPath = resourceFilePath;
+                  const currentBranch = cachedBranchForPush;
+
+                  if (currentBranch && isBranchSpecificFile(resourceFilePath)) {
+                    serverPath = fromBranchSpecificPath(
+                      resourceFilePath,
+                      currentBranch,
+                    );
+                  }
+
+                  await pushResource(
+                    workspace.workspaceId,
+                    serverPath,
+                    undefined,
+                    newObj,
+                    resourceFilePath,
+                  );
+                  if (stateTarget) {
+                    await writeFile(stateTarget, change.after, "utf-8");
+                  }
+                  continue;
+                }
+              }
               const oldObj = parseFromPath(change.path, change.before);
               const newObj = parseFromPath(change.path, change.after);
 
@@ -2619,7 +2740,8 @@ export async function push(
                 change.path.endsWith(".script.json") ||
                 change.path.endsWith(".script.yaml") ||
                 change.path.endsWith(".lock") ||
-                isFileResource(change.path)
+                isFileResource(change.path) ||
+                isFilesetResource(change.path)
               ) {
                 continue;
               } else if (

cli/src/core/specific_items.ts

@@ -1,6 +1,6 @@
 import { minimatch } from "minimatch";
 import { getCurrentGitBranch, isGitRepository } from "../utils/git.ts";
-import { isFileResource } from "../utils/utils.ts";
+import { isFileResource, isFilesetResource } from "../utils/utils.ts";
 import { SyncOptions } from "./conf.ts";
 import { TRIGGER_TYPES } from "../types.ts";
 
@@ -165,7 +165,7 @@ export function isItemTypeConfigured(path: string, specificItems: SpecificItemsC
     return specificItems.settings !== undefined;
   }
 
-  if (isFileResource(path)) {
+  if (isFileResource(path) || isFilesetResource(path)) {
     return specificItems.resources !== undefined;
   }
 
@@ -219,6 +219,14 @@ export function isSpecificItem(path: string, specificItems: SpecificItemsConfig
     }
   }
 
+  if (isFilesetResource(path)) {
+    const basePathMatch = path.match(/^(.+?)\.fileset[/\\]/);
+    if (basePathMatch && specificItems.resources) {
+      const basePath = basePathMatch[1] + '.resource.yaml';
+      return matchesPatterns(basePath, specificItems.resources);
+    }
+  }
+
   return false;
 }
 

cli/src/types.ts

@@ -14,7 +14,7 @@ import { pushResourceType } from "./commands/resource-type/resource-type.ts";
 import { pushVariable } from "./commands/variable/variable.ts";
 import { yamlOptions } from "./commands/sync/sync.ts";
 import { showDiffs } from "./core/conf.ts";
-import { deepEqual, isFileResource, isWorkspaceDependencies } from "./utils/utils.ts";
+import { deepEqual, isFileResource, isFilesetResource, isWorkspaceDependencies } from "./utils/utils.ts";
 import { pushSchedule } from "./commands/schedule/schedule.ts";
 import { pushWorkspaceUser } from "./commands/user/user.ts";
 import { pushGroup } from "./commands/user/user.ts";
@@ -333,7 +333,7 @@ export function getTypeStrFromPath(
   ) {
     return typeEnding;
   } else {
-    if (isFileResource(p)) {
+    if (isFileResource(p) || isFilesetResource(p)) {
       return "resource";
     }
     throw new Error("Could not infer type of path " + JSON.stringify(parsed));

cli/src/utils/utils.ts

@@ -154,6 +154,11 @@ export function isFileResource(path: string): boolean {
   );
 }
 
+/** Matches children inside a .fileset/ directory, not the directory itself. */
+export function isFilesetResource(path: string): boolean {
+  return path.includes(".fileset/") || path.includes(".fileset\\");
+}
+
 export function isRawAppFile(path: string): boolean {
   return isRawAppPath(path);
 }

cli/test/utils_unit.test.ts

@@ -4,7 +4,7 @@
  */
 
 import { expect, test, describe } from "bun:test";
-import { deepEqual, isFileResource, toCamel, capitalize } from "../src/utils/utils.ts";
+import { deepEqual, isFileResource, isFilesetResource, toCamel, capitalize } from "../src/utils/utils.ts";
 import {
   getTypeStrFromPath,
   removeType,
@@ -156,6 +156,32 @@ describe("isFileResource", () => {
   });
 });
 
+// =============================================================================
+// isFilesetResource
+// =============================================================================
+
+describe("isFilesetResource", () => {
+  test("detects fileset resource paths (unix separator)", () => {
+    expect(isFilesetResource("f/test/my_config.fileset/config.yaml")).toBe(true);
+    expect(isFilesetResource("u/admin/templates.fileset/path/to/file.txt")).toBe(true);
+  });
+
+  test("detects fileset resource paths (windows separator)", () => {
+    expect(isFilesetResource("f\\test\\my_config.fileset\\config.yaml")).toBe(true);
+  });
+
+  test("rejects non-fileset paths", () => {
+    expect(isFilesetResource("f/test/my_resource.resource.yaml")).toBe(false);
+    expect(isFilesetResource("f/test/my_file.resource.file.txt")).toBe(false);
+    expect(isFilesetResource("f/test/my_script.ts")).toBe(false);
+  });
+
+  test("rejects paths ending with .fileset (no child file)", () => {
+    // The directory itself is not a fileset resource file - only children are
+    expect(isFilesetResource("f/test/my_config.fileset")).toBe(false);
+  });
+});
+
 // =============================================================================
 // removeType
 // =============================================================================
@@ -241,6 +267,11 @@ describe("getTypeStrFromPath", () => {
     expect(getTypeStrFromPath("devs.group.yaml")).toBe("group");
   });
 
+  test("detects fileset resource files as resource type", () => {
+    expect(getTypeStrFromPath("f/test/my_config.fileset/config.yaml")).toBe("resource");
+    expect(getTypeStrFromPath("u/admin/templates.fileset/path/to/file.txt")).toBe("resource");
+  });
+
   test("throws for unknown type", () => {
     expect(() => getTypeStrFromPath("f/test/unknown.xyz.yaml")).toThrow();
   });

dev-dashboard/.gitignore

@@ -1,10 +0,0 @@
-node_modules/
-bun.lock
-backend/node_modules/
-backend/bun.lock
-frontend/node_modules/
-frontend/bun.lock
-frontend/dist/
-frontend/.vite/
-public/
-.env

dev-dashboard/README.md

@@ -1,247 +0,0 @@
-# Dev Dashboard
-
-Web-based dashboard for managing Windmill development worktrees. Lets you create, monitor, and interact with multiple isolated development environments, each running its own AI coding agent (Claude or Codex), backend, and frontend.
-
-## Quick start
-
-```bash
-# 1. Install dependencies
-cargo install workmux          # worktree orchestrator
-sudo apt install tmux socat    # (or brew install tmux socat)
-curl -fsSL https://bun.sh/install | bash  # bun >1.3.5 required
-
-# 2. Create the workmux global config
-mkdir -p ~/.config/workmux
-cat > ~/.config/workmux/config.yaml << 'EOF'
-nerdfont: false
-
-sandbox:
-  image: windmill-sandbox
-
-  # Forward R2/AWS credentials into sandbox containers (for screenshot uploads).
-  # The actual values come from dev-dashboard/.env, sourced by dev.sh/run.sh.
-  env_passthrough:
-    - AWS_ACCESS_KEY_ID
-    - AWS_SECRET_ACCESS_KEY
-    - R2_ENDPOINT
-    - R2_BUCKET
-    - R2_PUBLIC_URL
-
-  extra_mounts:
-    # Codex agent credentials
-    - host_path: ~/.codex
-      guest_path: /tmp/.codex
-      writable: true
-    # EE repo access (optional — only needed for enterprise features)
-    - host_path: ~/windmill-ee-private
-      writable: true
-    - host_path: ~/windmill-ee-private__worktrees
-      writable: true
-EOF
-
-# 3. (Optional) Build sandbox image — only needed for agent-yolo profile
-docker build -f Dockerfile.sandbox -t windmill-sandbox .
-
-# 4. Install frontend deps
-cd dev-dashboard/frontend && bun install && cd ..
-
-# 5. Start the dashboard
-./dev.sh                       # dev mode (hot reload), UI on :5112
-# or
-./run.sh                       # production mode (build + serve), UI on :4173
-
-# 6. Open http://localhost:5112
-```
-
-## Architecture
-
-```
-Browser (localhost:5112)
-    │
-    ├── REST API (/api/*)  ──┐
-    └── WebSocket (/ws/*)  ──┤
-                             │
-                    Vite dev proxy
-                             │
-                    Backend (localhost:5111)
-                             │
-              ┌──────────────┼──────────────┐
-              │              │              │
-          workmux CLI    tmux sessions   socat
-          (worktree       (terminal      (port forwarding
-           lifecycle)      access)        for sandboxes)
-```
-
-**Backend** — Bun/TypeScript HTTP + WebSocket server (`backend/src/server.ts`). Exposes two interfaces:
-
-- **REST API** (`/api/*`) — CRUD for worktrees. Wraps the `workmux` CLI to create/remove/merge worktrees and runs `socat` port forwarding for Docker sandbox containers. The `GET /api/worktrees` endpoint enriches each worktree with its directory, assigned ports (from `.env.local`), and whether the backend/frontend services are actually responding.
-- **WebSocket** (`/ws/*`) — Live terminal connection. This is what makes the in-browser terminal work. See [Terminal streaming](#terminal-streaming) below.
-
-**Frontend** — Svelte 5 SPA with Tailwind CSS and xterm.js (`frontend/src/`). Provides a two-panel UI: worktree list sidebar + embedded terminal. Polls the REST API every 5 seconds for status updates. The terminal is rendered by [xterm.js](https://xtermjs.org/), which handles all terminal emulation (escape sequences, colors, cursor, scrollback) in a `<canvas>`/DOM element.
-
-### Terminal streaming
-
-The WebSocket provides a bidirectional bridge between xterm.js in the browser and a tmux session on the server. The data flow:
-
-```
-Browser (xterm.js)  ←— WebSocket —→  Backend  ←— stdin/stdout pipes —→  script (PTY)  ←— tmux attach —→  tmux grouped session
-```
-
-When a worktree is selected, the frontend opens a WebSocket to `/ws/<worktree>` and sends an initial `resize` message with the terminal dimensions. The backend then:
-
-1. Spawns `script -q -c "... tmux attach-session ..." /dev/null` — `script` allocates a real PTY (pseudo-terminal), which is necessary for tmux to produce proper terminal escape sequences, colors, and cursor movement.
-2. The tmux command creates a **grouped session** (`tmux new-session -t <main-session>`), which is a separate "view" into the same tmux windows. This allows the dashboard and a real terminal to view the same worktree simultaneously without fighting over window/pane focus.
-3. An async reader loop reads the PTY's stdout and forwards the data over the WebSocket as `{ type: "output" }` messages, which xterm.js renders.
-4. Keystrokes arrive as `{ type: "input" }` messages and are written to the PTY's stdin pipe.
-5. Resize events trigger `tmux resize-window` to keep dimensions in sync.
-
-Output is also buffered in a scrollback array (up to 5000 chunks) so that reconnecting clients receive recent history immediately.
-
-### Worktree Profiles
-
-When creating a worktree, you pick a profile that determines what runs inside it:
-
-| Profile | What it does |
-|---------|-------------|
-| `full` | Agent + Cargo backend + Vite frontend (uses pane layout from `.workmux.yaml`) |
-| `agent-yolo` | Agent runs inside a Docker sandbox container with `--dangerously-skip-permissions`. Socat forwards the container's ports to the host so they're reachable from your browser. |
-
-## Prerequisites
-
-### Required tools
-
-| Tool | Min version | Purpose |
-|------|-------------|---------|
-| [**bun**](https://bun.sh) | >1.3.5 | Runtime for both backend and frontend dev server |
-| [**workmux**](https://github.com/raine/workmux) | latest | Worktree + tmux orchestration (`cargo install workmux` or see its repo) |
-| **tmux** | 3.x | Terminal multiplexer — workmux manages sessions/windows through it |
-| **socat** | 1.7+ | TCP port forwarding for sandbox containers (only needed for `agent-yolo` profile) |
-| **git** | 2.x | Worktree management |
-| **docker** | 28+ | Only needed for `agent-yolo` sandbox profile |
-
-### Workmux global config
-
-Workmux reads a global config from `~/.config/workmux/config.yaml`. Create it if it doesn't exist:
-
-```yaml
-nerdfont: false
-
-sandbox:
-  image: windmill-sandbox
-  env_passthrough:
-    - AWS_ACCESS_KEY_ID
-    - AWS_SECRET_ACCESS_KEY
-    - R2_ENDPOINT
-    - R2_BUCKET
-    - R2_PUBLIC_URL
-  extra_mounts:
-    - host_path: ~/.codex
-      guest_path: /tmp/.codex
-      writable: true
-    - host_path: ~/windmill-ee-private
-      writable: true
-    - host_path: ~/windmill-ee-private__worktrees
-      writable: true
-```
-
-**Fields:**
-
-- **`nerdfont`** — Set to `true` if your terminal uses a Nerd Font (adds icons to `workmux list` output). Default `false`.
-- **`sandbox.image`** — Docker image used for `agent-yolo` sandboxed worktrees. Must be pre-built with `workmux sandbox build` or pulled with `workmux sandbox pull`.
-- **`sandbox.env_passthrough`** — Host env vars to forward into sandbox containers (global config only). Used here for R2 screenshot upload credentials.
-- **`sandbox.extra_mounts`** — Additional bind mounts into sandbox containers. Mounts Codex credentials and the EE repo for enterprise features.
-
-To build the sandbox image (from the Windmill repo root):
-
-```bash
-docker build -f Dockerfile.sandbox -t windmill-sandbox .
-```
-
-### Workmux project config
-
-The repo-level `.workmux.yaml` at the Windmill root configures how worktrees are created. Key settings:
-
-- **`post_create`** — Runs `./scripts/worktree-env` after creating a worktree, which generates a `.env.local` file with unique `BACKEND_PORT` and `FRONTEND_PORT` assignments so multiple worktrees don't collide.
-- **`panes`** — Defines the tmux pane layout for `full` profile: agent pane (focused), backend pane (`cargo watch`), and frontend pane (`npm run dev`).
-- **`files.copy`** — Copies `backend/.env` and `scripts/` into each new worktree.
-
-## Running
-
-From the `dev-dashboard/` directory:
-
-```bash
-./dev.sh
-```
-
-This starts both backend and frontend, with logs prefixed `[BE]` / `[FE]`. `Ctrl+C` stops both.
-
-You can also start them separately:
-
-```bash
-# Terminal 1: backend (auto-reloads on save)
-cd backend && bun run dev
-
-# Terminal 2: frontend (Vite dev server)
-cd frontend && bun run dev
-```
-
-Open http://localhost:5112 in your browser.
-
-### Cursor IDE integration
-
-The top bar has a **Cursor** button that opens the selected worktree's directory in Cursor IDE via the `cursor://` protocol. Click the gear icon next to it to configure SSH remote host.
-
-By default, clicking the button reuses an existing Cursor window. To always open in a **new window**, add this to your Cursor `settings.json` (`Cmd+Shift+P` → "Preferences: Open Settings (JSON)"):
-
-```json
-"window.openFoldersInNewWindow": "on"
-```
-
-### Keyboard shortcuts
-
-| Shortcut | Action |
-|----------|--------|
-| `Cmd+Up/Down` | Navigate between worktrees |
-| `Cmd+K` | Create new worktree |
-| `Cmd+D` | Remove selected worktree |
-
-### Environment variables
-
-| Variable | Default | Description |
-|----------|---------|-------------|
-| `DASHBOARD_PORT` | `5111` | Backend API port |
-
-The frontend dev server is hardcoded to port `5112` and proxies `/api/*` and `/ws/*` to the backend.
-
-### Screenshot uploads (optional)
-
-Sandbox agents can take screenshots of the frontend UI with Playwright and upload them to a Cloudflare R2 bucket for use in PR descriptions. To enable this, create a `dev-dashboard/.env` file (already gitignored):
-
-```bash
-# Cloudflare R2 credentials — get from:
-# Dashboard → R2 → Manage R2 API Tokens → Create API Token (Object Read & Write, scoped to your bucket)
-AWS_ACCESS_KEY_ID=<your-r2-access-key>
-AWS_SECRET_ACCESS_KEY=<your-r2-secret-key>
-
-# Account ID is on the R2 overview page (right sidebar)
-R2_ENDPOINT=https://<ACCOUNT_ID>.r2.cloudflarestorage.com
-R2_BUCKET=windmill-screenshots
-
-# Enable public access on the bucket (Settings → Public access → r2.dev subdomain)
-R2_PUBLIC_URL=https://pub-<hash>.r2.dev
-```
-
-When these are set, `dev.sh`/`run.sh` source the file and the env vars are inlined onto the `workmux sandbox agent` command. The workmux global config's `env_passthrough` (see [above](#workmux-global-config)) forwards them into the container. The agent's system prompt automatically includes screenshot instructions when R2 is configured.
-
-## API
-
-| Method | Endpoint | Description |
-|--------|----------|-------------|
-| `GET` | `/api/worktrees` | List all worktrees with status, ports, and service health |
-| `POST` | `/api/worktrees` | Create a worktree (`{ branch, profile?, agent?, prompt? }`) |
-| `DELETE` | `/api/worktrees/:name` | Remove a worktree |
-| `POST` | `/api/worktrees/:name/open` | Open/focus a worktree's tmux window |
-| `POST` | `/api/worktrees/:name/close` | Close a worktree's tmux window (keeps the worktree) |
-| `POST` | `/api/worktrees/:name/send` | Send a prompt to the worktree's agent (`{ prompt }`) |
-| `GET` | `/api/worktrees/:name/status` | Get agent status for a worktree |
-| `WS` | `/ws/:worktree` | Terminal WebSocket (xterm.js ↔ tmux) |

