mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-10-28 08:02:43 +00:00
07d4f7fe613b285963fa27749bfb44bb91e237a1
7687
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
  hugocasaandClaude Opus 5.5
|
07d4f7fe61 |
feat: app conversations through the memory_id query parameter (#12025)
* feat: app conversations through the memory_id query parameter, chat-mode flows included Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: regenerate the mcp session instructions Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: type backendAsync's memoryId option in the eval diagnostics Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: pin git-sync hub scripts to windmill-cli 1.849.0 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: memoryId option on the sync backend call too Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: bump the ui builder artifact for the memoryId option Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: shared-utils 1.0.14 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: cli takes shared-utils 1.0.14 for the memoryId option Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: pin the app conversation scoping and the memoryId signatures Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: assert the ownership refusal, not any refusal Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: match the memoryId option in the cli wmill.ts signature tests Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: file an app's turns as the deployed flow's conversation, preview included Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
hugocasaandClaude Opus 5.5
|
8121dc2b1c |
feat: show runs, run tables, deploy reviews and items as mcp apps cards (#11969)
* feat: render mcp run tools as an mcp apps run card Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: back off run card polling and pin its run summary Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep the run card polling after a failed get_run Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: add run details, run form, diff and item views to the mcp card Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: guard the mcp card's run form and diff errors Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: honour the host's dark theme in the mcp card without its colours Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep untouched run form arguments and drop stale run refreshes Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: let the run form re-send references and label diff links by target Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: parse literals typed over run form references by field type Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: version the mcp card uri and declare its empty csp Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: keep the mcp card to runs, group loop and branch steps, restyle it Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: say when the mcp card cannot read a finished run's details Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: show runs, run tables and deploy reviews through dedicated mcp tools Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: review the whole draft before deploying from the mcp card Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: follow host card guidelines: header link, collapsible steps, review summary, no run form Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep fullscreen review diffs whole and match drafts by storage path first Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: link to windmill where a host has no fullscreen, cap inline logs, shrink the card back Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: say in the review summary why a draft cannot be deployed from the card Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: link the review to compare and deploy, cap inline tables, open long results Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: flag a cut result or log by what was kept, keep a lone log line Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: mark the mcp card's fullscreen buttons with the expand icon Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: capitalize the mcp card's windmill link labels Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: add a show_item card for workspace items, collapsible sections in fullscreen Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: apply windmill brand guidelines to the mcp card and show errors as windmill does Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: show more windmill result kinds in the mcp run card Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: tidy the mcp card layout and let oversized drafts deploy from the review Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: name a shown run by its summary, cap long item values, drop variable cards Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: link an app draft's card to its editor Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: show a running flow's progress in the mcp card, open cut blocks on click, link each step Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: read only a running step's log tail and skip the preprocessor in the progress bar Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: mcp card headers carry a kind icon, and a summary names the item over its path Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: skip result streams in log tail reads, keep the cut-result link when it fits Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: link app drafts and agents to their own pages, offer Cancel only to tokens that can cancel Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: simple inline mcp cards with a tabbed fullscreen run view and step drill-in Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: draw the mcp card's tabs as windmill's underlined tabs Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: link to windmill for what an mcp card hides when the host has no fullscreen Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: mcp run card steps as a tree beside the selected step, nested progress, danger cancel Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: draw image results in the mcp run card, and a collapse control in fullscreen Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: copy controls on the mcp card's results, logs and code Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: mcp card links read as text, hover tint only on buttons Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: windmill's names, icons, status colours and type scale in the mcp card, within the hosts' rules Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep images out of mcp run table rows, and re-read only single-field image results Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: measure a re-read mcp image result as postgres prints it, so wrapped images draw Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: mcp review deploys the selected drafts, loops list every iteration's result, branches and subflows named Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: mcp review diffs open on demand, as on the compare page Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: mcp script cards fade their code in inline, item sections open whole in fullscreen Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: mcp item cards link what a schedule or trigger runs, show a trigger's key settings and a schedule's arguments as rows Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: mcp card lists a loop's latest 10 iterations, trigger topics by name Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: mcp trigger cards open their other settings from a last table row Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: mcp draft badge in windmill's indigo without a spinner, show-more as a list's last row Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: consistent mcp cards: one expand icon and rule, aligned tables, path titles, error and empty states Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: mcp item cards offer fullscreen for cut values and overflowing code, name script steps by path Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: mcp cards show ai agents: their answer, named tool calls, what a waiting agent asks, saved agents Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: mcp saved-agent runs label tool calls by tool, never by the internal root step Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: a saved agent's run card names its steps tab Tool calls Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: an mcp card says an agent waits only while its run is going Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: mcp card paths wrap at slashes beside their icon; oauth approval offers all workspaces to a user in none Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: mcp card view read carries the cache hints 2026-07-28 clients require Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: mcp card leaves leaving fullscreen to the host's own close control Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: mcp cards name a saved agent's test run by the agent's path, without .chat Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * perf: mcp get_run builds no card data; the run card refreshes through show_run Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: mcp show_deploy_review refuses a token that cannot deploy, not only hides from it Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: mcp session tools carry a title and explicit read-only, destructive and open-world hints Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: mcp run card reads only the end of a run's log; create_datatable_migration is destructive Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: mcp run card counts log offsets from 1 and reads a finished run's archived log in full Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: mcp item card rechecks clipped code on resize; oauth hint hides once the toggle is on Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: mcp item card uncuts a code block once a wider card fits it Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
