* feat: open an AI session from the runs and trigger pages
* feat: tell the chat which page the session preview shows
* fix: observe shallow url writes and keep page tabs deduped by path
* feat: open an AI session from the resource and variable drawers
* fix: re-point page tabs on hash change and follow the drawer's workspace
* fix: force a load when a page tab is re-pointed within one document
* fix: report a re-pointed preview tab as retargeted, not opened
* fix: reload a preview tab re-pointed at the url the frame drifted from
* fix: canonicalize runs previews and read drawer anchors per page
* fix: dedupe page tabs on the path so self-written filters don't duplicate
* perf: carry the active-preview rule only in chats that have a side panel
* fix: read a preview tab's hash as a row only where the page deep-links one
* fix: focus the preview tab showing the exact location before retargeting by path
* refactor: give preview locations one module that says what they mean
* fix: report the active preview from what is on screen, not the selected tab
* fix: read a preview location's view from the params a request can set
* fix: count every filter a request can set, and flush drawer drafts before routing
* docs: state each preview-routing constraint once, within four lines
* fix: take a page's view params from the filter schema it already declares
* docs: describe the filter contract the url builders now follow
* fix: describe a preview to the model from addressing fields only
* fix: keep a filter value holding a delimiter apart from two filters
* fix: keep a preview description to one line the model can trust
* fix: materialize the resource editors before persisting the draft
* docs: bring the preview-routing constraints back within four lines
* fix: refuse to route a preview on state the drawer could not persist
* fix: read a resource drawer's validity from the editor, not from draft dirtiness
* fix: answer what the user can see from one place in both descriptions
* refactor: name each write to a preview tab's two locations, and the read
* fix: flush only editors holding a pending change
* fix: drop a list page's row anchor when its drawer closes
* fix: clear the row anchor on every list page that deep-links one
* fix: keep a closed drawer closed, and refuse to leave unparseable text
* refactor: register the resource json field in the shared unparseable set
* refactor: decide a forced load where the command changes, not in the host
* fix: navigate a preview frame only when it is not already there
* fix: boot a remounted preview frame where the user left it
* fix: carry a list page's filters and open row into the session
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: navigate a preview frame by what it shows, not by its url
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: read a resource's raw-editor validity from the current parse
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: compare preview views without iterating URLSearchParams
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* refactor: drop re-exports the path leaf left without readers
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* docs(agents): scope agent guidance to where it loads
AGENTS.md loads in every session. Three of its sections only ever applied to
one directory, and docs/autonomous-mode.md was unreferenced by anything in the
repo, so none of its content was in effect.
- Move "Verifying Backend Changes" to backend/CLAUDE.md, "Verifying Frontend
Changes" and "Banned Patterns" to frontend/CLAUDE.md. They now load when
working under those directories, which is when they apply.
- Update the two cross-references that pointed at the moved sections (pr and
svelte-frontend skills).
- Delete docs/autonomous-mode.md. Its "don't stop early" half is already in
.webmux.yaml's oneshot system prompt, which actually loads; its trigger was
bypassPermissions, which does not imply an absent user; and it restated
AGENTS.md and the pr skill with copies that had drifted (hardcoded ports,
relative screenshot paths). Salvaged the UI traps it uniquely documented
into frontend/CLAUDE.md and dropped the three stale profile references.
AGENTS.md drops ~3.6k characters with no guidance lost.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* docs(agents): guidance for building a feature — reuse, telemetry, live verification
Three recurring gaps, all cases where a pointer existed but nothing triggered
on it.
Component reuse. The svelte-frontend skill documented three components with
props, which reads as the whole catalog; the barrel exports 23 and common/ has
34 subdirectories against those 23. So "never use raw HTML elements" was an
instruction agents could not follow. Added a mandatory discovery step: read
the barrel, grep the tree, and treat the documented three as examples.
Brand guidelines. frontend/brand-guidelines.md is 34k characters referenced by
bare path, which nothing opens speculatively. Added a table mapping what you
are building to the section that governs it, entered with grep rather than a
full read.
Product telemetry. feature_usage has 14 registered actions across three
features, and an unregistered (feature, kind) pair is dropped by
valid_feature_usage_event with a bare continue — no error, still a 204 — so
frontend-only instrumentation silently records nothing. New
docs/feature-telemetry.md carries the criteria for when to instrument, the
four-step recipe including the allowlist and the InstanceSettings disclosure,
and the privacy rules. Raised in the plan for user-facing work, not as a
separate question, and not at all for bugfixes or refactors.
