windmill-components 1.655.2 → 1.665.1

package/package/components/InstanceGroupEditor.svelte

@@ -1,5 +1,4 @@
-<script lang="ts">import { run } from 'svelte/legacy';
-import { GroupService } from '../gen';
+<script lang="ts">import { GroupService } from '../gen';
 import { createEventDispatcher } from 'svelte';
 import autosize from '../autosize';
 import { Button } from './common';
@@ -7,6 +6,9 @@ import Skeleton from './common/skeleton/Skeleton.svelte';
 import TableCustom from './TableCustom.svelte';
 import { sendUserToast } from '../toast';
 import { Loader2 } from 'lucide-svelte';
+import { superadmin } from '../stores';
+import ToggleButtonGroup from './common/toggleButton-v2/ToggleButtonGroup.svelte';
+import ToggleButton from './common/toggleButton-v2/ToggleButton.svelte';
 let { name } = $props();
 let email = $state('');
 let instance_group = $state();
@@ -23,7 +25,7 @@ async function loadInstanceGroup() {
         })
         : [];
 }
-run(() => {
+$effect(() => {
     load();
 });
 </script>
@@ -44,7 +46,10 @@ run(() => {
 					on:click={async () => {
 						await GroupService.updateInstanceGroup({
 							name,
-							requestBody: { new_summary: instance_group?.summary ?? '' }
+							requestBody: {
+								new_summary: instance_group?.summary ?? '',
+								instance_role: instance_group?.instance_role ?? 'user'
+							}
 						})
 						dispatch('update')
 						sendUserToast('New summary saved')
@@ -52,6 +57,72 @@ run(() => {
 				>
 			</div>
 		</div>
+
+		{#if $superadmin}
+			<div class="flex flex-col gap-2">
+				<h2>Instance Role</h2>
+				<p class="text-secondary text-xs"
+					>Assign an instance-level role to all members of this group. Superadmin grants full admin
+					access, devops grants read-only admin visibility.</p
+				>
+				<ToggleButtonGroup
+					selected={instance_group.instance_role ?? 'user'}
+					on:selected={async (e) => {
+						let role = e.detail
+						await GroupService.updateInstanceGroup({
+							name,
+							requestBody: {
+								new_summary: instance_group?.summary ?? '',
+								instance_role: role
+							}
+						})
+						if (instance_group) {
+							instance_group.instance_role =
+								role === 'user' ? undefined : (role as 'superadmin' | 'devops')
+						}
+						dispatch('update')
+						sendUserToast('Instance role updated')
+					}}
+				>
+					{#snippet children({ item })}
+						<ToggleButton value="user" small label="User" {item} />
+						<ToggleButton
+							value="devops"
+							small
+							label="Devops"
+							tooltip="Devops is a role that grants visibility similar to that of a super admin, but without giving all rights."
+							{item}
+						/>
+						<ToggleButton value="superadmin" small label="Superadmin" {item} />
+					{/snippet}
+				</ToggleButtonGroup>
+			</div>
+		{/if}
+
+		{#if instance_group.workspaces && instance_group.workspaces.length > 0}
+			<div class="flex flex-col gap-2">
+				<h2>Workspace Membership</h2>
+				<TableCustom>
+					{#snippet headerRow()}
+						<tr>
+							<th>Workspace</th>
+							<th>Role</th>
+						</tr>
+					{/snippet}
+					{#snippet body()}
+						<tbody>
+							{#each instance_group?.workspaces ?? [] as ws (ws.workspace_id)}
+								<tr>
+									<td>{ws.workspace_name ?? ws.workspace_id}</td>
+									<td>{ws.role}</td>
+								</tr>
+							{/each}
+						</tbody>
+					{/snippet}
+				</TableCustom>
+			</div>
+		{/if}
+
 		<h2
 			>Members ({#if members?.length != undefined}{members?.length ?? 0}{:else}<Loader2
 					class="animate-spin"
@@ -80,36 +151,38 @@ run(() => {
 		{#if members}
 			<TableCustom>
 				{#snippet headerRow()}
-								<tr >
+					<tr>
 						<th>user</th>
 						<th></th>
 					</tr>
-							{/snippet}
+				{/snippet}
 				{#snippet body()}
-								<tbody >
-						{#each members as { member_email }}<tr>
+					<tbody>
+						{#each members as { member_email } (member_email)}
+							<tr>
 								<td>{member_email}</td>
 								<td>
 									<button
 										class="ml-2 text-red-500"
 										onclick={async () => {
-										await GroupService.removeUserFromInstanceGroup({
-											name,
-											requestBody: { email: member_email }
-										})
-										dispatch('update')
-										sendUserToast('User removed')
-										loadInstanceGroup()
-									}}>remove</button
+											await GroupService.removeUserFromInstanceGroup({
+												name,
+												requestBody: { email: member_email }
+											})
+											dispatch('update')
+											sendUserToast('User removed')
+											loadInstanceGroup()
+										}}>remove</button
 									>
 								</td>
-							</tr>{/each}
+							</tr>
+						{/each}
 					</tbody>
-							{/snippet}
+				{/snippet}
 			</TableCustom>
 		{:else}
 			<div class="flex flex-col">
-				{#each new Array(6) as _}
+				{#each new Array(6) as _, i (i)}
 					<Skeleton layout={[[2], 0.7]} />
 				{/each}
 			</div>

