The app provenance gate short-circuits on a valid presigned signature, but only the raw download_s3_file route parsed it. The parquet/csv/table-count/file-preview/metadata routes discarded sig/exp and always fell through to the provenance gate, so a presigned S3 object rendered as a table showed "File restricted" for any viewer who did not produce it. Thread sig/exp through every apps_u S3 display route and forward the presigned bearer from ParqetCsvTableRenderer/DisplayResult.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(ai): stop sending the AI agent system prompt twice for OpenAI
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(ai): document collect_system_prompt precedence and trim duplicate comments
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(ai): hoist only the leading system prompt for OpenAI
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
nsjail caps a jailed job's virtual address space at rlimit_as (4096 MiB for
python3 and ansible). JIT runtimes (Bun/JavaScriptCore, the JVM) reserve large
virtual ranges up front, so a subprocess spawned from a jailed Python/Ansible
job can crash against this cap even when its physical memory use is modest
(e.g. the Bun-compiled claude CLI hitting JSC/pthread allocation failures).
Most other language protos already run with disable_rl: true (unlimited);
python3 and ansible are the outliers with an explicit rlimit_as. This exposes
that cap via a per-language env var (NSJAIL_PY_RLIMIT_AS_MB,
NSJAIL_ANSIBLE_RLIMIT_AS_MB) so operators can raise or lift it on a dedicated
worker pool without a source patch/rebuild and without weakening the
mount/PID/user-namespace isolation that provides the real security boundary.
Only the address-space limit changes; cpu/fsize/nofile rlimits are untouched.
Value is in MiB, or unlimited/none/inf/0 to uncap (rlimit_as_type: INF). Unset
keeps the historical 4096 default.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(apps): invalidate cached app policy on change or deletion (GHSA-r5v4-cxh9-7qhq)
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* docs(agents): keep PR tests and comments minimal and non-ephemeral
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
A token scoped only to resources:write:<path> could delete linked secret
variables it had no variables:write scope for, by embedding $var:<victim>
in an attacker-controlled resource value and triggering the resource-delete
cascade. #9712 re-enforced scoped-token boundaries broadly but missed this path.
Add check_linked_var_delete_scopes, called before the cascade in both
delete_resource and delete_resources_bulk: require variables:write for every
linked variable, failing (and rolling back) the delete otherwise. No-op for
unscoped tokens, so full-token cascade cleanup is unchanged.
No co-located-path exemption: a resource and a variable may share a path, and a
resource-write token can create a resource over an existing standalone variable
and self-reference it, so "same path as the deleted resource" is attacker-
forgeable and cannot stand in for variable scope.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(ai): disable redirects on worker AI provider client (GHSA-5q4v)
The worker AI request path issued provider requests with the shared
HTTP_CLIENT, which follows up to 10 redirects without revalidating each
hop. SSRF validation on the provider base_url is single-shot, so a public
base_url could 3xx the worker into a private/internal host (e.g. cloud
metadata), bypassing the private-endpoint protection. The API proxy was
already hardened in #9370; the worker path was missed.
Add a dedicated AI_HTTP_CLIENT with redirects disabled and use it for the
user-controlled provider endpoint, mirroring the API proxy client.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(ai): add ALLOW_AI_BASE_URL_REDIRECTS debug escape hatch
Off by default (redirects stay disabled). When set, restores redirect
following on the AI HTTP client for debugging non-standard/self-hosted
gateways, with a startup warning that it weakens SSRF protection.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* docs(ai): correct redirect comment for the escape hatch override
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* docs(ai): condense redirect invariant comments per review
Anchor the SSRF rationale to ALLOW_AI_BASE_URL_REDIRECTS (the knob that
would break it) and shorten the AI_HTTP_CLIENT and call-site comments to
avoid restating it at multiple sites (AGENTS.md).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat(nativets): expose standard web-platform globals for bun parity
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat(nativets): wire bun-present Event subclasses and add construction smoke test
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(nativets): seed performance.timeOrigin per isolate, drop broken reportError
Addresses CI Codex review on #10112:
- performance.timeOrigin was undefined (setTimeOrigin never called); seed it
per isolate via __wmInitPerIsolate executed from create_nativets_runtime.
- reportError needs a global EventTarget this runtime never installs; drop it.
- reword the namespace-import comment to not describe drafting history.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat(nativets): wire DOMException global + broad edge-case smoke sweep
DOMException is present in bun and, more importantly, deno_web references it as
a global: AbortController.abort() with no reason constructs a
DOMException("...", "AbortError"), so the already-wired AbortController/
AbortSignal threw "DOMException is not defined" on abort. Surfaced by a new
functional edge-case sweep (smoke_web_globals_edge_cases) that exercises every
wired global for real (not just presence) — DOMException/abort, AbortSignal.timeout,
EventTarget dispatch, stream tee/reader/writer, all 3 compression formats,
structuredClone Map/Set/Date/circular/reject-function, performance mark/measure,
MessagePort delivery — plus a check that the merged Web Crypto globals still work.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* test(nativets): restore arg-default smoke tests dropped in merge, drop history comments
Addresses CI Codex/Pi review on the merge commit:
- Merge conflict resolution (checkout --ours) dropped smoke_missing_optional_arg_uses_default
and smoke_explicit_null_arg_is_preserved (added on main by #10111); restore them.
- Reword edge-case-sweep comments to state the constraint, not how the gaps were found.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(nativets): give reportException a global dispatch target; wire stream reader/controller globals
Addresses CI Codex review on #10112:
- P1: a throwing EventTarget listener (and reportError) is routed through
deno_web's reportException, which dispatches on a saved global reference.
With none set, dispatchEvent threw a masking error that hid the original.
Wire a dedicated EventTarget as that target so the ORIGINAL error is reported
(async unhandled, matching bun). Does NOT make globalThis an EventTarget (bun's
isn't either). Re-adds reportError, now functional. Regression test asserts the
original error is surfaced, not a masking one.