Also: validation now ends at exercising the change on the running instance,
with standing permission to spin up whatever that takes.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(dev): correct the worktree dev-environment guidance
Several things agents were told to do did not match what the machine does.
- Env discovery pointed at .env / .env.local / backend/.env. In a webmux
worktree the real values are in $(git rev-parse --git-dir)/webmux/runtime.env
(BACKEND_PORT, FRONTEND_PORT, DATABASE_URL, CARGO_FEATURES, WM_DB_NAME),
sourced by every pane and undocumented. Reading it is also not blocked by the
Read(**/.env) deny rules, which the old instruction walked straight into.
- The database name rule said branch-with-underscores. worktree-common.sh uses
the worktree directory basename, and Postgres truncates at 63 characters, so
branch hugo/win-2340-… resolves to windmill_win_2340_…_and_eval with no hugo_
prefix and the tail chopped. A wrong DATABASE_URL guts the sqlx cache.
- The restart procedure said "tmux pane 1" and sent keys to an undefined
<pane1>. Pane 1 is the backend under the full profile and the frontend under
frontendOnly. Replaced with finding the pane by pane_current_command,
recovering the live feature set from the running process (CARGO_FEATURES in
runtime.env only records what the pane started with), and restarting in place.
- Added recovery for an orphaned backend holding the port: it reparents to
systemd when its shell dies, so it survives anything that looks like cleanup.
Three checks before killing a single pid, because pkill -f windmill takes out
every sibling worktree.
- Agents spawned their own servers because AGENTS.md opened by telling them to.
Now it checks for the existing panes first; the spawn commands are scoped to
a plain checkout.
- New EE worktrees branched from the EE repo's local main, which nothing
fast-forwards, so they started behind the commit pinned in
backend/ee-repo-ref.txt — the one CI builds against. They now base on the pin,
falling back to main only when it is unreadable.
- Enabled webmux autoPull so local main stays current; new worktrees are
branched from it. Documented what WM_CLONE_DB does, including that it
terminates every connection to the base windmill database.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat(skills): vendor grilling/architecture skills; tighten PR ready and review rounds
Vendors five skills from https://github.com/mattpocock/skills (MIT, pinned at
84fdeffd12f2ee307994d1eb6feb48173b6e0502). They are one dependency closure:
grill-me is a stub that runs grilling, and improve-codebase-architecture draws
its vocabulary from codebase-design and its CONTEXT.md upkeep from
domain-modeling. .agents/skills/UPSTREAM.md records the license, the pin, and
the four local deltas so a refresh stays a diff:
- flattened the upstream engineering/ and productivity/ split
- rewrote bundled-file links to repo-root paths, since relative links break
when read through the .claude/skills symlink
- dropped the upstream agents/openai.yaml packaging metadata
- removed every ADR path. This repo has not adopted ADRs, and a skill that
offers to create them is how the practice arrives by side effect rather than
by decision.
PR workflow changes, all in the pr skill:
- A round that never starts is usually a conflict with main, not a CI outage.
Resolve by merging, not rebasing — a rebase rewrites the head SHA that round
verdicts and the clean-round marker are keyed to. If the merge advances
backend/ee-repo-ref.txt, the EE worktree has to follow or
cargo check --features private compiles a tree neither the author nor CI
intends.
- A clean round no longer means an automatic flip to ready. Wide blast radius
(*_ee.rs, migrations, OpenAPI or the generated client, auth paths, shared
worker infrastructure, a new public surface) asks first; self-contained
changes flip. Unattended, the judgement holds and the action degrades: flip
the small ones, leave the rest at a clean draft with the reason in the PR
body.
- Rounds that never converge are usually structural. After three without
convergence, stop, name the module the findings cluster around, and suggest
improve-codebase-architecture rather than burning more CI.
