slug/project_slug are caller-controlled and were interpolated straight into
the Hub request path; a crafted value (e.g. ../../admin) could reach an
unintended Hub endpoint after URL normalization. Validate against the
frontend charset (lowercase alphanumerics + hyphens, 3-50 chars) in the four
handlers that put the slug in the path.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
(folderName || slug).trim() let a whitespace-only folder bypass the slug
fallback and trim to an empty target, producing invalid f//... paths and a
failed import. Trim first, then fall back.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
extractFlowRefs only emitted refs for type: script steps, so a flow calling
an external sub-flow by path was never followed and the published project
was silently incomplete. Add a 'flow' RefKind, emit it for type: flow steps,
recurse on it in buildProjectBundle, and rewrite its path on relocation.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The workspace-switch effect only reset load-derived state, so phase,
draftItems, recordings, hub/bundle metadata, hubVersion, deploymentStatus,
effectiveSlug and hubItemIds survived a switch — a draft built in one
workspace could publish its items/slug under the next workspace's auth.
Reset the full publish session on switch. Also drop explanatory comments.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Hub publish endpoints ignored the {workspace} path and addressed the Hub
project purely by client-supplied project_slug, forwarding with an
instance-wide HUB_DEV_TOKEN. Any workspace admin could mutate or export
another workspace's Hub project by passing its slug.
Stamp the server-trusted workspace from the path onto every forwarded
request as source_id (body for mutations, query param for export) so the
Hub can enforce that the targeted project belongs to the calling
workspace. Requires the matching Hub-side source_id ownership check.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add a FolderPicker to the project install page (defaulting to the
project slug, with create-new-folder support) and retarget every
`f/<slug>/` prefix in the bundle — item paths, $res:/script refs,
schedule runnable paths — to the chosen folder in one pass. Ensures
the target folder exists before creating items.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat(frontend): use unified drill picker for AI chat @-mention dropdown
* fix(frontend): chat picker review followups + overlay alignment
- AIChatDisplay: migrate @-badge popover to ChatContextPicker (was still
importing the deleted AvailableContextList after the rebase onto #9034,
causing a build break).
- DrillPicker: handle Tab as Enter so the inline @<word> mention completes
without losing focus. Tweak leaf-row weight to font-normal; secondary
text uses text-hint.
- ContextTextarea: drop px-0.5 from the highlight span — extra horizontal
padding made every glyph typed after a mention drift right of the
invisible textarea below. box-decoration-clone keeps the rounded corners.
- ContextElementBadge: explicit font-normal label, hoist label into a
{@const} and pass to title= so the truncated badge shows the full title
on hover.
- workspaceTree: drop orphaned doc-comment left dangling by the rebase.
- Add unit tests for drillPicker.ts and workspaceTree.ts (51 tests cover
resolveScope/scopeChain/collectLeavesGrouped/leafHaystack, buildWorkspaceTree
shape + loading + dir forest + leaf shape, withCurrent rename suppression,
extraItemsByKind dedup, legacyScopeToPath, relativizeWorkspacePath).
* fix(flow-editor): ignore keyboard shortcuts when focus is outside the flow root
Menus, modals, drawers etc. live outside the flow root and capture focus
explicitly. Flow nodes aren't focusable, so the unfocused default
(activeElement === body) means "flow is the canvas" and we should react;
anything else means another surface has the user's attention and our
shortcuts would steal it.
* fix(frontend): inline @ mention picker + chat layout polish
- ContextTextarea: swap manual Portal+caret-math positioning for
svelte-floating-ui anchored at the `@` character (virtual reference,
middleware [offset, flip(crossAxis:false), shift]). Picker stays
pinned to `@` while the user types the query, slides leftward when
hitting the right edge instead of flipping alignment, and floating-ui
handles above-vs-below + edge clamping automatically. Drops the
60vh-worst-case reservation that left a big gap above the caret in
sessions, and the now-unused isFirstMessage prop is marked deprecated.
- AIChatDisplay: the `@`-button Popover now opens with placement
bottom-start (was the default `bottom`), aligning its left edge with
the button instead of centering under it.
- ChatContextPicker: when no Diffs/Modules/Databases branches are
present (e.g. global chat), return the Workspace tree's children at
the root instead of wrapping them under a redundant "Workspace" row.
handleScopeChange handles both the wrapped and unwrapped layouts and
the single-kind `dir:` top segment.
