starred/windmill
1
0
Fork 0
mirror of https://github.com/windmill-labs/windmill.git synced 2026-08-25 00:01:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/main' into glm/quick-datatable-onboarding

Browse Source 
# Conflicts:
#	backend/ee-repo-ref.txt
This commit is contained in:
Guilhem Lemouel
2026-08-13 18:34:09 +02:00
parent ad79a6eb9e 44b7d97e36
commit 3cc0d93acf
105 changed files with 3934 additions and 839 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.agents/skills/UPSTREAM.md
+63
View File
@@ -0,0 +1,63 @@
# Vendored skills
These five skills are copied from an external repository, not written here:
- `grill-me`, `grilling`
- `improve-codebase-architecture`, `codebase-design`, `domain-modeling`
Source: https://github.com/mattpocock/skills
Pinned at commit `84fdeffd12f2ee307994d1eb6feb48173b6e0502`.
They form one dependency closure — `grill-me` is a stub that runs `grilling`, and
`improve-codebase-architecture` draws its vocabulary from `codebase-design` and its
CONTEXT.md upkeep from `domain-modeling`. Removing any one breaks the others.
Local changes on top of upstream, kept to the minimum so a refresh stays a diff:
- Flattened the upstream `skills/engineering/` and `skills/productivity/` split, since this
repo's skills are flat.
- Replaced each SKILL.md's markdown links to its own bundled files with plain repo-root paths
in prose (`.agents/skills/<skill>/FILE.md`). Upstream's sibling-relative links break when the
file is read through the `.claude/skills/<skill>/SKILL.md` symlink, which mirrors only
SKILL.md — and a repo-root *link* is equally wrong, since a markdown target resolves relative
to the file containing it. Companion files keep their sibling-relative links; they are only
ever read at their real path, never through the symlink.
- Dropped the upstream `agents/openai.yaml` files — Codex packaging metadata for that repo's
own plugin distribution, unused here.
- **Removed every ADR path.** Upstream, `domain-modeling` offers to write Architecture Decision
Records into `docs/adr/` and `improve-codebase-architecture` reads and cites them. This repo has
not adopted ADRs, and a skill that offers to create them is how the practice arrives by side
effect rather than by decision. Deleted `domain-modeling/ADR-FORMAT.md`, its "Offer ADRs
sparingly" section, and the `docs/adr/` entries in its file-structure diagrams; dropped the ADR
clauses from `improve-codebase-architecture` (intro, explore step, "ADR conflicts", the
offer-an-ADR bullet in the grilling loop) and the ADR callout row in `HTML-REPORT.md`. Also cut
"record an architectural decision" from `domain-modeling`'s description, since that phrase is an
invocation trigger. What remains is CONTEXT.md and ubiquitous-language work only.
To refresh, diff against the same paths at a newer commit and re-apply these four changes. The
ADR removal is the one that needs judgement: if the team later adopts ADRs, take upstream's
version of those sections back rather than rewriting them here.
## License
MIT License
Copyright (c) 2026 Matt Pocock
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
.agents/skills/codebase-design/DEEPENING.md
+37
View File
@@ -0,0 +1,37 @@
# Deepening
How to deepen a cluster of shallow modules safely, given its dependencies. Assumes the vocabulary in [SKILL.md](SKILL.md) — **module**, **interface**, **seam**, **adapter**.
## Dependency categories
When assessing a candidate for deepening, classify its dependencies. The category determines how the deepened module is tested across its seam.
### 1. In-process
Pure computation, in-memory state, no I/O. Always deepenable — merge the modules and test through the new interface directly. No adapter needed.
### 2. Local-substitutable
Dependencies that have local test stand-ins (PGLite for Postgres, in-memory filesystem). Deepenable if the stand-in exists. The deepened module is tested with the stand-in running in the test suite. The seam is internal; no port at the module's external interface.
### 3. Remote but owned (Ports & Adapters)
Your own services across a network boundary (microservices, internal APIs). Define a **port** (interface) at the seam. The deep module owns the logic; the transport is injected as an **adapter**. Tests use an in-memory adapter. Production uses an HTTP/gRPC/queue adapter.
Recommendation shape: *"Define a port at the seam, implement an HTTP adapter for production and an in-memory adapter for testing, so the logic sits in one deep module even though it's deployed across a network."*
### 4. True external (Mock)
Third-party services (Stripe, Twilio, etc.) you don't control. The deepened module takes the external dependency as an injected port; tests provide a mock adapter.
## Seam discipline
- **One adapter means a hypothetical seam. Two adapters means a real one.** Don't introduce a port unless at least two adapters are justified (typically production + test). A single-adapter seam is just indirection.
- **Internal seams vs external seams.** A deep module can have internal seams (private to its implementation, used by its own tests) as well as the external seam at its interface. Don't expose internal seams through the interface just because tests use them.
## Testing strategy: replace, don't layer
- Old unit tests on shallow modules become waste once tests at the deepened module's interface exist — delete them.
- Write new tests at the deepened module's interface. The **interface is the test surface**.
- Tests assert on observable outcomes through the interface, not internal state.
- Tests should survive internal refactors — they describe behaviour, not implementation. If a test has to change when the implementation changes, it's testing past the interface.
.agents/skills/codebase-design/DESIGN-IT-TWICE.md
+44
View File
@@ -0,0 +1,44 @@
# Design It Twice
When the user wants to explore alternative interfaces for a chosen deepening candidate, use this parallel sub-agent pattern. Based on "Design It Twice" (Ousterhout) — your first idea is unlikely to be the best.
Uses the vocabulary in [SKILL.md](SKILL.md) — **module**, **interface**, **seam**, **adapter**, **leverage**.
## Process
### 1. Frame the problem space
Before spawning sub-agents, write a user-facing explanation of the problem space for the chosen candidate:
- The constraints any new interface would need to satisfy
- The dependencies it would rely on, and which category they fall into (see [DEEPENING.md](DEEPENING.md))
- A rough illustrative code sketch to ground the constraints — not a proposal, just a way to make the constraints concrete
Show this to the user, then immediately proceed to Step 2. The user reads and thinks while the sub-agents work in parallel.
### 2. Spawn sub-agents
Spawn 3+ sub-agents in parallel. Each must produce a **radically different** interface for the deepened module.
Prompt each sub-agent with a separate technical brief (file paths, coupling details, dependency category from [DEEPENING.md](DEEPENING.md), what sits behind the seam). The brief is independent of the user-facing problem-space explanation in Step 1. Give each agent a different design constraint:
- Agent 1: "Minimize the interface — aim for 1–3 entry points max. Maximise leverage per entry point."
- Agent 2: "Maximise flexibility — support many use cases and extension."
- Agent 3: "Optimise for the most common caller — make the default case trivial."
- Agent 4 (if applicable): "Design around ports & adapters for cross-seam dependencies."
Include both [SKILL.md](SKILL.md) vocabulary and CONTEXT.md vocabulary in the brief so each sub-agent names things consistently with the architecture language and the project's domain language.
Each sub-agent outputs:
1. Interface (types, methods, params — plus invariants, ordering, error modes)
2. Usage example showing how callers use it
3. What the implementation hides behind the seam
4. Dependency strategy and adapters (see [DEEPENING.md](DEEPENING.md))
5. Trade-offs — where leverage is high, where it's thin
### 3. Present and compare
Present designs sequentially so the user can absorb each one, then compare them in prose. Contrast by **depth** (leverage at the interface), **locality** (where change concentrates), and **seam placement**.
After comparing, give your own recommendation: which design you think is strongest and why. If elements from different designs would combine well, propose a hybrid. Be opinionated — the user wants a strong read, not a menu.
.agents/skills/codebase-design/SKILL.md
+114
View File
@@ -0,0 +1,114 @@
---
name: codebase-design
description: Shared vocabulary for designing deep modules. Use when the user wants to design or improve a module's interface, find deepening opportunities, decide where a seam goes, make code more testable or AI-navigable, or when another skill needs the deep-module vocabulary.
---
# Codebase Design
Design **deep modules**: a lot of behaviour behind a small interface, placed at a clean seam, testable through that interface. Use this language and these principles wherever code is being designed or restructured. The aim is leverage for callers, locality for maintainers, and testability for everyone.
## Glossary
Use these terms exactly — don't substitute "component," "service," "API," or "boundary." Consistent language is the whole point.
**Module** — anything with an interface and an implementation. Deliberately scale-agnostic: a function, class, package, or tier-spanning slice. _Avoid_: unit, component, service.
**Interface** — everything a caller must know to use the module correctly: the type signature, but also invariants, ordering constraints, error modes, required configuration, and performance characteristics. _Avoid_: API, signature (too narrow — they refer only to the type-level surface).
**Implementation** — what's inside a module, its body of code. Distinct from **Adapter**: a thing can be a small adapter with a large implementation (a Postgres repo) or a large adapter with a small implementation (an in-memory fake). Reach for "adapter" when the seam is the topic; "implementation" otherwise.
**Depth** — leverage at the interface: the amount of behaviour a caller (or test) can exercise per unit of interface they have to learn. A module is **deep** when a large amount of behaviour sits behind a small interface, **shallow** when the interface is nearly as complex as the implementation.
**Seam** _(Michael Feathers)_ — a place where you can alter behaviour without editing in that place; the *location* at which a module's interface lives. Where to put the seam is its own design decision, distinct from what goes behind it. _Avoid_: boundary (overloaded with DDD's bounded context).
**Adapter** — a concrete thing that satisfies an interface at a seam. Describes *role* (what slot it fills), not substance (what's inside).
**Leverage** — what callers get from depth: more capability per unit of interface they learn. One implementation pays back across N call sites and M tests.
**Locality** — what maintainers get from depth: change, bugs, knowledge, and verification concentrate in one place rather than spreading across callers. Fix once, fixed everywhere.
## Deep vs shallow
**Deep module** = small interface + lots of implementation:
```
┌─────────────────────┐
│ Small Interface │ ← Few methods, simple params
├─────────────────────┤
│ │
│ Deep Implementation│ ← Complex logic hidden
│ │
└─────────────────────┘
```
**Shallow module** = large interface + little implementation (avoid):
```
┌─────────────────────────────────┐
│ Large Interface │ ← Many methods, complex params
├─────────────────────────────────┤
│ Thin Implementation │ ← Just passes through
└─────────────────────────────────┘
```
When designing an interface, ask:
- Can I reduce the number of methods?
- Can I simplify the parameters?
- Can I hide more complexity inside?
## Principles
- **Depth is a property of the interface, not the implementation.** A deep module can be internally composed of small, mockable, swappable parts — they just aren't part of the interface. A module can have **internal seams** (private to its implementation, used by its own tests) as well as the **external seam** at its interface.
- **The deletion test.** Imagine deleting the module. If complexity vanishes, it was a pass-through. If complexity reappears across N callers, it was earning its keep.
- **The interface is the test surface.** Callers and tests cross the same seam. If you want to test *past* the interface, the module is probably the wrong shape.
- **One adapter means a hypothetical seam. Two adapters means a real one.** Don't introduce a seam unless something actually varies across it.
## Designing for testability
Good interfaces make testing natural:
1. **Accept dependencies, don't create them.**
```typescript
// Testable
function processOrder(order, paymentGateway) {}
// Hard to test
function processOrder(order) {
const gateway = new StripeGateway();
}
```
2. **Return results, don't produce side effects.**
```typescript
// Testable
function calculateDiscount(cart): Discount {}
// Hard to test
function applyDiscount(cart): void {
cart.total -= discount;
}
```
3. **Small surface area.** Fewer methods = fewer tests needed. Fewer params = simpler test setup.
## Relationships
- A **Module** has exactly one **Interface** (the surface it presents to callers and tests).
- **Depth** is a property of a **Module**, measured against its **Interface**.
- A **Seam** is where a **Module**'s **Interface** lives.
- An **Adapter** sits at a **Seam** and satisfies the **Interface**.
- **Depth** produces **Leverage** for callers and **Locality** for maintainers.
## Rejected framings
- **Depth as ratio of implementation-lines to interface-lines** (Ousterhout): rewards padding the implementation. We use depth-as-leverage instead.
- **"Interface" as the TypeScript `interface` keyword or a class's public methods**: too narrow — interface here includes every fact a caller must know.
- **"Boundary"**: overloaded with DDD's bounded context. Say **seam** or **interface**.
## Going deeper
- **Deepening a cluster given its dependencies** — see `.agents/skills/codebase-design/DEEPENING.md` (path from the repo root): dependency categories, seam discipline, and replace-don't-layer testing.
- **Exploring alternative interfaces** — see `.agents/skills/codebase-design/DESIGN-IT-TWICE.md` (path from the repo root): spin up parallel sub-agents to design the interface several radically different ways, then compare on depth, locality, and seam placement.
.agents/skills/domain-modeling/CONTEXT-FORMAT.md
+60
View File
@@ -0,0 +1,60 @@
# CONTEXT.md Format
## Structure
```md
# {Context Name}
{One or two sentence description of what this context is and why it exists.}
## Language
**Order**:
{A one or two sentence description of the term}
_Avoid_: Purchase, transaction
**Invoice**:
A request for payment sent to a customer after delivery.
_Avoid_: Bill, payment request
**Customer**:
A person or organization that places orders.
_Avoid_: Client, buyer, account
```
## Rules
- **Be opinionated.** When multiple words exist for the same concept, pick the best one and list the others under `_Avoid_`.
- **Keep definitions tight.** One or two sentences max. Define what it IS, not what it does.
- **Only include terms specific to this project's context.** General programming concepts (timeouts, error types, utility patterns) don't belong even if the project uses them extensively. Before adding a term, ask: is this a concept unique to this context, or a general programming concept? Only the former belongs.
- **Group terms under subheadings** when natural clusters emerge. If all terms belong to a single cohesive area, a flat list is fine.
## Single vs multi-context repos
**Single context (most repos):** One `CONTEXT.md` at the repo root.
**Multiple contexts:** A `CONTEXT-MAP.md` at the repo root lists the contexts, where they live, and how they relate to each other:
```md
# Context Map
## Contexts
- [Ordering](./src/ordering/CONTEXT.md) — receives and tracks customer orders
- [Billing](./src/billing/CONTEXT.md) — generates invoices and processes payments
- [Fulfillment](./src/fulfillment/CONTEXT.md) — manages warehouse picking and shipping
## Relationships
- **Ordering → Fulfillment**: Ordering emits `OrderPlaced` events; Fulfillment consumes them to start picking
- **Fulfillment → Billing**: Fulfillment emits `ShipmentDispatched` events; Billing consumes them to generate invoices
- **Ordering ↔ Billing**: Shared types for `CustomerId` and `Money`
```
The skill infers which structure applies:
- If `CONTEXT-MAP.md` exists, read it to find contexts
- If only a root `CONTEXT.md` exists, single context
- If neither exists, create a root `CONTEXT.md` lazily when the first term is resolved
When multiple contexts exist, infer which one the current topic relates to. If unclear, ask.
.agents/skills/domain-modeling/SKILL.md
+57
View File
@@ -0,0 +1,57 @@
---
name: domain-modeling
description: Build and sharpen a project's domain model. Use when the user wants to pin down domain terminology or a ubiquitous language, or when another skill needs to maintain the domain model.
---
# Domain Modeling
Actively build and sharpen the project's domain model as you design. This is the *active* discipline — challenging terms, inventing edge-case scenarios, and writing the glossary and decisions down the moment they crystallise. (Merely *reading* `CONTEXT.md` for vocabulary is not this skill — that's a one-line habit any skill can do. This skill is for when you're changing the model, not just consuming it.)
## File structure
Most repos have a single context:
```
/
├── CONTEXT.md
└── src/
```
If a `CONTEXT-MAP.md` exists at the root, the repo has multiple contexts. The map points to where each one lives:
```
/
├── CONTEXT-MAP.md
└── src/
├── ordering/
│ └── CONTEXT.md
└── billing/
└── CONTEXT.md
```
Create files lazily — only when you have something to write. If no `CONTEXT.md` exists, create one when the first term is resolved.
## During the session
### Challenge against the glossary
When the user uses a term that conflicts with the existing language in `CONTEXT.md`, call it out immediately. "Your glossary defines 'cancellation' as X, but you seem to mean Y — which is it?"
### Sharpen fuzzy language
When the user uses vague or overloaded terms, propose a precise canonical term. "You're saying 'account' — do you mean the Customer or the User? Those are different things."
### Discuss concrete scenarios
When domain relationships are being discussed, stress-test them with specific scenarios. Invent scenarios that probe edge cases and force the user to be precise about the boundaries between concepts.
### Cross-reference with code
When the user states how something works, check whether the code agrees. If you find a contradiction, surface it: "Your code cancels entire Orders, but you just said partial cancellation is possible — which is right?"
### Update CONTEXT.md inline
When a term is resolved, update `CONTEXT.md` right there. Don't batch these up — capture them as they happen. Use the format in `.agents/skills/domain-modeling/CONTEXT-FORMAT.md` (path from the repo root).
`CONTEXT.md` should be totally devoid of implementation details. Do not treat `CONTEXT.md` as a spec, a scratch pad, or a repository for implementation decisions. It is a glossary and nothing else.
.agents/skills/grill-me/SKILL.md
+7
View File
@@ -0,0 +1,7 @@
---
name: grill-me
description: A relentless interview to sharpen a plan or design.
disable-model-invocation: true
---
Run a `/grilling` session.
.agents/skills/grilling/SKILL.md
+22
View File
@@ -0,0 +1,22 @@
---
name: grilling
description: Grill the user relentlessly about a plan, decision, or idea. Use when the user wants to stress-test their thinking, or uses any 'grill' trigger phrases.
---
Interview the user relentlessly until you reach a shared understanding. Map this as a **design tree**: every decision branches into the decisions that hang off it.
Work the tree in **rounds**. The **frontier** is every decision whose prerequisites are already settled — the questions you can ask _now_ without guessing at answers you haven't heard yet. Ask the whole frontier in one round: number each question and give your recommended answer. Then wait for the user's answers before the next round.
Each question should be formatted like so:
```
❓ **Q1** - **<question title>**: <question body, might be multiple paragraphs, including multiple choices>
➡️ <your recommended answer>
```
Each round the user answers reshapes the tree — settled decisions push the frontier outward and unblock questions that depended on them. Recompute the frontier and ask the next round. A question whose answer depends on another question still open in this round belongs to a _later_ round, not this one.
Finding _facts_ is your job, never the user's. When a frontier question needs a fact from the environment (filesystem, tools, etc.), dispatch a sub-agent to find it — don't ask the user for anything you could look up yourself. Don't block on it: a running exploration is an unsettled prerequisite, so only the questions downstream of it wait for the sub-agent to report — ask the rest of the frontier now. The _decisions_ are the user's — put each to them and wait.
The session is done when the frontier is empty: every branch of the design tree visited, nothing left silently assumed. Do not act on it until the user confirms you have reached a shared understanding.
.agents/skills/improve-codebase-architecture/HTML-REPORT.md
+122
View File
@@ -0,0 +1,122 @@
# HTML Report Format
The architectural review is rendered as a single self-contained HTML file in the OS temp directory. Tailwind and Mermaid both come from CDNs. Mermaid handles graph-shaped diagrams reliably; hand-built divs and inline SVG handle the more editorial visuals (mass diagrams, cross-sections). Mix the two — don't lean on Mermaid for everything, it'll start to look generic.
## Scaffold
```html
<!doctype html>
<html lang="en">
<head>
<meta charset="utf-8" />
<title>Architecture review — {{repo name}}</title>
<script src="https://cdn.tailwindcss.com"></script>
<script type="module">
import mermaid from "https://cdn.jsdelivr.net/npm/mermaid@11/dist/mermaid.esm.min.mjs";
mermaid.initialize({ startOnLoad: true, theme: "neutral", securityLevel: "loose" });
</script>
<style>
/* small custom layer for things Tailwind doesn't cover cleanly:
dashed seam lines, hand-drawn-feeling arrow heads, etc. */
.seam { stroke-dasharray: 4 4; }
.leak { stroke: #dc2626; }
.deep { background: linear-gradient(135deg, #0f172a, #1e293b); }
</style>
</head>
<body class="bg-stone-50 text-slate-900 font-sans">
<main class="max-w-5xl mx-auto px-6 py-12 space-y-12">
<header>...</header>
<section id="candidates" class="space-y-10">...</section>
<section id="top-recommendation">...</section>
</main>
</body>
</html>
```
## Header
Repo name, date, and a compact legend: solid box = module, dashed line = seam, red arrow = leakage, thick dark box = deep module. No introduction paragraph — straight into the candidates.
## Candidate card
The diagrams carry the weight. Prose is sparse, plain, and uses the glossary terms (from the `/codebase-design` skill) without ceremony.
Each candidate is one `<article>`:
- **Title** — short, names the deepening (e.g. "Collapse the Order intake pipeline").
- **Badge row** — recommendation strength (`Strong` = emerald, `Worth exploring` = amber, `Speculative` = slate), plus a tag for the dependency category (`in-process`, `local-substitutable`, `ports & adapters`, `mock`).
- **Files** — monospaced list, `font-mono text-sm`.
- **Before / After diagram** — the centrepiece. Two columns, side by side. See patterns below.
- **Problem** — one sentence. What hurts.
- **Solution** — one sentence. What changes.
- **Wins** — bullets, ≤6 words each. e.g. "Tests hit one interface", "Pricing logic stops leaking", "Delete 4 shallow wrappers".
No paragraphs of explanation. If the diagram needs a paragraph to be understood, redraw the diagram.
## Diagram patterns
Pick the pattern that fits the candidate. Mix them. Don't make every diagram look the same — variety is part of the point.
### Mermaid graph (the workhorse for dependencies / call flow)
Use a Mermaid `flowchart` or `graph` when the point is "X calls Y calls Z, and look at the mess." Wrap it in a Tailwind-styled card so it doesn't feel parachuted in. Style with classDef to colour leakage edges red and the deep module dark. Sequence diagrams work well for "before: 6 round-trips; after: 1."
```html
<div class="rounded-lg border border-slate-200 bg-white p-4">
<pre class="mermaid">
flowchart LR
A[OrderHandler] --> B[OrderValidator]
B --> C[OrderRepo]
C -.leak.-> D[PricingClient]
classDef leak stroke:#dc2626,stroke-width:2px;
class C,D leak
</pre>
</div>
```
### Hand-built boxes-and-arrows (when Mermaid's layout fights you)
Modules as `<div>`s with borders and labels. Arrows as inline SVG `<line>` or `<path>` elements positioned absolutely over a relative container. Reach for this when you want the "after" diagram to feel like one thick-bordered deep module with greyed-out internals — Mermaid won't render that with the right weight.
### Cross-section (good for layered shallowness)
Stack horizontal bands (`h-12 border-l-4`) to show layers a call passes through. Before: 6 thin layers each doing nothing. After: 1 thick band labelled with the consolidated responsibility.
### Mass diagram (good for "interface as wide as implementation")
Two rectangles per module — one for interface surface area, one for implementation. Before: interface rectangle is nearly as tall as the implementation rectangle (shallow). After: interface rectangle is short, implementation rectangle is tall (deep).
### Call-graph collapse
Before: a tree of function calls rendered as nested boxes. After: the same tree collapsed into one box, with the now-internal calls shown faded inside it.
## Style guidance
- Lean editorial, not corporate-dashboard. Generous whitespace. Serif optional for headings (`font-serif` works well with stone/slate).
- Colour sparingly: one accent (emerald or indigo) plus red for leakage and amber for warnings.
- Keep diagrams ~320px tall so before/after sits comfortably side by side without scrolling.
- Use `text-xs uppercase tracking-wider` for module labels inside diagrams — they should read as schematic, not as UI.
- The only scripts are the Tailwind CDN and the Mermaid ESM import. The report is otherwise static — no app code, no interactivity beyond Mermaid's own rendering.
## Top recommendation section
One larger card. Candidate name, one sentence on why, anchor link to its card. That's it.
## Tone
Plain English, concise — but the architectural nouns and verbs come straight from the `/codebase-design` skill. Concision is not an excuse to drift.
**Use exactly:** module, interface, implementation, depth, deep, shallow, seam, adapter, leverage, locality.
**Never substitute:** component, service, unit (for module) · API, signature (for interface) · boundary (for seam) · layer, wrapper (for module, when you mean module).
**Phrasings that fit the style:**
- "Order intake module is shallow — interface nearly matches the implementation."
- "Pricing leaks across the seam."
- "Deepen: one interface, one place to test."
- "Two adapters justify the seam: HTTP in prod, in-memory in tests."
**Wins bullets** name the gain in glossary terms: *"locality: bugs concentrate in one module"*, *"leverage: one interface, N call sites"*, *"interface shrinks; implementation absorbs the wrappers"*. Don't write *"easier to maintain"* or *"cleaner code"* — those terms aren't in the glossary and don't earn their place.
No hedging, no throat-clearing, no "it's worth noting that…". If a sentence could be a bullet, make it a bullet. If a bullet could be cut, cut it. If a term isn't in the `/codebase-design` glossary, reach for one that is before inventing a new one.
.agents/skills/improve-codebase-architecture/SKILL.md
+68
View File
@@ -0,0 +1,68 @@
---
name: improve-codebase-architecture
description: Scan a codebase for deepening opportunities, present them as a visual HTML report, then grill through whichever one you pick.
disable-model-invocation: true
---
# Improve Codebase Architecture
Surface architectural friction and propose **deepening opportunities** — refactors that turn shallow modules into deep ones. The aim is testability and AI-navigability.
This command is _informed_ by the project's domain model and built on a shared design vocabulary:
- Run the `/codebase-design` skill for the architecture vocabulary (**module**, **interface**, **depth**, **seam**, **adapter**, **leverage**, **locality**) and its principles (the deletion test, "the interface is the test surface", "one adapter = hypothetical seam, two = real"). Use these terms exactly in every suggestion — don't drift into "component," "service," "API," or "boundary."
- The domain language in `CONTEXT.md` gives names to good seams.
## Process
### 1. Explore
**Scope before you scan — YAGNI.** Deepening a module pays off by making future changes to it easier, so put extra weight on the parts of the codebase that have recently changed. Decide *where* to look before you look:
- If the user named a direction — a module, a subsystem, a pain point — take it, and skip the inference below.
- Otherwise, walk back a good stretch of the commit history (`git log --oneline`) to find the codebase's hot spots — the files and areas that keep coming up — and let those paths pull your attention first. If the changes are scattered with no clear hot spot, widen the net.
Read the project's domain glossary (`CONTEXT.md`) first.
Then spawn a sub-agent to walk the codebase. Don't follow rigid heuristics — explore organically and note where you experience friction:
- Where does understanding one concept require bouncing between many small modules?
- Where are modules **shallow** — interface nearly as complex as the implementation?
- Where have pure functions been extracted just for testability, but the real bugs hide in how they're called (no **locality**)?
- Where do tightly-coupled modules leak across their seams?
- Which parts of the codebase are untested, or hard to test through their current interface?
Apply the **deletion test** to anything you suspect is shallow: would deleting it concentrate complexity, or just move it? A "yes, concentrates" is the signal you want.
### 2. Present candidates as an HTML report
Write a self-contained HTML file to the OS temp directory so nothing lands in the repo. Resolve the temp dir from `$TMPDIR`, falling back to `/tmp` (or `%TEMP%` on Windows), and write to `<tmpdir>/architecture-review-<timestamp>.html` so each run gets a fresh file. Open it for the user — `xdg-open <path>` on Linux, `open <path>` on macOS, `start <path>` on Windows — and tell them the absolute path.
The report uses **Tailwind via CDN** for layout and styling, and **Mermaid via CDN** for diagrams where a graph/flow/sequence reliably communicates the structure. Mix Mermaid with hand-crafted CSS/SVG visuals — use Mermaid when relationships are graph-shaped (call graphs, dependencies, sequences), and hand-built divs/SVG when you want something more editorial (mass diagrams, cross-sections, collapse animations). Each candidate gets a **before/after visualisation**. Be visual.
For each candidate, render a card with:
- **Files** — which files/modules are involved
- **Problem** — why the current architecture is causing friction
- **Solution** — plain English description of what would change
- **Benefits** — explained in terms of locality and leverage, and how tests would improve
- **Before / After diagram** — side-by-side, custom-drawn, illustrating the shallowness and the deepening
- **Recommendation strength** — one of `Strong`, `Worth exploring`, `Speculative`, rendered as a badge
End the report with a **Top recommendation** section: which candidate you'd tackle first and why.
**Use CONTEXT.md vocabulary for the domain, and the `/codebase-design` vocabulary for the architecture.** If `CONTEXT.md` defines "Order," talk about "the Order intake module" — not "the FooBarHandler," and not "the Order service."
See `.agents/skills/improve-codebase-architecture/HTML-REPORT.md` (path from the repo root) for the full HTML scaffold, diagram patterns, and styling guidance.
Do NOT propose interfaces yet. After the file is written, ask the user: "Which of these would you like to explore?"
### 3. Grilling loop
Once the user picks a candidate, run the `/grilling` skill to walk the decision tree with them — constraints, dependencies, the shape of the deepened module, what sits behind the seam, what tests survive.
Side effects happen inline as decisions crystallize — run the `/domain-modeling` skill to keep the domain model current as you go:
- **Naming a deepened module after a concept not in `CONTEXT.md`?** Add the term to `CONTEXT.md`. Create the file lazily if it doesn't exist.
- **Sharpening a fuzzy term during the conversation?** Update `CONTEXT.md` right there.
- **Want to explore alternative interfaces for the deepened module?** Run the `/codebase-design` skill and use its design-it-twice parallel sub-agent pattern.
.agents/skills/pr/SKILL.md
+76 -1
View File
@@ -62,7 +62,7 @@ If `git diff main...HEAD --name-only` matches `^frontend/`, the PR body **must**
screenshots of the affected UI. Skip only when there is no visible UI effect (types,
tests, build config) — and say so in the body.
1. Verify the change in the browser (AGENTS.md → "Verifying Frontend Changes").
1. Verify the change in the browser (frontend/AGENTS.md → "Verifying Frontend Changes").
2. Screenshot each affected page with `mcp__playwright__browser_take_screenshot` (save to a file).
3. Host each image and get its Markdown embed by pushing to the public
`windmill-labs/agent-screenshots-internal` repo. **Pipe base64 through stdin** —
@@ -130,6 +130,10 @@ and continue once they confirm it's done.
## Review rounds (draft → ready)
A PR leaves draft **only after a clean CI review round**. Never run `gh pr ready` before that.
This is the rule in every mode, autonomous included. A clean round is necessary but not always
sufficient — see "Flip, or ask first" below. The one standing exception is an explicit request to
leave that PR in draft (usually so it can be tested first) — honour it for that PR, and don't
carry it over to the next one.
1. **Trigger a round and wait for it**: launch the waiter as a background Bash task (a round takes 10–30 min; you are woken when it exits — do not stop the session or poll in the foreground while it runs):
@@ -162,6 +166,77 @@ A PR leaves draft **only after a clean CI review round**. Never run `gh pr ready
If any P0/P1 finding is unaddressed or the head moved for reasons other than nit fixes, do **not** post the marker or flip — run another round instead.
### A round that never starts is usually a conflict
The review workflows don't run on a PR that cannot merge, so a round that produces no verdict is
more often a conflict with `main` than a CI outage. Check before assuming anything is broken:
```bash
gh pr view <PR_NUMBER> --json mergeable,mergeStateStatus
```
Resolve by **merging, not rebasing** — a rebase rewrites the head SHA that round verdicts and the
clean-round marker are keyed to, invalidating work you have already paid for:
```bash
git fetch origin main
git merge origin/main
```
**If that merge changed `backend/ee-repo-ref.txt`, move the EE worktree to match.** The file pins
the EE commit CE builds against, so a merge that advances it leaves the EE checkout behind what CE
now expects, and `cargo check --features private` compiles a tree neither you nor CI intends:
```bash
git -C <ee-worktree> merge "$(tr -d '[:space:]' < backend/ee-repo-ref.txt)"
```
Push both, then start a fresh round — the head moved, so the earlier verdicts no longer apply.
### Flip, or ask first
A clean round earns the flip; it does not always earn it *unattended*. Judge the blast radius from
the diff first — `git diff --name-only main...HEAD` answers most of these.
**Ask before flipping** when the change:
- touches `*_ee.rs` (it spans the EE repo through symlinks and has a companion PR)
- adds a migration under `backend/migrations/`
- changes `openapi.yaml`, `openflow.openapi.yaml`, or the generated client
- touches auth, permission, or token paths
- changes shared worker infrastructure — the job poller, `handle_child`, an executor
- trips `REVIEW.md`'s "Checklist for new public surfaces"
**Flip without asking** when it is self-contained: a single-file fix, test-only, docs-only, one
call site, no new public surface.
Unattended (webmux oneshot) there is nobody to ask, so the judgement holds and the action
degrades: flip the self-contained ones, and leave the rest at a clean draft with a line in the PR
description saying why — `left in draft: adds a migration, wants a human look before ready`.
Don't flip a wide-blast-radius change just because the round came back clean, and don't ask a
question nobody will read.
`AGENTS.local.md` (gitignored, so it may not exist) carries a "PR ready calibration" section
recording how past ambiguous calls went. Read it before deciding; when a call is still genuinely
ambiguous, ask, then append the answer there so the next one is less ambiguous.
### When rounds stop converging
Three or more rounds without a clean verdict usually means the change's shape is wrong, not that
there is an endless supply of independent bugs. The tells:
- findings keep landing in the same files round after round
- fixing one finding creates the next
- the findings are about coupling, duplication, or state threaded through many places, rather
than logic errors
When that pattern holds, stop running rounds — each one costs a CI cycle and is not going to
converge. Say plainly that the remaining findings look structural rather than incidental, and
name the module or seam they cluster around. With a user present, suggest they run
`/improve-codebase-architecture` over that area: it is slash-only so you cannot invoke it
yourself, and reshaping the code is a scope change they should choose. Unattended, put the
diagnosis in the PR description and stop there rather than grinding out more rounds.
## EE Companion PR (when `*_ee.rs` files were modified)
The `*_ee.rs` files in the windmill repo are **symlinks** to `windmill-ee-private` — changes won't appear in `git diff` of the windmill repo. Instead, check the EE repo for uncommitted or unpushed changes.
.agents/skills/refine/SKILL.md
-1
View File
@@ -17,7 +17,6 @@ Reflect on the current session and update documentation with lessons learned.
2. **Read current docs**: Read the docs that were relevant to this session:
- `docs/validation.md`
- `docs/enterprise.md`
- `docs/autonomous-mode.md`
- Any skills that were invoked
3. **Propose updates**: For each piece of friction, decide if it warrants a doc update:
.agents/skills/rust-backend/SKILL.md
+7
View File
@@ -94,6 +94,13 @@ Use `tokio::sync::mpsc` (bounded) for channels. Avoid `std::thread::sleep` in as
Always use rust-analyzer LSP for go-to-definition, find-references, and type info. Do not guess at module paths.
## Feature Telemetry
`FEATURE_USAGE_KINDS` in `windmill-api-workspaces/src/workspaces.rs` is an allowlist: a
`(feature, kind)` pair missing from it is dropped by `valid_feature_usage_event` with a bare
`continue` — no error, and the route still returns 204. Adding a counter on the frontend without
registering it here records nothing. See `docs/feature-telemetry.md`.
## Axum Handlers
Destructure extractors directly in function signatures:
.agents/skills/svelte-frontend/SKILL.md
+48 -2
View File
@@ -7,9 +7,47 @@ description: Svelte coding guidelines for the Windmill frontend. MUST use when w
Apply these Windmill-specific patterns when writing Svelte code in `frontend/`. For general Svelte 5 syntax (runes, snippets, event handling), use the Svelte MCP server.
## Before writing any UI (MUST)
Do both of these before the first line of markup — not after, and not only when something
looks unfamiliar.
**1. Find the component that already exists.** `frontend/src/lib/components/common/index.ts`
is the design-system barrel — 28 lines, read it in full. It exports far more than the three
documented below: `Alert`, `Badge`, `Breadcrumb`, `Drawer`/`DrawerContent`, `Menu`/`MenuItem`,
`Tabs`/`Tab`/`TabContent`, `Skeleton`, `FileInput`, `RadioCard`, `Section`, `Kbd`, `ActionRow`,
`ClearableInput`, `CopyButton`, `SecondsInput`, `UndoRedo`, `Url`.
The barrel is not the full picture either: `common/` has 34 subdirectories and only 23 exports,
so `modal/`, `popup/`, `stepper/`, `tooltip/`, `checkbox/`, `table/`, `contextmenu/`,
`confirmationModal/`, `calendarPicker/`, `fileUpload/`, `toggleButton-v2/` and more exist but
must be imported by path. Selects, text inputs and melt-based primitives sit next to `common/`
in `components/select/`, `components/text_input/`, `components/meltComponents/`.
The tree holds 1,600+ components — grep `frontend/src/lib/components` for the thing you're about
to build; it almost certainly exists. Building a new one is the last resort, not the first move.
**2. Read the guideline for what you're building.** `frontend/brand-guidelines.md` is the
authority on how it should look and read. Don't load all 34k chars — jump to the section:
| Building | Section to read |
|---|---|
| Any new screen or component | `# Components` (Core Rules, Quick Reference) |
| Buttons, CTAs | `## Buttons` — hierarchy matters, only one Accent per view |
| Colors, surfaces, borders | `# Color system` (Quick Reference, Do's and Don'ts) |
| Text, labels, headings | `# Typography` — note `## Text Casing`, sentence case throughout |
| Spacing, grids, page structure | `# Spacing & Layout`; `# Layout` → `## Form` for forms |
| Shadows, overlays, depth | `# Elevation` |
| Icons | `# Iconography` |
| Wording of any UI copy | `# Voice & Communication`, `# Tone of Voice` |
Get the line range with `grep -n '^#' frontend/brand-guidelines.md`, then read just that span.
## Windmill UI Components (MUST use)
Always use Windmill's design-system components. Never use raw HTML elements.
Always use Windmill's design-system components. Never use raw HTML elements. The three below
are the ones you'll reach for most often — they are examples, not the catalog. For anything
else, go back to the barrel and grep.
