npm ci failed with 'Missing: @emnapi/core@1.11.2 / @emnapi/runtime@1.11.2 from
lock file'. @napi-rs/wasm-runtime declares @emnapi/core|runtime ^1.7.1 as
peerDependencies while @rolldown/binding-wasm32-wasi pins them to exactly
1.10.0. Newer npm (bundled with node 24 in CI) installs the peer deps at the
highest match (1.11.2) alongside rolldown's nested 1.10.0, so the ideal tree
needs both versions; the committed lock only had 1.10.0.
Regenerate the lock with npm 11.18 so it carries both 1.11.2 (top-level, for
the peer deps) and 1.10.0 (nested, for rolldown's pin). Verified npm ci passes.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
datatable_database_arg eagerly resolved instance data-table credentials
(including the shared instance-wide Postgres password) and passed them as the
migration job's plaintext `database` arg, landing in v2_job.args. Since the
run route has no admin gate, a non-admin could run a migration and read
args.database to recover the password, granting cross-workspace psql access to
all instance data-table DBs.
Pass a `datatable://<name>` reference for both resource-backed and instance
data tables instead; the pg executor already resolves it to real credentials
server-side at run time, so nothing sensitive is ever stored in the job args.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(kafka): set https.ca.location=probe for OAUTHBEARER OIDC token endpoint
Bump EE ref to pull in the mod_ee.rs change that sets https.ca.location for
the Kafka OAUTHBEARER (OIDC) token endpoint HTTPS request.
EE companion: windmill-labs/windmill-ee-private#642
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to 81d8a449effdc540a6e8810668dd5d4aea0c485a
This commit updates the EE repository reference after PR #642 was merged in windmill-ee-private.
Previous ee-repo-ref: a6761c3cbbf788c7273296f49bb0c39eef85afb9
New ee-repo-ref: 81d8a449effdc540a6e8810668dd5d4aea0c485a
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* fix(frontend): prevent truncated ai chat tool-call arguments from bricking the session
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix: heal empty tool-call arguments when replaying chat history
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* docs: state sanitize invariant without drafting history
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* fix(ai): route Azure Foundry Claude models via Anthropic Messages API
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(ai): keep explicit Azure OpenAI deployment base URLs intact
build_azure_openai_url only appends /openai/v1 for a bare resource root; any base with an explicit path (e.g. .../openai/deployments/<id>) is preserved. Adds a regression test and a unit test for usesAnthropicMessagesApi.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat(ai): enable Claude extended thinking on Azure Foundry
Route azure_foundry+Claude through the Anthropic reasoning branch (adaptive thinking + output_config.effort) instead of the gpt/o gate, and recognize claude-sonnet-5. Live-verified: sonnet-5 and opus-4-8 on Foundry accept the low/medium/high/xhigh/max ladder and render summarized thinking.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
App values are persisted to a json column, which permits the JSON NUL
escape (backslash-u-0000), but are later converted to jsonb (e.g. a
workspace fork clone_apps, search indexing), which rejects it with
"unsupported Unicode escape sequence" -- silently making the app
un-forkable. The usual source is a binary file such as .DS_Store
accidentally bundled into a raw app file map.
A real NUL is unstorable in jsonb either way, and frontend code that
needs the character writes it as the source escape (which JSON-encodes
to an escaped backslash + literal u0000 and is left untouched), so rather
than hard-failing the save we strip genuine NULs and warn.
Add strip_null_chars and apply it at both app_version insert sites
(create_app_internal and update_app_internal, covering the regular and
raw create/update routes). It removes a genuine NUL escape (odd run of
backslashes before u0000) while preserving an even run. Returns a
borrowed Cow (no allocation) when the value is already clean. Covered by
unit tests.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(forks): clone only the current raw-app bundle, via server-side copy
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(forks): fall back to get+put when object-store copy is unsupported
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(s3_proxy): enforce CE 50MB upload cap on multipart uploads
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat(s3): replace CE 50MB upload cap with 10GiB workspace storage quota
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(s3): gate CE quota OSS stubs to not(enterprise) to match callers
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(s3): delta-aware CE storage quota + guard usage-load retry loop
Account for the overwritten object's size in the quota check so valid
same-size overwrites near quota are not rejected (Codex review), and stop the
storage-usage $effect from re-firing on persistent API errors (Pi review).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(s3): count chunked PUTs; revert overreaching volume quota copy
Volumes write to workspace storage via a separate worker-side path with its own
50MB-per-file cap that this PR does not change, so revert the drawer copy that
claimed they count toward the 10GiB quota (Codex review). Bump ee-repo-ref for
the chunked-PUT accounting fix.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(s3): add SQLx cache for CE usage-bump/quota queries; exclude volumes
Regenerate the missing offline SQLx cache for the not(enterprise) bump and
remaining-quota queries so the private CE offline build compiles, and bump
ee-repo-ref for the volumes/-prefix exclusion from the counted quota (Codex
review).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(s3): always HEAD for CE upload delta so overwrites don't inflate usage
Bump ee-repo-ref for the fast-path overwrite-accounting fix (Codex review).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(s3): reserve volumes/ prefix on CE write surfaces to close quota bypass
Reject direct writes to the reserved volume prefix on the app-upload surface and
add the OSS stub; bump ee-repo-ref (Codex review).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(s3): refuse new multipart work when CE workspace is at quota
Bump ee-repo-ref for the multipart-initiate/part quota gate (Codex review).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat(s3): reserve in-flight multipart bytes against CE storage quota
Add workspace_multipart_inflight table + grants, SQLx cache for the reservation
queries, and bump ee-repo-ref. Bounds abandoned multipart uploads that the
list-based recount can't see (Codex review).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(s3): clear multipart reservation only after a successful complete
Add exclude-upload arg to the OSS quota stub/caller and the SQLx cache for the
updated remaining-quota query; bump ee-repo-ref (Codex review).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(s3): per-part multipart reservation; commit only on part success
Per-part workspace_multipart_inflight schema (upload_id, part_id) so retries
replace rather than double-count; SQLx cache for the reworked queries; bump
ee-repo-ref (Codex review).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* perf(s3): HEAD the multipart overwrite target once per upload, not per part
SQLx cache for the stored-credit lookup; bump ee-repo-ref.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* chore: update ee-repo-ref to bea5a8b5120d6d69cab1ad4611ebe463559bd200
This commit updates the EE repository reference after PR #640 was merged in windmill-ee-private.