hugocasaandClaude Opus 5.5
|
8dd46a4d14 |
feat: build, test and run standalone ai agents from ai sessions (#11954)
* feat: guidance for building standalone ai agents in ai sessions Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: agent guidance for resource-only sessions, no flow tools Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: tell the user to deploy a drafted tool script with its agent Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: scope plain agent values, document tool_inputs, list agents in get_instructions Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: test and run ai agents from ai sessions, open agents in their editor Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: full-bleed agent editor tabs, back to the run form for agent tests Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: describe read-and-run as running agents too, pin agent run links Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: host the agent editor natively in session tabs Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: switch the agent editor to tabs below 900px Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: name an agent's session tab after its summary Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: show deployed agents in session tabs, open and run them from the chat Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: deploy agents from the chat, report agent tabs as the active editor Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: pick agents from the tab picker, name their tabs, scope the agent page to its workspace Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: leave open editors alone on agent writes, read the agent page's workspace user Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: refresh an agent's deployed page when the chat deploys or deletes it Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: name agent tabs before they load, mark agents in the changes drawer, stay on a deleted agent's tab Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep a cleared agent summary out of its tab name Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep the resource drawer's json option that the resources list still passes Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: open an agent in an AI session from its pages, fix review findings on agent tabs Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: name the reserved agent tool names in the agent guidance Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: reload an agent's editor on a discard, open a new agent in a session Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: show agents as agents on compare and deploy, name a never-deployed one by its path Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep a deployed agent's type in its draft diff Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: link a fork row to the agent editor only on the side that holds the agent Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: guard agent page paths, mark drafted agents in the picker, side-aware agent rows on fork compare Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
  Ruben Fiszelandrubenfiszel
|
f2f38ddd4f |
chore(main): release 1.850.0 (#12019)
* chore(main): release 1.850.0 * Apply automatic changes --------- Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com> |
||
|
hugocasaandClaude Opus 5.5
|
7b1dce5af0 |
feat: forward a pinned version through the hub project export proxy (#12022)
The proxy rebuilds the hub URL instead of passing the request through, so a `?version=` on it was dropped and the current version exported in its place. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
bac1e463e5 |
feat: add ai review to fork deploys and deployment requests (#12029)
* feat: add ai review to deployment requests Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: bound ai review fetches and surface unreadable items Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: add fix in ai session and model picker to deployment ai review Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: add workspace instructions for deployment ai review Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: read review instructions from the parent and bind ai review to the fork Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: pin the fix-all session preview to the fork's compare page Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor: drop workspace-settings instructions from deployment ai review Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: review the selected items with ai on compare and deploy Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: mark an ai review out of date when its items change Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: post all ai review findings as comments at once Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: update ee-repo-ref to 77703cf32e58964906d87ee83ddda44b5b8d1b7e This commit updates the EE repository reference after PR #926 was merged in windmill-ee-private. Previous ee-repo-ref: e30ab9e69d1854fcaed5620c934ace32acb0a729 New ee-repo-ref: 77703cf32e58964906d87ee83ddda44b5b8d1b7e Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |
||
 AlexRV12
|
e2e2e7d7c4 | fix: build hub script urls and cache keys from the parsed id only (#12028) | ||
|
Ruben FiszelandClaude Opus 5.5
|
e0da560516 |
feat: build MCP OAuth urls from the api base url, narrowable per surface (#12010)
* feat: configurable public base url for the MCP gateway Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep mcpTokenUrlDisabled's doc comment on its function Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: build MCP OAuth urls from the api base url, narrowable per surface Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: save and discard companion setting keys in the per-category settings flow Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
hugocasaandClaude Opus 5.5
|
a1bc9ec0c2 |
feat: tool approval and a question tool for ai agent steps (#11826)
* feat(ai-agent): built-in approval tool that parks the agent An AI agent step can now be given a built-in "Request approval" tool. The model calls `request_approval` with a message; the agent stores its conversation in the new `ai_agent_checkpoint` table, releases its worker by parking its own queue row like a workflow-as-code parent, and resumes with the answer (approved, approver, comment) or a timeout once someone answers from the run page. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(ai-agent): tie approval answers to their request and hold the turn - A turn that asks for approval runs none of its other calls; they are refused so the model repeats them after the answer. - The run page sends the request's call id. An answer naming another request is ignored and the agent parks again for the time left; `suspend` is zeroed when the answer is read, so answers sent while the agent runs are refused. - The checkpoint is read whatever the current roster holds, the answer's outcome is written by position, and a cancel that beats the park completes the job as cancelled. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(ai-agent): say why calls beside an invalid approval request were refused Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(ai-agent): one approval form per request, none on a finished run Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(ai-agent): answer approval requests from a flow's chat Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(ai-agent): show chat approvals for agents that do not stream Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(ai-agent): approval as a per-tool setting, built-in tool asks a question Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(ai-agent): say when a nested agent leaves out tools that require approval Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(ai-agent): show chat approvals and questions on the tool's own card Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(ai-agent): question choices, and approval buttons shared with approval steps Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(ai-agent): show a waiting agent as suspended, and refused calls as not run Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(ai-agent): each added chat card shows its own call, answered marker keyed by job Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(ai-agent): approve and reject a held call through resume_suspended Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(ai-agent): require approval in a tool settings tab, plain descriptions on built-in tool panes Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(ai-agent): sentence case for the web search tool label Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(ai-agent): built-in tool drawers explain themselves in the header subtitle Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(ai-agent): clearer question tool subtitle Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(ai-agent): badge the tool settings tab like run settings Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore(ai-agent): regenerate system prompts and MCP session files Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