AGENTS.local.md (gitignored, with CLAUDE.local.md importing it) holds the
ready/ask calibration, recorded as dated observations rather than a rule.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* docs(dev): state that each worktree gets its own fresh database
The per-worktree section warned which DATABASE_URL to use but never said where
the database comes from: the post-create hook creates and migrates a new one
per worktree, so it starts with none of the main instance's workspaces, scripts
or flows. WM_CLONE_DB was documented only as a comment in .webmux.yaml, which
reads as how things work rather than as a per-project opt-in.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore(sqlx): script the cache backup/restore instead of documenting it
The update-sqlx skill spelled out a cp/comm/rm dance around `cargo sqlx
prepare`, which empties backend/.sqlx before regenerating — a failed run leaves
the cache gutted (observed: 2350 -> 142 entries), and a --all-targets run in a
CE checkout fails that way every time. Three problems with documenting it:
- The backup path was the literal /tmp/sqlx_backup, shared by every worktree.
Two concurrent runs overwrite each other's backup, which is the only thing
standing between a failed prepare and a gutted cache.
- The restore was a copy-pasted `rm -rf .sqlx && cp -r ... && cp ...` chain.
- Skipping the backup is what turns a routine failure into a lost cache, and a
convention is easier to skip than a command.
sqlx-cache.sh has backup / newq / restore, keeps state in a per-worktree
directory, and leaves the judgement call where it belongs: `newq` prints each
added entry's query field for review, and only `restore` writes them in.
Also adds the general rule that scratch files belong outside the checkout —
anything written into the tree has to be deleted again, and rm prompts each
time.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* docs(agents): state why a routine cleanup prompts, and where scratch goes
The guard hook already auto-allows a plain rm whose operands are under /tmp or
inside a git checkout in $HOME, so deleting a temp dir or a stale .sqlx entry
costs nothing. What prompts is the command shape: the hook's tokenizer defers on
&&, ;, redirects, quotes and $VAR, so a chained cleanup falls through to the
Bash(rm:*) ask rule.
That was recorded only inside a paragraph about screenshot file paths in
frontend/CLAUDE.md, where nobody looking for it would find it. Stated in Core
Principles instead, alongside the rule that scratch belongs outside the tree —
for the reason that actually applies, which is not committing junk rather than
avoiding prompts.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore(security): deny agent edits to the permission hooks and project settings
.claude/hooks/guard-rm-outside-tmp.sh and guard-main-branch.sh are the
enforcement points for everything the permission rules are meant to catch, and
nothing stopped an agent editing them. One sed -i disables the guard for every
later command, silently, and the deny list in .claude/settings.json has the same
exposure.
Defence in depth rather than a boundary: an agent with arbitrary bash can still
delete, and this may only close the Edit-tool path if Bash writes are not
covered by Edit deny rules. It costs nothing and removes the cheapest way to
turn the guards off. Changing them now means editing the files by hand, which is
the intent.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: address review round findings on head 3f47dc1
- backend/ and frontend/ guidance was Claude-only. Codex and Pi read AGENTS.md,
not CLAUDE.md, so moving "Verifying Backend/Frontend Changes" and the
$bindable ban out of the root AGENTS.md made them invisible to two of the
three CLIs this repo supports. Renamed both to AGENTS.md with a one-line
@AGENTS.md CLAUDE.md beside them, matching what the repo already does at the
root and in ai_evals/, and retargeted the four references.
- sqlx-cache.sh aborted with exit 2 and no output when .sqlx was empty:
list_entries ran `ls -1 ./*.json`, and an unmatched glob under
`set -euo pipefail` killed the script. An empty cache is precisely what a
failed prepare leaves behind, so it broke in the one case it exists for.
Replaced with a glob loop; reproduced the failure and verified the fix.
- The oneshot prompt ("never leave the PR sitting in draft") contradicted the
"Flip, or ask first" rule added in the same PR, which tells unattended runs to
leave wide-blast-radius changes as clean drafts. The prompt now defers to the
skill for the flip decision and keeps only "never stop at an unreviewed
draft".
- Bundled-resource references in the vendored skills were markdown links to
`.agents/skills/...`, which resolve relative to the file, not the repo root.
Replaced with inline paths stating they are repo-root relative.
- The PR-ready calibration file was write-only: the skill said to record
answers there but never to read it. It is now consulted before deciding.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Revert "chore(security): deny agent edits to the permission hooks and project settings"
This reverts commit 3f47dc1692.
* fix: address round 2 nits
- backend/AGENTS.md told agents to persist CARGO_FEATURES in runtime.env, but
webmux regenerates that file from metadata and .env.local every time the
worktree is opened, so the setting is lost on the next reopen. The persistent
source is .env.local, which scripts/post-create.sh already writes.
