* improve logging for github app operations
* ee ref
* chore: update ee-repo-ref to 0b9e92f9e089293c6d523b77ed2c11edbc7a99c0
This commit updates the EE repository reference after PR #489 was merged in windmill-ee-private.
Previous ee-repo-ref: b259642e7f36b83a991034d5b28ae616f94ee5fc
New ee-repo-ref: 0b9e92f9e089293c6d523b77ed2c11edbc7a99c0
Automated by sync-ee-ref workflow.
---------
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* test: add OTEL coverage tests
Add 38 unit tests covering OpenTelemetry infrastructure:
- OtelSettings serde (empty, partial, full, roundtrip, skip_serializing)
- OtelTracingProxySettings serde (defaults, languages, dedup, rejection)
- ScriptLang rename cases
- LogCounter initialization and CountingLayer event counting
- Targets filter suppression of windmill:job_log
- get_otel_context_envs traceparent format verification
- Worker OtelTracingProxySettings (HashSet variant)
Companion EE PR adds tests for span_cx_from_job_id, metric functions,
proto conversion, SpanBuilder, and tracing proxy handler.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* test: add E2E OTEL tests with in-memory exporters
Add integration tests that verify metrics and spans flow correctly
through the OpenTelemetry pipeline using in-memory exporters:
Metrics (1 comprehensive test):
- All 20 metric names registered correctly
- Counter values (push/delete/pull/zombie/execution/failed/started)
- Gauge values with attributes (queue count by tag, worker busy, db pool, health)
- Histogram values (execution duration, pull duration)
- Health status phase encoding (healthy=1, degraded=0, unhealthy=0)
Spans (6 tests):
- Root job span created with "full_job" name and Ok status
- Error status with "Job failed" description on failure
- trace_id derived from job UUID
- span_id derived from job UUID low bits
- Child jobs (with parent_job) produce no span
- Attribute values (job_id, workspace_id, script_path) match job data
Also:
- Add testing feature to opentelemetry_sdk for InMemoryMetricExporter
- Update otel_oss.rs for SdkTracer type rename in 0.30
- Add opentelemetry/opentelemetry_sdk to dev-dependencies
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* refactor: remove unit tests in favor of E2E OTEL tests
The E2E integration tests in backend/tests/otel.rs cover the same
ground more thoroughly with in-memory exporters.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* [ee] fix: update ee-repo-ref for dedicated worker job_dir fix
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* [ee] fix: update ee-repo-ref
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to 5e8b1bcfc2c9ade9db39c839f2faed4f82da5efc
This commit updates the EE repository reference after PR #490 was merged in windmill-ee-private.
Previous ee-repo-ref: d958cd3b8a9a17b5f3cb6cb411c8ebba0c380fdd
New ee-repo-ref: 5e8b1bcfc2c9ade9db39c839f2faed4f82da5efc
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: add DB-coordinated graceful restart staggering for settings changes
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: preserve original instance names in restart coordination record
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* refactor: remove randomness, add drain delay for in-flight requests
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: spawn restart in background, deduplicate entries, clarify stale filter
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
WAC v2 scripts previously disabled bundle caching, forcing every execution
to resolve windmill-client from node_modules at runtime (~74ms overhead per
bun launch). This makes both the prebundle and execution paths WAC-aware by
including WorkflowCtx/StepSuspend/setWorkflowCtx re-exports in the bundle,
so the wrapper can import them from the cached bundle instead of node_modules.
Benchmarked improvement: wac_inline_2 12→38 wf/s (3.2x), wac_seq_2 6→17 wf/s
(2.8x) with no regression on plain bun scripts or flows.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Previously, windmill.queue.count and windmill.queue.running_count OTEL
metrics would report no data instead of 0 when a tag's queue emptied.
