cli-commands

# Windmill CLI Commands The Windmill CLI (`wmill`) provides commands for managing scripts, flows, apps, and other resources. ## Global Options - `--workspace <workspace:string>` - Specify the target workspace. This overrides the default workspace. - `--debug --verbose` - Show debug/verbose logs - `--show-diffs` - Show diff informations when syncing (may show sensitive informations) - `--token <token:string>` - Specify an API token. This will override any stored token. - `--base-url <baseUrl:string>` - Specify the base URL of the API. If used, --token and --workspace are required and no local remote/workspace already set will be used. - `--config-dir <configDir:string>` - Specify a custom config directory. Overrides WMILL_CONFIG_DIR environment variable and default ~/.config location. ## Commands ### app app related commands **Options:** - `--json` - Output as JSON (for piping to jq) **Subcommands:** - `app list` - list all apps - `--json` - Output as JSON (for piping to jq) - `app get <path:string>` - get an app's details - `--json` - Output as JSON (for piping to jq) - `app push [file_path:string] [remote_path:string]` - push a local app. With no args, infers the app from the current directory and the remote path from its location relative to wmill.yaml. - `app dev [app_folder:string]` - Start a development server for building apps with live reload and hot module replacement - `--port <port:number>` - Port to run the dev server on (will find next available port if occupied) - `--host <host:string>` - Host to bind the dev server to - `--entry <entry:string>` - Entry point file (default: index.ts for Svelte/Vue, index.tsx otherwise) - `--no-open` - Don't automatically open the browser - `--recording` - Frame the app in a shell with a Record button, to capture a replayable session recording of the app under development - `app lint [app_folder:string]` - Lint a raw app folder to validate structure and buildability - `--fix` - Attempt to fix common issues (not implemented yet) - `app bundle [app_folder:string]` - Bundle a raw app folder to js/css without deploying it - `--out <dir:string>` - Directory to write bundle.js and bundle.css into (default: <app_folder>/dist) - `--no-minify` - Skip minification - `app new` - create a new raw app from a template - `--summary <summary:string>` - App summary (short description). Skips the prompt when provided. Triggers non-interactive mode. - `--path <path:string>` - App path (e.g., f/folder/my_app or u/username/my_app). Skips the prompt when provided. Triggers non-interactive mode. - `--framework <framework:string>` - Framework template: react19 | react18 | svelte5 | vue. Skips the prompt when provided. Triggers non-interactive mode. - `--datatable <datatable:string>` - Datatable to wire up. Without this flag in non-interactive mode, no datatable is configured. - `--schema <schema:string>` - Schema to use with --datatable. Created (CREATE SCHEMA IF NOT EXISTS) if it doesn't already exist. - `--overwrite` - Overwrite the target directory if it already exists, without prompting. - `--no-open-in-desktop` - Do not prompt to open the new app in Claude Desktop. - `app generate-agents [app_folder:string]` - regenerate AGENTS.md and DATATABLES.md from remote workspace - `app set-permissioned-as <path:string> <email:string>` - Set the on_behalf_of_email for an app (requires admin or wm_deployers group) ### audit View audit logs (requires admin) **Subcommands:** - `audit list` - List audit log entries - `audit get <id:string>` - Get a specific audit log entry - `--json` - Output as JSON (for piping to jq) ### config Show all available wmill.yaml configuration options **Options:** - `--json` - Output as JSON for programmatic consumption **Subcommands:** - `config migrate` - Migrate wmill.yaml from gitBranches/environments to workspaces format ### datatable datatable related commands **Subcommands:** - `datatable list` - list all datatables in the workspace - `--json` - Output as JSON (for piping to jq) - `datatable run <sql:string>` - run a SQL query on a datatable - `-n --name <name:string>` - Datatable name (default: main) - `-s --silent` - Output only the final result as JSON. Useful for scripting. - `datatable migrate` - manage datatable migrations - `datatable migrate new <name:string>` - scaffold a new migration (.up.sql / .down.sql files) - `-d --datatable <datatable:string>` - Target datatable (default: main) - `datatable migrate up` - apply all pending migrations to the main datatable (or one via --datatable) - `-d --datatable <datatable:string>` - Target datatable (default: main) - `datatable migrate down` - roll back the most recent migration on the main datatable (or one via --datatable) - `-d --datatable <datatable:string>` - Target datatable (default: main) - `datatable migrate