- P2: wire the stream reader/controller globals bun also exposes
(ReadableStreamDefaultReader/BYOBReader, ReadableStreamDefault/ByteStreamController,
ReadableStreamBYOBRequest, WritableStreamDefaultWriter/Controller,
TransformStreamDefaultController) for instanceof parity; sweep verifies via real
reader/writer/controller instances.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(nativets): make globalThis an EventTarget so globalThis.reportError() works
Addresses follow-up CI Codex review on #10112:
- P1: the prior fix saved a *separate* EventTarget as the global reference, so
globalThis.reportError() still failed its receiver check (this === globalThis_)
with 'Illegal invocation'. Make globalThis itself the saved reference by turning
it into a functional EventTarget (setPrototypeOf to DedicatedWorkerGlobalScope +
setEventTargetData + webidl brand + saveGlobalThisReference), per isolate in
__wmInitPerIsolate. Both reportError(e) and globalThis.reportError(e) now surface
the original error (async, matching bun) instead of throwing. New test
smoke_report_error_both_call_forms covers both call forms.
- P2: reword the regression-test comment to state the invariant, not the patch history.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat(nativets): wire performance constructor globals for bun parity
Addresses the P2 nit in the CI Codex review: bun exposes Performance,
PerformanceEntry, PerformanceMark, and PerformanceMeasure as globals (deno_web
exports all four), so wire them alongside the performance singleton. The
edge-case sweep verifies instanceof against real mark/measure entries.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* docs(nativets): state global-wiring comment as a constraint, not patch history
Addresses the P2 in the CI Codex review: reword the block comment to describe
the current bun-parity constraint and the deliberate EventSource/ImageData
exclusions, without narrating what was or wasn't wired before (per AGENTS.md).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(jseval): raise QuickJS eval memory cap to 128MB with clear OOM error
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* docs(jseval): note bare null/undefined throws are absorbed into OOM bucket
Addresses CI review P2 nit on map_quickjs_error.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(jseval): keep batch-rerun eval on a conservative 32MB cap; tighten OOM match
Addresses CI review: eval_simple_js runs in the API process with unbounded request concurrency, so it must not inherit the raised flow-transform cap. Tighten the Exception OOM match to exact string. Reword drafting-history comments per AGENTS.md.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(jseval): gate OOM on InternalError kind; path-specific remediation hint
Require the OOM InternalError name (not just the message) so a user throw new Error('out of memory') is not misclassified, and only suggest QUICKJS_MEMORY_LIMIT_MB on the env-tunable flow path (not the fixed-cap eval_simple_js path).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Flow input schemas omit `required` (they carry an `order` key instead),
which made `serde_json::from_str::<SchemaType>` fail in
`convert_schema_to_schema_type`. The error was swallowed and callers fell
back to an empty `SchemaType::default()`, so MCP flow tools advertised no
inputs. Add `#[serde(default)]` to `type`, `properties`, and `required` on
`SchemaType` so these schemas deserialize correctly. Scripts always include
`required` and were unaffected.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* perf(rls): wrap session GUC reads in RLS policies for per-statement InitPlan
RLS policies read current_setting('session.user' / 'session.groups' /
'session.pgroups' / 'session.folders_read' / 'session.folders_write')
directly inside their USING / WITH CHECK predicates. Postgres treats those
unwrapped calls as potentially row-varying and re-evaluates them once per
scanned row, on the read path of every workspace-scoped table.
The GUCs are set with SET LOCAL (set_config(..., true)) in
set_session_context(), so they are constant for the duration of a statement.
Wrapping each session-derived subexpression in a scalar sub-select lets the
planner hoist it to a one-time InitPlan (evaluated once per statement, reused
for every row) — same rows in, same rows out, N per-row GUC lookups collapse
to 1. Array-producing subexpressions keep an explicit ::text[] cast on the
sub-select so `= ANY (...)` / `?|` stay in their array-operand form rather
than being reparsed as a row-returning subquery.
The consolidating migration recreates every existing policy (across ~30 prior
migrations) whose predicate reads a session GUC, by deparsing the current
predicate and substituting the wrapped forms; the down migration is the exact
inverse (byte-identical round-trip). The adding-a-trigger skill documents the
wrapped form so new trigger tables inherit it.
Surfaced by pgrls (PERF001).
Fixes GIT-919
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* docs(adding-a-trigger): fix RLS example cast placement for = any context
The `= any(...)` example put the ::text[] cast inside the sub-select, which
Postgres parses as a row-returning subquery and rejects at CREATE POLICY with
`operator does not exist: text = text[]`. Move the cast outside the sub-select
(matching the migration's canonical form) so the operand stays in array form,
and note why.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The nativets in-process runtime (deno_core) exposed no Web Crypto API:
`crypto` was undefined, so scripts could not use `crypto.getRandomValues`,
`crypto.randomUUID`, or `crypto.subtle`, even though the bun runner provides
them. This closes that parity gap by registering the `deno_crypto` extension
and wiring the crypto globals onto `globalThis`.
- Pin `deno_crypto = "0.223.0"`, the sibling release of the already-pinned
deno_core 0.352 / deno_web 0.240 stack (deps: deno_core ^0.352,
deno_web ^0.240, deno_error =0.6.1), so the rest of the deno stack is
untouched.
- Register `deno_crypto::init(None)` after `deno_web` in both the snapshot
(build.rs) and the runtime (lib.rs) extension lists, keeping the snapshot a
prefix of the runtime list. deno_crypto declares deps = [deno_webidl,
deno_web], which the position satisfies.
- Import `ext:deno_crypto/00_crypto.js` in runtime.js and assign
`crypto` / `Crypto` / `CryptoKey` / `SubtleCrypto` to `globalThis`.
- Add the `smoke_web_crypto` opt-in smoke test asserting the UUIDv4 shape of
`randomUUID`, a non-zero `getRandomValues` fill, and the known
SHA-256("abc") vector via `subtle.digest`.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(mcp): let MCP tokens call preview run tools (jobs:run scope)
The MCP proxy mints an internal JWT scoped to exactly `scope_for_route`
for the endpoint it forwards to. For preview run routes
(`run/preview`, `run/preview_bundle`, `run/preview_flow`,
`run_wait_result/preview`, `run_wait_result/preview_flow`),
`determine_kind_from_route` matched the `SCRIPT_JOBS` prefix
`jobs/run_wait_result/p` (because "preview" starts with "p") and derived
`jobs:run:scripts`. But the preview handlers run arbitrary request-supplied
code with no deployed path and require the broad `jobs:run` scope, so
`jobs:run:scripts` was rejected with 403 "Required scope: jobs:run".