### Buttons — `<Button>`
@@ -70,6 +108,14 @@ Form components (TextInput, Toggle, Select, etc.) should use the unified size sy
- Use Windmill's theming classes for colors/surfaces (see `frontend/brand-guidelines.md`)
- Read component props JSDoc before using them
## Feature Telemetry
New user-facing UX is the main source of `feature_usage` counters — propose them in the plan, not
as a separate question, and read `docs/feature-telemetry.md` first. `logFeatureUsage()` from
`$lib/utils/featureUsage` is only half the change: the `(feature, kind)` pair must also be
registered in the backend allowlist or every event is silently discarded, and the disclosure copy
in `InstanceSettings.svelte` must name what you added.
## Svelte MCP Server
Use the Svelte MCP tools when working on Svelte code:
@@ -81,4 +127,4 @@ Use the Svelte MCP tools when working on Svelte code:
## Verifying in the Browser
After changing Svelte code, use the **Playwright MCP** (`mcp__playwright__*`) to drive the running frontend and confirm the change works. See AGENTS.md → "Verifying Frontend Changes" for the full flow. Use `playwright` (headless) on devboxes; `playwright-headed` when a display is available.
After changing Svelte code, use the **Playwright MCP** (`mcp__playwright__*`) to drive the running frontend and confirm the change works. See frontend/AGENTS.md → "Verifying Frontend Changes" for the full flow. Use `playwright` (headless) on devboxes; `playwright-headed` when a display is available.
.agents/skills/update-sqlx/SKILL.md
+11 -12
View File
@@ -28,8 +28,10 @@ delete only those.
1. **Back the cache up.** `prepare` deletes `.sqlx/` *before* regenerating, so any compile
failure leaves it gutted (observed: 2350 → 142 entries).
```bash
cp -r backend/.sqlx /tmp/sqlx_backup # restore with: rm -rf backend/.sqlx && cp -r /tmp/sqlx_backup backend/.sqlx
bash .agents/skills/update-sqlx/sqlx-cache.sh backup
```
Its state is per-worktree, so a sibling worktree running `prepare` at the same time
cannot overwrite your backup.
2. **Point `DATABASE_URL` at THIS worktree's database.** `prepare` compiles every
`sqlx::query!` against the **live** database. Another worktree's DB lacks your
migrations, so every new-table query fails and takes the cache down with it. The
@@ -52,24 +54,21 @@ Do not fight it — the abort is a pre-existing EE gap, not something your chang
Take the entries you need and put the backup back:
```bash
cd backend
cp -r .sqlx /tmp/sqlx_backup
ls /tmp/sqlx_backup | sort > /tmp/before.txt
bash .agents/skills/update-sqlx/sqlx-cache.sh backup
cd backend
DATABASE_URL=<this worktree's db> \
cargo sqlx prepare --workspace -- --workspace --features all_sqlx_features --all-targets
# expected to fail; it still wrote the entries it got to before dying
cd ..
ls .sqlx | sort > /tmp/after.txt
mkdir -p /tmp/newq
comm -13 /tmp/before.txt /tmp/after.txt | while read f; do cp ".sqlx/$f" /tmp/newq/; done
rm -rf .sqlx && cp -r /tmp/sqlx_backup .sqlx && cp /tmp/newq/*.json .sqlx/
bash .agents/skills/update-sqlx/sqlx-cache.sh newq # prints each added query
bash .agents/skills/update-sqlx/sqlx-cache.sh restore # backup back, added entries grafted on
```
**Read every file in `/tmp/newq` before copying it in** — print each one's `query` field and
confirm it is one of yours. The set is small (one per new test query), and anything else in
there means the run got further than you think.
**Read what `newq` prints before running `restore`** — it shows each added entry's `query`
field, and every one should be yours. The set is small (one per new test query); anything
else in there means the run got further than you think.
Then verify both targets, since the lib passing says nothing about the tests:
.agents/skills/update-sqlx/sqlx-cache.sh
Executable
+88
View File
@@ -0,0 +1,88 @@
#!/usr/bin/env bash
# Backup / inspect / restore the SQLx offline cache around `cargo sqlx prepare`.
#
# `prepare` empties backend/.sqlx before regenerating, so any compile failure leaves the
# cache gutted (observed: 2350 -> 142 entries). A `--all-targets` run in a CE checkout
# aborts that way every time. State lives in a per-worktree directory, so sibling
# worktrees running this concurrently cannot overwrite each other's backup.
#
# sqlx-cache.sh backup snapshot backend/.sqlx
# sqlx-cache.sh newq show the entries prepare added since the snapshot, and stage them
# sqlx-cache.sh restore put the snapshot back, grafting the staged entries on top
#
# Inspect what `newq` prints before running `restore` — an entry you don't recognise means
# the run got further than you think.
set -euo pipefail
repo_root="$(git rev-parse --show-toplevel)"
cache="$repo_root/backend/.sqlx"
state="${TMPDIR:-/tmp}/wm-sqlx-cache/$(basename "$repo_root")"
backup="$state/backup"
added="$state/added"
# `find -printf` is GNU-only; a glob loop stays portable to a macOS checkout and, unlike
# `ls *.json`, does not fail the script under `set -e` when the cache is empty — which is
# exactly the state a failed `prepare` leaves behind.
list_entries() {
local f
for f in "$1"/*.json; do
[ -e "$f" ] || continue
basename "$f"
done | sort
}
show_query() {
if command -v jq >/dev/null 2>&1; then
jq -r '.query' "$1" 2>/dev/null | head -6
else
sed -n 's/^ *"query": "\(.*\)",*$/\1/p' "$1" | head -6
fi
}
case "${1:-}" in
backup)
[[ -d $cache ]] || { echo "no cache at $cache" >&2; exit 1; }
rm -rf "$state"
mkdir -p "$state"
cp -r "$cache" "$backup"
list_entries "$backup" > "$state/before.txt"
echo "backed up $(wc -l < "$state/before.txt" | tr -d ' ') entries to $backup"
;;
newq)
[[ -d $backup ]] || { echo "no backup — run '$0 backup' first" >&2; exit 1; }
list_entries "$cache" > "$state/after.txt"
comm -13 "$state/before.txt" "$state/after.txt" > "$state/new.txt"
rm -rf "$added"
mkdir -p "$added"
n=0
while read -r f; do
[[ -n $f ]] || continue
cp "$cache/$f" "$added/$f"
n=$((n + 1))
echo "--- $f"
show_query "$cache/$f"
done < "$state/new.txt"
echo "$n entries added since the backup, staged in $added"
;;
restore)
[[ -d $backup ]] || { echo "no backup — nothing to restore" >&2; exit 1; }
[[ -d $added ]] || { echo "run '$0 newq' first so the added entries are staged" >&2; exit 1; }
rm -rf "$cache"
cp -r "$backup" "$cache"
n=0
for f in "$added"/*.json; do
[[ -e $f ]] || continue
cp "$f" "$cache/"
n=$((n + 1))
done
echo "restored $(list_entries "$cache" | wc -l | tr -d ' ') entries ($n grafted from this run)"
;;
*)
sed -n '2,14p' "$0" | sed 's/^# \{0,1\}//'
exit 1
;;
esac
.claude/skills/codebase-design/SKILL.md
Symlink
+1
View File
@@ -0,0 +1 @@
../../../.agents/skills/codebase-design/SKILL.md
.claude/skills/domain-modeling/SKILL.md
Symlink
+1
View File
@@ -0,0 +1 @@
../../../.agents/skills/domain-modeling/SKILL.md
.claude/skills/grill-me/SKILL.md
Symlink
+1
View File
@@ -0,0 +1 @@
../../../.agents/skills/grill-me/SKILL.md
.claude/skills/grilling/SKILL.md
Symlink
+1
View File
@@ -0,0 +1 @@
../../../.agents/skills/grilling/SKILL.md
.claude/skills/improve-codebase-architecture/SKILL.md
Symlink
+1
View File
@@ -0,0 +1 @@
../../../.agents/skills/improve-codebase-architecture/SKILL.md
.github/pi/pr-review.prompt.md
+11
View File
@@ -4,3 +4,14 @@
- Return a markdown PR comment starting with `## Pi Review`.
- Tag each finding with a severity (P0 / P1 / P2), file path, and line number when known confidently.
- Output ONLY the final review markdown — no preamble, no thinking, no tool transcripts.
# Before you settle on a verdict
`REVIEW.md` tells you to discard findings you are not confident in. That rule exists to suppress noise, not to license a quick approval. Review in two passes:
1. Enumerate every candidate defect you notice, without judging any of them yet.
2. Take each candidate and try to prove it is real: read the surrounding code, check the caller, check the error path. Keep it, or dismiss it for a specific reason.
A "Good to merge" verdict must be accompanied by a "Considered and dismissed" section listing each candidate from pass 1 with the concrete reason it is not a finding. If that section would be empty, pass 1 was skipped: go back and do it.
Facts cut both ways. If you notice that a cached value can be multiple megabytes, that a lock is held across an await, or that a new parameter is caller-controlled, that observation is a candidate for pass 2 even when the surrounding code looks deliberate. Do not narrate such a fact as evidence that the code is fine without first checking whether it is a bug.
.github/workflows/pi-pr-review.yml
+16 -1
View File
@@ -212,7 +212,9 @@ jobs:
- name: Install Pi CLI
if: steps.pi_config.outputs.enabled == 'true' && steps.pr.outputs.skip != 'true'
run: npm install --global @mariozechner/pi-coding-agent
# Pinned: this job holds DEEPSEEK_API_KEY and PR write access, and an
# unpinned reviewer also makes verdicts non-reproducible across runs.
run: npm install --global @earendil-works/pi-coding-agent@0.84.1
- name: Pre-fetch base and head refs for the PR
if: steps.pi_config.outputs.enabled == 'true' && steps.pr.outputs.skip != 'true'
@@ -362,9 +364,14 @@ jobs:
# The context file lives in RUNNER_TEMP (outside the checkout); tell the
# agent its absolute path.
printf '\nReview context file (absolute path): %s\n' "$CTX" >> /tmp/pi-prompt.md
# DeepSeek's reasoning_effort accepts low/high/max and silently maps both
# medium and xhigh onto high. Set the level explicitly rather than letting
# pi's default clamp onto it, so a change to either the default or the
# clamping is a visible diff here instead of a silent shift in review depth.
pi -p \
--provider deepseek \
--model deepseek-v4-pro \
--thinking high \
--tools "$PI_TOOLS" \
"${PI_HARDEN_FLAGS[@]}" \
--mode json \
@@ -399,6 +406,14 @@ jobs:
| (.content[]? | select(.type == "text") | .text)
' "$OUT_DIR/pi-events.jsonl" > "$OUT_DIR/pi-final-message.md"
# The final message often opens with chatter ("Now I have all the context
# I need..."), which would land above the verdict in the posted comment.
# Keep the trim conditional: without the heading there is nothing to cut
# and the range expression would empty the file.
if grep -q '^## Pi Review' "$OUT_DIR/pi-final-message.md"; then
sed -i -n '/^## Pi Review/,$p' "$OUT_DIR/pi-final-message.md"
fi
- name: Post Pi review comment
if: steps.pi_config.outputs.enabled == 'true' && steps.pr.outputs.skip != 'true'
uses: actions/github-script@v7
.gitignore
+4
View File
@@ -22,6 +22,10 @@ rust-client/Cargo.toml
.claude/settings.local.json
.claude/worktrees/
# Personal agent notes, not shared with the team
AGENTS.local.md
CLAUDE.local.md
# Symlinked cache directories (for git worktrees)
backend/target
node_modules/
.release-please-manifest.json
+1 -1
View File
@@ -1,3 +1,3 @@
{
".": "1.788.0"
".": "1.789.0"
}
.webmux.yaml
+16 -12
View File
@@ -5,9 +5,19 @@ workspace:
mainBranch: main
worktreeRoot: ../windmill__worktrees
defaultAgent: claude
# A new worktree is branched from the *local* `main` ref, so a stale local main means every
# new worktree starts behind. This keeps it current: fetch origin/main + fast-forward merge.
# Fast-forward only — it no-ops rather than forcing if local main has diverged.
autoPull:
enabled: true
intervalSeconds: 300
startupEnvs:
CARGO_FEATURES: "quickjs"
# true clones the base `windmill` DB via CREATE DATABASE ... TEMPLATE, which first
# terminates every open connection to `windmill` — expect the main dev instance to drop.
# false creates an empty DB and runs migrations. Either way the license key is copied over
# and pre-remove drops the DB. See scripts/worktree-common.sh.
WM_CLONE_DB: false
USE_RUST_PLUGIN: false
@@ -48,7 +58,6 @@ profiles:
To connect to the database, use this connection string: ${DATABASE_URL}
Because we are running backend with cargo watch, to verify your changes, just check the logs in the backend pane. No need for cargo check.
For UI verification, use the Playwright MCP (`mcp__playwright__*`) — the `playwright` server is headless and works without a display. Navigate to http://localhost:${FRONTEND_PORT}, log in as admin@windmill.dev / changeme.
IMPORTANT: Read docs/autonomous-mode.md before starting any work.
panes:
- id: agent
kind: agent
@@ -86,7 +95,6 @@ profiles:
To connect to the database, use this connection string: ${DATABASE_URL}
Because we are running frontend with npm run dev, to verify your changes, just check the logs in the frontend pane. No need for npm run build.
For UI verification, use the Playwright MCP (`mcp__playwright__*`) — the `playwright` server is headless and works without a display. Navigate to http://localhost:${FRONTEND_PORT}, log in as admin@windmill.dev / changeme.
IMPORTANT: Read docs/autonomous-mode.md before starting any work.
panes:
- id: agent
kind: agent
@@ -105,8 +113,6 @@ profiles:
runtime: host
yolo: true
envPassthrough: []
systemPrompt: >
IMPORTANT: Read docs/autonomous-mode.md before starting any work.
panes:
- id: agent
kind: agent
@@ -152,14 +158,12 @@ oneshot:
— note the choice in the PR description if it matters.
# PR readiness
Default to opening the PR as a draft. If you are highly confident in the
change — the scope is small and well-understood, validation passed
cleanly, and you would not change anything if a reviewer pushed back —
open the PR as ready-for-review directly (omit `--draft` when invoking
`gh pr create`, or call `gh pr ready <number>` after creation). Err on
the side of draft when validation was partial, the change touches
public APIs or shared infrastructure, or you made a non-obvious judgment
call.
Always open the PR as a draft, then drive the `pr` skill's "Review rounds"
until every reviewer verdict is a go. Never flip to ready without a clean
round behind it, and never stop at an *unreviewed* draft — that is an
unfinished oneshot. Whether a clean round then flips the PR is the skill's
"Flip, or ask first" call, not this prompt's: self-contained changes flip,
wide-blast-radius ones stay a clean draft with the reason in the PR body.
# Ending your turn
Never end your turn with a question, a suggestion to "take a look", or a
AGENTS.md
+53 -89
View File
@@ -5,9 +5,22 @@ Open-source platform for internal tools, workflows, API integrations, background
## Workflow
1. **Understand**: Before coding, explore the codebase (see Code Navigation below). Use `outline` to understand file structure, `body` to read specific symbols, `def`/`callers`/`callees` to trace code, `Grep` to find usages. Read `docs/` for domain context.
2. **Plan**: For non-trivial changes, use plan mode. For large features, break into reviewable stages
2. **Plan**: For non-trivial changes, use plan mode. For large features, break into reviewable stages.
For a new user-facing feature, put the `feature_usage` telemetry in the plan as a proposed item
(see `docs/feature-telemetry.md`) so the user can keep or drop it — don't ask separately, and
don't instrument bugfixes or refactors.
3. **Execute**: Follow coding patterns from skills (`rust-backend`, `svelte-frontend`)
4. **Validate**: After every change, run the appropriate checks per `docs/validation.md`
4. **Validate**: After every change, run the appropriate checks per `docs/validation.md`, then
**exercise the change on the running instance**. Type-checks are not verification. Whatever the
change touches, get that path actually running, and stand up whatever that takes — this is
expected, not a last resort. A few examples, not a closed list: drive the UI with the Playwright
MCP, run a real job of the kind you touched, restart the backend with the cargo features the
path needs (`backend/AGENTS.md`), put a stub in front of an upstream, start MinIO for an S3
path, plant state with SQL, exercise it through the `wmill` CLI. If the path you need has no
obvious way in, invent one rather than skipping it; `docs/` carries recipes for several areas.
If it needs a credential or a third-party account, ask for one rather than skipping the test or
inventing a value. If you genuinely cannot exercise it, say which path went unexercised instead
of implying it was verified.
## Documentation
@@ -17,6 +30,9 @@ Open-source platform for internal tools, workflows, API integrations, background
reaches the DB only through the API, so `Connection::Http` paths are never taken by a plain
`cargo run`; a normal build cannot start one at all.
- **Enterprise**: `docs/enterprise.md` — EE file conventions and PR workflow
- **Product telemetry**: `docs/feature-telemetry.md` — when to instrument a new feature with
`feature_usage`, and the four-step recipe. An unregistered `(feature, kind)` pair is dropped
silently, so frontend-only instrumentation records nothing.
- **Backend patterns**: use the `rust-backend` skill when writing Rust code
- **Frontend patterns**: use the `svelte-frontend` skill when writing Svelte code. Do NOT edit svelte files unless you have read that skill.
- **Frontend UUIDs**: do not call `crypto.randomUUID()` in frontend code. Import `randomUUID` from `$lib/utils/uuid` instead.
@@ -34,9 +50,15 @@ Open-source platform for internal tools, workflows, API integrations, background
> defaults in this section apply only to a plain single checkout. **Discover the real
> values before running anything** — see "Per-worktree ports and database" below.
**Check whether they are already running before starting anything.** In a webmux worktree
(`$WEBMUX_WORKTREE_PATH` is set) the backend and frontend are already up in sibling tmux panes —
use those, don't spawn your own. `tmux list-panes -t "$(tmux display-message -p -t "$TMUX_PANE"
'#{window_id}')" -F '#{pane_index} #{pane_current_command}'` shows what is running; read its log
with `tmux capture-pane`, and see `backend/AGENTS.md` to restart it with different cargo features.
A second server started in your own shell fights the first one for the port. The commands below
are for a plain checkout with nothing running.
- **Backend**: `cargo run` from `backend/` (API at http://localhost:8000)
- **DuckDB local jobs**: before running DuckDB scripts locally, build the FFI shared library with `cd backend/windmill-duckdb-ffi-internal && ./build_dev.sh`. Re-run it after clean builds or when `backend/target/debug/libwindmill_duckdb_ffi_internal.*` is missing. The bundled DuckDB compile (~2min) is cached in a per-user dir shared across worktrees, so a fresh worktree reuses it and the build is near-instant.
- **Data pipelines (DuckLake) from source**: a plain `cargo run` (even `--features quickjs`) advertises a `duckdb` worker tag but **cannot** execute DuckDB scripts and has **no** working S3 proxy (DuckLake writes 404). Build CE DuckLake with `cargo run --features quickjs,duckdb,parquet,private` (add `,python` for Python scripts, `,enterprise,license` for EE) **and** build the FFI (bullet above). See `backend/CLAUDE.md` → "Running data pipelines (DuckLake) from source" for the exact feature sets and the two feature-gate gotchas.
- **Frontend**: `REMOTE=http://localhost:8000 npm run dev` from `frontend/` (port 3000+)
- **DB**: `psql postgres://postgres:changeme@localhost:5432/windmill`
- **Login**: `admin@windmill.dev` / `changeme`
@@ -45,10 +67,27 @@ Open-source platform for internal tools, workflows, API integrations, background
### Per-worktree ports and database
A worktree's `.env` / `.env.local` (repo root) and `backend/.env` hold its own
`DATABASE_URL` and `PORT`; the database is typically `windmill_<branch_with_underscores>`
(branch `dbt-runtime` → `windmill_dbt_runtime`). Read them, or discover from what is
already running:
In a webmux worktree the authoritative values live in
`$(git rev-parse --git-dir)/webmux/runtime.env` — `BACKEND_PORT`, `FRONTEND_PORT`,
`DATABASE_URL`, `CARGO_FEATURES`, `WM_DB_NAME`. Every pane sources it at startup. Read that
first: it is not a `.env*` file, so the repo's secret-file read rules don't stand in the way.
In a plain checkout, fall back to `.env` / `.env.local` (repo root) and `backend/.env`.
Each worktree gets a **brand-new database**, created and migrated from scratch by the post-create
hook. It is not a copy of the main dev instance: you get the `admins` workspace, the
`admin@windmill.dev` superadmin, the license key copied from the base database, and whatever the
migrations seed — and none of your own workspaces, scripts, flows or apps. Create whatever a test
needs. Cloning the base `windmill` database instead is
opt-in per project via `WM_CLONE_DB` in `.webmux.yaml`; read the note there before turning it on.
The database is named after the **worktree directory, not the branch** (`scripts/worktree-common.sh`):
`windmill_` + the directory basename with `-` → `_`, which Postgres then truncates at 63
characters. Branch `hugo/win-2340-ai-agent-evals-standalone-agent-runs-and-eval-datasets` sits in
a worktree directory named `win-2340-…`, so its database is
`windmill_win_2340_ai_agent_evals_standalone_agent_runs_and_eval` — no `hugo_`, and the tail
chopped. Take `WM_DB_NAME` from `runtime.env` instead of reconstructing the name. Read those, or
discover from what is already running:
```bash
psql postgres://postgres:changeme@localhost:5432/postgres -tAc \
@@ -74,87 +113,6 @@ Getting these wrong is not a cheap mistake:
Beware that a `pgrep -f "<pattern>"` in a shell whose own command line contains
`<pattern>` matches the shell itself.
## Verifying Frontend Changes
After modifying frontend code, drive the running dev server with the **Playwright MCP** to verify the change in a real browser — don't claim a UI change works without exercising it.
Two MCP servers are registered in `.mcp.json`:
- `playwright` — headless Chromium, default for devboxes (no display required)
- `playwright-headed` — windowed Chromium, when a display is available
**One-time setup:** run `npx playwright install chromium` to download the browser binary (Playwright won't fetch it automatically on first use).
Typical flow:
1. Ensure backend (`cargo run`) and frontend (`REMOTE=http://localhost:8000 npm run dev`) are running
2. `mcp__playwright__browser_navigate` to the relevant page (login at `admin@windmill.dev` / `changeme`)
3. `mcp__playwright__browser_snapshot` to inspect the accessibility tree (preferred over screenshots for reading the DOM)
4. `mcp__playwright__browser_click` / `browser_fill_form` / `browser_type` to interact
5. `mcp__playwright__browser_take_screenshot` for visual confirmation
6. `mcp__playwright__browser_console_messages` / `browser_network_requests` to surface errors
Write screenshots to an absolute path under `/tmp` (the MCP servers already do; standalone
Playwright scripts must be told): moving a PNG out of the checkout afterwards needs a `mv` the
permission hooks always prompt on. Same reason to run `rm`/`mv`/`cp` as one plain command per Bash
call: those hooks defer on `&&`, `;`, redirects, quotes and `$VAR`.
**Attach the screenshots to the PR.** For any change under `frontend/`, embed screenshots of the affected UI in the PR body — the `pr` skill requires this and carries the upload recipe.
If you cannot exercise a UI change (no dev server, etc.), say so explicitly rather than claiming success.
## Verifying Backend Changes
`cargo check` and the unit tests do not exercise a worker code path. **If you changed how
a job runs — an executor, `handle_child`, anything spawning or reading from a
subprocess — run an actual job of that kind** and confirm it completed, then say so.
Whole classes of defect compile and unit-test clean:
- **Stack overflow from a large buffer in an async block.** An array declared across an
`.await` is baked into the future's state; once that future is boxed a few layers deep
by the job poller, two 16 KB arrays abort the worker *process* (`thread
'tokio-runtime-worker' has overflowed its stack`). Heap-allocate read buffers
(`vec![0u8; N]`, not `[0u8; N]`).
- Deadlocks from draining only one of a child's pipes, missed cancellation or timeout
propagation, and anything depending on the real engine's output format.
A crash like this takes down every job on that worker, not just yours, so check the
backend log after the run rather than only the job's own status. If you cannot run one,
say which path went unexercised instead of implying it was verified.
### How many jobs a worker runs at once
`NUM_WORKERS > 1` falls back to 1 outside native mode (`backend/src/main.rs`, unless
`I_ACK_NUM_WORKERS_IS_UNSAFE`), so a worker serving script tags — `go`, `python3`,
`dependency`, `flow`, … — runs one job at a time: a per-job resource budget (memory, CPU,
temp space) shares the worker with the worker process alone.
Native mode is the exception, and budgets for its tags must divide by its concurrency:
it forces 8 workers, and `NATIVE_TAGS` includes executors that already claim a per-job
share of the worker's memory (`postgresql` and `mysql` through `MAX_SQL_RESULT_SIZE`), so
up to 8 of those run against the same limit at once.
## Banned Patterns
### `$bindable(default_value)` on optional props
Using `$bindable(default_value)` on props that can be `undefined` is **banned**. This pattern causes subtle bugs because the default value masks the `undefined` state.
**Bad:**
```svelte
let { my_prop = $bindable(default_value) }: { my_prop?: string } = $props()
```
**Correct alternatives:**
1. **Use `$derived` with nullish coalescing** — handle the potential `undefined` at the usage site:
```svelte
let { my_prop = $bindable() }: { my_prop?: string } = $props()
let effective_value = $derived(my_prop ?? default_value)
```
2. **Create a `useMyPropState()` helper** — encapsulate the undefined-handling logic in a reusable function and call it higher in the component tree, so the child component always receives a defined value.
## Code Navigation
`wm-ts-nav` is an AST-aware code navigator. Use **wm-ts-nav** for structural queries — it skips comments/strings and understands symbol boundaries.
@@ -186,6 +144,12 @@ $NAV --root backend callees "X" # what does X call?
## Core Principles
- **MUST `outline` before `Read`** on unfamiliar files — then `body` or `Read` with offset/limit for specifics
- **Scratch stays outside the checkout.** Temp scripts, data dumps, cache backups and
screenshots go in the session scratch directory or `/tmp`, so nothing temporary can end up
committed. Write `rm`/`mv`/`cp` as one plain unchained command: a PreToolUse hook
auto-allows those when every operand is under `/tmp` or inside this checkout, but it defers
on `&&`, `;`, redirects, quotes and `$VAR` — that deferral, not the delete itself, is what
turns a routine cleanup into a permission prompt.
- Search for existing code to reuse before writing new code
- Follow established patterns in the codebase
- Keep changes focused — don't refactor beyond what's asked
CHANGELOG.md
+19
View File
@@ -1,5 +1,24 @@
# Changelog
## [1.789.0](https://github.com/windmill-labs/windmill/compare/v1.788.0...v1.789.0) (2026-08-13)
### Features
* add EXIT_AFTER_N_JOBS worker mode for environment cleanup ([#10671](https://github.com/windmill-labs/windmill/issues/10671)) ([2fcce45](https://github.com/windmill-labs/windmill/commit/2fcce4526a239437221e37cfd4adfd4da616cf19))
* add memory limits to the go build subprocess ([#10666](https://github.com/windmill-labs/windmill/issues/10666)) ([4cb51cf](https://github.com/windmill-labs/windmill/commit/4cb51cf7bc6aa869efd055cb459ac3a58a6e0e7b))
* auto-build binaries to object storage on deployment ([#10673](https://github.com/windmill-labs/windmill/issues/10673)) ([71b9989](https://github.com/windmill-labs/windmill/commit/71b9989daa9c450faa00ec2605c77e0457d820d6))
* open an AI session from runs, jobs and trigger pages ([#10608](https://github.com/windmill-labs/windmill/issues/10608)) ([adc7947](https://github.com/windmill-labs/windmill/commit/adc7947579090d9695c17144e07d3b8d130818c1))
### Bug Fixes
* expand AZURE_DEVOPS_TOKEN placeholder in backend git probes ([#10677](https://github.com/windmill-labs/windmill/issues/10677)) ([2714210](https://github.com/windmill-labs/windmill/commit/2714210d7c74aa9375ecbb8742e16d007d991ea4))
* **flow:** pass the flow's worker tag when testing a loop iteration ([#10680](https://github.com/windmill-labs/windmill/issues/10680)) ([6fbc3fc](https://github.com/windmill-labs/windmill/commit/6fbc3fccb607a8d80885f0face284c01871a3162))
* git sync missed metadata-only deploys, deploy check missed job link ([#10662](https://github.com/windmill-labs/windmill/issues/10662)) ([93b811f](https://github.com/windmill-labs/windmill/commit/93b811fd8d007e2aa715b458194cfdc35a0bb1d6))
* **github-app:** complete the self-managed setup instructions, render the page header ([#10683](https://github.com/windmill-labs/windmill/issues/10683)) ([ef99a73](https://github.com/windmill-labs/windmill/commit/ef99a739dda73fba60df011e34981c2cb5e23a3c))
* stream ansible playbook logs in real time ([#10669](https://github.com/windmill-labs/windmill/issues/10669)) ([dad4c10](https://github.com/windmill-labs/windmill/commit/dad4c10c8b06ce72d8d808ceea95c7d8efa4918d))
## [1.788.0](https://github.com/windmill-labs/windmill/compare/v1.787.0...v1.788.0) (2026-08-12)
backend/AGENTS.md
+223
View File
@@ -0,0 +1,223 @@
# Backend (Rust)
- **Coding patterns**: MUST use the `rust-backend` skill when writing Rust code
- **Validation**: `docs/validation.md` — which `cargo check` flags to use
- **Enterprise**: `docs/enterprise.md` — EE file conventions and PR workflow
- **DB schema**: `backend/summarized_schema.txt`
- **API routes entry point**: `windmill-api/src/lib.rs`
- **OpenAPI spec**: `windmill-api/openapi.yaml`
- **DuckDB local jobs**: build the dynamic FFI library before running DuckDB scripts locally:
```bash
cd backend/windmill-duckdb-ffi-internal && ./build_dev.sh
```
Re-run after clean builds or when `target/debug/libwindmill_duckdb_ffi_internal.*` is missing.
The bundled DuckDB compile (~2min) is cached in a per-user dir shared across
worktrees (keyed by the crate's `Cargo.lock`), so a fresh worktree reuses it and
the build is near-instant — you don't pay the full compile per worktree. Editing
the FFI crate's own source falls back to an isolated per-worktree `./target`.
The engine is a **patched fork** of duckdb-rs, not the crates.io crate — read
`docs/duckdb-isolation.md` before bumping it or touching the isolation transform.
- **Running data pipelines (DuckLake) from source**: see the section below — a plain build
advertises the `duckdb` tag but cannot execute DuckDB scripts and has no working S3 proxy.
## Cargo features & running the dev backend
The dev backend runs under `cargo watch` and is launched by default with **only
`--features quickjs`** (see the tmux backend pane). That baseline compiles fast but
**deliberately omits most functionality** — notably S3/object storage, the S3 proxy, all
EE code, MCP, and every non-JS language runtime. A running server never gains a feature you
didn't compile in: feature-gated routes 404 or return a `"requires <feature>"` stub. So if
you touch code behind a feature gate, or need to *exercise* such a feature at runtime, you
MUST **restart the backend with the appropriate features** for what you're working on.
### Restarting the dev backend with the right features
Restart in the **same pane**, so the relaunch inherits that pane's `DATABASE_URL`, `BACKEND_PORT`
and the rest of `runtime.env`. Scope every kill to this worktree — **never**
`pkill -f target/debug/windmill`, which kills every sibling worktree's backend.
1. Find the backend pane by what it is running, not by index. The index depends on the webmux
profile: pane 1 is the backend under `full`, but the *frontend* under `frontendOnly`.
```bash
WIN=$(tmux display-message -p -t "$TMUX_PANE" '#{window_id}')
tmux list-panes -t "$WIN" -F '#{pane_index} #{pane_current_command} #{pane_pid}'
```
2. Read the feature set it is **actually** running. `CARGO_FEATURES` in `runtime.env` is only what
the pane started with, and goes stale the first time anyone restarts by hand:
```bash
ps --ppid <pane_pid> -o args=
# /home/hugo/.cargo/bin/cargo-watch watch -x run --features quickjs
```
3. Stop it and relaunch with the extended set. `PORT` in the pane shell can be stale, so pass it
explicitly:
```bash
tmux send-keys -t "$WIN.<idx>" C-c
tmux send-keys -t "$WIN.<idx>" 'PORT=$BACKEND_PORT cargo watch -x "run --features quickjs,private,parquet"' Enter
```
Carry over every feature the old command had unless you mean to drop one — rebuilding the list
from memory is how a backend silently loses `quickjs`.
4. Persist the new set so a recreated pane starts with it: set `CARGO_FEATURES` in the
worktree's `.env.local`, which `scripts/post-create.sh` writes and webmux reads. Do **not**
edit `runtime.env` for this — webmux regenerates it from metadata and `.env.local` every time
the worktree is opened, so an edit there is lost on the next reopen. Either way the change
only affects a future pane; step 3 is what takes effect now.
5. Re-capture the pane until `health check completed` appears before hitting the API. A cold
rebuild takes ~60s, and the previous run's success line is still in the scrollback, so a
capture taken too early reads as ready when it isn't.
cargo-watch only re-runs on a file change, so after an idle/failed run `touch README.md` (from
`backend/`, where the watch runs) is a cheap retrigger (touching a `.rs` forces a full rebuild).
### An orphaned backend is holding the port
If the pane's `cargo watch` looks alive but the API never answers, or the build ends in an
address-already-in-use error, a backend from an earlier run is probably still bound to the port.
It gets reparented to `systemd --user` when its shell dies, so it survives everything that looks
like a cleanup.
Confirm all three before killing anything — a dozen sibling worktrees run their own backend, and
`pkill -f windmill` (or `-f target/debug/windmill`) kills every one of them:
```bash
ss -ltnp | grep ":$BACKEND_PORT" # 1. which pid holds the port
readlink /proc/<pid>/cwd # 2. must be THIS worktree's backend/
ps -o ppid= -p <pid> # 3. parent is systemd/pid 1, not your pane's cargo-watch
```
Only when the port owner is this worktree's backend **and** it is orphaned, kill that single pid
(`kill <pid>`, then `kill -9` if it does not exit). Ask first when there is a human in the loop;
unattended, the three checks are what make it safe. Then `touch README.md` to retrigger the
watch.
### What each feature gate does (the ones you'll actually toggle)
`backend/Cargo.toml` `[features]` is the source of truth; this is the practical dev map. Combine
only what you need — build time scales with the set.
| Feature | Enables | Need it for |
|---|---|---|
| `quickjs` | Embedded JS engine for inline JS eval (the default dev baseline). | Keep in every dev set. |
| `private` | Compiles the `*_ee.rs` files (symlinked from `windmill-ee-private`). Gates **all** EE code, including the real S3 helpers, the S3 proxy, and advanced S3 permission checks. | Any EE code path, S3/object storage. |
| `enterprise` | EE business logic (autoscaling, SAML hooks, advanced S3 rule **enforcement**, WAP, forks, …). Pulls in `license`. | Running EE features. Advanced S3 permission rules only take effect with this. |
| `license` | License-key/plan plumbing (`LICENSE_KEY`). Pulled in by `enterprise`. Having the feature compiled does **not** require a license *key* at runtime — CE defaults to a free plan and most EE paths still run keyless. | License-gated behavior. |
| `parquet` | S3/object-storage support: the `job_helpers/*` and `apps_u/*` S3 endpoints, parquet/CSV preview, workspace large-file storage. Without it those routes return `"requires parquet"`. | Anything touching S3/object storage or datasets. |
| `duckdb` | DuckDB script executor (also needs the FFI dylib — see above). | DuckDB scripts, DuckLake. |
| `python` `rust` `php` `java` `ruby` `csharp` `nu` `deno_core` `mysql` `mssql` `bigquery` `snowflake` `oracledb` `rlang` | Each enables that language/DB runtime for job execution. | Running jobs in that language. |
| `mcp` | MCP gateway routes (baseline `quickjs` does NOT include it → MCP routes 404). | MCP work. |
| `websocket` `http_trigger` `kafka` `nats` `mqtt_trigger` `sqs_trigger` `gcp_trigger` `azure_trigger` `postgres_trigger` `native_trigger` | Each native trigger kind; none on by default (creating one 404s without its feature). | Working on / exercising that trigger. |
| `no_auth` | Treats every request as an admin superadmin (`CLOUD_HOSTED`-guarded). | Local auth-free experiments only. |
Convenience bundles (`ce`, `ee`, `oss`, …) exist in `[features]` but are heavy — prefer the
minimal explicit set for dev.
**Common combinations** (run from `backend/`):
| Goal | `--features` |
|---|---|
| Plain dev baseline (JS eval only) | `quickjs` |
| S3 / object storage / datasets (CE) | `quickjs,private,parquet` |
| S3 + EE (advanced S3 rules, on-behalf app reads, WAP, forks) | `quickjs,enterprise,private,parquet` |
| DuckLake / DuckDB (CE) | `quickjs,duckdb,parquet,private` (+ build the FFI) |
| + Python jobs | append `,python` |
## Workspace object storage in dev — use the local filesystem
For a dev workspace you don't need MinIO/S3: use the built-in **`FilesystemStorage`** large-file
storage (a root path on local disk). It is intentionally hidden from the settings-UI storage
dropdown (dev-only), so set it via the API. Requires the backend built with `parquet` (+ `private`
for the real S3 helpers, + `enterprise` if you want advanced permission rules enforced):
```bash
curl -X POST "$BASE/api/w/<ws>/workspaces/edit_large_file_storage_config" \
-H "Authorization: Bearer <admin-token>" -H "Content-Type: application/json" \
-d '{"large_file_storage":{"type":"FilesystemStorage","root_path":"/abs/writable/dir",
"public_resource":false,"advanced_permissions":null,"secondary_storage":{}}}'
```
Optional `advanced_permissions` (EE) is a list of `{"pattern":"<glob>","allow":"read[,write,delete,list]"}`
rules: admins bypass them, non-admins are confined to matching grants. Uploads/reads then flow
through the normal `job_helpers/*` (viewer-scoped) and `apps_u/*` (app-author on-behalf) S3
endpoints. Caveat: direct DuckDB access rejects filesystem stores (`"Filesystem is not supported
in DuckDB"`) — DuckLake/datatable go through the S3 proxy instead, which works.
