The run page and runs list now mount in process (#11721, #11724), which gives
`/run/<id>` a slot of its own instead of resolving to an iframe. The tab tests
here read better for it: a tab showing a run is `kind: 'run'`, so it cannot
match the viewer test that routes a proposed run to an item's page, and the
card keeps the form as intended.
`Run again` arrives with it, seeding a deployed page's form from the tab url's
fragment. The detail pages now read both that and a chat call's proposal at
init, the proposal last — re-pointing a tab rebuilds its url without the
fragment, so in practice only one of them seeds — and `ItemViewerView`'s load
key takes both, since either changing has to rebuild the form.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
A reader who declines a proposal and asks for different arguments still has
that item's page open, and the next proposal belongs on it — but it was parked
on the card until Preview was pressed again. `requestRunArgs` now routes the
call to that page itself, through `openRunOnDeployedPage` with
`onlyIfAlreadyOpen`: a tab already on the item is re-pointed, and anything else
— a tab showing a run included — answers no and leaves the form on the card.
The card keeps a working form while a page carries the call, rather than
reporting that its inputs are elsewhere. Only the chat's own form in a tab is
exclusive with it, since that one is the same draft and two mounts each reorder
the schema in place; a page builds its form from a copy of the proposal and
shares nothing. So the card folds its row instead of emptying it, and expanding
it is how a run goes from the transcript. `isRunFormTabOpen` answers that
narrower question, and the collapse moves into the row's default so pressing
Preview and being routed here behave alike.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The banner was its own block directly above the form, so it sat flush against
the first field. It now shares the row that carries the JSON toggle, where the
existing input badges get their spacing from `min-h-12`.
It goes ahead of the saved-input badge, whose reserved slot stays mounted while
hidden and would otherwise push the banner off the left edge. The row's gate
takes `pendingRun` as well, since a runnable with no schema properties renders
no row and would drop the banner with it.
The badge's reject button also takes the alert palette it sits on, through
`tone`, instead of the neutral bordered one it had from the deprecated
`color`/`size` props.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* refactor: mount the runs list in process in ai session previews
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: tell runs list tabs apart by filters and reseed on re-point
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: remount a hosted runs list only when moved from outside
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: data table migration tools and role guidance in ai sessions
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: shared data table guidance and safer migration tool failures
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep a migration that fails to apply and let the session rewrite it
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: rewrite only a pending migration and qualify fork isolation
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: mount the run page in process in ai session previews
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: let run again fire repeatedly and re-pin an open script tab
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep a run opened through a share link in its own frame
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Redaction only visits the leaves the schema it is given declares, and the page
runs the deployed version as it stands when Run is pressed. A deploy between
this call reading the schema and that press can add a file argument ours never
had, and its bytes then passed unredacted into the persisted card and the
model's result, under the size limit that would have caught a large one.
`adopt` hands over the schema it ran against alongside the job and arguments,
and both redactions use it.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Closing the JSON editor when the form starts refusing writes mounted
`SchemaForm` in its place, and `PasswordArgInput` mints a variable from the
literal it opens on without consulting `disabled` — so a reader who typed a
plaintext secret into JSON view had it stored by the act of entering plan mode,
with no run and no Run press.
The form no longer swaps sides while it refuses: `JsonInputs` takes `readOnly`
and the editor stays mounted and uneditable. The JSON toggle is already hidden
in that state, which is what keeps the fields from mounting from the other
direction.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore: bump frontend python parser wasm packages to 1.830.0
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: bump cli python parser wasm packages to 1.830.0
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep the app editor's parent_version out of deployed apps
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: drop parent_version when deploying an app draft
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Two findings on the deployed page carrying a chat call.
`RunForm.run()` mints a variable per `password` argument before it calls
`runAction`, so the plan-mode gate in the detail pages ran after the write it
was there to prevent — and the keybinding reached it without the button. The
refusal moves into the form, as `runRefusal`: set, it takes no writes at all,
its submit buttons are disabled, and `run()` says so and returns before the
secret processing. The page also stops offering the JSON editor under plan
mode, instead of leaving one mounted that silently discards what is typed.