This was because the SQL query uses GROUP BY tag, so empty tags are
absent from results. The Prometheus path already handled this by tracking
previously-seen tags and emitting 0, but the OTEL path was missing this
logic.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: upgrade axum 0.7 to 0.8 and related dependencies
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* test: add route reachability tests for ~80 previously untested endpoints
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: switch feature-gated trigger handlers from axum::async_trait to async_trait crate
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: update new trash routes to axum 0.8 path syntax
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to latest EE commit
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* test: upgrade route tests to assert 2xx responses with proper data setup
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* test: restore npm_proxy and ai_routes tests using local echo servers
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: gate workspace fork test behind enterprise feature flag
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* test: add ~40 more endpoint tests (jobs authed, health, favorites, ACLs, reachability)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: address review findings from axum 0.8 upgrade
- Use cookie value_trimmed() instead of value() for cookie 0.18 compat
- Update comments still referencing old :workspace_id syntax
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to 61ae055ea31481f1899953e9d5f65566b8c707b1
This commit updates the EE repository reference after PR #486 was merged in windmill-ee-private.
Previous ee-repo-ref: 0059d175a6fdddf52998b183bf91059b224704ac
New ee-repo-ref: 61ae055ea31481f1899953e9d5f65566b8c707b1
Automated by sync-ee-ref workflow.
* test: add test for new get_imports endpoint
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: remove unused import in raw_apps test
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* prepare sqlx
* Add relative imports to getDependencies of deployUI
* nit
* fix: correct get_imports doc comment, add tracing, use Set for dedup
- Fix copy-pasted doc comment on get_imports (said "get dependents")
- Add tracing::debug to get_imports handler to match get_dependents
- Use Set for O(1) duplicate detection in deploy dependency traversal
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: resolve parent_hash race condition in sync push with auto_parent
During concurrent sync push operations (parallel CLI groups or separate
CI pipelines), multiple requests could read the same remote script hash
and both try to create a new version with the same parent_hash, causing
"the lineage must be linear" errors.
Adds an opt-in `auto_parent` field to the create_script API. When set,
the backend resolves the parent_hash to the current head script at that
path within the transaction, atomically. This eliminates the client-side
race window where the parent could change between read and write.
The CLI now sends `auto_parent: true` when updating existing scripts,
so sync push is resilient to concurrent deployments.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: add missing auto_parent field in clone_script NewScript initializer
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: add advisory lock to serialize concurrent auto_parent script creates
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* sqlx
* fix: add sqlx anchor for CE-only user count query
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: add PDF input support to AI agent with user_attachments field
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* test: add integration tests for PDF input and backward compat
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: add ContentPart::File variant for PDF support across all providers
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* refactor: address review feedback on PDF support
- Extract parse_data_url_bytes and mime_to_document_format helpers in Bedrock
- Add is_document_mime helper in ai_types for centralized MIME routing
- Extract s3_object_to_content_part helper to deduplicate image_handler/openai
- Rename AnthropicImageSource to AnthropicBase64Source
- Derive Bedrock DocumentFormat from MIME type instead of hardcoding Pdf
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: merge user message and attachments into single message for Bedrock
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: use resource-level scope overrides during OAuth2 token refresh
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref.txt
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to 6db424512b0d02f86489e85f0026581b7637d6e6
This commit updates the EE repository reference after PR #484 was merged in windmill-ee-private.
Previous ee-repo-ref: c9277992608537155a9505a089aca91403d91159
New ee-repo-ref: 6db424512b0d02f86489e85f0026581b7637d6e6
Automated by sync-ee-ref workflow.