## Running data pipelines (DuckLake) from source
DuckLake pipelines need **both** the right cargo features **and** the prebuilt DuckDB FFI. A
plain `cargo run` (or `cargo run --features quickjs`) does **not** suffice, and the failure modes
are silent-ish, so agents lose time. Verify feature names against `backend/Cargo.toml` `[features]`.
**Feature sets** (run from `backend/`):
| Goal | Command |
|---|---|
| CE DuckLake (DuckDB scripts + S3 proxy) | `cargo run --features quickjs,duckdb,parquet,private` |
| + Python scripts | add `,python` |
| EE features (WAP, partitioning, forks, …) | add `,enterprise,license` |
`enterprise` already pulls in `license`, but list both when you want the license-gated paths.
`quickjs` is for JS eval, not DuckLake per se — keep it if your baseline build had it.
**Before running any DuckDB script**, build the FFI (see the bullet above):
`cd backend/windmill-duckdb-ffi-internal && ./build_dev.sh`.
**Two gotchas that a wrong feature set produces:**
1. **`duckdb` tag advertised, feature missing.** The `duckdb` worker tag is in the *unconditional*
default tag list (`windmill-common/src/worker.rs`, `DEFAULT_TAGS`), so a worker advertises it even
without the `duckdb` feature. Jobs then dispatch but fail at execution with
`"Duck DB requires the duckdb feature to be enabled"` (`windmill-worker/src/worker.rs`). Fix:
compile with `--features duckdb`.
2. **DuckLake writes 404 (no S3 proxy).** The workspace S3 proxy (`/w/{ws}/s3_proxy/*`) that
DuckLake uses for reads/writes only mounts the real service under
`#[cfg(all(feature = "private", feature = "parquet"))]` (`windmill-api/src/s3_proxy_oss.rs`);
otherwise it's an empty router and every proxied request 404s. Fix: compile with **both**
`private` and `parquet`.
## Cloud vs self-hosted gating
The `cloud` cargo feature is compiled into **all** EE builds, so `#[cfg(feature = "cloud")]` is **not** a "cloud-only" runtime gate — it only means the code is present. The real gate for behavior specific to the managed cloud (app.windmill.dev) is the runtime flag `*CLOUD_HOSTED` (`windmill_common::worker::CLOUD_HOSTED`, from the `CLOUD_HOSTED` env var; note it's loaded from `.env` via `dotenv`, so it won't show in `/proc/<pid>/environ` — check the running behavior, not the exec env).
Cloud-only logic must be behind `if *CLOUD_HOSTED { ... }`: feature-gate the helper so it compiles, then **runtime-gate the call**. `#[cfg(feature = "cloud")]` on its own is only sufficient for:
- pure helper/struct definitions (they only run when a gated caller invokes them),
- code already inside an `if *CLOUD_HOSTED { ... }` block,
- handlers that early-return on `!*CLOUD_HOSTED`,
- idempotent no-ops that are harmless off-cloud (e.g. cache invalidation).
## Verifying Backend Changes
`cargo check` and the unit tests do not exercise a worker code path. **If you changed how
a job runs — an executor, `handle_child`, anything spawning or reading from a
subprocess — run an actual job of that kind** and confirm it completed, then say so.
Whole classes of defect compile and unit-test clean:
- **Stack overflow from a large buffer in an async block.** An array declared across an
`.await` is baked into the future's state; once that future is boxed a few layers deep
by the job poller, two 16 KB arrays abort the worker *process* (`thread
'tokio-runtime-worker' has overflowed its stack`). Heap-allocate read buffers
(`vec![0u8; N]`, not `[0u8; N]`).
- Deadlocks from draining only one of a child's pipes, missed cancellation or timeout
propagation, and anything depending on the real engine's output format.
A crash like this takes down every job on that worker, not just yours, so check the
backend log after the run rather than only the job's own status. If you cannot run one,
say which path went unexercised instead of implying it was verified.
### How many jobs a worker runs at once
`NUM_WORKERS > 1` falls back to 1 outside native mode (`backend/src/main.rs`, unless
`I_ACK_NUM_WORKERS_IS_UNSAFE`), so a worker serving script tags — `go`, `python3`,
`dependency`, `flow`, … — runs one job at a time: a per-job resource budget (memory, CPU,
temp space) shares the worker with the worker process alone.
Native mode is the exception, and budgets for its tags must divide by its concurrency:
it forces 8 workers, and `NATIVE_TAGS` includes executors that already claim a per-job
share of the worker's memory (`postgresql` and `mysql` through `MAX_SQL_RESULT_SIZE`), so
up to 8 of those run against the same limit at once.
backend/CLAUDE.md
+1 -144
View File
@@ -1,144 +1 @@
# Backend (Rust)
- **Coding patterns**: MUST use the `rust-backend` skill when writing Rust code
- **Validation**: `docs/validation.md` — which `cargo check` flags to use
- **Enterprise**: `docs/enterprise.md` — EE file conventions and PR workflow
- **DB schema**: `backend/summarized_schema.txt`
- **API routes entry point**: `windmill-api/src/lib.rs`
- **OpenAPI spec**: `windmill-api/openapi.yaml`
- **DuckDB local jobs**: build the dynamic FFI library before running DuckDB scripts locally:
```bash
cd backend/windmill-duckdb-ffi-internal && ./build_dev.sh
```
Re-run after clean builds or when `target/debug/libwindmill_duckdb_ffi_internal.*` is missing.
The bundled DuckDB compile (~2min) is cached in a per-user dir shared across
worktrees (keyed by the crate's `Cargo.lock`), so a fresh worktree reuses it and
the build is near-instant — you don't pay the full compile per worktree. Editing
the FFI crate's own source falls back to an isolated per-worktree `./target`.
The engine is a **patched fork** of duckdb-rs, not the crates.io crate — read
`docs/duckdb-isolation.md` before bumping it or touching the isolation transform.
- **Running data pipelines (DuckLake) from source**: see the section below — a plain build
advertises the `duckdb` tag but cannot execute DuckDB scripts and has no working S3 proxy.
## Cargo features & running the dev backend
The dev backend runs under `cargo watch` and is launched by default with **only
`--features quickjs`** (see the tmux backend pane). That baseline compiles fast but
**deliberately omits most functionality** — notably S3/object storage, the S3 proxy, all
EE code, MCP, and every non-JS language runtime. A running server never gains a feature you
didn't compile in: feature-gated routes 404 or return a `"requires <feature>"` stub. So if
you touch code behind a feature gate, or need to *exercise* such a feature at runtime, you
MUST **restart the backend with the appropriate features** for what you're working on.
### Restarting the dev backend with the right features
The backend runs in tmux pane 1 as `cargo watch -x "run --features <…>"`. To restart it with a
different feature set — scope kills by pid/cwd, **never** `pkill -f target/debug/windmill` (it
kills every sibling worktree's backend):
1. Stop the current run: `tmux send-keys -t <pane1> C-c`, then kill *this worktree's*
`cargo-watch` pid (find it via `/proc/<pid>/cwd`).
2. Relaunch in the same pane so it inherits the shell's `DATABASE_URL` etc.; the pane env's
`PORT` may be stale, so set it explicitly:
```bash
export PORT=$BACKEND_PORT
cargo watch -x "run --features enterprise,private,parquet,quickjs"
```
3. Wait for `health check completed` in the pane before hitting the API.
cargo-watch only re-runs on a file change, so after an idle/failed run `touch README.md` (from
`backend/`, where the watch runs) is a cheap retrigger (touching a `.rs` forces a full rebuild).
### What each feature gate does (the ones you'll actually toggle)
`backend/Cargo.toml` `[features]` is the source of truth; this is the practical dev map. Combine
only what you need — build time scales with the set.
| Feature | Enables | Need it for |
|---|---|---|
| `quickjs` | Embedded JS engine for inline JS eval (the default dev baseline). | Keep in every dev set. |
| `private` | Compiles the `*_ee.rs` files (symlinked from `windmill-ee-private`). Gates **all** EE code, including the real S3 helpers, the S3 proxy, and advanced S3 permission checks. | Any EE code path, S3/object storage. |
| `enterprise` | EE business logic (autoscaling, SAML hooks, advanced S3 rule **enforcement**, WAP, forks, …). Pulls in `license`. | Running EE features. Advanced S3 permission rules only take effect with this. |
| `license` | License-key/plan plumbing (`LICENSE_KEY`). Pulled in by `enterprise`. Having the feature compiled does **not** require a license *key* at runtime — CE defaults to a free plan and most EE paths still run keyless. | License-gated behavior. |
| `parquet` | S3/object-storage support: the `job_helpers/*` and `apps_u/*` S3 endpoints, parquet/CSV preview, workspace large-file storage. Without it those routes return `"requires parquet"`. | Anything touching S3/object storage or datasets. |
| `duckdb` | DuckDB script executor (also needs the FFI dylib — see above). | DuckDB scripts, DuckLake. |
| `python` `rust` `php` `java` `ruby` `csharp` `nu` `deno_core` `mysql` `mssql` `bigquery` `snowflake` `oracledb` `rlang` | Each enables that language/DB runtime for job execution. | Running jobs in that language. |
| `mcp` | MCP gateway routes (baseline `quickjs` does NOT include it → MCP routes 404). | MCP work. |
| `websocket` `http_trigger` `kafka` `nats` `mqtt_trigger` `sqs_trigger` `gcp_trigger` `azure_trigger` `postgres_trigger` `native_trigger` | Each native trigger kind; none on by default (creating one 404s without its feature). | Working on / exercising that trigger. |
| `no_auth` | Treats every request as an admin superadmin (`CLOUD_HOSTED`-guarded). | Local auth-free experiments only. |
Convenience bundles (`ce`, `ee`, `oss`, …) exist in `[features]` but are heavy — prefer the
minimal explicit set for dev.
**Common combinations** (run from `backend/`):
| Goal | `--features` |
|---|---|
| Plain dev baseline (JS eval only) | `quickjs` |
| S3 / object storage / datasets (CE) | `quickjs,private,parquet` |
| S3 + EE (advanced S3 rules, on-behalf app reads, WAP, forks) | `quickjs,enterprise,private,parquet` |
| DuckLake / DuckDB (CE) | `quickjs,duckdb,parquet,private` (+ build the FFI) |
| + Python jobs | append `,python` |
## Workspace object storage in dev — use the local filesystem
For a dev workspace you don't need MinIO/S3: use the built-in **`FilesystemStorage`** large-file
storage (a root path on local disk). It is intentionally hidden from the settings-UI storage
dropdown (dev-only), so set it via the API. Requires the backend built with `parquet` (+ `private`
for the real S3 helpers, + `enterprise` if you want advanced permission rules enforced):
```bash
curl -X POST "$BASE/api/w/<ws>/workspaces/edit_large_file_storage_config" \
-H "Authorization: Bearer <admin-token>" -H "Content-Type: application/json" \
-d '{"large_file_storage":{"type":"FilesystemStorage","root_path":"/abs/writable/dir",
"public_resource":false,"advanced_permissions":null,"secondary_storage":{}}}'
```
Optional `advanced_permissions` (EE) is a list of `{"pattern":"<glob>","allow":"read[,write,delete,list]"}`
rules: admins bypass them, non-admins are confined to matching grants. Uploads/reads then flow
through the normal `job_helpers/*` (viewer-scoped) and `apps_u/*` (app-author on-behalf) S3
endpoints. Caveat: direct DuckDB access rejects filesystem stores (`"Filesystem is not supported
in DuckDB"`) — DuckLake/datatable go through the S3 proxy instead, which works.
## Running data pipelines (DuckLake) from source
DuckLake pipelines need **both** the right cargo features **and** the prebuilt DuckDB FFI. A
plain `cargo run` (or `cargo run --features quickjs`) does **not** suffice, and the failure modes
are silent-ish, so agents lose time. Verify feature names against `backend/Cargo.toml` `[features]`.
**Feature sets** (run from `backend/`):
| Goal | Command |
|---|---|
| CE DuckLake (DuckDB scripts + S3 proxy) | `cargo run --features quickjs,duckdb,parquet,private` |
| + Python scripts | add `,python` |
| EE features (WAP, partitioning, forks, …) | add `,enterprise,license` |
`enterprise` already pulls in `license`, but list both when you want the license-gated paths.
`quickjs` is for JS eval, not DuckLake per se — keep it if your baseline build had it.
**Before running any DuckDB script**, build the FFI (see the bullet above):
`cd backend/windmill-duckdb-ffi-internal && ./build_dev.sh`.
**Two gotchas that a wrong feature set produces:**
1. **`duckdb` tag advertised, feature missing.** The `duckdb` worker tag is in the *unconditional*
default tag list (`windmill-common/src/worker.rs`, `DEFAULT_TAGS`), so a worker advertises it even
without the `duckdb` feature. Jobs then dispatch but fail at execution with
`"Duck DB requires the duckdb feature to be enabled"` (`windmill-worker/src/worker.rs`). Fix:
compile with `--features duckdb`.
2. **DuckLake writes 404 (no S3 proxy).** The workspace S3 proxy (`/w/{ws}/s3_proxy/*`) that
DuckLake uses for reads/writes only mounts the real service under
`#[cfg(all(feature = "private", feature = "parquet"))]` (`windmill-api/src/s3_proxy_oss.rs`);
otherwise it's an empty router and every proxied request 404s. Fix: compile with **both**
`private` and `parquet`.
## Cloud vs self-hosted gating
The `cloud` cargo feature is compiled into **all** EE builds, so `#[cfg(feature = "cloud")]` is **not** a "cloud-only" runtime gate — it only means the code is present. The real gate for behavior specific to the managed cloud (app.windmill.dev) is the runtime flag `*CLOUD_HOSTED` (`windmill_common::worker::CLOUD_HOSTED`, from the `CLOUD_HOSTED` env var; note it's loaded from `.env` via `dotenv`, so it won't show in `/proc/<pid>/environ` — check the running behavior, not the exec env).
Cloud-only logic must be behind `if *CLOUD_HOSTED { ... }`: feature-gate the helper so it compiles, then **runtime-gate the call**. `#[cfg(feature = "cloud")]` on its own is only sufficient for:
- pure helper/struct definitions (they only run when a gated caller invokes them),
- code already inside an `if *CLOUD_HOSTED { ... }` block,
- handlers that early-return on `!*CLOUD_HOSTED`,
- idempotent no-ops that are harmless off-cloud (e.g. cache invalidation).
@AGENTS.md
backend/Cargo.lock
Generated
+79 -79
View File
@@ -14664,7 +14664,7 @@ dependencies = [
[[package]]
name = "windmill"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"async-nats",
@@ -14749,7 +14749,7 @@ dependencies = [
[[package]]
name = "windmill-ai"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"async-stream",
"async-trait",
@@ -14782,7 +14782,7 @@ dependencies = [
[[package]]
name = "windmill-alerting"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"axum 0.8.9",
"chrono",
@@ -14795,7 +14795,7 @@ dependencies = [
[[package]]
name = "windmill-api"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"argon2",
@@ -14935,7 +14935,7 @@ dependencies = [
[[package]]
name = "windmill-api-agent-workers"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"axum 0.8.9",
"chrono",
@@ -14958,7 +14958,7 @@ dependencies = [
[[package]]
name = "windmill-api-assets"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"axum 0.8.9",
"chrono",
@@ -14975,7 +14975,7 @@ dependencies = [
[[package]]
name = "windmill-api-auth"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"axum 0.8.9",
@@ -15001,7 +15001,7 @@ dependencies = [
[[package]]
name = "windmill-api-client"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"reqwest 0.12.28",
"serde",
@@ -15011,7 +15011,7 @@ dependencies = [
[[package]]
name = "windmill-api-configs"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"axum 0.8.9",
"chrono",
@@ -15028,7 +15028,7 @@ dependencies = [
[[package]]
name = "windmill-api-debug"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"axum 0.8.9",
"base64 0.22.1",
@@ -15050,7 +15050,7 @@ dependencies = [
[[package]]
name = "windmill-api-embeddings"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"axum 0.8.9",
@@ -15073,7 +15073,7 @@ dependencies = [
[[package]]
name = "windmill-api-flow-conversations"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"axum 0.8.9",
"chrono",
@@ -15089,7 +15089,7 @@ dependencies = [
[[package]]
name = "windmill-api-flows"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"axum 0.8.9",
"chrono",
@@ -15111,7 +15111,7 @@ dependencies = [
[[package]]
name = "windmill-api-groups"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"axum 0.8.9",
"chrono",
@@ -15132,7 +15132,7 @@ dependencies = [
[[package]]
name = "windmill-api-inputs"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"axum 0.8.9",
"chrono",
@@ -15146,7 +15146,7 @@ dependencies = [
[[package]]
name = "windmill-api-integration-tests"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"async-nats",
@@ -15181,7 +15181,7 @@ dependencies = [
[[package]]
name = "windmill-api-jobs"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"axum 0.8.9",
@@ -15206,7 +15206,7 @@ dependencies = [
[[package]]
name = "windmill-api-npm-proxy"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"axum 0.8.9",
"chrono",
@@ -15234,7 +15234,7 @@ dependencies = [
[[package]]
name = "windmill-api-openapi"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"axum 0.8.9",
@@ -15256,7 +15256,7 @@ dependencies = [
[[package]]
name = "windmill-api-schedule"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"axum 0.8.9",
"chrono",
@@ -15276,7 +15276,7 @@ dependencies = [
[[package]]
name = "windmill-api-scripts"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"axum 0.8.9",
"chrono",
@@ -15314,7 +15314,7 @@ dependencies = [
[[package]]
name = "windmill-api-settings"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"axum 0.8.9",
@@ -15342,7 +15342,7 @@ dependencies = [
[[package]]
name = "windmill-api-sse"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"lazy_static",
"serde",
@@ -15354,7 +15354,7 @@ dependencies = [
[[package]]
name = "windmill-api-users"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"argon2",
"axum 0.8.9",
@@ -15379,7 +15379,7 @@ dependencies = [
[[package]]
name = "windmill-api-workers"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"axum 0.8.9",
"chrono",
@@ -15393,7 +15393,7 @@ dependencies = [
[[package]]
name = "windmill-api-workspaces"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"axum 0.8.9",
"chrono",
@@ -15428,7 +15428,7 @@ dependencies = [
[[package]]
name = "windmill-audit"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"chrono",
"lazy_static",
@@ -15442,7 +15442,7 @@ dependencies = [
[[package]]
name = "windmill-autoscaling"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"axum 0.8.9",
@@ -15461,7 +15461,7 @@ dependencies = [
[[package]]
name = "windmill-common"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"aes-gcm",
"aho-corasick",
@@ -15565,7 +15565,7 @@ dependencies = [
[[package]]
name = "windmill-dep-map"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"chrono",
"itertools 0.14.0",
@@ -15584,7 +15584,7 @@ dependencies = [
[[package]]
name = "windmill-git-sync"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"regex",
"serde",
@@ -15599,7 +15599,7 @@ dependencies = [
[[package]]
name = "windmill-indexer"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"astral-tokio-tar",
@@ -15623,7 +15623,7 @@ dependencies = [
[[package]]
name = "windmill-jseval"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"futures",
@@ -15640,7 +15640,7 @@ dependencies = [
[[package]]
name = "windmill-macros"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"itertools 0.14.0",
"lazy_static",
@@ -15656,7 +15656,7 @@ dependencies = [
[[package]]
name = "windmill-mcp"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"async-trait",
@@ -15677,7 +15677,7 @@ dependencies = [
[[package]]
name = "windmill-native-triggers"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"async-trait",
@@ -15708,7 +15708,7 @@ dependencies = [
[[package]]
name = "windmill-oauth"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"arc-swap",
@@ -15733,7 +15733,7 @@ dependencies = [
[[package]]
name = "windmill-object-store"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"async-stream",
@@ -15767,7 +15767,7 @@ dependencies = [
[[package]]
name = "windmill-operator"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"futures",
@@ -15785,7 +15785,7 @@ dependencies = [
[[package]]
name = "windmill-parser"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"convert_case 0.6.0",
"serde",
@@ -15794,7 +15794,7 @@ dependencies = [
[[package]]
name = "windmill-parser-bash"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"lazy_static",
@@ -15806,7 +15806,7 @@ dependencies = [
[[package]]
name = "windmill-parser-csharp"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"serde_json",
@@ -15818,7 +15818,7 @@ dependencies = [
[[package]]
name = "windmill-parser-go"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"gosyn",
@@ -15830,7 +15830,7 @@ dependencies = [
[[package]]
name = "windmill-parser-graphql"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"lazy_static",
@@ -15842,7 +15842,7 @@ dependencies = [
[[package]]
name = "windmill-parser-java"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"serde_json",
@@ -15854,7 +15854,7 @@ dependencies = [
[[package]]
name = "windmill-parser-nu"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"nu-parser",
@@ -15865,7 +15865,7 @@ dependencies = [
[[package]]
name = "windmill-parser-php"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"itertools 0.14.0",
@@ -15876,7 +15876,7 @@ dependencies = [
[[package]]
name = "windmill-parser-py"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"itertools 0.14.0",
@@ -15888,7 +15888,7 @@ dependencies = [
[[package]]
name = "windmill-parser-py-asset"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"rustpython-ast",
@@ -15899,7 +15899,7 @@ dependencies = [
[[package]]
name = "windmill-parser-py-imports"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"async-recursion",
@@ -15921,7 +15921,7 @@ dependencies = [
[[package]]
name = "windmill-parser-r"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"serde_json",
@@ -15933,7 +15933,7 @@ dependencies = [
[[package]]
name = "windmill-parser-ruby"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"lazy_static",
@@ -15947,7 +15947,7 @@ dependencies = [
[[package]]
name = "windmill-parser-rust"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"convert_case 0.6.0",
@@ -15964,7 +15964,7 @@ dependencies = [
[[package]]
name = "windmill-parser-sql"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"lazy_static",
@@ -15977,7 +15977,7 @@ dependencies = [
[[package]]
name = "windmill-parser-sql-asset"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"serde",
@@ -15989,7 +15989,7 @@ dependencies = [
[[package]]
name = "windmill-parser-ts"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"lazy_static",
@@ -16007,7 +16007,7 @@ dependencies = [
[[package]]
name = "windmill-parser-ts-asset"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"serde-wasm-bindgen",
@@ -16023,7 +16023,7 @@ dependencies = [
[[package]]
name = "windmill-parser-wac"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"rustpython-ast",
@@ -16039,7 +16039,7 @@ dependencies = [
[[package]]
name = "windmill-parser-yaml"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"lazy_static",
@@ -16053,7 +16053,7 @@ dependencies = [
[[package]]
name = "windmill-queue"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"async-recursion",
@@ -16092,7 +16092,7 @@ dependencies = [
[[package]]
name = "windmill-runtime-nativets"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"const_format",
@@ -16132,7 +16132,7 @@ dependencies = [
[[package]]
name = "windmill-sql-datatype-parser-wasm"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"getrandom 0.3.4",
"wasm-bindgen",
@@ -16143,7 +16143,7 @@ dependencies = [
[[package]]
name = "windmill-store"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"async-recursion",
@@ -16178,7 +16178,7 @@ dependencies = [
[[package]]
name = "windmill-test-utils"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"async-trait",
@@ -16202,7 +16202,7 @@ dependencies = [
[[package]]
name = "windmill-trigger"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"async-trait",
@@ -16235,7 +16235,7 @@ dependencies = [
[[package]]
name = "windmill-trigger-amqp"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"async-trait",
@@ -16262,7 +16262,7 @@ dependencies = [
[[package]]
name = "windmill-trigger-azure"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"async-trait",
@@ -16295,7 +16295,7 @@ dependencies = [
[[package]]
name = "windmill-trigger-email"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"async-trait",
@@ -16315,7 +16315,7 @@ dependencies = [
[[package]]
name = "windmill-trigger-gcp"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"async-trait",
@@ -16349,7 +16349,7 @@ dependencies = [
[[package]]
name = "windmill-trigger-http"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"async-trait",
@@ -16385,7 +16385,7 @@ dependencies = [
[[package]]
name = "windmill-trigger-kafka"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"async-trait",
@@ -16408,7 +16408,7 @@ dependencies = [
[[package]]
name = "windmill-trigger-mqtt"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"async-trait",
@@ -16432,7 +16432,7 @@ dependencies = [
[[package]]
name = "windmill-trigger-nats"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"async-nats",
@@ -16456,7 +16456,7 @@ dependencies = [
[[package]]
name = "windmill-trigger-postgres"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"async-trait",
@@ -16491,7 +16491,7 @@ dependencies = [
[[package]]
name = "windmill-trigger-sqs"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"async-trait",
@@ -16519,7 +16519,7 @@ dependencies = [
[[package]]
name = "windmill-trigger-websocket"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"async-trait",
@@ -16544,7 +16544,7 @@ dependencies = [
[[package]]
name = "windmill-types"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"bitflags 2.13.1",
@@ -16563,7 +16563,7 @@ dependencies = [
[[package]]
name = "windmill-worker"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"async-once-cell",
@@ -16679,7 +16679,7 @@ dependencies = [
[[package]]
name = "windmill-worker-volumes"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"bytes",
"futures",
backend/Cargo.toml
+2 -2
View File
@@ -1,6 +1,6 @@
[package]
name = "windmill"
version = "1.788.0"
version = "1.789.0"
authors.workspace = true
edition.workspace = true
@@ -88,7 +88,7 @@ members = [
exclude = ["./windmill-duckdb-ffi-internal", "./parsers/windmill-parser-wasm"]
[workspace.package]
version = "1.788.0"
version = "1.789.0"
authors = ["Ruben Fiszel <ruben@windmill.dev>"]
edition = "2021"
backend/ee-repo-ref.txt
+1 -1
View File
@@ -1 +1 @@
d73f73d3c25dc54cf6be3631f0a4a81d9c556fcc
71ef2cf2a5badd53d16d5cc945ab4ada1a639314
backend/parsers/windmill-parser-wasm/Cargo.lock
Generated
+24 -24
View File
@@ -6191,7 +6191,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
[[package]]
name = "windmill-common"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"aho-corasick",
"anyhow",
@@ -6274,7 +6274,7 @@ dependencies = [
[[package]]
name = "windmill-macros"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"proc-macro2",
"quote",
@@ -6286,7 +6286,7 @@ dependencies = [
[[package]]
name = "windmill-parser"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"convert_case",
"serde",
@@ -6295,7 +6295,7 @@ dependencies = [
[[package]]
name = "windmill-parser-bash"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"lazy_static",
@@ -6307,7 +6307,7 @@ dependencies = [
[[package]]
name = "windmill-parser-csharp"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"serde_json",
@@ -6319,7 +6319,7 @@ dependencies = [
[[package]]
name = "windmill-parser-go"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"gosyn",
@@ -6331,7 +6331,7 @@ dependencies = [
[[package]]
name = "windmill-parser-graphql"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"lazy_static",
@@ -6343,7 +6343,7 @@ dependencies = [
[[package]]
name = "windmill-parser-java"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"serde_json",
@@ -6355,7 +6355,7 @@ dependencies = [
[[package]]
name = "windmill-parser-nu"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"nu-parser",
@@ -6366,7 +6366,7 @@ dependencies = [
[[package]]
name = "windmill-parser-php"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"itertools 0.14.0",
@@ -6377,7 +6377,7 @@ dependencies = [
[[package]]
name = "windmill-parser-py"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"itertools 0.14.0",
@@ -6389,7 +6389,7 @@ dependencies = [
[[package]]
name = "windmill-parser-py-asset"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"rustpython-ast",
@@ -6400,7 +6400,7 @@ dependencies = [
[[package]]
name = "windmill-parser-py-imports"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"async-recursion",
@@ -6422,7 +6422,7 @@ dependencies = [
[[package]]
name = "windmill-parser-r"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"serde_json",
@@ -6434,7 +6434,7 @@ dependencies = [
[[package]]
name = "windmill-parser-ruby"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"lazy_static",
@@ -6448,7 +6448,7 @@ dependencies = [
[[package]]
name = "windmill-parser-rust"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"convert_case",
@@ -6465,7 +6465,7 @@ dependencies = [
[[package]]
name = "windmill-parser-sql"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"lazy_static",
@@ -6478,7 +6478,7 @@ dependencies = [
[[package]]
name = "windmill-parser-sql-asset"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"serde",
@@ -6490,7 +6490,7 @@ dependencies = [
[[package]]
name = "windmill-parser-ts"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"lazy_static",
@@ -6508,7 +6508,7 @@ dependencies = [
[[package]]
name = "windmill-parser-ts-asset"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"serde-wasm-bindgen",
@@ -6524,7 +6524,7 @@ dependencies = [
[[package]]
name = "windmill-parser-wac"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"rustpython-ast",
@@ -6540,7 +6540,7 @@ dependencies = [
[[package]]
name = "windmill-parser-wasm"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"getrandom 0.2.17",
@@ -6572,7 +6572,7 @@ dependencies = [
[[package]]
name = "windmill-parser-yaml"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"lazy_static",
@@ -6586,7 +6586,7 @@ dependencies = [
[[package]]
name = "windmill-types"
version = "1.788.0"
version = "1.789.0"
dependencies = [
"anyhow",
"bitflags",
backend/parsers/windmill-parser-wasm/Cargo.toml
+1 -1
View File
@@ -12,7 +12,7 @@ resolver = "2"
members = ["."]
[workspace.package]
version = "1.788.0"
version = "1.789.0"
edition = "2021"
authors = ["Ruben Fiszel <ruben@windmill.dev>"]
backend/tests/asset_trigger_dispatch.rs
+1
View File
@@ -244,6 +244,7 @@ fn make_mini(id: Uuid, runnable_path: &str) -> MiniCompletedJob {
cache_ttl: None,
cache_ignore_s3_path: None,
runnable_settings_handle: None,
build_binary_only: false,
}
}
backend/windmill-api-flows/src/flows.rs
+36 -2
View File
@@ -381,6 +381,7 @@ async fn toggle_workspace_error_handler(
async fn toggle_workspace_error_handler(
authed: ApiAuthed,
Extension(user_db): Extension<UserDB>,
Extension(db): Extension<DB>,
Path((w_id, path)): Path<(String, StripPath)>,
Json(req): Json<ToggleWorkspaceErrorHandler>,
) -> Result<String> {
@@ -401,9 +402,10 @@ async fn toggle_workspace_error_handler(
.await?
.unwrap_or(None);
let mut updated_rows = 0;
let response = match error_handler_maybe {
Some(_) => {
sqlx::query_scalar!(
updated_rows = sqlx::query_scalar!(
r#"
UPDATE
flow
@@ -418,7 +420,8 @@ async fn toggle_workspace_error_handler(
req.muted,
)
.execute(&mut *tx)
.await?;
.await?
.rows_affected();
Ok("".to_string())
}
None => Err(Error::BadRequest(
@@ -428,6 +431,37 @@ async fn toggle_workspace_error_handler(
tx.commit().await?;
// `ws_error_handler_muted` is part of the synced flow metadata, so the
// toggle is a deploy like any other edit of it. The version is a
// placeholder: git sync keys off the path and kind alone. The update runs
// under RLS against an unchecked path, so it can match nothing — deploy
// only what it actually wrote.
if updated_rows > 0 {
handle_deployment_metadata(
&authed.email,
&authed.username,
&db,
&w_id,
DeployedObject::Flow {
path: path.to_path().to_string(),
parent_path: None,
version: 0,
},
Some(format!(
"Flow '{}' {} the workspace error handler",
path.to_path(),
if req.muted.unwrap_or(false) {
"muted"
} else {
"unmuted"
}
)),
true,
None,
)
.await?;
}
return response;
}
backend/windmill-api-groups/src/folders.rs
+26
View File
@@ -851,6 +851,7 @@ async fn delete_folder(
async fn add_owner(
authed: ApiAuthed,
Extension(user_db): Extension<UserDB>,
Extension(db): Extension<DB>,
Extension(webhook): Extension<WebhookShared>,
Path((w_id, name)): Path<(String, String)>,
Json(Owner { owner, .. }): Json<Owner>,
@@ -905,6 +906,18 @@ async fn add_owner(
tx.commit().await?;
handle_deployment_metadata(
&authed.email,
&authed.username,
&db,
&w_id,
DeployedObject::Folder { path: format!("f/{}", name) },
Some(format!("Folder '{}' changed permissions", name)),
true,
None,
)
.await?;
webhook.send_message(
w_id.clone(),
WebhookMessage::UpdateFolder { workspace: w_id, name: name.clone() },
@@ -916,6 +929,7 @@ async fn add_owner(
async fn remove_owner(
authed: ApiAuthed,
Extension(user_db): Extension<UserDB>,
Extension(db): Extension<DB>,
Extension(webhook): Extension<WebhookShared>,
Path((w_id, name)): Path<(String, String)>,
Json(Owner { owner, write }): Json<Owner>,
@@ -999,6 +1013,18 @@ async fn remove_owner(
tx.commit().await?;
handle_deployment_metadata(
&authed.email,
&authed.username,
&db,
&w_id,
DeployedObject::Folder { path: format!("f/{}", name) },
Some(format!("Folder '{}' changed permissions", name)),
true,
None,
)
.await?;
webhook.send_message(
w_id.clone(),
WebhookMessage::UpdateFolder { workspace: w_id, name: name.clone() },
backend/windmill-api-scripts/src/scripts.rs
+34 -1
View File
@@ -2827,6 +2827,7 @@ async fn toggle_workspace_error_handler(
async fn toggle_workspace_error_handler(
authed: ApiAuthed,
Extension(user_db): Extension<UserDB>,
Extension(db): Extension<DB>,
Path((w_id, path)): Path<(String, StripPath)>,
Json(req): Json<ToggleWorkspaceErrorHandler>,
) -> Result<String> {
@@ -2842,7 +2843,7 @@ async fn toggle_workspace_error_handler(
match error_handler_maybe {
Some(_) => {
sqlx::query_scalar!(
let updated = sqlx::query_scalar!(
"UPDATE script
SET ws_error_handler_muted = $3
WHERE ctid = (
@@ -2859,6 +2860,38 @@ async fn toggle_workspace_error_handler(
.execute(&mut *tx)
.await?;
tx.commit().await?;
// `ws_error_handler_muted` is part of the synced script metadata, so
// the toggle is a deploy like any other edit of it. The hash is a
// placeholder: git sync keys off the path and kind alone. The update
// runs under RLS against an unchecked path, so it can match nothing —
// deploy only what it actually wrote.
if updated.rows_affected() > 0 {
handle_deployment_metadata(
&authed.email,
&authed.username,
&db,
&w_id,
DeployedObject::Script {
hash: ScriptHash(0),
path: path.to_path().to_string(),
parent_path: None,
},
Some(format!(
"Script '{}' {} the workspace error handler",
path.to_path(),
if req.muted.unwrap_or(false) {
"muted"
} else {
"unmuted"
}
)),
true,
None,
)
.await?;
}
Ok("".to_string())
}
None => {
backend/windmill-api/openapi.yaml
+1 -1
View File
@@ -1,7 +1,7 @@
openapi: "3.0.3"
info:
version: 1.788.0
version: 1.789.0
title: Windmill API
contact:
backend/windmill-common/src/workspaces.rs
+2 -2
View File
@@ -175,7 +175,7 @@ pub enum ObjectType {
DatatableMigration,
}
pub const LATEST_GIT_SYNC_SCRIPT_PATH: &str = "hub/28871/sync-script-to-git-repo-windmill";
pub const LATEST_GIT_SYNC_SCRIPT_PATH: &str = "hub/28904/sync-script-to-git-repo-windmill";
/// Hub script that applies a repository's state back into a workspace
/// (the repo → Windmill / "pull" direction). Same script the UI runs from
@@ -183,7 +183,7 @@ pub const LATEST_GIT_SYNC_SCRIPT_PATH: &str = "hub/28871/sync-script-to-git-repo
/// ignores the slug, so the slug is kept free of characters that would be
/// percent-encoded into the run URL (a `:` becomes `%3A`, which some hardened
/// reverse proxies reject as double-encoding when the client re-encodes it).
pub const GIT_SYNC_PULL_SCRIPT_PATH: &str = "hub/28890/git-sync-init-repository-windmill";
pub const GIT_SYNC_PULL_SCRIPT_PATH: &str = "hub/28903/git-sync-init-repository-windmill";
/// Prefix used to identify fork workspaces. A workspace whose id starts with this string is a
/// fork of another workspace.
backend/windmill-store/src/resources.rs
+525 -40
View File
@@ -1140,6 +1140,19 @@ async fn create_resource(
}
let authed = maybe_refresh_folders(&resource.path, &w_id, authed, &db).await;
authorize_azure_devops_reference(
&authed,
&db,
&user_db,
&w_id,
resource
.value
.as_deref()
.and_then(|v| serde_json::from_str::<serde_json::Value>(v.get()).ok())
.as_ref(),
)
.await?;
let mut tx = user_db.begin(&authed).await?;
let update_if_exists = q.update_if_exists.unwrap_or(false);
@@ -1821,6 +1834,18 @@ async fn update_resource(
sqlb.returning("path");
let authed = maybe_refresh_folders(path, &w_id, authed, &db).await;
authorize_azure_devops_reference(
&authed,
&db,
&user_db,
&w_id,
ns.value
.as_deref()
.and_then(|v| serde_json::from_str::<serde_json::Value>(v.get()).ok())
.as_ref(),
)
.await?;
let mut tx = user_db.begin(&authed).await?;
if let Some(npath) = ns.path.clone() {
@@ -2098,6 +2123,8 @@ async fn set_resource_value(
{
return Err(Error::PermissionDenied(msg));
}
authorize_azure_devops_reference(authed, db, user_db, w_id, value.as_ref()).await?;
let mut tx = user_db.clone().begin(authed).await?;
// `RETURNING resource_type` rather than a second lookup: the advisory below has to know the
@@ -2954,6 +2981,50 @@ fn extract_host_from_git_url(url: &str) -> Option<String> {
None
}
/// Strip the userinfo from a git URL. These probes run against URLs that embed a
/// credential (a `$var:` token, or one minted from an `AZURE_DEVOPS_TOKEN(...)`
/// placeholder), and their errors are persisted as the repository's sync status and
/// rendered in the UI. git's own redaction cannot be relied on — it drops the userinfo
/// from `unable to access '<url>'` but echoes it in `could not read Password for
/// '<url>'` — so anything that formats a probe URL has to strip it here.
fn redact_git_url_credentials(url: &str) -> String {
match git_url_userinfo_range(url) {
Some(r) => format!("{}***{}", &url[..r.start], &url[r.end..]),
None => url.to_string(),
}
}
/// Byte range of a git URL's userinfo (the credentials before the authority's '@'),
/// for both `scheme://user[:pass]@host/path` and SCP-style `user@host:path`.