* chore(frontend): address review suggestions on chat picker PR
- DrillPicker: clamp width to viewport on narrow screens —
w-[420px] → w-[min(420px,calc(100vw-20px))].
- workspaceTree.buildWorkspaceTree: make loadingKind optional (defaults
to {}). Chat picker still passes it; callers that don't track loading
no longer need to thread an empty object.
- ChatContextPicker.handleScopeChange: name the WRAPPED vs UNWRAPPED
layouts in a comment block so the dir:/kind: branches are obvious.
- ContextTextarea: drop deprecated isFirstMessage prop (floating-ui
handles direction); drop defensive Math.max on the @ index now that
the invariant is documented; comment the floatingRef(anchorRef) call
as the supported virtual-reference path in svelte-floating-ui.
- AIChatInput: stop forwarding isFirstMessage to ContextTextarea.
* feat(frontend): sync selectedContext with @-mentions in textarea
Both picker entry points now insert a visible `@title` token in the
textarea, and deleting that token drops the matching entry from
selectedContext.
- AIChatInput: new insertMention(title) export. Appends `@title ` to
instructions, prefixing a space only if the existing text doesn't
already end in whitespace.
- AIChatDisplay: the `@`-button popover calls insertMention after
addContextToSelection so its picks match the inline-mention path's
textarea state.
- ContextTextarea: new onRemoveContext callback. A $effect compares the
set of `@title` tokens in `value` (derived) against the previous
snapshot; titles that disappeared trigger onRemoveContext for any
selectedContext entry with `deletable !== false`. The diff lives in
an effect (not handleInput) so it catches both keystroke deletions
AND programmatic value updates from updateInstructionsWithContext.
- AIChatInput: passes onRemoveContext that filters selectedContext by
type+title — mirrors the existing badge X-button handler.
* chore(frontend): narrow ChatContextPicker `inner` from `any` to `DrillPicker | undefined`
The previous `let inner: any` worked around svelte-check rejecting
`DrillPicker<ChatLeafData>` (the imported component is seen as the
non-generic `Comp`). Dropping the type parameter keeps the workaround
without `any`, so handleKeydown / pickHighlighted are at least typed
at the call site.
Addresses May-14 PR review.
* fix(frontend): address PR #9159 bot-review findings (eager preload, focus, dedup, icon types)
- [P1] ChatContextPicker.handleScopeChange: stop preloading workspace
kinds at the wrapped picker root. New `isWorkspaceOnly` $derived (true
when no Diffs/Modules/Databases branches are present) gates the at-
root preload, so the chat root no longer fires two list requests
before the user enters Workspace. Reported by Codex.
- [P2] AIChatDisplay @-button popover: call aiChatInput.focusInput()
after close() so the textarea is focused for immediate typing — mirrors
the inline-mention path's setTimeout(textarea.focus, 0). Reported by
Claude.
- [P2] AIChatInput.insertMention: no-op when the `@title` token is
already present in instructions, so re-picking a workspace item
doesn't leave duplicate visible tokens for a single selectedContext
entry. Reported by Codex.
- [P2] drillPicker.ts: introduce `DrillIcon = ComponentType |
Component<any, {}, ''>` and replace `icon: any` on DrillLeaf,
DrillBranch, and ChatContextPicker.buildContextBranch. Mirrors the
ComponentType | Component pattern used in TriggersBadge.svelte for
the same Svelte 4/5 compatibility window. Reported by Pi.
* fix(frontend): preserve workspace context on refresh + load all kinds for internal search
- [P1, Codex] ContextManager.updateAvailableContextForScript/Flow:
preserve workspace_script and workspace_flow entries through the
selectedContext filter on editor refresh. They're user-picked refs
that don't appear in availableContext, so the previous filter was
silently dropping them whenever the script/flow editor refreshed
options (e.g. on any code change).
- [P2, cubic-dev-ai] WorkspaceItemDrillPicker: in internal-search mode
(externalFilter === undefined, DrillPicker renders its own search
box), preload all kinds on mount. Without this, typing in the
picker's search before clicking a kind branch produced incomplete
results since DrillPicker can't reach back through the adapter to
trigger fetches on internalFilter change. Cached items keep the
effective cost near-zero on warm sessions.
* fix(frontend): preserve workspace refs through script-mode context refresh
The script-mode updateAvailableContext overwrites newSelectedContext
with a fresh [code] entry, defeating the workspace_script /
workspace_flow preservation in the later filter — the entries are
already gone by the time the filter runs.
Seed newSelectedContext with the refreshed code block AND the user-
picked workspace_script / workspace_flow / code_piece entries from
currentlySelectedContext, so editor refreshes don't wipe @-mention
badges in script chat. The existing line-271 filter still validates
each entry against newAvailableContext + the per-type allowlist.
Reported by Codex on PR #9159 — completes the prior workspace-context-
on-refresh fix (b02d1f2d35) which only patched the filter, not the
rebuild step that runs before it.
* fix(frontend): preserve all previously-selected contexts on script refresh
The prior c2775fe0c5 fix only carried over workspace_script /
workspace_flow / code_piece entries from currentlySelectedContext.
That preserved the workspace P1 path but still dropped previously-
selected diff / error / db / runtime-context badges, which cubic
flagged in its 16:55 review.
Spread the full currentlySelectedContext (minus `code`, which we just
rebuilt). The downstream filter validates each entry against
newAvailableContext + the per-type allowlist, so auto-derived types
like diff / error / db survive when still applicable, and unrelated
items are dropped automatically.
Reported by cubic-dev-ai on PR #9159.
* fix(frontend): rehydrate auto-derived context + sync badge X with textarea
- [P2, cubic] ContextManager.updateAvailableContext: when the rebuild
carries over previously-selected diff/error/db entries, swap each one
for the matching freshly-built entry from newAvailableContext in the
final .map() step. Preserves the user's `deletable` override on top
of the fresh content/diff/schema, so refreshes don't keep stale
payloads while still surviving the badge across edits.
- [P2, Pi/Codex] AIChatInput: new `removeMention(title)` export that
strips `@title` tokens from `instructions` (whitespace-bounded so
substring matches don't bleed). The badge X-button now calls it
after filtering selectedContext, mirroring the inverse textarea-to-
badge sync. No double-remove: ContextTextarea's $effect-driven
onRemoveContext is a no-op once selectedContext no longer holds the
entry.
* fix(frontend): retype ChatContextPicker.inner to DrillPicker<ChatLeafData>
`npm run check:fast` (TypeScript-only) and `npm run check` (svelte-check)
disagree on whether the imported DrillPicker is generic — `check:fast`
sees it as `Comp` and rejects the type parameter, while `svelte-check`
sees the real generic component and requires it. CI runs `check`, so
follow that: `DrillPicker<ChatLeafData> | undefined`.
This also fully replaces the prior `inner: any` workaround called out in
multiple bot reviews — handleKeydown / pickHighlighted now type-check at
the call site against the correct component instance.
* fix(frontend): scope removeMention's whitespace collapse to the mention site
The trailing `.replace(/ +/g, ' ')` in `removeMention` was global,
collapsing any pre-existing double-spaces in the prompt — e.g. a user
typing `"hello world @foo bar"` lost their intentional formatting
when they deleted the `@foo` badge.
Rework the regex to match `(^|\s)@title(\s|$)` and decide per-match:
- Mention at a boundary (no lead or no trail): drop entirely.
- Mention in the middle: keep ONE bordering whitespace char (the
leading one verbatim, so newlines/tabs aren't downgraded to spaces).
No global pass over `instructions`. Unrelated whitespace stays intact.
Reported by cubic-dev-ai on PR #9159 (07:27 review of 9e07eac4).
* fix(frontend): expose DrillPicker.onFilterChange + lazy-load workspace kinds
Both Codex P1s came from over-eager preload heuristics on my prior fixes:
the workspace picker cold-loaded every configured kind on mount in
internal-filter mode, and the chat badge popover never observed its own
internal filter so workspace results were missing from search until the
user drilled into Workspace.
Replace both ad-hoc effects with a single `onFilterChange` callback on
DrillPicker that fires whenever the EFFECTIVE filter (external or
internal) changes:
- [P1] WorkspaceItemDrillPicker: drop the "cold-load on mount when
externalFilter === undefined" effect. Workspace kinds now load only
once the user actually types something — closer to the pre-refactor
behavior where the breadcrumb / "Open editor" pickers only fetched
the drilled-into kind plus all kinds on search.