- UPSTREAM.md still described the vendoring delta as rewriting bundled-file
*links* to repo-root paths. 555f063 replaced them with plain paths in prose,
because a markdown target resolves relative to the file — a repo-root link is
just as broken as a sibling-relative one through the symlink. Replaying the
old wording on a refresh would reintroduce the bug UPSTREAM.md exists to
prevent.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* docs(skills): correct the UPSTREAM.md link-rewrite delta
The delta note still described rewriting bundled-file *links* to repo-root
paths. 555f063 replaced them with plain paths in prose, because a markdown
target resolves relative to the file containing it — a repo-root link is as
broken as a sibling-relative one read through the symlink. Replaying the old
wording on a refresh would reintroduce exactly the bug UPSTREAM.md exists to
prevent.
The preceding commit's message claimed this fix; the edit had failed on a
stale anchor and only the backend/AGENTS.md half landed.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* docs(dev): describe what a fresh worktree database actually contains
Exercising a real worktree creation showed the previous wording ("none of your
workspaces, scripts or flows") reads as an empty database. It is a bootstrap
instance: the admins workspace, the admin@windmill.dev superadmin, the license
key copied from the base database, and the migration seeds — observed as
u/admin/hub_sync and the default app theme resource.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: expand AZURE_DEVOPS_TOKEN placeholder in backend git probes
* fix: require azure token placeholder to be http userinfo
* fix: scrub probe credentials from git stderr and harden token mint
* fix: confine azure token placeholder to azure devops hosts
* fix: require https and authorize azure reference at write time
* fix: require workspace admin to configure an azure token reference
* fix: name the azure reference in the admin-required error
* docs(github-app): state the pull-direction permissions and the App owner field
The in-product "How to create a GitHub App" panel only listed Contents and
Metadata, which covers the push direction of git sync. Webhooks, pull requests
and checks are what the git to Windmill direction needs, and a GHE Cloud
(*.ghe.com) app also needs App owner, whose field hint was the only place
saying so.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(instance-settings): render the GitHub App page header
The branch tested the pre-rename category name, so the page rendered with no
header at all. Naming the header after the category duplicates the card
below it, so the card that holds the app credentials is now labelled for what
it is, next to the webhook base url card.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: git sync missed metadata-only deploys, deploy check missed job link
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: skip the deploy hook when the mute toggle matched no row
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore: pin ee ref forward of main so the bump only adds this change
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to a65162b22b127b54c0686095ee1b16b04e3111f7
This commit updates the EE repository reference after PR #724 was merged in windmill-ee-private.
Previous ee-repo-ref: ac5f646c3ace7e5841200c6b83b34fb4371340d9
New ee-repo-ref: a65162b22b127b54c0686095ee1b16b04e3111f7
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: auto-build binaries to object storage on deployment
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: queue the auto-build from pre-locked deploys and off the lock slot
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: materialize companion modules before a deploy-time build
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: keep a build job from stamping lock_error_logs on a healthy script
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* test: de-flake test_flow_lock_all and surface the lock error it hides
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* test: trim drafting history from the flow-lock fixture comments
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: stop a binary build from restarting dedicated workers
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: keep the build-job marker off the agent wire and out of user args
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: stop websockets resurrecting a reclaimed dev server
* docs: condense the websocket invariant comment
* test: stub fetch suite-wide so waking cannot hit a real dev server
* fix: let websockets join an in-flight start
* fix: close SSRF bypasses in git URL validation (DNS + redirects)
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: name the remedy when a git probe stops at a redirect
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: retry the .git form when a probe stops at a same-host redirect
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: keep the .git retry on the validated host for pathless URLs
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore: add dev server supervisor and dev-only polling dormancy
* fix: address review findings in dev supervisor
* fix: support https mode and bound the idle reaper in dev supervisor
* fix: persist dormancy install guard and hold the reaper during startup
* chore: run worktree frontends under the dev supervisor
* fix: keep app websockets working and reap children on sighup
* feat: add EXIT_AFTER_N_JOBS worker mode for environment cleanup
