- `sslmode` was found by searching the query text, so it also matched inside
another parameter's value: `?application_name=sslmode=disable` passed the
allowlist on the parameter name and then parsed as a request to turn TLS off,
which both the wizard and the resource form saved and probed. Parsed with
`URLSearchParams` by exact name, with a test.
- `secretMark` read the variable with `decryptSecret` defaulted to true, so
every write decrypted a secret nothing reads and recorded the decryption --
including someone else's on the retry about to refuse it. It wants only
`edited_at`, which is returned either way.
- The probe gave up at 15s while the worker allows its Postgres connect 20s, so
a host that accepts the connection and never answers was cancelled and
reported as a missing worker rather than a failed connection.
- The create-mode region and project name did not report an intent change, so
renaming a project after a name collision left the failure naming the old one.
- Two comments described the code as it was before the claim mark became a
revision, and a doc comment outlived the field it documented.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
`text-blue-500` is the marketing blue `#3B82F6`, which brand-guidelines.md
rules out in the app interface.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The wider side padding and lighter dialog heading were changing all 17 Modal2
dialogs to suit this one flow. They move behind an opt-in `formStyling`, taken
by the three dialogs this branch owns; every other Modal2 renders as it did.
Also drops two comments that cited a design approval rather than a constraint,
and shortens the blocks that had grown past the four lines AGENTS.md asks for.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: show runtime-detected assets in a run's Assets tab
* fix: address review nits on run assets tab
* fix: cap the run assets list and report when it is cut
* fix: cap run assets by asset, not by row
- useSupabaseOauth reports success as onAuthed, alongside the failures it
already reported. SupabaseResourceConnect was watching `authed` to find out;
it takes the callback instead, keeping the guard that stops an authorization
started elsewhere on the page from opening its dialog.
- SupabaseProjectStep loads its orgs and projects through a resource keyed on
the token, so the `loaded` latch goes and re-authorizing reloads rather than
keeping the lists from the expired session.
- SetupChecklist records what the user toggled and derives the open state from
it, a failed step defaulting to open. Recording the open state instead needed
an effect to force it, and that effect re-ran on every progress update, so a
description closed while anything was still ticking reopened. A close now
holds for the life of the checklist, including across Try again.
Leaves the message listener, which subscribes to another window.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* test: settle the backlog before the capped audit-export drain
* chore: update ee-repo-ref to bd4de74eb37b32a2b6c7c69f6dedac031ef8436b
This commit updates the EE repository reference after PR #730 was merged in windmill-ee-private.
Previous ee-repo-ref: b5a5f9114df26088cfe976d91f10e55ba8bfcaa6
New ee-repo-ref: bd4de74eb37b32a2b6c7c69f6dedac031ef8436b
Automated by sync-ee-ref workflow.
---------
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Each was doing work a derived, a load callback or a real entry point does
better.
- The name conflict is kept with the name it was raised for and derived from
it. As an effect it was correct only because it never read what it wrote:
the pre-flight sets the message and the effect does not re-trigger, so adding
a read would have cleared it the instant it appeared. The message now also
comes back if the taken name is retyped, which is what the server will say.
- The default resource selection is seeded inside the fetcher that loads the
list, where "has the fetch settled" cannot be asked wrong.
- Reset-on-open becomes an exported open(), called by the settings page, so a
fresh run is set up by the act of opening rather than by a flag emulating
mount.
- The OAuth connects and the folder list become resources; supabaseAvailable
and folders are derived from them. defaultFolder takes the list rather than
reading it, so the fetch can seed off its own result.