- [P1] ChatContextPicker: handleFilterChange replaces the prior
externalFilter-only effect. Badge-popover search (internal filter)
now triggers the same preload as inline-mention search (external
filter), so workspace results appear without needing to drill first.
Both fixes reported by Codex on PR #9159.
* fix(frontend): skip mention-removal sync when textarea is programmatically cleared
sendRequest() sets `instructions = ''` immediately after dispatching to
AIChatManager. The mention-removal effect treated this as user-initiated
deletion and cleared selectedContext BEFORE AIChatManager.beforeSend
snapshotted it — selected `@` contexts disappeared from the outgoing
request. Skip the sync when value is empty; user-initiated mention
deletes happen in-place against non-empty content.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix(frontend): scope post-send wipe protection to the send path only
Replace the blanket `if (value !== '')` guard on the mention-removal
effect with an explicit `clearForSend()` export. `sendRequest()` now
calls it instead of `instructions = ''`, so a user manually clearing
the whole textarea still drops the corresponding context badges while
the post-dispatch programmatic wipe is silent.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* refactor(frontend): extract useWorkspaceItemsLoader composable shared by both drill picker adapters
WorkspaceItemDrillPicker and ChatContextPicker each duplicated the same
machinery: loaded/loadingKind state seeded from the module cache, a
stale-while-revalidate ensureLoaded coroutine with an untrack guard, a
kind:/dir: scope-segment decoder, and the "load every kind once the user
starts searching" filter callback.
Move that to a single useWorkspaceItemsLoader() returning
{loaded, loadingKind, ensureLoaded, ensureAll, ensureForScopeSegment,
onFilterChange}. Adapters keep their own scope-walking policy (chat
collapses an optional 'workspace' wrapper, workspace handles single-kind
mode) but delegate kind decoding and lazy fetch to the composable.
Net: -135 +28 LOC in the two adapters; +109 LOC in the new composable.
The cache-version race, untrack discipline, and stale-while-revalidate
semantics now live in one place.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix(frontend): address Codex P1+P2s — non-context clear, same-title cross-removal, single-kind cold load
P1: sendRequest() now clears `instructions` unconditionally after the
optional `clearForSend()` so APP/NAVIGATOR/ASK/API modes (which don't
mount ContextTextarea) still reset the input after send.
P2: removeMention() now calls a new `unsyncMention(title)` on the
textarea before stripping `@title` from `value`, so the mention-removal
effect doesn't fire a second onRemoveContext on a same-title sibling
(e.g. workspace_script + workspace_flow sharing a path).
P2: single-kind WorkspaceItemDrillPicker loads its kind at mount even
when scope is empty — buildWorkspaceTree collapses to the kind's
children, so there's no kind row to drill into to trigger the load.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
New /projects/install page pulls a hub project's export and re-creates it in
the selected workspace.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add an optional path field to the publish bodies and a GET
/projects/{slug}/export route that proxies the hub export (admin-only,
authenticated with HUB_DEV_TOKEN).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Include each item's newPath in the script/flow/app/raw_app publish payloads so
the hub can store the relocated Windmill path.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- Detect modern raw apps (app table, raw_app=true) and push them to the Hub
as raw apps: fetch source files + runnables + the compiled bundle (via the
latest-version bundle secret) and shape them into the raw payload RawAppView
expects. Fail loudly when no compiled bundle exists.
- Capture the Hub id for raw apps and wire "Share as iframe"/"Unpublish" for
them (post-bundle, like recordings); re-sync the embed on re-bundle for
already-public apps. Factor the publish/unpublish flow into setAppShared +
pushRawAppEmbed helpers.