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: address review findings on the EXIT_AFTER_N_JOBS worker mode
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: address round-2 review findings on EXIT_AFTER_N_JOBS
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: address round-3 review findings on EXIT_AFTER_N_JOBS
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: bound WORKER_SUFFIX length and document the same-worker drain
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: validate the assembled worker name length
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat: bound go compilation memory with GOMEMLIMIT
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: bound the whole go build tree, not each toolchain process
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: keep the go build memlimit and parallelism atomic
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: log the go limits actually installed and stop serializing small workers
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: make go build parallelism authoritative over persisted GOFLAGS
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: canonicalize the go build -p value and floor the module-step budget
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: parse GOMAXPROCS for -p the way the go runtime does
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: read GOMAXPROCS with go's own grammar and report limits neutrally
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: derive go build parallelism from the cgroup quota over its own period
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: keep go's minimum build parallelism under sub-CPU quotas
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: keep the windows 1CU cap out of go's two-compiler floor
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* docs: record that a worker runs one job at a time
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* docs: scope the one-job-at-a-time rule away from native workers
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: home search matches each term instead of the whole query verbatim
* docs: state the search term cap and drop unreachable test cases
* fix: treat a term-less search as no filter and trim the comment
* fix: a term-less search matches nothing instead of the whole page
* feat: match the homepage fuzzy search exactly in the runnables endpoint
* docs: say apostrophes stay in terms; test summary-less and draft rows
* docs: separate an empty search from one holding no terms
* docs: state that terms split on ASCII alphanumerics only
* fix: escape and validate custom env var names in the nativets prologue
Custom workspace environment variable names were spliced verbatim into the
generated NativeTS/Bun JS prologue (both the `const {name}` binding and the
`process.env['{name}']` assignment), while only the value was escaped. A
non-identifier name could therefore alter the generated program.
- Add `escape_js_single_quoted` / `is_valid_js_identifier` helpers.
- worker.rs and bun_executor.rs: escape the name as a string literal, and only
emit the `const {name}` binding for valid identifiers.
- set_environment_variable: reject non-identifier names on write (deletion stays
unrestricted so existing rows remain removable).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* fix: address review — reserved-word const gate, grandfathered-name editability
- Gate the `const {name}` prologue binding on `can_bind_as_prologue_const`, which
additionally excludes JS reserved words and the prologue's own bindings
(`process`, `BASE_URL`, `BASE_INTERNAL_URL`); such names would otherwise emit a
SyntaxError that breaks every NativeTS run. They are still exposed via
`process.env['{name}']`.
- set_environment_variable: only enforce the identifier check for names that don't
already exist, so editing the value of a pre-existing non-identifier name (the
edit UI resubmits the name) isn't rejected with no in-product fix.
- Document the name constraint on the endpoint in openapi.yaml.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* fix: exclude eval/arguments from const gate; skip existence query on valid names
- Strict-mode ES modules forbid `eval` and `arguments` as binding names, so add
them to the non-bindable set — otherwise an env var named `eval`/`arguments`
emits `const eval = ...`, a SyntaxError that breaks every NativeTS run.
- set_environment_variable: run the existence check only when the name isn't a
valid identifier, so the common (valid-name) path skips the extra query; trim
the rationale comment.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* fix: allow `async` as a prologue const binding; note reserved-bindings coupling
`async` is a contextual keyword, not a reserved word — `const async = ...` is
valid, so it needn't be excluded from the const binding. Also cross-reference the
prologue head from PROLOGUE_RESERVED_BINDINGS so the two stay in sync.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* fix: authorize GET /concurrency_groups/{job_id}/key per job
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: answer 404 for an inaccessible and an unknown job alike
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat(sessions): persist artifact version selection in preview tabs
The artifact viewer's version pin was component-local state, so picking an
older version from the history dropdown was lost on reload. It now rides on
the preview tab's URL (`artifact:<id>?v=<n>#<name>`), which is persisted with
the tab, so a reload lands the reader back on the version they were reading.