Leaves the debounced path check, which is async with an out-of-order guard.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The previous commit restored main's tip rather than the merge base, which
carried three unrelated main-only changes into this branch: the resource
mcp_tools truncation fields, the execution_mode description, and a version bump.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
It was lifted into components so three endpoints could share it. Two of those
are gone, so it is back to one user and the extraction changes nothing.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The helper was split out so the two connection-test endpoints could share a
body. Those endpoints are gone, leaving one caller.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The wizard's connection check ran on the API server through two endpoints added
for it. That server is a different machine with a different identity, so the
answer was about the API server rather than about the worker that will run the
queries: a host reachable from one is not necessarily reachable from the other,
and IAM RDS and Azure workload identity authenticate as whichever process opens
the connection.
Run the privilege query as a preview job instead. A job goes through the
worker's Postgres executor, which is where `PgAuthMode::of` already picks the
authentication mode, and it takes either a resource value or a `$res:` path
exactly as a Postgres step does. Postgres composes the suggested GRANT
statements through `format('%I')`, so identifier quoting stays where it is
already implemented.
Removes `test_datatable_resource_connection` and
`test_datatable_connection_value`, and `connect_as_the_worker_would` with them.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: default an omitted app policy execution_mode to publisher
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* docs: drop stale comments claiming execution_mode is required
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: derive a raw app's policy on deploy instead of trusting the caller's
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore: pin the ee ref to the companion branch
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: vendor the raw-app policy derivation into the bundle job
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* docs: note the vendored raw-app policy bundle
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: derive the policy on a value-only raw-source update too
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: reject raw-app runnables whose shape yields an unusable grant
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: cache the new policy query and tighten raw-app runnable validation
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: let the policy bundle drift guard survive a CRLF checkout
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to 23431f5cf1d627051ded89111bbf2e301e9db456
This commit updates the EE repository reference after PR #729 was merged in windmill-ee-private.
Previous ee-repo-ref: 0bdf8818fa115ad6b0d14f3117a18e8a580cce4d
New ee-repo-ref: 23431f5cf1d627051ded89111bbf2e301e9db456
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* fix(copilot): validate the version an approval stamps
* feat(copilot): let plan mode write artifacts, but never the plan
* feat(copilot): tell plan mode it may keep notes, not rewrite the plan
* feat: add empty state cards to list pages
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: animate trigger drawers on first open
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: distinguish filtered-empty schedules, reuse the rAF helper
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: hide the header create button while the empty state offers it
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Revert "fix: hide the header create button while the empty state offers it"
This reverts commit 98c57eede3.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: use the default variant for the empty state button
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* refactor: share hasActiveFilters from the filter searchbar module
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* docs: announce we are not seeking outside contribution
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* docs: point big ideas at the feature request template
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
WindmillFinder's ModuleSpec lacked origin, so __file__ was never set on
loaded modules. inspect.getfile() then raised "is a built-in module",
breaking typeguard's @typechecked and anything else that introspects
module source. Use spec_from_file_location() which sets origin correctly.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: hugocasa <hugo@casademont.ch>
* perf: cap resource content sent to the search modal
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: address review — fence the LATERAL, flag partial search, add cap test
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: pluralize the truncation notice and link the cap to its openapi doc
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: recover from a refused mcp read assertion, drop stale discovery
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: drop the stale listing from the raw error, not the bounded payload
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: drop sampling params on Claude models that reject them
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* docs: scope the sampling-param claim to what was probed and split the bedrock test
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* test: build the disable body through the resolver instead of asserting a rejected shape
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: use the Gemini 3.1 Pro id that actually resolves
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: Bedrock Sonnet 5 cannot disable thinking, unlike the native API
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: confine path-scoped jobs:run tokens to their runnable's jobs
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: project singlestepflow onto its runnable and confine kind-only run scopes
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: keep every by-id job read reachable by a jobs:run token
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: whitelist the dbt and wac-approval by-id job reads for run tokens
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: let an apps:run scope satisfy job-read confinement for that app's runs
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: apply run-scope confinement on top of the approval-token read bypass
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: confine the resume-secret job reads to the run scope as well
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Guilhem Lemouel
Ruben Fiszel
AlexRV12
Pyra
hugocasa