///
/// The authority ends at the first '/', '?' or '#' and the credentials are the *last*
/// '@' within it, so an '@' planted in the path cannot mis-scope the split
/// (GHSA-p5cj-8cfh-mjv6).
fn git_url_userinfo_range(url: &str) -> Option<std::ops::Range<usize>> {
let (authority_start, authority) = match url.find("://") {
Some(scheme_sep) => {
let start = scheme_sep + 3;
let after = &url[start..];
let end = after
.find(|c| c == '/' || c == '?' || c == '#')
.unwrap_or(after.len());
(start, &after[..end])
}
// SCP-style `[user@]host:path` has no scheme, and its authority is bounded by
// the first ':' — never by the last '@', which an '@' in the path would move
// (the same mis-scoping `extract_host_from_git_url` guards against). scp syntax
// has no password field, so bounding this way cannot cut a credential in half.
None if url.contains('@') => (0, url.split(':').next().unwrap_or(url)),
None => return None,
};
let at = authority.rfind('@')?;
(at > 0).then(|| authority_start..authority_start + at)
}
fn git_url_userinfo(url: &str) -> Option<&str> {
git_url_userinfo_range(url).map(|r| &url[r])
}
/// Validates a git URL to prevent option injection, SSRF, and local file read.
async fn validate_git_url(url: &str) -> Result<()> {
let url = url.trim();
@@ -2979,6 +3050,14 @@ async fn validate_git_url(url: &str) -> Result<()> {
"Git URL cannot contain '?' or '#' characters".to_string(),
));
}
// Every probe URL is validated, so this catches a caller that reached git without
// expanding the placeholder — which git would otherwise report as an unresolvable
// host, the placeholder's own '/' having truncated the authority.
if url.contains(AZURE_DEVOPS_TOKEN_PLACEHOLDER) {
return Err(Error::BadRequest(
"Git URL still contains an unexpanded AZURE_DEVOPS_TOKEN(...) placeholder".to_string(),
));
}
let lower = url.to_lowercase();
@@ -3112,12 +3191,14 @@ async fn get_git_commit_hash(
.await
.map_err(|e| Error::NotFound(format!("Access to resource {} denied: ({e})", path)))?;
let git_resource: GitRepositoryResource = match git_repo_resource_value {
let mut git_resource: GitRepositoryResource = match git_repo_resource_value {
Some(value) => serde_json::from_value(value).map_err(|e| {
Error::BadRequest(format!("Invalid git repository resource format: {}", e))
})?,
None => return Err(Error::NotFound(format!("Resource {} not found", path)).into()),
};
git_resource.url =
resolve_azure_devops_url(&db_with_opt_authed, &w_id, &git_resource.url, false).await?;
let identities: Vec<String> = query
.git_ssh_identity
@@ -3259,9 +3340,21 @@ fn is_refused_redirect(stderr: &str) -> bool {
/// Decode a failed probe's stderr, naming the remedy when the remote redirected
/// somewhere the `.git` retry could not reach (an `http://` URL upgraded to https,
/// say) — `git_probe_command` refuses redirects, so nothing else explains the status.
fn git_probe_stderr(stderr: Vec<u8>) -> String {
///
/// `probe_url` is the URL the probe ran against, and its userinfo is scrubbed from the
/// output: git strips credentials from some messages but not all — a token in the
/// username position comes back verbatim in `could not read Password for
/// 'https://<token>@host'` — and these strings are persisted as a repository's sync
/// status and rendered in the UI.
fn git_probe_stderr(stderr: Vec<u8>, probe_url: &str) -> String {
let stderr =
String::from_utf8(stderr).unwrap_or_else(|_| "Failed to decode stderr".to_string());
// Scrub the `<userinfo>@` form git prints, not the bare userinfo: a one-character
// username would otherwise be replaced everywhere it happens to occur.
let stderr = match git_url_userinfo(probe_url) {
Some(userinfo) => stderr.replace(&format!("{userinfo}@"), "***@"),
None => stderr,
};
if is_refused_redirect(&stderr) {
format!(
"{} (the remote redirects, and redirects are not followed; set the repository URL to the address it redirects to)",
@@ -3333,6 +3426,317 @@ async fn run_git_probe(mut git_cmd: Command, what: &str) -> Result<std::process:
}
}
/// Git-sync repository URLs may carry `AZURE_DEVOPS_TOKEN(<path/to/azure/resource>)`
/// where a credential belongs: an Azure DevOps access token minted at use time from
/// that `azure` resource's client credentials. The hub sync scripts expand it in
/// TypeScript before running git; the probes below shell out to git from the backend,
/// so they must expand it too or git is handed the literal placeholder (whose '/'
/// truncates the authority, and curl rejects the resulting hostname).
const AZURE_DEVOPS_TOKEN_PLACEHOLDER: &str = "AZURE_DEVOPS_TOKEN(";
/// Azure DevOps resource id the token is minted for, and the endpoint that mints it —
/// both identical to the hub sync scripts', so a repository that authenticates for a
/// sync job authenticates for these probes too.
const AZURE_DEVOPS_RESOURCE_ID: &str = "499b84ac-1321-427f-aa17-267ca6975798/.default";
const AZURE_LOGIN_HOST: &str = "https://login.microsoftonline.com";
/// Minted tokens, keyed by a digest of the credentials they came from — never by
/// resource path, so a cache hit cannot hand a token to a caller who was not able to
/// read the resource itself. Auto-pull probes every repository on an interval; without
/// this, every tick would mint a fresh token.
static AZURE_DEVOPS_TOKEN_CACHE: LazyLock<DashMap<String, (String, i64)>> =
LazyLock::new(DashMap::new);
/// Shaved off a token's advertised lifetime so one is never handed out as it expires.
const AZURE_TOKEN_EXPIRY_MARGIN_S: i64 = 60;
/// Lifetime assumed when the token response omits `expires_in`.
const AZURE_TOKEN_FALLBACK_LIFETIME_S: i64 = 300;
/// Whether the span `start..end` of `url` is the userinfo of an https authority.
/// The placeholder contains '/', which truncates the authority for any left-to-right
/// parse, so terminators falling inside the span are skipped rather than honored.
///
/// https only: over plaintext an on-path attacker answers the probe's first request
/// with a Basic challenge, and git retries carrying the minted token.
fn span_is_https_userinfo(url: &str, start: usize, end: usize) -> bool {
let Some(scheme_sep) = url.find("://") else {
return false;
};
if !url[..scheme_sep].eq_ignore_ascii_case("https") {
return false;
}
let body_start = scheme_sep + 3;
if start < body_start {
return false;
}
let authority_end = url[body_start..]
.char_indices()
.map(|(i, c)| (body_start + i, c))
.find(|&(i, c)| (i < start || i >= end) && (c == '/' || c == '?' || c == '#'))
.map_or(url.len(), |(i, _)| i);
// Taking the authority's *last* '@' is what makes one inside the span harmless:
// such a match sits before `end` and fails the comparison.
url[body_start..authority_end]
.rfind('@')
.is_some_and(|rel| end <= body_start + rel)
}
/// Locate the placeholder in a git URL, returning `(whole placeholder, resource path)`.
fn parse_azure_devops_placeholder(url: &str) -> Result<Option<(&str, &str)>> {
let Some(start) = url.find(AZURE_DEVOPS_TOKEN_PLACEHOLDER) else {
return Ok(None);
};
let after = &url[start + AZURE_DEVOPS_TOKEN_PLACEHOLDER.len()..];
// Greedy to the last ')', matching the hub scripts' `AZURE_DEVOPS_TOKEN\((.+)\)`.
let end = after.rfind(')').ok_or_else(|| {
Error::BadRequest(
"Git repository URL has an unterminated AZURE_DEVOPS_TOKEN(...) placeholder"
.to_string(),
)
})?;
let end = start + AZURE_DEVOPS_TOKEN_PLACEHOLDER.len() + end + 1;
// Anywhere but the userinfo, the minted token would be spliced into a part of the
// URL that git echoes verbatim in its failure messages (which are persisted as the
// repository's sync status) and that credential redaction does not cover.
if !span_is_https_userinfo(url, start, end) {
return Err(Error::BadRequest(
"The AZURE_DEVOPS_TOKEN(...) placeholder must be the credentials of an https git URL, i.e. directly before the '@'".to_string(),
));
}
Ok(Some((
&url[start..end],
&after[..end - start - AZURE_DEVOPS_TOKEN_PLACEHOLDER.len() - 1],
)))
}
/// Hosts an Azure DevOps token may be sent to. The minted token is an AAD token for
/// the Azure DevOps resource id, so Microsoft is the only party it is meaningful to.
fn is_azure_devops_host(host: &str) -> bool {
let host = host.trim_end_matches('.');
host == "dev.azure.com"
|| host.ends_with(".dev.azure.com")
|| host == "visualstudio.com"
|| host.ends_with(".visualstudio.com")
}
/// Expand an `AZURE_DEVOPS_TOKEN(...)` placeholder in a git URL, or return the URL
/// unchanged when it has none. The referenced resource is read through `dba`, so an
/// authed caller only reaches credentials they can already read.
async fn resolve_azure_devops_url(
dba: &DbWithOptAuthed<'_, ApiAuthed>,
w_id: &str,
url: &str,
allow_cache: bool,
) -> Result<String> {
// Trim first: the http(s) gates the callers apply trim too, so a stored URL with
// leading whitespace must not reach the scheme check here as a non-http one.
let url = url.trim();
let Some((placeholder, resource_path)) = parse_azure_devops_placeholder(url)? else {
return Ok(url.to_string());
};
// Vet the destination before minting: a URL the host checks would reject must not
// cost a live credential (nor cache one), and whoever can edit the URL would
// otherwise drive a token mint per poll tick.
let probe_url = url.replace(placeholder, "windmill");
validate_git_url(&probe_url).await?;
// The background poller reads the referenced resource under the system identity,
// which bypasses RLS. Confining the destination is what keeps that from becoming an
// exfiltration primitive: whoever can write this URL picks both the resource path
// and the host, so an unconfined splice would hand a credential they cannot read to
// a host they choose. Unlike `$var:`, which substitutes a whole value and so cannot
// place a secret inside a caller-chosen URL, this placeholder is a substring.
let host = extract_host_from_git_url(&probe_url)
.ok_or_else(|| Error::BadRequest("Could not parse hostname from git URL".to_string()))?;
if !is_azure_devops_host(&host) {
return Err(Error::BadRequest(format!(
"An AZURE_DEVOPS_TOKEN(...) placeholder is only allowed on an Azure DevOps URL (dev.azure.com or visualstudio.com), not '{host}'"
)));
}
let value =
get_resource_value_interpolated_internal(dba, w_id, resource_path, None, None, allow_cache)
.await
.map_err(|e| {
Error::BadRequest(format!(
"Azure resource '{resource_path}' referenced by the git repository URL could not be read: {e}"
))
})?
.ok_or_else(|| {
Error::NotFound(format!(
"Azure resource '{resource_path}' referenced by the git repository URL was not found"
))
})?;
let field = |name: &str| -> Result<String> {
value
.get(name)
.and_then(|v| v.as_str())
.filter(|s| !s.is_empty())
.map(|s| s.to_string())
.ok_or_else(|| {
Error::BadRequest(format!(
"Azure resource '{resource_path}' referenced by the git repository URL has no '{name}'"
))
})
};
let token = mint_azure_devops_token(
&field("azureTenantId")?,
&field("azureClientId")?,
&field("azureClientSecret")?,
allow_cache,
)
.await?;
Ok(url.replace(placeholder, &token))
}
/// Gate writing an `AZURE_DEVOPS_TOKEN(...)` reference into a resource value.
///
/// The background probes mint from the named `azure` resource under the system identity,
/// which bypasses RLS, and no principal exists at that point to authorize against — so
/// authorization cannot be enforced where the credential is used, only where the
/// reference is introduced. A read check alone would not survive that gap: the reference
/// names a resource whose own value stays mutable, and repointing it at `$res:`/`$var:`
/// the writer cannot read would be a later write this never sees.
///
/// Hence workspace admin, who can already read every resource in the workspace: the
/// escalation a mutable reference would otherwise buy is one the configurer already has.
/// The read check stays as a typo guard, so a reference to a nonexistent resource fails
/// at configuration time rather than as a puzzling sync error later.
///
/// Only the `url` field is inspected, and with the same parser the probes use, so the
/// path checked here is exactly the path they will resolve.
pub async fn authorize_azure_devops_reference(
authed: &ApiAuthed,
db: &DB,
user_db: &UserDB,
w_id: &str,
value: Option<&serde_json::Value>,
) -> Result<()> {
let Some(url) = value.and_then(|v| v.get("url")).and_then(|u| u.as_str()) else {
return Ok(());
};
let Some((_, resource_path)) = parse_azure_devops_placeholder(url.trim())? else {
return Ok(());
};
if !authed.is_admin {
return Err(Error::PermissionDenied(format!(
"Only a workspace admin can point a git repository URL at AZURE_DEVOPS_TOKEN({resource_path}): background sync mints that credential under an identity that bypasses resource permissions"
)));
}
let dba = DbWithOptAuthed::from_authed(authed, db.clone(), Some(user_db.clone()));
let readable =
get_resource_value_interpolated_internal(&dba, w_id, resource_path, None, None, false)
.await
.unwrap_or(None);
if readable.is_none() {
return Err(Error::PermissionDenied(format!(
"Cannot reference AZURE_DEVOPS_TOKEN({resource_path}) in a git repository URL: no such resource"
)));
}
Ok(())
}
/// `allow_cache` carries the caller's freshness requirement through to the token, not
/// just to the resource read: an on-demand check must not succeed on a token minted
/// before the Azure app's permissions were last changed.
async fn mint_azure_devops_token(
tenant_id: &str,
client_id: &str,
client_secret: &str,
allow_cache: bool,
) -> Result<String> {
use sha2::{Digest, Sha256};
let mut hasher = Sha256::new();
for part in [tenant_id, client_id, client_secret] {
hasher.update(part.as_bytes());
hasher.update([0u8]);
}
let cache_key = hex::encode(hasher.finalize());
let now = chrono::Utc::now().timestamp();
// Entries are only ever replaced by a later mint for the same credentials, so a
// rotated secret's entry would otherwise sit here for the process's lifetime.
AZURE_DEVOPS_TOKEN_CACHE.retain(|_, (_, expires_at)| *expires_at > now);
if allow_cache {
let cached = AZURE_DEVOPS_TOKEN_CACHE
.get(&cache_key)
.map(|e| e.value().0.clone());
if let Some(token) = cached {
return Ok(token);
}
}
let response = windmill_common::utils::HTTP_CLIENT
.post(format!("{AZURE_LOGIN_HOST}/{tenant_id}/oauth2/token"))
.form(&[
("client_id", client_id),
("client_secret", client_secret),
("grant_type", "client_credentials"),
("resource", AZURE_DEVOPS_RESOURCE_ID),
])
.send()
.await
.map_err(|e| {
Error::BadRequest(format!("Failed to request an Azure DevOps token: {e:#}"))
})?;
let status = response.status();
let body = response.text().await.unwrap_or_default();
if !status.is_success() {
return Err(Error::BadRequest(format!(
"Azure DevOps token request failed ({status}): {}",
windmill_common::utils::truncate_with_ellipsis(&body, 500)
)));
}
#[derive(Deserialize)]
struct AzureTokenResponse {
access_token: String,
expires_in: Option<Value>,
}
let parsed: AzureTokenResponse = serde_json::from_str(&body)
.map_err(|e| Error::BadRequest(format!("Unexpected Azure DevOps token response: {e}")))?;
// The v1 token endpoint returns `expires_in` as a string, the v2 one as a number.
let lifetime = parsed
.expires_in
.as_ref()
.and_then(|v| {
v.as_i64()
.or_else(|| v.as_str().and_then(|s| s.parse::<i64>().ok()))
})
.unwrap_or(AZURE_TOKEN_FALLBACK_LIFETIME_S);
AZURE_DEVOPS_TOKEN_CACHE.insert(
cache_key,
(
parsed.access_token.clone(),
now + (lifetime - AZURE_TOKEN_EXPIRY_MARGIN_S).max(0),
),
);
Ok(parsed.access_token)
}
/// System identity used by background git-sync polling. SECURITY: bypasses resource
/// RLS — see [`resolve_git_repository_resource`] for the caller obligations.
fn git_sync_system_dba(db: &DB) -> DbWithOptAuthed<'static, ApiAuthed> {
DbWithOptAuthed::DB {
db: db.clone(),
audit_author: windmill_common::audit::AuditAuthor {
username: "git_sync_auto_pull".to_string(),
email: windmill_common::users::SUPERADMIN_SYNC_EMAIL.to_string(),
username_override: None,
token_prefix: None,
},
}
}
async fn get_repo_latest_commit_hash(
git_resource: &GitRepositoryResource,
git_ssh_command: Option<String>,
@@ -3363,7 +3767,7 @@ async fn get_repo_latest_commit_hash(
.await?;
if !output.status.success() {
let stderr = git_probe_stderr(output.stderr);
let stderr = git_probe_stderr(output.stderr, &git_resource.url);
return Err(Error::BadRequest(format!(
"Error getting git repo commit hash: {}",
stderr
@@ -3378,7 +3782,8 @@ async fn get_repo_latest_commit_hash(
if lines.is_empty() {
return Err(Error::BadRequest(format!(
"No commits found for reference '{}' in repository '{}'",
ref_spec, git_resource.url
ref_spec,
redact_git_url_credentials(&git_resource.url)
)));
}
@@ -3399,7 +3804,9 @@ async fn get_repo_latest_commit_hash(
///
/// SECURITY: reads under the system identity (`SUPERADMIN_SYNC_EMAIL`), so it
/// **bypasses resource RLS** and returns fully-interpolated JSON that **may
/// contain credentials** (an embedded `$var:` token in the URL). Callers must
/// contain credentials** — an embedded `$var:` token in the URL, or the `azure`
/// resource named by an `AZURE_DEVOPS_TOKEN(...)` placeholder. Both name a path
/// chosen by whoever can write the repository URL, not by the reader. Callers must
/// have already authorized access to `w_id`, must use it only for git-sync
/// `git_repository` resources, and must **not** return the resolved value to a
/// client — derive and return only non-sensitive facts. Pass `allow_cache=true`
@@ -3411,24 +3818,19 @@ pub async fn resolve_git_repository_resource(
git_repo_resource_path: &str,
allow_cache: bool,
) -> Result<Option<serde_json::Value>> {
use windmill_common::db::DbWithOptAuthed;
let resource_path = git_repo_resource_path
.strip_prefix("$res:")
.unwrap_or(git_repo_resource_path);
let dba: DbWithOptAuthed<'_, ApiAuthed> = DbWithOptAuthed::DB {
db: db.clone(),
audit_author: windmill_common::audit::AuditAuthor {
username: "git_sync_auto_pull".to_string(),
email: windmill_common::users::SUPERADMIN_SYNC_EMAIL.to_string(),
username_override: None,
token_prefix: None,
},
};
get_resource_value_interpolated_internal(&dba, w_id, resource_path, None, None, allow_cache)
.await
get_resource_value_interpolated_internal(
&git_sync_system_dba(db),
w_id,
resource_path,
None,
None,
allow_cache,
)
.await
}
/// Resolve a workspace git-sync repository and return its current head commit
@@ -3459,19 +3861,22 @@ pub async fn get_git_repo_head_for_autopull(
return Ok(None);
}
let git_resource: GitRepositoryResource = serde_json::from_value(value)
let mut git_resource: GitRepositoryResource = serde_json::from_value(value)
.map_err(|e| Error::BadRequest(format!("Invalid git repository resource: {}", e)))?;
// The SSH identity is supplied per-call in the authed commit-hash path; the
// background poller has none, so an SSH remote can't authenticate here. Fail
// with an actionable message instead of a confusing ls-remote auth error —
// these repos should use an HTTPS token URL or the GitHub App for auto-pull.
let url = git_resource.url.trim_start();
if !url.starts_with("http://") && !url.starts_with("https://") {
if !git_resource.url.trim_start().starts_with("http://")
&& !git_resource.url.trim_start().starts_with("https://")
{
return Err(Error::BadRequest(
"Automatic pull can't authenticate an SSH git remote in the background. Use an HTTPS URL with an embedded token, or connect the repository through the GitHub App.".to_string(),
));
}
git_resource.url =
resolve_azure_devops_url(&git_sync_system_dba(db), w_id, &git_resource.url, true).await?;
if let Some(branch) = git_resource.branch.as_deref().filter(|s| !s.is_empty()) {
let branch = branch.to_string();
@@ -3491,7 +3896,7 @@ pub async fn get_git_repo_head_for_autopull(
})
.await?;
if !output.status.success() {
let stderr = git_probe_stderr(output.stderr);
let stderr = git_probe_stderr(output.stderr, &git_resource.url);
return Err(Error::BadRequest(format!(
"Error resolving git repo HEAD: {}",
stderr
@@ -3503,7 +3908,7 @@ pub async fn get_git_repo_head_for_autopull(
let sha = sha.ok_or_else(|| {
Error::BadRequest(format!(
"No HEAD found in repository '{}'",
git_resource.url
redact_git_url_credentials(&git_resource.url)
))
})?;
Ok(Some((branch.unwrap_or_else(|| "HEAD".to_string()), sha)))
@@ -3545,21 +3950,11 @@ pub async fn get_git_repo_fork_heads_for_autopull(
base_branch: &str,
extra_refs: &[String],
) -> Result<Option<Vec<(String, String)>>> {
use windmill_common::db::DbWithOptAuthed;
let resource_path = git_repo_resource_path
.strip_prefix("$res:")
.unwrap_or(git_repo_resource_path);
let dba: DbWithOptAuthed<'_, ApiAuthed> = DbWithOptAuthed::DB {
db: db.clone(),
audit_author: windmill_common::audit::AuditAuthor {
username: "git_sync_auto_pull".to_string(),
email: windmill_common::users::SUPERADMIN_SYNC_EMAIL.to_string(),
username_override: None,
token_prefix: None,
},
};
let dba = git_sync_system_dba(db);
let value =
get_resource_value_interpolated_internal(&dba, w_id, resource_path, None, None, true)
.await?
@@ -3578,14 +3973,16 @@ pub async fn get_git_repo_fork_heads_for_autopull(
return Ok(None);
}
let git_resource: GitRepositoryResource = serde_json::from_value(value)
let mut git_resource: GitRepositoryResource = serde_json::from_value(value)
.map_err(|e| Error::BadRequest(format!("Invalid git repository resource: {}", e)))?;
let url = git_resource.url.trim_start();
if !url.starts_with("http://") && !url.starts_with("https://") {
if !git_resource.url.trim_start().starts_with("http://")
&& !git_resource.url.trim_start().starts_with("https://")
{
return Err(Error::BadRequest(
"Automatic pull can't authenticate an SSH git remote in the background. Use an HTTPS URL with an embedded token, or connect the repository through the GitHub App.".to_string(),
));
}
git_resource.url = resolve_azure_devops_url(&dba, w_id, &git_resource.url, true).await?;
validate_git_url(&git_resource.url).await?;
validate_git_ref(base_branch)?;
@@ -3608,7 +4005,7 @@ pub async fn get_git_repo_fork_heads_for_autopull(
})
.await?;
if !output.status.success() {
let stderr = git_probe_stderr(output.stderr);
let stderr = git_probe_stderr(output.stderr, &git_resource.url);
return Err(Error::BadRequest(format!(
"Error listing fork branches: {}",
stderr
@@ -4081,7 +4478,7 @@ mod tests {
target_requests.lock().unwrap().is_empty(),
"git followed the redirect to the unvalidated target"
);
let stderr = git_probe_stderr(output.stderr);
let stderr = git_probe_stderr(output.stderr, "");
assert!(
stderr.contains("301") && stderr.contains("redirects are not followed"),
"the failure should name the refused redirect and its remedy, got: {stderr}"
@@ -4169,6 +4566,94 @@ mod tests {
assert!(validate_git_url("--upload-pack=evil").await.is_err());
}
#[test]
fn test_parse_azure_devops_placeholder() {
// The resource path holds '/', so the placeholder must be cut at its own
// closing ')' rather than at the first path separator.
let url = "https://AZURE_DEVOPS_TOKEN(f/azure/devops)@dev.azure.com/org/proj/_git/repo";
assert_eq!(
parse_azure_devops_placeholder(url).unwrap(),
Some(("AZURE_DEVOPS_TOKEN(f/azure/devops)", "f/azure/devops"))
);
assert_eq!(
parse_azure_devops_placeholder("https://token@github.com/user/repo.git").unwrap(),
None
);
assert!(parse_azure_devops_placeholder(
"https://AZURE_DEVOPS_TOKEN(f/azure@dev.azure.com/o"
)
.is_err());
// Outside the userinfo the minted token would land in a URL component that git
// echoes back in its errors and redaction does not cover.
assert!(parse_azure_devops_placeholder(
"https://dev.azure.com/org/AZURE_DEVOPS_TOKEN(f/azure)/repo"
)
.is_err());
assert!(parse_azure_devops_placeholder(
"ssh://AZURE_DEVOPS_TOKEN(f/azure)@dev.azure.com/o"
)
.is_err());
// Plaintext would let an on-path Basic challenge harvest the minted token.
assert!(parse_azure_devops_placeholder(
"http://AZURE_DEVOPS_TOKEN(f/azure)@dev.azure.com/o"
)
.is_err());
// A `user:token` userinfo is still the credentials position.
assert_eq!(
parse_azure_devops_placeholder("https://u:AZURE_DEVOPS_TOKEN(f/azure)@dev.azure.com/o")
.unwrap(),
Some(("AZURE_DEVOPS_TOKEN(f/azure)", "f/azure"))
);
}
#[test]
fn test_is_azure_devops_host() {
assert!(is_azure_devops_host("dev.azure.com"));
assert!(is_azure_devops_host("vssps.dev.azure.com"));
assert!(is_azure_devops_host("myorg.visualstudio.com"));
// The whole point: a token must never be splice-able onto a chosen host.
assert!(!is_azure_devops_host("attacker.example"));
assert!(!is_azure_devops_host("dev.azure.com.attacker.example"));
assert!(!is_azure_devops_host("notvisualstudio.com"));
assert!(!is_azure_devops_host("github.com"));
}
#[test]
fn test_redact_git_url_credentials() {
assert_eq!(
redact_git_url_credentials("https://tok@dev.azure.com/o/p"),
"https://***@dev.azure.com/o/p"
);
assert_eq!(
redact_git_url_credentials("https://user:tok@github.com/u/r.git"),
"https://***@github.com/u/r.git"
);
// SCP-style `[user@]host:path` carries its credential in the user position.
assert_eq!(
redact_git_url_credentials("tok@github.com:u/r.git"),
"***@github.com:u/r.git"
);
// A '@' in the path must not be mistaken for the credentials separator.
assert_eq!(
redact_git_url_credentials("https://github.com/u/r@v1.git"),
"https://github.com/u/r@v1.git"
);
// A userinfo that also occurs in the scheme must not be redacted there.
assert_eq!(
redact_git_url_credentials("https://s@https.com/r"),
"https://***@https.com/r"
);
}
#[test]
fn test_git_probe_stderr_scrubs_the_probe_url_credentials() {
// git echoes a username-position token verbatim in this message, and the result
// is persisted as the repository's sync status.
let stderr = b"fatal: could not read Password for 'https://SECRET@dev.azure.com'".to_vec();
let out = git_probe_stderr(stderr, "https://SECRET@dev.azure.com/o/p");
assert!(!out.contains("SECRET"), "token survived redaction: {out}");
}
#[tokio::test]
async fn test_validate_git_url_blocks_fragment_query_ssrf() {
// GHSA-p5cj-8cfh-mjv6: a loopback authority must stay blocked, and the
backend/windmill-worker/src/result_processor.rs
+39 -9
View File
@@ -884,6 +884,14 @@ fn parse_pr_check_error(result_raw: &str) -> Option<String> {
})
}
/// The run page for `job_id`, or `None` when the instance has no `BASE_URL` set
/// (it defaults to empty) — a check must not carry a link that goes nowhere.
#[cfg(all(feature = "enterprise", feature = "private"))]
fn job_run_url(base_url: &str, job_id: &uuid::Uuid, workspace_id: &str) -> Option<String> {
let base = base_url.trim_end_matches('/');
(!base.is_empty()).then(|| format!("{base}/run/{job_id}?workspace={workspace_id}"))
}
#[cfg(all(feature = "enterprise", feature = "private"))]
fn format_change_list(changes: &[(String, String)]) -> Vec<String> {
let mut lines = Vec::new();
@@ -898,7 +906,19 @@ fn format_change_list(changes: &[(String, String)]) -> Vec<String> {
#[cfg(all(test, feature = "enterprise", feature = "private"))]
mod git_sync_check_tests {
use super::{format_change_list, parse_git_sync_changes, parse_pr_check_error};
use super::{format_change_list, job_run_url, parse_git_sync_changes, parse_pr_check_error};
#[test]
fn job_run_url_is_none_without_a_base_url() {
let id = uuid::Uuid::nil();
assert_eq!(
job_run_url("https://app.windmill.dev/", &id, "w").as_deref(),
Some("https://app.windmill.dev/run/00000000-0000-0000-0000-000000000000?workspace=w")
);
// BASE_URL defaults to empty; a link built from it would 404 the reader.
assert_eq!(job_run_url("", &id, "w"), None);
assert_eq!(job_run_url("/", &id, "w"), None);
}
#[test]
fn pr_check_error_is_a_field_not_a_substring() {
@@ -1376,6 +1396,10 @@ async fn maybe_post_git_sync_check(
} else {
None
};
// The creating call could only link the check to the workspace's run list —
// the check predates the job fulfilling it. Now that the job is known, point
// both the summary and the check's "Details" link at its logs.
let job_url = job_run_url(&windmill_common::BASE_URL.load(), job_id, workspace_id);
let (conclusion, title, summary): (&str, String, String) = if is_deploy {
// Phase 6: real deploy pull -> "Deployed N changes" / "In sync" / failure.
@@ -1383,8 +1407,7 @@ async fn maybe_post_git_sync_check(
(
"failure",
format!("Deploy to {} failed", workspace_id),
"Deploying the latest commit failed. See the job in Windmill for details."
.to_string(),
"Deploying the latest commit failed.".to_string(),
)
} else {
match parse_git_sync_changes(result_raw) {
@@ -1447,15 +1470,13 @@ async fn maybe_post_git_sync_check(
(
"failure",
"Windmill diff failed".to_string(),
"The dry-run pull reported an unrecognized error. See the job in Windmill for details."
.to_string(),
"The dry-run pull reported an unrecognized error.".to_string(),
)
} else if !success {
(
"failure",
"Windmill diff failed".to_string(),
"The dry-run pull to compute the diff failed. See the job in Windmill for details."
.to_string(),
"The dry-run pull to compute the diff failed.".to_string(),
)
} else {
match parse_git_sync_changes(result_raw) {
@@ -1495,6 +1516,10 @@ async fn maybe_post_git_sync_check(
}
};
let check_summary = match job_url.as_deref() {
Some(url) => format!("{summary}\n\n[See the job in Windmill]({url})"),
None => summary.clone(),
};
if let Err(e) = windmill_common::git_sync_ee::update_check_run(
db,
workspace_id,
@@ -1502,7 +1527,8 @@ async fn maybe_post_git_sync_check(
check.check_run_id,
conclusion,
&title,
&summary,
&check_summary,
job_url.as_deref(),
)
.await
{
@@ -1520,8 +1546,12 @@ async fn maybe_post_git_sync_check(
.as_deref()
.map(|s| &s[..s.len().min(7)])
.unwrap_or("latest");
let job_row = job_url
.as_deref()
.map(|url| format!("\n| **Job** | [See the logs]({url}) |"))
.unwrap_or_default();
let body = format!(
"{marker}\n### Windmill deploy preview\n\n| | |\n|---|---|\n| **Workspace** | `{workspace_id}` |\n| **Status** | {title} |\n| **Commit** | `{head}` |\n\n<details><summary>Details</summary>\n\n{summary}\n\n</details>"
"{marker}\n### Windmill deploy preview\n\n| | |\n|---|---|\n| **Workspace** | `{workspace_id}` |\n| **Status** | {title} |\n| **Commit** | `{head}` |{job_row}\n\n<details><summary>Details</summary>\n\n{summary}\n\n</details>"
);
if let Err(e) = windmill_common::git_sync_ee::upsert_pr_comment(
db,
benchmarks/lib.ts
+1 -1
View File
@@ -2,7 +2,7 @@ import { sleep } from "https://deno.land/x/sleep@v1.2.1/mod.ts";
import * as windmill from "https://deno.land/x/windmill@v1.174.0/mod.ts";
import * as api from "https://deno.land/x/windmill@v1.174.0/windmill-api/index.ts";
export const VERSION = "v1.788.0";
export const VERSION = "v1.789.0";
export async function login(email: string, password: string): Promise<string> {
return await windmill.UserService.login({
cli/src/core/constants.ts
+1 -1
View File
@@ -10,4 +10,4 @@ export const WM_FORK_PREFIX = "wm-fork";
// (e.g. utils.ts) can read it without importing main.ts and creating a circular
// dependency (main → workspace → utils → main) that triggers a TDZ.
// Re-exported from main.ts for backwards compatibility.
export const VERSION = "1.788.0";
export const VERSION = "1.789.0";
docs/autonomous-mode.md
-83
View File
@@ -1,83 +0,0 @@
# Autonomous Mode (Bypass Permissions)
When running in bypass/auto permission mode, follow these instructions to work end-to-end without human intervention.
## Available Tools
The Nix devShell provides these tools for documentation and testing:
- **`mmdc`** (mermaid-cli): Generate diagrams from Mermaid markup. Uses Nix-provided headless Chrome via `$PUPPETEER_EXECUTABLE_PATH`.
- **`asciinema`**: Record terminal sessions as `.cast` files for demo videos.
- **`playwright`** CLI: Take screenshots of the running frontend.
### When to Use Them
- **Designing a feature**: Use `mmdc` to generate Mermaid diagrams (architecture, data flow, sequence diagrams) during the planning phase. Include them in the PR description.
- **Frontend changes**: Take screenshots with the Playwright CLI after manual testing. Attach them to the PR.
- **CLI / terminal changes**: Record a demo with `asciinema` showing the feature in action. Attach to the PR.
### Quick Reference
```bash
# Generate a diagram
echo 'graph LR; A-->B; B-->C;' | mmdc -i - -o diagram.png
# Take a screenshot of a page
playwright screenshot --browser chromium http://localhost:3000 screenshot.png
# Record a terminal demo
asciinema rec demo.cast
# ... do the demo ...
# ctrl-d to stop
```
## Always Plan First
Even in bypass mode, **enter plan mode before starting non-trivial work**. Ask all important questions upfront:
- Clarify ambiguous requirements before writing code
- Identify which files, crates, and features are affected
- Read `docs/validation.md` to know what checks you'll need to run
- Break large features into stages — commit each stage separately
## Manual Testing
After code changes compile and type-check, verify the feature works:
1. **Check backend logs** (`tmux capture-pane -t .1 -p -S -50`) — confirm no panics or errors
2. **Check frontend logs** (`tmux capture-pane -t .2 -p -S -50`) — confirm no build errors
3. **Use Playwright MCP** to test the UI flow:
- Navigate to `http://localhost:3000/user/login`
- Click "Log in without third-party"
- Login with `admin@windmill.dev` / `changeme`
- Navigate to the page affected by your change
- Verify the feature works as expected
4. **Test edge cases**: empty states, error states, permissions
### Playwright Gotchas
- Backend takes ~60s to compile on first change; check logs for `health check completed`
- Frontend rebuilds in ~5s
- `critical_alerts` 404s are expected on CE builds (EE-only endpoint) — ignore them
- VSCode worker 404s are dev-mode artifacts — ignore them
- The `<Toggle>` component hides the checkbox (`sr-only`). Click the `<label>` wrapper, not the checkbox
## End-of-Task Summary
When done, directly open or update a **draft PR** against `main` once the work and validation are complete. Do not stop at a local summary or ask a human to create the PR manually.
Then drive the PR through CI review rounds to ready, per the `pr` skill ("Review rounds"): run `.agents/skills/pr/review-round.sh` as a background task, let its completion wake you, address the findings, and repeat until every reviewer verdict is a go — then post the clean-round marker comment and `gh pr ready`. Do not end the session at an unreviewed draft or while a round is pending; waiting on the background waiter costs nothing.
In your final summary, provide:
- What was changed and why (files modified, approach taken)
- What checks passed (cargo check, npm run check, etc.)
- What was manually tested and the results
- **Screenshots** of UI changes (via `playwright screenshot`)
- **Terminal recordings** of CLI changes (via asciinema)
- Any known limitations or follow-up work needed
### Attaching images to a PR
Embed screenshots, Mermaid diagrams, and asciinema frames by uploading them to the
public `windmill-labs/agent-screenshots-internal` repo and pasting the
`raw.githubusercontent.com` URL into the PR. The upload recipe lives in the `pr`
skill (`.agents/skills/pr/SKILL.md` → "Screenshots"); reuse it for any image type.
docs/feature-telemetry.md
+92
View File
@@ -0,0 +1,92 @@
# Feature usage telemetry
`feature_usage` is the product-telemetry accumulator: day-bucketed counters that roll into the
anonymous usage-stats payload. It answers "does anyone use this, and which variant do they pick"
without any identifying data leaving the instance.