Omitting a version means "leave the reader where they are", not "show the
latest". Every artifact tool re-opens the document it just wrote, so an
omitted version that cleared the pin would yank a reader out of the version
they chose on every single edit. That rule lives in keptVersion(), which
targetUrl() applies to every path that re-points a tab, so open() and
navigate() cannot disagree about it — the breadcrumb picker opens highlighting
the artifact the active tab already shows, and re-picking it must not double
as a reset to latest. A pin belongs to a (tab, artifact) pair, so a tab
re-pointed at a different document carries nothing over, and a new tab starts
unpinned. Moving off a pin is the reader's own action, through the version
dropdown, "Back to latest", or the new pinArtifactVersion(). Since the pin is
part of the tab model, get_preview_status now reports it, so the assistant can
tell that the reader is not looking at what it just wrote.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix(sessions): bound a stamped artifact version to a safe integer
Number.isInteger(1e21) is true, but interpolating it yields `?v=1e+21` while
parseArtifactRoute matches digits only, so artifactUrl could stamp a url that
reads back as null — the one outcome the guard exists to prevent, and one that
would persist with the tab. Safe integers always interpolate in decimal.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix(artifacts): tell a failed version read apart from a missing version
getArtifactVersion swallowed a rejected read and returned undefined, so a
transient IndexedDB failure was indistinguishable from a pruned snapshot. Both
its callers act on that distinction, and both acted wrongly: the artifact
viewer clears the reader's pinned version on absence — now that the pin is
persisted with the tab, clearing it destroys it — and read_artifact tells the
model the version is gone and to call list_artifact_versions.
It now rejects instead. The store still answers for the current version, which
it holds in memory and can serve without the DB; anything older propagates, the
viewer keeps the pin and leaves the document on screen, and read_artifact
reports a read it could not make rather than a version that does not exist.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
* fix: clear orphaned usr_to_group rows on service account creation
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* test: pin service account creation over orphaned usr_to_group rows
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to 60c20e686cead73ff075512b15c6e2d6232beca6
This commit updates the EE repository reference after PR #723 was merged in windmill-ee-private.
Previous ee-repo-ref: 5c2c553f960abcd7988fdac8830dd36c066160ad
New ee-repo-ref: 60c20e686cead73ff075512b15c6e2d6232beca6
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* fix(frontend): use the Password component on the login and reset-password forms
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(frontend): submit auth forms once per Enter keypress
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(frontend): conceal revealed password before submitting auth forms
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: stop the AI chat destroying secret variables on edit
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: clear stale staged secret values and state the draft-staging rule
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* docs: condense the pending-secret invariant to its field
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: refuse empty and oauth-managed secret values, keep drawer-staged ones in the draft
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: resolve a variable deploy's secret from one draft snapshot
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* refactor: make the variable draft the single source of a staged secret
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* docs: drop stale in-memory secret invariants from comments and the eval
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: stop null account/expires_at leaking into variable drafts and diffs
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: report when a variable deploy leaves the secret value unchanged
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* docs: scope the variable-value readability claims to the chat
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* docs: correct the secret-draft invariant in the diff masking comment
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* docs: record why a non-secret value is resent on a partial update
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: stop "Load secret value" discarding a staged secret
The audit-logged load writes the deployed secret into the draft row the
variable drawer shares with the AI chat, so offering it while that row
already stages a value silently replaces it — and the deploy that follows
carries the old value with no sign the staged one was lost.
The gate that hid the action already existed but keyed on
`isEncryptedDraftValue`, which only holds once a draft has round-tripped
through the server. A value staged in the same tab is still plaintext, so
it slipped through. Key on "anything staged" instead; clearing stays
explicit via Reset.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: extend the variable draft's empty-value sentinel past secrets
Two gaps in the chat's variable write path, both from treating "the draft
cannot carry this value" as meaning only "the value is secret".
`variableToDraftState` drops the value of an OAuth-managed variable so a
refreshed live token is never pinned into a draft, leaving '' behind. The
deploy body resent that '' verbatim for a non-secret one, wiping the token
the refresh flow owns. The sentinel now covers every value the draft is not
allowed to hold, which also removes the divergence from
`VariableEditor.save` and the shared deployer.
Making a variable secret when it holds no value produced a secret draft
staging '', a deploy body with no `value`, and the backend's "cannot change
is_secret without updating value too" — the sibling create path already
answers that case with guidance, so answer it here too.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: gate the Secret toggle's secret load on the staged value too
The toggle calls `onLoadSecret` on every change so an is_secret flip has a
value to send, but that load overwrites the shared draft row — the same
discard the button gate just closed, reached by a different control.
It now loads only when the row stages nothing, which is exactly when the
flip needs a value fetched. With a value already staged there is one to
send, and it is the one the user or the chat put there.