An adopted job's arguments are the page's, and the card had no way to show
them: it kept rendering the proposal, so a reader who edited a field saw the
wrong values and the model was told nothing. `adopt` now hands them over with
the job id, and they go through the same redaction and size guard as a run
this tool starts.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat: connect to a data table with every role of the job's viewer
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: key a cached result by the run's recorded viewer
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: pin the per-viewer cache key and fix a stale doc sentence
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: length-prefix the viewer in the result cache key
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: drop data table role set logins unused for 30 days
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: pin the ee ref with the set login sweep fixes
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: pin the ee ref with the sweep retry fix
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: give the cache key test its own migrated database
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: add the viewer's roles to a data table connection that names none
The default role of a data table under roles is now a floor: a connection
naming no role also holds the roles its viewer is a tenant of, unless the
default is admin. This replaces the explicit as=viewer option, which is
removed from the reference parser, the executors and both clients. The roles
drawer warns while the default is admin and confirms before removing the
default role.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: let a data table have no default role
A connection naming no role then holds its viewer's roles only and is
refused without any. The roles drawer offers the choice, states what an
unnamed connection gets for the current settings, says who gets admin while
it is the default, and notes who owns a table created over several roles.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: start a data table's roles with admin open to everyone
Turning roles on from the drawer seeded admin with no tenant, which refused
every non-admin member's job as soon as it was saved. It now starts open to
everyone, so the toggle changes nothing until the roles are edited, and the
drawer warns for as long as everyone can connect as admin.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 40ab35596e6fcb82a4dfc56e186befb807f8e2af
This commit updates the EE repository reference after PR #873 was merged in windmill-ee-private.
Previous ee-repo-ref: a5def184a29fffab8ed42c70c5a7445b2b3cbe98
New ee-repo-ref: 40ab35596e6fcb82a4dfc56e186befb807f8e2af
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
The proposal reached the deployed page through the tab url's hash, which the
page already reads for "Run again". Two things were wrong with that carrier:
- A tab already open on the item does not remount when it is re-pointed, and
both detail pages read the hash once at init — so a second proposal for the
same item opened its form on the first one's arguments.
- Tab urls are persisted with the session, so a draft holding file bytes or an
un-minted `password` literal was written to IndexedDB. The transcript avoids
both deliberately, through `redactFileArgs` and `MAX_PERSISTED_ARGS_LENGTH`.
The call now carries its own proposal: `PendingRun.proposedArgs` reads the
card's live draft, the page seeds its form from it at init, and the tab's url
names only the call. `ItemViewerView`'s load key includes that name, so a tab
re-pointed to another call builds its form again.
Two more fixes on the same path:
- `adopt` was read off the prop after awaiting job creation, so a call that
settled during the request could be answered with another call's job. The
press now captures the call it was made under.
- An adopted job's arguments and version are the page's, which this tool cannot
read, but the model was told `Ran with arguments: {}`. It is now told the user
ran it on the item's own page, and that the arguments are the page's.
- Adopting hands the carrying tab to the run, so the page no longer navigates
there as well — that left two tabs open on the same job.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: wait for the raw app build before reading its preview dom
* fix: warn the dom and screenshot tools when the raw app build failed
* fix: tell the dom and screenshot tools when the raw app awaits sdk consent
* fix: tell the dom and screenshot tools while the raw app sdk token loads
* feat: sign OIDC tokens with an external signer and log every mint
* fix: init the signer in sqs_trigger builds and show signer reachability from results
* fix: key the OIDC key rows by source and kid
* chore: bump ee ref and list the oidc-signer subcommand only where it exists
* fix: advertise the actual signing algorithm in OIDC discovery
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: harden the external signer startup, agent workers and failed mints
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: bump ee ref for the stored key listing fix
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: list the oidc signing settings page only with an external signer
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 1e538620a9b2f08b044997d032e71d8720ecbd5c
This commit updates the EE repository reference after PR #859 was merged in windmill-ee-private.
Previous ee-repo-ref: 84fa325737df98407c7b9f79c09d6e9378c46147
New ee-repo-ref: 1e538620a9b2f08b044997d032e71d8720ecbd5c
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* fix: make the packaged components resolvable by consumers
The svelte-package output of @windmill-labs/components imported the chat
SDK from outside the package root, pointed `$lib/utils` at a directory
with no index, and shipped an `import.meta.glob` on the `$lib` alias.