Ruben FiszelandClaude Opus 5.5
|
a2b91fd17e |
fix: detect attached -c and --no-config in DENO_FLAGS (#12027)
* fix: detect attached -c and --no-config in DENO_FLAGS Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep tracing span on handle_deno_job Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
hugocasaandClaude Opus 5.5
|
ee4150a69c |
fix: serve new MCP OAuth sign-ins the session toolset on the tools server URLs (#12024)
* fix: serve new MCP OAuth sign-ins the session toolset on /api/mcp/gateway Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep the mcp:session marker across every token scope edit Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: serve marked MCP sign-ins the session toolset on the per-workspace URL too Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: let a restricted caller re-save a token's mcp:session marker Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: preselect build and run when an MCP client requests every scope Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: advertise only granting MCP scopes in protected resource metadata Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: apply the blanket-request default on the consent page only Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: treat only an mcp:all request with both narrowings as blanket Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
hugocasaandClaude Opus 5.5
|
2b4dfccb36 |
fix: add job_id, step_id and flow_path to native ts step errors (#12012)
* fix: add job_id, step_id and flow_path to every executor's step error Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: take the step error's flow_path from the pulled job, not a query Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: add step context to native ts errors in the executor instead of process_result Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
Ruben Fiszelandrubenfiszel
|
a72484b2aa |
chore(main): release 1.849.0 (#12002)
* chore(main): release 1.849.0 * Apply automatic changes --------- Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com> |
||
|
Ruben FiszelandClaude Opus 5.5
|
878d690a5b |
chore: remove nsjail enterprise feature startup warning (#12003)
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
|
6c8fd6cfe2 |
feat: per-user Anthropic Workload Identity Federation for Windmill AI (#11998)
* feat: authenticate Windmill AI to Anthropic with per-user Workload Identity Federation Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: reject WIF-only Anthropic resources in agent steps, scale token refresh margin Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor: move Anthropic WIF to a separate anthropic_federated resource type Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: point agent steps at an anthropic resource instead of a federated one Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: report a federated resource missing a field instead of reading it as standard Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: count Anthropic federated token exchanges in feature_usage Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: update ee-repo-ref to 747336910e5c7498544613ad7863cea59f4db6a1 This commit updates the EE repository reference after PR #923 was merged in windmill-ee-private. Previous ee-repo-ref: 3ea70adff288448f7318ff20b41225fd726ca8d1 New ee-repo-ref: 747336910e5c7498544613ad7863cea59f4db6a1 Automated by sync-ee-ref workflow. * feat: authenticate AI agent steps with anthropic_federated resources (#11999) * feat: authenticate AI agent steps with anthropic_federated resources Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep get_id_token's signature for its EE callers Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: update ee-repo-ref to 747336910e5c7498544613ad7863cea59f4db6a1 This commit updates the EE repository reference after PR #923 was merged in windmill-ee-private. Previous ee-repo-ref: 3ea70adff288448f7318ff20b41225fd726ca8d1 New ee-repo-ref: 747336910e5c7498544613ad7863cea59f4db6a1 Automated by sync-ee-ref workflow. * feat: switch between anthropic and anthropic_federated when adding a resource Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep registryCcCapable's doc comment on it Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |
||
|
Ruben Fiszelandrubenfiszel
|
1ce00e0263 |
chore(main): release 1.848.3 (#11996)
* chore(main): release 1.848.3 * Apply automatic changes --------- Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com> |
||
|
Ruben Fiszelandrubenfiszel
|
34a01cc61a |
chore(main): release 1.848.2 (#11993)
* chore(main): release 1.848.2 * Apply automatic changes --------- Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com> |
||
 Alexander PetricandClaude Opus 4.8
|
ccf889269b |
fix: tighten file handling in deno/bun, stricter codebase tarball,executor isolation (#11990)
* chore: tighten file handling in deno/bun, stricter codebase tarball, executor isolation * fix(worker): gate now-unused extract_tar behind its enterprise+parquet caller Removing the codebase-bundle caller of global_cache::extract_tar left its only remaining caller, pull_from_tar, gated on enterprise+parquet, so under other feature sets the function (and its tokio::time::Instant import) became dead code and failed CI's -D warnings build. Gate the definition and the import with the same cfg as the caller so they appear and disappear together. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> |
||
|
Ruben Fiszelandrubenfiszel
|
2e577bb6f6 |
chore(main): release 1.848.1 (#11981)
* chore(main): release 1.848.1 * Apply automatic changes --------- Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com> |
||
|
Alexander Petric
|
82d1076604 | chore: normalize NUL escapes in job args before name-based checks (#11989) | ||
|
Alexander PetricandClaude Opus 5.5
|
45d3c951bb |
fix: restore workspace pg_dump changes reverted by 812ff6ea5e (#11988)
|
||
|
Alexander PetricandClaude Opus 5
|
812ff6ea5e |
Merge commit from fork
Co-authored-by: Claude Opus 5 <noreply@anthropic.com> |
||
|
Alexander PetricandClaude Opus 5
|
8af484292f |
Merge commit from fork
The database name of a Postgres resource was the bare positional argument of pg_dump and the value of psql's --dbname. Both forms are interpreted: as a positional argument a name opening with `-` is read as an option of pg_dump (`--file=`, `--restrict-key=`), and in both forms a name holding `=` is expanded as a libpq connection string that overrides the host, port and user Windmill passed before it. libpq reads PGDATABASE as a plain name, neither parsed nor expanded, so the name now goes there. The change is in the shared helpers, so it covers every caller: import_pg_database, export_pg_schema, datatable_clone::make_copy, generate_initial_datatable_migration and pg_import_dump. pg_dump's invocation is extracted into pg_dump_command() beside the existing psql_command() so the argument vector can be asserted on directly. Beside that: - resolve_pg_source_checked_with_kind() now refuses a name opening with `-` for every source and target it resolves, where validate_dbname() only ever reached a target. The check is deliberately narrower than validate_dbname(): a source is any database a user already has, and `2024_archive`, `my.db` or a non-ASCII name are all names Postgres accepts and resources carry today. - export_pg_schema and import_pg_database now require the `code` capability, the one the data table migration endpoints next door already ask for. Both make the API server run pg_dump/psql as children of its own process against a database the request names, so the role that may not run code should not reach them; they stay open to every author, who can run pg_dump in a job anyway. The frontend offers both only from the database manager. Co-authored-by: Claude Opus 5 <noreply@anthropic.com> |
||
|
Alexander PetricandClaude Opus 5.5
|
f1c361e3d1 |
chore(worker): identify init and periodic scripts by how they are queued (#11987)
Recognise the worker's own init and periodic scripts through a single helper shared by the bash and PowerShell executors, based on the workspace, identity and tag they are queued with. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
Alexander PetricandClaude Opus 5.5
|
65c078d2a0 |
chore(nsjail): align dependency install profiles with the run profiles (#11986)
Set `keep_caps: false` in the python, ruby and R dependency install/lock profiles, matching the run profiles, and build the uv argument list in `download_deps.py.sh` directly instead of through a command string. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
Alexander PetricandClaude Opus 5.5
|
70d3c637ef |
chore(rust): run host-side cargo commands from a dedicated working directory (#11985)
Run `cargo sweep` and `cargo generate-lockfile` from a worker-owned scratch directory instead of the job directory, pointing at the crate with `--manifest-path`. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
hugocasaandClaude Opus 5.5
|
001313aa24 |
fix: use linkedin openid connect default scopes (#11953)
* oauth: linkedin OIDC default scopes + scope_options, quickbooks asks isSandBox Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: leave quickbooks connect fields to #11960 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
Ruben FiszelandClaude Opus 5.5
|
511e10563e |
chore: apply 1.848.0 version bump (#11980)
The change-versions job on the release PR failed to push after the branch was deleted on merge, so v1.848.0 shipped with only version.txt bumped. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
|
7a29abc7ee |
feat: run a workspace handler when a variable's value expires (#10837)