* fix: restore non-enterprise sqlx cache entries deleted by update_sqlx.sh
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: update sqlx cache for latest EE changes
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: rename migration to avoid timestamp collision with trashbin
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* refactor: collapse duplicate match arms and simplify effective_scopes
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: mask sensitive values (secrets, password args) in job logs
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* test: replace artificial unit tests with real integration tests
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* test: consolidate into single comprehensive masking test covering 8 scenarios
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: show first 3 chars of masked secrets and add security notice
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: update masking notice to say "display full value"
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: handle poisoned locks, deduplicate notice, mask non-string encrypted args
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* perf: snapshot-based masking, one lock per batch instead of per line
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* perf: use Aho-Corasick for O(m) single-pass matching regardless of secret count
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: track notice in snapshot (no global lock), document snapshot race trade-off
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* refactor: move fs-backed cache under WINDMILL_DIR
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: add WINDMILL_CACHE_PREFIX env var for per-session cache isolation
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: auto-use WEBMUX_BRANCH as cache prefix for session isolation
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: show groups and notes in flow status viewer
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: include notes/groups in flow_version_lite for run page
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: GitHub Enterprise Server (GHE) support for self-managed GitHub Apps
- Fix GHE installation URL: use /github-apps/ path instead of /apps/ for non-github.com hosts
- Fix double decodeURIComponent on OAuth state param (URLSearchParams already decodes)
- Add client_id to self-managed GitHub App validation
- Bump hub scripts to GHE-compatible versions (sync, test, init, clone)
- Bump LATEST_GIT_SYNC_SCRIPT_PATH to hub/28176
- Rename "GitHub Enterprise App" → "GitHub App" in UI labels (it works for both)
- Formatting fixes in GhesAppSettings.svelte and gh_success page
EE ref: windmill-labs/windmill-ee-private@09c9ed1
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Update SQLx metadata
* fix: handle GHE Cloud (*.ghe.com) app installation URL path
GHE Cloud uses /apps/ like github.com, not /github-apps/ like self-hosted GHES.
Docs: https://docs.github.com/en/enterprise-cloud@latest/apps/using-github-apps/installing-a-github-app-from-a-third-party
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: handle GHE Cloud (*.ghe.com) installation URL and update ee-repo-ref
GHE Cloud uses /apps/ like github.com, not /github-apps/ like self-hosted GHES.
Docs: https://docs.github.com/en/enterprise-cloud@latest/apps/using-github-apps/installing-a-github-app-from-a-third-party
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: update hubPaths to deprecate 28176 and use 28180 as latest sync script
Aligns with main's LATEST_GIT_SYNC_SCRIPT_PATH bump in PR #8532.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore: update ee-repo-ref to 6bb0ff0 (includes GHE fixes)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: add instance-level setting to enforce workspace prefix for HTTP routes
Add `http_route_workspaced_route` instance setting that forces all HTTP routes
to use workspace prefix (`/api/r/{workspace_id}/{route}`), mirroring the existing
`app_workspaced_route` setting for apps.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: bump http trigger version on setting change to invalidate route cache
The route cache is version-based, not TTL-based. Without bumping the
version sequence when the instance setting changes, cached routes would
continue serving with the old prefix behavior until a route is
created/updated/deleted or the server restarts.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: immediately refresh HTTP routers on setting change
The route cache polls every 60 seconds, but bumping the version sequence
only makes the next poll pick up changes. Explicitly call refresh_routers
after the setting reload so routes are rebuilt immediately.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: replace host docker socket with dind sidecar for isolation
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: comment out dind sidecar by default to avoid wasting resources
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: enable dind by default, comment out insecure host socket mount
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* [ee] feat: handle active:false in SCIM user PATCH/PUT for deprovisioning
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref for SCIM active:false deprovision fix
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* nit sqlx
* [ee] feat: add password.disabled column for SCIM user deactivation
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* [ee] feat: enforce password.disabled in auth checks
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* [ee] refactor: use scim_deactivated_user table instead of password.disabled
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* [ee] fix: apply SCIM filters to deactivated users, add name column
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: add down migration for scim_deactivated_user
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: rename migration to avoid timestamp conflict, update sqlx cache
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* [ee] refactor: use password.disabled for SCIM deactivation, block login for disabled users
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* [ee] feat: show disabled toggle in superadmin user list, add disabled field to API
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: add confirmation modal when disabling instance user
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: improve disable user confirmation text
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: revert toggle state when disable confirmation is cancelled
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: properly revert toggle on disable cancel using reset key
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* refactor: move disable/enable to dropdown menu, add disabled badge on email
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: rename 'Show active users only' to 'Recently active only' to avoid confusion with disabled state
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: remove accidentally committed gen files
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: use .catch() for enable user error handling in dropdown action
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: delete tokens on user removal, improve confirmation modal texts
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update sqlx cache for non-enterprise code paths
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: restore sqlx cache files deleted by incorrect prepare run
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: add missing sqlx cache for non-enterprise git sync query
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to a1274aa11a83f608eacc32c0d449ca3527d98c15
This commit updates the EE repository reference after PR #473 was merged in windmill-ee-private.