Blocking the load costs the side effect that used to mask a worse bug: for
a deployed variable, the load replaced an `$encrypted:` marker with real
plaintext before save. Without it, un-securing a marker would store the
marker string as the value, since the deploy endpoints only decrypt it while
is_secret stays true. So the toggle is disabled outright while a marker is
staged — Reset first. That closes the marker case for draft-only variables
as well, where no load could ever have masked it.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
create_schedule opened the RLS transaction (user_db.begin) first, then ran
reads that deliberately use the non-RLS `db` pool — fork-ness and
permissioned_as/email resolution — while holding it. Acquiring a second pooled
connection while the tx holds one self-deadlocks on a single-connection pool
(embedded Postgres, PgBouncer statement mode, any max_connections=1 setup): the
read blocks on the sqlx acquire timeout, then errors.
Move those reads (and the ScheduleType::from_str validation) above
user_db.begin(). They don't depend on the tx and bypass RLS by design, so the
result is semantically identical; the RLS transaction is simply opened later and
held for less time. Same class of fix as #9970 (migration bootstrap on the
migrator's held connection).
Note: sibling paths keep the same latent pattern on branches this change does
not touch (push_scheduled_job reads the pool under the tx for flow schedules;
edit_schedule/set_enabled for cross-user permissioned_as) — a possible follow-up.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* test: wait for the app dependency job before pulling in repro_diffname
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* test: reuse waitForDeploymentJobs and assert pulled lock files
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* test: condense the dependency-job wait comment
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat: expose every runs filter on the open_page chat tool
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: reject runs filters the page would silently ignore
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: normalize runs list filters and refuse combinations the page drops
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: validate the full folder-name contract and pin evals to one call
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: refuse queue statuses the concurrency view cannot filter on
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: avoid content shift on home page load and in the script editor logs pane
The tutorial banner rendered by default and was removed once an API round-trip
resolved that it should not show, jumping everything below it up by 58px on
every home page load. It now caches the last resolved state in localStorage and
paints that first, so the first frame already matches what the sync concludes; a
device with nothing cached stays hidden until the sync answers.
The logs header spinner was an unsized lucide icon (24px) where the settled
state renders a 12px Timer, so the row grew 7px while a job was queued and
shrank back when it started, shoving the log body down and up again.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: keep the tutorial banner hidden when dismissed mid-sync
The banner is interactive while the initial tutorial-progress request is still
in flight, so a dismiss or a skip can land before the sync resolves. The
continuation then overwrote the user's choice and brought the banner back.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: pin the result placeholder row height across the spinner swap
Sizing the spinner to the font size still left it 6px short of the text-sm line
box it replaces, so the row contracted instead of growing. Pin the height on the
container so it holds in both states and tracks the root font size.
Also assign state before persisting it, and collapse the duplicated rationale
above the banner cache.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: stop the test panel splitpanes resting one header too tall
The panes carried `!max-h-[calc(100%-{...}px)]`, but the arbitrary value is
built by string interpolation so Tailwind never emitted a rule for it: the
class was inert and the computed max-height was `none`. The panes then took
their 100% height, ignoring the header row above them, and overflowed the
column by exactly the header. Flex only applied the shrink transiently, so a
reflow during a run snapped the whole logs & result region up ~12px and back.
min-h-0 lets flex size the panes to the space that is actually left, which is
what the clamp was reaching for and is correct for the debug and bottom layouts
too, without their hardcoded 83/43/0 pixel guesses.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: bound postgres result collection so it cannot OOM the worker
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: render the sql result limit exactly so the error can be set verbatim
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* docs: point the fraction rationale at the renderer that still emits them
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* perf: stop re-parsing every collected row to rebuild it as a RawValue
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* style: drop a dangling doc line and an unrelated rustfmt reflow
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: bound duckdb result collection so an oversized result cannot OOM the worker
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: keep the duckdb cap a worker-survival limit rather than a cloud product one
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: refuse an oversized blob before it expands to one json value per byte
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: share one expansion budget across a row's values, nested ones included
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: bound the row's own serialization so escaping cannot outgrow the budget
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: charge a json column before parsing it into a value tree
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* docs: trim the json budget rationale and name what the budget does not cover
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: gate the sql result size limit on the duckdb feature
Its only consumer is the duckdb executor, so the minimal build compiled it
as dead code and failed under -D warnings.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat: bound how much disk a single duckdb job can spill
* fix: name the env var and correct duckdb's unreachable spill-cap advice
* fix: do not blame an unset env var for duckdb's default spill cap
* style: keep the duckdb spill-cap invariant comments within four lines
* docs: size the duckdb spill cap against the disk cloud pods actually use
* fix: tell MCP clients which tool parameters may be omitted
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* refactor: make the mcp property-key rename testable and shorten the hint
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: keep the mcp omission hint from calling flow inputs optional
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: skip the mcp omission hint on a parameterless tool
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* docs: design for where the npm proxy keeps cached registry content
* feat(npm-proxy): keep package files on disk and in the object store
* fix(npm-proxy): degrade when the cache is unwritable, stream and bound it
* fix(npm-proxy): keep the happy path off the heap and isolate pull scratch
* fix(npm-proxy): bound the upload, verify pulled trees, keep oversized manifests
* fix(npm-proxy): protect live scratch, bound uploads by parts, refuse traversals
* fix: let the blocking unpack own the scratch it writes into
* fix: replace a cache directory that is not a package instead of deferring to it
* fix: evict by moving a package off the live path, not by deleting it in place
* fix: leave a package the sweep cannot move rather than deleting it in place
* fix: take one registry snapshot through a cache miss
* fix: stamp a pulled package as used so the sweep does not evict it first
* fix: explain duckdb failures caused by job isolation
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: apply the isolation policy to the schema-sync pre-pass
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore: bump ee ref for the out-of-memory hint wording
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: bump the bundled DuckDB engine to 1.5.5
The 1.5.5 duckdb crate no longer hands back a 96-bit `rust_decimal`, so a
DECIMAL wider than that renders instead of panicking inside an `extern "C"`
frame — which, being unable to unwind, aborted the whole worker process and
left the job running as a zombie. `SELECT
'1234567890123456789012345678.9012345678'::DECIMAL(38, 10)` was enough.
Adapting to the crate's API: `Value` is now `#[non_exhaustive]` and gained
`UHugeInt` and `Geometry`, and `rust_decimal` became an optional feature that
the `decimal`/`numeric` argument path still needs.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: address review findings on the duckdb bump
Run the FFI crate's own tests in CI: it is excluded from the workspace, so the
`cargo test --all` in backend-test never reached them and the new guard against
the worker-aborting DECIMAL would not have run. build_dev.sh now honors a
caller-pinned CARGO_TARGET_DIR so the test build reuses that compile instead of
building the bundled engine a second time.
Also pin UHUGEINT rendering, and correct the rust_decimal rationale —
`Decimal::new` is public without the feature, so the reason is that the feature
reproduces the exact binding the crate used to derive, not that nothing else can.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: address review nits on the duckdb bump
Name the unsupported DuckDB type rather than dumping the value, which may be
arbitrarily large or hold data that does not belong in an error message, and
say which column it came from.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore: pin the ee ref to the narrowed duckdb extension allowlist
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat: keep duckdb spilling behind the local-filesystem fence
* chore: repin the duckdb fork after adding the reset-test exclusion
* docs: stop claiming the duckdb patch has been filed upstream
* docs: point the backend duckdb bullet at the fork's rationale
* fix: place lock_temp_directory so no existing struct member moves
* fix: skip the extension-load guard when the repo is unreachable
* refactor: trim the fork comments and fail the extension guard in CI
* chore: repin the duckdb fork onto upstream duckdb-rs main
* fix: keep the engine patch applying on a CRLF checkout
* docs: link the upstream issue tracking the underlying problem
* chore: repin the duckdb fork onto the patch as filed upstream
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to 88568d11162ffa11723e7955e613224bab4f0568
This commit updates the EE repository reference after PR #720 was merged in windmill-ee-private.
Previous ee-repo-ref: 22f075c1164d9dd5a3ba92d682905aabd071d273
New ee-repo-ref: 88568d11162ffa11723e7955e613224bab4f0568
Automated by sync-ee-ref workflow.
* chore: repin the duckdb fork onto the cmake/fmt build fix
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* test: pin the immutability half of lock_temp_directory
The spill test proves the exemption works; nothing proved the lock that makes
it sound. A rebase could drop the refusals and leave every other tripwire green.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Guilhem Lemouel
Ruben Fiszel
hugocasa
AlexRV12