Bundle the chat SDK entry point into the package, repair the directory
specifier, make the glob relative, and fail packaging on any import a
consumer cannot resolve.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: pin the chat sdk output root and widen the packaging checks
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: restyle s3 explorer tree like the db manager tree
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: make s3 explorer flush with its drawer
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: show s3 file preview as an inset card
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: redesign s3 explorer file header
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: move s3 csv preview options into the file header band
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: narrow the s3 csv separator select
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: show csv, parquet and json files as tables in the s3 explorer
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep the detected s3 csv separator shown in text view
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: drop stale s3 table responses and unfilterable nested columns
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: pin ee ref for the s3 table decimal filter fix
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: pin ee ref for the s3 table decimal scale fix
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: pin ee ref for strict s3 table decimal filter parsing
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: pin ee ref for the s3 decimal exponent bound
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to 06610ecc950ed64a2709d7f1aa8c7b49a95fdbae
This commit updates the EE repository reference after PR #869 was merged in windmill-ee-private.
Previous ee-repo-ref: 74f041e9767f2ac612e21f351f96e71c584e2904
New ee-repo-ref: 06610ecc950ed64a2709d7f1aa8c7b49a95fdbae
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: let operators compose full-code apps when the workspace grants it
Adds operator_settings.builder_apps, the second builder right, granted
independently of flows because the two are not equally verifiable: a composed
flow is checked in full server-side, while a full-code app is a browser-built
bundle no check can read. The app right rests instead on forced sandbox
isolation, a refusal of Viewer execution mode, and a deploy-time check of every
runnable the app can reach.
BuilderKind arrives with the second kind and is a mandatory argument, so no gate
can mean "either" by accident: one that did would authorize an app write on a
flows-only workspace. The only surfaces reading .any() are the ones that are
genuinely not per-kind, the seat a membership costs and listing drafts.
validate_operator_composed_app checks two surfaces rather than one, because they
are not the same list: the policy's triggerables and the runnableByPath entries
in the app value, which is what the deployed bundle actually resolves against.
Every colon in a triggerable key is a possible split, since execute_component
looks up "<component>:<path>" with an unrestricted component string.
create_app_raw_source stays closed: it compiles caller-supplied sources with a
bundler job on a worker, which is arbitrary code execution. Builders lose
nothing, since the browser and the CLI both bundle locally and deploy through
the multipart endpoints.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Dsf6VC4MVLisiEoeQkgbr4
* fix: list a builder's app drafts and refuse inline code in them
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 6d15ff957df4dcd5129e1ab217eab1a13af62fbb
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: check a builder app as it will be stored
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: show the home list edit button to builder operators
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: pause the raw app preview for an app an operator deployed
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: let app builders save a full-code app's deploy settings
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: record the builder app settings path, public apps and the editor preview
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: cache the merged EE seat usage query
The EE query now reads audit_partitioned and skips service accounts, so the
cached entry for its builder_apps predicate no longer matched and offline EE
builds failed with no cached data.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: pause the raw app preview for loaded drafts and unknown authors
A draft loaded from an operator ran in the viewer's preview because the pause
only checked the app's last deployer, and an author no longer in the workspace
read as a developer. The pause now checks a loaded draft's owner, records it
in the viewer's draft until the preview is run or deployed, and holds when the
author cannot be found.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: name guest apps among the modes a builder may deploy
Guest runs as the publisher with no Viewer fallback, like Publisher and
Anonymous, and RestrictGuestAppDeployment refuses it per workspace.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep a loaded draft's preview paused in AI sessions and chat edits
The session draft codec and the chat's draft save dropped loaded_from, so
opening a paused operator draft in an AI session, or editing it through the
chat, ran it with the viewer's session.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: pin builder refusals for low-code apps and unreviewed previews
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep the operator mark when loading a developer's copy of a draft
Loading another user's draft recorded only who saved it, so a developer's
copy of an operator draft they never previewed opened unpaused for the next
person who loaded it, running the operator's code with their session.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: let builders restore a full-code app from deployment history
Restore always sends allow_kind_change, which the builder check refused even
for a full-code version restored over a full-code app. Builders now drop the
flag, so the locked kind check still refuses an actual conversion.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* style: rustfmt the builder checks in jobs.rs
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: record the builder kind-check race as an accepted risk
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: never trust the owner name a loaded draft carries
A loaded draft's loaded_from is written by its owner, so an operator could
name a developer, or leave it empty, and the next person to load the draft
previewed it unpaused. A loaded draft that carries any mark now stays
paused as unattributable; an unmarked one is still checked against its
real owner.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: record viewer-supplied resources in builder apps as an accepted risk
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: say that the app right lets operators write frontend code
The settings section and the docs told admins builder operators "still
cannot write code", but the app right has them write the app's frontend
bundle. Only backend code stays out of reach.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: state the raw-source closure once and drop an unreachable preview case
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* perf: look up only the author when deciding whether to pause the preview
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: pin that the app right alone bills operators as developers
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: point ee-repo-ref at the EE seat test