package/package/components/InstanceSetting.svelte

@@ -19,6 +19,8 @@ import SimpleEditor from './SimpleEditor.svelte';
 import CriticalAlertChannels from './instanceSettings/CriticalAlertChannels.svelte';
 import SmtpSettings from './instanceSettings/SmtpSettings.svelte';
 import SecretBackendConfig from './instanceSettings/SecretBackendConfig.svelte';
+import GhesAppSettings from './instanceSettings/GhesAppSettings.svelte';
+import WsConnectivityTest from './instanceSettings/WsConnectivityTest.svelte';
 import IndexerMemorySettings from './instanceSettings/IndexerMemorySettings.svelte';
 import IndexerJobIndexSettings from './instanceSettings/IndexerJobIndexSettings.svelte';
 import IndexerLogIndexSettings from './instanceSettings/IndexerLogIndexSettings.svelte';
@@ -247,12 +249,16 @@ $effect(() => {
 	{:else}
 		<SettingCard
 			label={setting.key === 'disable_stats'
-				? ($enterpriseLicense ? 'Minimal telemetry' : 'Disable telemetry')
-				: (setting.fieldType != 'smtp_connect' ? setting.label : undefined)}
+				? $enterpriseLicense
+					? 'Minimal telemetry'
+					: 'Disable telemetry'
+				: setting.fieldType != 'smtp_connect'
+					? setting.label
+					: undefined}
 			description={setting.key === 'disable_stats'
-				? ($enterpriseLicense
+				? $enterpriseLicense
 					? 'Reduces telemetry to only what is needed for license compliance (no job usage data).'
-					: 'Disables telemetry entirely.')
+					: 'Disables telemetry entirely.'
 				: setting.description}
 			ee_only={setting.ee_only}
 			tooltip={setting.tooltip}
@@ -517,10 +523,10 @@ $effect(() => {
 									options={{ right: 'Logs' }}
 								/>
 								<Toggle
-									disabled
+									disabled={!$enterpriseLicense}
 									id="metrics_enabled"
 									bind:checked={$values[setting.key].metrics_enabled}
-									options={{ right: 'Metrics (coming soon)' }}
+									options={{ right: 'Metrics' }}
 								/>
 							</div>
 
@@ -679,6 +685,10 @@ $effect(() => {
 					<SmtpSettings {values} disabled={loading} />
 				{:else if setting.fieldType == 'secret_backend'}
 					<SecretBackendConfig {values} disabled={loading} />
+				{:else if setting.fieldType == 'github_enterprise_app'}
+					<GhesAppSettings {values} disabled={loading || !$enterpriseLicense} />
+				{:else if setting.fieldType == 'ws_connectivity'}
+					<WsConnectivityTest {values} />
 				{/if}
 				{#if hasError}
 					<span class="text-red-600 dark:text-red-400 text-xs">