Previous ee-repo-ref: 30f8c53b101b9e25107e793cdc038b0e07061739
New ee-repo-ref: a1274aa11a83f608eacc32c0d449ca3527d98c15
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: add runner groups for shared-process multi-script dedicated workers
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* refactor: unify dedicated worker and runner group wrappers into single multi-script wrapper
Replace per-language single-script wrappers with the unified load/exec/exec_preprocess/end
protocol. Each start_worker() now writes scripts to scripts/<safe_name>/ and uses
generate_multi_script_wrapper(). handle_dedicated_process() sends load: on start and
exec: per job instead of raw JSON args.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* refactor: merge runner groups into dedicated workers with inline arg metadata
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to match EE branch
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: gate EE-only functions behind cfg(feature = "private") to fix OSS dead_code errors
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: auto-detect runner groups from workspace dependency annotations
- New endpoint GET /scripts/list_dedicated_with_deps: returns dedicated
scripts with parsed workspace dependency names from content annotations
- Frontend: show dep badges in DedicatedWorkersSelector with links to
workspace settings, warn when referenced dep doesn't exist, group
scripts sharing deps into "Shared runner" sections
- Remove manual "Runner groups" tab and RunnerGroupSelector component
- Remove runner_groups from WorkerConfigOpt/WorkerConfig (auto-detected)
- Fix Node.js single dedicated workers: transpile main.ts -> main.js via
Bun.build so the multi-script wrapper's dynamic import() works under Node
- Add package.json with type:module in scripts dir to silence Node warning
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* refactor: unify dedicated worker wrappers with baked-in codegen and routing
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* test: add e2e tests for multi-script dedicated worker routing (bun, deno, python)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: remove dead generate_dedicated_worker_wrapper function
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: add dependency installation to runner groups + make dep functions pub(crate)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: prevent bun loader from intercepting absolute paths within cwd
When a plugin's onResolve returns an absolute path, Bun re-invokes
the resolver with that path. The loader was then routing it through
the remote URL resolver, breaking runner group script imports.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: use _wm_ prefix for runner group scripts to avoid bun loader interception
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* refactor: extract DENO_UNSTABLE_ARGS constant to avoid repeating flags
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: regenerate system prompts
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: gate private-only exports behind cfg(feature = "private") for OSS build
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: move format strings before handle_dedicated_process to fix lifetime
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: regenerate sqlx offline cache
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix sqlx
* fix: skip empty lines in deno e2e tests (double newline from console.log + '\n')
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: use dict() instead of {{}} in python wrapper to avoid set literal
{{{{}}}} in format!() produces {{}} which Python interprets as an
empty set, not a dict. Use dict() which is unambiguous.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* refactor: remove deno from runner groups and associated tests
Deno resolves dependencies at runtime via URLs/import maps, so there's
no shared node_modules/pip install to benefit from runner groups.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* refactor: revert deno wrapper to inline old-style with exec: protocol
Since deno doesn't support runner groups, the unified multi-script
wrapper is unnecessary. Reverted to the old inline wrapper from main
but adapted to use the exec:<path>:<args> protocol.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* refactor: extract deno wrapper into reusable function and add e2e tests
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: use codebase presence (not nodejs annotation) to determine wrapper import extension
On main, codebase scripts import ./main.js (pre-bundled JS).