It currently carries 14 registered actions across three features (`ai_session`, `ai_chat`,
`flow_editor`). Nearly all of the product is uninstrumented, so new user-facing work is the
opportunity to change that.
## When to instrument
Raise it **in the plan**, with the concrete vocabulary written out, and let the user keep or drop
it in one line. Don't stop and ask as a standalone question.
Propose it when a new user-facing affordance leaves a real question open:
- a new panel, mode, tab, toggle, or entry point — is it discovered and used at all?
- competing UX paths, or a new default — which one wins?
- an opt-in or beta gate — what is the take rate?
- a multi-step flow — where do people stop?
Stay silent for bugfixes, refactors, internal plumbing, and anything whose useful signal would
need per-item identifiers (paths, names, prompts, code) — those cannot be logged at all, see
[Privacy rules](#privacy-rules). If the answer wouldn't change a decision, instrumenting is
overkill; say nothing.
## Designing the vocabulary
| Field | Meaning | Limits |
|---|---|---|
| `feature` | Product area: `ai_chat`, `flow_editor` | ≤50 chars |
| `kind` | The action within it: `message`, `panel_placement`. `(feature, kind)` is the allowlisted pair | ≤50 chars |
| `key` | A facet of the action — mode, tab kind, tool name, `provider:model`. Aggregation groups by `(feature, kind, key)`, so this is what splits one counter into comparable buckets | ≤100 chars, identifier-shaped, optional |
| `entity_id` | An **opaque random** id (e.g. a session id) when you need per-entity distributions rather than a flat count | ≤50 chars, identifier-shaped, optional |
| `value` | Increment, default 1 | clamped to 1…1,000,000 |
Identifier-shaped means ASCII alphanumerics plus `_ - : . /` — no spaces. Anything else is
rejected.
Supplying `entity_id` is what unlocks the distribution stats: the payload reports `entity_count`,
`total_value`, `median_value`, `p90_value`, and `inactive_3d_entity_count` per
`(feature, kind, key)`. Omit it for a plain "how many times did this happen" counter. Keep the key
vocabulary closed and small — enumerate the values in a TS union next to the call site, the way
`flowEditorTelemetry.ts` does, so the whole set is reviewable in one place.
## The recipe
Four steps. Skipping step 1 or 3 fails quietly.
**1. Register the pair** in `FEATURE_USAGE_KINDS`
(`backend/windmill-api-workspaces/src/workspaces.rs`). An unregistered `(feature, kind)` is
dropped by `valid_feature_usage_event` with a bare `continue` — no error, no log, still a 204 to
the browser. Frontend-only instrumentation records **nothing** and looks like it worked.
**2. Log from the frontend:**
```ts
import { logFeatureUsage } from '$lib/utils/featureUsage'
logFeatureUsage('flow_editor', 'panel_placement', { key: 'force_detach' })
```
Fire-and-forget. Events sum locally per `(workspace, feature, kind, key, entityId)` and flush
every 30s, on `visibilitychange` → hidden, and on `pagehide`; 50 events per request, and a failed
batch is dropped rather than retried.
**3. Update the disclosure.** `InstanceSettings.svelte` lists what a non-minimal payload contains
(two places — the copy appears twice). A new counter that isn't named there means the instance
under-discloses what it sends. This has already drifted once.
**4. Verify a row lands.** The silent-drop path means "no error" proves nothing:
```sql
SELECT feature, kind, key, entity_id, day, value FROM feature_usage ORDER BY updated_at DESC LIMIT 10;
```
## Privacy rules
Only aggregated counts ever leave the instance, and only when telemetry is enabled and minimal
mode is off. Never put a path, prompt, script body, workspace name, email, or any user identifier
into `key` or `entity_id`. Entity ids must be opaque random ids, never anything that maps back to
a user or a resource. If the signal you want can only be expressed with identifying data, it
cannot be collected — drop it.
Counters aggregate over the last 30 days; rows are pruned after 60.
## Backend-only features
Ingestion is frontend-only: `log_feature_usage` is an HTTP route the browser posts to, and there
is no Rust-side helper. A feature with no UI cannot be instrumented today without adding one.
Scope the default to user-facing work, and say so rather than implying backend coverage exists.
frontend/AGENTS.md
+85
View File
@@ -0,0 +1,85 @@
# Frontend (Svelte 5)
- **Coding patterns**: MUST use the `svelte-frontend` skill when writing Svelte code
- **Validation**: `docs/validation.md` — `npm run check:fast` (2s) for iteration, `npm run check` (50s) for final PR
- **UI components**: use Windmill's design-system components — never raw HTML elements. Start from the barrel `src/lib/components/common/index.ts` and grep `src/lib/components/`; the component you need almost certainly exists
- **Brand/design**: `frontend/brand-guidelines.md` — read the relevant section before building UI, not after; the `svelte-frontend` skill maps which section covers what
- **Backend API**: routes in `../backend/windmill-api/openapi.yaml`, generated types in `src/lib/gen/`
- **Regenerate client**: `npm run generate-backend-client` after backend API changes
## Key Frontend Patterns
### Prefer Composable State Over Two-Way Binding
```typescript
// Use resource() from runed for async data
import { resource } from 'runed'
let items = resource(() => args, (args) => SomeService.list(args))
// items.loading, items.current
// Use composables for shared reactive state
function useLoader(argsGetter: () => Args) {
let items = $state([])
let loading = $state(false)
$effect(() => { /* react to argsGetter() */ })
return { get loading() { return loading }, get items() { return items } }
}
```
Two-way binding is fine for simple form inputs. Avoid it for component-to-component state.
## Verifying Frontend Changes
After modifying frontend code, drive the running dev server with the **Playwright MCP** to verify the change in a real browser — don't claim a UI change works without exercising it.
Two MCP servers are registered in `.mcp.json`:
- `playwright` — headless Chromium, default for devboxes (no display required)
- `playwright-headed` — windowed Chromium, when a display is available
**One-time setup:** run `npx playwright install chromium` to download the browser binary (Playwright won't fetch it automatically on first use).
Typical flow:
1. Ensure backend (`cargo run`) and frontend (`REMOTE=http://localhost:8000 npm run dev`) are running
2. `mcp__playwright__browser_navigate` to the relevant page (login at `admin@windmill.dev` / `changeme`)
3. `mcp__playwright__browser_snapshot` to inspect the accessibility tree (preferred over screenshots for reading the DOM)
4. `mcp__playwright__browser_click` / `browser_fill_form` / `browser_type` to interact
5. `mcp__playwright__browser_take_screenshot` for visual confirmation
6. `mcp__playwright__browser_console_messages` / `browser_network_requests` to surface errors
Write screenshots to an absolute path under `/tmp` (the MCP servers already do; standalone
Playwright scripts must be told): moving a PNG out of the checkout afterwards needs a `mv` the
permission hooks always prompt on. Same reason to run `rm`/`mv`/`cp` as one plain command per Bash
call: those hooks defer on `&&`, `;`, redirects, quotes and `$VAR`.
**Attach the screenshots to the PR.** For any change under `frontend/`, embed screenshots of the affected UI in the PR body — the `pr` skill requires this and carries the upload recipe.
If you cannot exercise a UI change (no dev server, etc.), say so explicitly rather than claiming success.
### Traps while driving the UI
- `critical_alerts` 404s are expected on CE builds (EE-only endpoint) — ignore them.
- VSCode worker 404s are dev-mode artifacts — ignore them.
- `<Toggle>` hides its checkbox (`sr-only`). Click the `<label>` wrapper, not the checkbox.
## Banned Patterns
### `$bindable(default_value)` on optional props
Using `$bindable(default_value)` on props that can be `undefined` is **banned**. This pattern causes subtle bugs because the default value masks the `undefined` state.
**Bad:**
```svelte
let { my_prop = $bindable(default_value) }: { my_prop?: string } = $props()
```
**Correct alternatives:**
1. **Use `$derived` with nullish coalescing** — handle the potential `undefined` at the usage site:
```svelte
let { my_prop = $bindable() }: { my_prop?: string } = $props()
let effective_value = $derived(my_prop ?? default_value)
```
2. **Create a `useMyPropState()` helper** — encapsulate the undefined-handling logic in a reusable function and call it higher in the component tree, so the child component always receives a defined value.
frontend/CLAUDE.md
+1 -29
View File
@@ -1,29 +1 @@
# Frontend (Svelte 5)
- **Coding patterns**: MUST use the `svelte-frontend` skill when writing Svelte code
- **Validation**: `docs/validation.md` — `npm run check:fast` (2s) for iteration, `npm run check` (50s) for final PR
- **UI components**: use Windmill's design-system components (Button, TextInput, Select) — never raw HTML elements
- **Brand/design**: `frontend/brand-guidelines.md`
- **Backend API**: routes in `../backend/windmill-api/openapi.yaml`, generated types in `src/lib/gen/`
- **Regenerate client**: `npm run generate-backend-client` after backend API changes
## Key Frontend Patterns
### Prefer Composable State Over Two-Way Binding
```typescript
// Use resource() from runed for async data
import { resource } from 'runed'
let items = resource(() => args, (args) => SomeService.list(args))
// items.loading, items.current
// Use composables for shared reactive state
function useLoader(argsGetter: () => Args) {
let items = $state([])
let loading = $state(false)
$effect(() => { /* react to argsGetter() */ })
return { get loading() { return loading }, get items() { return items } }
}
```
Two-way binding is fine for simple form inputs. Avoid it for component-to-component state.
@AGENTS.md
frontend/package-lock.json
Generated
+2 -2
View File
@@ -1,12 +1,12 @@
{
"name": "@windmill-labs/components",
"version": "1.788.0",
"version": "1.789.0",
"lockfileVersion": 3,
"requires": true,
"packages": {
"": {
"name": "@windmill-labs/components",
"version": "1.788.0",
"version": "1.789.0",
"hasInstallScript": true,
"license": "AGPL-3.0",
"dependencies": {
frontend/package.json
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@windmill-labs/components",
"version": "1.788.0",
"version": "1.789.0",
"scripts": {
"dev": "vite dev",
"dev:ui-builder": "mv static/ui_builder static/ui_builder.dev-disabled 2>/dev/null || true ; trap 'mv static/ui_builder.dev-disabled static/ui_builder 2>/dev/null || true' EXIT ; vite dev",
frontend/src/lib/components/FlowLoopIterationPreview.svelte
+4 -2
View File
@@ -89,7 +89,7 @@
runPreview(previewArgs, undefined)
}
const { flowStateStore, pathStore, opWorkspace } =
const { flowStateStore, flowStore, pathStore, opWorkspace } =
getContext<FlowEditorContext>('FlowEditorContext')
const dispatch = createEventDispatcher()
@@ -98,7 +98,9 @@
restartedFrom: RestartedFrom | undefined
) {
progressBar?.reset()
const newFlow = { value: { modules }, summary: '' }
// The preview flow holds only the loop body, so it inherits none of the flow's settings:
// carry the tag over so the iteration lands on the worker group the flow runs on.
const newFlow = { value: { modules }, summary: '', tag: flowStore.val.tag }
jobId = await runFlowPreview(
whileLoop ? withWhileLoopIter(args) : args,
newFlow,
frontend/src/lib/components/InstanceSettings.svelte
+4 -3
View File
@@ -1144,10 +1144,11 @@
description="Configure where secrets (secret variables) are stored."
link="https://www.windmill.dev/docs/core_concepts/workspace_secret_encryption"
/>
{:else if category == 'GitHub Enterprise App'}
{:else if category == 'GitHub App'}
<SettingsPageHeader
title="GitHub Enterprise App"
description="Configure a self-managed GitHub App for GitHub Enterprise Server git sync."
title="GitHub App"
description="Configure a self-managed GitHub App for git sync on GitHub.com, GHE Cloud or GitHub Enterprise Server."
link="https://www.windmill.dev/docs/integrations/git_repository#self-managed-github-app"
/>
{:else if category == 'DB Health'}
<SettingsPageHeader
frontend/src/lib/components/JsonEditor.svelte
+8 -1
View File
@@ -2,8 +2,9 @@
import '@codingame/monaco-vscode-standalone-json-language-features'
import SimpleEditor from '$lib/components/SimpleEditor.svelte'
import { createEventDispatcher, untrack } from 'svelte'
import { createEventDispatcher, onDestroy, untrack } from 'svelte'
import { createDispatcherIfMounted } from '$lib/createDispatcherIfMounted'
import { setEditorUnparseable } from './pendingEditorFlush'
import Button from './common/button/Button.svelte'
import { twMerge } from 'tailwind-merge'
import { inputBorderClass } from './text_input/TextInput.svelte'
@@ -36,6 +37,11 @@
let loadTooBigAnyway = $state(false)
let focused = $state(false)
// Identity for this editor's entry in the unparseable registry, so a caller about to
// persist what is on screen can refuse rather than save the last value that parsed.
const unparseableKey = {}
onDestroy(() => setEditorUnparseable(unparseableKey, false))
const dispatch = createEventDispatcher()
const dispatchIfMounted = createDispatcherIfMounted(dispatch)
@@ -51,6 +57,7 @@
} catch (e) {
error = e.message
}
setEditorUnparseable(unparseableKey, error !== '')
}
$effect(() => {
code != undefined && untrack(() => parseJson())
frontend/src/lib/components/ResourceEditorDrawer.svelte
+21 -1
View File
@@ -8,6 +8,13 @@
import { userStore, workspaceStore } from '$lib/stores'
import { isOwner } from '$lib/utils'
import LocalDraftBanner from './LocalDraftBanner.svelte'
import OpenInSessionButton from './sessions/OpenInSessionButton.svelte'
import {
clearPageDrawerAnchor,
pageDrawerSessionSource,
setPageDrawerAnchor
} from './sessions/pageDrawerSession'
import { RESOURCES_PATH } from './sessions/previewPaths'
import ResourceVersionHistory from './ResourceVersionHistory.svelte'
let {
@@ -53,6 +60,7 @@
path = p
selected = effectiveWorkspace
drawer?.openDrawer?.()
setPageDrawerAnchor(RESOURCES_PATH, p)
}
export async function initNew(
@@ -67,9 +75,20 @@
}
let mode: 'edit' | 'new' = $derived(!path ? 'new' : 'edit')
// `selected`, not `effectiveWorkspace`: WsSpecificVersions re-points this drawer
// at another workspace's version, and the session must act on the one shown.
const sessionSource = $derived(
pageDrawerSessionSource(RESOURCES_PATH, path, selected ?? effectiveWorkspace)
)
</script>
<Drawer bind:this={drawer} size="50rem" {disableChatOffset}>
<Drawer
bind:this={drawer}
size="50rem"
{disableChatOffset}
on:close={() => clearPageDrawerAnchor(RESOURCES_PATH)}
>
<DrawerContent
title={mode == 'edit' ? 'Edit ' + path : 'Add a resource'}
bannerReserved={mode == 'edit'}
@@ -102,6 +121,7 @@
/>
{/snippet}
{#snippet actions()}
<OpenInSessionButton source={sessionSource} />
{#if mode == 'edit' && path && effectiveWorkspace}
<Button
variant="default"
frontend/src/lib/components/ResourceForm.svelte
+16
View File
@@ -1,6 +1,8 @@
<script lang="ts">
import type { Schema } from '$lib/common'
import type { Resource, ResourceType } from '$lib/gen'
import { onDestroy } from 'svelte'
import { setEditorUnparseable } from './pendingEditorFlush'
import { emptyString, isOwner, urlize } from '$lib/utils'
import { Alert, Skeleton } from './common'
import Path from './Path.svelte'
@@ -75,6 +77,12 @@
let rawCode: string | undefined = $state(undefined)
let textFileContent: string = $state('')
// This field is a bare SimpleEditor parsed here, so it never passes through JsonEditor —
// it has to register itself, or a caller persisting what is on screen would save the
// last value that parsed and leave without the text in front of the user.
const unparseableKey = {}
onDestroy(() => setEditorUnparseable(unparseableKey, false))
function parseJson() {
try {
args = JSON.parse(rawCode ?? '')
@@ -101,6 +109,14 @@
if (rawCode !== undefined) parseJson()
})
// Both halves, and from the current parse rather than from a transition: `rawCode`
// outlives the raw editor, so text that does not parse is the user's to fix exactly
// while that editor is the active input — which the schema loading and the resource
// type flip as well as the toggle, and only the toggle reseeds `rawCode`.
$effect(() => {
setEditorUnparseable(unparseableKey, usesRawEditor && jsonError !== '')
})
$effect(() => {
if (usesRawEditor && rawCode === undefined) {
rawCode = JSON.stringify(args, null, 2)
frontend/src/lib/components/RunsPage.svelte
+13
View File
@@ -43,6 +43,8 @@
import Toggle from '$lib/components/Toggle.svelte'
import ConfirmationModal from '$lib/components/common/confirmationModal/ConfirmationModal.svelte'
import RunsQueue from '$lib/components/runs/RunsQueue.svelte'
import OpenInSessionButton from '$lib/components/sessions/OpenInSessionButton.svelte'
import { pageHref, RUNS_PATH } from '$lib/components/sessions/previewPaths'
import { twMerge } from 'tailwind-merge'
import { computeJobKinds, useJobsLoader } from '$lib/components/runs/useJobsLoader.svelte'
import ConcurrentJobsChart from '$lib/components/ConcurrentJobsChart.svelte'
@@ -845,6 +847,17 @@
placeholder="Filter runs..."
autofocus
/>
<!-- The filters are shallow-routed, so the search has to come off
`window.location` at click time — `page.url` never sees them. Always the
canonical `/runs`: only that is a recognized preview page, and the
`/runs/<path>` route mirrors its path into `?path=` anyway. -->
<OpenInSessionButton
source={{
page: () => pageHref(RUNS_PATH) + window.location.search,
workspaceId: $workspaceStore ?? undefined
}}
btnProps={{ unifiedSize: 'md' }}
/>
</div>
<!-- Graph -->
frontend/src/lib/components/SimpleEditor.svelte
+15
View File
@@ -11,6 +11,7 @@
</script>
<script lang="ts">
import { registerPendingEditor } from './pendingEditorFlush'
import { BROWSER } from 'esm-env'
import { editorConfig, updateOptions } from '$lib/editorUtils'
@@ -149,6 +150,18 @@
const uri = `file:///${untrack(() => hash)}.${langToExt(untrack(() => lang))}`
/** Materialise the debounced buffer into `code` now. A consumer that must act on
* what is on screen — persisting a draft before navigating away — cannot wait out
* CHANGE_TIMEOUT. Mirrors `Editor.flushPendingChanges`. */
export function flushPendingChanges(): void {
// Same guards as onDestroy: only a pending keystroke debounce is ours to flush.
// `getCode()` is '' until Monaco finishes initialising, and a caller draining every
// mounted editor reaches ones that have not — flushing those writes the blank out.
if (!editor || changeTimeoutId === undefined) return
cancelPendingChanges()
updateCode()
}
export function getCode(): string {
if (valueAfterDispose != undefined) {
return valueAfterDispose
@@ -650,6 +663,8 @@
}
})
onMount(() => registerPendingEditor({ flushPendingChanges: () => flushPendingChanges() }))
onDestroy(() => {
try {
// Same guards as Editor: only a pending keystroke debounce is ours to flush.
frontend/src/lib/components/VariableEditor.svelte
+16 -1
View File
@@ -5,6 +5,13 @@
import { Button } from './common'
import Drawer from './common/drawer/Drawer.svelte'
import DrawerContent from './common/drawer/DrawerContent.svelte'
import OpenInSessionButton from './sessions/OpenInSessionButton.svelte'
import {
clearPageDrawerAnchor,
pageDrawerSessionSource,
setPageDrawerAnchor
} from './sessions/pageDrawerSession'
import { VARIABLES_PATH } from './sessions/previewPaths'
import Alert from './common/alert/Alert.svelte'
import { sendUserToast } from '$lib/toast'
import { canWrite } from '$lib/utils'
@@ -92,6 +99,12 @@
const MAX_VARIABLE_LENGTH = 10000
const edit = $derived(editPath !== undefined)
const initialPath = $derived(editPath ?? '')
// `selected`, not `curWs`: WsSpecificVersions re-points this drawer at another
// workspace's version of the variable, and the session must act on the one the
// user is looking at.
const sessionSource = $derived(
pageDrawerSessionSource(VARIABLES_PATH, editPath, selected ?? curWs)
)
const current = $derived(selected ? states[selected]?.draft : undefined)
const can_write = $derived.by(() => {
if (!selected || !edit) return true
@@ -221,6 +234,7 @@
editPath = edit_path
selected = curWs!
drawer?.openDrawer()
setPageDrawerAnchor(VARIABLES_PATH, edit_path)
}
async function loadSecret(): Promise<void> {
@@ -293,7 +307,7 @@
}
</script>
<Drawer bind:this={drawer} size="50rem">
<Drawer bind:this={drawer} size="50rem" on:close={() => clearPageDrawerAnchor(VARIABLES_PATH)}>
<DrawerContent
title={edit ? `Update variable at ${initialPath}` : 'Add a variable'}
bannerReserved={edit}
@@ -347,6 +361,7 @@
{/if}
</div>
{#snippet actions()}
<OpenInSessionButton source={sessionSource} />
{#if edit && curWs}
<WsSpecificVersions kind="variable" workspaceId={curWs} {initialPath} bind:selected />
{/if}
frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
+11 -2
View File
@@ -120,7 +120,8 @@ import {
type ChatCommandItem,
type SessionPromptContext,
getSessionContextPromptSection,
type GlobalToolHelpers
type GlobalToolHelpers,
type GlobalActivePreviewContext
} from './global/core'
import { formatChatJobCompletion } from './datatableTools'
import { isGlobalAiEnabled } from './global/gate'
@@ -584,6 +585,10 @@ export class AIChatManager {
// sessions modules — and re-read on every system-message rebuild; the send
// path rebuilds after beforeSend, so a fork committed there is picked up.
sessionContextResolver: (() => SessionPromptContext | undefined) | undefined = undefined
// The page the side panel shows, stamped on each user message. Same seam as above:
// a page tab is an iframe in its own realm, so the tab model is the only place the
// chat can learn it. Undefined for a live editor — ACTIVE EDITOR covers those.
activePreviewResolver: (() => GlobalActivePreviewContext | undefined) | undefined = undefined
// Resolves the workspace this chat operates on. Session chats set it to their
// own (possibly forked) workspace so the chat targets it WITHOUT switching the
// global workspaceStore. Undefined for the global side-panel chat, which
@@ -2329,7 +2334,10 @@ export class AIChatManager {
return prepareGlobalUserMessage(
pendingPrompt,
this.contextManager.getSelectedContext(),
{ workspace: this.operatingWorkspace }
{
workspace: this.operatingWorkspace,
activePreview: this.activePreviewResolver?.()
}
)
}
return undefined
@@ -2936,6 +2944,7 @@ export class AIChatManager {
case AIMode.GLOBAL:
userMessage = prepareGlobalUserMessage(modelInstructions, oldSelectedContext, {
workspace: this.operatingWorkspace,
activePreview: this.activePreviewResolver?.(),
images: sentImages,
files: files
})
frontend/src/lib/components/copilot/chat/global/core.test.ts
+27
View File
@@ -5052,6 +5052,18 @@ describe('session-only preview tools gating', () => {
}
})
// Only a session chat can ever receive an ACTIVE PREVIEW section, so the rule
// explaining it is dead weight (~100 prompt tokens per request) anywhere else.
it('carries the ACTIVE PREVIEW rule only in a chat that has a side panel', () => {
const off = prepareGlobalSystemMessage(undefined, { previewTools: false }).content as string
const on = prepareGlobalSystemMessage(undefined, { previewTools: true }).content as string
expect(off).not.toContain('ACTIVE PREVIEW')
expect(on).toContain('ACTIVE PREVIEW')
// The ACTIVE EDITOR rule is unconditional — live editors exist in both.
expect(off).toContain('ACTIVE EDITOR')
expect(on).toContain('ACTIVE EDITOR')
})
it('mentions open_preview / get_app_runtime_logs / list_app_runs in the system prompt only when preview tools are enabled', () => {
const off = prepareGlobalSystemMessage(undefined, { previewTools: false }).content as string
const on = prepareGlobalSystemMessage(undefined, { previewTools: true }).content as string
@@ -5256,6 +5268,21 @@ describe('prepareGlobalUserMessage', () => {
expect(message.content).not.toContain('content')
})
it('injects the previewed page and the row its drawer has open', () => {
const message = prepareGlobalUserMessage('Disable it', [], {
activePreview: {
label: 'Schedules',
location: '/schedules',
open: 'u/me/daily_report'
}
})
expect(message.content).toContain('## ACTIVE PREVIEW')
expect(message.content).toContain('page: Schedules')
expect(message.content).toContain('location: /schedules')
expect(message.content).toContain('open: u/me/daily_report')
})
it('includes selected workspace item references without contents', () => {
const message = prepareGlobalUserMessage('Update these items', [
{
frontend/src/lib/components/copilot/chat/global/core.ts
+34 -1
View File
@@ -254,9 +254,26 @@ export type GlobalActiveEditorContext = {
isLiveDraft: true
}
/** The page the session's side panel is showing, when it isn't one of the live
* editors ACTIVE EDITOR already covers. A page tab is an iframe in its own realm,
* so the chat can only learn about it from the tab model the session owns. */
export type GlobalActivePreviewContext = {
/** Page name as the tab strip shows it, e.g. "Schedules". */
label: string
/** Base-stripped page path plus the request params the page declares — values kept
* only for the ones addressing a workspace object, and percent-encoded. Never a raw
* location: a tab can host a legacy app whose hash is app state, and a filter value
* can be free text the user typed. Build it with `previewLocationContext`. */
location: string
/** The row whose drawer is open on that page. The list pages drop the anchor when
* their drawer closes, so its absence means no row is open. */
open?: string
}
export type GlobalUserMessageOptions = {
workspace?: string
activeEditor?: GlobalActiveEditorContext
activePreview?: GlobalActivePreviewContext
/** Images attached to this message; delivered as image_url content parts. */
images?: AttachedImage[]
/** Text files attached to this message; listed by reference below — the model
@@ -1197,6 +1214,12 @@ const buildGlobalSystemPrompt = (
const pipelineAlphaNote = previewTools
? ' Data pipeline support in this chat is in ALPHA: the first time the user asks for a data pipeline in this session, briefly tell them it is an alpha feature before you start building.'
: ''
// Gated on `previewTools` (constant per chat), never on whether a preview is open
// right now: the system prompt is the cached prefix, so a line appearing and
// disappearing between turns costs more cache than the tool call it saves.
const activePreviewRule = previewTools
? '\n- If the user message includes an ACTIVE PREVIEW section, that is the page the side panel is showing — resolve "this page", "here" and "it" against it, and against `open` (the row the page is anchored at, whose drawer the user opened) when there is one. It already tells you what get_preview_status would, so do not call that tool to learn what is on screen; call it only to check the panel\'s *other* tabs.'
: ''
const pipelineBullet = `- A "data pipeline" is NOT a flow: it is a DAG of independent scripts in one folder, wired by storage assets (DuckLake/data tables/S3) and triggers via top-of-file \`pipeline\` / \`on <ref>\` annotation comments written in each script's comment syntax (\`--\` for SQL, \`#\` for Python/Bash, \`//\` for TS — a \`//\` line in a SQL node is a syntax error). When the user asks for a data pipeline (or to ingest/transform/materialize data across steps), call get_instructions with subject "pipeline" and build annotated script drafts — do not build a flow.${pipelineAlphaNote}`
return `You are Windmill's global workspace assistant.
@@ -1214,7 +1237,7 @@ Path conventions:
Rules:
- Draft tools create or update drafts only; they do not deploy or mutate deployed workspace items.
- Use list_workspace_items to find items and read_workspace_item before changing an existing item. For triggers, pass trigger_kind.
- If the user message includes an ACTIVE EDITOR section, treat it as the currently open item and use it for references like "this", "current", or "open editor".
- If the user message includes an ACTIVE EDITOR section, treat it as the currently open item and use it for references like "this", "current", or "open editor".${activePreviewRule}
- Use deploy_workspace_item only after the user explicitly asks to deploy. It persists a draft to the workspace.
- To undo something you created or changed in this chat, use discard_local_draft: everything you write is a draft until it is explicitly deployed, so "delete it" / "never mind" / "remove that" about your own work means discarding the draft (it also clears the matching open editor draft). Use delete_workspace_item only to remove an item that is already deployed in the workspace; it mutates the workspace and fails if nothing is deployed at that path.
- Use diff to review changes — before deploying, or when the user asks what changed. It is read-only: without arguments it lists every draft in the workspace with its change status; with type+path it returns that item's unified diff (for multi-file apps, pass file to read one file's diff). In a fork, pass against="parent_workspace" to compare the deployed fork with its parent workspace instead. Pass search to grep changed lines across all diffs.
@@ -7341,6 +7364,16 @@ export function prepareGlobalUserMessage(
content += `isLiveDraft: true\n\n`
}
if (options.activePreview) {
content += '## ACTIVE PREVIEW\n'
content += `page: ${options.activePreview.label}\n`
content += `location: ${options.activePreview.location}\n`
if (options.activePreview.open) {
content += `open: ${options.activePreview.open}\n`
}
content += '\n'
}
if (selectedWorkspaceItems.length > 0) {
content += '## SELECTED CONTEXT\n'
for (const context of selectedWorkspaceItems) {
frontend/src/lib/components/copilot/chat/global/pageNavigation.ts
+29 -41
View File
@@ -1,9 +1,8 @@
import { buildFilterUrl } from '$lib/navigation'
import { buildRunsFilterSearchbarSchema } from '$lib/components/runs/runsFilter'
import { buildSchedulesFilterSchema } from '$lib/components/schedules/schedulesFilter'
import {
COMPARE_PAGE,
TRIGGER_PAGES,
pageRequestParams,
type TriggerKind
} from '$lib/components/sessions/previewRouter'
import {
@@ -11,16 +10,17 @@ import {
serializeItemsMaskParam
} from '$lib/components/sessions/modifiedItemsMask'
// In-app paths for the deep-linkable preview pages the AI chat can open.
export const RUNS_PATH = '/runs'
export const SCHEDULES_PATH = '/schedules'
export const VARIABLES_PATH = '/variables'
export const RESOURCES_PATH = '/resources'
export const ASSETS_PATH = '/assets'
export const AUDIT_LOGS_PATH = '/audit_logs'
export const WORKSPACE_SETTINGS_PATH = '/workspace_settings'
export const FOLDERS_PATH = '/folders'
export const GROUPS_PATH = '/groups'
import {
RUNS_PATH,
SCHEDULES_PATH,
VARIABLES_PATH,
RESOURCES_PATH,
ASSETS_PATH,
AUDIT_LOGS_PATH,
WORKSPACE_SETTINGS_PATH,
FOLDERS_PATH,
GROUPS_PATH
} from '$lib/components/sessions/previewPaths'
// Selectable tabs on the Workspace settings page (the `?tab=` query param). Mirrors the
// union in routes/(root)/(logged)/workspace_settings/+page.svelte.
@@ -49,27 +49,17 @@ export const WORKSPACE_SETTINGS_TABS = [
'shared_ui'
] as const
// Valid query-param keys are derived from the real filter schemas (option arrays are
// irrelevant to the key set), so a renamed filter key propagates here for free. The
// permission flags are on so the key set is complete: gating `all_workspaces` is the
// caller's job, and the Runs page ignores it for anyone whose own schema lacks the key.
const RUNS_FILTER_KEYS = Object.keys(
buildRunsFilterSearchbarSchema({
paths: [],
usernames: [],
folders: [],
jobTriggerKinds: [],
isSuperAdminOrDevops: true,
isAdminsWorkspace: true
})
)
const SCHEDULES_FILTER_KEYS = Object.keys(
buildSchedulesFilterSchema({ paths: [], scriptPaths: [] })
)
// Every builder below allows exactly the params `previewRouter` records as
// request-settable for that page, so the URLs this emits and the preview's reading of
// them stay one set. Wherever the page declares a filter schema that set is its full
// key list, so a renamed or added filter propagates here for free — including the keys
// only some viewers see: gating `all_workspaces` is the caller's job, and the Runs page
// ignores it for anyone whose own schema lacks it. What the chat may actually pass is
// narrower and lives in the open_page tool schema, not here.
/** Deep-link to the Runs page with the given filters (keys must match `runsFilter`). */
export function buildRunsUrl(filters: Record<string, unknown>): string {
return buildFilterUrl(RUNS_PATH, filters, { validKeys: RUNS_FILTER_KEYS })
return buildFilterUrl(RUNS_PATH, filters, { validKeys: pageRequestParams(RUNS_PATH) })
}
/**
@@ -84,15 +74,11 @@ export function buildSchedulesUrl({
filters?: Record<string, unknown>
}): string {
return buildFilterUrl(SCHEDULES_PATH, filters ?? {}, {
validKeys: SCHEDULES_FILTER_KEYS,
validKeys: pageRequestParams(SCHEDULES_PATH),
hash: open
})
}
// The remaining pages expose a curated subset of each page's real query params (not the
// full filter schema), so the allow-list is the exact set of keys the builder emits —
// these names match the query params the pages read (variablesFilter/resourcesFilter/
// assetsFilter and audit_logs/+page.svelte).
/** When `open` is set, the variable at that exact path is opened in the edit
* drawer via the `#<path>` hash the page already handles. */
export function buildVariablesUrl({
@@ -103,7 +89,7 @@ export function buildVariablesUrl({
filters?: Record<string, unknown>
}): string {
return buildFilterUrl(VARIABLES_PATH, filters ?? {}, {
validKeys: ['path', 'owner'],
validKeys: pageRequestParams(VARIABLES_PATH),
hash: open
})
}
@@ -118,24 +104,26 @@ export function buildResourcesUrl({
filters?: Record<string, unknown>
}): string {
return buildFilterUrl(RESOURCES_PATH, filters ?? {}, {
validKeys: ['path', 'resource_type', 'owner'],
validKeys: pageRequestParams(RESOURCES_PATH),
hash: open ? `/resource/${open}` : undefined
})
}
export function buildAssetsUrl(filters: Record<string, unknown>): string {
return buildFilterUrl(ASSETS_PATH, filters, { validKeys: ['path'] })
return buildFilterUrl(ASSETS_PATH, filters, { validKeys: pageRequestParams(ASSETS_PATH) })
}
export function buildAuditLogsUrl(filters: Record<string, unknown>): string {
return buildFilterUrl(AUDIT_LOGS_PATH, filters, {
validKeys: ['username', 'operation', 'resource']
validKeys: pageRequestParams(AUDIT_LOGS_PATH)
})
}
/** Deep-link to the Workspace settings page, optionally on a specific `?tab=`. */
export function buildWorkspaceSettingsUrl({ tab }: { tab?: string }): string {
return buildFilterUrl(WORKSPACE_SETTINGS_PATH, tab ? { tab } : {})
return buildFilterUrl(WORKSPACE_SETTINGS_PATH, tab ? { tab } : {}, {
validKeys: pageRequestParams(WORKSPACE_SETTINGS_PATH)
})
}
/** Folders and Groups list pages have no query filters — just open them. */
@@ -173,7 +161,7 @@ export function buildCompareUrl({
mode,
[COMPARE_ITEMS_PARAM]: items ? serializeItemsMaskParam(items) : undefined
},
{ validKeys: ['workspace_id', 'mode', COMPARE_ITEMS_PARAM] }
{ validKeys: pageRequestParams(COMPARE_PAGE.path) }
)
}
frontend/src/lib/components/instanceSettings.ts
+4 -2
View File
@@ -1005,9 +1005,11 @@ export const settings: Record<string, Setting[]> = {
],
'GitHub App': [
{
label: 'GitHub App',
// The category header above already names the section; this labels the
// card that holds the app credentials, next to the webhook base url one.
label: 'App configuration',
description:
'Configure a self-managed GitHub App to enable git sync without stats.windmill.dev.',
'Use your own GitHub App instead of the Windmill-managed one on stats.windmill.dev.',
key: 'github_enterprise_app',
fieldType: 'github_enterprise_app',
storage: 'setting',
frontend/src/lib/components/instanceSettings/GhesAppSettings.svelte
+34 -2
View File
@@ -194,13 +194,34 @@
<li>
<strong>Callback URL</strong>: <code>&lt;your-windmill-url&gt;/gh_success</code>
</li>
<li>Uncheck <strong>Active</strong> under Webhook (not needed)</li>
<li>
Uncheck <strong>Active</strong> under Webhook. Windmill registers the webhooks it
needs per repository, so the app-level webhook stays unused.
</li>
</ul>
<p><strong>3.</strong> Set repository permissions:</p>
<ul class="list-disc ml-4 space-y-1">
<li><strong>Contents</strong>: Read &amp; write</li>
<li><strong>Metadata</strong>: Read-only</li>
</ul>
<p>
Those two are the minimum, for the push direction (Windmill &rarr; git). Add these for
the pull direction (git &rarr; Windmill), all read &amp; write:
</p>
<ul class="list-disc ml-4 space-y-1">
<li>
<strong>Repository webhooks</strong>: deploy commits within seconds instead of
polling the repository
</li>
<li>
<strong>Pull requests</strong>: open pull requests for the branches Windmill pushes,
and maintain the deploy-preview comment
</li>
<li>
<strong>Checks</strong>: post the "Windmill diff" and deploy status checks on commits
and pull requests
</li>
</ul>
<p>
<strong>4.</strong> Under "Where can this GitHub App be installed?", choose
<strong>Any account</strong> (or restrict to your organization).
@@ -219,7 +240,18 @@
</p>
<p>
<strong>8.</strong> The <strong>Base URL</strong> is your GitHub instance root (e.g.
<code>https://github.com</code> or <code>https://github.mycompany.com</code>).