package/package/components/InstanceSettings.svelte

@@ -15,7 +15,8 @@ import YAML from 'yaml';
 import Toggle from './Toggle.svelte';
 import SettingsFooter from './workspaceSettings/SettingsFooter.svelte';
 import SettingsPageHeader from './settings/SettingsPageHeader.svelte';
-let { tab = $bindable('Core'), hideTabs = false, closeDrawer = () => { }, authSubTab = $bindable('sso'), onNavigateToTab, quickSetup = false, yamlMode = $bindable(false), hasUnsavedChanges = $bindable(false) } = $props();
+import WorkspaceRegistries from './instanceSettings/WorkspaceRegistries.svelte';
+let { tab = $bindable('Core'), hideTabs = false, closeDrawer = () => { }, authSubTab = $bindable('sso'), onNavigateToTab, quickSetup = false, yamlMode = $bindable(false), hasUnsavedChanges = $bindable(false), hasAnyInvalid = $bindable(false) } = $props();
 let values = writable({});
 let initialOauths = $state({});
 let initialRequirePreexistingUserForOauth = $state(false);
@@ -43,7 +44,8 @@ const formDefaults = {
     smtp_settings: {},
     otel: {},
     indexer_settings: {},
-    critical_error_channels: []
+    critical_error_channels: [],
+    github_enterprise_app: {}
 };
 function applyFormDefaults(vals) {
     for (const [key, defaultVal] of Object.entries(formDefaults)) {
@@ -205,12 +207,13 @@ let downloadingStats = $state(false);
 async function downloadStats() {
     try {
         downloadingStats = true;
-        const encryptedData = await SettingService.getStats();
-        const blob = new Blob([encryptedData], { type: 'application/octet-stream' });
+        const result = await SettingService.getStats();
+        const blob = new Blob([result.data ?? ''], { type: 'application/json' });
         const url = URL.createObjectURL(blob);
         const a = document.createElement('a');
         a.href = url;
-        a.download = `windmill-telemetry-${new Date().toISOString().split('T')[0]}.enc`;
+        const date = new Date().toISOString().split('T')[0];
+        a.download = `windmill-telemetry-${date}-${result.signature}.json`;
         document.body.appendChild(a);
         a.click();
         document.body.removeChild(a);
@@ -324,6 +327,9 @@ function buildCategoryYaml(category, vals, oauthsObj, reqPreexisting) {
             obj['require_preexisting_user_for_oauth'] = reqPreexisting;
         }
     }
+    if (category === 'Registries') {
+        obj['workspace_registries'] = vals['workspace_registries'] ?? null;
+    }
     return YAML.stringify(obj);
 }
 let dirtyCategories = $derived.by(() => {
@@ -352,6 +358,9 @@ let invalidCategories = $derived.by(() => {
     }
     return result;
 });
+$effect(() => {
+    hasAnyInvalid = Object.values(invalidCategories).some(Boolean);
+});
 export function isDirty(category) {
     return dirtyCategories[category] ?? false;
 }
@@ -372,6 +381,11 @@ export function discardCategory(category) {
             const v = initialValues[s.key];
             $values[s.key] = v !== undefined ? JSON.parse(JSON.stringify(v)) : undefined;
         }
+        if (category === 'Registries') {
+            const v = initialValues['workspace_registries'];
+            $values['workspace_registries'] =
+                v !== undefined ? JSON.parse(JSON.stringify(v)) : undefined;
+        }
     }
 }
 export function discardAll() {
@@ -462,6 +476,18 @@ export async function saveCategorySettings(category) {
             initialRequirePreexistingUserForOauth = requirePreexistingUserForOauth;
         }
     }
+    // Handle workspace_registries (saved separately like oauths)
+    if (category === 'Registries') {
+        if (!deepEqual(initialValues['workspace_registries'], $values['workspace_registries'])) {
+            await SettingService.setGlobal({
+                key: 'workspace_registries',
+                requestBody: { value: $values['workspace_registries'] ?? null }
+            });
+            initialValues['workspace_registries'] = $values['workspace_registries']
+                ? JSON.parse(JSON.stringify($values['workspace_registries']))
+                : undefined;
+        }
+    }
     if (licenseKeySet)
         setLicense();
     if (shouldReloadPage) {
@@ -486,7 +512,8 @@ const sensitiveKeys = new Set([
         .filter((s) => s.fieldType === 'password' || s.fieldType === 'license_key')
         .map((s) => s.key),
     'ducklake_user_pg_pwd',
-    'jwt_secret'
+    'jwt_secret',
+    'workspace_registries'
 ]);
 // Settings that should never appear in YAML export/import
 const excludedKeys = new Set([]);
@@ -497,7 +524,8 @@ const nestedSensitiveFields = {
     secret_backend: ['token'],
     object_store_cache_config: ['secret_key', 'serviceAccountKey'],
     custom_instance_pg_databases: ['user_pwd'],
-    rsa_keys: ['private_key']
+    rsa_keys: ['private_key'],
+    github_enterprise_app: ['private_key']
 };
 /** Returns SENSITIVE_UNCHANGED if the value is non-empty and matches the initial */
 function maskField(current, initial) {
@@ -818,6 +846,10 @@ $effect(() => {
 					<br />When minimal telemetry is disabled, the following is also collected:
 					<ul class="list-disc list-inside pl-2">
 						<li>job usage (language, total duration, count)</li>
+						<li>git sync repo count (sync vs promotion mode)</li>
+						<li
+							>AI chat usage (provider, model, mode, session count, message count — last 30 days)</li
+						>
 					</ul>
 					<br />For air-gapped instances, you can download the telemetry data and send it manually.
 				</div>
@@ -853,6 +885,9 @@ $effect(() => {
 						<li>worker usage (worker, worker instance, vCPUs, memory)</li>
 						<li>user usage (author count, operator count)</li>
 						<li>development instance status</li>
+						<li
+							>AI chat usage (provider, model, mode, session count, message count — last 30 days)</li
+						>
 					</ul>
 				</div>
 			{/if}
@@ -880,6 +915,11 @@ $effect(() => {
 				description="Configure where secrets (secret variables) are stored."
 				link="https://www.windmill.dev/docs/core_concepts/workspace_secret_encryption"
 			/>
+		{:else if category == 'GitHub Enterprise App'}
+			<SettingsPageHeader
+				title="GitHub Enterprise App"
+				description="Configure a self-managed GitHub App for GitHub Enterprise Server git sync."
+			/>
 		{:else if category == 'Auth/OAuth/SAML'}
 			<AuthSettings
 				bind:oauths
@@ -963,6 +1003,10 @@ $effect(() => {
 			{/if}
 		</div>
 