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: drop the editor preview pause now that sandboxed apps preview isolated
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: refuse a builder operator's app draft without the sandbox
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: turn the sandbox on when a builder operator opens the app editor
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: refuse builder app drafts naming runnables they cannot read
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: note the editor preview asks before minting a builder app token
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: trim the builder app check comments to the constraints
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: refuse an app runnable whose runType is not script, flow or hub
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: check builder app draft policy keys like a deploy does
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: count main's half-seat service accounts in the builder billing test
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: name the builder policy check for drafts as well as deploys
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: let a builder app draft autosave with a stale triggerables_v2
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: check the script version a builder app would run, not any version
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: refuse viewer mode in a builder app draft as on deploy
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: hold builder app drafts and deploys to one check
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: say a builder's script may not have finished deploying
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: cap builder app triggerable keys before reading every colon split
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: refuse a builder app draft that runs as someone else
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: conform builder app drafts saved by the AI chat as the editor does
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: record that a deployed builder draft runs as its deployer
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: refuse builder app runnables not written as plain text
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: a builder draft may carry its builder's own run identity
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: offer builders Start with AI only when it opens a session
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: name full-code apps in the builder rights confirmation
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: name only the granted builder rights in the confirmation
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: note a wm_deployers builder may keep another run identity
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: give builders a starter app that calls no missing runnables
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: seed the builder starter under the picker for builders
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: qualify the builder run identity comment for wm_deployers
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: resolve builder app script hashes before opening the RLS transaction
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: run the builder app tests serially to share the rights cache safely
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: give builders the builder starter on a fresh editor load
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: drop a new-app load overtaken while waiting for the workspace list
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep main's 401 for operators previewing without the app right
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 5d7726c4979070ee8db4fb9e8014152872a641ba
This commit updates the EE repository reference after PR #816 was merged in windmill-ee-private.
Previous ee-repo-ref: 7151060bfc02908e97d9344b3820ee33a4951322
New ee-repo-ref: 5d7726c4979070ee8db4fb9e8014152872a641ba
Automated by sync-ee-ref workflow.
* refactor: let the app row's edit button trust its write flag
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: point ee-repo-ref at the merged EE companion
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: note the session raw-app editor does not conform builder drafts yet
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: stop offering deno for new scripts and ship it only on full images
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep deno in the integration test worker and narrow the missing-deno error
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep deno selectable on existing deno scripts when the saved order omits it
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: drop the deno workloads from the benchmark suite
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: run bun instead of deno in tests that are not about the deno runtime
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: drop the deno cases from the integration suite
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: update the app policy hash for the bun inline script
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: add a jobs:run:dependencies token scope for lock generation
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: pin lock-job reads to the dependencies scope
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: align scope labels with and without a restrict paths button
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: match a lock job's stored path literally on job reads
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: drop the dependency-lock warning from the jobs scope heading
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KNiYsRRDyvkRYwkHda6uyf
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: sync hub resource types daily from the server
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: retire the legacy hub_sync script and its schedule
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: sync only from the hub on the daily schedule
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: sync resource types through the endpoint in e2e setup
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: honor ACCEPT_INVALID_CERTS in the hub resource type sync
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: audit manual hub resource type syncs that change types
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: show the AI step's resource type sync as a setting card
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep the hub_sync opt-out and move sync state to task state
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: hold the daily hub sync until the legacy hub_sync is retired
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: turn off the daily sync when an edited hub_sync is scheduled
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: make the daily hub resource type sync opt-in
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: bring back the setup wizard's daily resource type sync toggle
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: apply the image's resource types on every SYNC_CACHED_RT start
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: operators get AI sessions
`prefersSessionHandoff` stops taking the role, so every AI entry point an operator
can reach — Ask AI, the home composer, Open in session, the flow editor's hand-off,
the raw-app template picker — opens a session for them like anyone else. The
sessions page drops its refusal, and the layout stops keeping them on the docked
chat.
