* feat: run AI decision steps on OpenAI's Decisions API
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: fail refused openai decisions and keep structured criteria
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: send only user message lists as openai decision messages
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: omit descriptions the openai decision step does not have
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: pass only exact openai user messages through as decision input
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: check the payload of openai decision message parts
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: concurrency limit over-admits when the counter row is missing
* chore: bump ee ref
* fix: restore sqlx entry for the locked counter read and bump ee ref
* feat: default new raw apps to react 19 and ask for the data setup
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: say what app new --schema writes and soften the already-set-up wording
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: resolve bare init_app table names in the app schema, fix --schema help
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: make every trigger and schedule editor control respect read-only mode
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: grey out read-only option buttons in gcp, mqtt and sqs editors
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep chat tool cards collapsed the way the user left them
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: open a tool card awaiting confirmation even after the user collapsed it
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: set up a new app before starting with AI and follow its deploy
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: set up a new app in one modal over its ai session
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: show schema creation progress and put the new app modal over the page
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: say when no worker can create a new app's schema instead of waiting
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: drop the summary from the new app modal
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: list existing tables only under an existing schema, explore from the schema row
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: start a new app from two cards, with ai recommended
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: isolate the raw-app editor preview when the app opts into sandboxing
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: gate job reads from a sandboxed editor preview like the deployed app
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: send a plain user in a sandboxed raw app's startup message
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: pin ui_builder to d3fdb70
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: strip NUL from ai agent output and job args before jsonb writes
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: also strip NUL from tool call ids and citations
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: count OIDC signatures and reuse server-side tokens
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: update ee ref
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: update ee ref
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: update ee ref
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to cbda28f632d773fd44e9bef8bea36dcb5e35b55d
This commit updates the EE repository reference after PR #847 was merged in windmill-ee-private.
Previous ee-repo-ref: cec12fc52eb1bb5d3f4f4ae489d86a64e96c6c0c
New ee-repo-ref: cbda28f632d773fd44e9bef8bea36dcb5e35b55d
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: refuse unscoped tokens of restricted jobs, add OIDC scopes claim
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep restricted job_perms rows by a stamp that survives retention
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: log refused unscoped job tokens at warn
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: key the unrestricted cache by token, keep restricted rows on bulk delete
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: clear a sweep stamp raced onto a queued job
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: stamp restricted job_perms rows under a row lock
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* test: give the memo test's job token scopes
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* refactor: keep only the OIDC claim, drop the server-side refusal
A relying party can already tell a restricted job from the claim, which is
absent when the presented token carries no scopes. The auth-layer refusal,
its lookup cache and the job_perms retention it needed are removed.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to 065c2c64c3904d5c0b2766b424210d34f9e54d2d
This commit updates the EE repository reference after PR #845 was merged in windmill-ee-private.
Previous ee-repo-ref: ea5354477cdf281598a816a5e16ad1f476d42afb
New ee-repo-ref: 065c2c64c3904d5c0b2766b424210d34f9e54d2d
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: choose build with AI or code when creating a raw app
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: carry the picked data table into a new-app session and seed only on 404
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: wait for data tables before build with AI and stop re-registering on edits
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: create apps without an unusable data table and name session-seeded apps
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: rename new-app choices and hint where to switch to AI later
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: run the weekly ai evals on global and cli across sonnet, opus, gpt-6 and deepseek
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep claude- prefixed and capitalised aliases in the cli model filter
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: add drive.readonly and drive to gdocs oauth scope options
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: describe what the gdocs drive scope grants in its label
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: open a run as a pushed page on narrow runs page
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep modifier-click multi-select and arrow keys on the narrow runs list
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: leave the narrow re-run page once the re-run is sent, and clear the opened run on reset
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: close the re-run options once a table re-run completes
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: serve the raw-app preview shell sandboxed, load a blob copy in the editor
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: give the preview shell the deployed app wrapper's sandbox flags
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: confine jobs:read to the runnable paths it names
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: filter job lists by read scopes alone and keep a job's own flow run readable
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: drop the add a prompt for AI button from the run page
* fix: open the run page in the session preview from a plain chat button
* fix: rename additional prompt for AI to AI prompt
* fix: put the run page chat button beside advanced when no AI prompt
* fix: honor custom timeout in setup phases and name the limit hit
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: label a shared-deadline phase timeout as the job's remaining budget
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: register dbt deploy jobs so their phase timeout is not called custom
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: search slow runs filters by time windows instead of timing out
* fix: cancel a pending runs page when its listing is reset
* fix: keep runs scan windows disjoint at microsecond precision
* fix: race the single runs request against the window scan
* fix: list the cursor window when a runs scan starts at the oldest job
* fix: show the runs history scan as an info alert
* fix: show runs scan progress as a bar and keep the session button on the searchbar row
* fix: stop a runs scan whose windows are no faster when narrower
* fix: right-align the runs searchbar row when the header wraps
* fix: keep the runs scan stop button inside a narrow list pane
A team plan canceled mid-month now keeps premium until the 1st, capped at the
executions its final invoice paid for. That reuses the past-due cap, so the job
refusal and the UI toast said "your last invoice is unpaid". Word both for a
canceled plan, and show it on the plan settings page.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat(ai-chat): show per-file diffs for raw app edits
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep reference runnable writes on the generic tool card
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: extend diff row highlights across horizontal overflow
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: collapse queued and running chat tool calls into a waiting row
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: correct the waiting-row comment in groupToolRuns
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: fold queued calls only behind a call in flight, after edit groups
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: stop a waiting row before queued calls that form an edit or explore group
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: flush proxied responses before the dev supervisor closes the client
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: shorten dev supervisor close-path comment
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* refactor: use the session tab strip for workflow sdk module tabs
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep module deletion on the explicit button and tab order view-only
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* refactor: use the design-system button for module deletion
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: let modified keys through file tabs and keep keyboard rename off the tab
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: route modified enter past the dnd zone so page shortcuts fire from draggable tabs
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: forward modified enter from dnd item wrappers too
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Ruben FiszelandClaude Opus 5.5
AlexRV12andClaude Opus 5.5
GuilhemandClaude Opus 5.5
hugocasaandClaude Opus 5.5
Diego ImbertandClaude Opus 5.5