* feat: run a workspace handler when a secret variable expires Secret variables gain an optional `value_expires_at`, and a workspace can point at a script or flow to run once that date passes, so a rotation is driven by the platform instead of tracked out of band. The secret never leaves the database. The sweep selects the path, description and expiry and nothing else, so the handler is given a reference to rotate rather than a value to handle. Job results are stored in cleartext and shown in Runs, which is what makes that a boundary rather than a preference; a test asserts the job's args never contain the value. Each row is claimed by writing `expiration_dispatched_for` in the same transaction as the push, so a failed push un-claims it and a lost race claims nothing. Moving the date re-arms the row; re-saving the same date does not. A pass takes at most 100 rows under a transaction-scoped advisory lock, and orders so that one broken workspace cannot starve the rest. Dispatch runs as `g/variable_expiration_handler`, exempt from the CE group limit and from non-premium exec metering the way the error and schedule handlers already are. A handler that keeps failing backs off and raises a critical alert instead of retrying every pass, and the back-off ends when the handler is repointed. The expiry travels with the variable through workspace clone, tarball export and workspace comparison. The dispatch marker deliberately does not, so a fork re-arms on its own copy. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(frontend): expose variable value expiration in the UI The variable drawer takes an optional expiry on a secret value, and the variables list badges it, turning red once the date has passed. A workspace settings tab picks the handler, its extra args, and whether variables under `u/` are skipped. That mute flag is stored inside the handler setting, so the toggle stays disabled until a handler is picked: saving it on its own would clear the setting it lives in and still report success. The expiry is carried as a tri-state through the draft deploy and copilot paths — absent leaves the remote value alone, an explicit null clears it — so deploying a draft cannot silently drop a date someone set elsewhere. The settings tab names the one case where the configured identity does not apply: a handler script carrying `on_behalf_of` runs as that user rather than as `g/variable_expiration_handler`, which matters because the same tab asks the admin to grant that group write access to the variables it rotates. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(cli): sync variable expiry and the workspace expiration handler `wmill sync` carries `value_expires_at` on variables in both directions, and pushes the workspace handler alongside the error and success handlers in the grouped settings format. Dropping the key from a variable's yaml clears the remote expiry, so the file stays canonical rather than accumulating fields that can only ever be added. The handler follows the same rule, with the caveat recorded where the type is declared: an omitted handler only reaches the clear when some other setting differs, because the push short-circuits on a comparison that walks the local object's keys and so never sees a missing one. That gate is shared with the two existing handlers and is left as it is here. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(frontend): open the variable expiration handler template in a new tab The "Create a handler" button hands its script template to /scripts/add through the URL hash, which `load` reads from `window.location`. A client-side navigation leaves the previous page's hash in place, so the payload was dropped and the editor opened on the default template at a `u/` path. `target="_blank"` forces a full page load, matching the success handler's "Create from template" button. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(frontend): make the variable expiry field state its own status The expiry field rendered a DateTimeInput whose time defaults to 12:00 when it holds no value, so a variable with no expiry looked like one already configured, and "cleared" looked identical to "never set". Setting an expiry is optional, so the field has to say which it is. Rebuild it on the shape ScriptAdvancedSettings already uses for Timeout, Cache and Concurrency limits: a toggle whose checked state is the stored value being present, seeding a date on enable rather than revealing an empty picker, with the input under its own label. Drop `clearable` with it, so the toggle is the single way to mean "no expiry" instead of competing with an X. Stop the surrounding copy promising a run that may not happen. A handler is only dispatched if the workspace has one configured and does not skip u/ paths, so the list tooltip now states the date alone, and the form hedges both conditions, naming the u/ mute only on personal paths where it can apply. Also anchor the mute toggle's tooltip: Popover's trigger is a span around a block-level label, which stretched to the full width of its SettingCard and left the popup floating beside the card rather than under the control. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(rust-client): initialize value_expires_at in the variable models The generated `CreateVariable` / `EditVariable` structs gain the field from openapi.yaml, and client.rs builds both with exhaustive literals. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(frontend): drop extra_args when the variable expiration handler is cleared Clearing the handler nulls the whole setting server-side, extra_args included, but the tab kept its loaded copy. A handler picked afterwards without reloading was persisted with the cleared one's arguments, which the tab does not display. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat: back the variable expiration handler's built-in Slack and Teams destinations Backfills the Slack bot token grant for g/variable_expiration_handler, mirroring 20231016142659 for g/error_handler: the slack_bot folder's extra_perms is written once at Slack connect and never refreshed, and disconnecting leaves the folder behind, so workspaces that already connected Slack cannot pick the grant up from the creation-time list alone. Adds run_variable_expiration_test_job so an admin can exercise the handler on demand rather than waiting for a real expiry, which may be months away. It goes through push_variable_expiration_handler so the test run proves what matters: the handler resolves, and the group can read what it needs, under the same identity and argument shape the sweep uses. Also covers extra_args on the edit endpoint, which the settings tab now writes for the built-ins' channel. The endpoint rebuilds the setting from the request, so an omitted extra_args erases it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Do7wJTnL6MG6ngFpCGW4DG * feat(frontend): offer Slack and Teams as variable expiration handlers Gives the variable expiration tab the same no-code destinations the workspace error handler has, so "tell #ops before this credential expires" no longer requires writing a script. A sibling component rather than a fourth mode of ErrorOrRecoveryHandler: that one is shared with the workspace error handler and the three schedule handlers, and its stripped-args list, hub path suffixes and Email tab are all error-shaped. This reuses the pieces that are already generic (SlackConnectionStatus, TeamsConnectionStatus, ChannelSelector, ScriptPicker, SchemaForm) and leaves those five call sites untouched. extra_args stops being an API/CLI-only escape hatch now that the built-ins write their channel into it, so it joins the unsaved-changes comparison and the discard path, normalised through the existing helper that drops the two auto-managed keys. The two hub ids are placeholders until the scripts are pushed to the hub. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Do7wJTnL6MG6ngFpCGW4DG * fix(frontend): scope the handler identity notice to the chosen destination The notice told every admin to grant g/variable_expiration_handler write access to the variables it rotates. That is right for a custom handler and wrong for the built-ins, which only post a message and are granted the Slack bot token by migration. Following it for a Slack handler would hand a group write access to the workspace's secrets for no reason. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Do7wJTnL6MG6ngFpCGW4DG * feat(frontend): flag the Slack and Teams handlers as EE Connecting a workspace to Slack or Teams is EE-only (oauth2_oss.rs returns "Slack only available on enterprise"), so on CE those two tabs can never be completed. Says so up front, the way the error/success handler tab does, instead of leaving the user at a "not connected" badge with no working path. Only on those two tabs: a custom script or flow handler is CE. Drops the "Connect Slack first" alert, now that the banner and the connection badge above it already say it twice. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Do7wJTnL6MG6ngFpCGW4DG * chore(backend): regenerate the sqlx cache after the merge The merged workspace_settings column list in change_workspace_id is a new query text, so it needs a new cached entry. Drops the two pre-merge entries it supersedes; both had been left with conflict markers by the merge, since rename/rename markers are eight characters and escape the usual scan. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Do7wJTnL6MG6ngFpCGW4DG * fix(cli): narrow the expiry-clear check to a variable that exists remotely Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Do7wJTnL6MG6ngFpCGW4DG * feat(frontend): point the built-in handlers at their published hub scripts Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * chore(backend): regenerate the sqlx cache after the merge Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(frontend): disable the Slack and Teams handler controls without a license Matches the workspace error handler, which greys out its built-in destinations and hides the test button on an unlicensed instance. The custom destination stays editable: unlike the error handler, the variable expiration handler itself is not an EE feature. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * feat: record which destination a variable expiration handler uses handler_configured now counts slack, teams, custom or cleared instead of set or cleared, so usage shows whether the built-in destinations are picked. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix(frontend): let the variable expiration handler template run on any worker Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: guard the variable expiration test endpoint and correct its help text * fix: reuse the error handler's slack arg and built-in path helpers * docs: trim variable expiration sweep and backfill comments * feat: put the variable value expiration under an advanced section * fix: restrict the expiration test job to built-ins and keep expiry on conflict reload * fix: link the expiry hint to the variable's workspace and document built-in test paths * fix: give the expiration sweep its own lock id and reuse double_option * fix: pin the variable expiration presets so the hub-paths test accepts them * feat: let the variable expiration handler set how far ahead it runs * fix: give the notify before expiry setting its own card * feat: remind the variable expiration handler at a set interval * fix: tighten the gap between the Slack channel field and its test button * feat: refuse a value expiry on variables linked to an OAuth account * refactor: reuse the shared handler form for variable expiration * refactor: sweep expiring variables round-robin and check the handler exists * chore: trim comments to the constraints they record * fix: compare expiry dates by moment when deploying a variable draft * refactor: rename value_expires_at to value_valid_until * fix: neutralize variable fields in expiration handler args * fix: reserve the variable_expiration_handler group name for admins * fix: send first expiry notices before reminders * test: pin that a handler failing to start leaves its rows unclaimed * chore: say any hub handler path skips the existence check * fix: empty a pre-existing handler group before granting it the Slack token * docs: correct the registered feature usage counts * fix: let a workspace whose handler failed to start sit out for an hour * fix: send first notices before reminders across workspaces * fix: end a failed handler's wait as soon as it is redeployed * fix: show an expiry-only variable change in the AI fork diff * chore: regenerate workspace tool schemas * test: keep one variable expiration guard per behavior * fix: use the renamed hub expiration handlers and template * feat: carry the variable expiry in windmill-utils-internal 1.8.4 * fix: keep the variable expiry through MCP drafts * chore: bump windmill-utils-internal to 1.8.4 * fix: keep the variable expiry through mcp deploys * fix: disable saving a slack or teams expiry handler without ee * fix: skip the failure mark when the expiry handler was saved mid-sweep * fix: count expiry telemetry only where the expiry changed * test: assert the exact variable expiry in export and cli push tests * fix: stamp an expiry handler failure with the pass's read time * fix: wait for a pending handler lock instead of marking it failed * test: isolate expiry handler tests from the deployed-script cache * fix: retry a failing expiry handler every pass instead of waiting an hour * chore: update ee-repo-ref to b6e23d229966cf0019c0a1926a254fda658d8def This commit updates the EE repository reference after PR #744 was merged in windmill-ee-private. Previous ee-repo-ref: c52c06d145b13a6fb04459e85ca5818bf3c1bff4 New ee-repo-ref: b6e23d229966cf0019c0a1926a254fda658d8def Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> Co-authored-by: hugocasa <hugo@casademont.ch> |
||
|
|
11f2a4c7ff |
feat: fill docusign, salesforce and quickbooks fields on connect (#11960)
* feat: fill docusign account_id and base_uri on connect Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: fill salesforce and quickbooks connect fields through connect_fields Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: note connect_fields source trust and pin sandbox inheritance Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: update ee-repo-ref to 5517ff637a675aee66d4e417d3f37266045f0e0c This commit updates the EE repository reference after PR #913 was merged in windmill-ee-private. Previous ee-repo-ref: ba98803b236f018ed45199344f744ea1387afe2d New ee-repo-ref: 5517ff637a675aee66d4e417d3f37266045f0e0c Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> Co-authored-by: Ruben Fiszel <ruben@windmill.dev> |
||
|
|
79fe8ab03f |
fix: keep the log indexer starting when a stored day chunk is broken (#11979)
* fix: keep the log indexer starting when a stored day chunk is broken Bumps the EE ref to the companion change in windmill-ee-private. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: update ee-repo-ref to f806a793b07105417dd7a592fbfc93ec2f226d4e This commit updates the EE repository reference after PR #921 was merged in windmill-ee-private. Previous ee-repo-ref: 008b710eb0d92b382b9d20835c9fa8a41d867dad New ee-repo-ref: f806a793b07105417dd7a592fbfc93ec2f226d4e Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |
||
|
Ruben FiszelandClaude Opus 5.5
|
fe38a1d376 |
fix: share settings.yaml's git sync block between a fork and its parent (#11974)
* fix: keep a fork's own auto-pull settings when applying settings.yaml The settings.yaml on a fork branch carries the parent's git_sync, so a pull into a fork failed with "Auto-pull cannot be configured on a fork workspace". The fork now keeps its own auto_pull and fork_open_prs and a throwaway fork drops promotion repos, matching fork creation. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: show the parent's git sync side in a fork's settings document A fork's settings.yaml is the parent's file, so exporting the fork's own git_sync (auto-pull off, no fork PRs, no promotion repos) and merging the fork back would turn off the parent's auto-pull. The fork's document now states the parent's values for the parts the parent owns, and applying one keeps the fork's own: the two are inverses, so a round trip is a no-op. Repos the fork does not carry are no longer added. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: drop promotion repos on non-dev forks and keep the fork's repo order A dev workspace detached from dev keeps its promotion repo, which the validator refuses on a non-dev fork, so its pull still failed. And a fork whose own repo came before a shared one saw its document reorder the repos, so re-applying it was a change. The apply now drops promotion repos unless the fork is a dev workspace and emits repos in the fork's own order. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: apply only a fork's synced git sync keys from settings.yaml Taking the parent's repo entry and restoring a few fork-owned fields let every unlisted field flow from the parent: a dev workspace lost its promotion mode, and a malformed repository list emptied the fork. The fork now starts from its own git_sync and takes only the item filters (settings, exclude_types_override, group_by_folder) of the repos it carries; the document is the parent's block with those keys from the fork. The parent's block is folded down the ancestor chain, so a fork of a dev workspace shows the root's auto-pull too. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: sync a fork's legacy git sync filters and drop its stale promotion repos Repos without their own settings filter by the workspace-level include/exclude lists, which a fork now takes from settings.yaml while it stores them. A non-dev fork's apply drops the promotion repos it kept from a dev designation, so the write passes the save's check. An unset and a null key no longer count as a difference, so settings.yaml is not rewritten over the two spellings. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: copy the filters a repo syncs by between a fork and settings.yaml A fork on per-repo settings applying a file still on workspace-level filters lost its repo settings and gained none, so it synced nothing. The copy now goes between each side's effective filters, the repo's settings with the workspace-level lists they fall back to filled in, so either layout maps onto the other. The workspace-level keys are no longer synced separately, and a null git_sync leaves them alone. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: sync a fork's filters only between per-repo settings on both sides The workspace-level filter layout reads an empty or missing per-repo list as "use the workspace's", so it cannot state some filters the per-repo layout can, and every mapping between the two widened or emptied a fork's filters on some round trip. Filters now cross only when neither the fork nor the file uses workspace-level filters; otherwise the fork keeps its own and its document keeps the parent's. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: detect the legacy git sync layout by its fallback filters only exclude_path and extra_include_path are read only beside a fallback include_path, and the save leaves them behind once every repo has migrated, so they no longer mark a workspace as legacy. Rewraps the comment on the synced keys to say when settings crosses. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