+		{#if category === 'Registries'}
+			<WorkspaceRegistries {values} {loading} />
+		{/if}
+
 		{#if !loading && !quickSetup && !hideTabs}
 			<SettingsFooter
 				hasUnsavedChanges={dirtyCategories[category] ?? false}

package/package/components/InstanceSettings.svelte.d.ts

@@ -7,6 +7,7 @@ interface Props {
     quickSetup?: boolean;
     yamlMode?: boolean;
     hasUnsavedChanges?: boolean;
+    hasAnyInvalid?: boolean;
 }
 interface $$__sveltets_2_IsomorphicComponent<Props extends Record<string, any> = any, Events extends Record<string, any> = any, Slots extends Record<string, any> = any, Exports = {}, Bindings = string> {
     new (options: import('svelte').ComponentConstructorOptions<Props>): import('svelte').SvelteComponent<Props, Events, Slots> & {
@@ -38,6 +39,6 @@ declare const InstanceSettings: $$__sveltets_2_IsomorphicComponent<Props, {
         original: string;
         modified: string;
     };
-}, "tab" | "hasUnsavedChanges" | "authSubTab" | "yamlMode">;
+}, "tab" | "hasUnsavedChanges" | "authSubTab" | "yamlMode" | "hasAnyInvalid">;
 type InstanceSettings = InstanceType<typeof InstanceSettings>;
 export default InstanceSettings;