The wrapper_ext was incorrectly based on annotation.nodejs.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: improve dedicated workers UI - combine lists, better badges, tooltips
- Merge shared runners section with selected tags into one unified list
- Move language tag to right side of selector for alignment
- Change dep badge color from dark-gray to indigo
- Add tooltip on yellow warning badge explaining missing workspace dep
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: group shared runners visually in dedicated workers list
- Runner groups shown with a header (Shared runner · language · dep badge)
- Scripts in the same group nested under the header
- Standalone scripts/flows shown after groups
- Used Svelte snippet for reusable tag row rendering
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: improve visual separation between shared runner groups and standalone items
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: give standalone runners same header style as shared runners
- Each standalone script/flow gets its own header row with bg-surface-secondary
- Header shows "Dedicated runner" / "Flow runner" label, dep link, language badge
- Shared runner header: swapped language and dep badge positions
- Dep shown as inline link instead of badge in headers for cleaner look
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: inline standalone runner path in header, language badge on right edge, no max height
- Standalone items: path shown directly in header row (no sub-row)
- Language badge placed after flex-1 spacer (right-aligned)
- Removed max-h-64 overflow constraint from the list
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: consistent badges across runner list - dep+language on right, depBadge snippet
- Shared runner scripts: show (workspace) and language badge on right
- Standalone items: dep badges and language badge on right (after flex-1)
- Shared runner header: dep badge and language badge on right
- Extract depBadge snippet to deduplicate dep badge rendering
- Picker selector also uses depBadge snippet
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: show language badge on standalone items, hide from shared runner sub-items
- Fetch script language from API when not available from workspace deps
- Hide dep+language badges from tagRow when script is inside a runner group
(already shown in the group header)
- Standalone items now always show language badge
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: differentiate badge colors - gray for language, indigo for workspace deps
Matches codebase convention: gray for metadata (like script hashes),
indigo for linkable features/entities.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: use transparent (bordered) badge for language - visible on all backgrounds
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: use gray badge for language everywhere
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: revert skills.ts and AI files, add _wm_ exclusion to Windows loader
- Revert cli/src/guidance/skills.ts to main (not our change)
- Revert AI provider formatting changes (not our change)
- Add _wm_ prefix exclusion to loader.bun.windows.js filterResolve
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: update ee-repo-ref and regenerate system prompts after merge
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* perf: use DISTINCT ON in list_dedicated_with_deps to dedup at DB level
Avoids fetching all script versions and deduplicating in Rust.
Addresses PR review feedback.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: use sqlx query! macro for list_dedicated_with_deps and regenerate cache
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: dedicated worker review fixes and test coverage
- Fix Python relative imports in dedicated workers (write loader.py, add
import loader to wrapper when needed)
- Move Python colon parsing inside try/except to prevent crashes on
malformed stdin
- Add indexOf guard in Bun/Deno wrappers for malformed protocol messages
- Add stderr logging for unrecognized stdin commands in all wrappers
- Remove asyncio handling from Python wrapper (consistent with normal path)
- Add exec_preprocess protocol tests for Bun, Deno, and Python
- Add argument transformation tests (dates, bytes, kwargs, sentinel)
- Add relative import detection test for Python wrapper
- Add PreprocessedArgs variant to DedicatedWorkerResult test helper
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: remove symlink from git and gate has_relative_imports behind private feature
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: update ee-repo-ref for dedicated_worker_ee.rs changes
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: add mixed exec+preprocess test to use ProtocolCmd::Exec variant
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: remove hanging deno missing-preprocessor test
The Deno wrapper only generates the exec_preprocess handler when the
script has a preprocessor function. Without one, the message is
unrecognized and the test hangs reading stdout.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to 182943e5ad9bf2a905ccdf07d4e346437fb329a9
This commit updates the EE repository reference after PR #466 was merged in windmill-ee-private.