|
f6f3a0a1f2 |
fix: return variable.value as text so widening it changes no result type (#11976)
* fix: return variable.value as text so widening it changes no result type Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: update ee-repo-ref to 16858ac4cf7326ed3d5a6fae1a97fcade5a97af7 This commit updates the EE repository reference after PR #920 was merged in windmill-ee-private. Previous ee-repo-ref: dcf6219b5635fc93f11dcb2fd0564c1c5f8407b3 New ee-repo-ref: 16858ac4cf7326ed3d5a6fae1a97fcade5a97af7 Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |
||
|
d6c2b2c683 |
feat: add a use/plan/build mode picker and read-only prod sessions (#11940)
* feat: read-only ai sessions on protected workspaces with a use, plan and build picker Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: address local review findings on the use, plan and build picker Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: address CI review findings on use mode and protected sessions Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: hold test-run forms and pending protection lookups to use mode Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * refactor: fetch rules once per send and dedupe helpers and prompt text Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: send role-locked operators to an admin and cover it with an eval Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * feat: count the work mode each session message runs in Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore: regenerate the mcp session definitions after merging main Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * feat: rename build to use & build and let the chat ask to switch modes Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: word a declined mode switch by the switch, not the mode Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore: update ee-repo-ref to 55445977dd05c25791388070182c77f4dbc20c0e This commit updates the EE repository reference after PR #915 was merged in windmill-ee-private. Previous ee-repo-ref: 7f7bf7003e356346ce74395af02c5bdf14f38781 New ee-repo-ref: 55445977dd05c25791388070182c77f4dbc20c0e Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |
||
|
|
c89a82750e |
fix: run unstamped git auto-pulls as a superadmin when no admin (#11973)
* [ee] fix: run unstamped git auto-pulls as a superadmin when the workspace has no admin Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * bump ee ref: log the fallback identity Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: update ee-repo-ref to 6858e4cbd515b52713afea8dc32b23072af2248c This commit updates the EE repository reference after PR #918 was merged in windmill-ee-private. Previous ee-repo-ref: 03d89d10bdd9fba9d1184dc75f8582a5ad3741a8 New ee-repo-ref: 6858e4cbd515b52713afea8dc32b23072af2248c Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |
||
|
ebeea51492 |
feat: composer pills that teach Windmill from the workspace (#11889)
* feat: open empty ai sessions with the home build-with-ai composer * feat: vertically center the empty session composer * fix: drop the stray indent on the session composer's rotating placeholder * fix: give the starter composer a stable accessible name * feat: pick workspace, fork and permission mode from the home composer * fix: hand off the workspace home displays, not only an explicit pick * feat: drop the starter prompt chips from the empty session * feat: home and empty ai sessions share one session composer * fix: keep session draft attachments across home and session page Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: drop superseded home ai-hidden responses Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: load home session starter lazily to keep monaco out of home Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * feat: redesign home composer and items list Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * feat: align the composer chat icon, share the folder row, add a home preview page Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * refactor: drop home tech debt, fix phone layout and keyboard access, remove the home preview page Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * feat: suggest composer prompts from workspace signals Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: pass dev page placeholders through inputProps, key settled signals by role Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * perf: read filter chip positions before hiding any in clampRows Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: scope composer signal caches to the account, drop stale workspace answers Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore: update ee-repo-ref to dd0c7087f9b2453260f3d73b0d589042b4393a1d This commit updates the EE repository reference after PR #900 was merged in windmill-ee-private. Previous ee-repo-ref: e922599943c472a6d0f736f629ae04081f866686 New ee-repo-ref: dd0c7087f9b2453260f3d73b0d589042b4393a1d Automated by sync-ee-ref workflow. * chore: update ee-repo-ref to dd0c7087f9b2453260f3d73b0d589042b4393a1d This commit updates the EE repository reference after PR #900 was merged in windmill-ee-private. Previous ee-repo-ref: e922599943c472a6d0f736f629ae04081f866686 New ee-repo-ref: dd0c7087f9b2453260f3d73b0d589042b4393a1d Automated by sync-ee-ref workflow. * feat: name workspace items and connections in composer pills Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * feat: teach one Windmill concept per composer pill from the workspace Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: drop the failed-deploy pill, which reports a run outcome Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: read favorites from the workspace's own item list Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore: regenerate mcp session guidance for the data table row Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: address cubic review of the composer signals and data table guidance Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * test: make the billing fixture's receipt step send what its summary says Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: keep loaded item kinds and drop stale loads in the composer playground Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: preview an instance admin who is a plain member in the composer playground Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: scope the enterprise note to external_instance and check receipt sends Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Diego Imbert <diego@windmill.dev> Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |
||
|
hugocasaandClaude Opus 5.5
|
e5dedd147e |
feat: let flow builder operators build AI agents (#11898)
* feat: let flow builder operators build AI agents Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: check linked agents' bound tools and type, validate on the write's transaction Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: bound the linked-agent walk by sorting bound tool ids Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: let builders bind only the agent tool inputs left to the model Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: check every agent tool sharing a bound id Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: show builders the agent's own tool inputs read-only and name agents in the setting Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor: show the agent's own tool inputs with the read-only step viewer Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * style: give the agent-set inputs heading the input label style Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * style: label the agent's fixed tool inputs static inputs Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: address cubic review on agent builder rights Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: check agent writes against the role's flows capability Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: name the flows capability as the agent builder right Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: gate agent evals on the role's code capability Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor: move the composed-flow check into windmill-api-auth Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
GuilhemandClaude Opus 5.5
|
725b15f546 |
fix: change an app's access mode under the deploy row lock (#11965)
* fix: change an app's access mode under the deploy row lock Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: defer a mode change to deploy on an app run as another user Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: hold the access toggle while its change is in flight Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * revert: leave the deploy panel's access toggle to the settings drawer PR Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: keep the caller's draft on a mode-only app update Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: refuse a builder's mode-only change on an unsandboxed app Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> |
||
|
|
72c6b10821 |
fix: make the autoscaling Test scaling button run the integration (#11972)
* fix: make the autoscaling Test scaling button run the integration Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: bump ee ref Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: bound the test scaling worker input at zero Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: update ee-repo-ref to a2a23aebcf91985778fb632a415a6990d022f7c8 This commit updates the EE repository reference after PR #917 was merged in windmill-ee-private. Previous ee-repo-ref: c9e8c8853e2042a11797e322e1e4bb4be241380c New ee-repo-ref: a2a23aebcf91985778fb632a415a6990d022f7c8 Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |
||
|
Ruben FiszelandClaude Opus 5.5
|
fb193d7a81 |
fix: list usr columns explicitly in whoami's user lookup (#11970)
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
Ruben FiszelandClaude Opus 5.5
|
6d1e3952be |
settle async diff tallies in workspace comparison tests (#11963)
test_compare_secret_variables_by_value planted workspace_diff rows with a plain INSERT after a DELETE, but the variable creates tally those rows from a spawned git-sync task that can land between the two, failing with a workspace_diff_pkey violation. Upsert the plant instead. test_rename_records_the_vacated_path could read the inline create's `write` event, or have it overwrite `rename_from`, since both deploys tally from their own spawned task. Wait for the create's tally before the rename and poll for the event that replaces it. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
Ruben Fiszelandrubenfiszel
|
39cacd71ae |
chore(main): release 1.847.0 (#11937)
* chore(main): release 1.847.0 * Apply automatic changes --------- Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com> |
||
|
|
8a0318a28f |
feat: worker group toggle to keep the worker's proxy out of jobs (#11958)
* feat: worker group setting to strip env vars from the nsjail sandbox Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: apply the nsjail env denylist to profile envar directives too Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor: drop the nsjail env denylist spawn hook Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: replace the nsjail env denylist with a worker group toggle for the job proxy Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: honor the job proxy toggle in duckdb and drop the env var fallback Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: pre-install duckdb extensions with the proxy when jobs run without it Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: update ee-repo-ref to 5cfc0dc6760ea7f631fc98ea1edd39adfc55bf11 This commit updates the EE repository reference after PR #914 was merged in windmill-ee-private. Previous ee-repo-ref: 8394f2d1b67765ba854205836185342e62df841e New ee-repo-ref: 5cfc0dc6760ea7f631fc98ea1edd39adfc55bf11 Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |
||
|
AlexRV12andRuben Fiszel
|
0dd131b380 |
fix: compare fork secret variables by decrypted value (#11952)
* fix: compare fork secret variables by decrypted value * test: restore MIN_VERSION even when the secret compare test fails * fix: re-evaluate cached variable diffs once after the secret compare fix * refactor: decrypt already-loaded secret rows when comparing variables * docs: state the authorization contract of decrypt_secret_value * fix: compare external-backend secrets by their resolved values --------- Co-authored-by: Ruben Fiszel <ruben@windmill.dev> |
||
|
AlexRV12
|
8a7b1481bd | fix: compare a null resource description as empty (#11947) | ||
|
hugocasaandClaude Opus 5.5
|
c6a93a9b56 |
feat: chat with a saved agent from a raw app through an agent runnable (#11921)
* feat(chat-sdk): chat through a raw app's backend runnable Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(chat-sdk): finish a lost stream and wait out a stopped turn in streamChatTurn Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(chat-sdk): show the answer when a stream is lost before a tool call Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(chat-sdk): send attachments through the raw app runnable Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(chat-sdk): point sandboxed attachments at the runnable section Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: agent runnables for raw apps Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: build agent runnables without the parquet feature, cache the agent check query Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: address review nits on the agent picker and the CLI schema doc Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: run an agent runnable once when it is given no memory_id Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: accept previous_messages on agent runs, read-checking the files it quotes Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: refuse an anonymous agent turn while one with the same memory still runs Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: show the agent's settings in the raw-app runnable panel, size its button like the row Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: offer an agent runnable memory_id or previous_messages after the agent's memory Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: take previous_messages in a memory-off agent's run form, type agent attachments as s3object Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: file an anonymous agent turn as a conversation, so its memory is collected and its turns serialized Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: own anonymous agent conversations under a fixed name that fits created_by Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: own anonymous agent conversations as anonymous and keep them out of conversation lists Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: point file_chat_turn at the anonymous conversation owner Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: title the runnable picker after what it lists, in sentence case Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: start a chat with local history listing its stored conversations Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: chat through a raw app's agent runnable with { wmill, runnable } Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: key an agent runnable chat's local history by its app as well Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: address review findings on agent runnables Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: offer memory_id to an agent runnable over an older auto memory Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: drop inherited static inputs from an agent runnable, show the memory-off note only when it is off Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
Ruben Fiszelandwindmill-internal-app[bot]
|
5ef19a88a9 |
fix: stop audit inserts from silently rolling back saves (#11938)
* fix: let non-admins write audit rows for jobs run as another user * fix: keep logging audit failures on pool connections * chore: point ee-repo-ref at the import fix * chore: update ee-repo-ref to 06b2eb32cd7d40fd93078285d8b6150648384602 This commit updates the EE repository reference after PR #910 was merged in windmill-ee-private. Previous ee-repo-ref: da546d93c846192ed599b02a5aa3edd5d1ecdcfd New ee-repo-ref: 06b2eb32cd7d40fd93078285d8b6150648384602 Automated by sync-ee-ref workflow. --------- Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |
||
|
hugocasaandClaude Opus 5.5
|
eeb48f0c26 |
feat: add job_id and flow_path to flow step error objects (#11941)
* feat: add job_id to step error objects in bun, deno, python and php wrappers Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: add job_id to the duckdb data-test step error Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: add flow_path to step error objects Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: close the job_id guard before flow_path in the deno wrapper Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
|
dc1fb5087b |
feat: let native triggers act through per-user or shared connections (#11352)
* fix: only let an oauth account's creator or readers link it to a variable Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: drop an oauth account link the caller may not hold instead of failing Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: cover relinking an oauth account through a variable update Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: cover a permitted relink through a variable update Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep an oauth account's creator in step with the user's username Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: follow a non-member superadmin's instance username on the OAuth accounts they created Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor: link a variable to its OAuth account only in the connect flow The variable endpoints no longer take an account link from the caller. The connect flows create the token variable first and pass its path to create_account, which links it server-side. This replaces the creator check and the created_by bookkeeping, along with both migrations. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: keep the MCP secret variable test's formatting Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: link the account to the token variable AppConnect created, even if the path is edited mid-save Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: stop exporting the OAuth account a variable links, and regenerate the chat tool schema Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: pin the EE refresh and linking checks Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: delete AppConnect's token variable when linking its account fails, so Save can be retried Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep the resource AppConnect fills when linking its account fails Deleting a variable also deletes the resource at its path, so the rollback is skipped when filling an existing resource. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor: create an OAuth token variable and its account in one request createAccount takes the variable and the store creates both in one transaction, so a connect is either fully saved or not at all. The connect flows make that single call instead of creating the variable and linking it afterwards. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: stop listing the ignored account input in the chat's write_variable instructions Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: drop the account visibility helper the oauth refresh route no longer uses Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: let native triggers act through per-user or shared connections Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: bind native trigger oauth state to its user and follow connection renames Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: authorize oauth account links and scope native trigger disconnects Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: order the native trigger connection migration after account ownership Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: delete only the scope-checked triggers when disconnecting Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: skip triggers moved since their scope check when disconnecting Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: scope-check the connection path when connecting, keep a connection still in use Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: key token write-back by account and serialize trigger creation with disconnect Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: let an admin share one native trigger connection with the whole workspace Members can use the shared connection without reading its token. It reuses workspace_integrations.resource_path, so existing workspace connections stay usable by members after upgrading. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: pick the workspace connection like other workspace resources, connect and disconnect from the picker Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: label the disconnect action in the connection picker Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: drop the own-account note from the workspace connection field Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: let admins share any connection, serialize service removal with trigger creation An admin can already read every connection, so restricting sharing to their own added nothing. Removing a service now takes each connection's lock and keeps everything if a trigger was created meanwhile. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: show each native trigger service's OAuth app status and keep removal apart Remove now only appears with a workspace OAuth app, since a workspace using the instance app has nothing of its own to remove. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: configure a native trigger service's OAuth app in a dialog The card states once which OAuth app is in use, with a single Configure action, and the form follows the design system. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: drop a stray brace from the OAuth app dialog binding Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: lead the OAuth app row with which app is in use, with a link to change it Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: compact the native trigger service card Edit and Remove sit on the workspace OAuth app row, and the workspace connection reads as part of the same section. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: show the OAuth app status in each native trigger card's header App actions move into a menu, the card body holds only the shared account, and service descriptions name what fires the trigger. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: say who configured each native trigger service, and name removal for what it removes Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: say what members can do with each native trigger service, keep the shared account optional Nextcloud, whose webhooks need an admin account, offers connecting and sharing one directly instead. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: pick the shared account with an inline select, and keep Nextcloud's own-account path in its wording Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: one status line per native trigger service, a Nextcloud admin hint, and clearer refusals The shared account is a regular form field, Nextcloud shows an alert while no admin account is shared, a non-admin Nextcloud account gets a message saying why it cannot create triggers, and the OAuth dialog only accepts a full server URL. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: point native trigger error hints at the account picker and the shared account Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: say members can browse what a shared native trigger account can access Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: make the OAuth app dialog's open prop required Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep pre-connection triggers working, and guard reconnects and service removal - The migration recovers a service's connection when the workspace row lost its path, which saving the OAuth app or an abandoned instance connect used to do. - A trigger created without a connection uses the shared account, as older clients and trigger specs expect. - Only whoever connected a path, or an admin, may reconnect over it. - Removing a service or sharing an account checks a path-scoped token against what it touches. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: connect native trigger accounts at a chosen path through the resource drawer, and reconnect from the picker Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: date the native trigger connection migration after main's newest Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: say a disconnect deletes the triggers other members created on the account Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: offer Reconnect next to an existing trigger's account and point the refresh hints at it Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: date the native trigger connection migration after main's newest Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: update ee-repo-ref to da49c12e3006fc77de789277f1462a4d8d7d92ce This commit updates the EE repository reference after PR #829 was merged in windmill-ee-private. Previous ee-repo-ref: 58681a2e7eafb5689ed739cd2560fa0f5d82c3dc New ee-repo-ref: da49c12e3006fc77de789277f1462a4d8d7d92ce Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |
||
|
|
d6adac8b75 |
fix: link a variable to its OAuth account only in the connect flow (#11361)
* fix: only let an oauth account's creator or readers link it to a variable Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: drop an oauth account link the caller may not hold instead of failing Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: cover relinking an oauth account through a variable update Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: cover a permitted relink through a variable update Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep an oauth account's creator in step with the user's username Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: follow a non-member superadmin's instance username on the OAuth accounts they created Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor: link a variable to its OAuth account only in the connect flow The variable endpoints no longer take an account link from the caller. The connect flows create the token variable first and pass its path to create_account, which links it server-side. This replaces the creator check and the created_by bookkeeping, along with both migrations. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: keep the MCP secret variable test's formatting Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: link the account to the token variable AppConnect created, even if the path is edited mid-save Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: stop exporting the OAuth account a variable links, and regenerate the chat tool schema Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: pin the EE refresh and linking checks Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: delete AppConnect's token variable when linking its account fails, so Save can be retried Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep the resource AppConnect fills when linking its account fails Deleting a variable also deletes the resource at its path, so the rollback is skipped when filling an existing resource. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor: create an OAuth token variable and its account in one request createAccount takes the variable and the store creates both in one transaction, so a connect is either fully saved or not at all. The connect flows make that single call instead of creating the variable and linking it afterwards. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: stop listing the ignored account input in the chat's write_variable instructions Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: drop the account visibility helper the oauth refresh route no longer uses Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: update ee-repo-ref to da49c12e3006fc77de789277f1462a4d8d7d92ce This commit updates the EE repository reference after PR #829 was merged in windmill-ee-private. Previous ee-repo-ref: 58681a2e7eafb5689ed739cd2560fa0f5d82c3dc New ee-repo-ref: da49c12e3006fc77de789277f1462a4d8d7d92ce Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |