createAccount takes the variable and the store creates both in one
transaction, so a connect is either fully saved or not at all. The connect
flows make that single call instead of creating the variable and linking it
afterwards.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Deleting a variable also deletes the resource at its path, so the rollback
is skipped when filling an existing resource.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The variable endpoints no longer take an account link from the caller. The connect
flows create the token variable first and pass its path to create_account, which
links it server-side. This replaces the creator check and the created_by
bookkeeping, along with both migrations.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: grant raw app SDK tokens identity access without a toggle
* test: pin the implicit identity scope on raw app SDK tokens
* refactor: let raw app SDK tokens reach whoami at the route check
* fix: relock scripts deployed from a draft that carries the deployed lock
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: reword fetchDeployed lock comment
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: drop the lock of flow steps whose code the chat changed
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: drop stale flow step locks at deploy, from drafts and the flow editor
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep locks of copied flows and never block a deploy on the lock check
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep the lock of a renamed or duplicated flow step with unchanged code
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: prototype running duckdb jobs out of process inside nsjail
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: bound runner output, honor force install outside the jail, set oom score before exec
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: gate the duckdb runner bin behind a feature and decode pre-install errors
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: allowlist-only policy inside the duckdb jail, with its own extension cache
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: run duckdb jobs out of process under job isolation and drop the engine fork
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: runner everywhere, stock duckdb engine, no sql fence
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 24bdc6615b3f651141fb740e2cacf9c3c2d81252
This commit updates the EE repository reference after PR #884 was merged in windmill-ee-private.
Previous ee-repo-ref: 73452bbc280cc9ca33cf0fe325d26c2fbf3aace4
New ee-repo-ref: 24bdc6615b3f651141fb740e2cacf9c3c2d81252
Automated by sync-ee-ref workflow.
* fix: pass the windows system env and TZ to the duckdb runner
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: cap a jailed duckdb job's disk use from the worker, 6GiB by default on cloud
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep a disk-backed jail tmp under the duckdb disk cap
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: drop the benchmark scaffolding and bump duckdb to 1.5.6
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: operators get AI sessions
`prefersSessionHandoff` stops taking the role, so every AI entry point an operator
can reach — Ask AI, the home composer, Open in session, the flow editor's hand-off,
the raw-app template picker — opens a session for them like anyone else. The
sessions page drops its refusal, and the layout stops keeping them on the docked
chat.
In the sidebar they now get the Workspace/AI Sessions switch and session mode, and
lose the Ask AI entry that stood in for them, since the pane behind it is no longer
the one they are sent to.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat: operators get run-oriented examples in the home composer
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* docs: note builder_flows in the operator composer examples comment
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: gate session tools and editors on operator rights
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: keep operator AI sessions behind a browser opt-in
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep flows refused in the prompt for operators without builder rights
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* refactor: decide every frontend edit check through one editRights module
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: let admins who are also operators open session editors, as drafts.rs does
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: let operators with manage rights save schedule and trigger drafts
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep rebase_draft from operators who can only draft schedules and triggers
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: let operators save resource and variable drafts
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: name deploy and delete tools only where a kind is left to act on
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: list an operator's draft-only resources and variables while they may draft them
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: let job tokens post Teams messages to their own workspace's team
* chore: point ee-repo-ref at the Teams job-token check
* chore: update ee-repo-ref to 3b6bd2b15d9bddb0bb8f1de08b30b897db0415b4
This commit updates the EE repository reference after PR #885 was merged in windmill-ee-private.
Previous ee-repo-ref: e8e4bcd63d6fc804d29e67d42ca6d4163b144a33
New ee-repo-ref: 3b6bd2b15d9bddb0bb8f1de08b30b897db0415b4
Automated by sync-ee-ref workflow.
---------
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* feat: count homepage ai session hero removals and re-pins
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to 0253ffdd6c0b0f1ba162a43d19aed56bc7bd7a71
This commit updates the EE repository reference after PR #882 was merged in windmill-ee-private.