<code>https://github.com</code>, <code>https://mycompany.ghe.com</code> or
<code>https://github.mycompany.com</code>). On GHE Cloud (<code>*.ghe.com</code>), also
set <strong>App owner</strong> to the organization or user that owns the app: its
installation urls carry the owner.
</p>
<p>
Full setup guide: <a
href="https://www.windmill.dev/docs/integrations/git_repository#self-managed-github-app"
target="_blank"
rel="noreferrer"
class="underline">Self-managed GitHub App</a
>.
</p>
</div>
</details>
frontend/src/lib/components/pendingEditorFlush.test.ts
+27
View File
@@ -0,0 +1,27 @@
import { describe, it, expect } from 'vitest'
import {
anyEditorUnparseable,
setEditorUnparseable,
registerPendingEditor,
flushAllPendingEditorChanges
} from './pendingEditorFlush'
describe('pendingEditorFlush', () => {
it('reports unparseable text until the editor clears it', () => {
const editor = {}
expect(anyEditorUnparseable()).toBe(false)
setEditorUnparseable(editor, true)
expect(anyEditorUnparseable()).toBe(true)
setEditorUnparseable(editor, false)
expect(anyEditorUnparseable()).toBe(false)
})
it('flushes registered editors, and stops once they unmount', () => {
let flushed = 0
const deregister = registerPendingEditor({ flushPendingChanges: () => flushed++ })
flushAllPendingEditorChanges()
deregister()
flushAllPendingEditorChanges()
expect(flushed).toBe(1)
})
})
frontend/src/lib/components/pendingEditorFlush.ts
+36
View File
@@ -0,0 +1,36 @@
// Every mounted `SimpleEditor`, so a caller can materialise what the user typed without
// knowing which editors a page contains — a drawer nests them through SchemaForm and
// ArgInput, so enumerating them from the container does not scale. Plain module rather
// than the editor component: importing that pulls Monaco's side-effect imports into every
// graph that reaches this, and the components around it defer Monaco deliberately.
const liveEditors = new Set<{ flushPendingChanges: () => void }>()
/** Register a mounted editor; the returned function deregisters it. */
export function registerPendingEditor(editor: { flushPendingChanges: () => void }): () => void {
liveEditors.add(editor)
return () => liveEditors.delete(editor)
}
/** Drain every mounted editor's debounced buffer. For code that must act on what is on
* screen before leaving it — persisting a draft before routing to a session. */
export function flushAllPendingEditorChanges(): void {
for (const editor of liveEditors) editor.flushPendingChanges()
}
// Editors whose current text does not parse. Their value never reaches the bound field, so
// a caller persisting "what is on screen" would save the last value that did parse and
// leave without it. Registered by the editors that parse, not by the ones that only hold text.
const unparseable = new Set<object>()
/** Mark or clear this editor as holding text that does not parse. */
export function setEditorUnparseable(key: object, invalid: boolean): void {
if (invalid) unparseable.add(key)
else unparseable.delete(key)
}
/** Whether any editor on screen holds text that cannot be persisted as written. Registry-
* wide rather than per-item: the editors that parse are nested arbitrarily deep and none
* of them knows which draft it belongs to. */
export function anyEditorUnparseable(): boolean {
return unparseable.size > 0
}
frontend/src/lib/components/sessions/OpenInSessionButton.svelte
+36 -5
View File
@@ -4,14 +4,26 @@
// What an editor hands over for "Open in AI session": the session target it
// maps to, the workspace it lives in, and a persist hook run before routing
// so the session preview opens the item exactly as currently edited.
export type OpenInSessionSource = {
target: SessionTarget
type OpenInSessionCommon = {
workspaceId?: string
beforeOpen?: () => void | Promise<void>
/** Where inside the item the preview should open (a flow's `selected`
* step). Steers the editor only — tab identity is (kind, path). */
previewParams?: Record<string, string>
}
// A destination is either an editable item or a page, never both and never
// neither — the union is what makes that a compile error rather than a button
// that silently does nothing.
export type OpenInSessionSource = OpenInSessionCommon &
(
| { target: SessionTarget; page?: never }
/** Base-prefixed href of a workspace page the preview opens as a tab (Runs,
* a trigger list). Resolved on click, not at render: a page whose filters
* live in shallow-routed query params never reflects them in `page.url`, so
* only `window.location` read at that moment matches what the user sees. */
| { page: () => string | undefined; target?: never }
)
</script>
<script lang="ts">
@@ -20,7 +32,9 @@
import AIButton from '$lib/components/copilot/chat/AIButton.svelte'
import { AIBtnClasses } from '$lib/components/copilot/chat/AIButtonStyle'
import { isGlobalAiEnabled } from '$lib/components/copilot/chat/global/gate'
import { openEditorInSession } from './sessionSwitch.svelte'
import { userStore } from '$lib/stores'
import { sendUserToast } from '$lib/toast'
import { openEditorInSession, openPageInSession } from './sessionSwitch.svelte'
let {
source,
@@ -46,7 +60,14 @@
// SessionEditorTarget / the session wrapper); iframe preview tabs are not
// the top window.
const inSessionPanel = !!getContext('aiChatManager') || (BROWSER && window.self !== window.top)
const show = $derived(!inSessionPanel && !!source && isGlobalAiEnabled())
// The sessions page refuses operators, so an entry point on a page they can
// reach (Runs, the trigger lists) would only route them into that refusal.
const show = $derived(
!inSessionPanel &&
!!(source?.target || source?.page) &&
!$userStore?.operator &&
isGlobalAiEnabled()
)
// Not $state: only read inside open() as a re-entrancy latch, never rendered.
let opening = false
@@ -54,8 +75,18 @@
if (opening || !source) return
opening = true
try {
// `beforeOpen` persists what is on screen and throws when it could not, so a
// failure has to stay on this page and say so — the session would otherwise
// open on an older draft than the editor the user is looking at.
await source.beforeOpen?.()
await openEditorInSession(source.target, source.workspaceId, source.previewParams)
if (source.target) {
await openEditorInSession(source.target, source.workspaceId, source.previewParams)
} else {
const href = source.page?.()
if (href) await openPageInSession(href, source.workspaceId)
}
} catch (e) {
sendUserToast(e instanceof Error ? e.message : String(e), true)
} finally {
opening = false
}
frontend/src/lib/components/sessions/PreviewTabHost.svelte
+75 -4
View File
@@ -1,5 +1,7 @@
<script lang="ts">
import { untrack } from 'svelte'
import { workspaceStore } from '$lib/stores'
import { whereIs } from './sessionPreviewTabs.svelte'
import type { WorkspaceItem } from '$lib/components/workspacePicker'
import {
getEffectiveWorkspaceId,
@@ -9,7 +11,12 @@
} from './sessionState.svelte'
import type { SessionRuntime } from './sessionRuntime.svelte'
import { Loader2 } from 'lucide-svelte'
import { resolvePreviewTab, parsePreviewItemRoute, parsePreviewSelectedId } from './previewRouter'
import {
resolvePreviewTab,
parsePreviewItemRoute,
parsePreviewSelectedId,
showsView
} from './previewRouter'
import { withMenuHidden } from './sessionMode.svelte'
import ArtifactViewer from '../copilot/chat/artifacts/ArtifactViewer.svelte'
import { setOverlayHost } from '../common/overlayHost.svelte'
@@ -114,10 +121,16 @@
// current URL is a no-op when it carries a fragment (same-document
// navigation, no load) — only then fall back to location.reload(), which
// always performs a full load of that same URL.
const target = withMenuHidden(tab.loc || tab.url, workspaceId || undefined)
const target = withMenuHidden(whereIs(tab), workspaceId || undefined)
const { pathname, search, hash } = win.location
if (pathname + search + hash === target) win.location.reload()
else win.location.replace(target)
else if (pathname + search === target.split('#')[0]) {
// Only the fragment differs: replace() would navigate within the same
// document, so the page never re-runs the hash handling that opens a
// drawer. Land on the target, then force the load.
win.location.replace(target)
win.location.reload()
} else win.location.replace(target)
} catch {
// Cross-navigation timing — skip; the next mutation reloads again.
}
@@ -160,6 +173,64 @@
})
$effect(() => () => clearTimeout(flashTimer))
// Where a booting frame starts, from the observed location: a tab remounted after the
// user moved inside it should come back where they were, not where it started. Only
// written while there is no frame — this host outlives the iframe (eviction keeps the
// component, `mounted` gates only the markup below), so a value captured once would
// send a remount back to whatever the tab held when it was opened.
let bootSrc = $state(untrack(() => withMenuHidden(whereIs(tab), workspaceId || undefined)))
// A live frame is navigated instead, and only when it is not already there. Binding
// `src` reactively would navigate on every write to `tab.url` — including the anchor
// drop that follows the user closing a drawer, where the frame already shows the
// target and a fragment removal is a full load, not a same-document move.
let lastCommanded = untrack(() => withMenuHidden(tab.url, workspaceId || undefined))
// The workspace the frame was last sent to. A session re-scopes — switching workspace
// before its first send, or a staged fork becoming the committed one — and the scope
// lives in the URL alone, while `showsView` reads it as the noise it is for a location's
// meaning. Tracked apart so a re-scope always reaches the frame.
let lastScope = untrack(() => workspaceId)
$effect(() => {
const target = withMenuHidden(tab.url, workspaceId || undefined)
const scope = workspaceId
const live = mounted
untrack(() => {
const win = live ? frame?.contentWindow : undefined
if (!win) {
bootSrc = withMenuHidden(whereIs(tab), workspaceId || undefined)
lastCommanded = target
lastScope = scope
return
}
if (target === lastCommanded) return
const rescoped = scope !== lastScope
// A frame the user browsed to another origin refuses the read but not the
// navigation, and navigating it is the only way back to a Windmill page. So the
// command counts as applied once acted on, never before.
let here: string | undefined
try {
const { pathname, search, hash } = win.location
here = pathname + search + hash
} catch {
here = undefined
}
// By view, not by string: a page hands its params back in an order and encoding
// of its own, and re-loading the frame over that costs the user their scroll
// position and everything else it holds outside the URL.
if (!rescoped && here !== undefined && (here === target || showsView(here, target))) {
lastCommanded = target
return
}
try {
win.location.replace(target)
lastCommanded = target
lastScope = scope
} catch {
// Cross-navigation timing — the next command navigates again.
}
})
})
// Forced-load signal for a navigation to the tab's exact current URL (see
// pulseReload) — without it the page never re-runs its URL-driven behavior.
// Seeded from the current nonce: a pulse from before this host mounted is
@@ -259,7 +330,7 @@
{:else if mounted}
<iframe
bind:this={frame}
src={withMenuHidden(tab.url, workspaceId || undefined)}
src={bootSrc}
onload={(e) => {
const f = e.currentTarget as HTMLIFrameElement
// Re-apply after load so a toggle that happened while the frame was
frontend/src/lib/components/sessions/pageDrawerSession.ts
+142
View File
@@ -0,0 +1,142 @@
import { tick } from 'svelte'
import { page } from '$app/state'
import { goto } from '$lib/navigation'
import {
anyEditorUnparseable,
flushAllPendingEditorChanges
} from '$lib/components/pendingEditorFlush'
import { UserDraftDbSyncer } from '$lib/userDraftDbSyncer.svelte'
import type { UserDraftItemKind } from '$lib/gen'
// From the path leaf rather than `previewRouter`: these drawers mount inside script and
// flow editors, where pulling the filter schemas that module reads views from would make
// every trigger's save utils eager.
import {
pageHref,
stripBase,
TRIGGER_PAGES,
RESOURCES_PATH,
SCHEDULES_PATH,
VARIABLES_PATH,
type TriggerKind
} from './previewPaths'
import type { OpenInSessionSource } from './OpenInSessionButton.svelte'
// The draft each page's drawer edits. The preview loads the page in its own
// document and reads the draft back from the server, so opening a session has to
// wait for the debounced autosave to land — see `beforeOpen` below.
const DRAWER_DRAFT_KIND: Record<string, UserDraftItemKind> = {
[VARIABLES_PATH]: 'variable',
[RESOURCES_PATH]: 'resource',
[SCHEDULES_PATH]: 'trigger_schedule',
...Object.fromEntries(
Object.entries(TRIGGER_PAGES).map(([kind, p]) => [
p.path,
`trigger_${kind as TriggerKind}` as UserDraftItemKind
])
)
}
// Push the drawer's pending autosave and refuse to leave if it did not land: `flush`
// reports a failed or conflicting POST through its state rather than by throwing, so
// routing regardless would open the preview on the server's older draft while the drawer
// the user is looking at still holds the edit. The flush is the explicit kind, saving even
// with auto-save off: asking for a session is asking for the edit to come along.
async function flushOrRefuse(query: Parameters<typeof UserDraftDbSyncer.flush>[0]): Promise<void> {
// Before the save, not after: text that does not parse never reached the draft, so
// leaving now would open the session on the last value that did and drop the buffer
// with the drawer — and saving first would write that stale value on the way to
// refusing. The editors were materialised before this call, so the check is current.
if (anyEditorUnparseable()) {
throw new Error('This page has changes that are not valid JSON. Fix them first.')
}
await UserDraftDbSyncer.flush(query)
if (UserDraftDbSyncer.getConflict(query).conflict) {
throw new Error(
'This draft has a newer conflicting version on the server. Resolve it here before opening a session.'
)
}
const { state, failureMessage } = UserDraftDbSyncer.getState(query)
if (state === 'failed') {
throw new Error(
`Saving the latest draft failed (${failureMessage ?? 'unknown error'}). Retry before opening a session.`
)
}
}
// How each page addresses a row in its hash. Resources route theirs through an extra
// segment; every other page names the path directly.
const drawerHashFor = (pagePath: string, itemPath: string) =>
pagePath === RESOURCES_PATH ? `/resource/${itemPath}` : itemPath
/**
* Deep-link the row whose drawer just opened, so the location says what is on screen — a
* drawer opened from a row's Edit button is as open as one reached by link, and the chat
* is told what the session shows through the location alone. No-op off that page, where
* these drawers also open inside editors and pickers with no row convention to keep.
*
* Written straight to history rather than through the router: these pages open their
* drawer *from* the hash, so a router-visible write would come back as a second open on
* the row the user is already editing. The preview observes `replaceState` either way.
*/
export function setPageDrawerAnchor(pagePath: string, itemPath: string | undefined): void {
if (!itemPath) return
const { pathname, search, hash } = window.location
if (stripBase(pathname) !== pagePath) return
const anchor = `#${drawerHashFor(pagePath, itemPath)}`
if (hash === anchor) return
history.replaceState(history.state, '', `${pathname}${search}${anchor}`)
}
/**
* Drop the row a list page deep-links, once its drawer closes. The hash is how the row was
* requested; leaving it behind makes the location claim a drawer that is no longer open —
* and the chat reports that location as what the user is looking at. No-op off that page,
* where the same drawers open without a hash convention.
*/
export async function clearPageDrawerAnchor(pagePath: string): Promise<void> {
// Read the location from the document, never from `page.url`: these pages write their
// filters with shallow routing, which never reaches `page.url`, so rebuilding the query
// from it would drop the filters the user typed along with the anchor.
const { pathname, search, hash } = window.location
if (stripBase(pathname) !== pagePath || !hash) return
await goto(`${pathname}${search}`, { replaceState: true, noScroll: true })
}
/**
* "Open in AI session" source for the edit drawer of a workspace list page (trigger
* lists, schedules, resources, variables): none is an editable item the preview can
* host, so the session opens the page with `itemPath`'s drawer deep-linked.
*
* Undefined — so the button renders nothing — unless that page's own route is on
* screen: these drawers also open inside script/flow editors and pickers, which carry
* their own entry point.
*/
export function pageDrawerSessionSource(
pagePath: string,
itemPath: string | undefined,
workspaceId: string | undefined
): OpenInSessionSource | undefined {
if (!itemPath || stripBase(page.url.pathname) !== pagePath) return undefined
const anchor = drawerHashFor(pagePath, itemPath)
const itemKind = DRAWER_DRAFT_KIND[pagePath]
return {
// The list behind the drawer is part of what the user is looking at, and its filters
// are written with shallow routing — so the query has to come from the document at
// click time, as the thunk exists for.
page: () => `${pageHref(pagePath)}${window.location.search}#${anchor}`,
workspaceId,
// Autosave is debounced, and the preview reads the draft back through the server
// from a document of its own — routing before the POST lands opens the drawer on a
// value the user has already changed. Editors hold their last keystrokes behind a
// debounce of their own, so materialise those and let the bindings settle first.
// Text that does not parse never reaches the draft, so routing is refused instead.
beforeOpen:
itemKind && workspaceId
? async () => {
flushAllPendingEditorChanges()
await tick()
await flushOrRefuse({ workspace: workspaceId, itemKind, path: itemPath })
}
: undefined
}
}
frontend/src/lib/components/sessions/previewPaths.ts
+82
View File
@@ -0,0 +1,82 @@
import { base } from '$lib/base'
import type { WorkspaceItemKind } from '$lib/components/workspacePicker'
// The paths a preview location can point at, and the base handling around them. Kept apart
// from `previewRouter`, which reads a location's *view* from each page's filter schema and
// through those reaches every trigger's save utils: a drawer that needs nothing but a page
// path is mounted inside script and flow editors, which must not pull that in.
// In-app paths for the deep-linkable preview pages the AI chat can open.
export const RUNS_PATH = '/runs'
export const SCHEDULES_PATH = '/schedules'
export const VARIABLES_PATH = '/variables'
export const RESOURCES_PATH = '/resources'
export const ASSETS_PATH = '/assets'
export const AUDIT_LOGS_PATH = '/audit_logs'
export const WORKSPACE_SETTINGS_PATH = '/workspace_settings'
export const FOLDERS_PATH = '/folders'
export const GROUPS_PATH = '/groups'
// Trigger list pages, by kind. Deliberately kept out of PREVIEW_PAGES (the curated
// breadcrumb picker) but shared here so open_page can route to them and the preview tab
// can label them. `ee` kinds require an enterprise license. Each supports `#<path>` to
// open a specific trigger, like Schedules.
export type TriggerKind =
| 'http'
| 'websocket'
| 'postgres'
| 'kafka'
| 'nats'
| 'sqs'
| 'gcp'
| 'azure'
| 'mqtt'
| 'amqp'
| 'email'
export const TRIGGER_PAGES: Record<TriggerKind, { path: string; label: string; ee?: boolean }> = {
http: { path: '/routes', label: 'HTTP routes' },
websocket: { path: '/websocket_triggers', label: 'WebSocket triggers' },
postgres: { path: '/postgres_triggers', label: 'Postgres triggers' },
kafka: { path: '/kafka_triggers', label: 'Kafka triggers', ee: true },
nats: { path: '/nats_triggers', label: 'NATS triggers', ee: true },
sqs: { path: '/sqs_triggers', label: 'SQS triggers', ee: true },
gcp: { path: '/gcp_triggers', label: 'GCP Pub/Sub triggers', ee: true },
azure: { path: '/azure_triggers', label: 'Azure Event Grid triggers', ee: true },
mqtt: { path: '/mqtt_triggers', label: 'MQTT triggers' },
amqp: { path: '/amqp_triggers', label: 'AMQP triggers' },
email: { path: '/email_triggers', label: 'Email triggers' }
}
/** Label a trigger list page from its (base-stripped) pathname, or undefined. */
export function triggerLabelForPath(path: string): string | undefined {
const clean = stripBase(path)
return Object.values(TRIGGER_PAGES).find((t) => t.path === clean)?.label
}
export const pageKey = (path: string) => `page:${path}`
export const pageHref = (path: string) => `${base}${path}`
/** Strip the deployment base prefix (and any query/hash) from a preview path
* so it can be matched against `PREVIEW_PAGES` / parsed as an item route. */
export function stripBase(path: string): string {
let p = path.split('?')[0].split('#')[0]
if (base && p.startsWith(base)) p = p.slice(base.length)
return p || '/'
}
export type PreviewItemRoute = { kind: WorkspaceItemKind; raw_app: boolean; itemPath: string }
// Parse a preview URL/pathname into the workspace item it edits, or null for a
// non-item page (home, runs, …). Shared by the breadcrumb (drill segments) and
// `previewRouter`'s tab resolver so both agree on what counts as an item route.
export function parsePreviewItemRoute(fullPath: string): PreviewItemRoute | null {
const p = stripBase(fullPath)
const m = p.match(/^\/(scripts|flows|apps|apps_raw)\/(?:edit|get)\/(.+)$/)
if (!m) return null
const itemPath = decodeURIComponent(m[2])
if (m[1] === 'scripts') return { kind: 'script', raw_app: false, itemPath }
if (m[1] === 'flows') return { kind: 'flow', raw_app: false, itemPath }
if (m[1] === 'apps_raw') return { kind: 'app', raw_app: true, itemPath }
return { kind: 'app', raw_app: false, itemPath }
}
frontend/src/lib/components/sessions/previewReload.ts
+3 -2
View File
@@ -1,5 +1,6 @@
import type { SessionPreviewTab } from './sessionState.svelte'
import { stripBase, TRIGGER_PAGES, type TriggerKind } from './previewRouter'
import { whereIs } from './sessionPreviewTabs.svelte'
import { stripBase, TRIGGER_PAGES, type TriggerKind } from './previewPaths'
// Which list pages a completed chat tool can change, as base-stripped paths
// (e.g. `/schedules`). This allowlist is the single source of truth for "does
@@ -71,5 +72,5 @@ export function tabsToReload(
pages: ReadonlySet<string>
): SessionPreviewTab[] {
if (pages.size === 0) return []
return tabs.filter((t) => pages.has(stripBase(t.loc || t.url)))
return tabs.filter((t) => pages.has(stripBase(whereIs(t))))
}
frontend/src/lib/components/sessions/previewRouter.test.ts
+164 -1
View File
@@ -1,16 +1,179 @@
import { describe, it, expect } from 'vitest'
import {
artifactUrl,
describeLocation,
draftFriendlyLeaf,
drawerAnchorFor,
showsView,
itemDisplayName,
matchReusablePage,
parseArtifactRoute,
parsePreviewItemRoute,
parsePreviewSelectedId,
previewLocationContext,
previewLocationLabel,
resolvePreviewTab
} from './previewRouter'
describe('drawerAnchorFor', () => {
it('reads the anchored row on the pages that deep-link one', () => {
expect(drawerAnchorFor('/schedules#u/me/daily')).toBe('u/me/daily')
expect(drawerAnchorFor('/variables?owner=u#u/me/token')).toBe('u/me/token')
expect(drawerAnchorFor('/kafka_triggers#f/team/ingest')).toBe('f/team/ingest')
// Resources route theirs through an extra segment.
expect(drawerAnchorFor('/resources#/resource/u/me/db')).toBe('u/me/db')
})
it('ignores a hash on pages where it is not a row', () => {
// A legacy app hands its hash to the app as `context.hash`.
expect(drawerAnchorFor('/apps/get/u/me/dashboard#tab=2')).toBeUndefined()
expect(drawerAnchorFor('/runs?path=u/me/foo')).toBeUndefined()
expect(drawerAnchorFor('/schedules')).toBeUndefined()
})
})
describe('describeLocation', () => {
it('reads a query param as the view only when a request could have set it', () => {
// Runs: the filters are what the tab shows.
expect(showsView('/runs?path=u/me/a', '/runs')).toBe(false)
// A list page writes its own defaults back; that is not a different view.
expect(describeLocation('/routes?filter_path_of=trigger').view).toBe('')
expect(showsView('/routes', '/routes?filter_path_of=trigger')).toBe(true)
expect(showsView('/runs?path=a', '/runs?path=b')).toBe(false)
})
it('separates the two authors on a page that has both', () => {
// Audit logs page itself its paging, while a request sets the filters. Reading
// its paging as the view makes re-opening the page look like a navigation away
// and reload it, throwing away wherever the user had paged to.
expect(showsView('/audit_logs', '/audit_logs?page=1&perPage=100')).toBe(true)
expect(showsView('/audit_logs?username=a', '/audit_logs?username=b')).toBe(false)
})
it('counts every filter its page offers, not just the ones the chat can set', () => {
// The names come from each page's own filter schema. A filter the user sets in the
// frame but the chat cannot request is still the view they chose, so leaving it out
// would let a filtered tab answer a request for the unfiltered page.
expect(showsView('/variables', '/variables?description=api')).toBe(false)
expect(showsView('/resources', '/resources?label=prod')).toBe(false)
expect(showsView('/assets', '/assets?asset_kinds=s3')).toBe(false)
})
it('counts a filter only some viewers can reach', () => {
// `all_workspaces` exists only for a superadmin in the admins workspace, and the
// Runs entry point carries the live query into the preview wholesale. Left out of
// the vocabulary it reads as the page's own, and an all-workspaces tab would
// answer a request for the workspace-scoped view.
expect(showsView('/runs?all_workspaces=true', '/runs')).toBe(false)
expect(showsView('/schedules?user_folders_only=true', '/schedules')).toBe(false)
})
it('lets a page restore a filter the request never mentioned', () => {
// Runs seeds `job_trigger_kind` / `show_future_jobs` from the user's stored
// preference whenever the URL it loads with is silent about them. Reading that as
// another view reloads the tab onto a page that seeds it right back.
expect(showsView('/runs?job_trigger_kind=!schedule', '/runs')).toBe(true)
expect(showsView('/runs?show_future_jobs=false', '/runs')).toBe(true)
// One direction only: a request that names one still has to reach a frame showing
// something else, and the concession is per page — nothing seeds these elsewhere.
expect(showsView('/runs', '/runs?job_trigger_kind=schedule')).toBe(false)
expect(showsView('/runs?job_trigger_kind=!schedule', '/runs?job_trigger_kind=schedule')).toBe(
false
)
expect(showsView('/runs?job_trigger_kind=!schedule&path=a', '/runs')).toBe(false)
})
it('keeps a requested filter a different view on a page that writes none', () => {
// Schedules never rewrites its own query, so a requested filter is the whole
// difference — treating it as page state drops the filter and reports success.
expect(showsView('/schedules', '/schedules?path=u/me/daily')).toBe(false)
expect(showsView('/variables', '/variables?owner=u/me')).toBe(false)
})
it('reads the hash as a row only where the page deep-links rows', () => {
expect(describeLocation('/schedules#u/me/daily').anchor).toBe('u/me/daily')
expect(describeLocation('/resources#/resource/u/me/db').anchor).toBe('u/me/db')
// A legacy app hands its hash to the app as `context.hash`.
expect(describeLocation('/apps/edit/u/me/dash#tab=2').anchor).toBe('')
expect(showsView('/apps/edit/u/me/dash', '/apps/edit/u/me/dash#tab=2')).toBe(true)
})
it('keeps an artifact addressed by id, not by URL grammar', () => {
// `new URL` parses `artifact:` as a scheme and would drop it.
expect(describeLocation('artifact:abc-123#My Doc').identity).toBe('artifact:abc-123')
expect(showsView('artifact:abc-123#Old name', 'artifact:abc-123#New name')).toBe(true)
expect(showsView('artifact:abc-123', 'artifact:def-456')).toBe(false)
})
it('keeps a value holding a delimiter apart from two filters', () => {
// Decoded, one `arg` whose value is `x&result=y` reads exactly like `arg` plus
// `result` — collapsing them focuses the open tab and drops the filter asked for.
expect(showsView('/runs?arg=x%26result%3Dy', '/runs?arg=x&result=y')).toBe(false)
// The re-encoding a page does to what it was handed is still not a change of view.
expect(showsView('/runs?path=f/crm/x', '/runs?path=f%2Fcrm%2Fx')).toBe(true)
})
it('ignores the params the preview host injects, and param order', () => {
expect(showsView('/runs?path=a', '/runs?path=a&nomenubar=true&workspace=ws')).toBe(true)
expect(showsView('/runs?path=a&status=running', '/runs?status=running&path=a')).toBe(true)
})
})
describe('previewLocationContext', () => {
it('keeps the page, the recognized filters and the anchored row', () => {
expect(previewLocationContext('/runs?path=u/me/a&status=failed')).toEqual({
label: 'Runs',
location: '/runs?path=u%2Fme%2Fa&status=failed',
open: undefined
})
expect(previewLocationContext('/schedules#u/me/daily')).toEqual({
label: 'Schedules',
location: '/schedules',
open: 'u/me/daily'
})
})
it('drops state the page owns rather than passing a location through whole', () => {
// A legacy app's hash is whatever its author put there, and the chat has no
// redaction boundary — it must never reach the model.
expect(previewLocationContext('/apps/get/u/me/dash#token=sk-secret').location).toBe(
'/apps/get/u/me/dash'
)
// Same for a param no page declares, and for the ones a page writes itself.
expect(previewLocationContext('/runs?unknown=sk-secret').location).toBe('/runs')
expect(previewLocationContext('/routes?filter_path_of=trigger').location).toBe('/routes')
})
it('cannot write a line of its own into the prompt block', () => {
// These fields render as `key: value` lines of ACTIVE PREVIEW, and a shared link is
// attacker-shaped input: a newline in a filter would forge an `open:` of its own.
const forged = previewLocationContext('/runs?concurrency_key=x%0Aopen:%20f/admin/target')
expect(forged.location).not.toContain('\n')
expect(forged.location).toBe('/runs?concurrency_key=x%0Aopen%3A%20f%2Fadmin%2Ftarget')
// A Unicode terminator breaks a line just as a newline does, and arrives decoded.
const uni = previewLocationContext('/runs?concurrency_key=x%E2%80%A8open:%20f/admin/target')
expect(uni.location).not.toMatch(/[\u2028\u2029]/)
expect(previewLocationContext('/run/abc%E2%80%A9open:%20x').label).not.toMatch(/[\u2028\u2029]/)
// The label is decoded out of the path, so it is free text too.
expect(previewLocationContext('/run/abc%0Aopen:%20x').label).not.toContain('\n')
})
it('keeps the name but not the value of a filter that searches content', () => {
// These search *over* what they filter: a job's arguments and result, a variable's
// or resource's value, the free-text box. Their values are the content itself.
expect(previewLocationContext('/runs?arg=sk-secret&result=sk-secret').location).toBe(
'/runs?arg&result'
)
expect(previewLocationContext('/variables?value=sk-secret').location).toBe('/variables?value')
expect(previewLocationContext('/resources?value=sk-secret').location).toBe('/resources?value')
expect(previewLocationContext('/runs?_default_=sk-secret').location).toBe('/runs?_default_')
// Addressing filters alongside them still carry their value.
expect(previewLocationContext('/runs?path=u/me/a&arg=sk-secret').location).toBe(
'/runs?arg&path=u%2Fme%2Fa'
)
})
})
describe('matchReusablePage', () => {
it('matches curated pages and the compare page, ignoring query params', () => {
expect(matchReusablePage('/runs?path=f/a/b')?.path).toBe('/runs')
@@ -20,7 +183,7 @@ describe('matchReusablePage', () => {
expect(previewLocationLabel('/forks/compare?workspace_id=ws')).toBe('Compare & Deploy')
})
it('does not match trigger pages (they dedupe on exact URL)', () => {
it('does not match trigger pages (they re-point via the generic open path)', () => {
expect(matchReusablePage('/kafka_triggers')).toBeUndefined()
})
})
frontend/src/lib/components/sessions/previewRouter.ts
+289 -73
View File
@@ -1,4 +1,33 @@
import { base } from '$lib/base'
import {
ASSETS_PATH,
AUDIT_LOGS_PATH,
FOLDERS_PATH,
GROUPS_PATH,
pageKey,
pageHref,
parsePreviewItemRoute,
RESOURCES_PATH,
RUNS_PATH,
SCHEDULES_PATH,
stripBase,
VARIABLES_PATH,
WORKSPACE_SETTINGS_PATH,
triggerLabelForPath,
TRIGGER_PAGES,
type PreviewItemRoute,
type TriggerKind
} from './previewPaths'
// Re-exported so the preview code that already reads locations through this module keeps
// one import, while a caller needing only a path can reach for the leaf instead.
export {
pageKey,
pageHref,
parsePreviewItemRoute,
stripBase,
TRIGGER_PAGES,
type PreviewItemRoute,
type TriggerKind
}
import {
Home,
Play,
@@ -13,8 +42,14 @@ import {
ScrollText
} from 'lucide-svelte'
import type { DrillIcon } from '$lib/components/drillPicker'
import { buildRunsFilterSearchbarSchema } from '$lib/components/runs/runsFilter'
import { buildSchedulesFilterSchema } from '$lib/components/schedules/schedulesFilter'
import { buildVariablesFilterSchema } from '$lib/components/variables/variablesFilter'
import { buildResourcesFilterSchema } from '$lib/components/resources/resourcesFilter'
import { buildAssetsFilterSchema } from '$lib/components/assets/assetsFilter'
import { COMPARE_ITEMS_PARAM } from './modifiedItemsMask'
import { normalizePipelineFolder } from '$lib/utils/pipelineFolder'
import type { WorkspaceItem, WorkspaceItemKind } from '$lib/components/workspacePicker'
import type { WorkspaceItem } from '$lib/components/workspacePicker'
import type { SessionTargetKind } from './sessionRuntime.svelte'
/** What the preview breadcrumb picker can route to: a static workspace page
@@ -32,54 +67,17 @@ export type PreviewPage = { label: string; path: string; icon: DrillIcon }
// EE/feature gating in SidebarContent and aren't worth duplicating here).
export const PREVIEW_PAGES: PreviewPage[] = [
{ label: 'Home', path: '/', icon: Home },
{ label: 'Runs', path: '/runs', icon: Play },
{ label: 'Variables', path: '/variables', icon: DollarSign },
{ label: 'Resources', path: '/resources', icon: Boxes },
{ label: 'Schedules', path: '/schedules', icon: Calendar },
{ label: 'Assets', path: '/assets', icon: Database },
{ label: 'Folders', path: '/folders', icon: FolderOpen },
{ label: 'Groups', path: '/groups', icon: Users },
{ label: 'Workspace settings', path: '/workspace_settings', icon: Settings },
{ label: 'Audit logs', path: '/audit_logs', icon: ScrollText }
{ label: 'Runs', path: RUNS_PATH, icon: Play },
{ label: 'Variables', path: VARIABLES_PATH, icon: DollarSign },
{ label: 'Resources', path: RESOURCES_PATH, icon: Boxes },
{ label: 'Schedules', path: SCHEDULES_PATH, icon: Calendar },
{ label: 'Assets', path: ASSETS_PATH, icon: Database },
{ label: 'Folders', path: FOLDERS_PATH, icon: FolderOpen },
{ label: 'Groups', path: GROUPS_PATH, icon: Users },
{ label: 'Workspace settings', path: WORKSPACE_SETTINGS_PATH, icon: Settings },
{ label: 'Audit logs', path: AUDIT_LOGS_PATH, icon: ScrollText }
]
// Trigger list pages, by kind. Deliberately kept out of PREVIEW_PAGES (the curated
// breadcrumb picker) but shared here so open_page can route to them and the preview tab
// can label them. `ee` kinds require an enterprise license. Each supports `#<path>` to
// open a specific trigger, like Schedules.
export type TriggerKind =
| 'http'
| 'websocket'
| 'postgres'
| 'kafka'
| 'nats'
| 'sqs'
| 'gcp'
| 'azure'
| 'mqtt'
| 'amqp'
| 'email'
export const TRIGGER_PAGES: Record<TriggerKind, { path: string; label: string; ee?: boolean }> = {
http: { path: '/routes', label: 'HTTP routes' },
websocket: { path: '/websocket_triggers', label: 'WebSocket triggers' },
postgres: { path: '/postgres_triggers', label: 'Postgres triggers' },
kafka: { path: '/kafka_triggers', label: 'Kafka triggers', ee: true },
nats: { path: '/nats_triggers', label: 'NATS triggers', ee: true },
sqs: { path: '/sqs_triggers', label: 'SQS triggers', ee: true },
gcp: { path: '/gcp_triggers', label: 'GCP Pub/Sub triggers', ee: true },
azure: { path: '/azure_triggers', label: 'Azure Event Grid triggers', ee: true },
mqtt: { path: '/mqtt_triggers', label: 'MQTT triggers' },
amqp: { path: '/amqp_triggers', label: 'AMQP triggers' },
email: { path: '/email_triggers', label: 'Email triggers' }
}
/** Label a trigger list page from its (base-stripped) pathname, or undefined. */
export function triggerLabelForPath(path: string): string | undefined {
const clean = stripBase(path)
return Object.values(TRIGGER_PAGES).find((t) => t.path === clean)?.label
}
// The Compare & Deploy review page. Kept out of PREVIEW_PAGES (it's not a picker
// destination — it's reached through the chat's open_page tool or a session's
// Review button) but known here so preview tabs label it and reuse it on
@@ -90,15 +88,248 @@ export const COMPARE_PAGE: PreviewPage = {
icon: GitCompareArrows
}
export const pageKey = (path: string) => `page:${path}`
export const pageHref = (path: string) => `${base}${path}`
// Workspace list pages that deep-link one row through the hash. Resources route
// theirs through an extra `/resource/` segment. Nothing else may be read that way:
// a legacy drag-and-drop app hands its hash to the app itself as `context.hash`,
// so treating that as a row would describe app state as a workspace item.
const DRAWER_ANCHOR_PAGES = [SCHEDULES_PATH, VARIABLES_PATH, RESOURCES_PATH] as const
/** Strip the deployment base prefix (and any query/hash) from a preview path
* so it can be matched against `PREVIEW_PAGES` / parsed as an item route. */
export function stripBase(path: string): string {
let p = path.split('?')[0].split('#')[0]
if (base && p.startsWith(base)) p = p.slice(base.length)
return p || '/'
/** The workspace item whose drawer a preview location has open, or undefined when
* the page doesn't deep-link rows (or none is anchored). Takes the location with
* its suffix — a raw href, or an observed location. */
export function drawerAnchorFor(location: string): string | undefined {
const hashAt = location.indexOf('#')
if (hashAt < 0) return undefined
const route = stripBase(location)
const known =
(DRAWER_ANCHOR_PAGES as readonly string[]).includes(route) ||
Object.values(TRIGGER_PAGES).some((p) => p.path === route)
if (!known) return undefined
return location.slice(hashAt + 1).replace(/^\/resource\//, '') || undefined
}
// Query params the preview host injects into an iframe URL (`nomenubar` hides the nav,
// `workspace` scopes the page). Never part of what a location means.