Preview/bundle routes now carry no runnable kind, so the derived scope is
the broad `jobs:run` the handlers expect. This also aligns the route-level
access check with the handler check for these routes.
Fixes GIT-920
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(mcp): anchor preview-route match to endpoint segment
Address CI review: `route_path.contains("preview")` also matched by-path
runs of a deployed runnable whose path contains "preview" (e.g.
`jobs/run_wait_result/p/f/team/preview_report`). Since determine_kind_from_route
also feeds check_route_access, such a route would derive the broad `jobs:run`
and reject a legitimately kind-scoped `jobs:run:scripts:*`/`jobs:run:flows:*`
token with 403.
Anchor the exception to the actual preview endpoints
(`jobs/run/preview*`, `jobs/run_wait_result/preview*`) so by-path runs keep
their kind. Add regression tests for preview-named by-path paths, and trim
the comments per AGENTS.md.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat(ai-agent): use a real tool description instead of the tool name
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(ai-agent): render tool-name error full width and hoist it above the description
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(ai-agent): make tool description field hug its content so a single line is vertically centered
Add an optional minHeight param to the autosize action (default unchanged at 30px) and pass minHeight 0 for the tool description so an empty/one-line field no longer reserves the 30px floor and leaves dead space below the text.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* chore(ai-agent): regenerate OpenFlow-derived prompts, CLI guidance, and copilot zod schema for tool description
Fixes the check-freshness CI failure (system_prompts + skills.gen.ts) and makes the flow copilot's openFlow.json / openFlowZod.gen.ts aware of the new AgentTool.description field so AI-authored tools can set it.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The MCP `get_items` script filter used `auto_kind IS NULL`, which excluded
every script with a non-null `auto_kind` (pipeline, test, WAC, ...). These
are valid runnable scripts and should surface as MCP tools.
Switch to the deny-list `(auto_kind IS NULL OR auto_kind <> 'lib')`, matching
the scripts list API (windmill-api-scripts). Only library scripts (no main
function) are excluded; pipeline/test/WAC and any future auto_kind values are
included.
Fixes WIN-2190
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat(saml): add ALLOW_PRIVATE_SAML_METADATA_URLS SSRF bypass
Introduce the ALLOW_PRIVATE_SAML_METADATA_URLS env var and its
allow_private_saml_metadata_urls() helper, mirroring the existing
ALLOW_PRIVATE_MCP_SERVER_URLS opt-out. This lets self-hosted deployments
with internal SAML IdPs (private IPs, no public DNS) skip the metadata-URL
SSRF check that otherwise blocks server startup.
The companion EE change (saml_ee.rs) consumes the helper to gate the
validate_url_for_ssrf() call and additionally treats a cleared
(empty/whitespace-only) SAML_METADATA setting as no SAML configured.
Fixes WIN-2169
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat(saml): surface opt-in hint and record SSRF control in threat model
Add saml_ssrf_error_message() so private-IdP metadata URL rejections point
to ALLOW_PRIVATE_SAML_METADATA_URLS (mirroring the MCP helper), with a unit
test. Record the new SSRF opt-in under T2 in THREAT_MODEL.md, and bump the
EE ref for the companion saml_ee.rs change.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* refactor(saml): add validate_saml_metadata_url with opt-in unit tests
Factor the SAML metadata SSRF gating into validate_saml_metadata_url()
(mirroring validate_mcp_server_url) so the private-URL opt-in branch is
unit-tested at the ssrf layer: blocks private by default, allows on
true/1, and keeps scheme/host syntax guards when the opt-in is on. Bump
the EE ref for the companion saml_ee.rs change.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to 394ad23242de429aef4074cc1dc28867dac95870
This commit updates the EE repository reference after PR #659 was merged in windmill-ee-private.
Previous ee-repo-ref: 86da208c5aef2570568e18c7ab98f4d58adeec18
New ee-repo-ref: 394ad23242de429aef4074cc1dc28867dac95870
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* fix(apps): cover script/flow component outputs in deployed-app S3 provenance gate
Deployed apps read S3 files on-behalf of the app author for logged-in viewers
(#10048). A confused-deputy guard confines those reads to files the app
"produced", but the recent-production check only matched inline `appscript`/
`preview` jobs nested under the app path. Files produced by the deployed
script/flow components an app is wired to run (e.g. a SQL query persisted to S3)
were therefore denied "File restricted" for every viewer, admins included.
Expand the provenance check to also match completed `script`/`flow`/`flowscript`/
`flownode` jobs whose `runnable_path` is one of the app's declared triggerables,
and accept the author identity via `permissioned_as = on_behalf_of` (not only
`created_by = caller`) so files produced on-behalf of the author are covered.
Reads outside the app's declared triggerables stay denied.
Adds a regression test seeding a script-kind produced file that reproduces the
"File restricted" denial before the fix and passes after.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(apps): key S3 provenance on on-behalf identity + cover flow steps (review)
Addresses the CI review on the S3 provenance gate:
- P1 (confused deputy): the recent-production check keyed on `created_by =
caller`, so a viewer who can run a declared script/flow directly (outside the
app, with un-pinned inputs) could craft a result naming an author-only key and
read it back through the app as the author. Key provenance instead on the
producing job's `permissioned_as` matching the on-behalf identity the download
reads as (the author in author-mode); a viewer's direct run has
`permissioned_as = viewer` and no longer clears the gate. Drops `created_by`
from both the appscript/preview and script/flow branches, closing the same
latent hole in the pre-existing inline-script branch.
- P2 (dead flow-step branch): `flowscript`/`flownode` jobs have
`runnable_path = <flow_path>/<step_id>`, which exact `= ANY(...)` never matched.
Split script vs flow triggerable paths; flow kinds now match the flow's own job
(bare path) and its step jobs via a `<flow_path>/%` prefix, bounded to declared
flows.
- P2 (test realism): the regression test now uses the production
component-prefixed triggerable key format (`<id>:script/...`), exercises a
flow-step-produced key, and asserts a viewer's own direct run of a declared
script stays denied (the P1 case).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(apps): tie deployed-app S3 provenance to an app-origination marker (review)
Second CI-review round flagged that `permissioned_as` still does not prove a job
was app-launched: a runnable configured with its own `on_behalf_of` makes a direct
`/jobs/run` resolve `permissioned_as` to that identity (the app author), so a viewer
with run access could execute a declared runnable directly, craft an S3 result, and
read it back through the app. The flow-path `LIKE fp || '/%'` match also let `_`/`%`
in a declared path admit unrelated flows.