Previous ee-repo-ref: a5d4fd2b21ffd0a6ced604c34d39a5747d9ea940
New ee-repo-ref: 0253ffdd6c0b0f1ba162a43d19aed56bc7bd7a71
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
The viewer registered its header item with the path only, so a deployed app's
summary never reached the band. It is read from the lite app endpoint the viewer
already calls, which also covers sandboxed low-code apps whose content loads in
an iframe.
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: relock apps in place so imported script changes reach them
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: requeue an app relock whose version was rewritten meanwhile
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: relock every component of the version a superseded app relock requeues
Also share raw-app runnable dependency extraction between the worker and the dependency-map rebuild, and take no-key-update row locks, which still order against a deploy's UPDATE without blocking app_script inserts.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: relock every component when an app relock runs on a newer version
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: resolve a requeued app relock's components when it runs
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: regenerate every lock when an app relock relocks every component
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* test: expect app scoping to refuse a foreign app_script id in app_preview_auth
#11777 scopes run-mode app_script ids to their app, so another app's id is
now refused with 401 before the content-hash pin check is reached.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: run end_user_email inline scripts through the deployed app_script id
#11777 runs inline code only through the app_script rows the deployed lite
value references once it exists, so id-less raw_code is refused. Shape the
fixtures like real apps (nested inlineScript) and run by the deployed id.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: wait for both dedicated worker jobs on one listener
The second completed-job listener was opened only after the first job
completed, so a second job that finished first was never seen and the test
hung until the 90s worker timeout.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(cli): keep a raw app's custom_path on sync pull
The pull rendered raw_app.yaml without custom_path, so every pull removed
the line and every push --dry-run listed the file as modified, while the
deployed app still had it and push still sent it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(cli): send custom_path on app update only when it changed
The backend requires admin for any update carrying custom_path, so the value
a pull now writes into raw_app.yaml made every non-admin push of that app fail.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(cli): sync an app's custom path as a workspace-specific file
Unless app routes are workspace-prefixed, a custom path is unique across the
instance, so a value carried in the app file every workspace shares can never
be promoted. Sync now renders it as <app>.<workspace>.custom_path.yaml next
to the app folder, always workspace-specific. A push applies only the target
workspace's file and leaves the deployed custom path alone without one; a
checkout that still has custom_path in its app file converges on push, and
the next pull moves it out.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(cli): drop the custom_path rationale repeated from changedCustomPath
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(cli): apply a custom path pushed with its raw app, and converge a cleared one
The raw-app bundle collapse kept one change per group and dropped the
custom-path file grouped with it, so a push editing both deployed only the
app. App files and their custom-path file now group under the app path in
both folder layouts, and the collapse keeps the custom-path change.
A cleared custom path (custom_path: '') has no file in the export, so the
push diff listed it as added forever; an empty value with nothing deployed
is now in sync.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(cli): never read a file inside a flow or app folder as workspace-specific
The workspace-name segment of the workspace-specific patterns spans '/', so a
raw-app asset such as settings.prod.custom_path.json was taken for a
workspace's file and dropped from the pull. Like fileset children, files
inside a flow or app folder are content of that item, whatever their name.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(cli): recognize a custom-path file only beside its app
isCustomPathFile excluded app and flow folders but still matched a fileset
child such as data.fileset/settings.custom_path.json, so a push dropped
edits to it and a pull renamed it. A custom-path file is now identified by
where it sits: its name is <app>[.<workspace>].custom_path.<ext> and no part
of its directory is an item's folder.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* perf: drive schedule already-exists check from v2_job_queue
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* perf: index v2_job_queue by workspace and scheduled_for
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: send Azure Foundry gpt-5.5+ models to the Responses API
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: name Azure AI Foundry in the reasoning summary notice
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: iterate workspace picker nav items without spreading a NodeList
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: let raw app backend runnables import each other
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: preview only imported sibling runnables and reserve the main id
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: resolve a module's workspace imports from the entrypoint's folder
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: scope run-mode app scripts to their app and key bundles on module imports
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: clone app_version_lite into forks with remapped app_script ids
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: update the run-mode raw_code comment for app-scoped ids
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: run module-bearing app scripts only from the deployed version
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: run deployed inline code only through the deployed version's rows
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: in-workspace app viewers run through the deployed rows
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: let the app embed token read the app's lite value
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: pass sibling modules to the agent-worker Python preview resolver
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: list the lite route in the app embed scope comment
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 455f98540fb042d4f624dcec681dab88b2c8df22
This commit updates the EE repository reference after PR #883 was merged in windmill-ee-private.