dev-dashboard/backend/package.json

@@ -1,13 +0,0 @@
-{
-  "name": "windmill-dev-dashboard-backend",
-  "private": true,
-  "type": "module",
-  "scripts": {
-    "dev": "bun --watch src/server.ts",
-    "start": "bun src/server.ts"
-  },
-  "devDependencies": {
-    "@types/bun": "latest",
-    "typescript": "^5.0.0"
-  }
-}

dev-dashboard/backend/src/env.ts

@@ -1,15 +0,0 @@
-/** Read key=value pairs from a worktree's .env.local file. */
-export function readEnvLocal(wtDir: string): Record<string, string> {
-  try {
-    const content = Bun.spawnSync(["cat", `${wtDir}/.env.local`], { stdout: "pipe" });
-    const text = new TextDecoder().decode(content.stdout).trim();
-    const env: Record<string, string> = {};
-    for (const line of text.split("\n")) {
-      const match = line.match(/^(\w+)=(.*)$/);
-      if (match) env[match[1]] = match[2];
-    }
-    return env;
-  } catch {
-    return {};
-  }
-}

dev-dashboard/backend/src/server.ts

@@ -1,290 +0,0 @@
-import {
-  listWorktrees,
-  getStatus,
-  addWorktree,
-  removeWorktree,
-  openWorktree,
-  mergeWorktree,
-  readEnvLocal,
-  type Profile,
-  type Agent,
-} from "./workmux";
-import { reconcileForwarding, stopAll } from "./socat";
-import {
-  attach,
-  detach,
-  write,
-  resize,
-  selectPane,
-  getScrollback,
-  setCallbacks,
-  clearCallbacks,
-  cleanupStaleSessions,
-} from "./terminal";
-
-const PORT = parseInt(process.env.DASHBOARD_PORT || "5111");
-
-function ts(): string {
-  return new Date().toISOString().slice(11, 23);
-}
-
-/** Map branch name → worktree directory using git worktree list. */
-function getWorktreePaths(): Map<string, string> {
-  const result = Bun.spawnSync(["git", "worktree", "list", "--porcelain"], { stdout: "pipe" });
-  const output = new TextDecoder().decode(result.stdout);
-  const paths = new Map<string, string>();
-  let currentPath = "";
-  for (const line of output.split("\n")) {
-    if (line.startsWith("worktree ")) {
-      currentPath = line.slice("worktree ".length);
-    } else if (line.startsWith("branch ")) {
-      // branch refs/heads/foo → "foo"
-      const branch = line.slice("branch ".length).replace("refs/heads/", "");
-      // Also map by directory basename (workmux uses basename as branch key)
-      const basename = currentPath.split("/").pop() ?? "";
-      paths.set(branch, currentPath);
-      if (basename !== branch) paths.set(basename, currentPath);
-    }
-  }
-  return paths;
-}
-
-/** Check if a port has a service responding (not just a TCP handshake). */
-function isPortListening(port: number): Promise<boolean> {
-  return new Promise((resolve) => {
-    const timeout = setTimeout(() => { resolve(false); }, 1000);
-    fetch(`http://127.0.0.1:${port}/`, { signal: AbortSignal.timeout(1000) })
-      .then((res) => { clearTimeout(timeout); resolve(true); })
-      .catch(() => { clearTimeout(timeout); resolve(false); });
-  });
-}
-
-function jsonResponse(data: unknown, status = 200): Response {
-  return new Response(JSON.stringify(data), {
-    status,
-    headers: { "Content-Type": "application/json" },
-  });
-}
-
-function errorResponse(message: string, status = 500): Response {
-  return jsonResponse({ error: message }, status);
-}
-
-interface WsData {
-  worktree: string;
-  attached: boolean;
-}
-
-function makeCallbacks(ws: { send: (data: string) => void; readyState: number }) {
-  return {
-    onData: (data: string) => {
-      if (ws.readyState <= 1) {
-        ws.send(JSON.stringify({ type: "output", data }));
-      }
-    },
-    onExit: (exitCode: number) => {
-      if (ws.readyState <= 1) {
-        ws.send(JSON.stringify({ type: "exit", exitCode }));
-      }
-    },
-  };
-}
-
-Bun.serve<WsData>({
-  port: PORT,
-  idleTimeout: 255, // seconds; worktree removal can take >10s
-
-  async fetch(req, server) {
-    const url = new URL(req.url);
-
-    const wsMatch = url.pathname.match(/^\/ws\/(.+)$/);
-    if (wsMatch) {
-      const worktree = decodeURIComponent(wsMatch[1]);
-      const upgraded = server.upgrade(req, { data: { worktree, attached: false } });
-      if (upgraded) return undefined as unknown as Response;
-      return new Response("WebSocket upgrade failed", { status: 400 });
-    }
-
-    if (url.pathname.startsWith("/api/")) {
-      return handleApi(req, url);
-    }
-
-    return new Response("Not Found", { status: 404 });
-  },
-
-  websocket: {
-    open(ws) {
-      console.log(`[ws:${ts()}] open worktree=${ws.data.worktree}`);
-    },
-
-    async message(ws, message) {
-      try {
-        const msg = JSON.parse(typeof message === "string" ? message : new TextDecoder().decode(message));
-        const { worktree } = ws.data;
-
-        switch (msg.type) {
-          case "input":
-            write(worktree, msg.data);
-            break;
-          case "selectPane":
-            if (ws.data.attached && typeof msg.pane === "number") {
-              console.log(`[ws:${ts()}] selectPane pane=${msg.pane} worktree=${worktree}`);
-              selectPane(worktree, msg.pane);
-            }
-            break;
-          case "resize":
-            if (!ws.data.attached) {
-              // First resize = client reporting actual dimensions. Spawn now.
-              ws.data.attached = true;
-              console.log(`[ws:${ts()}] first resize (attaching) worktree=${worktree} cols=${msg.cols} rows=${msg.rows}`);
-              try {
-                const initialPane = typeof msg.initialPane === "number" ? msg.initialPane : undefined;
-                if (initialPane !== undefined) {
-                  console.log(`[ws:${ts()}] initialPane=${initialPane} worktree=${worktree}`);
-                }
-                await attach(worktree, msg.cols, msg.rows, initialPane);
-                const { onData, onExit } = makeCallbacks(ws);
-                setCallbacks(worktree, onData, onExit);
-                const scrollback = getScrollback(worktree);
-                console.log(`[ws:${ts()}] attached worktree=${worktree} scrollback=${scrollback.length} bytes`);
-                if (scrollback) {
-                  ws.send(JSON.stringify({ type: "scrollback", data: scrollback }));
-                }
-              } catch (err: unknown) {
-                const errMsg = err instanceof Error ? err.message : String(err);
-                console.log(`[ws:${ts()}] attach failed worktree=${worktree}: ${errMsg}`);
-                ws.send(JSON.stringify({ type: "error", message: errMsg }));
-                ws.close();
-              }
-            } else {
-              resize(worktree, msg.cols, msg.rows);
-            }
-            break;
-        }
-      } catch {
-        // Ignore malformed messages
-      }
-    },
-
-    async close(ws) {
-      console.log(`[ws:${ts()}] close worktree=${ws.data.worktree} attached=${ws.data.attached}`);
-      clearCallbacks(ws.data.worktree);
-      await detach(ws.data.worktree);
-      console.log(`[ws:${ts()}] close complete worktree=${ws.data.worktree}`);
-    },
-  },
-});
-
-async function handleApi(req: Request, url: URL): Promise<Response> {
-  const method = req.method;
-  const parts = url.pathname.slice(5).split("/").filter(Boolean);
-
-  try {
-    // GET /api/worktrees
-    if (parts[0] === "worktrees" && parts.length === 1 && method === "GET") {
-      const [worktrees, status] = await Promise.all([listWorktrees(), getStatus()]);
-      const wtPaths = getWorktreePaths();
-      const merged = await Promise.all(worktrees.map(async (wt) => {
-        const st = status.find(s =>
-          s.worktree.includes(wt.branch) || s.worktree.startsWith(wt.branch)
-        );
-        const wtDir = wtPaths.get(wt.branch);
-        const env = wtDir ? readEnvLocal(wtDir) : {};
-        const backendPort = env.BACKEND_PORT ? parseInt(env.BACKEND_PORT) : null;
-        const frontendPort = env.FRONTEND_PORT ? parseInt(env.FRONTEND_PORT) : null;
-        const [backendRunning, frontendRunning] = await Promise.all([
-          backendPort ? isPortListening(backendPort) : false,
-          frontendPort ? isPortListening(frontendPort) : false,
-        ]);
-        return {
-          ...wt,
-          dir: wtDir ?? null,
-          status: st?.status ?? "",
-          elapsed: st?.elapsed ?? "",
-          title: st?.title ?? "",
-          profile: env.PROFILE || null,
-          agentName: env.AGENT || null,
-          backendPort,
-          frontendPort,
-          backendRunning,
-          frontendRunning,
-        };
-      }));
-      return jsonResponse(merged);
-    }
-
-    // POST /api/worktrees
-    if (parts[0] === "worktrees" && parts.length === 1 && method === "POST") {
-      const body = await req.json() as { branch?: string; prompt?: string; profile?: string; agent?: string };
-      if (!body.branch) {
-        return errorResponse("branch is required", 400);
-      }
-      const validProfiles = ["full", "agent-yolo"] as const;
-      const validAgents = ["claude", "codex"] as const;
-      const profile = validProfiles.includes(body.profile as any) ? body.profile as Profile : "full";
-      const agent = validAgents.includes(body.agent as any) ? body.agent as Agent : "claude";
-      console.log(`[worktree:add] branch=${body.branch} agent=${agent} profile=${profile}${body.prompt ? ` prompt="${body.prompt.slice(0, 80)}"` : ""}`);
-      const result = await addWorktree(body.branch, { prompt: body.prompt, profile, agent });
-      console.log(`[worktree:add] done branch=${body.branch}: ${result}`);
-      return jsonResponse({ message: result }, 201);
-    }
-
-    // DELETE /api/worktrees/:name
-    if (parts[0] === "worktrees" && parts.length === 2 && method === "DELETE") {
-      const name = decodeURIComponent(parts[1]);
-      console.log(`[worktree:rm] name=${name}`);
-      const result = await removeWorktree(name);
-      console.log(`[worktree:rm] done name=${name}: ${result}`);
-      return jsonResponse({ message: result });
-    }
-
-    // POST /api/worktrees/:name/open
-    if (parts[0] === "worktrees" && parts.length === 3 && parts[2] === "open" && method === "POST") {
-      const name = decodeURIComponent(parts[1]);
-      console.log(`[worktree:open] name=${name}`);
-      return jsonResponse({ message: await openWorktree(name) });
-    }
-
-    // POST /api/worktrees/:name/merge
-    if (parts[0] === "worktrees" && parts.length === 3 && parts[2] === "merge" && method === "POST") {
-      const name = decodeURIComponent(parts[1]);
-      console.log(`[worktree:merge] name=${name}`);
-      const result = await mergeWorktree(name);
-      console.log(`[worktree:merge] done name=${name}: ${result}`);
-      return jsonResponse({ message: result });
-    }
-
-    // GET /api/worktrees/:name/status
-    if (parts[0] === "worktrees" && parts.length === 3 && parts[2] === "status" && method === "GET") {
-      const name = decodeURIComponent(parts[1]);
-      const status = await getStatus();
-      const match = status.find(s => s.worktree.includes(name));
-      return jsonResponse(match ?? { status: "unknown" });
-    }
-
-    return errorResponse("Not Found", 404);
-  } catch (err: unknown) {
-    const message = err instanceof Error ? err.message : String(err);
-    console.error(`[api:error] ${method} ${url.pathname}: ${message}`);
-    return errorResponse(message);
-  }
-}
-
-// Ensure tmux server is running (needs at least one session to persist)
-const tmuxCheck = Bun.spawnSync(["tmux", "list-sessions"], { stdout: "pipe", stderr: "pipe" });
-if (tmuxCheck.exitCode !== 0) {
-  Bun.spawnSync(["tmux", "new-session", "-d", "-s", "0"]);
-  console.log("Started tmux session");
-}
-
-cleanupStaleSessions();
-
-// Re-establish socat forwarding for any sandbox containers still running
-const wtPathsForReconcile = getWorktreePaths();
-reconcileForwarding((branch) => wtPathsForReconcile.get(branch));
-
-// Clean shutdown: kill socat processes
-process.on("SIGINT", () => { stopAll(); process.exit(0); });
-process.on("SIGTERM", () => { stopAll(); process.exit(0); });
-
-console.log(`Dev Dashboard API running at http://localhost:${PORT}`);