package/package/components/JobLoader.svelte

@@ -36,7 +36,7 @@ const noLogsChangeRestartEvent = 'SSE restart after no logs change';
 $effect(() => {
     if (noLogs != lastNoLogs) {
         lastNoLogs = noLogs;
-        if (!noLogs) {
+        if (!noLogs && !getActiveReplay()) {
             currentEventSource?.onerror?.(new Event(noLogsChangeRestartEvent));
             const lastJobId = lastCompletedJobId;
             if (lastJobId && (job || lastCallbacks?.loadExtraLogs)) {
@@ -144,7 +144,7 @@ function refreshLogOffset() {
     }
 }
 export async function getLogs() {
-    if (job) {
+    if (job && !getActiveReplay()) {
         refreshLogOffset();
         const getUpdate = await JobService.getJobUpdates({
             workspace: workspace,
@@ -164,7 +164,7 @@ export async function runDynamicInputScript(entrypoint_function, runnable_ref, a
         requestBody: { entrypoint_function, args, runnable_ref }
     }), callbacks);
 }
-export async function runPreview(path, code, lang, args, tag, lock, hash, callbacks, flowPath) {
+export async function runPreview(path, code, lang, args, tag, lock, hash, callbacks, flowPath, modules) {
     return abstractRun(() => JobService.runScriptPreview({
         workspace: $workspaceStore,
         requestBody: {
@@ -175,7 +175,8 @@ export async function runPreview(path, code, lang, args, tag, lock, hash, callba
             tag,
             lock,
             script_hash: hash,
-            flow_path: flowPath
+            flow_path: flowPath,
+            modules: modules ?? undefined
         }
     }), callbacks);
 }

package/package/components/JobLoader.svelte.d.ts

@@ -59,7 +59,7 @@ declare const JobLoader: import("svelte").Component<Props, {
     }, callbacks?: Callbacks, path?: string) => Promise<string>;
     getLogs: () => Promise<void>;
     runDynamicInputScript: (entrypoint_function: string, runnable_ref: DynamicInput.HelperScript, args: Record<string, any>, callbacks?: Callbacks) => Promise<string>;
-    runPreview: (path: string | undefined, code: string, lang: SupportedLanguage | undefined, args: Record<string, any>, tag: string | undefined, lock?: string, hash?: string, callbacks?: Callbacks, flowPath?: string) => Promise<string>;
+    runPreview: (path: string | undefined, code: string, lang: SupportedLanguage | undefined, args: Record<string, any>, tag: string | undefined, lock?: string, hash?: string, callbacks?: Callbacks, flowPath?: string, modules?: Record<string, import("../gen").ScriptModule> | null) => Promise<string>;
     cancelJob: () => Promise<void>;
     clearCurrentJob: () => Promise<void>;
     watchJob: (testId: string, callbacks?: Callbacks) => Promise<void>;

package/package/components/Login.svelte

@@ -127,7 +127,8 @@ async function redirectUser() {
                     workspace: $workspaceStore
                 });
                 if (!emptyString(defaultApp.default_app_path)) {
-                    goto(`/apps/get/${defaultApp.default_app_path}`);
+                    const prefix = defaultApp.default_app_raw ? '/apps_raw/get' : '/apps/get';
+                    goto(`${prefix}/${defaultApp.default_app_path}`);
                 }
                 else {
                     goto(rd ?? '/');
@@ -300,6 +301,13 @@ $effect(() => {
 				btnClasses="mt-2 w-full"
 				on:click={() => {
 					if (saml) {
+						if (rd) {
+							try {
+								localStorage.setItem('rd', rd)
+							} catch (e) {
+								console.error('Could not persist redirection to local storage', e)
+							}
+						}
 						window.location.href = saml
 					} else {
 						sendUserToast('No SAML login available', true)

package/package/components/NoMainFuncBadge.svelte

@@ -4,7 +4,7 @@ import { Badge } from './common';
 