Introduce a real app-origination marker instead of inferring provenance:
- Add `JobTriggerKind::App`; `execute_component` stamps every app-launched job with
`trigger_kind = 'app'` + `trigger = <app path>`. A direct `/jobs/run` cannot set
this, so it is the authoritative signal that a file was produced *by the app*.
- The provenance gate's recent-production check collapses to
`trigger_kind = 'app' AND trigger = <this app path>` (+ the 3h window and result
containment). This drops the forgeable `created_by`/`permissioned_as`/
`runnable_path`/kind logic entirely and removes the `LIKE` wildcard issue.
- Provenance is scoped to THIS app's path, so another app's jobs (even same author)
do not authorize this app's reads.
Regression test rewritten to the marker model: an app-produced key clears for viewer
and admin; a direct run whose `permissioned_as` resolves to the author stays denied
(the forgery); another app's output stays denied. Adds `app` to the OpenAPI
JobTriggerKind enum.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* test(apps): assert execute_component stamps trigger_kind='app' at runtime
Adds an end-to-end test that runs a real script component through the app
runtime (`apps_u/execute_component`) and asserts the enqueued job carries the
app-origination marker `trigger_kind = 'app'` + `trigger = <app path>` (not the
runnable path). The provenance-gate tests seed the marker directly; this proves
the runtime actually produces the exact marker the gate depends on.
execute_component commits the job row and returns its id, so the assertion reads
the row directly — no worker needed to run the job.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(triggers): reject trigger_kind=app for suspended-job reassignment (review)
`JobTriggerKind::App` (added for the app-origination S3 marker) became a valid
value for the resume/cancel suspended-trigger routes, whose handler derives the
table name `<kind>_trigger`. There is no `app_trigger` table, so both endpoints
would fail with a missing-relation database error (500). Reject `App` in
`get_suspended_trigger` alongside webhook/schedule so it returns a clean 400.
Adds a regression test asserting the reassignment route returns 400 (not 500) for
trigger_kind=app.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(apps): don't stamp app-origination marker on preview runs (review)
The app-origination marker (trigger_kind='app') was stamped unconditionally,
including preview mode. A preview lets a `jobs:run` caller supply arbitrary
`raw_code` against ANY app path without that app's deployed policy (raw_code with
no path/id skips all app authorization), so a preview returning
`{"s3":"<author-only-key>"}` would forge the exact marker the S3 provenance gate
trusts and read the victim app author's file.
Gate the marker on `!is_preview`: only deployed, policy-checked executions are
app-provenanced. Preview/editor S3 display does not rely on this marker (the editor
routes reads through the force_viewer allowlist), so nothing legitimate regresses.
Adds a regression test asserting a preview run's job is not stamped trigger_kind='app'.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(apps): editor-authorize preview marker + per-viewer S3 provenance isolation (review)
Closes the codex P1 (preview forgery) without breaking editor preview downloads,
and adds cross-viewer isolation to the provenance gate.
- Preview marker now requires app write: `execute_component` stamps the
app-origination marker on a preview only when the caller can EDIT that app
(`require_is_writer`), instead of never stamping previews. An app editor already
wields the app's author identity (they can deploy a component that reads the same
file), so marking their own preview is no escalation and keeps preview-produced
S3 results downloadable in the editor; a `jobs:run`-only caller who cannot edit
the app still cannot forge the marker. Deployed runs are unchanged (always
marked).
- Per-viewer isolation: the provenance gate now also requires
`j.created_by = <this caller>`. The security boundary stays the un-forgeable
`trigger_kind='app'` marker; `created_by` is an additional filter ANDed under it,
so it only narrows — a viewer can only download keys their OWN app runs produced,
not another viewer's result. Restores the per-caller scoping #10048 had, now safe
on top of the marker.
Tests: preview marked iff caller can edit the app; cross-viewer isolation (another
viewer's app-marked key denied, no admin bypass); direct-run and other-app keys
still denied; deployed run still stamped.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(apps): require apps:write scope (not just writer ACL) to mark preview provenance (review)
require_is_writer checks the user's underlying ACL but ignores token scopes, so a
writer's token deliberately scoped to apps:run/apps:read/jobs:run but WITHOUT
apps:write could still mark a preview and forge provenance — even though that token
cannot deploy the app (update_app requires apps:write), breaking the "any marked
caller can deploy equivalent code" rationale.
Require BOTH apps:write:<path> scope (check_scopes) AND the writer ACL
(require_is_writer) before stamping a preview's app-origination marker. Deployed
runs unchanged.
Adds a scope-restricted-writer token to the test (apps:run/read + jobs:run, no
apps:write) and asserts its preview stays unmarked; retains the full-editor
positive case and the non-editor negative case.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(apps): never app-provenance preview runs; read editor S3 as the caller (review)
Simplifies the preview handling: a preview executes as the *caller* (Viewer mode),
never as the author, so its results must be read back as the caller — never
author-mode — and must never carry the app-origination marker. This removes the
whole `require_is_writer` / `apps:write` / `can_preserve_on_behalf_of` reasoning
(which was also unsound: a writer's token or session may not be able to deploy a
component running as the app's on-behalf identity, so marking their preview could
still escalate).
- Backend: mark the app-origination marker for deployed runs only (`!is_preview`).
- Frontend: `getS3File` (AppImage/AppPdf/AppDownload) now routes editor/preview
reads through the viewer-scoped `job_helpers/download_s3_file` endpoint (reads as
the caller), matching what DisplayResult/ParqetCsvTableRenderer already do; only
a deployed app view uses the provenance-gated `apps_u` endpoint. This is the path
that previously relied on marking previews, so nothing regresses.