- Scope bundles to a single required f/<folder>/ (Select instead of MultiSelect)
so relocated paths stay predictable.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add POST /w/{workspace}/hub/raw_apps/{id}/embed forwarding to the Hub so a
shared (public) raw app's external_embed_url can be set/cleared. null is
forwarded (not skipped) so unpublish clears the embed.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Adds a small ExternalLink icon at the far right of every row in the
Resource dependencies drawer (script / flow / app / raw_app) and the
Triggers drawer (per trigger kind, opens the matching list page —
/routes, /schedules, /websocket_triggers, /kafka_triggers, …). Both
buttons open in a new tab scoped to the current $workspaceStore. Sized
to sit after the role badge so the dominant signal (input vs hardcoded
path, script vs flow) stays read first.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The Hub-deploy surface now talks about *projects* (the bundle published
to the Hub) instead of *workspaces* (which still means the source
tenant). Tab is "Publish project", header copy mentions "project", the
Hub URL in the breadcrumb points to /projects/<slug>, payload field is
`project_slug`. Internal state names (`workspaceItems`, `workspaceStore`,
`WorkspaceService`, …) stay — they refer to the instance workspace the
items are read from, which has not been renamed.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Matches the windmillhub rename: every body now carries `project_slug`
instead of `workspace_slug`, the draft creation forwards to `/projects`,
and the resource_types/resources/triggers proxies hit
`/projects/{slug}/...`. `HubWorkspaceBody` becomes `HubProjectBody`. The
instance-side `Path(workspace)` extractor and the `workspace` URL
parameter stay because that's still the source tenant's identifier.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
After scripts/flows/apps land on the Hub, pushTriggers() builds a
relocation map for the trigger paths, strips operational metadata
(workspace_id, edited_by/at, enabled, last_*/captured_*, capture data,
error_handler_path/args, permissioned_as*) from each config, resolves
script_ask_id / flow_id via the hubItemIds map produced by step 3, and
POSTs the whole set to /api/w/:wsp/hub/triggers. Triggers whose runnable
didn't publish are skipped with a warning rather than emitted as broken
stubs.
Also drops the per-kind trigger-load error surfacing: feature-gated
services (Kafka, NATS, ...) 404 on instances that don't enable them, and
the banner was lighting up on every load for nothing. Errors are
swallowed silently again, matching the pre-review behaviour.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Mirrors the existing /scripts, /flows, /apps thin proxies. Forwards
{ triggers, workspace_slug } to Hub's POST /workspaces/[slug]/triggers
bulk-replace endpoint, with the same require_admin + HUB_DEV_TOKEN
guardrails. Lets the frontend push trigger stubs in a single round-trip
after the items they reference have landed on the Hub.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- Add ApiAuthed + require_admin to all hub publish handlers; previously any
workspace-authenticated session could trigger Hub-side writes attributed
to the URL workspace via the shared HUB_DEV_TOKEN.
- Track per-kind trigger fetch failures (triggerLoadErrors) so an EE-gated
or transiently failing trigger service no longer silently maps to "0
triggers"; UI surfaces an amber badge listing the missing kinds and a
toast warns the operator before publish.
- Add workspaceLoadSeq cancellation so the parallel loadWorkspace +
loadTriggers stop bleeding stale data when the workspace switches mid
load.
- Drop the silent effectiveSlug fallback to sanitizeSlug(hubName) when
the Hub response can't be parsed; abort the publish instead so items
don't land under a slug the Hub never locked.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- deployAll now builds a self-contained project bundle (buildProjectBundle),
pushing resource types, empty resource stubs at relocated f/<slug>/ paths,
and the rewritten items — so a fork's references resolve inside the project.
- Resource-dependency detection is unified on the same bundle: the UI list
(dependencyTypes) is derived from the bundle preview, guaranteeing what's
shown matches what's pushed. Removes the duplicate in-component detection
(extractResRefs/refsForItem/resolveResourceSet/typeForResource).
- Input-type deps (schema format: resource-<type>) are synced as types and
conventional f/<slug>/<type> stubs alongside hardcoded ones.
- Replaces the hardcoded-path warning/fix/block machinery with a read-only
"Resource dependencies" drawer: per-type usages tagged input vs hardcoded
path, with an info popover explaining the portability tradeoff.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Derive resource dependencies from the $res:/res:// references in the selected
scripts/flows/apps instead of a manual resource list, sync them as empty stubs,
and show them read-only (chip per type, hover for path + which items use it).
Aborts item publish if dependency sync fails to avoid broken fork references.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Forward workspace resource stubs (path + type) to the hub's
/workspaces/{slug}/resources endpoint.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Replaces the mocked deploy flow with real backend calls:
- confirmBundle() POSTs /hub/publish_draft with sanitized slug,
name, summary and readme.
- deployAll() pushes selectedItems one by one via pushItem(),
fetching the live content (Script/Flow/AppService + raw_apps
get_data) before forwarding to /hub/{scripts,flows,apps,raw_apps}.
- saveRecording() builds the replay-shaped payload expected by
the Hub (initial_job + events with type: 'CompletedJob') and
POSTs to /hub/{scripts,flows}/{hub_id}/recording.