In the sidebar they now get the Workspace/AI Sessions switch and session mode, and
lose the Ask AI entry that stood in for them, since the pane behind it is no longer
the one they are sent to.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat: operators get run-oriented examples in the home composer
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* docs: note builder_flows in the operator composer examples comment
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: gate session tools and editors on operator rights
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: keep operator AI sessions behind a browser opt-in
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep flows refused in the prompt for operators without builder rights
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* refactor: decide every frontend edit check through one editRights module
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: let admins who are also operators open session editors, as drafts.rs does
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: mirror drafts.rs exactly in roleCanDraft and correct the edit-rights docs
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: say Running on a chat run card only once its job exists
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: put Starting in the run card's verb rather than its status slot
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: say Waiting for a worker on a queued chat run, and time the run from its start
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep a chat run card on Starting until a poll has seen its job
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: resolve dropdown items before showing the menu on first open
* fix: open the chat + menu without waiting on the skills and mcp fetches
* fix: keep mcp submenu rows in place when toggling a server
The page kept the chat's arguments in step and ran on the chat's behalf, which
meant reproducing everything `RunForm` does to arguments on the way through —
the PowerShell split was the third thing found missing from that. It now runs
the way it runs anything, with its own form, its own version and its own
arguments, and tells the call which job that was. The tool follows that job
instead of starting one.
The proposal reaches the form through the url hash the deployed pages already
read for "Run again", so nothing seeds it. `PendingRun` is three members, and
`RunForm` goes back untouched but for the plan-mode gate.
Two classes go with the copy. A version pinned on the page is simply the version
that runs, since the page starts the job. PowerShell common parameters travel
with it for the same reason.
Plan mode still has to reach the page: a `password` mints as it is typed and the
dynamic-select helper runs on mount, both before Run is pressed, and the page's
own Run would otherwise start a job the chat promised not to make.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat: let workspace admins delete another user's draft
* feat: delete every draft at a path when no username is given
* fix: leave the editor cleanly after deleting the last draft at a path
* fix: drain autosave before a path-wide draft delete
* fix: resume a parked autosave when a path-wide draft delete fails
* feat: export worker cpu, memory and occupancy metrics
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: refresh the exported memory limit with the cgroup readings
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: per-script resource rollup and heaviest scripts table
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: pin the companion ee commit and drop job cpu entries on every exit
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: count the cpu time of suspended workflow rounds
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: count suspended workflow rounds' runtime and guard empty averages
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* perf: flush the runnable rollup hourly in key order and drop its workspace fk
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: order the rollup upsert in sql and sweep rows of deleted workspaces
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* perf: keep the rollup orphan sweep on a primary key range
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to a1c00d73a05f227a61d2bf37cc86cd9f5bb1777a
This commit updates the EE repository reference after PR #866 was merged in windmill-ee-private.
Previous ee-repo-ref: c6bcb1bbb5a7e85e870f9de232a0ad1540acf2bd
New ee-repo-ref: a1c00d73a05f227a61d2bf37cc86cd9f5bb1777a
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* fix: load schedules once per page load and poll critical alerts every 30s
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: list schedules read-only when the user lookup fails
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: agent nits: multi-select, memory-off notice, agent step label
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: say saved, not renamed, on a new agent's first deploy
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: run the agent page form on cmd+enter, select agents by keyboard
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: pin the agent step label
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep raw app deploy panel settings shared with the editor
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: take the first deploy's policy copy after bundling
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: add an api base url instance setting for displayed urls
* feat: show the api base url as cli remote, keep mcp url on origin
* fix: keep push captures on origin and load the api base url on svix page
* fix: reject shell metacharacters in webhook and api base urls
* test: drop the trivial api base url resolver test
* feat: hide the api base url setting behind a toggle
* fix: let the quick setup toggle reveal the api base url field
* chore: update ee-repo-ref to 017710bdd0a10de857f0f40800dde238cdb1ad24
This commit updates the EE repository reference after PR #863 was merged in windmill-ee-private.
Previous ee-repo-ref: f67cd621bd45840e6389e0469a67378864f269a0
New ee-repo-ref: 017710bdd0a10de857f0f40800dde238cdb1ad24
Automated by sync-ee-ref workflow.
---------
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: name the open workspace settings tab in the page header breadcrumb
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: let the page header breadcrumb shrink when nothing else in the bar can
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep the breadcrumb's slower shrink when a summary shares the bar
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Guilhem LemouelandClaude Opus 5
Ruben FiszelandClaude Opus 5.5
AlexRV12andClaude Opus 5.5
hugocasaandClaude Opus 5.5
Alexander PetricandClaude Opus 5.5