Test: a preview is never app-provenanced (owner's own preview and a non-editor's
both stay unmarked). Cross-viewer isolation, deployed marking, and the reassignment
guard are unchanged.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(apps): app components run on-behalf of the app, not the referenced runnable (review)
Root-causes codex's on-behalf-preview finding: `execute_component` was overriding the
app's resolved on-behalf identity with the referenced script/flow's OWN
`on_behalf_of` (its `on_behalf_of_email`). That is wrong in the app context — the
app's execution mode should govern:
- A Viewer-mode app could execute a component AS the referenced runnable's on_behalf
identity (privilege confusion / escalation), instead of as the viewer.
- A preview would run as that identity rather than as the caller, so its S3 output
could not be read back as the caller — the download-identity mismatch codex flagged.
Always use the app-resolved identity (author in author-mode, caller in
viewer/preview); a referenced runnable's own `on_behalf_of` no longer leaks into app
execution. Direct `/jobs/run` still honors a runnable's `on_behalf_of` (unchanged).
With this, previews always run as the caller, so reading editor/preview S3 as the
caller (viewer-scoped `job_helpers`) is unconditionally correct.
- Test: the deployed-component e2e now seeds the script with a distinct on_behalf and
asserts the component job's `permissioned_as` is the app identity, not the script's.
- Also reword the getS3File `configuration` param comment to describe current state
only (AGENTS.md comment rule).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* chore(apps): surface 'app' trigger kind in Runs UI; condense provenance comments (review)
Addresses codex review nits:
- Add `app` to `jobTriggerKinds`, `triggerIconMap` (LayoutDashboard), and
`triggerDisplayNamesMap` so app-component jobs (which now carry
`trigger_kind = 'app'`) are filterable in Runs and render their trigger info.
- Condense the app-origination marker, on-behalf-identity, and provenance-gate
comments to state each invariant once in <=4 lines at its relevant site
(AGENTS.md comment rule).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add an opt-in `wm_content_transfer_encoding: "base64"` field to the composite
result. When set (together with `wm_content_type`), result_to_response decodes
the string result into raw bytes before sending it, so sync HTTP routes/webhooks
can return arbitrary binary payloads (PDFs, images, ...) with any content type —
not just as base64 text or via object storage.
Explicit and safe: the encoding is never guessed, invalid base64 is a hard error
(no silent fallback to the encoded text), an unsupported encoding is rejected,
and a transfer encoding without a content type is rejected. Existing string
responses are unchanged.
Closes#5986
* fix: replicate all secrets on fork with external backend (WIN-2161)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* test: add Azure KV fork secret-replication reproduction (WIN-2161)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* style: condense clone_variables invariant comment (WIN-2161)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* test: drive real create_fork handler in Azure KV repro (WIN-2161)
Replace the windmill-common test that mirrored clone_variables' loop with an
end-to-end test in windmill-api-integration-tests that exercises the real
migration, create_fork and variable-read endpoints against a local Azure KV
emulator. Verified it fails (404 "not found in Azure Key Vault") without the
fix and passes with it; unique per-run ids keep it robust to the emulator's
persistent state.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* feat: add per-workspace job-retention override (EE)
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to 2ba6a2a75b6fc97858b306b2c98ada481e363c10
This commit updates the EE repository reference after PR #658 was merged in windmill-ee-private.
Previous ee-repo-ref: e7fb36acd813cd717bcf05f5aafbf81de271d618
New ee-repo-ref: 2ba6a2a75b6fc97858b306b2c98ada481e363c10
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* fix: clearer errors on auto-draft save failure (WIN-2157)
When an autosave draft save fails, the cloud indicator now surfaces the
backend reason on hover (native title tooltip) in addition to the
existing click popover, so the cause is discoverable without a click.
Backend now returns a clearer, actionable message:
- `require_can_write_path` distinguishes a malformed path (unrecognized
namespace prefix -> BadRequest) from a genuine permission denial, and
the deny message spells out where the user *can* write.
- `require_owner_of_path` no longer panics with an out-of-bounds index on
a malformed single-segment path (e.g. a bare `u`/`f`); it returns a
clear BadRequest instead. Covered by a regression test.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* chore: trim narrative comment to invariant in drafts.rs (WIN-2157)
Address CI review (AGENTS.md: comments record constraints, not narration,
≤4 lines): keep the malformed-path invariant, drop the motivation tail.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix: don't let a malformed stored draft 400 the draft listing (WIN-2157)
Address CI review (P1): require_can_write_path can now return BadRequest
for a malformed path, and list_drafts propagated it — so a single
malformed stored draft row (the draft table has no path constraint;
legacy/admin-authored rows may be malformed) would make GET /drafts/list
return 400. Treat BadRequest like NotAuthorized there: the row is simply
not writable. Verified e2e on EE — listing returns 200 with can_write
false for the malformed rows.
Also trim "unchanged"/"still" drafting-history narration from the
regression test comments (P2, AGENTS.md).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* chore: compress list_drafts comment to 4 lines (WIN-2157)
Address CI review P2: keep the constraint (draft table has no path
constraint) and the invariant (one malformed row must not 400 the
listing) within the AGENTS.md ≤4-line limit.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat(apps): authorize deployed-app S3 reads on-behalf of the author for logged-in viewers
A logged-in user viewing a deployed app now reads S3 files (rich result,
table/image/PDF preview, CSV export, download, metadata) the same way an
anonymous viewer already does: on-behalf of the app author per the app policy's
execution_mode, gated by an app-provenance check — instead of against the
viewer's own S3 permissions. This aligns S3 with every other thing an app does
(scripts, flows, resources all already run on-behalf of the author) and lets an
operator who lacks folder S3 permission still see data rendered inside the app.
The raw job_helpers/* S3 API stays viewer-scoped: a viewer who lacks folder
permission is still denied there. Only which endpoint the app frontend uses for
logged-in deployed viewers changes.
Backend:
- Add app-scoped, provenance-gated apps_u/* variants for all S3 display ops
(download_s3_file already existed; add download_s3_parquet_file_as_csv,
load_file_metadata, load_file_preview, load_parquet_preview, load_csv_preview,
load_table_count). Each routes through one shared helper
(app_s3_on_behalf_and_provenance) that scope-confines an app embed token,
resolves the on-behalf identity, and runs the provenance gate ONCE before
dispatching to the EE *_internal S3 helpers.
- Close the confused-deputy hole in check_if_allowed_to_access_s3_file_from_app:
the unconditional Ok() bypass for a logged-in, non-embed session now only
applies in viewer execution mode (where the on-behalf identity IS the viewer,
so the viewer's own permissions still bound the read downstream). Author-mode
reads (anonymous/publisher) always enforce provenance, for anonymous and
logged-in viewers alike, so a viewer cannot launder the author's S3
permissions with an arbitrary file_key.
Frontend:
- Route the deployed-app view through apps_u/* using the app-viewer isEditor
signal instead of login state (the old $userStore proxy wrongly sent
logged-in deployed viewers to the viewer-scoped job_helpers API). Editor and
preview keep viewer identity via job_helpers.
execution_mode: viewer remains the escape hatch for per-viewer S3 enforcement.
Fixes provenance-gated S3 display for logged-in operators on deployed apps.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* docs(backend): document cargo features, restarting the dev backend, and filesystem object storage
The dev backend runs `cargo watch --features quickjs` by default, which omits S3,
EE, MCP, and non-JS runtimes — feature-gated routes then 404 or return a
"requires <feature>" stub at runtime. Add a backend/CLAUDE.md section that:
- explains that you must restart the backend with the appropriate features to
exercise gated functionality, with the pid/cwd-scoped restart recipe (never
pkill target/debug/windmill) and the PORT=$BACKEND_PORT gotcha;
- documents what each commonly-toggled feature gate does (private, enterprise,
license, parquet, duckdb, language runtimes, mcp, trigger kinds, no_auth) plus
common combinations;
- documents using the built-in FilesystemStorage large-file storage for dev
workspace object storage (hidden from the UI dropdown; set via
edit_large_file_storage_config), including the advanced_permissions shape.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(apps): don't flatten inner query in app-scoped S3 preview routes
axum's `Query` uses `serde_urlencoded`, which cannot deserialize the typed
(numeric/bool) fields of a `#[serde(flatten)]`-ed struct and 400s on `limit` /
`offset` ("invalid type: string, expected u32"). The app-scoped
load_csv_preview / load_parquet_preview / load_table_count routes flattened
LoadPreviewQuery / LoadCountQuery, so their previews were broken. Restate the
fields directly on the outer query structs (with an into_inner() to rebuild the
inner query) and extend the CE OSS stub to match.
Also bumps ee-repo-ref.txt for the companion EE csv-separator panic fix.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix: address CI review — nested DisplayResult routing, byte-range contract, docs, tests
- [P1] Thread `appPath` into the nested `DisplayResult`s (render_all children and
the expanded-result drawer) so logged-in deployed viewers route nested/expanded
S3 tables, images, PDFs, and downloads through `apps_u/*` too, not job_helpers.
- [P2] Mark `read_bytes_from`/`read_bytes_length` required on the
`apps_u/load_file_preview` route (they are non-optional in LoadFilePreviewQuery),
and mirror the full query shape in the CE OSS stub so the byte-range contract is
enforced identically on CE and EE.
- [P2] Fix the backend retrigger command in backend/CLAUDE.md: cargo watch runs
from `backend/`, so `touch README.md` (not `backend/README.md`).
- [P2] Trim app_s3_onbehalf.rs comments per AGENTS.md (state the invariant once,
no drafting-history narration).
- Extend the integration test to cover the table-count, csv-preview (numeric
limit/offset deserialization), and file-preview (byte-range required) routes.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* docs(apps): tighten S3 provenance-gate comments per AGENTS.md
Consolidate the viewer-mode / author-mode rationale to ≤4 lines at each branch
of the gate, and drop the repeated explanation from the shared
app_s3_on_behalf_and_provenance doc comment (which now just states what the
helper does). No behavior change.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to f292a1040da6a667ce7c22abf63ec0debfdd480f
This commit updates the EE repository reference after PR #657 was merged in windmill-ee-private.
Previous ee-repo-ref: a582389084eb363997cb5e8053f29220e0d3eaec
New ee-repo-ref: f292a1040da6a667ce7c22abf63ec0debfdd480f
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
`sign_s3_objects` minted a long-lived HMAC bearer signature for any S3 key
handed to it, by any authenticated workspace member, with no check that the
caller was allowed to read that key. Since `validate_s3_signature` only
verifies the HMAC and expiry at fetch time, any member (operators included)
could mint a transferable capability to read arbitrary S3 keys, bypassing the
advanced S3 permission rules (`check_lfs_object_path_permissions`).
Authorize the read at mint time: add an `ApiAuthed` extractor and, before
signing each key, require the caller's own `S3Permission::READ` via
`get_workspace_s3_resource_and_check_paths`. A caller can no longer sign a key
they cannot themselves read. The fetch-side validators are left unchanged.
The only legitimate caller is the wmill SDK invoked from an app-author job,
whose token authenticates as the executing (author) identity — which can read
the key — so authorized app display is unaffected.
Adds an integration test proving an authorized caller can sign a readable key
(and the signature validates end-to-end through the presigned fetch route)
while an unauthorized caller is refused.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix: keep agent-worker server job-completed processor alive on init-script failure
The agent-worker API server's background job-completed processors relay
completions on behalf of many remote agent workers. The processor loop exited
(dropping its receiver) on an init-script failure, but on the server that failed
init script belongs to a remote worker, not the server. Once enough processors
exited, the shared completion channel disconnected and every /send_result POST
returned 500, stranding completions and creating zombie-job restart loops.
Add an is_agent_server flag so server relay processors don't self-terminate on
init-script failure. Pins the EE companion change.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* chore: bump EE ref for send_result wait-for-processor change
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* test: agent-worker server survives a failed init script
End-to-end regression for the agent-worker-server processor bug: an agent worker
runs a failing init script, POSTs the failed init-script completion to
/send_result, and the test asserts the server's background job-completed
processor stays alive (a subsequent job completes and no bg-processor critical
alert is raised). Fails if the is_agent_server guard is removed (the processor
breaks, the supervisor raises a critical alert).
Requires --features enterprise,license,private,agent_worker_server.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* test: replace heavyweight init-script e2e with focused unit tests
The panic/respawn/alert and 503 timeout paths are now covered by fast, deterministic
unit tests in windmill-api-agent-workers (supervise_processor, classify_send). Drop
the enterprise-only, global-config-mutating e2e in favor of those. Bump EE ref.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to bc45d9275d4307132927dc8ad3e82049b1aed463
This commit updates the EE repository reference after PR #653 was merged in windmill-ee-private.
Previous ee-repo-ref: 2aca03f28bb37e938ae548b81f1620b2e00dc0f7
New ee-repo-ref: bc45d9275d4307132927dc8ad3e82049b1aed463
Automated by sync-ee-ref workflow.
* chore: bump EE ref for bg-processor alert rate-limiting
Picks up windmill-ee-private#654: exponential backoff + rate-limited critical
alerts in supervise_processor, addressing the code-review nit.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to d48c0e01e8601a372353c032dd237ddb6fa3bbad
This commit updates the EE repository reference after PR #654 was merged in windmill-ee-private.
Previous ee-repo-ref: f89eeb6e333614850ef650e7df78e3c2335f107c
New ee-repo-ref: d48c0e01e8601a372353c032dd237ddb6fa3bbad
Automated by sync-ee-ref workflow.
* chore: bump EE ref for graceful-shutdown-during-backoff fix
Picks up windmill-ee-private#655: supervise_processor re-checks shutdown before
respawn and selects on the shutdown broadcast during backoff, so a crash-loop
backoff can't hang graceful shutdown. Addresses the Codex P1.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to 9bc5dfb9ce73a2d9b981a1de86eea6aa26688b79
This commit updates the EE repository reference after PR #655 was merged in windmill-ee-private.
Previous ee-repo-ref: 8dc3b3d9ec8f9c28b227d36c2a1327b4b2017665
New ee-repo-ref: 9bc5dfb9ce73a2d9b981a1de86eea6aa26688b79
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat(mcp): add multi-workspace MCP tokens via the gateway endpoint
A single MCP token with no bound workspace (workspace_id NULL + mcp scope)
now works across every workspace the token owner can access, served through
the existing /api/mcp/gateway endpoint. This avoids having to register one
MCP server entry per workspace in clients like Claude/Cursor.
In multi-workspace mode the runner exposes a synthetic `list_workspaces`
tool plus the generic API endpoint tools, each workspace-scoped one gaining
a required `workspace_id` argument (mirroring the proxy pattern users built
externally). Per-workspace scripts/flows are not enumerated to avoid
flooding the tool list — they are run via runScriptByPath/runFlowByPath
with an explicit workspace_id.
Auth is resolved per tool call: the gateway middleware detects a
workspace-less mcp token and marks the request MultiWorkspaceMcp, and the
runner resolves a per-workspace ApiAuthed from the raw token via the
AuthCache (validating membership; superadmins may act in any workspace).
Single-workspace tokens are unchanged.
Frontend: the MCP token creation flow gains an "All workspaces" option that
produces a workspace-less token and the gateway URL.
Fixes WIN-2153
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* test(mcp): cover multi-workspace endpoint tool transformation
Unit tests for endpoint_tool_to_mcp_tool_multi and list_workspaces_tool:
workspace-scoped tools gain a required workspace_id arg, global tools are
left unchanged, workspace_id is not duplicated, and list_workspaces takes
no arguments.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(mcp): forward script/flow args for runScriptByPath/runFlowByPath
These endpoints have an additionalProperties body (no declared properties),
so build_request_body previously returned an empty body and dropped every
script/flow argument. This was latent for the per-path run endpoints and
became load-bearing in multi-workspace mode, where scripts/flows can only be
run via runScriptByPath/runFlowByPath — parameterized runs silently lost
their arguments.
build_request_body now forwards all arguments not consumed by a path/query
parameter for pass-through (additionalProperties) bodies, keeping the strict
declared-only behavior for endpoints with explicit properties. The runner
strips the synthetic workspace_id argument before dispatch so it can't leak
into the forwarded body.
Reported by Codex review on #10043.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat(mcp): note workspace_id requirement in multi-workspace tool descriptions
Workspace-scoped tools already gain a required workspace_id parameter (with
its own schema description) in multi-workspace mode, but the tool's prose
description was unchanged. Append a note so models/clients that read the
description text know to pass workspace_id (and to call list_workspaces
first). Global tool descriptions are left untouched.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* refactor(mcp): trim multi-workspace tool/arg descriptions
The workspace_id note repeats across every workspace-scoped tool in each
tools/list, so keep it terse: description suffix "Requires `workspace_id`."
and arg description "Target workspace id (from list_workspaces)." to avoid
spending tokens on repeated boilerplate.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(mcp): enforce script/flow path scopes for multi-workspace run-by-path
In multi-workspace mode runScriptByPath/runFlowByPath are the only way to run
scripts/flows, but they were authorized against the endpoint scope only — never
the caller's mcp:scripts:/mcp:flows: path scopes. A granular token could run
items outside its allowed paths (e.g. mcp:scripts:f/team/* + mcp:endpoints:*
running f/other/secret), and a mcp:endpoints:* token could run arbitrary
scripts.
Now these two endpoints are authorized by the script/flow scope of the
requested path (matching single-workspace mode's per-item tools): exposed in
list_tools only when the token grants some script/flow (McpScopeConfig::has_any),
and at call time the path is checked via is_allowed("script"/"flow", path).
Verified e2e: mcp:scripts:f/team/* runs f/team/* but is denied f/other/*;
mcp:endpoints:* alone no longer exposes or runs run-by-path.
Reported by Codex + Pi review on #10043.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(mcp): deny run-by-path for mcp:favorites multi-workspace tokens
mcp:favorites sets granular=false, so the previous run-by-path scope check
(gated on `granular`) was skipped entirely — a default "Favorites only"
all-workspaces token could run any script/flow by naming its path, bypassing
the favorites restriction.
Favorites are an enumerated set reachable only through per-item tools, not by
arbitrary path, so they grant nothing for run-by-path. has_any() now returns
true only for mcp:all (not favorites), and the call-time check drops the
`granular` gate and relies on is_allowed() directly (already false for
favorites, true for mcp:all, pattern-matched for granular).
Verified e2e: mcp:favorites no longer exposes or runs run-by-path; mcp:all
still runs; granular script scopes still path-enforced.
Reported by Codex review on #10043.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Perpetual scripts (restart_unless_cancelled) re-pushed their restart job
with custom_timeout = None, so every rerun ignored the script's
configured timeout and fell back to the instance-level job_default_timeout.
Only the first run honored the script timeout.
Fetch the script timeout alongside restart_unless_cancelled (both cached
by the immutable script hash) and pass it as custom_timeout when
re-pushing the perpetual job.
Fixes WIN-2149
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The `// sandbox` annotation (and global nsjail sandboxing) restricted Deno to
`--allow-run=git,/usr/bin/chromium`. Both binaries can be coerced into spawning
`/bin/sh`, escaping Deno's permission model:
- git via hook configs, e.g. `git -c core.fsmonitor='/bin/sh -c <cmd>' status`
- chromium via subprocess-launcher flags, e.g. `--renderer-cmd-prefix` /
`--gpu-launcher`, pointed at a launcher the script writes into `./`
Because the subprocess is spawned by git/chromium — not Deno — it is invisible
to Deno's permission checks, giving any user with script-execution permission
arbitrary OS command execution (root, in the default worker container).
Critically, the Deno runtime is the ONE language never wrapped in nsjail (there
is no run.deno.config.proto; every other language has one). So for deno the Deno
permission model is the *entire* sandbox — there is no OS-level containment to
fall back on, and handing it any subprocess-spawning binary is an unconditional
escape regardless of the nsjail setting.
Fix: emit no `--allow-run` in the restricted path, denying all subprocess
execution. The advisory's alternative (inject `-c core.fsmonitor=false ...`)
doesn't apply — the user controls the git/chromium argv, so any injected
hardening is overridden. Admins who accept the risk (e.g. puppeteer) can still
re-add specific binaries via `DENO_FLAGS`.
Verified with both PoCs on a running worker: git and chromium invocations now
return `Requires run access to "<bin>"`; the sandbox escapes are closed.
Fixes WIN-2151
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The `// sandbox` annotation restricts Deno to `--allow-run=git,/usr/bin/chromium`.
git can be coerced into spawning `/bin/sh` via hook configs such as
`git -c core.fsmonitor=<cmd> status`, and that subprocess is spawned by git —
not Deno — so it is invisible to Deno's permission model. This let any user
with script-execution permission run arbitrary OS commands as root inside the
worker, fully defeating the sandbox.
The advisory's alternative (injecting `-c core.fsmonitor=false -c
core.hooksPath=/dev/null`) does not apply here: the user's own script invokes
git directly via `Deno.Command`, so Windmill cannot inject hardening flags into
that call. Removing git from the allowlist is the only complete fix. git was
originally allowed for git-sync-adjacent use, which no longer needs it.
Verified with the advisory PoC: git invocation now returns
`Requires run access to "git"` and the sandbox escape is closed. chromium
(puppeteer) support is preserved.
Fixes WIN-2151
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat(db-health): add connection sizing guidance
The Database Connections panel showed current/max connections but gave no
guidance on how to size max_connections for the deployment. Derive an estimate
from the live worker fleet: each worker instance shares a pool sized
DEFAULT_MAX_CONNECTIONS_WORKER + (workers - 1), and each server opens up to
DEFAULT_MAX_CONNECTIONS_SERVER (both overridable via DATABASE_CONNECTIONS).
The endpoint now returns live worker/instance counts, the default per-server
and per-worker pool sizes, the estimated peak worker connections, the reserved
superuser connections, and a recommended max_connections floor (workers + one
server + 25% headroom). Servers do not ping worker_ping, so the recommendation
assumes one server and exposes the per-server increment. The panel renders this
as a sizing breakdown and warns when max_connections is below the recommended
floor.
Fixes WIN-2147
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* refactor(db-health): single source for pool-size constants + sizing tests
Address review: db_connect.rs kept its own copies of DEFAULT_MAX_CONNECTIONS_*
that duplicate the windmill_common constants the sizing guidance reads, so
tuning the runtime pool size would silently leave the guidance stale. Re-export
the windmill_common constants from db_connect.rs so there is one source of truth.
Add unit tests for compute_connection_sizing covering the zero-fleet, single
worker, multi-instance, and reserved-clamp cases.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat(db-health): 20% headroom and 200-connection minimum floor
Lower the sizing headroom from 25% to 20% and never recommend below 200
connections (postgres defaults to 100; cheap headroom for growth/bursts/psql).
Update the guidance message and unit tests accordingly.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(db-health): honor DATABASE_CONNECTIONS in sizing recommendation
Address Codex P1: the runtime caps every process's pool at DATABASE_CONNECTIONS
when set (db_connect.rs), but the sizing guidance always used the default 50/5
pools. For a tuned deployment this under-estimated worker demand and could hide
a genuine under-provisioning (e.g. DATABASE_CONNECTIONS=100 with 5 instances is
500 worker connections, not 25).
compute_connection_sizing now takes the effective DATABASE_CONNECTIONS override
(read the same way db_connect.rs reads it): when set, each worker instance and
server pool is that value and the worker estimate is override * instances. The
response exposes server_pool_size / worker_pool_size (effective) and
database_connections_override; the panel renders both pool rows and labels them
(default) vs (DATABASE_CONNECTIONS), and the message states which source is used.
Adds a unit test for the override path.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(db-health): exclude agent workers from connection sizing
Agent workers reach the API over HTTP (MODE=agent, Connection::Http) and hold
no postgres pool, but their pings still land in worker_ping (written server-side
by /api/agent_workers/update_ping). Counting them inflated the connection
estimate. Filter the fleet query by the worker-name prefixes: DB-connected
workers use "wk-" (WORKER_NAME_PREFIX), agent workers use "ag-"
(AGENT_WORKER_NAME_PREFIX). Only wk- workers/instances feed the estimate; ag-
workers are counted separately and surfaced as context ("N agent workers
excluded — they use HTTP, not postgres connections"). Adds a unit test.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat: add parent_workspace claim to OIDC job tokens for fork workspaces
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* refactor: rename claim to fork_parent_workspace for clarity
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* chore: update ee-repo-ref to e2df172596e00877068d4b0a98afaef62fe429d1
This commit updates the EE repository reference after PR #651 was merged in windmill-ee-private.
Previous ee-repo-ref: f73001ac6c038694cfc2604233a59be1c0daa40b
New ee-repo-ref: e2df172596e00877068d4b0a98afaef62fe429d1
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Ruben Fiszel
hugocasa
lucsoft
Diego Imbert