dev-dashboard/backend/src/socat.ts

@@ -1,130 +0,0 @@
-/**
- * Manages socat port forwarding for sandbox containers.
- *
- * When a worktree runs inside a Docker sandbox, its ports are only reachable
- * via the container's bridge IP. socat forwards host ports to the container
- * so the browser (over SSH) can reach them.
- */
-
-import { $ } from "bun";
-import { readEnvLocal } from "./env";
-
-interface ForwardingEntry {
-  branch: string;
-  containerIp: string;
-  ports: { host: number; proc: ReturnType<typeof Bun.spawn> }[];
-}
-
-const registry = new Map<string, ForwardingEntry>();
-
-/** Get the bridge IP of a running sandbox container for a worktree branch. */
-async function getContainerIp(branch: string): Promise<string | null> {
-  try {
-    // Container names follow the pattern wm-{branch}-*
-    const ps = await $`docker ps --filter name=wm-${branch}- --format {{.ID}}`.text();
-    const containerId = ps.trim().split("\n")[0];
-    if (!containerId) return null;
-    const ip = (await $`docker inspect ${containerId} --format {{.NetworkSettings.IPAddress}}`.text()).trim();
-    return ip || null;
-  } catch {
-    return null;
-  }
-}
-
-/** Start socat forwarding for a sandbox worktree. Returns true if forwarding was started. */
-export async function startForwarding(branch: string, wtDir: string): Promise<boolean> {
-  // Don't double-start
-  if (registry.has(branch)) return true;
-
-  const containerIp = await getContainerIp(branch);
-  if (!containerIp) {
-    return false;
-  }
-
-  const env = readEnvLocal(wtDir);
-  const backendPort = env.BACKEND_PORT ? parseInt(env.BACKEND_PORT) : null;
-  const frontendPort = env.FRONTEND_PORT ? parseInt(env.FRONTEND_PORT) : null;
-
-  const entry: ForwardingEntry = { branch, containerIp, ports: [] };
-
-  for (const port of [backendPort, frontendPort]) {
-    if (!port) continue;
-    const proc = Bun.spawn([
-      "socat",
-      `TCP-LISTEN:${port},fork,reuseaddr`,
-      `TCP:${containerIp}:${port}`,
-    ], { stdout: "ignore", stderr: "pipe" });
-    // Consume the exit promise so Bun reaps the child (prevents zombies)
-    proc.exited.then(() => {});
-    entry.ports.push({ host: port, proc });
-    console.log(`[socat] forwarding :${port} → ${containerIp}:${port} (branch=${branch}, pid=${proc.pid})`);
-  }
-
-  if (entry.ports.length > 0) {
-    registry.set(branch, entry);
-  }
-  return true;
-}
-
-/** Stop socat forwarding for a worktree. */
-export function stopForwarding(branch: string): void {
-  const entry = registry.get(branch);
-  if (!entry) return;
-
-  for (const { host, proc } of entry.ports) {
-    try {
-      proc.kill();
-      console.log(`[socat] stopped :${host} (branch=${branch}, pid=${proc.pid})`);
-    } catch {
-      // Already exited
-    }
-  }
-  registry.delete(branch);
-}
-
-/**
- * Reconcile socat forwarding on startup.
- * Kills any orphaned socat processes from a previous run, then starts
- * forwarding for any running sandbox containers.
- */
-export async function reconcileForwarding(getWorktreeDir: (branch: string) => string | undefined): Promise<void> {
-  try {
-    // Kill orphaned socat processes from previous dashboard runs
-    try {
-      await $`pkill -f ${"socat TCP-LISTEN.*TCP:172\\."}`.quiet();
-      console.log("[socat] reconcile: killed orphaned socat processes");
-    } catch {
-      // No orphans found (pkill exits non-zero when no match)
-    }
-
-    const ps = await $`docker ps --filter name=wm- --format {{.Names}}`.text();
-    const names = ps.trim().split("\n").filter(Boolean);
-
-    for (const name of names) {
-      // Container name format: wm-{branch}-{pid}
-      const match = name.match(/^wm-(.+)-\d+$/);
-      if (!match) continue;
-      const branch = match[1];
-
-      if (registry.has(branch)) continue;
-
-      const wtDir = getWorktreeDir(branch);
-      if (!wtDir) {
-        console.log(`[socat] reconcile: no worktree dir found for ${branch}, skipping`);
-        continue;
-      }
-
-      console.log(`[socat] reconcile: starting forwarding for ${branch}`);
-      await startForwarding(branch, wtDir);
-    }
-  } catch (err) {
-    console.error(`[socat] reconcile failed:`, err);
-  }
-}
-
-/** Stop all forwarding (for clean shutdown). */
-export function stopAll(): void {
-  for (const branch of [...registry.keys()]) {
-    stopForwarding(branch);
-  }
-}

dev-dashboard/backend/src/terminal.ts

@@ -1,212 +0,0 @@
-import { FileSink } from "bun";
-import { getTmuxSession } from "./workmux";
-
-interface TerminalSession {
-  proc: ReturnType<typeof Bun.spawn>;
-  groupedSessionName: string;
-  scrollback: string[];
-  onData: ((data: string) => void) | null;
-  onExit: ((exitCode: number) => void) | null;
-}
-
-const SESSION_PREFIX = "wm-dash-";
-const MAX_SCROLLBACK = 5000;
-const sessions = new Map<string, TerminalSession>();
-let sessionCounter = 0;
-
-function ts(): string {
-  return new Date().toISOString().slice(11, 23);
-}
-
-function groupedName(): string {
-  return `${SESSION_PREFIX}${++sessionCounter}`;
-}
-
-/** Kill any orphaned wm-dash-* tmux sessions left from previous server runs. */
-export function cleanupStaleSessions(): void {
-  try {
-    const result = Bun.spawnSync(
-      ["tmux", "list-sessions", "-F", "#{session_name}"],
-      { stdout: "pipe", stderr: "pipe" }
-    );
-    if (result.exitCode !== 0) return;
-    const lines = new TextDecoder().decode(result.stdout).trim().split("\n");
-    for (const name of lines) {
-      if (name.startsWith(SESSION_PREFIX)) {
-        Bun.spawnSync(["tmux", "kill-session", "-t", name]);
-      }
-    }
-  } catch {
-    // No tmux server running
-  }
-}
-
-/** Kill a tmux session by name, ignoring errors. */
-function killTmuxSession(name: string): void {
-  try {
-    Bun.spawnSync(["tmux", "kill-session", "-t", name]);
-  } catch {}
-}
-
-export async function attach(
-  worktreeName: string,
-  cols: number,
-  rows: number,
-  initialPane?: number
-): Promise<string> {
-  console.log(`[term:${ts()}] attach(${worktreeName}) cols=${cols} rows=${rows} existing=${sessions.has(worktreeName)}`);
-  if (sessions.has(worktreeName)) {
-    console.log(`[term:${ts()}] attach(${worktreeName}) detaching existing session first`);
-    await detach(worktreeName);
-    console.log(`[term:${ts()}] attach(${worktreeName}) detach complete`);
-  }
-
-  const tmuxSession = await getTmuxSession();
-  const gName = groupedName();
-  const windowTarget = `wm-${worktreeName}`;
-  console.log(`[term:${ts()}] attach(${worktreeName}) tmuxSession=${tmuxSession} gName=${gName} window=${windowTarget}`);
-
-  // Kill stale session with same name if it exists (leftover from previous server run)
-  killTmuxSession(gName);
-
-  const paneTarget = `${gName}:${windowTarget}.${initialPane ?? 0}`;
-  const cmd = [
-    `tmux new-session -d -s "${gName}" -t "${tmuxSession}"`,
-    `tmux set-option -t "${gName}" mouse on`,
-    `tmux set-option -t "${gName}" set-clipboard on`,
-    `tmux select-window -t "${gName}:${windowTarget}"`,
-    // Unzoom if a previous session left a pane zoomed (zoom state is shared across grouped sessions)
-    `if [ "$(tmux display-message -t '${gName}:${windowTarget}' -p '#{window_zoomed_flag}')" = "1" ]; then tmux resize-pane -Z -t '${gName}:${windowTarget}'; fi`,
-    `tmux select-pane -t "${paneTarget}"`,
-    // On mobile, zoom the selected pane to fill the window
-    ...(initialPane !== undefined ? [`tmux resize-pane -Z -t "${paneTarget}"`] : []),
-    `stty rows ${rows} cols ${cols}`,
-    `exec tmux attach-session -t "${gName}"`,
-  ].join(" && ");
-
-  const session: TerminalSession = {
-    proc: null as any,
-    groupedSessionName: gName,
-    scrollback: [],
-    onData: null,
-    onExit: null,
-  };
-
-  sessions.set(worktreeName, session);
-
-  const proc = Bun.spawn(["script", "-q", "-c", cmd, "/dev/null"], {
-    stdin: "pipe",
-    stdout: "pipe",
-    stderr: "pipe",
-    env: { ...process.env, TERM: "xterm-256color" },
-  });
-
-  session.proc = proc;
-  console.log(`[term:${ts()}] attach(${worktreeName}) spawned pid=${proc.pid}`);
-
-  // Read stdout → push to scrollback + callback
-  (async () => {
-    const reader = proc.stdout.getReader();
-    try {
-      while (true) {
-        const { done, value } = await reader.read();
-        if (done) break;
-        const str = new TextDecoder().decode(value);
-        session.scrollback.push(str);
-        if (session.scrollback.length > MAX_SCROLLBACK) {
-          session.scrollback.shift();
-        }
-        session.onData?.(str);
-      }
-    } catch {
-      // Stream closed
-    }
-  })();
-
-  proc.exited.then((exitCode) => {
-    console.log(`[term:${ts()}] proc exited(${worktreeName}) pid=${proc.pid} code=${exitCode}`);
-    // Only clean up if this session is still the active one (not replaced by a new attach)
-    if (sessions.get(worktreeName) === session) {
-      session.onExit?.(exitCode);
-      sessions.delete(worktreeName);
-    } else {
-      console.log(`[term:${ts()}] proc exited(${worktreeName}) stale session, skipping cleanup`);
-    }
-    killTmuxSession(gName);
-  });
-
-  return worktreeName;
-}
-
-export async function detach(worktreeName: string): Promise<void> {
-  const session = sessions.get(worktreeName);
-  if (!session) {
-    console.log(`[term:${ts()}] detach(${worktreeName}) no session found`);
-    return;
-  }
-
-  console.log(`[term:${ts()}] detach(${worktreeName}) killing pid=${session.proc.pid} tmux=${session.groupedSessionName}`);
-  session.proc.kill();
-  sessions.delete(worktreeName);
-
-  killTmuxSession(session.groupedSessionName);
-  console.log(`[term:${ts()}] detach(${worktreeName}) done`);
-}
-
-export function write(worktreeName: string, data: string): void {
-  const session = sessions.get(worktreeName);
-  if (!session) {
-    console.log(`[term:${ts()}] write(${worktreeName}) NO SESSION - input dropped (${data.length} bytes)`);
-    return;
-  }
-  if (!session.proc.stdin) {
-    console.log(`[term:${ts()}] write(${worktreeName}) NO STDIN - input dropped (${data.length} bytes)`);
-    return;
-  }
-  (session.proc.stdin as FileSink).write(new TextEncoder().encode(data));
-}
-
-export function resize(worktreeName: string, cols: number, rows: number): void {
-  const session = sessions.get(worktreeName);
-  if (!session) return;
-  // Resize via tmux directly (we don't have access to script's internal PTY)
-  Bun.spawnSync(["tmux", "resize-window", "-t", session.groupedSessionName, "-x", String(cols), "-y", String(rows)]);
-}
-
-export function getScrollback(worktreeName: string): string {
-  return sessions.get(worktreeName)?.scrollback.join("") ?? "";
-}
-
-export function setCallbacks(
-  worktreeName: string,
-  onData: (data: string) => void,
-  onExit: (exitCode: number) => void
-): void {
-  const session = sessions.get(worktreeName);
-  if (session) {
-    session.onData = onData;
-    session.onExit = onExit;
-  }
-}
-
-export function selectPane(worktreeName: string, paneIndex: number): void {
-  const session = sessions.get(worktreeName);
-  if (!session) {
-    console.log(`[term:${ts()}] selectPane(${worktreeName}) no session found`);
-    return;
-  }
-  const windowTarget = `wm-${worktreeName}`;
-  const target = `${session.groupedSessionName}:${windowTarget}.${paneIndex}`;
-  console.log(`[term:${ts()}] selectPane(${worktreeName}) pane=${paneIndex} target=${target}`);
-  const r1 = Bun.spawnSync(["tmux", "select-pane", "-t", target]);
-  const r2 = Bun.spawnSync(["tmux", "resize-pane", "-Z", "-t", target]);
-  console.log(`[term:${ts()}] selectPane(${worktreeName}) select=${r1.exitCode} zoom=${r2.exitCode}`);
-}
-
-export function clearCallbacks(worktreeName: string): void {
-  const session = sessions.get(worktreeName);
-  if (session) {
-    session.onData = null;
-    session.onExit = null;
-  }
-}

dev-dashboard/backend/src/workmux.ts

@@ -1,272 +0,0 @@
-import { $ } from "bun";
-import { startForwarding, stopForwarding } from "./socat";
-import { readEnvLocal } from "./env";
-
-export interface Worktree {
-  branch: string;
-  agent: string;
-  mux: string;
-  unmerged: string;
-  path: string;
-}
-
-export interface WorktreeStatus {
-  worktree: string;
-  status: string;
-  elapsed: string;
-  title: string;
-}
-
-function parseTable<T>(output: string, mapper: (cols: string[]) => T): T[] {
-  const lines = output.trim().split("\n").filter(Boolean);
-  if (lines.length < 2) return [];
-
-  const headerLine = lines[0];
-
-  // Find column positions based on header spacing
-  const colStarts: number[] = [];
-  let inSpace = true;
-  for (let i = 0; i < headerLine.length; i++) {
-    if (headerLine[i] !== " " && inSpace) {
-      colStarts.push(i);
-      inSpace = false;
-    } else if (headerLine[i] === " " && !inSpace) {
-      inSpace = true;
-    }
-  }
-
-  return lines.slice(1).map(line => {
-    const cols = colStarts.map((start, idx) => {
-      const end = idx + 1 < colStarts.length ? colStarts[idx + 1] : line.length;
-      return line.slice(start, end).trim();
-    });
-    return mapper(cols);
-  });
-}
-
-export async function listWorktrees(): Promise<Worktree[]> {
-  const result = await $`workmux list`.text();
-  return parseTable(result, (cols) => ({
-    branch: cols[0] ?? "",
-    agent: cols[1] ?? "",
-    mux: cols[2] ?? "",
-    unmerged: cols[3] ?? "",
-    path: cols[4] ?? "",
-  }));
-}
-
-export async function getStatus(): Promise<WorktreeStatus[]> {
-  const result = await $`workmux status`.text();
-  return parseTable(result, (cols) => ({
-    worktree: cols[0] ?? "",
-    status: cols[1] ?? "",
-    elapsed: cols[2] ?? "",
-    title: cols[3] ?? "",
-  }));
-}
-
-async function runChecked(args: string[]): Promise<string> {
-  const proc = Bun.spawn(args, { stdout: "pipe", stderr: "pipe" });
-  const stdout = await new Response(proc.stdout).text();
-  const stderr = await new Response(proc.stderr).text();
-  const exitCode = await proc.exited;
-
-  if (exitCode !== 0) {
-    const msg = `${args.join(" ")} failed (exit ${exitCode}): ${stderr || stdout}`;
-    console.error(`[workmux:exec] ${msg}`);
-    throw new Error(msg);
-  }
-  return stdout.trim();
-}
-
-export type Profile = "full" | "agent-yolo";
-export type Agent = "claude" | "codex";
-
-export { readEnvLocal } from "./env";
-
-function buildSandboxSystemPrompt(env: Record<string, string>): string {
-  const backendPort = env.BACKEND_PORT || "8000";
-  const frontendPort = env.FRONTEND_PORT || "3000";
-  const hasR2 = !!(process.env.R2_ENDPOINT && process.env.R2_BUCKET && process.env.R2_PUBLIC_URL);
-  console.log(`[workmux:buildSandboxSystemPrompt] hasR2=${hasR2}`);
-  const lines: string[] = [
-    "You are running inside a sandboxed container with full permissions.",
-    `This worktree is configured with the following ports:`,
-    `- Backend: port ${backendPort}. Start with: cd backend && PORT=${backendPort} DATABASE_URL=postgres://postgres:changeme@localhost:5432/windmill cargo watch -x run`,
-    `- Frontend: port ${frontendPort}. Start with: cd frontend && REMOTE=http://localhost:${backendPort} npm run dev -- --port ${frontendPort} --host 0.0.0.0`,
-  ];
-  if (hasR2) {
-    lines.push(
-      `--- Screenshots ---`,
-      `You can take screenshots of the frontend UI and upload them to R2 for use in PR descriptions.`,
-      `1) Take a screenshot: bunx playwright screenshot --browser chromium http://localhost:${frontendPort}/path/to/page /tmp/screenshot.png`,
-      `2) Upload to R2: aws s3 cp /tmp/screenshot.png "s3://$(printenv R2_BUCKET)/$(git rev-parse --abbrev-ref HEAD)/screenshot.png" --endpoint-url "$(printenv R2_ENDPOINT)"`,
-      `3) The public URL will be: $(printenv R2_PUBLIC_URL)/<branch>/screenshot.png`,
-      `4) Include screenshots in PR descriptions as markdown images: ![description]($(printenv R2_PUBLIC_URL)/<branch>/screenshot.png)`,
-    );
-  }
-  return lines.join(" ");
-}
-
-/** Env vars to forward into the sandbox container (via workmux env_passthrough). */
-const SANDBOX_ENV_PASSTHROUGH = [
-  "AWS_ACCESS_KEY_ID",
-  "AWS_SECRET_ACCESS_KEY",
-  "R2_ENDPOINT",
-  "R2_BUCKET",
-  "R2_PUBLIC_URL",
-];
-
-/** Build an inline env prefix (e.g. "KEY=val KEY2=val2 ") from process.env. */
-function buildEnvPrefix(): string {
-  const parts: string[] = [];
-  for (const key of SANDBOX_ENV_PASSTHROUGH) {
-    const val = process.env[key];
-    if (val) {
-      // Shell-escape the value (single quotes, escaping inner single quotes)
-      const escaped = val.replace(/'/g, "'\\''");
-      parts.push(`${key}='${escaped}'`);
-    }
-  }
-  return parts.length > 0 ? parts.join(" ") + " " : "";
-}
-
-function buildSandboxAgentCmd(env: Record<string, string>, agent: Agent): string {
-  const prompt = buildSandboxSystemPrompt(env);
-  const innerEscaped = prompt.replace(/["\\$`]/g, "\\$&");
-  const envPrefix = buildEnvPrefix();
-
-  if (agent === "codex") {
-    return `${envPrefix}workmux sandbox agent -- codex --yolo -c '"developer_instructions=${innerEscaped}"'`;
-  }
-  return `${envPrefix}workmux sandbox agent -- claude --dangerously-skip-permissions --append-system-prompt '"${innerEscaped}"'`;
-}
-
-function ensureTmux(): void {
-  const check = Bun.spawnSync(["tmux", "list-sessions"], { stdout: "pipe", stderr: "pipe" });
-  if (check.exitCode !== 0) {
-    Bun.spawnSync(["tmux", "new-session", "-d", "-s", "0"]);
-    console.log("[workmux] restarted tmux session");
-  }
-}
-
-export async function addWorktree(
-  branch: string,
-  opts?: { prompt?: string; profile?: Profile; agent?: Agent }
-): Promise<string> {
-  ensureTmux();
-  const profile = opts?.profile ?? "full";
-  const agent = opts?.agent ?? "claude";
-  const args: string[] = ["workmux", "add", "-b"]; // -b = background (don't switch tmux)
-
-  // Skip default pane commands for non-full profiles
-  if (profile !== "full") {
-    args.push("-C"); // --no-pane-cmds
-  }
-
-  // Enable sandbox for yolo profile (safe to skip permissions inside container)
-  if (profile === "agent-yolo") {
-    args.push("-S"); // --sandbox
-  }
-
-  if (opts?.prompt) args.push("-p", opts.prompt);
-  args.push(branch);
-
-  console.log(`[workmux:add] running: ${args.join(" ")}`);
-  const result = await runChecked(args);
-  console.log(`[workmux:add] result: ${result}`);
-
-  const windowTarget = `wm-${branch}`;
-
-  // Read worktree dir and log assigned ports
-  const wtDirResult = Bun.spawnSync(
-    ["tmux", "display-message", "-t", `${windowTarget}.0`, "-p", "#{pane_current_path}"],
-    { stdout: "pipe" }
-  );
-  const wtDir = new TextDecoder().decode(wtDirResult.stdout).trim();
-  const env = readEnvLocal(wtDir);
-  console.log(`[workmux:add] branch=${branch} dir=${wtDir} ports: backend=${env.BACKEND_PORT || "8000"} frontend=${env.FRONTEND_PORT || "3000"}`);
-
-  // Append profile to .env.local (worktree-env creates it, we just add to it)
-  if (wtDir) {
-    const envPath = `${wtDir}/.env.local`;
-    const existing = await Bun.file(envPath).text().catch(() => "");
-    if (!existing.includes("PROFILE=")) {
-      await Bun.write(envPath, existing.trimEnd() + `\nPROFILE=${profile}\nAGENT=${agent}\n`);
-    }
-  }
-
-  // For non-full profiles, kill extra panes and send commands
-  if (profile !== "full") {
-    // Kill extra panes (highest index first to avoid shifting)
-    const paneCountResult = Bun.spawnSync(
-      ["tmux", "list-panes", "-t", windowTarget, "-F", "#{pane_index}"],
-      { stdout: "pipe" }
-    );
-    const paneIds = new TextDecoder().decode(paneCountResult.stdout).trim().split("\n");
-    // Kill all panes except pane 0
-    for (let i = paneIds.length - 1; i >= 1; i--) {
-      Bun.spawnSync(["tmux", "kill-pane", "-t", `${windowTarget}.${paneIds[i]}`]);
-    }
-    // Build and send agent command for sandbox (env vars are inlined as a prefix)
-    const agentCmd = buildSandboxAgentCmd(env, agent);
-    console.log(`[workmux] sending command to ${windowTarget}.0:\n${agentCmd}`);
-    Bun.spawnSync(["tmux", "send-keys", "-t", `${windowTarget}.0`, agentCmd, "Enter"]);
-    // Open a shell pane on the right (1/3 width) in the worktree dir
-    Bun.spawnSync(["tmux", "split-window", "-h", "-t", `${windowTarget}.0`, "-l", "25%", "-c", wtDir]);
-    // Keep focus on the agent pane (left)
-    Bun.spawnSync(["tmux", "select-pane", "-t", `${windowTarget}.0`]);
-
-    // Start socat port forwarding for sandbox containers (non-blocking).
-    // The container takes a few seconds to start after the tmux command is sent,
-    // so we poll in the background rather than blocking the API response.
-    if (profile === "agent-yolo" && wtDir) {
-      (async () => {
-        console.log(`[socat] waiting for container to start for ${branch}...`);
-        for (let i = 1; i <= 15; i++) {
-          await new Promise(r => setTimeout(r, 2000));
-          if (await startForwarding(branch, wtDir)) return;
-          console.log(`[socat] container not ready for ${branch}, retrying (${i}/15)...`);
-        }
-        console.error(`[socat] gave up waiting for container for ${branch} after 30s`);
-      })();
-    }
-  }
-
-  return result;
-}
-
-export async function removeWorktree(name: string): Promise<string> {
-  console.log(`[workmux:rm] running: workmux rm --force ${name}`);
-  stopForwarding(name);
-  const result = await runChecked(["workmux", "rm", "--force", name]);
-  console.log(`[workmux:rm] result: ${result}`);
-  return result;
-}
-
-export async function openWorktree(name: string): Promise<string> {
-  return runChecked(["workmux", "open", name]);
-}
-
-export async function mergeWorktree(name: string): Promise<string> {
-  console.log(`[workmux:merge] running: workmux merge ${name}`);
-  stopForwarding(name);
-  const result = await runChecked(["workmux", "merge", name]);
-  console.log(`[workmux:merge] result: ${result}`);
-  return result;
-}
-
-export async function getTmuxSession(): Promise<string> {
-  try {
-    const result = await $`tmux list-windows -a -F "#{session_name}:#{window_name}"`.text();
-    for (const line of result.trim().split("\n")) {
-      const [session, window] = line.split(":");
-      if (window?.startsWith("wm-")) {
-        return session!;
-      }
-    }
-  } catch {
-    // No tmux server running
-  }
-  return "0";
-}

dev-dashboard/backend/tsconfig.json

@@ -1,14 +0,0 @@
-{
-  "compilerOptions": {
-    "target": "ESNext",
-    "module": "ESNext",
-    "moduleResolution": "bundler",
-    "strict": true,
-    "esModuleInterop": true,
-    "skipLibCheck": true,
-    "outDir": "dist",
-    "rootDir": "src",
-    "types": ["bun-types"]
-  },
-  "include": ["src/**/*.ts"]
-}

dev-dashboard/dev.sh

@@ -1,27 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-cd "$(dirname "$0")"
-
-# Load env vars (R2 credentials, etc.) if present
-if [ -f .env ]; then
-  set -a; source .env; set +a
-fi
-
-cleanup() {
-  kill $BE_PID $FE_PID 2>/dev/null || true
-}
-trap cleanup EXIT
-
-# Backend (bun --watch)
-cd backend
-bun run dev 2>&1 | sed 's/^/[BE] /' &
-BE_PID=$!
-cd ..
-
-# Frontend (vite dev)
-cd frontend
-bun run dev 2>&1 | sed 's/^/[FE] /' &
-FE_PID=$!
-cd ..
-
-wait

dev-dashboard/frontend/index.html

@@ -1,15 +0,0 @@
-<!doctype html>
-<html lang="en">
-  <head>
-    <meta charset="UTF-8" />
-    <meta
-      name="viewport"
-      content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no"
-    />
-    <title>Windmill Dev Dashboard</title>
-  </head>
-  <body>
-    <div id="app"></div>
-    <script type="module" src="/src/main.ts"></script>
-  </body>
-</html>

dev-dashboard/frontend/package.json

@@ -1,23 +0,0 @@
-{
-  "name": "windmill-dev-dashboard-frontend",
-  "private": true,
-  "type": "module",
-  "scripts": {
-    "dev": "vite --host 0.0.0.0",
-    "build": "vite build",
-    "preview": "vite preview --host 0.0.0.0",
-    "check": "svelte-check --tsconfig ./tsconfig.json"
-  },
-  "devDependencies": {
-    "@sveltejs/vite-plugin-svelte": "^5.0.0",
-    "@tailwindcss/vite": "^4.2.0",
-    "@xterm/addon-fit": "^0.10.0",
-    "@xterm/addon-web-links": "^0.11.0",
-    "@xterm/xterm": "^5.5.0",
-    "svelte": "^5.0.0",
-    "svelte-check": "^4.0.0",
-    "tailwindcss": "^4.2.0",
-    "typescript": "^5.0.0",
-    "vite": "^6.0.0"
-  }
-}

dev-dashboard/frontend/src/App.svelte

@@ -1,319 +0,0 @@
-<script lang="ts">
-  import { onMount } from "svelte";
-  import WorktreeList from "./lib/WorktreeList.svelte";
-  import TopBar from "./lib/TopBar.svelte";
-  import Terminal from "./lib/Terminal.svelte";
-  import ConfirmDialog from "./lib/ConfirmDialog.svelte";
-  import CreateWorktreeDialog from "./lib/CreateWorktreeDialog.svelte";
-  import SettingsDialog from "./lib/SettingsDialog.svelte";
-  import PaneBar from "./lib/PaneBar.svelte";
-  import type { WorktreeInfo } from "./lib/types";
-  import type { Profile, Agent } from "./lib/api";
-  import * as api from "./lib/api";
-
-  let worktrees = $state<WorktreeInfo[]>([]);
-  let selectedBranch = $state<string | null>(null);
-  let removeBranch = $state<string | null>(null);
-  let mergeBranch = $state<string | null>(null);
-  let merging = $state(false);
-  let mergeError = $state("");
-  let removingBranches = $state<Set<string>>(new Set());
-  const SSH_STORAGE_KEY = "wt-ssh-host";
-  let showCreateDialog = $state(false);
-  let showSettingsDialog = $state(false);
-  let creating = $state(false);
-  let sshHost = $state(localStorage.getItem(SSH_STORAGE_KEY) ?? "");
-
-  // Mobile state
-  let isMobile = $state(false);
-  let sidebarOpen = $state(false);
-  let activePane = $state(0);
-  let terminalRef: { sendSelectPane: (pane: number) => void } | undefined = $state();
-
-  let visibleWorktrees = $derived(
-    worktrees.filter((w) => w.path === "(here)" || w.branch === "main" || w.mux === "✓")
-  );
-  let selectedWorktree = $derived(visibleWorktrees.find((w) => w.branch === selectedBranch));
-  let isMain = $derived(selectedWorktree?.path === "(here)" || selectedBranch === "main");
-  let canConnect = $derived(!!selectedBranch && !isMain);
-
-  let paneBarProfile = $derived(
-    selectedWorktree?.profile === "full" || selectedWorktree?.profile === "agent-yolo"
-      ? selectedWorktree.profile as "full" | "agent-yolo"
-      : null
-  );
-  let showPaneBar = $derived(isMobile && canConnect && paneBarProfile !== null);
-
-  async function refresh() {
-    try {
-      worktrees = await api.fetchWorktrees();
-    } catch (err) {
-      console.error("Failed to refresh:", err);
-    }
-  }
-
-  function randomName(len: number): string {
-    const chars = "abcdefghijklmnopqrstuvwxyz0123456789";
-    let result = "";
-    for (let i = 0; i < len; i++) {
-      result += chars[Math.floor(Math.random() * chars.length)];
-    }
-    return result;
-  }
-
-  /** Sanitize user input into a valid git branch name */
-  function sanitizeBranchName(raw: string): string {
-    return raw
-      .replace(/\s+/g, "-")              // spaces → dashes
-      .replace(/[~^:?*\[\]\\]+/g, "")    // remove git-invalid chars
-      .replace(/\.{2,}/g, ".")            // collapse ".." → "."
-      .replace(/\/{2,}/g, "/")            // collapse consecutive slashes
-      .replace(/-{2,}/g, "-")             // collapse consecutive dashes
-      .replace(/^[.\-/]+|[.\-/]+$/g, "") // no leading/trailing . - /
-      .replace(/\.lock$/i, "");           // no trailing .lock
-  }
-
-  async function handleCreate(name: string, profile: Profile, agent: Agent) {
-    const branch = (name && sanitizeBranchName(name)) || randomName(8);
-    creating = true;
-    try {
-      await api.createWorktree(branch, profile, agent);
-      await api.openWorktree(branch);
-      showCreateDialog = false;
-      await refresh();
-      selectedBranch = branch;
-    } catch (err) {
-      alert(`Failed to create: ${err instanceof Error ? err.message : err}`);
-    } finally {
-      creating = false;
-    }
-  }
-
-  function selectNeighborOf(branch: string) {
-    if (selectedBranch !== branch) return;
-    const idx = visibleWorktrees.findIndex((w) => w.branch === branch);
-    const neighbor = visibleWorktrees[idx - 1] ?? visibleWorktrees[idx + 1];
-    const isNeighborMain = neighbor && (neighbor.path === "(here)" || neighbor.branch === "main");
-    selectedBranch = neighbor && !isNeighborMain ? neighbor.branch : null;
-  }
-
-  async function handleRemove() {
-    const branch = removeBranch;
-    if (!branch) return;
-    removeBranch = null;
-    selectNeighborOf(branch);
-
-    removingBranches = new Set([...removingBranches, branch]);
-    try {
-      await api.removeWorktree(branch);
-      await refresh();
-    } catch (err) {
-      alert(`Failed to remove: ${err instanceof Error ? err.message : err}`);
-    } finally {
-      removingBranches = new Set([...removingBranches].filter((b) => b !== branch));
-    }
-  }
-
-  async function handleMerge() {
-    const branch = mergeBranch;
-    if (!branch) return;
-
-    merging = true;
-    mergeError = "";
-    try {
-      await api.mergeWorktree(branch);
-      mergeBranch = null;
-      selectNeighborOf(branch);
-      await refresh();
-    } catch (err) {
-      mergeError = err instanceof Error ? err.message : String(err);
-    } finally {
-      merging = false;
-    }
-  }
-
-  function selectNeighborWorktree(direction: -1 | 1) {
-    const selectable = visibleWorktrees.filter(
-      (w) => w.path !== "(here)" && w.branch !== "main" && !removingBranches.has(w.branch)
-    );
-    if (selectable.length === 0) return;
-    if (!selectedBranch) {
-      selectedBranch = selectable[direction === 1 ? 0 : selectable.length - 1].branch;
-      return;
-    }
-    const idx = selectable.findIndex((w) => w.branch === selectedBranch);
-    const next = idx + direction;
-    if (next >= 0 && next < selectable.length) {
-      selectedBranch = selectable[next].branch;
-    }
-  }
-
-  function handleKeydown(e: KeyboardEvent) {
-    // Ignore shortcuts when a dialog is open (let dialog handle its own keys)
-    if (showCreateDialog || removeBranch || mergeBranch) return;
-
-    const mod = e.metaKey || e.ctrlKey;
-    if (!mod) return;
-
-    if (e.key === "ArrowUp") {
-      e.preventDefault();
-      selectNeighborWorktree(-1);
-    } else if (e.key === "ArrowDown") {
-      e.preventDefault();
-      selectNeighborWorktree(1);
-    } else if (e.key === "k" || e.key === "K") {
-      e.preventDefault();
-      if (!creating) showCreateDialog = true;
-    } else if (e.key === "m" || e.key === "M") {
-      e.preventDefault();
-      if (selectedBranch && !isMain) mergeBranch = selectedBranch;
-    } else if (e.key === "d" || e.key === "D") {
-      e.preventDefault();
-      if (selectedBranch && !isMain) removeBranch = selectedBranch;
-    }
-  }
-
-  function handlePaneSelect(pane: number) {
-    activePane = pane;
-    terminalRef?.sendSelectPane(pane);
-  }
-
-  onMount(() => {
-    refresh();
-    const interval = setInterval(refresh, 5000);
-    window.addEventListener("keydown", handleKeydown);
-
-    const mq = window.matchMedia("(max-width: 768px)");
-    isMobile = mq.matches;
-    function onMqChange(e: MediaQueryListEvent) { isMobile = e.matches; }
-    mq.addEventListener("change", onMqChange);
-
-    return () => {
-      clearInterval(interval);
-      window.removeEventListener("keydown", handleKeydown);
-      mq.removeEventListener("change", onMqChange);
-    };
-  });
-</script>
-
-<div class="flex h-screen bg-surface text-primary">
-  <!-- Sidebar: fixed overlay on mobile, static on desktop -->
-  {#if !isMobile || sidebarOpen}
-    <!-- svelte-ignore a11y_no_static_element_interactions -->
-    {#if isMobile}
-      <div
-        class="fixed inset-0 bg-black/50 z-40"
-        onclick={() => (sidebarOpen = false)}
-        onkeydown={(e) => { if (e.key === "Escape") sidebarOpen = false; }}
-      ></div>
-    {/if}
-    <aside class="{isMobile ? 'fixed inset-0 z-50 w-full' : 'w-[220px] min-w-[220px]'} bg-sidebar border-r border-edge flex flex-col overflow-hidden">
-      <div class="flex items-center justify-between p-4 border-b border-edge">
-        <h1 class="text-base font-semibold">Windmill</h1>
-        <div class="flex items-center gap-2">
-          <button
-            class="h-8 px-2 gap-1.5 rounded-md border border-edge bg-surface text-accent text-xs flex items-center justify-center cursor-pointer hover:bg-hover disabled:opacity-50 disabled:cursor-not-allowed"
-            onclick={() => (showCreateDialog = true)}
-            disabled={creating}
-            title="New Worktree (Cmd+K)"
-          ><span class="text-lg leading-none">+</span> New</button>
-          {#if isMobile}
-            <button
-              class="h-8 w-8 rounded-md border border-edge bg-surface text-muted text-sm flex items-center justify-center cursor-pointer hover:bg-hover"
-              onclick={() => (sidebarOpen = false)}
-              title="Close sidebar"
-            >&times;</button>
-          {/if}
-        </div>
-      </div>
-      <WorktreeList
-        worktrees={visibleWorktrees}
-        selected={selectedBranch}
-        removing={removingBranches}
-        onselect={(b) => { selectedBranch = b; if (isMobile) sidebarOpen = false; }}
-        onremove={(b) => (removeBranch = b)}
-      />
-      {#if !isMobile}
-        <div class="shrink-0 border-t border-edge px-4 py-3 text-[11px] text-muted flex flex-col gap-1">
-          <div class="flex justify-between"><span>Navigate</span><kbd class="opacity-60">Cmd+Up/Down</kbd></div>
-          <div class="flex justify-between"><span>New worktree</span><kbd class="opacity-60">Cmd+K</kbd></div>
-          <div class="flex justify-between"><span>Merge</span><kbd class="opacity-60">Cmd+M</kbd></div>
-          <div class="flex justify-between"><span>Remove</span><kbd class="opacity-60">Cmd+D</kbd></div>
-        </div>
-      {/if}
-    </aside>
-  {/if}
-
-  <main class="flex-1 min-w-0 flex flex-col overflow-hidden">
-    <TopBar
-      name={selectedBranch}
-      worktree={selectedWorktree}
-      {sshHost}
-      {isMobile}
-      ontogglesidebar={() => (sidebarOpen = !sidebarOpen)}
-      onmerge={() => { if (selectedBranch) mergeBranch = selectedBranch; }}
-      onremove={() => { if (selectedBranch) removeBranch = selectedBranch; }}
-      onsettings={() => (showSettingsDialog = true)}
-    />
-
-    {#if canConnect}
-      {#key selectedBranch}
-        <Terminal
-          worktree={selectedBranch!}
-          {isMobile}
-          initialPane={isMobile ? activePane : undefined}
-          bind:this={terminalRef}
-        />
-      {/key}
-    {:else}
-      <div class="flex-1 flex items-center justify-center text-muted text-sm">
-        <p>
-          {#if isMain}
-            Main worktree — use workmux to manage
-          {:else}
-            Select a worktree from the sidebar to connect
-          {/if}
-        </p>
-      </div>
-    {/if}
-
-    {#if showPaneBar}
-      <PaneBar {activePane} profile={paneBarProfile!} onselect={handlePaneSelect} />
-    {/if}
-  </main>
-</div>
-
-{#if showCreateDialog}
-  <CreateWorktreeDialog
-    loading={creating}
-    oncreate={handleCreate}
-    oncancel={() => (showCreateDialog = false)}
-  />
-{/if}
-
-{#if removeBranch}
-  <ConfirmDialog
-    message={`Remove worktree "${removeBranch}"? This action cannot be undone.`}
-    onconfirm={handleRemove}
-    oncancel={() => (removeBranch = null)}
-  />
-{/if}
-
-{#if mergeBranch}
-  <ConfirmDialog
-    message={`Merge worktree "${mergeBranch}" into main? The worktree will be removed after merging.`}
-    confirmLabel="Merge"
-    variant="accent"
-    loading={merging}
-    error={mergeError}
-    onconfirm={handleMerge}
-    oncancel={() => { mergeBranch = null; mergeError = ""; }}
-  />
-{/if}
-
-{#if showSettingsDialog}
-  <SettingsDialog
-    onsave={(host) => { sshHost = host; showSettingsDialog = false; }}
-    onclose={() => (showSettingsDialog = false)}
-  />
-{/if}