- Adds bundleSummary state + TextInput in the drawer.
Hub item ids (ask_id / flow_id) returned by the create calls are
cached client-side to wire later recording uploads.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
New workspaced router /api/w/:ws/hub/* forwarding to the Hub:
- POST /publish_draft → POST {HUB}/workspaces (slug/name/summary/readme)
- POST /scripts → POST {HUB}/scripts/add (workspace_slug + content)
- POST /flows | /apps | /raw_apps → corresponding hub endpoints
- POST /scripts/:ask_id/recording, /flows/:flow_id/recording → recording uploads
Auth uses HUB_DEV_TOKEN env var (dev shortcut). All bodies are
serde-typed; the helper forward_to_hub centralises the HTTP call.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(queue): bump EE ref to include worker_ping fairness signal
The current ee-repo-ref.txt pointed to 31cda7c (an unrelated merge
commit on the asset-graph-view-ee branch) instead of ddc9e80, which
contains the workspace-fairness fix that switches the active-share
signal from v2_job_queue.running=true to worker_ping. As a result
cloud was still computing overload off the legacy signal, so a
workspace with many in-flight/suspended flows (lancom01-prod, with
799 suspended flows × 3 v2_job_queue bookkeeping rows each = 2397
running-true rows) was flagged as 95% of cluster activity despite
consuming zero worker slots.
Bumping to ddc9e80 picks up the worker_ping-based signal, which
naturally excludes (a) suspended jobs (no worker pinging them),
(b) zombie running-rows from dead workers, and (c) flow/flownode
orchestration rows that never run on a worker in the first place.
* test(queue): seed v2_job rows + realistic durations for fairness helpers
The new duration-weighted fairness algorithm joins v2_job_queue and
v2_job_completed to v2_job for the `kind` filter (excluding flow
bookkeeping) and reads `duration_ms` for the completed contribution.
Update the test helpers to mirror that schema:
* `insert_completed` now inserts a matching v2_job row (kind=script)
and writes `duration_ms = 1000` with a 1-second [started_at,
completed_at] interval, so each completed row contributes ~1
worker-second when fully inside the refresh window.
* `insert_queued` likewise pre-inserts v2_job, sets `started_at`
to NOW() - 1s when running=true (so running rows contribute ~1
worker-second by the time the refresh runs), and seeds
v2_job_runtime.ping so the running side accrues real-time worker
seconds (the algorithm bounds end-of-interval by ping).
The zombie/suspended insert helpers are intentionally left without
v2_job rows — the new algorithm's INNER JOIN excludes them, so they
still correctly contribute zero worker-seconds.
* chore(queue): bump EE ref to duration-weighted fairness algorithm
Companion to windmill-ee-private#<TBD>: switch the EE workspace
fairness aggregation from a count-based UNION (worker_ping snapshot
+ v2_job_completed count) to a worker-seconds aggregation sourced
directly from v2_job_queue and v2_job_completed, with kind/suspend
filters mirroring handle_zombie_jobs and per-row defenses against
zombie inflation on both halves.
* chore(queue): bump EE ref for fairness perf fix (inline window_start)
* chore(queue): bump EE ref for fairness perf rewrite (driver-side flip)
* update ee ref
`fairness_ignores_zombie_running_rows` and
`fairness_ignores_concurrency_suspended_rows` panic intermittently in CI
(both Linux and Windows runs). Mark them `#[ignore]` until the
underlying flakiness is resolved.
* feat(websocket-trigger): honor HTTPS_PROXY/HTTP_PROXY/NO_PROXY (WIN-1988)
`tokio_tungstenite::connect_async` opens a raw TCP socket and ignores
the standard outbound-proxy env vars, so deployments behind a forward
HTTP proxy can't reach the WebSocket endpoint and Test Connection
times out after 30s.
Add a small `proxy` module that resolves the right proxy URL for the
target host (HTTPS_PROXY for wss://, HTTP_PROXY for ws://, NO_PROXY
exclusions, ALL_PROXY fallback, lowercase variants), opens an HTTP
CONNECT tunnel when one applies, and hands the resulting TcpStream to
`client_async_tls_with_config` for the TLS + WS handshake. Direct
connect remains the default when no proxy env is set.