Previous ee-repo-ref: 995f701fe3754be6260fc6b679e5de8fc636e68a
New ee-repo-ref: 182943e5ad9bf2a905ccdf07d4e346437fb329a9
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Move the require_admin check from blocking the entire tarball export
to only guarding the include_key=true path. Non-admins can still
export tarballs for workspace sync/git, but only admins can export
the raw workspace encryption key.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: show sync resource types button when resource type is missing
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: show prominent error message when resource type is not found
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: use sync_cached_resource_types endpoint instead of hub_sync script
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: fallback to fetching resource types from hub when cache file missing
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: move basic git sync from EE to CE with runtime user count gating
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref.txt for git sync CE migration
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* refactor: keep git sync impl in private repo, revert oss to stub
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref.txt
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref.txt
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref.txt after merge
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: use LICENSE_KEY check instead of get_license_plan for runtime gating
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref.txt
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: improve git sync CE UX — use "Community Edition" wording, mention user limit
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: use "workspace members" instead of "users" in git sync messaging
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: lower CE git sync limit from 3 to 2 workspace members
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref.txt
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref.txt
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: simplify git sync CE alerts to warn about EE feature with member limit
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: add EE feature restrictions detail to CE git sync warning
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: show git sync settings even when >2 members, with disabled warning
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: show error alert when git sync settings exist but members exceed CE limit
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: mention CE git sync limit is for testing and hobbyist use
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to 79eeacccc0438010d7dfa60207a5cbdaf2eda08d
This commit updates the EE repository reference after PR #476 was merged in windmill-ee-private.
Previous ee-repo-ref: c4d69c6e700c16d44f909d9c7b6738b07043db98
New ee-repo-ref: 79eeacccc0438010d7dfa60207a5cbdaf2eda08d
Automated by sync-ee-ref workflow.
* chore: update sqlx cache
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: regenerate full sqlx cache after main merge
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update sqlx cache
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref and regenerate sqlx cache with private feature
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: use LICENSE_KEY_VALID for EE check, allow delete without access check, extract helpers
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref.txt
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* refactor: use compile-time cfg(enterprise) gating instead of runtime license checks
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref.txt
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to 6171a91da38d6d16a88aeb1a3a4f4df78f995383
This commit updates the EE repository reference after PR #481 was merged in windmill-ee-private.
Previous ee-repo-ref: 52681940cda6d70f65aeeb7144288f060b4d736e
New ee-repo-ref: 6171a91da38d6d16a88aeb1a3a4f4df78f995383
Automated by sync-ee-ref workflow.
* chore: update ee-repo-ref.txt
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to b5c8af4df9ba2c39fdd494d7a40f9a92fbff8abc
This commit updates the EE repository reference after PR #482 was merged in windmill-ee-private.
Previous ee-repo-ref: 6e5b2741831468a7b30b26c0df1241e6141c6833
New ee-repo-ref: b5c8af4df9ba2c39fdd494d7a40f9a92fbff8abc
Automated by sync-ee-ref workflow.
* fix: gate CE_GIT_SYNC_MAX_USERS behind cfg(not(enterprise))
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* [ee] fix: serve index disk storage sizes from /srch/ endpoint
On multi-container deployments, the API server doesn't have the index
files on its local disk, so disk size was always reported as 0.0B.
Added a new GET /srch/index/storage/disk endpoint that calculates disk
sizes on the indexer process (which owns the files). The frontend now
fetches disk sizes from this endpoint in parallel with the status call.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to 71aab648925f31cde37efd31d79a7f3a977fd42a
This commit updates the EE repository reference after PR #480 was merged in windmill-ee-private.
Previous ee-repo-ref: b3e0000e2528809302c18f36930aebf3d004747a
New ee-repo-ref: 71aab648925f31cde37efd31d79a7f3a977fd42a
Automated by sync-ee-ref workflow.
* chore: update ee-repo-ref to indexer-disk-storage-zero branch
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update sqlx metadata and ee-repo-ref
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Ruben Fiszel
Alexander Petric
hugocasa
centdix
wendrul
Samuel Wilk