 <Popover notClickable>
 	{#snippet text()}
-		The script has no main function exported
+		Library script (no exported main function)
 	{/snippet}
-	<Badge small color="yellow" baseClass="border border-indigo-200">No main</Badge>
+	<Badge small color="yellow" baseClass="border border-indigo-200">Library</Badge>
 </Popover>

package/package/components/OnBehalfOfSelector.svelte

@@ -1,11 +1,15 @@
 <script lang="ts" module>/**
  * Check if an item needs on_behalf_of selection.
- * Shows the selector when the source item has an on_behalf_of_email set.
+ * Shows the selector when the source item has an on_behalf_of value set.
  */
-export function needsOnBehalfOfSelection(kind, sourceEmail) {
-    if (kind !== 'flow' && kind !== 'script' && kind !== 'app' && kind !== 'trigger')
+export function needsOnBehalfOfSelection(kind, sourceValue) {
+    if (kind !== 'flow' &&
+        kind !== 'script' &&
+        kind !== 'app' &&
+        kind !== 'raw_app' &&
+        kind !== 'trigger')
         return false;
-    return !!sourceEmail;
+    return !!sourceValue;
 }
 </script>
 
@@ -15,9 +19,10 @@ import Modal from './common/modal/Modal.svelte';
 import { userStore } from '../stores';
 import { UserService } from '../gen';
 import TextInput from './text_input/TextInput.svelte';
-let { targetWorkspace, targetEmail, selected, onSelect, kind, canPreserve, customEmail, isDeployment = true } = $props();
-let label = $derived(kind === 'trigger'
-    ? 'Set the user this will be recorded as edited by:'
+let { targetWorkspace, targetValue, selected, onSelect, kind, canPreserve, customValue, isDeployment = true } = $props();
+const isTrigger = $derived(kind === 'trigger');
+let label = $derived(isTrigger
+    ? 'Set the user this will be permissioned as:'
     : 'Set the user this will be run on behalf of:');
 let users = $state([]);
 let usersLoaded = $state(false);
@@ -36,13 +41,18 @@ async function loadUsers() {
 }
 // Fetch users eagerly so we can resolve usernames for display
 loadUsers();
-function resolveUsername(email) {
-    if (!email)
+/** Resolve a value to a display name, always showing u/username format */
+function resolveDisplayName(value) {
+    if (!value)
         return undefined;
-    return users.find((u) => u.email === email)?.username ?? email;
+    if (value.startsWith('u/') || value.startsWith('g/'))
+        return value;
+    const username = users.find((u) => u.email === value)?.username;
+    return username ? `u/${username}` : value;
 }
-let targetUsername = $derived(resolveUsername(targetEmail));
-let customUsername = $derived(resolveUsername(customEmail));
+let targetDisplayName = $derived(resolveDisplayName(targetValue));
+let customDisplayName = $derived(resolveDisplayName(customValue));
+let myDisplayName = $derived($userStore?.username ? `u/${$userStore.username}` : undefined);
 let activeUsers = $derived(users.filter((u) => !u.disabled));
 let filteredUsers = $derived(searchQuery
     ? activeUsers.filter((u) => {
@@ -54,7 +64,7 @@ let filteredUsers = $derived(searchQuery
     : activeUsers);
 // Preselect "target" when available and user has permission to preserve
 $effect(() => {
-    if (selected === undefined && targetEmail && canPreserve) {
+    if (selected === undefined && targetValue && canPreserve) {
         onSelect('target');
     }
 });
@@ -64,36 +74,34 @@ function openModal() {
     modalOpen = true;
 }
 function selectUser(user) {
-    onSelect('custom', user.email, user.username);
+    onSelect('custom', { email: user.email, permissionedAs: `u/${user.username}` });
     modalOpen = false;
 }
 let selectedDisplayName = $derived.by(() => {
     if (selected === 'target')
-        return targetUsername;
+        return targetDisplayName;
     if (selected === 'me')
-        return $userStore?.username;
+        return myDisplayName;
     if (selected === 'custom')
-        return customUsername;
+        return customDisplayName;
     return undefined;
 });
 </script>
 
 <MeltPopover placement="bottom" on:openChange={(e) => e.detail && loadUsers()}>
 	{#snippet trigger()}
-	
-			<span class="inline-flex items-center gap-1">
-				<UserCog class="w-4 h-4 {selected ? 'text-green-500' : 'text-yellow-500'}" />
-				{#if selectedDisplayName}
-					<span class="text-xs truncate max-w-24">{selectedDisplayName}</span>
-				{/if}
-			</span>
-		
+		<span class="inline-flex items-center gap-1">
+			<UserCog class="w-4 h-4 {selected ? 'text-green-500' : 'text-yellow-500'}" />
+			{#if selectedDisplayName}
+				<span class="text-xs truncate max-w-24">{selectedDisplayName}</span>
+			{/if}
+		</span>
 	{/snippet}
 	{#snippet content({ close: closePopover })}
-		<div   class="p-3 flex flex-col gap-2 min-w-48">
+		<div class="p-3 flex flex-col gap-2 min-w-48">
 			<div class="text-xs font-medium text-secondary mb-1">{label}</div>
 			<!-- Target option -->
-			{#if targetEmail}
+			{#if targetValue}
 				<button
 					class="flex items-center gap-2 px-2 py-1.5 rounded text-left text-xs hover:bg-surface-hover {!canPreserve
 						? 'opacity-50 cursor-not-allowed'
@@ -102,7 +110,7 @@ let selectedDisplayName = $derived.by(() => {
 					onclick={() => onSelect('target')}
 				>
 					<Check class="w-3 h-3 {selected === 'target' ? 'opacity-100' : 'opacity-0'}" />
-					<span class="truncate max-w-40">{targetUsername}</span>
+					<span class="truncate max-w-40">{targetDisplayName}</span>
 					<span class="text-xs text-tertiary">{isDeployment ? '(target)' : '(current)'}</span>
 				</button>
 			{/if}
@@ -112,7 +120,7 @@ let selectedDisplayName = $derived.by(() => {
 				onclick={() => onSelect('me')}
 			>
 				<Check class="w-3 h-3 {selected === 'me' ? 'opacity-100' : 'opacity-0'}" />
-				<span class="truncate max-w-40">{$userStore?.username}</span>
+				<span class="truncate max-w-40">{myDisplayName}</span>
 				<span class="text-xs text-tertiary">(me)</span>
 			</button>
 			<!-- Custom / Pick from workspace -->
@@ -126,9 +134,9 @@ let selectedDisplayName = $derived.by(() => {
 					openModal()
 				}}
 			>
-				{#if selected === 'custom' && customUsername}
+				{#if selected === 'custom' && customDisplayName}
 					<Check class="w-3 h-3 opacity-100" />
-					<span class="truncate max-w-40">{customUsername}</span>
+					<span class="truncate max-w-40">{customDisplayName}</span>
 					<span class="text-xs text-tertiary">(custom)</span>
 				{:else}
 					<Check class="w-3 h-3 opacity-0" />
@@ -144,11 +152,15 @@ let selectedDisplayName = $derived.by(() => {
 <Modal title="Select a user" bind:open={modalOpen} kind="X">
 	<div class="flex flex-col gap-4">
 		<div class="text-xs text-secondary">
-			{#if kind === 'trigger'}
-				Choose the user this trigger will be recorded as edited by {isDeployment ? 'in the target workspace' : 'in this workspace'}.
+			{#if isTrigger}
+				Choose the user this trigger will be permissioned as {isDeployment
+					? 'in the target workspace'
+					: 'in this workspace'}. The selected user's permissions will be used when the trigger
+				fires.
 			{:else}
-				Choose the user this {kind} will run on behalf of {isDeployment ? 'in the target workspace' : 'in this workspace'}. The selected
-				user's permissions will be used when executing.
+				Choose the user this {kind} will run on behalf of {isDeployment
+					? 'in the target workspace'
+					: 'in this workspace'}. The selected user's permissions will be used when executing.
 			{/if}
 			<a
 				href="https://www.windmill.dev/docs/core_concepts/roles_and_permissions"
@@ -170,10 +182,10 @@ let selectedDisplayName = $derived.by(() => {
 					onclick={() => selectUser(user)}
 				>
 					<div class="flex flex-col min-w-0">
-						<span class="font-medium truncate">{user.username}</span>
+						<span class="font-medium truncate">u/{user.username}</span>
 						<span class="text-xs text-tertiary truncate">{user.email}</span>
 					</div>
-					{#if customEmail === user.email && selected === 'custom'}
+					{#if selected === 'custom' && (customValue === `u/${user.username}` || customValue === user.email)}
 						<Check class="w-4 h-4 text-green-500 ml-auto flex-shrink-0" />
 					{/if}
 				</button>