dev-dashboard/frontend/src/app.css

@@ -1,72 +0,0 @@
-@import "tailwindcss";
-
-@theme {
-  --color-surface: #0d1117;
-  --color-sidebar: #161b22;
-  --color-topbar: #1c2128;
-  --color-hover: #21262d;
-  --color-active: #1f6feb33;
-  --color-edge: #30363d;
-  --color-primary: #e6edf3;
-  --color-muted: #8b949e;
-  --color-accent: #58a6ff;
-  --color-danger: #f85149;
-  --color-success: #3fb950;
-  --color-warning: #d29922;
-}
-
-body {
-  font-family:
-    -apple-system, BlinkMacSystemFont, "Segoe UI", Helvetica, Arial, sans-serif;
-}
-
-/* dialog styling (no tailwind equivalents for ::backdrop) */
-dialog[open] {
-  margin: auto;
-}
-dialog::backdrop {
-  background: rgba(0, 0, 0, 0.6);
-}
-
-dialog textarea {
-  font-family: inherit;
-}
-
-dialog textarea:focus {
-  outline: none;
-  border-color: var(--color-accent);
-}
-
-/* spinner */
-@keyframes spin {
-  to {
-    transform: rotate(360deg);
-  }
-}
-.spinner {
-  display: inline-block;
-  width: 12px;
-  height: 12px;
-  border: 1.5px solid currentColor;
-  border-top-color: transparent;
-  border-radius: 50%;
-  animation: spin 0.6s linear infinite;
-}
-
-/* xterm overrides */
-.xterm {
-  height: 100%;
-  width: 100%;
-}
-
-/* Mobile: increase touch targets */
-@media (max-width: 768px) {
-  /* Prevent overscroll/bounce on iOS */
-  html,
-  body {
-    overflow: hidden;
-    position: fixed;
-    width: 100%;
-    height: 100%;
-  }
-}

dev-dashboard/frontend/src/lib/ConfirmDialog.svelte

@@ -1,38 +0,0 @@
-<script lang="ts">
-  let { message, loading = false, error = "", confirmLabel = "Remove", variant = "danger", onconfirm, oncancel }: {
-    message: string;
-    loading?: boolean;
-    error?: string;
-    confirmLabel?: string;
-    variant?: "danger" | "accent";
-    onconfirm: () => void;
-    oncancel: () => void;
-  } = $props();
-
-  let dialogEl: HTMLDialogElement;
-  let confirmBtn: HTMLButtonElement;
-
-  $effect(() => {
-    dialogEl?.showModal();
-    confirmBtn?.focus();
-  });
-
-  const btn = "px-3 py-1.5 rounded-md border border-edge bg-surface text-primary text-xs cursor-pointer hover:bg-hover";
-</script>
-
-<dialog bind:this={dialogEl} onclose={oncancel} class="bg-sidebar text-primary border border-edge rounded-xl p-6 max-w-[380px] w-[90%]">
-  <form method="dialog" onsubmit={(e) => { e.preventDefault(); onconfirm(); }}>
-    <h2 class="text-base mb-4">Confirm</h2>
-    <p class="text-[13px] text-muted mb-6">{message}</p>
-    {#if error}<p class="text-[12px] text-danger mb-4 -mt-2 whitespace-pre-wrap">{error}</p>{/if}
-    <div class="flex justify-end gap-2">
-      <button type="button" class={btn} onclick={oncancel} disabled={loading}>Cancel</button>
-      <button
-        bind:this={confirmBtn}
-        type="submit"
-        class="{btn} !text-white hover:!opacity-90 disabled:!opacity-50 disabled:!cursor-not-allowed flex items-center gap-1.5 {variant === 'accent' ? '!bg-accent !border-accent' : '!bg-danger !border-danger'}"
-        disabled={loading}
-      >{#if loading}<span class="spinner"></span>{/if} {confirmLabel}</button>
-    </div>
-  </form>
-</dialog>

dev-dashboard/frontend/src/lib/CreateWorktreeDialog.svelte

@@ -1,150 +0,0 @@
-<script lang="ts">
-  import type { Profile, Agent } from "./api";
-
-  const AGENTS: { value: Agent; label: string }[] = [
-    { value: "claude", label: "Claude" },
-    { value: "codex", label: "Codex" },
-  ];
-
-  const PROFILES: { value: Profile; label: string }[] = [
-    { value: "full", label: "Full (agent + backend + frontend)" },
-    { value: "agent-yolo", label: "Agent (sandboxed, yolo mode)" },
-  ];
-
-  let {
-    loading = false,
-    oncreate,
-    oncancel,
-  }: {
-    loading?: boolean;
-    oncreate: (name: string, profile: Profile, agent: Agent) => void;
-    oncancel: () => void;
-  } = $props();
-
-  const STORAGE_KEY = "wt-default-profile";
-  const AGENT_STORAGE_KEY = "wt-default-agent";
-  const savedProfile = localStorage.getItem(STORAGE_KEY) as Profile | null;
-  const savedAgent = localStorage.getItem(AGENT_STORAGE_KEY) as Agent | null;
-
-  let name = $state("");
-  let agent = $state<Agent>(savedAgent ?? "claude");
-  let profile = $state<Profile>(savedProfile ?? "full");
-  let saveDefault = $state(false);
-
-  let dialogEl: HTMLDialogElement;
-
-  $effect(() => {
-    dialogEl?.showModal();
-  });
-
-  function handleKeydown(e: KeyboardEvent) {
-    if (e.key === "ArrowUp" || e.key === "ArrowDown") {
-      e.preventDefault();
-      const idx = PROFILES.findIndex((p) => p.value === profile);
-      const next = e.key === "ArrowDown"
-        ? (idx + 1) % PROFILES.length
-        : (idx - 1 + PROFILES.length) % PROFILES.length;
-      profile = PROFILES[next].value;
-    }
-  }
-
-  const btn =
-    "px-3 py-1.5 rounded-md border border-edge bg-surface text-primary text-xs cursor-pointer hover:bg-hover";
-</script>
-
-<dialog
-  bind:this={dialogEl}
-  onclose={oncancel}
-  onkeydown={handleKeydown}
-  class="bg-sidebar text-primary border border-edge rounded-xl p-6 max-w-[380px] w-[90%]"
->
-  <form
-    method="dialog"
-    onsubmit={(e) => {
-      e.preventDefault();
-      if (saveDefault) {
-        localStorage.setItem(STORAGE_KEY, profile);
-        localStorage.setItem(AGENT_STORAGE_KEY, agent);
-      } else {
-        localStorage.removeItem(STORAGE_KEY);
-        localStorage.removeItem(AGENT_STORAGE_KEY);
-      }
-      oncreate(name.trim(), profile, agent);
-    }}
-  >
-    <h2 class="text-base mb-4">New Worktree</h2>
-    <div class="mb-4">
-      <label class="block text-xs text-muted mb-1.5" for="wt-name"
-        >Name <span class="opacity-60">(optional)</span></label
-      >
-      <input
-        id="wt-name"
-        type="text"
-        class="w-full px-2.5 py-1.5 rounded-md border border-edge bg-surface text-primary text-[13px] placeholder:text-muted/50 outline-none focus:border-accent"
-        placeholder="auto-generated if empty"
-        bind:value={name}
-      />
-    </div>
-    <div class="flex gap-2 mb-4">
-      {#each AGENTS as a}
-        <label
-          class="flex-1 flex items-center justify-center gap-2 p-2.5 rounded-lg border cursor-pointer text-[13px] transition-colors
-            {agent === a.value
-            ? 'border-accent bg-accent/10'
-            : 'border-edge hover:bg-hover'}"
-        >
-          <input
-            type="radio"
-            name="agent"
-            value={a.value}
-            checked={agent === a.value}
-            onchange={() => (agent = a.value)}
-            class="accent-[var(--accent)]"
-          />
-          {a.label}
-        </label>
-      {/each}
-    </div>
-    <div class="flex flex-col gap-2 mb-6">
-      {#each PROFILES as p}
-        <label
-          class="flex items-center gap-2.5 p-2.5 rounded-lg border cursor-pointer text-[13px] transition-colors
-            {profile === p.value
-            ? 'border-accent bg-accent/10'
-            : 'border-edge hover:bg-hover'}"
-        >
-          <input
-            type="radio"
-            name="profile"
-            value={p.value}
-            checked={profile === p.value}
-            onchange={() => (profile = p.value)}
-            class="accent-[var(--accent)]"
-          />
-          {p.label}
-        </label>
-      {/each}
-    </div>
-    <label
-      class="flex items-center gap-2 mb-4 text-[13px] text-muted cursor-pointer"
-    >
-      <input
-        type="checkbox"
-        bind:checked={saveDefault}
-        class="accent-[var(--accent)]"
-      />
-      Save as default
-    </label>
-    <div class="flex justify-end gap-2">
-      <button type="button" class={btn} onclick={oncancel} disabled={loading}
-        >Cancel</button
-      >
-      <button
-        type="submit"
-        class="{btn} !bg-accent !text-white !border-accent hover:!opacity-90 disabled:!opacity-50 disabled:!cursor-not-allowed flex items-center gap-1.5"
-        disabled={loading}
-        >{#if loading}<span class="spinner"></span>{/if} Create</button
-      >
-    </div>
-  </form>
-</dialog>

dev-dashboard/frontend/src/lib/PaneBar.svelte

@@ -1,42 +0,0 @@
-<script lang="ts">
-  let { activePane, profile, onselect }: {
-    activePane: number;
-    profile: "full" | "agent-yolo";
-    onselect: (pane: number) => void;
-  } = $props();
-
-  const panesByProfile = {
-    "full": [
-      { index: 0, label: "Claude" },
-      { index: 1, label: "Backend" },
-      { index: 2, label: "Frontend" },
-    ],
-    "agent-yolo": [
-      { index: 0, label: "Claude" },
-      { index: 1, label: "Shell" },
-    ],
-  };
-
-  let panes = $derived(panesByProfile[profile] ?? panesByProfile["full"]);
-</script>
-
-<nav class="flex items-stretch bg-topbar border-t border-edge pane-bar">
-  {#each panes as p (p.index)}
-    <button
-      type="button"
-      class="flex-1 py-3 text-sm font-medium cursor-pointer border-none bg-transparent {activePane === p.index ? 'text-accent pane-active' : 'text-muted'}"
-      onclick={() => onselect(p.index)}
-    >
-      {p.label}
-    </button>
-  {/each}
-</nav>
-
-<style>
-  .pane-bar {
-    padding-bottom: env(safe-area-inset-bottom, 0px);
-  }
-  .pane-active {
-    box-shadow: inset 0 2px 0 0 var(--color-accent);
-  }
-</style>

dev-dashboard/frontend/src/lib/SendDialog.svelte

@@ -1,41 +0,0 @@
-<script lang="ts">
-  let { onsubmit, oncancel }: {
-    onsubmit: (prompt: string) => void;
-    oncancel: () => void;
-  } = $props();
-
-  let dialogEl: HTMLDialogElement;
-  let prompt = $state("");
-
-  $effect(() => {
-    dialogEl?.showModal();
-  });
-
-  function handleSubmit(e: SubmitEvent) {
-    e.preventDefault();
-    const trimmed = prompt.trim();
-    if (trimmed) onsubmit(trimmed);
-  }
-
-  const btn = "px-3 py-1.5 rounded-md border border-edge bg-surface text-primary text-xs cursor-pointer hover:bg-hover";
-</script>
-
-<dialog bind:this={dialogEl} onclose={oncancel} class="bg-sidebar text-primary border border-edge rounded-xl p-6 max-w-[440px] w-[90%]">
-  <form onsubmit={handleSubmit}>
-    <h2 class="text-base mb-4">Send Prompt</h2>
-    <label class="block text-[13px] text-muted mb-3">
-      Prompt
-      <textarea
-        rows="4"
-        required
-        placeholder="Implement the feature..."
-        bind:value={prompt}
-        class="block w-full mt-1 p-2 bg-surface border border-edge rounded-md text-primary text-[13px]"
-      ></textarea>
-    </label>
-    <div class="flex justify-end gap-2 mt-4">
-      <button type="button" class={btn} onclick={oncancel}>Cancel</button>
-      <button type="submit" class="{btn} !bg-accent !text-white !border-accent hover:!opacity-90">Send</button>
-    </div>
-  </form>
-</dialog>