status` - show applied and pending migrations on the main datatable (or one via --datatable) - `-d --datatable <datatable:string>` - Target datatable (default: main) - `--json` - Output as JSON (for piping to jq) - `datatable create [name:string]` - register a datatable database in the workspace (default: instance-backed 'main') so scripts can use datatable://<name> - `--resource <resource:string>` - Back the datatable with an existing postgresql resource path instead of the instance database - `--force` - Allow adding to a workspace that already has datatables (fork metadata on existing ones is not preserved) - `datatable serve` - Serve all datatables as a Postgres-wire endpoint (psql, DBeaver, pgAdmin); the client picks the datatable via the database name in its connection string - `--port <port:number>` - Port to listen on (default: first free port in 5433-5500) - `--host <host:string>` - Bind address (default: 127.0.0.1) - `--password <password:string>` - Password for Postgres clients (default: generate a random password at startup) - `datatable psql` - Start a serve listener and launch psql connected to it - `-n --name <name:string>` - Datatable to connect psql to (default: main) - `--port <port:number>` - Port the proxy listens on (default: first free port in 5433-5500) - `--host <host:string>` - Bind address for the proxy (default: 127.0.0.1) - `--password <password:string>` - Password for the temporary Postgres proxy (default: generate a random password at startup) ### dependencies workspace dependencies related commands **Alias:** `deps` **Subcommands:** - `dependencies push <file_path:string>` - Push workspace dependencies from a local file ### dev Watch local file changes and live-reload the dev page for preview. Does NOT deploy to the remote workspace — use wmill sync push for that. **Options:** - `--includes <pattern...:string>` - Filter paths given a glob pattern or path - `--proxy-port <port:number>` - Port for a localhost reverse proxy to the remote Windmill server - `--path <path:string>` - Watch a specific windmill path (e.g., u/admin/my_script or f/my_flow) - `--no-open` - Do not open the browser automatically ### digest Compute the content digest of local scripts and flows, as the `digest` and `root_digest` claims of job OIDC tokens carry it. Run from the root of a sync checkout, pulled after the deployment's dependency jobs completed: they write the lockfiles the digest covers. A flow also lists the digest of each inline step, as `<flow path>/<step id>`. **Arguments:** `<paths...:string>` **Options:** - `--json` - Output the digests as JSON ### docs Search Windmill documentation. **Arguments:** `<query:string>` **Options:** - `--json` - Output results as JSON. ### ducklake ducklake related commands **Subcommands:** - `ducklake list` - list all ducklakes in the workspace - `--json` - Output as JSON (for piping to jq) - `ducklake run <sql:string>` - run a SQL query on a ducklake - `-n --name <name:string>` - Ducklake name (default: main) - `-s --silent` - Output only the final result as JSON. Useful for scripting. ### flow flow related commands **Options:** - `--show-archived` - Enable archived flows in output - `--json` - Output as JSON (for piping to jq) **Subcommands:** - `flow list` - list all flows - `--show-archived` - Enable archived flows in output - `--json` - Output as JSON (for piping to jq) - `flow get <path:string>` - get a flow's details - `--json` - Output as JSON (for piping to jq) - `flow push <file_path:string> <remote_path:string>` - push a local flow spec. This overrides any remote versions. - `--message <message:string>` - Deployment message - `flow run <path:string>` - run a flow by path. - `-d --data <data:string>` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-. A resource argument is the bare string $res:<path> as its whole value, and a variable argument is the bare string $var:<path> — not an object wrapper keyed on $res/$var, and not a plain path. - `-s --silent` - Do not ouput anything other then the final output. Useful for scripting. - `--tag <tag:string>` - Override the worker tag the run is dispatched to (e.g. to route it to dev workers instead of the flow's default tag). - `flow preview <flow_path:string>` - preview a local flow without deploying it. Runs the flow definition from local files and uses local PathScripts by default. Pass --step <id> to run only one module in isolation (resolves nested steps inside branchone/branchall/forloopflow/whileloopflow plus the special preprocessor/failure modules; supported step types: rawscript, script, flow). - `-d --data <data:string>` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-. A resource argument is the bare string $res:<path> as its whole value, and a variable argument is the bare string $var:<path> — not an object