Previous ee-repo-ref: 927d3592a6b2127ffe16fb14eb47f5bd66afc026
New ee-repo-ref: 455f98540fb042d4f624dcec681dab88b2c8df22
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: sandbox new low-code and raw apps by default
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: navigate the top page from plain links in a sandboxed low-code app
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: allow clipboard and fullscreen in sandboxed raw-app frames
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: leave non-http links to the browser in the sandboxed app frame
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: let a link's own click handlers run before relaying it out of the frame
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: read link attributes so SVG anchors relay correctly
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: tidy the app deploy drawer to the brand guidelines
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: show enabled frontend api scopes as badges, rename runs-as section
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep frontend api access collapsed by default, badges next to its title
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: lead the run-on-behalf-of section with the user picker
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: explain publisher execution and WM_END_USER_EMAIL in the run-on-behalf-of tooltip
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: shorten the run-on-behalf-of tooltip, mention viewer data access for raw apps
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: tell the AI what breaks in a sandboxed raw app and that turning it off is a security risk
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: warn in the deploy drawer when an app is not isolated
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: drop the sandbox toggle help line
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: say when to turn sandbox isolation off in the toggle tooltip
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: show who a non-deployer's app runs as, read-only
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: show a new app runs as the deployer, gray read-only user line
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: read-only on-behalf-of display as an opt-in selector prop
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: show a folder's default run-as user on a new app instead of the deployer
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: deploy an app under a group folder default without a mismatched email
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* revert: leave a new app's run-as user unselected, as on main
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: warn in the app deploy drawer when a deploy changes the run-as user
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: snapshot the deployed policy so later edits don't change the saved app
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: run script and flow previews on behalf of another user
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: refuse operators and detect servers that drop preview on_behalf_of
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: editor previews run as the configured on_behalf_of identity
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: probe before submitting, keep step and viewer data identity in previews
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: never let a job token request viewer data access on a preview
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: open impersonated preview logs with who they run as and who asked
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: allow early return on steps inside a branch to one
The "Early return for sync webhooks" flow setting could only point at a
top-level step. It can now also point at a step inside a branch to one,
in any branch including the default one, and through nested branches to
one.
When the branch is taken, the sync call returns that step's result as
soon as it completes while the rest of the flow keeps running. When it
is not taken, the call returns the flow's final result. The sync wait
loops already resolved nested steps and fell back to the final result,
so they are unchanged.
Worker: check_if_early_return_or_last_in_early_return_parent now
accepts a job whose step id matches early_return at any depth, as long
as every job between it and the root is a branch to one. A loop
iteration or a subflow reusing the same id does not take the stream.
The existing case, the last step of a branch to one that is itself the
early-return step, is unchanged.
Frontend: the native <select> is replaced by EarlyReturnPicker, a
searchable list in flow order where each nested step shows its path
(e.g. `a › Branch 1`). Branch to all and loops inside a branch to one,
and the steps inside them, are not offered: the results lookup cannot
resolve them when nested. Picking a nested step shows a hint that it
only runs if its branch is taken.