dev-dashboard/frontend/src/lib/SettingsDialog.svelte

@@ -1,58 +0,0 @@
-<script lang="ts">
-  const STORAGE_KEY = "wt-ssh-host";
-
-  let { onsave, onclose }: {
-    onsave: (sshHost: string) => void;
-    onclose: () => void;
-  } = $props();
-
-  let sshHost = $state(localStorage.getItem(STORAGE_KEY) ?? "");
-  let dialogEl: HTMLDialogElement;
-  let inputEl: HTMLInputElement;
-
-  $effect(() => {
-    dialogEl?.showModal();
-    inputEl?.focus();
-  });
-
-  function handleSave() {
-    const trimmed = sshHost.trim();
-    if (trimmed) {
-      localStorage.setItem(STORAGE_KEY, trimmed);
-    } else {
-      localStorage.removeItem(STORAGE_KEY);
-    }
-    onsave(trimmed);
-  }
-
-  const btn = "px-3 py-1.5 rounded-md border border-edge bg-surface text-primary text-xs cursor-pointer hover:bg-hover";
-</script>
-
-<dialog bind:this={dialogEl} onclose={onclose} class="bg-sidebar text-primary border border-edge rounded-xl p-6 max-w-[380px] w-[90%]">
-  <form method="dialog" onsubmit={(e) => { e.preventDefault(); handleSave(); }}>
-    <h2 class="text-base mb-4">Settings</h2>
-    <div class="mb-4">
-      <label class="block text-xs text-muted mb-1.5" for="ssh-host">
-        SSH Host <span class="opacity-60">(for "Open in Cursor")</span>
-      </label>
-      <input
-        bind:this={inputEl}
-        id="ssh-host"
-        type="text"
-        class="w-full px-2.5 py-1.5 rounded-md border border-edge bg-surface text-primary text-[13px] placeholder:text-muted/50 outline-none focus:border-accent"
-        placeholder="e.g. devbox or 10.0.0.5"
-        bind:value={sshHost}
-      />
-      <p class="text-[11px] text-muted mt-1.5">
-        Must match an entry in your local <code class="text-accent/80">~/.ssh/config</code>. Leave empty for local mode.
-      </p>
-    </div>
-    <div class="flex justify-end gap-2">
-      <button type="button" class={btn} onclick={onclose}>Cancel</button>
-      <button
-        type="submit"
-        class="{btn} !bg-accent !text-white !border-accent hover:!opacity-90"
-      >Save</button>
-    </div>
-  </form>
-</dialog>

dev-dashboard/frontend/src/lib/Terminal.svelte

@@ -1,143 +0,0 @@
-<script lang="ts">
-  import { onMount, onDestroy } from "svelte";
-  import { Terminal } from "@xterm/xterm";
-  import { FitAddon } from "@xterm/addon-fit";
-  import { WebLinksAddon } from "@xterm/addon-web-links";
-  import "@xterm/xterm/css/xterm.css";
-
-  let { worktree, isMobile = false, initialPane }: {
-    worktree: string;
-    isMobile?: boolean;
-    initialPane?: number;
-  } = $props();
-
-  let containerEl: HTMLDivElement;
-  let term: Terminal;
-  let fitAddon: FitAddon;
-  let ws: WebSocket;
-  let resizeObs: ResizeObserver;
-
-  export function sendSelectPane(pane: number) {
-    if (ws?.readyState === WebSocket.OPEN) {
-      ws.send(JSON.stringify({ type: "selectPane", pane }));
-    }
-  }
-
-  onMount(() => {
-    term = new Terminal({
-      cursorBlink: true,
-      theme: {
-        background: "#0d1117",
-        foreground: "#e6edf3",
-        cursor: "#58a6ff",
-        selectionBackground: "#264f78",
-      },
-      fontFamily: "'JetBrains Mono', 'Fira Code', 'Cascadia Code', Menlo, monospace",
-      fontSize: isMobile ? 13 : 11,
-      scrollback: 10000,
-    });
-
-    fitAddon = new FitAddon();
-    term.loadAddon(fitAddon);
-    term.loadAddon(new WebLinksAddon());
-    term.open(containerEl);
-
-    // Prevent browser context menu so tmux right-click works unobstructed
-    containerEl.addEventListener("contextmenu", (e) => e.preventDefault());
-
-    // Handle OSC 52 sequences from tmux → write to system clipboard
-    term.parser.registerOscHandler(52, (data) => {
-      const idx = data.indexOf(";");
-      if (idx !== -1) {
-        const b64 = data.slice(idx + 1);
-        try {
-          const text = atob(b64);
-          navigator.clipboard.writeText(text);
-        } catch {}
-      }
-      return true;
-    });
-
-    // Auto-copy on xterm.js selection (e.g. when user Shift+drags to bypass tmux mouse)
-    term.onSelectionChange(() => {
-      const sel = term.getSelection();
-      if (sel) {
-        navigator.clipboard.writeText(sel);
-      }
-    });
-
-    // Let app-level shortcuts (Cmd+Arrow, Cmd+N, Cmd+D) bubble up instead of
-    // being consumed by xterm.  Return false → xterm ignores the event.
-    term.attachCustomKeyEventHandler((e: KeyboardEvent) => {
-      if (e.type !== "keydown") return true;
-      const mod = e.metaKey || e.ctrlKey;
-      if (mod && (e.key === "ArrowUp" || e.key === "ArrowDown")) return false;
-      if (mod && (e.key === "k" || e.key === "K")) return false;
-      if (mod && (e.key === "d" || e.key === "D")) return false;
-      return true;
-    });
-
-    requestAnimationFrame(() => {
-      fitAddon.fit();
-      term.focus();
-    });
-
-    const protocol = location.protocol === "https:" ? "wss:" : "ws:";
-    ws = new WebSocket(`${protocol}//${location.host}/ws/${encodeURIComponent(worktree)}`);
-
-    ws.onmessage = (event) => {
-      try {
-        const msg = JSON.parse(event.data);
-        switch (msg.type) {
-          case "scrollback":
-          case "output":
-            term.write(msg.data);
-            break;
-          case "exit":
-            term.writeln(`\r\n\x1b[33m[Process exited with code ${msg.exitCode}]\x1b[0m`);
-            break;
-          case "error":
-            term.writeln(`\r\n\x1b[31m[Error: ${msg.message}]\x1b[0m`);
-            break;
-        }
-      } catch {
-        // Ignore malformed messages
-      }
-    };
-
-    ws.onopen = () => {
-      fitAddon.fit();
-      const msg: Record<string, unknown> = { type: "resize", cols: term.cols, rows: term.rows };
-      if (isMobile && initialPane !== undefined) {
-        msg.initialPane = initialPane;
-      }
-      ws.send(JSON.stringify(msg));
-    };
-
-    ws.onclose = () => {
-      term.writeln("\r\n\x1b[90m[Disconnected]\x1b[0m");
-    };
-
-    term.onData((data) => {
-      if (ws.readyState === WebSocket.OPEN) {
-        ws.send(JSON.stringify({ type: "input", data }));
-      }
-    });
-
-    resizeObs = new ResizeObserver(() => {
-      fitAddon.fit();
-      if (ws.readyState === WebSocket.OPEN) {
-        ws.send(JSON.stringify({ type: "resize", cols: term.cols, rows: term.rows }));
-      }
-    });
-    resizeObs.observe(containerEl);
-  });
-
-  onDestroy(() => {
-    resizeObs?.disconnect();
-    ws?.close();
-    term?.dispose();
-  });
-</script>
-
-<div class="flex-1 min-h-0 w-full p-1 overflow-hidden" bind:this={containerEl}></div>

dev-dashboard/frontend/src/lib/TopBar.svelte

@@ -1,82 +0,0 @@
-<script lang="ts">
-  import type { WorktreeInfo } from "./types";
-
-  let { name, worktree, sshHost, isMobile = false, ontogglesidebar, onmerge, onremove, onsettings }: {
-    name: string | null;
-    worktree: WorktreeInfo | undefined;
-    sshHost: string;
-    isMobile?: boolean;
-    ontogglesidebar?: () => void;
-    onmerge: () => void;
-    onremove: () => void;
-    onsettings: () => void;
-  } = $props();
-
-  let cursorUrl = $derived.by(() => {
-    const dir = worktree?.dir;
-    if (!dir) return null;
-    if (sshHost) {
-      return `cursor://vscode-remote/ssh-remote+${sshHost}${dir}`;
-    }
-    return `cursor://file${dir}`;
-  });
-
-  const btn = "px-3 py-1.5 rounded-md border border-edge bg-surface text-primary text-xs cursor-pointer hover:bg-hover";
-</script>
-
-<div class="flex items-center justify-between px-4 py-2 bg-topbar border-b border-edge min-h-12">
-  <div class="flex items-center gap-3">
-    {#if isMobile && ontogglesidebar}
-      <button
-        type="button"
-        class="p-1 -ml-1 cursor-pointer bg-transparent border-none text-muted hover:text-primary"
-        onclick={ontogglesidebar}
-        title="Toggle sidebar"
-      >
-        <svg xmlns="http://www.w3.org/2000/svg" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><line x1="3" y1="6" x2="21" y2="6"/><line x1="3" y1="12" x2="21" y2="12"/><line x1="3" y1="18" x2="21" y2="18"/></svg>
-      </button>
-    {/if}
-    <span class="text-sm font-semibold truncate">{name ?? "Select a worktree"}</span>
-    {#if !isMobile}
-      {#if worktree?.backendPort}
-        <a
-          href="{window.location.protocol}//{window.location.hostname}:{worktree.backendPort}"
-          target="_blank"
-          rel="noopener"
-          class="text-[11px] px-1.5 py-0.5 rounded border font-mono no-underline hover:opacity-80 {worktree.backendRunning ? 'text-success border-success/40' : 'text-muted border-edge pointer-events-none'}"
-        >BE :{worktree.backendPort}</a>
-      {/if}
-      {#if worktree?.frontendPort}
-        <a
-          href="{window.location.protocol}//{window.location.hostname}:{worktree.frontendPort}"
-          target="_blank"
-          rel="noopener"
-          class="text-[11px] px-1.5 py-0.5 rounded border font-mono no-underline hover:opacity-80 {worktree.frontendRunning ? 'text-success border-success/40' : 'text-muted border-edge pointer-events-none'}"
-        >FE :{worktree.frontendPort}</a>
-      {/if}
-      {#if cursorUrl}
-        <a
-          href={cursorUrl}
-          class="text-[11px] px-1.5 py-0.5 rounded-l border border-accent/40 text-accent font-mono no-underline hover:opacity-80"
-          title="Open in Cursor"
-        >Cursor</a><button
-          type="button"
-          class="text-[11px] px-1 py-0.5 rounded-r border border-l-0 border-accent/40 text-accent cursor-pointer bg-transparent hover:opacity-80"
-          title="Cursor SSH settings"
-          onclick={onsettings}
-        >
-          <svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12.22 2h-.44a2 2 0 0 0-2 2v.18a2 2 0 0 1-1 1.73l-.43.25a2 2 0 0 1-2 0l-.15-.08a2 2 0 0 0-2.73.73l-.22.38a2 2 0 0 0 .73 2.73l.15.1a2 2 0 0 1 1 1.72v.51a2 2 0 0 1-1 1.74l-.15.09a2 2 0 0 0-.73 2.73l.22.38a2 2 0 0 0 2.73.73l.15-.08a2 2 0 0 1 2 0l.43.25a2 2 0 0 1 1 1.73V20a2 2 0 0 0 2 2h.44a2 2 0 0 0 2-2v-.18a2 2 0 0 1 1-1.73l.43-.25a2 2 0 0 1 2 0l.15.08a2 2 0 0 0 2.73-.73l.22-.39a2 2 0 0 0-.73-2.73l-.15-.08a2 2 0 0 1-1-1.74v-.5a2 2 0 0 1 1-1.74l.15-.09a2 2 0 0 0 .73-2.73l-.22-.38a2 2 0 0 0-2.73-.73l-.15.08a2 2 0 0 1-2 0l-.43-.25a2 2 0 0 1-1-1.73V4a2 2 0 0 0-2-2z"/><circle cx="12" cy="12" r="3"/></svg>
-        </button>
-      {/if}
-    {/if}
-  </div>
-  {#if name}
-    <div class="flex gap-2 items-center">
-      {#if !isMobile}
-        <span class="text-xs px-2 py-0.5 rounded-xl bg-hover">{worktree?.status || worktree?.agent || ""}</span>
-      {/if}
-      <button class="{btn} !text-accent !border-accent hover:!bg-accent/10" onclick={onmerge} title="Merge worktree">{isMobile ? "M" : "Merge"}</button>
-      <button class="{btn} !text-danger !border-danger hover:!bg-danger/10" onclick={onremove} title="Remove worktree">{isMobile ? "R" : "Remove"}</button>
-    </div>
-  {/if}
-</div>