const INJECTED_PARAMS = ['nomenubar', 'workspace'] as const
/** Drop the params the preview host injects, so a location observed in the frame can be
* compared with the one that was commanded (which never carries them). */
export function canonicalizeObservedLoc(loc: string): string {
// An artifact is a scheme, not a path — `new URL` would happily parse it and hand
// back a pathname with the scheme gone.
if (parseArtifactRoute(loc)) return loc
try {
const u = new URL(loc, 'http://_')
for (const p of INJECTED_PARAMS) u.searchParams.delete(p)
return u.pathname + u.search + u.hash
} catch {
return loc
}
}
// The query params belonging to the request; every other one the page wrote into its own
// URL (`filter_path_of`, `page`/`perPage`) and must not read as a view. A page's own
// filter schema is the list, with every option on so the set is its whole vocabulary and
// not one viewer's subset. Built on first use — every trigger drawer imports this module.
let requestParams: Record<string, readonly string[]> | undefined
function pageRequestParamTable(): Record<string, readonly string[]> {
return (requestParams ??= {
[RUNS_PATH]: Object.keys(
buildRunsFilterSearchbarSchema({
paths: [],
usernames: [],
folders: [],
jobTriggerKinds: [],
isSuperAdminOrDevops: true,
isAdminsWorkspace: true
})
),
[SCHEDULES_PATH]: Object.keys(
buildSchedulesFilterSchema({ paths: [], scriptPaths: [], showUserFoldersFilter: true })
),
[VARIABLES_PATH]: Object.keys(
buildVariablesFilterSchema({ paths: [], owners: [], showUserFoldersFilter: true })
),
[RESOURCES_PATH]: Object.keys(
buildResourcesFilterSchema({
paths: [],
resourceTypes: [],
owners: [],
showUserFoldersFilter: true
})
),
[ASSETS_PATH]: Object.keys(buildAssetsFilterSchema({ paths: [], assetKinds: [] })),
[AUDIT_LOGS_PATH]: ['username', 'operation', 'resource'],
[WORKSPACE_SETTINGS_PATH]: ['tab'],
[COMPARE_PAGE.path]: ['workspace_id', 'mode', COMPARE_ITEMS_PARAM]
})
}
/** The query params a request can set on `path` — empty for a page that takes none. */
export function pageRequestParams(path: string): readonly string[] {
return pageRequestParamTable()[stripBase(path)] ?? []
}
/** What a preview location means, read against the page it points at. */
export type PreviewLocation = {
/** What two locations must share to be the same tab. */
identity: string
/** The view within that page: only the params a request could have set. */
view: string
/** The row the page deep-links, `''` where the hash is the page's own state. */
anchor: string
}
/** Decompose a preview location into what it means. Everything comparing two locations
* goes through this: a query or a hash means something different per class of page, and
* answering that at the call site is how a tab ends up duplicated, reloaded, or reported
* as showing a row it is not. The page classes live here and only here. */
export function describeLocation(loc: string): PreviewLocation {
const artifact = parseArtifactRoute(loc)
if (artifact) return { identity: `artifact:${artifact.id}`, view: '', anchor: '' }
const canonical = canonicalizeObservedLoc(loc)
const path = stripBase(canonical)
const bare = canonical.split('#')[0]
const query = bare.includes('?') ? bare.slice(bare.indexOf('?') + 1) : ''
return {
identity: path,
view: requestedParams(query, pageRequestParamTable()[path]),
anchor: drawerAnchorFor(canonical) ?? ''
}
}
// By content, never by the raw string: a page hands its params back in its own order and
// re-encodes what it was given (`path=f/a` arrives as `path=f%2Fa`), and neither is a
// change of view. Re-encoded on the way out so a value holding a delimiter stays one
// pair — decoded, `?arg=x%26result%3Dy` and `?arg=x&result=y` read alike.
function requestedParams(query: string, allowed: readonly string[] | undefined): string {
if (!allowed?.length) return ''
const parts: string[] = []
new URLSearchParams(query).forEach((v, k) => {
if (allowed.includes(k)) parts.push(`${encodeURIComponent(k)}=${encodeURIComponent(v)}`)
})
return parts.sort().join('&')
}
// Params a page restores from the user's stored preference whenever the URL it loads with
// says nothing about them. Requestable like any other filter, so they stay in the view —
// but a frame carrying one the request never mentioned is the page's own doing, and
// loading over it lands on a page that seeds it straight back, scroll position gone.
const PAGE_SEEDED_PARAMS: Record<string, readonly string[]> = {
[RUNS_PATH]: ['job_trigger_kind', 'show_future_jobs']
}
/** Whether the frame at `observed` is already showing what `commanded` asks for: same
* page, same row, and every filter the request names carrying the value it named. */
export function showsView(observed: string, commanded: string): boolean {
const x = describeLocation(observed)
const y = describeLocation(commanded)
if (x.identity !== y.identity || x.anchor !== y.anchor) return false
if (x.view === y.view) return true
const seeded = PAGE_SEEDED_PARAMS[x.identity]
if (!seeded?.length) return false
// Both views come out of `requestedParams` already sorted and encoded, so they compare
// as strings once the seeded params are dropped. One direction only: the page may add
// what the request left out, never drop what it asked for — dropping in both would let
// a tab answer a request it does not satisfy.
const pairs = (view: string) => (view ? view.split('&') : [])
const keyOf = (pair: string) => decodeURIComponent(pair.split('=')[0])
const asked = new Set(pairs(y.view).map(keyOf))
return (
pairs(x.view)
.filter((pair) => !seeded.includes(keyOf(pair)) || asked.has(keyOf(pair)))
.join('&') === y.view
)
}
// Filters whose value addresses a workspace object — a path, owner, kind, state, time —
// and so may be repeated to the model. Any other keeps its name and loses its value: the
// rest search *over* content (the free-text box, a job's result, a resource's value), and
// withholding by default means a filter added later leaks nothing until it is listed.
const ADDRESSING_PARAMS = new Set([
'path',
'path_start',
'schedule_path',
'script_path',
'asset_path',
'usage_path',
'owner',
'user',
'username',
'folder',
'worker',
'tag',
'label',
'resource_type',
'asset_kinds',
'job_kinds',
'job_trigger_kind',
'operation',
'resource',
'concurrency_key',
'status',
'min_ts',
'max_ts',
'timeframe',
'all_workspaces',
'show_skipped',
'show_future_jobs',
'resolved',
'user_folders_only',
'columns',
'tab',
'workspace_id',
'mode',
COMPARE_ITEMS_PARAM
])
const CONTEXT_FIELD_MAX = 300
/** Collapse a value to one field of prompt text or a tool result. Both are line-oriented
* formats with no escaping, so a value carrying a newline writes a line of its own — and
* these values are decoded out of URLs, which are attacker-shaped input the moment a link
* can be shared. Length is capped too: a path this long tells the model nothing. */
export function promptSafe(text: string): string {
// C0 and DEL, plus the Unicode terminators a renderer also breaks a line on — these
// values are percent-decoded, so `%E2%80%A8` arrives as a real U+2028.
// eslint-disable-next-line no-control-regex
return text
.replace(/[\u0000-\u001f\u007f\u0085\u2028\u2029]+/g, ' ')
.trim()
.slice(0, CONTEXT_FIELD_MAX)
}
/** How a preview location may be described to the model: reassembled from the parts this
* module recognizes, never passed through whole. A tab can host a legacy app whose hash is
* app state, and a filter can search contents rather than address them — so only the
* addressing ones keep their value, the chat having no redaction boundary of its own. */
export function previewLocationContext(loc: string): {
label: string
location: string
open?: string
} {
const { identity, anchor } = describeLocation(loc)
const bare = canonicalizeObservedLoc(loc).split('#')[0]
const query = bare.includes('?') ? bare.slice(bare.indexOf('?') + 1) : ''
const declared = pageRequestParams(identity)
const filters: string[] = []
new URLSearchParams(query).forEach((v, k) => {
// Re-encoded for the same reason the view is: decoded, a value holding `&` or `=`
// reads as another filter entirely.
if (declared.includes(k)) {
const key = encodeURIComponent(k)
filters.push(ADDRESSING_PARAMS.has(k) ? `${key}=${encodeURIComponent(v)}` : key)
}
})
return {
// Labels come from route shape (page name, trigger kind, run id, item leaf), so
// they carry no query or hash of their own — but a run id and an item leaf are
// decoded out of the path, so they still reach here as free text.
label: promptSafe(previewLocationLabel(loc)),
location: promptSafe(identity + (filters.length ? `?${filters.sort().join('&')}` : '')),
open: anchor ? promptSafe(anchor) : undefined
}
}
// Match a base-stripped preview pathname to a known page, for breadcrumb
@@ -111,7 +342,8 @@ export function matchPreviewPage(path: string): PreviewPage | undefined {
/** Match a preview href to a page whose tab should be re-pointed in place when
* only its query params change (the open_page filter-change behavior): the
* curated pages plus the compare page. Trigger pages are deliberately not
* matched — their tabs dedupe on the exact URL instead. */
* matched — they take the generic path in `SessionPreviewTabs.open`, which
* dedupes on the location ignoring the hash and re-points the tab it finds. */
export function matchReusablePage(href: string): PreviewPage | undefined {
if (stripBase(href) === COMPARE_PAGE.path) return COMPARE_PAGE
return matchPreviewPage(href)
@@ -166,22 +398,6 @@ export function itemDisplayName(
return summary?.trim() || draftFriendlyLeaf(storagePath, friendlyPath)
}
export type PreviewItemRoute = { kind: WorkspaceItemKind; raw_app: boolean; itemPath: string }
// Parse a preview URL/pathname into the workspace item it edits, or null for a
// non-item page (home, runs, …). Shared by the breadcrumb (drill segments) and
// the tab resolver below so both agree on what counts as an item route.
export function parsePreviewItemRoute(fullPath: string): PreviewItemRoute | null {
const p = stripBase(fullPath)
const m = p.match(/^\/(scripts|flows|apps|apps_raw)\/(?:edit|get)\/(.+)$/)
if (!m) return null
const itemPath = decodeURIComponent(m[2])
if (m[1] === 'scripts') return { kind: 'script', raw_app: false, itemPath }
if (m[1] === 'flows') return { kind: 'flow', raw_app: false, itemPath }
if (m[1] === 'apps_raw') return { kind: 'app', raw_app: true, itemPath }
return { kind: 'app', raw_app: false, itemPath }
}
// The place inside a previewed flow editor its tab URL asks for (`?selected=`,
// the same param the full-page flow editor reads). Live editors are mounted in
// process rather than in an iframe, so the host has to read this off the tab URL
frontend/src/lib/components/sessions/sessionPreviewTabs.svelte.ts
+133 -46
View File
@@ -4,9 +4,14 @@ import { editPathFor, type WorkspaceItem } from '$lib/components/workspacePicker
import { normalizePipelineFolder } from '$lib/utils/pipelineFolder'
import {
artifactUrl,
canonicalizeObservedLoc,
describeLocation,
matchPreviewPage,
showsView,
parseArtifactRoute,
parsePipelineRoute,
previewLocationContext,
promptSafe,
parsePreviewItemRoute,
previewLocationLabel,
resolvePreviewTab,
@@ -87,20 +92,21 @@ function retargetTab(tab: SessionPreviewTab, url: string): void {
tab.loc = url
}
// Strip the query params the sessions preview injects into iframe URLs
// (`nomenubar` to hide the nav, `workspace` to scope the page): they aren't part
// of the canonical page URL. The observed `loc` must drop them to stay symmetric
// with `url` (targetUrl, which never carries them), else reopening the same page
// spawns a duplicate tab instead of focusing the existing one.
export function canonicalizeObservedLoc(loc: string): string {
try {
const u = new URL(loc, 'http://_')
u.searchParams.delete('nomenubar')
u.searchParams.delete('workspace')
return u.pathname + u.search + u.hash
} catch {
return loc
}
// A tab carries two locations and each write touches a different one, so the choice is a
// function name rather than a judgement: `url` is what we last commanded and what the host
// loads; `loc` is where the frame actually went, written only by the observer.
/** The frame is already showing `url` — record what was asked for without moving it. A
* refresh and a remount both reload from `url`, so leaving it behind sends the tab back to
* wherever it started. */
function recordCommand(tab: SessionPreviewTab, url: string): void {
tab.url = url
}
/** Where the tab is, as well as we know: the frame's own location once it has reported
* one, else what we commanded. */
export function whereIs(tab: Pick<SessionPreviewTab, 'url' | 'loc'>): string {
return tab.loc || tab.url
}
// The editor target a destination maps to, or undefined when it isn't an item we
@@ -173,7 +179,7 @@ export function hydratePreviewTabs(session: {
seen.add(t.id)
// Rebuilt field-by-field so stray properties on old saved records (e.g. the
// retired `pinned` flag) don't survive hydration and get persisted back.
tabs.push({ id: t.id, url: t.url, loc: t.loc ?? t.url })
tabs.push({ id: t.id, url: t.url, loc: t.loc || t.url })
}
if (tabs.length > 0) {
const wantActive = session.activePreviewTabId
@@ -240,6 +246,12 @@ export class SessionPreviewTabs {
get activeTab(): SessionPreviewTab | undefined {
return this.#tabs.find((t) => t.id === this.#activeId) ?? this.#tabs[0]
}
/** The tab the user can actually see, or undefined when the panel is not on
* screen. Anything describing the preview to the user (or to the chat) wants
* this, not `activeTab` — which answers for a collapsed panel too. */
get displayedTab(): SessionPreviewTab | undefined {
return this.#displayedTab()
}
get collapsed(): boolean {
return this.#collapsed
}
@@ -260,10 +272,30 @@ export class SessionPreviewTabs {
return this.#reloadPulse
}
// Ask the tab's host to reload its iframe. Needed when a navigation targets the
// tab's exact current URL: nothing changes, so URL-driven behavior in the page
// (e.g. a #<path> hash opening an edit drawer the user has since closed) would
// never re-fire without a forced load.
// Point a tab at `url` and make sure the frame follows. The host navigates off a
// change of the commanded `url`, so re-commanding one a tab already points at moves
// nothing — exactly the case where `loc` shows the frame drifted elsewhere.
#retarget(tab: SessionPreviewTab, url: string): void {
const commandUnchanged = tab.url === url
// Drift is a change of what the frame *shows*, not of its URL string: a page
// writing its own filter defaults back is not the user navigating away.
const drifted = !showsView(tab.loc, url)
// Both cases the browser will not act on, decided here because this is where the
// old and new commands are both in hand: re-commanding the URL a drifted frame
// already carries moves nothing, and moving to another fragment resolves within the
// same document — so a list page never re-runs the `#<path>` read that opens a row.
// Dropping the fragment is not one of them: the same-document path applies only to a
// target that has one, so the browser loads the page — closing the drawer by itself —
// and forcing a second load races that one back onto the row.
const fragmentOnly =
!commandUnchanged && url.includes('#') && tab.url.split('#')[0] === url.split('#')[0]
retargetTab(tab, url)
if ((commandUnchanged && drifted) || fragmentOnly) this.pulseReload(tab.id)
}
// Force the host to reload the iframe. A navigation onto the tab's exact current URL
// changes nothing, so URL-driven behavior — a `#<path>` opening a drawer the user has
// since closed — would never re-fire.
pulseReload(id: string): void {
this.#reloadPulse = { id, nonce: this.#reloadPulse.nonce + 1 }
}
@@ -331,11 +363,20 @@ export class SessionPreviewTabs {
// Open — or focus, if already shown — a tab for a destination, and reveal the
// panel. An editable item dedupes against the tab already hosting that same
// (kind, path); anything else dedupes on the tab's observed location.
open(target: PreviewTarget): { status: 'opened' | 'focused' } {
return this.#pulsingIfUnchanged(() => this.#open(target))
// `forceNewTab` opts a page out of that location dedupe (open_page's `new_tab`).
// It deliberately does not reach the item, pipeline and artifact branches: those
// dedupe because a second tab would fight over one piece of shared state.
open(
target: PreviewTarget,
opts?: { forceNewTab?: boolean }
): { status: 'opened' | 'focused' | 'retargeted' } {
return this.#pulsingIfUnchanged(() => this.#open(target, opts))
}
#open(target: PreviewTarget): { status: 'opened' | 'focused' } {
#open(
target: PreviewTarget,
opts?: { forceNewTab?: boolean }
): { status: 'opened' | 'focused' | 'retargeted' } {
const editorTarget = editorTargetFor(target)
// A fresh session starts collapsed, so without this the tab opens behind a
// collapsed panel and the user sees nothing change.
@@ -360,7 +401,7 @@ export class SessionPreviewTabs {
const existing = this.#tabs.find((t) => parsePipelineRoute(t.url) !== null)
if (existing) {
const same = existing.url === url
retargetTab(existing, url)
this.#retarget(existing, url)
this.#activeId = existing.id
this.#flush()
return { status: same ? 'focused' : 'opened' }
@@ -374,25 +415,37 @@ export class SessionPreviewTabs {
// see keptVersion), else preserving a pin would report 'opened' with nothing moved.
const kept = targetUrl(target, existing)
const same = existing.url === kept
existing.url = kept
existing.loc = kept
retargetTab(existing, kept)
this.#activeId = existing.id
this.#flush()
return { status: same ? 'focused' : 'opened' }
}
}
// Focus the tab currently *showing* this destination instead of opening a
// duplicate. Matched on the observed `loc`, not `url`: a tab that was
// opened here but navigated away no longer counts as showing it. Both sides
// are canonicalized because a caller may bake `?workspace=` into the href
// (the frame re-injects it from the session anyway) while the observed loc
// has had it stripped — comparing raw would reopen the page as a duplicate.
const canonicalUrl = canonicalizeObservedLoc(url)
const shown = this.#tabs.find((t) => canonicalizeObservedLoc(t.loc) === canonicalUrl)
// Matched on the observed `loc`, not `url`: a tab that navigated away no longer
// shows this. The tab on this exact view wins over any other on the page —
// `new_tab` puts two views side by side, and retargeting whichever sits first
// would overwrite the other and leave both on the same row.
const shown = opts?.forceNewTab
? undefined
: (this.#tabs.find((t) => showsView(t.loc, url)) ??
this.#tabs.find((t) => describeLocation(t.loc).identity === describeLocation(url).identity))
if (shown) {
const same = showsView(shown.loc, url)
if (same) {
// The frame is already here, but record what was asked for: `url` is what the
// tab persists and remounts from, so leaving it on where the frame started
// sends a refresh back to the row the user has since moved off.
recordCommand(shown, url)
// Nothing to navigate to, so nothing would re-run: the list pages read their
// `#<path>` once per document, and the drawer it opens may since have been
// closed. Only a forced load can bring it back.
if (describeLocation(url).anchor) this.pulseReload(shown.id)
} else {
this.#retarget(shown, url)
}
this.#activeId = shown.id
this.#flush()
return { status: 'focused' }
return { status: same ? 'focused' : 'retargeted' }
}
const tab: SessionPreviewTab = { id: randomUUID(), url, loc: url }
this.#tabs.push(tab)
@@ -431,7 +484,7 @@ export class SessionPreviewTabs {
if (pipelineFolder) {
const existing = this.#tabs.find((x) => parsePipelineRoute(x.url) !== null)
if (existing && existing.id !== t.id) {
retargetTab(existing, targetUrl(target, existing))
this.#retarget(existing, targetUrl(target, existing))
this.#activeId = existing.id
this.#flush()
return
@@ -443,13 +496,13 @@ export class SessionPreviewTabs {
if (target.type === 'artifact') {
const existing = this.#tabs.find((x) => parseArtifactRoute(x.url)?.id === target.id)
if (existing && existing.id !== t.id) {
retargetTab(existing, targetUrl(target, existing))
this.#retarget(existing, targetUrl(target, existing))
this.#activeId = existing.id
this.#flush()
return
}
}
retargetTab(t, targetUrl(target, t))
this.#retarget(t, targetUrl(target, t))
this.#flush()
}
@@ -523,14 +576,23 @@ export class SessionPreviewTabs {
}
// Feed back the location an iframe reported on load (only the page can read
// contentWindow.location). Updates the observed `loc`, leaving `url` alone so
// the tab doesn't reload.
// contentWindow.location). Updates the observed `loc`; `url` follows only when a
// drawer closed (below), and the host navigates on a command it isn't already at,
// so that write does not move the frame.
observeLocation(id: string, loc: string): void {
const t = this.#tabs.find((x) => x.id === id)
if (!t) return
const canonical = canonicalizeObservedLoc(loc)
if (t.loc === canonical) return
t.loc = canonical
// Closing a drawer drops the row from the frame's URL. The command has to follow, or
// the tab reopens it on the next mount — the iframe loads `url`, not `loc`. Only the
// anchor: any other in-frame move is the user browsing, which must not re-command.
const commanded = describeLocation(t.url)
const observed = describeLocation(canonical)
if (commanded.anchor && !observed.anchor && commanded.identity === observed.identity) {
t.url = t.url.split('#')[0]
}
this.#flush()
}
@@ -604,7 +666,7 @@ export function selectPreviewTabsToClose(
const needle = opts.match?.trim().toLowerCase()
if (!needle) return []
return tabs.filter((t) => {
const where = t.loc || t.url
const where = whereIs(t)
return (
previewLocationLabel(where).toLowerCase().includes(needle) ||
where.toLowerCase().includes(needle)
@@ -612,13 +674,31 @@ export function selectPreviewTabsToClose(
})
}
// A list page's query and hash carry what the page label drops: the filters in
// force and, on the pages that deep-link one (`/schedules#u/me/daily`), the row
// whose drawer is open. Empty for a bare page, so a plain tab costs nothing.
// This string is a tool result, so it is assembled from the parts previewRouter
// recognizes rather than from the location itself: an iframe tab can host a legacy app,
// whose hash is app state, and any page can carry a filter value the user typed.
function previewLocationDetail(where: string): string {
const { location, open } = previewLocationContext(where)
const detail = [location === stripBase(where) ? undefined : location, open && `open: ${open}`]
.filter(Boolean)
.join(', ')
return detail ? ` (${detail})` : ''
}
// Human-readable summary of a session's open preview tabs, for the
// `get_preview_status` AI tool. Pure over the owner's model. The "no session"
// case is the caller's (the tool handler has the session context).
export function describePreview(tabs: SessionPreviewTab[], activeId: string): string {
export function describePreview(
tabs: SessionPreviewTab[],
activeId: string,
onScreen: boolean = true
): string {
if (tabs.length === 0) return 'No preview tabs are open in the side panel.'
const lines = tabs.map((t) => {
const where = t.loc || t.url
const where = whereIs(t)
const artifact = parseArtifactRoute(where)
const page = matchPreviewPage(where)
const pipelineFolder = parsePipelineRoute(where)
@@ -628,15 +708,22 @@ export function describePreview(tabs: SessionPreviewTab[], activeId: string): st
// summary would tell it so.
`artifact "${artifact.name || 'Artifact'}"${artifact.version ? ` (pinned to v${artifact.version})` : ''}`
: page
? `page "${page.label}"`
? `page "${page.label}"${previewLocationDetail(where)}`
: pipelineFolder
? `pipeline "${pipelineFolder}"`
: route
? `${route.raw_app ? 'raw_app' : route.kind} "${route.itemPath}"`
: stripBase(where)
: // Trigger list pages land here (they're outside PREVIEW_PAGES), and
// their `#<path>` is the trigger the drawer has open.
`${stripBase(where)}${previewLocationDetail(where)}`
const live = resolvePreviewTab(t.url).kind === 'editor' ? ', live editor' : ''
const active = t.id === activeId ? ', active' : ''
return `- ${label}${live}${active}`
// One list entry per tab: an artifact's name, a pipeline folder and an item path
// all arrive decoded from a URL, so any of them could otherwise write a line here.
return `- ${promptSafe(label)}${live}${active}`
})
return `${tabs.length} preview tab${tabs.length === 1 ? '' : 's'} open in the side panel:\n${lines.join('\n')}`
// Whether a tab is *selected* and whether the user can *see* it are different facts,
// and both descriptions the chat receives have to agree on the second one.
const hidden = onScreen ? '' : '\nThe side panel is collapsed, so none of these is on screen.'
return `${tabs.length} preview tab${tabs.length === 1 ? '' : 's'} open in the side panel:\n${lines.join('\n')}${hidden}`
}
frontend/src/lib/components/sessions/sessionPreviewTabs.test.ts
+281
View File
@@ -232,6 +232,166 @@ describe('SessionPreviewTabs.open', () => {
expect(o.activeId).toBe(firstId)
})
// A trigger list page is not a `matchReusablePage`, so the runtime's
// navigate-in-place path doesn't cover it: re-pointing the tab has to happen
// here or the panel keeps showing the previously opened row.
it('re-points a page tab whose hash target changed instead of only focusing it', () => {
const o = owner()
const routes = (href: string) => ({ type: 'page' as const, href, label: 'HTTP routes' })
o.open(routes('/routes#u/me/a'))
const firstId = o.activeId
// 'retargeted', not 'opened': the tab count is unchanged, and the caller
// reports that to the model.
const res = o.open(routes('/routes#u/me/b'))
expect(res.status).toBe('retargeted')
expect(o.tabs).toHaveLength(1)
expect(o.activeId).toBe(firstId)
expect(o.tabs[0].url).toBe('/routes#u/me/b')
// Back to the bare list: still the same tab, no longer anchored at a row.
expect(o.open(routes('/routes')).status).toBe('retargeted')
expect(o.tabs).toHaveLength(1)
expect(o.tabs[0].url).toBe('/routes')
// ...and asking for the view it already shows is a plain focus.
expect(o.open(routes('/routes')).status).toBe('focused')
})
// The list pages rewrite their own filter defaults into the URL after mount,
// and `loc` follows that rewrite. Matching on anything but the path made a tab
// stop recognizing itself, so every later open spawned a duplicate.
it('still recognizes a tab after the page rewrote its own filter params', () => {
const o = owner()
const routes = (href: string) => ({ type: 'page' as const, href, label: 'HTTP routes' })
o.open(routes('/routes#u/me/a'))
const id = o.tabs[0].id
o.observeLocation(id, '/routes?filter_path_of=trigger#u/me/a')
const res = o.open(routes('/routes#u/me/b'))
expect(res.status).toBe('retargeted')
expect(o.tabs).toHaveLength(1)
expect(o.tabs[0].url).toBe('/routes#u/me/b')
})
// `new_tab` deliberately keeps two views of one page side by side. Reopening one of
// them must focus the tab already showing it, not retarget whichever tab happens to
// sit first in the strip — that would overwrite the other view and leave two tabs
// on the same row.
it('focuses the tab already showing the exact location before retargeting by path', () => {
const o = owner()
const routes = (href: string) => ({ type: 'page' as const, href, label: 'HTTP routes' })
o.open(routes('/routes#u/me/a'))
const first = o.tabs[0].id
o.open(routes('/routes#u/me/b'), { forceNewTab: true })
const second = o.tabs[1].id
expect(o.open(routes('/routes#u/me/b')).status).toBe('focused')
expect(o.activeId).toBe(second)
expect(o.tabs).toHaveLength(2)
expect(o.tabs.find((t) => t.id === first)?.url).toBe('/routes#u/me/a')
})
// The list pages read their `#<path>` once per document, so a drawer the user closed
// inside the frame only comes back on a forced load — and re-commanding the location
// the tab already shows produces no navigation the host could act on.
it('forces a load when the requested row is the one the tab already shows', () => {
const o = owner()
const routes = (href: string) => ({ type: 'page' as const, href, label: 'HTTP routes' })
o.open(routes('/routes#u/me/a'))
const id = o.tabs[0].id
o.observeLocation(id, '/routes?filter_path_of=trigger#u/me/a')
const before = o.reloadPulse.nonce
expect(o.open(routes('/routes#u/me/a')).status).toBe('focused')
expect(o.reloadPulse).toEqual({ id, nonce: before + 1 })
})
// Dropping the fragment is a load in itself, so the forced one lands on top of a
// navigation still in flight — and reloads the row the command asked to leave.
it('does not force a load when the requested location drops the row', () => {
const o = owner()
const routes = (href: string) => ({ type: 'page' as const, href, label: 'HTTP routes' })
o.open(routes('/routes#u/me/a'))
const id = o.tabs[0].id
const before = o.reloadPulse.nonce
o.navigate(routes('/routes'))
expect(o.tabs.find((t) => t.id === id)?.url).toBe('/routes')
expect(o.reloadPulse.nonce).toBe(before)
})
// Runs restores the user's "hide schedules" preference into the URL whenever a load
// says nothing about it. Counting that as drift reloaded the tab on every re-open —
// onto a page that seeds it straight back, so the only effect was the lost scroll.
it('does not reload when the page restored a filter the request never mentioned', () => {
const o = owner()
const runs = () => ({ type: 'page' as const, href: '/runs', label: 'Runs' })
o.open(runs())
const id = o.tabs[0].id
o.observeLocation(id, '/runs?job_trigger_kind=!schedule')
const before = o.reloadPulse.nonce
o.navigate(runs())
expect(o.reloadPulse.nonce).toBe(before)
})
// ...but a real in-frame move away from the commanded view still is drift.
it('reloads when the frame moved to a different view of the page', () => {
const o = owner()
const runs = () => ({ type: 'page' as const, href: '/runs?path=u/me/a', label: 'Runs' })
o.open(runs())
const id = o.tabs[0].id
o.observeLocation(id, '/runs?path=u/me/b')
const before = o.reloadPulse.nonce
o.navigate(runs())
expect(o.reloadPulse).toEqual({ id, nonce: before + 1 })
})
// A legacy app owns its own hash (the editor reads it as `context.hash`), so the
// observer records app state into `loc`. Reading that as a drawer anchor would
// retarget on reopen, and a same-document retarget forces a reload that discards
// the state the user was looking at.
it('focuses a legacy app whose own hash changed instead of reloading it', () => {
const o = owner()
const app = () => ({ type: 'page' as const, href: '/apps/edit/u/me/dash', label: 'dash' })
o.open(app())
const id = o.tabs[0].id
o.observeLocation(id, '/apps/edit/u/me/dash#tab=2')
expect(o.open(app()).status).toBe('focused')
expect(o.tabs).toHaveLength(1)
expect(o.tabs[0].url).toBe('/apps/edit/u/me/dash')
})
// Re-commanding the URL a tab is already pointed at changes nothing the host can
// see, so the frame would stay wherever the user navigated it inside the page.
it('forces a reload when the request matches the command but the frame drifted', () => {
const o = owner()
const routes = (href: string) => ({ type: 'page' as const, href, label: 'HTTP routes' })
o.open(routes('/routes#u/me/a'))
const id = o.tabs[0].id
// The user clicked another trigger inside the iframe.
o.observeLocation(id, '/routes#u/me/b')
const before = o.reloadPulse.nonce
const res = o.open(routes('/routes#u/me/a'))
expect(res.status).toBe('retargeted')
expect(o.tabs).toHaveLength(1)
expect(o.tabs[0].loc).toBe('/routes#u/me/a')
expect(o.reloadPulse.nonce).toBe(before + 1)
})
it('forceNewTab opts a page out of the location dedupe', () => {
const o = owner()
const routes = (href: string) => ({ type: 'page' as const, href, label: 'HTTP routes' })
o.open(routes('/routes#u/me/a'))
const res = o.open(routes('/routes#u/me/b'), { forceNewTab: true })
expect(res.status).toBe('opened')
expect(o.tabs).toHaveLength(2)
})
it('opens a fresh page tab when the original navigated away', () => {
const o = owner()
o.open(pageTarget)
@@ -321,6 +481,59 @@ describe('SessionPreviewTabs.open', () => {
})
})
describe('SessionPreviewTabs.open — commanded url', () => {
it('records the requested row even when the frame is already showing it', () => {
const o = owner()
o.open({ type: 'page', href: '/routes#u/me/a', label: 'R' })
// The user moves to another row inside the frame.
o.observeLocation(o.tabs[0].id, '/routes#u/me/b')
o.open({ type: 'page', href: '/routes#u/me/b', label: 'R' })
// `url` is what a refresh and a remount reload from, so it has to follow.
expect(o.tabs[0].url).toBe('/routes#u/me/b')
expect(o.tabs).toHaveLength(1)
})
})
describe('SessionPreviewTabs.observeLocation', () => {
it('drops the row from the command when the frame closes its drawer', () => {
const o = owner()
o.open({ type: 'page', href: '/routes#u/me/a', label: 'R' })
// The page clears its own hash when the drawer closes.
o.observeLocation(o.tabs[0].id, '/routes?filter_path_of=trigger')
// The iframe mounts from `url`, so a remount would otherwise reopen the drawer.
expect(o.tabs[0].url).toBe('/routes')
})
it('leaves the command alone when the user just browses inside the frame', () => {
const o = owner()
o.open({ type: 'page', href: '/routes#u/me/a', label: 'R' })
o.observeLocation(o.tabs[0].id, '/routes#u/me/b')
expect(o.tabs[0].url).toBe('/routes#u/me/a')
})
})
describe('SessionPreviewTabs.open — forced loads', () => {
it('pulses when only the fragment changes, since the browser would not load', () => {
const o = owner()
o.open({ type: 'page', href: '/routes#u/me/a', label: 'R' })
const before = o.reloadPulse.nonce
o.open({ type: 'page', href: '/routes#u/me/b', label: 'R' })
// Same document: the browser resolves the new fragment without a load, so the
// list page never re-runs the `#<path>` read that opens the row.
expect(o.reloadPulse.nonce).toBeGreaterThan(before)
expect(o.tabs).toHaveLength(1)
})
it('does not pulse when the document itself changes', () => {
const o = owner()
o.open({ type: 'page', href: '/routes#u/me/a', label: 'R' })
const before = o.reloadPulse.nonce
o.open({ type: 'page', href: '/schedules#u/me/a', label: 'S' })
// Different page: src changes, the browser loads it, nothing to force.
expect(o.reloadPulse.nonce).toBe(before)
})
})
describe('SessionPreviewTabs.navigate', () => {
it('retargets the active tab to an editor item', () => {
const o = owner()
@@ -582,6 +795,23 @@ describe('SessionPreviewTabs.select / close / setCollapsed', () => {
vi.runAllTimers()
expect(persisted.at(-1)?.tabs.map((t) => t.url)).toEqual(['/z'])
})
// What the chat is told the user is looking at comes from `displayedTab`, so a
// collapsed panel must report nothing — otherwise a bare "disable it" resolves
// against a row that is not on screen.
it('displays no tab while collapsed, and the active one again in fullscreen', () => {
const o = owner()
o.open(pageTarget)
const id = o.tabs[0].id
expect(o.displayedTab?.id).toBe(id)
o.setCollapsed(true)
expect(o.displayedTab).toBeUndefined()
expect(o.activeTab?.id).toBe(id)
o.setFullscreen(true)
expect(o.displayedTab?.id).toBe(id)
})
})
describe('SessionPreviewTabs.reorder', () => {
@@ -704,6 +934,57 @@ describe('describePreview', () => {
expect(out).not.toContain('live editor')
})
it('describes a location by what is recognized, never passing it through whole', () => {
const at = (loc: string, url = loc.split(/[?#]/)[0]): SessionPreviewTab[] => [
{ id: 'a', url, loc }
]
// A declared filter and an anchored row are worth telling the model.
expect(describePreview(at('/runs?path=u/me/a'), 'a')).toContain('/runs?path=u%2Fme%2Fa')
expect(describePreview(at('/schedules#u/me/daily'), 'a')).toContain('open: u/me/daily')
// A legacy app's hash is app state and an undeclared param is unknown text; this
// string is a tool result, so neither may ride along.
expect(describePreview(at('/apps/get/u/me/dash#token=sk-secret'), 'a')).not.toContain('sk-')
expect(describePreview(at('/runs?unknown=sk-secret'), 'a')).not.toContain('sk-')
})
it('cannot let one tab forge a second entry in the list', () => {
// The listing is one `- ` line per tab, and an artifact name, a pipeline folder and
// an item path all arrive decoded from a URL.
const forged = describePreview(
[{ id: 'a', url: '/scripts/edit/u/me/x', loc: '/scripts/edit/u%2Fme%2Fx%0A- page "Runs"' }],
'a'
)
expect(forged.split('\n')).toHaveLength(2)
expect(
describePreview(
[
{
id: 'a',
url: artifactUrl('i', 'N\n- page "Runs"'),
loc: artifactUrl('i', 'N\n- page "Runs"')
}
],
'a'
).split('\n')
).toHaveLength(2)
})
it('agrees with the active-preview block about what is on screen', () => {
// A collapsed panel yields no ACTIVE PREVIEW, so this description must not call a
// tab visible either — the chat would otherwise be told both at once.
const tabs: SessionPreviewTab[] = [{ id: 'a', url: '/runs', loc: '/runs' }]
expect(describePreview(tabs, 'a', true)).not.toContain('collapsed')
const collapsed = describePreview(tabs, 'a', false)
expect(collapsed).toContain('none of these is on screen')
})
it('names the row a page tab has open', () => {
const tabs: SessionPreviewTab[] = [
{ id: 'a', url: '/schedules', loc: '/schedules#u/me/daily_report' }
]
expect(describePreview(tabs, 'a')).toContain('page "Schedules" (open: u/me/daily_report)')
})
it('reports the pinned version, so the assistant knows the reader is behind', () => {
const url = artifactUrl('uuid-1', 'My Plan', 2)
expect(describePreview([{ id: 'a', url, loc: url }], 'a')).toContain(
frontend/src/lib/components/sessions/sessionRuntime.svelte.ts
+33 -41
View File
@@ -48,12 +48,14 @@ import {
describePreview,
hydratePreviewTabs,
previewTargetForSessionTarget,
selectPreviewTabsToClose
selectPreviewTabsToClose,
whereIs
} from './sessionPreviewTabs.svelte'
import {
matchReusablePage,
parsePreviewItemRoute,
previewLocationContext,
previewLocationLabel,
promptSafe,
resolvePreviewTab
} from './previewRouter'
import { normalizePipelineFolder } from '$lib/utils/pipelineFolder'
@@ -361,6 +363,20 @@ function createRuntime(session: Session): SessionRuntime {
pendingForkOf: s.pending_fork?.parent_workspace_id
}
}
// What the side panel is showing, stamped on each user message so the chat
// knows the page (and the row whose drawer is open) without spending a
// get_preview_status round-trip. Live editors are skipped: they register
// themselves as the ACTIVE EDITOR through UserDraft's live-draft registry.
manager.activePreviewResolver = () => {
const owner = getRuntime(session.id)?.previewTabs
// What is on screen, not merely which tab is selected: the rule tells the model
// to resolve "this page" and "it" against this block, and a collapsed panel would
// point those at a page the user cannot see.
const tab = owner?.displayedTab
if (!tab) return undefined
if (resolvePreviewTab(tab.url).kind !== 'iframe') return undefined
return previewLocationContext(whereIs(tab))
}
// Pre-flight: materialise the (still-transient) session, then commit
// the workspace (creating a staged fork if needed) before any send.