wrapper keyed on $res/$var, and not a plain path. - `-s --silent` - Do not output anything other then the final output. Useful for scripting. - `--remote` - Use deployed workspace scripts for PathScript steps instead of local files. - `--step <step_id:string>` - Run only the named step instead of the whole flow. Honors --data as the step's args and --remote / local-PathScript resolution the same way the full-flow preview does. - `--tag <tag:string>` - Override the worker tag the preview is dispatched to (e.g. to route it to dev workers instead of the flow's default tag). - `flow new <flow_path:string>` - create a new empty flow - `--summary <summary:string>` - flow summary - `--description <description:string>` - flow description - `flow bootstrap <flow_path:string>` - create a new empty flow (alias for new) - `--summary <summary:string>` - flow summary - `--description <description:string>` - flow description - `flow history <path:string>` - Show version history for a flow - `--json` - Output as JSON (for piping to jq) - `flow show-version <path:string> <version:string>` - Show a specific version of a flow - `--json` - Output as JSON (for piping to jq) - `flow set-permissioned-as <path:string> <email:string>` - Set the on_behalf_of_email for a flow (requires admin or wm_deployers group) ### folder folder related commands **Options:** - `--json` - Output as JSON (for piping to jq) **Subcommands:** - `folder list` - list all folders - `--json` - Output as JSON (for piping to jq) - `folder get <name:string>` - get a folder's details - `--json` - Output as JSON (for piping to jq) - `folder new <name:string>` - create a new folder locally - `--summary <summary:string>` - folder summary - `folder push <name:string>` - push a local folder to the remote by name. This overrides any remote versions. - `folder add-missing` - create default folder.meta.yaml for all subdirectories of f/ that are missing one - `-y, --yes` - skip confirmation prompt - `folder show-rules <name:string>` - Show default_permissioned_as rules for a folder. Use --test-path to see which rule matches a given item path. - `--test-path <path:string>` - Test which rule matches this item path (e.g. f/prod/jobs/my_script) - `--json` - Output as JSON ### generate-metadata Regenerate stale local locks and script schemas and refresh wmill-lock.yaml content hashes (scripts, flows, apps). Writes local files only, not a deploy. Run it after edits that add or remove imports or change a script's arguments, so the lock, the auto-generated UI schema, and wmill-lock.yaml stay in sync. **Arguments:** `[folder:string]` **Options:** - `--yes` - Skip confirmation prompt - `--dry-run` - Show what would be updated without making changes - `--lock-only` - Re-generate only the lock files - `--schema-only` - Re-generate only script schemas (skips flows and apps) - `--skip-scripts` - Skip processing scripts - `--skip-flows` - Skip processing flows - `--skip-apps` - Skip processing apps - `--strict-folder-boundaries` - Only update items inside the specified folder (requires folder argument) - `--parallel <n:number>` - Number of items to process in parallel - `-i --includes <patterns:file[]>` - Comma separated patterns to specify which files to include - `-e --excludes <patterns:file[]>` - Comma separated patterns to specify which files to exclude **Subcommands:** - `generate-metadata rehash [folder:string]` - Refresh wmill-lock.yaml content hashes from the on-disk .lock and .script.yaml without re-resolving dependencies or hitting the backend. Use when those files are already correct and only the hashes need updating: bootstrapping missing entries or recovering from hash drift. - `--skip-scripts` - Skip processing scripts - `--skip-flows` - Skip processing flows - `--skip-apps` - Skip processing apps - `--parallel <n:number>` - Number of items to process in parallel - `-i --includes <patterns:file[]>` - Comma separated patterns to specify which files to include - `-e --excludes <patterns:file[]>` - Comma separated patterns to specify which files to exclude ### gitsync-settings Manage git-sync settings between local wmill.yaml and Windmill backend **Subcommands:** - `gitsync-settings pull` - Pull git-sync settings from Windmill backend to local wmill.yaml - `--repository <repo:string>` - Specify repository path (e.g., u/user/repo) - `--default` - Write settings to top-level defaults instead of overrides - `--replace` - Replace existing settings (non-interactive mode) - `--override` - Add branch-specific override (non-interactive mode) - `--diff` - Show differences without applying changes - `--json-output` - Output in JSON format - `--with-backend-settings <json:string>` - Use provided JSON settings instead of querying backend (for testing) - `--yes` - Skip interactive prompts and use default behavior