dev-dashboard/frontend/src/lib/WorktreeList.svelte

@@ -1,65 +0,0 @@
-<script lang="ts">
-  import type { WorktreeInfo } from "./types";
-
-  let { worktrees, selected, removing, onselect, onremove }: {
-    worktrees: WorktreeInfo[];
-    selected: string | null;
-    removing: Set<string>;
-    onselect: (branch: string) => void;
-    onremove: (branch: string) => void;
-  } = $props();
-
-  function dotColor(agent: string): string {
-    if (agent === "working") return "bg-success";
-    if (agent === "waiting") return "bg-warning";
-    if (agent === "error") return "bg-danger";
-    return "bg-muted";
-  }
-</script>
-
-<ul class="list-none overflow-y-auto flex-1 p-2">
-  {#each worktrees as wt (wt.branch)}
-    {@const isMain = wt.path === "(here)" || wt.branch === "main"}
-    {@const isActive = wt.branch === selected}
-    {@const isRemoving = removing.has(wt.branch)}
-    <li class="mb-0.5 group relative {isRemoving ? 'opacity-40 pointer-events-none' : ''}">
-      <button
-        type="button"
-        class="w-full py-2.5 px-3 rounded-md border cursor-pointer flex flex-col gap-1 text-left text-inherit text-sm bg-transparent hover:bg-hover {isActive ? 'bg-active border-accent' : 'border-transparent'}"
-        onclick={() => onselect(wt.branch)}
-      >
-        <span class="font-medium truncate pr-5">{wt.branch}</span>
-        <span class="flex gap-2 text-[11px] text-muted items-center flex-wrap">
-          <span><span class="inline-block w-2 h-2 rounded-full mr-1 align-middle {dotColor(wt.agent)}"></span>{wt.agent || "none"}</span>
-          {#if wt.agentName}
-            <span>{wt.agentName}</span>
-          {/if}
-          {#if wt.profile}
-            <span>{wt.profile}</span>
-          {/if}
-          {#if isMain}
-            <span>main</span>
-          {/if}
-        </span>
-        {#if wt.backendPort || wt.frontendPort}
-          <span class="flex gap-2 text-[11px] text-muted font-mono">
-            {#if wt.backendPort}
-              <span class={wt.backendRunning ? 'text-success' : ''}>BE:{wt.backendPort}</span>
-            {/if}
-            {#if wt.frontendPort}
-              <span class={wt.frontendRunning ? 'text-success' : ''}>FE:{wt.frontendPort}</span>
-            {/if}
-          </span>
-        {/if}
-      </button>
-      {#if !isMain}
-        <button
-          type="button"
-          class="absolute top-2 right-2 w-5 h-5 rounded flex items-center justify-center text-muted hover:text-danger hover:bg-hover opacity-0 group-hover:opacity-100 transition-opacity cursor-pointer"
-          title="Remove worktree"
-          onclick={(e) => { e.stopPropagation(); onremove(wt.branch); }}
-        >&times;</button>
-      {/if}
-    </li>
-  {/each}
-</ul>

dev-dashboard/frontend/src/lib/api.ts

@@ -1,41 +0,0 @@
-import type { WorktreeInfo } from "./types";
-
-async function api<T = unknown>(path: string, opts?: RequestInit): Promise<T> {
-  const res = await fetch(`/api/${path}`, {
-    headers: { "Content-Type": "application/json" },
-    ...opts,
-  });
-  const data = await res.json();
-  if (!res.ok) throw new Error(data.error || `HTTP ${res.status}`);
-  return data as T;
-}
-
-export function fetchWorktrees(): Promise<WorktreeInfo[]> {
-  return api<WorktreeInfo[]>("worktrees");
-}
-
-export type Profile = "full" | "agent-yolo";
-export type Agent = "claude" | "codex";
-
-export function createWorktree(
-  branch: string,
-  profile: Profile = "full",
-  agent: Agent = "claude",
-): Promise<unknown> {
-  return api("worktrees", {
-    method: "POST",
-    body: JSON.stringify({ branch, profile, agent }),
-  });
-}
-
-export function removeWorktree(name: string): Promise<unknown> {
-  return api(`worktrees/${encodeURIComponent(name)}`, { method: "DELETE" });
-}
-
-export function openWorktree(name: string): Promise<unknown> {
-  return api(`worktrees/${encodeURIComponent(name)}/open`, { method: "POST" });
-}
-
-export function mergeWorktree(name: string): Promise<unknown> {
-  return api(`worktrees/${encodeURIComponent(name)}/merge`, { method: "POST" });
-}

dev-dashboard/frontend/src/lib/types.ts

@@ -1,16 +0,0 @@
-export interface WorktreeInfo {
-  branch: string;
-  agent: string;
-  mux: string;
-  path: string;
-  dir: string | null;
-  status: string;
-  elapsed: string;
-  title: string;
-  profile: string | null;
-  agentName: string | null;
-  backendPort: number | null;
-  frontendPort: number | null;
-  backendRunning: boolean;
-  frontendRunning: boolean;
-}

dev-dashboard/frontend/src/main.ts

@@ -1,5 +0,0 @@
-import "./app.css";
-import App from "./App.svelte";
-import { mount } from "svelte";
-
-mount(App, { target: document.getElementById("app")! });

dev-dashboard/frontend/src/vite-env.d.ts

@@ -1,2 +0,0 @@
-/// <reference types="svelte" />
-/// <reference types="vite/client" />

dev-dashboard/frontend/svelte.config.js

@@ -1,5 +0,0 @@
-import { vitePreprocess } from "@sveltejs/vite-plugin-svelte";
-
-export default {
-  preprocess: vitePreprocess(),
-};

dev-dashboard/frontend/tsconfig.json

@@ -1,13 +0,0 @@
-{
-  "compilerOptions": {
-    "target": "ESNext",
-    "module": "ESNext",
-    "moduleResolution": "bundler",
-    "strict": true,
-    "esModuleInterop": true,
-    "skipLibCheck": true,
-    "isolatedModules": true,
-    "verbatimModuleSyntax": true
-  },
-  "include": ["src/**/*.ts", "src/**/*.svelte", "vite.config.ts"]
-}

dev-dashboard/frontend/vite.config.ts

@@ -1,27 +0,0 @@
-import { defineConfig } from "vite";
-import { svelte } from "@sveltejs/vite-plugin-svelte";
-import tailwindcss from "@tailwindcss/vite";
-
-export default defineConfig({
-  plugins: [svelte(), tailwindcss()],
-  server: {
-    port: 5112,
-    proxy: {
-      "/api": "http://localhost:5111",
-      "/ws": {
-        target: "ws://localhost:5111",
-        ws: true,
-      },
-    },
-  },
-  preview: {
-    port: 4173,
-    proxy: {
-      "/api": "http://localhost:5111",
-      "/ws": {
-        target: "ws://localhost:5111",
-        ws: true,
-      },
-    },
-  },
-});

dev-dashboard/run.sh

@@ -1,32 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-cd "$(dirname "$0")"
-
-# Load env vars (R2 credentials, etc.) if present
-if [ -f .env ]; then
-  set -a; source .env; set +a
-fi
-
-# Build frontend
-cd frontend
-bun run build
-cd ..
-
-cleanup() {
-  kill $BE_PID $FE_PID 2>/dev/null || true
-}
-trap cleanup EXIT
-
-# Backend (production)
-cd backend
-bun run start 2>&1 | sed 's/^/[BE] /' &
-BE_PID=$!
-cd ..
-
-# Frontend (preview built assets)
-cd frontend
-bun run preview 2>&1 | sed 's/^/[FE] /' &
-FE_PID=$!
-cd ..
-
-wait

frontend/package-lock.json

@@ -835,7 +835,6 @@
 			"version": "1.7.1",
 			"resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.7.1.tgz",
 			"integrity": "sha512-o1uhUASyo921r2XtHYOHy7gdkGLge8ghBEQHMWmyJFoXlpU58kIrhhN3w26lpQb6dspetweapMn2CSNwQ8I4wg==",
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"dependencies": {
@@ -847,7 +846,6 @@
 			"version": "1.7.1",
 			"resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.7.1.tgz",
 			"integrity": "sha512-PVtJr5CmLwYAU9PZDMITZoR5iAOShYREoR45EyyLrbntV50mdePTgUn4AmOw90Ifcj+x2kRjdzr1HP3RrNiHGA==",
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"dependencies": {
@@ -858,7 +856,6 @@
 			"version": "1.1.0",
 			"resolved": "https://registry.npmjs.org/@emnapi/wasi-threads/-/wasi-threads-1.1.0.tgz",
 			"integrity": "sha512-WI0DdZ8xFSbgMjR1sFsKABJ/C5OnRrjT06JXbZKexJGrDuPTzZdDYfFlsgcCXCyf+suG5QU2e/y1Wo2V/OapLQ==",
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"dependencies": {
@@ -1348,7 +1345,6 @@
 			"version": "1.1.0",
 			"resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.1.0.tgz",
 			"integrity": "sha512-Fq6DJW+Bb5jaWE69/qOE0D1TUN9+6uWhCeZpdnSBk14pjLcCWR7Q8n49PTSPHazM37JqrsdpEthXy2xn6jWWiA==",
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"dependencies": {
@@ -1503,7 +1499,6 @@
 			"cpu": [
 				"arm64"
 			],
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1520,7 +1515,6 @@
 			"cpu": [
 				"arm64"
 			],
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1537,7 +1531,6 @@
 			"cpu": [
 				"x64"
 			],
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1554,7 +1547,6 @@
 			"cpu": [
 				"x64"
 			],
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1571,7 +1563,6 @@
 			"cpu": [
 				"arm"
 			],
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1588,7 +1579,6 @@
 			"cpu": [
 				"arm64"
 			],
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1605,7 +1595,6 @@
 			"cpu": [
 				"arm64"
 			],
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1622,7 +1611,6 @@
 			"cpu": [
 				"x64"
 			],
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1639,7 +1627,6 @@
 			"cpu": [
 				"x64"
 			],
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1656,7 +1643,6 @@
 			"cpu": [
 				"arm64"
 			],
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1673,7 +1659,6 @@
 			"cpu": [
 				"wasm32"
 			],
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"dependencies": {
@@ -1690,7 +1675,6 @@
 			"cpu": [
 				"arm64"
 			],
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -1707,7 +1691,6 @@
 			"cpu": [
 				"x64"
 			],
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"os": [
@@ -2313,7 +2296,6 @@
 			"version": "0.10.1",
 			"resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.1.tgz",
 			"integrity": "sha512-9tTaPJLSiejZKx+Bmog4uSubteqTvFrVrURwkmHixBo0G4seD0zUxp98E1DzUBJxLQ3NPwXrGKDiVjwx/DpPsg==",
-			"dev": true,
 			"license": "MIT",
 			"optional": true,
 			"dependencies": {
@@ -7193,7 +7175,7 @@
 			"version": "1.21.7",
 			"resolved": "https://registry.npmjs.org/jiti/-/jiti-1.21.7.tgz",
 			"integrity": "sha512-/imKNG4EbWNrVjoNC/1H5/9GFy+tqjGBHCaSsN+P2RnPqjsLmv6UD3Ej+Kj8nBWaRAwyk7kK5ZUc+OEatnTR3A==",
-			"dev": true,
+			"devOptional": true,
 			"license": "MIT",
 			"bin": {
 				"jiti": "bin/jiti.js"
@@ -7692,7 +7674,6 @@
 			"cpu": [
 				"arm64"
 			],
-			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -7713,7 +7694,6 @@
 			"cpu": [
 				"arm64"
 			],
-			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -7734,7 +7714,6 @@
 			"cpu": [
 				"x64"
 			],
-			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -7755,7 +7734,6 @@
 			"cpu": [
 				"x64"
 			],
-			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -7776,7 +7754,6 @@
 			"cpu": [
 				"arm"
 			],
-			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -7797,7 +7774,6 @@
 			"cpu": [
 				"arm64"
 			],
-			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -7818,7 +7794,6 @@
 			"cpu": [
 				"arm64"
 			],
-			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -7839,7 +7814,6 @@
 			"cpu": [
 				"x64"
 			],
-			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -7860,7 +7834,6 @@
 			"cpu": [
 				"x64"
 			],
-			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -7881,7 +7854,6 @@
 			"cpu": [
 				"arm64"
 			],
-			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -7902,7 +7874,6 @@
 			"cpu": [
 				"x64"
 			],
-			"dev": true,
 			"license": "MPL-2.0",
 			"optional": true,
 			"os": [
@@ -12529,21 +12500,6 @@
 				}
 			}
 		},
-		"node_modules/svelte-check/node_modules/picomatch": {
-			"version": "4.0.3",
-			"resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
-			"integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
-			"dev": true,
-			"license": "MIT",
-			"optional": true,
-			"peer": true,
-			"engines": {
-				"node": ">=12"
-			},
-			"funding": {
-				"url": "https://github.com/sponsors/jonschlinkert"
-			}
-		},
 		"node_modules/svelte-eslint-parser": {
 			"version": "0.43.0",
 			"resolved": "https://registry.npmjs.org/svelte-eslint-parser/-/svelte-eslint-parser-0.43.0.tgz",

frontend/src/lib/components/ApiConnectForm.svelte

@@ -1,5 +1,6 @@
 <script lang="ts">
 	import { OauthService, type ResourceType } from '$lib/gen'
+	import FilesetEditor from './FilesetEditor.svelte'
 	import { workspaceStore } from '$lib/stores'
 	import { emptySchema, emptyString } from '$lib/utils'
 	import SchemaForm from './SchemaForm.svelte'
@@ -79,7 +80,7 @@
 			rawCode = JSON.stringify(args, null, 2)
 		} else {
 			parseJson()
-			if (resourceTypeInfo?.format_extension) {
+			if (resourceTypeInfo?.format_extension && !resourceTypeInfo?.is_fileset) {
 				textFileContent = args.content
 			}
 		}
@@ -237,6 +238,11 @@
 			/>
 		{/await}
 	</div>
+{:else if resourceTypeInfo?.is_fileset}
+	<h5 class="mt-1 inline-flex items-center gap-4">
+		Fileset
+	</h5>
+	<FilesetEditor bind:args />
 {:else if resourceTypeInfo?.format_extension}
 	<h5 class="mt-4 inline-flex items-center gap-4">
 		File content ({resourceTypeInfo.format_extension})

frontend/src/lib/components/ConcurrentJobsChart.svelte

@@ -260,6 +260,6 @@
 	} as any)
 </script>
 
-<div class="relative max-h-40">
+<div class="relative h-44">
 	<Line {data} {options} />
 </div>

frontend/src/lib/components/DateTimeInput.svelte

@@ -184,13 +184,13 @@
 			unifiedSize="md"
 			wrapperClasses="h-full"
 			{disabled}
+			iconOnly
+			endIcon={{ icon: X }}
 			on:click={() => {
 				value = null
 				dispatch('clear')
 			}}
-		>
-			<X size={14} />
-		</Button>
+		></Button>
 	{/if}
 	<!-- <div>
 		<ToggleButtonGroup bind:selected={format} let:item>