Previous ee-repo-ref: 6e6ff86f1939cf74736b7d435bf6851416437523
New ee-repo-ref: bea5a8b5120d6d69cab1ad4611ebe463559bd200
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: support workspace forks on cloud using parent workspace limits
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* docs: clarify count_paid_seats approximates rather than mirrors billing seats
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix: non-admin fork UI, attach cap, and fork-count for cloud forks
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix: cloud fork billing cache on rename, usage display, attach cap edge
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat: fork count in cloud quotas + fork billing points to parent
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix: invalidate billing/fork caches on fork deletion for id reuse
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix: gate fork usage remap on CLOUD_HOSTED, not just the cloud feature
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* docs: note cloud feature vs CLOUD_HOSTED gating in backend guide
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix: reserve fork-cap slots for an attach candidate's whole subtree
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix: invalidate team-plan cache on delete, raise fork depth cap
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat: cap fork nesting depth (MAX_FORK_DEPTH, default 5)
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix: fork count/height robust to cycles and deleted intermediates
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(frontend): reset fork button loading state on creation error
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix: invalidate billing cache for attached fork subtree; helper auth docs
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix: invalidate bun bundle cache on transitive relative-import changes
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix: do not memoize transient fetch errors in bundle-key import cache
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix: use regular comment on lazy_static block (deny unused_doc_comments)
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix: align bundle-key import version selection with loader content endpoint
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* fix(frontend): show inline workspace name editor on general settings
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(frontend): guard rename and support enter-to-save on workspace name
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat(ai): add Azure AI Foundry as a native AI provider
Adds `azure_foundry` as a new AIProvider variant wired through the AI
chat (copilot) and AI agent flow steps. Foundry's chat completions API
is OpenAI-compatible and uses Azure conventions (api-key header, Azure
URL building), so it reuses the existing OpenAI-compatible query builder
and proxy path via the shared `is_azure` helper (renamed from
`is_azure_openai`).
Backend (windmill-ai):
- New `AzureFoundry` enum variant (serde `azure_foundry`)
- `get_base_url` requires a resource base URL (like Azure OpenAI / Custom)
- `is_azure()` covers Azure OpenAI + Foundry (api-key auth, Azure URL)
- Added to OpenAI-compatible proxy support and HttpForward proxy mode
- New proxy URL unit test
Frontend (copilot):
- New provider entry, completion config, model-token handling, streamed
usage tracking, and reasoning registry (all model-id-gated, so a no-op
for Foundry's non-OpenAI catalog)
- Treated as a chat-completions provider, not the OpenAI Responses API
OpenAPI:
- `azure_foundry` added to AIProvider (openapi.yaml) and AIProviderKind
(openflow.openapi.yaml); regenerated CLI guidance
Note: the `azure_foundry` resource type (base_url + optional api_key) is
hub-managed and must be published to the Windmill Hub separately.
Fixes WIN-2122
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(ai): add azure_foundry to copilot flow Zod provider enum
The tracked copilot flow schema (openFlowZod.gen.ts and its openFlow.json
source) still carried the old AIProvider enum, so validateFlowModules /
validateSpecialFlowModule rejected AI-generated flow edits that create or
update an aiagent module with provider kind "azure_foundry" before they
could be saved. Add the value to both (preserving the generated single-line
format) and a regression test over the flow-module validation path.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat(ai): lead provider list with OpenAI, Anthropic, Google AI
Reorder AI_PROVIDERS so the three primary direct providers come first. The
AIProviderPicker renders the first three entries as quick-access buttons, so
these become the defaults (previously OpenAI, Azure OpenAI, Azure Foundry);
Azure OpenAI / Azure Foundry stay adjacent right after. No logic depends on
provider order (only per-provider defaultModels[0] is read).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(frontend): home New submenus fall back below hugging the right edge
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(frontend): re-hug submenu on window resize even without a melt reposition
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Diego Imbert
Diego Imbert
Ruben Fiszelandrubenfiszel
GuilhemandClaude Fable 5