* fix: stream the last step when the early return branch is not taken
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep the stream off the last step once the early return step ran
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: list early return steps by id only
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: use the standard select for the early return step
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: match the early return step by its flow scope, not its path
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep branch to all and loop steps off the early return stream
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: allow early return on steps inside a branch to all
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: resolve a nested branch to all or loop as the early return step
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: pin which step streams for an early return inside branches
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: return an empty nested loop or branch to all as its early return list
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* revert: read an empty container's early return status from the root
An empty nested loop or branch to all falls back to the flow's final result again,
so an empty top-level loop that failed keeps its real status.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: stefan <stefan.radovanovic@ip-paris.fr>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: add search to the workspace picker dropdown past 8 workspaces
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep focus in workspace search when the menu opens from the keyboard
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: reach workspace picker actions from the search field by keyboard
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: ignore IME keys and reset workspace search state only on input
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: reach the cloud upgrade entry from the workspace search by keyboard
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: add a navigation picker after the breadcrumb's last segment
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: open the navigation picker among the current page's siblings
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* style: size the navigation chevron like the workspace chevron
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* style: keep one-line picker lists at one-line row height
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: show the navigation chevron only once the item's path is known
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: highlight a draft in the navigation picker by its storage path
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: key the picker's current item on the header path outside editors
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: count navigation picker picks in feature_usage
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: shrink the page header in stages and let the bar fold page actions
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: fold the runs header through the bar and wrap its filter to a second row
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: truncate the run id and fold run actions into one menu on a narrow bar
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: keep an item's summary and drop its path on a narrow page header
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: show the full summary and path read-only when they cannot be edited
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: keep secondary detail actions in menus and the star beside the summary
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: show secondary detail actions as buttons while the bar has room for them
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to 346bd5417537b76591465e63b9d15bd081e9228c
This commit updates the EE repository reference after PR #868 was merged in windmill-ee-private.
Previous ee-repo-ref: 581b18cac39a4bee2671fd1aa86f91b9e702e8f5
New ee-repo-ref: 346bd5417537b76591465e63b9d15bd081e9228c
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* feat: operators get AI sessions
`prefersSessionHandoff` stops taking the role, so every AI entry point an operator
can reach — Ask AI, the home composer, Open in session, the flow editor's hand-off,
the raw-app template picker — opens a session for them like anyone else. The
sessions page drops its refusal, and the layout stops keeping them on the docked
chat.
In the sidebar they now get the Workspace/AI Sessions switch and session mode, and
lose the Ask AI entry that stood in for them, since the pane behind it is no longer
the one they are sent to.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat: operators get run-oriented examples in the home composer
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* docs: note builder_flows in the operator composer examples comment
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: gate session tools and editors on operator rights
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: keep operator AI sessions behind a browser opt-in
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep flows refused in the prompt for operators without builder rights
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* refactor: decide every frontend edit check through one editRights module
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: let admins who are also operators open session editors, as drafts.rs does
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: let operators with manage rights save schedule and trigger drafts
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep rebase_draft from operators who can only draft schedules and triggers
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: list operators' schedule and trigger drafts under their draft rights
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* docs: say which drafts write_draft gates now that schedules and triggers have their own
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* oauth: add onedrive, sharepoint and microsoft_excel providers
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* oauth: rename microsoft_excel provider to excel, add msword icon
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* oauth: rename providers to msonedrive, mssharepoint, msexcel
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* oauth: use underscore slugs ms_onedrive, ms_sharepoint, ms_excel, ms_word
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: give full-code app previews the deployed app's window.ctx
* chore: pin the UI Builder build that sets window.ctx in the preview
* fix: hold the editor preview until the viewer belongs to the app's workspace
* fix: let Rebuild retry a failed viewer lookup in the editor preview
* feat: read and change workspace settings from ai sessions and mcp
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: cover wmill workspace settings commands in the settings guidance
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: say unknown settings keys are warned and ee-only ones refused
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: cover datatable_permissions and protection_rules in the settings guidance
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(cli): keep script run waiting on long jobs and flaky log streaming
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(cli): back off job result polling after an error
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(cli): keep skipped jobs successful and color early completions
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(cli): fall back to the polled result when the final job fetch fails
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: add a yaml mode to the workspace settings page
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: confirm before leaving yaml mode with unsaved edits
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: guard pane edits when entering yaml mode and harden the yaml load
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: refresh the active ai config after a yaml apply
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: tie the yaml document to its workspace and reset cleared form state
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
hugocasaandClaude Opus 5.5
AlexRV12
GuilhemandClaude Opus 5.5