// AIChatManager awaits this so the first message hits a persisted
@@ -1032,44 +1048,18 @@ setOpenPagePreviewHandler(({ sessionId: callerSessionId, href, label, newTab })
const session = sessionState.sessions.find((s) => s.id === sessionId)
if (!session) return undefined
const owner = getOrCreateRuntime(session).previewTabs
// Re-point the tab already showing this page (matched ignoring query/hash) so a
// filter change updates it in place instead of spawning a duplicate — unless the
// user asked for a separate tab. open() dedupes on the exact URL, so differing
// filters would otherwise always open a new tab.
const targetPage = matchReusablePage(href)
if (!newTab && targetPage) {
const existing = owner.tabs.find(
(t) => matchReusablePage(t.loc || t.url)?.path === targetPage.path
)
if (existing) {
// A target identical to what the tab already shows produces no navigation
// signal at all, so a drawer-opening hash (an edit drawer the user closed)
// would silently not re-fire — force a load. Hashless targets need no
// reload: focusing the already-correct view is enough.
const unchanged = href.includes('#') && (existing.loc || existing.url) === href
// One change, not three: switching to a background tab is already visible,
// so the navigate that follows must not read as "nothing happened".
owner.asOneChange(() => {
owner.select(existing.id)
owner.navigate({ type: 'page', href, label })
owner.setCollapsed(false)
})
if (unchanged) {
owner.pulseReload(existing.id)
return `Re-opened the ${label} preview tab on the requested view.`
}
return `Updated the ${label} preview tab with the new filters.`
}
}
const result = owner.open({ type: 'page', href, label })
// open() owns the whole decision — which tab already shows this page, whether the
// requested view differs from what it shows, and whether a forced load is needed to
// re-fire a drawer. Deciding any of that again here means two predicates for one
// question, and the report going out of step with what actually happened.
const result = owner.open({ type: 'page', href, label }, { forceNewTab: newTab })
if (result.status === 'focused') {
// Same no-signal situation as above: open() only reports 'focused' when a
// tab already shows this exact URL.
if (href.includes('#')) {
const shown = owner.tabs.find((t) => (t.loc || t.url) === href)
if (shown) owner.pulseReload(shown.id)
}
return `A preview tab is already showing ${label} — focused it and applied the filters.`
return `A preview tab is already showing ${label} — focused it.`
}
// The tab count did not change: saying "opened a new tab" would leave the model
// believing in a tab that does not exist, and offering to close it.
if (result.status === 'retargeted') {
return `Updated the ${label} preview tab with the requested view.`
}
return `Opened ${label} in a new preview tab in the side panel.`
})
@@ -1083,7 +1073,9 @@ setGetPreviewStatusHandler((callerSessionId) => {
const session = sessionState.sessions.find((s) => s.id === sessionId)
if (!session) return 'No active session; the preview panel is unavailable.'
const owner = getOrCreateRuntime(session).previewTabs
return describePreview(owner.tabs, owner.activeId)
// `displayedTab` is the one place that decides what the user can see; the ACTIVE
// PREVIEW block reads it too, so the two descriptions cannot contradict each other.
return describePreview(owner.tabs, owner.activeId, !!owner.displayedTab)
})
// close_page dispatches here to close preview tabs in the calling session's
@@ -1097,7 +1089,7 @@ setClosePreviewTabsHandler(({ sessionId: callerSessionId, all, match }) => {
const owner = getOrCreateRuntime(session).previewTabs
if (owner.tabs.length === 0) return 'The preview panel has no open tabs.'
const labelFor = (t: (typeof owner.tabs)[number]) => previewLocationLabel(t.loc || t.url)
const labelFor = (t: (typeof owner.tabs)[number]) => promptSafe(previewLocationLabel(whereIs(t)))
// Resolve the doomed tabs to ids up front — close() re-indexes on each call.
const doomed = selectPreviewTabsToClose(owner.tabs, { all, match })
if (doomed.length === 0) {
frontend/src/lib/components/sessions/sessionSwitch.svelte.ts
+14 -4
View File
@@ -77,12 +77,22 @@ export async function openEditorInSession(
workspaceId?: string,
previewParams?: Record<string, string>
): Promise<void> {
// Seed the fresh session's preview with a single tab on `target` so it opens
// straight onto the editor the caller wants (resetSessionPreviewTabs also
// writes through a live runtime if one already exists for this id).
await openInSession(withPreviewParams(sessionTargetHref(target), previewParams), workspaceId)
}
// Open a fresh AI session showing a workspace page (Runs, a trigger list) in its
// preview. A page is not an editable item, so callers hand over the in-app href
// they want the tab to load rather than a SessionTarget.
export async function openPageInSession(href: string, workspaceId?: string): Promise<void> {
await openInSession(href, workspaceId)
}
async function openInSession(url: string | undefined, workspaceId?: string): Promise<void> {
// Seed the fresh session's preview with a single tab on `url` so it opens
// straight onto what the caller wants (resetSessionPreviewTabs also writes
// through a live runtime if one already exists for this id).
const session = createSession()
if (workspaceId) setSessionPendingWorkspace(session.id, workspaceId)
const url = withPreviewParams(sessionTargetHref(target), previewParams)
if (url) {
// Dynamic import: a static one would drag the runtime's heavy graph
// (chat manager → monaco) into this thin navigation seam, breaking its
frontend/src/lib/components/triggers/TriggerEditorToolbar.svelte
+31 -1
View File
@@ -9,6 +9,11 @@
import TriggerSuspendedJobsModal from './TriggerSuspendedJobsModal.svelte'
import type { TriggerMode } from '$lib/gen'
import TriggerModeToggle from './TriggerModeToggle.svelte'
import OpenInSessionButton from '$lib/components/sessions/OpenInSessionButton.svelte'
import { stripBase, TRIGGER_PAGES, SCHEDULES_PATH } from '$lib/components/sessions/previewPaths'
import { pageDrawerSessionSource } from '../sessions/pageDrawerSession'
import { page } from '$app/state'
import { workspaceStore } from '$lib/stores'
interface Props {
saveDisabled: any
@@ -27,6 +32,9 @@
trigger?: Trigger
suspendedJobsModal?: TriggerSuspendedJobsModal | null
disableSuspendedMode?: boolean
/** Path of the trigger being edited, used to deep-link "Open in AI session"
* at this trigger. Empty while creating one. */
triggerPath?: string
}
let {
@@ -45,14 +53,35 @@
cloudDisabled = false,
trigger,
suspendedJobsModal,
disableSuspendedMode = false
disableSuspendedMode = false,
triggerPath
}: Props = $props()
const canSave = $derived((permissions === 'write' && edit) || permissions === 'create')
// "Open in AI session", on the standalone trigger list pages only: the route
// gate inside pageDrawerSessionSource is what keeps it off this same toolbar
// when it renders in a script/flow editor's Triggers panel, which has the
// editor's own button. A trigger being created has no path to deep-link at.
const triggerPagePath = $derived.by(() => {
const route = stripBase(page.url.pathname)
if (route === SCHEDULES_PATH) return route
return Object.values(TRIGGER_PAGES).some((p) => p.path === route) ? route : undefined
})
const sessionSource = $derived(
triggerPagePath
? pageDrawerSessionSource(
triggerPagePath,
trigger?.isDraft ? undefined : triggerPath || trigger?.path,
$workspaceStore ?? undefined
)
: undefined
)
</script>
{#if !allowDraft}
{@render extra?.()}
<OpenInSessionButton source={sessionSource} />
{#if edit}
<TriggerModeToggle
canWrite={canSave}
@@ -78,6 +107,7 @@
{/if}
{:else}
<div class="flex flex-row gap-2 items-center">
<OpenInSessionButton source={sessionSource} />
{#if !trigger?.draftConfig}
<div class="center-center">
<TriggerModeToggle
frontend/src/lib/components/triggers/amqp/AmqpTriggerEditorInner.svelte
+12 -1
View File
@@ -1,5 +1,10 @@
<script lang="ts">
import { untrack } from 'svelte'
import {
clearPageDrawerAnchor,
setPageDrawerAnchor
} from '$lib/components/sessions/pageDrawerSession'
import { TRIGGER_PAGES } from '$lib/components/sessions/previewPaths'
import { Alert } from '$lib/components/common'
import Drawer from '$lib/components/common/drawer/Drawer.svelte'
import DrawerContent from '$lib/components/common/drawer/DrawerContent.svelte'
@@ -159,6 +164,7 @@
drawerLoading = true
try {
drawer?.openDrawer()
setPageDrawerAnchor(TRIGGER_PAGES.amqp.path, ePath)
initialPath = ePath
itemKind = isFlow ? 'flow' : 'script'
edit = true
@@ -392,7 +398,11 @@
{/if}
{#if useDrawer}
<Drawer size="800px" bind:this={drawer}>
<Drawer
size="800px"
bind:this={drawer}
on:close={() => clearPageDrawerAnchor(TRIGGER_PAGES.amqp.path)}
>
<DrawerContent
bannerReserved={draftSync.hasBaseline}
title={edit
@@ -435,6 +445,7 @@
{#snippet actionsSnippet()}
{#if !drawerLoading}
<TriggerEditorToolbar
triggerPath={initialPath}
{trigger}
permissions={drawerLoading || !can_write ? 'none' : 'create'}
{saveDisabled}
frontend/src/lib/components/triggers/azure/AzureTriggerEditorInner.svelte
+17 -6
View File
@@ -1,5 +1,10 @@
<script lang="ts">
import { Alert, Button } from '$lib/components/common'
import {
clearPageDrawerAnchor,
setPageDrawerAnchor
} from '$lib/components/sessions/pageDrawerSession'
import { TRIGGER_PAGES } from '$lib/components/sessions/previewPaths'
import Drawer from '$lib/components/common/drawer/Drawer.svelte'
import DrawerContent from '$lib/components/common/drawer/DrawerContent.svelte'
import Path from '$lib/components/Path.svelte'
@@ -131,6 +136,7 @@
drawerLoading = true
try {
drawer?.openDrawer()
setPageDrawerAnchor(TRIGGER_PAGES.azure.path, ePath)
initialPath = ePath
itemKind = isFlow ? 'flow' : 'script'
edit = true
@@ -206,11 +212,11 @@
const { draft: draftFromBackend, ...deployedTrigger } = (s ?? {}) as any
loadTriggerConfig(deployedTrigger)
return {
noDeployed: !!(s as any)?.no_deployed,
overlay: draftFromBackend
? ({ ...deployedTrigger, ...draftFromBackend } as Record<string, any>)
: undefined
}
noDeployed: !!(s as any)?.no_deployed,
overlay: draftFromBackend
? ({ ...deployedTrigger, ...draftFromBackend } as Record<string, any>)
: undefined
}
} catch (error) {
sendUserToast(`Could not load Azure trigger: ${error.body}`, true)
return { overlay: undefined, noDeployed: false }
@@ -348,7 +354,11 @@
{/if}
{#if useDrawer}
<Drawer size="800px" bind:this={drawer}>
<Drawer
size="800px"
bind:this={drawer}
on:close={() => clearPageDrawerAnchor(TRIGGER_PAGES.azure.path)}
>
<DrawerContent
bannerReserved={draftSync.hasBaseline}
title={edit
@@ -394,6 +404,7 @@
{#snippet actionsButtons()}
{#if !drawerLoading && can_write}
<TriggerEditorToolbar
triggerPath={initialPath}
permissions={drawerLoading || !can_write ? 'none' : 'create'}
{saveDisabled}
{mode}
frontend/src/lib/components/triggers/email/EmailTriggerEditorInner.svelte
+12 -1
View File
@@ -1,5 +1,10 @@
<script lang="ts">
import { Button } from '$lib/components/common'
import {
clearPageDrawerAnchor,
setPageDrawerAnchor
} from '$lib/components/sessions/pageDrawerSession'
import { TRIGGER_PAGES } from '$lib/components/sessions/previewPaths'
import Drawer from '$lib/components/common/drawer/Drawer.svelte'
import DrawerContent from '$lib/components/common/drawer/DrawerContent.svelte'
import Path from '$lib/components/Path.svelte'
@@ -128,6 +133,7 @@
}, 100) // if loading takes less than 100ms, we don't show the loader
try {
drawer?.openDrawer()
setPageDrawerAnchor(TRIGGER_PAGES.email.path, ePath)
initialPath = ePath
path = ePath
itemKind = isFlow ? 'flow' : 'script'
@@ -461,6 +467,7 @@
{#snippet saveButton()}
{#if !drawerLoading}
<TriggerEditorToolbar
triggerPath={initialPath}
{trigger}
permissions={drawerLoading || !can_write ? 'none' : can_write && isAdmin ? 'create' : 'write'}
{saveDisabled}
@@ -479,7 +486,11 @@
{/snippet}
{#if useDrawer}
<Drawer size="700px" bind:this={drawer}>
<Drawer
size="700px"
bind:this={drawer}
on:close={() => clearPageDrawerAnchor(TRIGGER_PAGES.email.path)}
>
<DrawerContent
bannerReserved={draftSync.hasBaseline}
title={edit
frontend/src/lib/components/triggers/gcp/GcpTriggerEditorInner.svelte
+13 -8
View File
@@ -1,5 +1,10 @@
<script lang="ts">
import { Alert, Button } from '$lib/components/common'
import {
clearPageDrawerAnchor,
setPageDrawerAnchor
} from '$lib/components/sessions/pageDrawerSession'
import { TRIGGER_PAGES } from '$lib/components/sessions/previewPaths'
import Drawer from '$lib/components/common/drawer/Drawer.svelte'
import DrawerContent from '$lib/components/common/drawer/DrawerContent.svelte'
import Path from '$lib/components/Path.svelte'
@@ -136,6 +141,7 @@
drawerLoading = true
try {
drawer?.openDrawer()
setPageDrawerAnchor(TRIGGER_PAGES.gcp.path, ePath)
initialPath = ePath
itemKind = isFlow ? 'flow' : 'script'
edit = true
@@ -255,13 +261,7 @@
if (!cfg) {
return
}
const isSaved = await saveGcpTriggerFromCfg(
initialPath,
cfg,
edit,
wsId!,
usedTriggerKinds
)
const isSaved = await saveGcpTriggerFromCfg(initialPath, cfg, edit, wsId!, usedTriggerKinds)
if (isSaved) {
draftSync.discard(previousPath, getGcpConfig())
onUpdate?.(cfg.path)
@@ -368,7 +368,11 @@
{/if}
{#if useDrawer}
<Drawer size="800px" bind:this={drawer}>
<Drawer
size="800px"
bind:this={drawer}
on:close={() => clearPageDrawerAnchor(TRIGGER_PAGES.gcp.path)}
>
<DrawerContent
bannerReserved={draftSync.hasBaseline}
title={edit
@@ -411,6 +415,7 @@
{#snippet actionsButtons()}
{#if !drawerLoading && can_write}
<TriggerEditorToolbar
triggerPath={initialPath}
permissions={drawerLoading || !can_write ? 'none' : 'create'}
{saveDisabled}
{mode}
frontend/src/lib/components/triggers/http/RouteEditorInner.svelte
+14 -3
View File
@@ -1,5 +1,10 @@
<script lang="ts">
import { Button } from '$lib/components/common'
import {
clearPageDrawerAnchor,
setPageDrawerAnchor
} from '$lib/components/sessions/pageDrawerSession'
import { TRIGGER_PAGES } from '$lib/components/sessions/previewPaths'
import Drawer from '$lib/components/common/drawer/Drawer.svelte'
import DrawerContent from '$lib/components/common/drawer/DrawerContent.svelte'
import Path from '$lib/components/Path.svelte'
@@ -224,6 +229,7 @@
}, 100) // if loading takes less than 100ms, we don't show the loader
try {
drawer?.openDrawer()
setPageDrawerAnchor(TRIGGER_PAGES.http.path, ePath)
initialPath = ePath
path = ePath
itemKind = isFlow ? 'flow' : 'script'
@@ -362,8 +368,8 @@
return {
noDeployed: !!(s as any)?.no_deployed,
overlay: draftFromBackend
? ({ ...deployedTrigger, ...draftFromBackend } as Record<string, any>)
: undefined
? ({ ...deployedTrigger, ...draftFromBackend } as Record<string, any>)
: undefined
}
}
@@ -985,6 +991,7 @@
{#snippet saveButton()}
{#if !drawerLoading}
<TriggerEditorToolbar
triggerPath={initialPath}
{trigger}
permissions={drawerLoading || !can_write ? 'none' : 'create'}
{saveDisabled}
@@ -1003,7 +1010,11 @@
{/snippet}
{#if useDrawer}
<Drawer size="700px" bind:this={drawer}>
<Drawer
size="700px"
bind:this={drawer}
on:close={() => clearPageDrawerAnchor(TRIGGER_PAGES.http.path)}
>
<DrawerContent
bannerReserved={draftSync.hasBaseline}
title={edit
frontend/src/lib/components/triggers/kafka/KafkaTriggerEditorInner.svelte
+12 -1
View File
@@ -1,5 +1,10 @@
<script lang="ts">
import { Alert, Button } from '$lib/components/common'
import {
clearPageDrawerAnchor,
setPageDrawerAnchor
} from '$lib/components/sessions/pageDrawerSession'
import { TRIGGER_PAGES } from '$lib/components/sessions/previewPaths'
import ConfirmationModal from '$lib/components/common/confirmationModal/ConfirmationModal.svelte'
import Drawer from '$lib/components/common/drawer/Drawer.svelte'
import DrawerContent from '$lib/components/common/drawer/DrawerContent.svelte'
@@ -159,6 +164,7 @@
drawerLoading = true
try {
drawer?.openDrawer()
setPageDrawerAnchor(TRIGGER_PAGES.kafka.path, ePath)
initialPath = ePath
itemKind = isFlow ? 'flow' : 'script'
edit = true
@@ -412,7 +418,11 @@
{/if}
{#if useDrawer}
<Drawer size="800px" bind:this={drawer}>
<Drawer
size="800px"
bind:this={drawer}
on:close={() => clearPageDrawerAnchor(TRIGGER_PAGES.kafka.path)}
>
<DrawerContent
bannerReserved={draftSync.hasBaseline}
title={edit
@@ -455,6 +465,7 @@
{#snippet actionsButtons(size: 'xs' | 'sm' = 'sm')}
{#if !drawerLoading}
<TriggerEditorToolbar
triggerPath={initialPath}
{trigger}
permissions={drawerLoading || !can_write ? 'none' : 'create'}
{mode}
frontend/src/lib/components/triggers/mqtt/MqttTriggerEditorInner.svelte
+13 -8
View File
@@ -1,5 +1,10 @@
<script lang="ts">
import { untrack } from 'svelte'
import {
clearPageDrawerAnchor,
setPageDrawerAnchor
} from '$lib/components/sessions/pageDrawerSession'
import { TRIGGER_PAGES } from '$lib/components/sessions/previewPaths'
import { Alert, Button } from '$lib/components/common'
import Drawer from '$lib/components/common/drawer/Drawer.svelte'
import DrawerContent from '$lib/components/common/drawer/DrawerContent.svelte'
@@ -154,6 +159,7 @@
drawerLoading = true
try {
drawer?.openDrawer()
setPageDrawerAnchor(TRIGGER_PAGES.mqtt.path, ePath)
initialPath = ePath
itemKind = isFlow ? 'flow' : 'script'
edit = true
@@ -317,13 +323,7 @@
deploymentLoading = true
const previousPath = initialPath
const cfg = getSaveCfg()
const isSaved = await saveMqttTriggerFromCfg(
initialPath,
cfg,
edit,
wsId!,
usedTriggerKinds
)
const isSaved = await saveMqttTriggerFromCfg(initialPath, cfg, edit, wsId!, usedTriggerKinds)
if (isSaved) {
draftSync.discard(previousPath, getSaveCfg())
onUpdate?.(cfg.path)
@@ -392,7 +392,11 @@
{/if}
{#if useDrawer}
<Drawer size="800px" bind:this={drawer}>
<Drawer
size="800px"
bind:this={drawer}
on:close={() => clearPageDrawerAnchor(TRIGGER_PAGES.mqtt.path)}
>
<DrawerContent
bannerReserved={draftSync.hasBaseline}
title={edit
@@ -435,6 +439,7 @@
{#snippet actionsSnippet()}
{#if !drawerLoading}
<TriggerEditorToolbar
triggerPath={initialPath}
{trigger}
permissions={drawerLoading || !can_write ? 'none' : 'create'}
{saveDisabled}
frontend/src/lib/components/triggers/nats/NatsTriggerEditorInner.svelte
+13 -8
View File
@@ -1,5 +1,10 @@
<script lang="ts">
import { Alert, Button } from '$lib/components/common'
import {
clearPageDrawerAnchor,
setPageDrawerAnchor
} from '$lib/components/sessions/pageDrawerSession'
import { TRIGGER_PAGES } from '$lib/components/sessions/previewPaths'
import Drawer from '$lib/components/common/drawer/Drawer.svelte'
import DrawerContent from '$lib/components/common/drawer/DrawerContent.svelte'
import Path from '$lib/components/Path.svelte'
@@ -142,6 +147,7 @@
drawerLoading = true
try {
drawer?.openDrawer()
setPageDrawerAnchor(TRIGGER_PAGES.nats.path, ePath)
initialPath = ePath
itemKind = isFlow ? 'flow' : 'script'
edit = true
@@ -296,13 +302,7 @@
deploymentLoading = true
const previousPath = initialPath
const cfg = natsConfig
const isSaved = await saveNatsTriggerFromCfg(
initialPath,
cfg,
edit,
wsId!,
usedTriggerKinds
)
const isSaved = await saveNatsTriggerFromCfg(initialPath, cfg, edit, wsId!, usedTriggerKinds)
if (isSaved) {
draftSync.discard(previousPath, getSaveCfg())
onUpdate?.(cfg.path)
@@ -389,7 +389,11 @@
{/if}
{#if useDrawer}
<Drawer size="800px" bind:this={drawer}>
<Drawer
size="800px"
bind:this={drawer}
on:close={() => clearPageDrawerAnchor(TRIGGER_PAGES.nats.path)}
>
<DrawerContent
bannerReserved={draftSync.hasBaseline}
title={edit
@@ -432,6 +436,7 @@
{#snippet actionsSnippet()}
{#if !drawerLoading}
<TriggerEditorToolbar
triggerPath={initialPath}
{trigger}
permissions={drawerLoading || !can_write ? 'none' : 'create'}
{saveDisabled}
frontend/src/lib/components/triggers/postgres/PostgresTriggerEditorInner.svelte
+12 -1
View File
@@ -1,5 +1,10 @@
<script lang="ts">
import { Alert, Button, TabContent } from '$lib/components/common'
import {
clearPageDrawerAnchor,
setPageDrawerAnchor
} from '$lib/components/sessions/pageDrawerSession'
import { TRIGGER_PAGES } from '$lib/components/sessions/previewPaths'
import Drawer from '$lib/components/common/drawer/Drawer.svelte'
import DrawerContent from '$lib/components/common/drawer/DrawerContent.svelte'
import Path from '$lib/components/Path.svelte'
@@ -243,6 +248,7 @@
drawerLoading = true
try {
drawer?.openDrawer()
setPageDrawerAnchor(TRIGGER_PAGES.postgres.path, ePath)
initialPath = ePath
itemKind = isFlow ? 'flow' : 'script'
edit = true
@@ -567,7 +573,11 @@
{/if}
{#if useDrawer}
<Drawer size="800px" bind:this={drawer}>
<Drawer
size="800px"
bind:this={drawer}
on:close={() => clearPageDrawerAnchor(TRIGGER_PAGES.postgres.path)}
>
<DrawerContent
bannerReserved={draftSync.hasBaseline}
title={edit
@@ -608,6 +618,7 @@
{#snippet actionsSnippet()}
{#if !drawerLoading}
<TriggerEditorToolbar
triggerPath={initialPath}
{trigger}
permissions={drawerLoading || !can_write ? 'none' : 'create'}
{saveDisabled}
frontend/src/lib/components/triggers/schedules/ScheduleEditorInner.svelte
+8 -1
View File
@@ -1,5 +1,10 @@
<script lang="ts">
import { Alert, Badge, Button, ButtonType, Tab, Tabs } from '$lib/components/common'
import {
clearPageDrawerAnchor,
setPageDrawerAnchor
} from '$lib/components/sessions/pageDrawerSession'
import { SCHEDULES_PATH } from '$lib/components/sessions/previewPaths'
import TriggerAdvancedBadges from '../TriggerAdvancedBadges.svelte'
import Drawer from '$lib/components/common/drawer/Drawer.svelte'
import DrawerContent from '$lib/components/common/drawer/DrawerContent.svelte'
@@ -165,6 +170,7 @@
drawerLoading = true
try {
drawer?.openDrawer()
setPageDrawerAnchor(SCHEDULES_PATH, ePath)
initialPath = ePath
itemKind = isFlow ? 'flow' : 'script'
path = defaultCfg?.path ?? ePath
@@ -729,6 +735,7 @@
{#snippet saveButton()}
{#if !drawerLoading}
<TriggerEditorToolbar
triggerPath={initialPath}
{trigger}
permissions={drawerLoading || !can_write ? 'none' : 'create'}
{saveDisabled}
@@ -1396,7 +1403,7 @@
{/snippet}
{#if useDrawer}
<Drawer size="900px" bind:this={drawer}>
<Drawer size="900px" bind:this={drawer} on:close={() => clearPageDrawerAnchor(SCHEDULES_PATH)}>
<DrawerContent
bannerReserved={draftSync.hasBaseline}
title={edit
frontend/src/lib/components/triggers/sqs/SqsTriggerEditorInner.svelte
+13 -8
View File
@@ -1,5 +1,10 @@
<script lang="ts">
import { Alert, Button } from '$lib/components/common'
import {
clearPageDrawerAnchor,
setPageDrawerAnchor
} from '$lib/components/sessions/pageDrawerSession'
import { TRIGGER_PAGES } from '$lib/components/sessions/previewPaths'
import Drawer from '$lib/components/common/drawer/Drawer.svelte'
import DrawerContent from '$lib/components/common/drawer/DrawerContent.svelte'
import Path from '$lib/components/Path.svelte'
@@ -137,6 +142,7 @@
drawerLoading = true
try {
drawer?.openDrawer()
setPageDrawerAnchor(TRIGGER_PAGES.sqs.path, ePath)
initialPath = ePath
itemKind = isFlow ? 'flow' : 'script'
edit = true
@@ -306,13 +312,7 @@
deploymentLoading = true
const previousPath = initialPath
const cfg = getSaveCfg()
const isSaved = await saveSqsTriggerFromCfg(
initialPath,
cfg,
edit,
wsId!,
usedTriggerKinds
)
const isSaved = await saveSqsTriggerFromCfg(initialPath, cfg, edit, wsId!, usedTriggerKinds)
if (isSaved) {
draftSync.discard(previousPath, getSaveCfg())
onUpdate?.(cfg.path)
@@ -371,7 +371,11 @@
{/if}
{#if useDrawer}
<Drawer size="800px" bind:this={drawer}>
<Drawer
size="800px"
bind:this={drawer}
on:close={() => clearPageDrawerAnchor(TRIGGER_PAGES.sqs.path)}
>
<DrawerContent
bannerReserved={draftSync.hasBaseline}
title={edit
@@ -414,6 +418,7 @@
{#snippet actionsSnippet()}
{#if !drawerLoading}
<TriggerEditorToolbar
triggerPath={initialPath}
{trigger}
permissions={drawerLoading || !can_write ? 'none' : 'create'}
{saveDisabled}
frontend/src/lib/components/triggers/websocket/WebsocketTriggerEditorInner.svelte
+12 -1
View File
@@ -1,5 +1,10 @@
<script lang="ts">
import { Alert, Button } from '$lib/components/common'
import {
clearPageDrawerAnchor,
setPageDrawerAnchor
} from '$lib/components/sessions/pageDrawerSession'
import { TRIGGER_PAGES } from '$lib/components/sessions/previewPaths'
import TextInput from '$lib/components/text_input/TextInput.svelte'
import Drawer from '$lib/components/common/drawer/Drawer.svelte'
import DrawerContent from '$lib/components/common/drawer/DrawerContent.svelte'
@@ -180,6 +185,7 @@
drawerLoading = true
try {
drawer?.openDrawer()
setPageDrawerAnchor(TRIGGER_PAGES.websocket.path, ePath)
initialPath = ePath
itemKind = isFlow ? 'flow' : 'script'
edit = true
@@ -453,7 +459,11 @@
{/if}
{#if useDrawer}
<Drawer size="800px" bind:this={drawer}>
<Drawer
size="800px"
bind:this={drawer}
on:close={() => clearPageDrawerAnchor(TRIGGER_PAGES.websocket.path)}
>
<DrawerContent
bannerReserved={draftSync.hasBaseline}
title={edit
@@ -496,6 +506,7 @@
{#snippet actionsButtons()}
{#if !drawerLoading}
<TriggerEditorToolbar
triggerPath={initialPath}
{trigger}
permissions={!drawerLoading && can_write ? 'create' : 'none'}
{allowDraft}
frontend/src/lib/hubPaths.json
+1 -1
View File
@@ -1,6 +1,6 @@
{
"gitSyncTest": "hub/28184/git-repo-test-read-write-windmill",
"gitInitRepo": "hub/28890/git-sync-init-repository-windmill",
"gitInitRepo": "hub/28903/git-sync-init-repository-windmill",
"slackErrorHandler": "hub/28794/workspace-or-schedule-error-handler-slack",
"emailErrorHandler": "hub/19795/workspace-or-error-handler-email",
"slackRecoveryHandler": "hub/28791/slack/schedule-recovery-handler-slack",
frontend/src/routes/(root)/(logged)/+layout.svelte
+1 -1
View File
@@ -83,7 +83,7 @@
import SessionPicker from '$lib/components/sessions/SessionPicker.svelte'
import SessionModeSwitch from '$lib/components/sessions/SessionModeSwitch.svelte'
import { isGlobalAiEnabled } from '$lib/components/copilot/chat/global/gate'
import { parsePreviewItemRoute } from '$lib/components/sessions/previewRouter'
import { parsePreviewItemRoute } from '$lib/components/sessions/previewPaths'
import { rememberNavRoute } from '$lib/components/sessions/sessionSwitch.svelte'
import { sessionState } from '$lib/components/sessions/sessionState.svelte'
import { currentWorkspaceRootId } from '$lib/components/sessions/sessionScope.svelte'
frontend/src/routes/(root)/(logged)/run/[...run]/+page.svelte
+13
View File
@@ -91,6 +91,7 @@
import ExecutionDuration from '$lib/components/ExecutionDuration.svelte'
import { isWindmillTooBigObject } from '$lib/components/job_args'
import ScheduleEditor from '$lib/components/triggers/schedules/ScheduleEditor.svelte'
import OpenInSessionButton from '$lib/components/sessions/OpenInSessionButton.svelte'
import { onDestroy, setContext, untrack } from 'svelte'
import { getJobStatusKind, resetFavicon, setStatusFavicon } from '$lib/favicon'
@@ -941,6 +942,18 @@
size="sm"
startIcon={{ icon: Pen }}>Edit</Button
>
{#if showEditButton}
<!-- Opens the deployed runnable at this job's path, like Edit — unlike
"View script", which pins the hash this run executed. Same gate as
Edit: where direct deployment is off, the way in is "Edit in fork". -->
<OpenInSessionButton
source={{
target: { kind: isScript ? 'script' : 'flow', path: job?.script_path ?? '' },
workspaceId: $workspaceStore ?? undefined
}}
btnProps={{ unifiedSize: 'md' }}
/>
{/if}
{/if}
{#if !showEditButton && !isCloudHosted() && editInForkAllowed($workspaceStore, $userWorkspaces)}
<Button
frontend/src/routes/(root)/(logged)/sessions/+page.svelte
+34 -3
View File
@@ -421,11 +421,42 @@
// land on the visible session's tabs.
function onTabLoad(tabs: SessionPreviewTabs, tab: SessionPreviewTab, frame: HTMLIFrameElement) {
try {
const loc = frame.contentWindow?.location
if (!loc) return
const win = frame.contentWindow
if (!win) return
// observeLocation canonicalizes away the injected nomenubar/workspace
// params so the tab's `loc` stays symmetric with `url` for dedupe/display.
tabs.observeLocation(tab.id, loc.pathname + loc.search)
// The hash is kept: on a list page it names the row whose drawer is open
// (`/schedules#u/me/daily`), which is what tells the chat what the user
// is looking at.
const observe = () => {
try {
const loc = win.location
tabs.observeLocation(tab.id, loc.pathname + loc.search + loc.hash)
} catch {
// Same best-effort as below.
}
}
observe()
// A drawer only changes the hash and a filter only rewrites the query; neither
// reloads the frame, so `load` alone would leave `loc` frozen on the seeded page.
// These listeners die with the framed document, so each load attaches one set.
win.addEventListener('hashchange', observe)
win.addEventListener('popstate', observe)
// Filters write params with `replaceState` (shallow routing), which fires no
// event at all — the history methods are the only way to see them. Guarded so a
// re-load reusing the window can't wrap the wrapper.
const w = win as Window & { __wmObservedHistory?: boolean }
if (!w.__wmObservedHistory) {
w.__wmObservedHistory = true
for (const method of ['pushState', 'replaceState'] as const) {
const original = win.history[method]
win.history[method] = function (this: History, ...args: any[]) {
const result = original.apply(this, args as any)
observe()
return result
} as History[typeof method]
}
}
} catch {
// Best-effort: the preview is same-origin, but reading location could
// still throw mid-navigation — keep the seeded path in that case.
lsp/Pipfile
+1 -1
View File
@@ -4,7 +4,7 @@ verify_ssl = true
name = "pypi"
[packages]
wmill = ">=1.788.0"
wmill = ">=1.789.0"
sendgrid = "*"
mysql-connector-python = "*"
pymongo = "*"
openflow.openapi.yaml
+1 -1
View File
@@ -1,7 +1,7 @@
openapi: '3.0.3'
info:
version: 1.788.0
version: 1.789.0
title: OpenFlow Spec
contact:
name: Ruben Fiszel
powershell-client/WindmillClient/WindmillClient.psd1
+1 -1
View File
@@ -12,7 +12,7 @@
RootModule = 'WindmillClient.psm1'
# Version number of this module.
ModuleVersion = '1.788.0'
ModuleVersion = '1.789.0'
# Supported PSEditions
# CompatiblePSEditions = @()
python-client/wmill/pyproject.toml
+1 -1
View File
@@ -1,6 +1,6 @@
[tool.poetry]
name = "wmill"
version = "1.788.0"
version = "1.789.0"
description = "A client library for accessing Windmill server wrapping the Windmill client API"
license = "Apache-2.0"
homepage = "https://windmill.dev"
scripts/worktree-common.sh
+15 -2
View File
@@ -164,10 +164,20 @@ wm_find_ee_repo() {
return 1
}
# The EE commit this CE checkout builds against. CI reads the same file, so basing a new EE
# worktree on it keeps a local `cargo check --features private` on the tree CI compiles. Local
# `main` in the EE repo is not a substitute: nothing fast-forwards it, so it drifts behind the pin.
wm_ee_pinned_ref() {
local repo_root=$1 ref
ref="$(tr -d '[:space:]' < "${repo_root}/backend/ee-repo-ref.txt" 2>/dev/null)" || return 1
[[ -n "$ref" ]] || return 1
printf '%s' "$ref"
}
wm_setup_ee_worktree() {
local repo_root=$1
local main_repo_root=$2
local ee_repo branch wt_basename ee_worktree_dir ee_rel rust_plugin
local ee_repo branch wt_basename ee_worktree_dir ee_rel rust_plugin ee_ref
if ! ee_repo="$(wm_find_ee_repo "$repo_root" "$main_repo_root")"; then
return
@@ -189,8 +199,11 @@ wm_setup_ee_worktree() {
elif git -C "$ee_repo" show-ref --verify --quiet "refs/remotes/origin/$branch" \
&& git -C "$ee_repo" worktree add --track -b "$branch" "$ee_worktree_dir" "origin/$branch" 2>/dev/null; then
echo "Created EE worktree at $ee_worktree_dir (tracking origin/$branch)"
elif ee_ref="$(wm_ee_pinned_ref "$repo_root")" \
&& git -C "$ee_repo" worktree add -b "$branch" "$ee_worktree_dir" "$ee_ref" 2>/dev/null; then
echo "Created EE worktree at $ee_worktree_dir (new branch: $branch from pinned ${ee_ref:0:12})"
elif git -C "$ee_repo" worktree add -b "$branch" "$ee_worktree_dir" main 2>/dev/null; then
echo "Created EE worktree at $ee_worktree_dir (new branch: $branch from main)"
echo "Created EE worktree at $ee_worktree_dir (new branch: $branch from main — pin unavailable)"
else
echo "Warning: Could not create EE worktree for branch $branch"
fi

Some files were not shown because too many files have changed in this diff Show More