Unit tests cover NO_PROXY matching, proxy URL parsing (including IPv6
literals and basic-auth userinfo), and the CONNECT handshake itself
against an in-process fake proxy (success, basic-auth header, 407
rejection).
Fixes WIN-1988
* refactor(websocket-trigger): reduce blast radius and reuse existing logic
Follow-up to the proxy support change. Three things:
1. Skip the new code path entirely when no proxy is configured.
`connect_async_with_proxy` now checks the env-var snapshots up front
and delegates straight to `tokio_tungstenite::connect_async` if
neither `HTTP_PROXY` nor `HTTPS_PROXY` is set. Same fall-through
applies when proxy env is set but `NO_PROXY` excludes the host or
the proxy URL doesn't parse. Non-proxied deployments now exercise
exactly the previous code path.
2. Move the `NO_PROXY` / `HTTP_PROXY` / `HTTPS_PROXY` env-var snapshots
from `windmill-worker::worker` into `windmill-common`. The worker's
`PROXY_ENVS` static now reads from there, and the websocket trigger
reads from the same source — one place reads the env, one source
of truth for both call sites.
3. Replace the hand-rolled proxy-URL parser with `url::Url::parse`
(already a workspace dep, used across the codebase). Half the LoC
and handles edge cases (userinfo percent-encoding, IPv6 literals,
path/query stripping) via the well-tested crate instead of by hand.
All 13 proxy unit tests still pass. `cargo check` is clean.
* fix(websocket-trigger): unbreak EE build + trim proxy tests
- Re-export `NO_PROXY` / `HTTP_PROXY` / `HTTPS_PROXY` from
`windmill-worker::worker` (via `pub use windmill_common::...`) so the
EE `otel_tracing_proxy_ee` module's `use crate::{HTTPS_PROXY, ...}`
resolves like it did before. Fixes the `check_ee_full` / `cargo_test`
CI failures from the previous commit.
- Trim the proxy tests to one un-ignored canary
(`http_connect_tunnel_sends_well_formed_request_and_unwraps_stream`)
that exercises the actual on-wire CONNECT handshake plus byte-perfect
tunnel passthrough. The NO_PROXY-matching, URL-parsing, and edge-case
tunnel tests are kept under `#[ignore]` for manual debugging
(`cargo test -- --ignored`) since they're either delegated to
`url::Url::parse` or trivial string matching — low ROI on every CI run.
* feat(raw_apps): surface UI Builder build errors over the preview pane
Companion to the matching change in the UI Builder repo (see linked PR),
which stops rendering the build-error overlay over the VS Code editor
iframe and instead emits a `buildError` postMessage on every build
(message: undefined on success to clear).
Listen for that message on the existing window message handler (already
source-gated by the UI Builder iframe), store it in a `buildError`
$state, and surface it in two places:
* A red banner over the preview iframe, sibling to the existing logs
overlay (`top-12 left-2 right-2 z-20` so it clears the tab bar) —
failures appear right where the user looks for the rendered output.
* The Preview tab's icon and label tint red
(`text-red-600 dark:text-red-400`, matching the existing error
convention in raw_apps) — important in single-tab mode where the
preview pane is collapsed to 0px and the banner would be hidden.
Done by mapping `leftPaneTabs` / `rightPaneTabs` through a small
`tintPreviewOnError` helper so the source-of-truth `tabs` array is
untouched (DnD, ordering, fallback selection keep using the original
previewTab object).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* refactor(raw_apps): use Alert component for the build-error banner
Replace the hand-rolled red div with the shared `Alert` component
(`type="error"`, `title="Build failed"`). The error text stays in a
`<pre>` child so multi-line bundler output keeps its formatting, with
`max-h-60` so a long error never takes over the whole preview pane.
The absolute-positioned wrapper (`top-12 left-2 right-2 z-20`) and the
`role="alert"` move to that wrapper so the Alert component itself stays
unstyled at the call site.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(raw_apps): solid bg-surface backing behind build-error Alert
The Alert's error background is semi-transparent in dark mode
(`bg-red-900/40` in `common/alert/model.ts`), so the preview iframe
shows through when the banner is laid over it. Add a `::before`
pseudo on the Alert root with `bg-surface` (matched `rounded-md`,
`-z-10` so it sits behind the red bg) to give it a solid plate.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* refactor(raw_apps): isolate banner stacking context, DRY tab tint chain
Two small follow-ups from review:
* Add `isolate` to the build-error banner wrapper so the `before:-z-10`
pseudo's stacking context is pinned locally — it works today because
`position: absolute` + `z-20` creates one, but `isolate` makes the
dependency self-documenting and survives a future refactor that
removes the explicit `z-20`.
* Extract `tintTabs = (ts) => ts.map(tintPreviewOnError)` so the two
`$derived` blocks for leftPaneTabs / rightPaneTabs read identically.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* chore(raw_apps): trim build-error overlay comments
Per review feedback. Keep only the load-bearing facts (bg-surface backs
the Alert's translucent red, isolate pins the pseudo stacking, the
`message: undefined` clear convention) and drop the prose context that
duplicated what the code already shows.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* chore(raw_apps): bump bundled ui_builder to 00c9834
Brings in the postMessage emission from
windmill-labs/windmill-code-ui-builder#9 (merged) so this PR's host
listener actually receives `buildError` events. SHA verified against
the R2 artifact.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(jobs): enforce anonymous-only guard on `only_result` job updates
The `jobs_u/getupdate/{id}` and `jobs_u/getupdate_sse/{id}` endpoints
accept `only_result=true`. In that branch, `get_job_update_data` queried
the result solely by (workspace_id, job_id) and skipped the
`created_by == "anonymous"` check that the non-only_result path and
adjacent unauthenticated endpoints apply. An unauthenticated requester
who learned a private job UUID could therefore retrieve that job's
output.
Hoist the guard to the top of `get_job_update_data` so both branches are
covered.
Fixes WIN-1980
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* refactor: fold `created_by` check into existing only_result queries
Avoids the extra `SELECT created_by` round-trip per call by joining
`v2_job` once in the two queries that handled the unauth path and
checking inline. Behavior is identical to the prior commit; the SSE
polling loop now does one query per poll instead of two for
unauthenticated callers.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* refactor: cache anonymous_verified across SSE polls
Replace the LEFT JOIN approach with an upfront `SELECT created_by`
guarded by a new `&mut bool anonymous_verified` parameter that mirrors
`early_return_suppressed`. The SSE polling loop now performs the auth
check exactly once per stream rather than per poll, and the data SQL
reverts to its original form so authenticated callers pay no extra
cost. `created_by` cannot change after job creation, so caching the
verification across polls is safe.
Cost matrix:
- Authed (any path): 0 extra queries
- Unauthed one-shot: 1 extra query (unavoidable)
- Unauthed SSE: 1 extra query at stream start, 0 per poll
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* refactor: scope anonymous check to only_result branch
The non-only_result branch already enforces the `created_by` check via
its main query, so a top-level hoisted check duplicated work for
unauthenticated default-path callers. Move the check inside the
`if only_result.unwrap_or(false)` block — exactly where the bypass
lives — and leave the non-only_result path untouched.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* [ee] feat(service-accounts): allow choosing role at creation time
Previously, service accounts were hardcoded to operator and could not be
used as the CLI sync user since they had no write access. They also only
counted as 0.5 seat each.
This change:
- Extends `NewServiceAccount` to accept optional `is_admin` / `operator`
(defaults to `operator=true` for backward compatibility).
- Exposes a role picker in `AddUser.svelte` when creating a service
account (Operator / Developer / Admin).
- Lets admins update a service account's role from the user list (it
used to be locked to "Operator" with a tooltip).
- Updates the OpenAPI spec + regenerates the frontend client.
A developer/admin service account counts as 1 seat under the existing
seat-cap logic (operators stay at 0.5).
Companion PR on windmill-ee-private updates the `INSERT INTO usr` to
honour the chosen role.
Fixes WIN-1985
* [ee] feat(service-accounts): wm_deployers opt-in for Dev role
When creating a service account with role=Developer, surface a toggle
"Add to wm_deployers" (recommended). Members of wm_deployers can deploy
on behalf of other users — the typical setup when the service account is
used as the CLI sync / CI deploy identity.
- `NewServiceAccount` gains an optional `add_to_deployers` flag.
- Frontend defaults the toggle to on but only shows it under Developer
(admins have it implicitly; operators can't deploy).
- Tooltip links to docs.windmill.dev "Run on behalf of".
Companion EE PR updates the handler to INSERT into usr_to_group for
wm_deployers when the flag is set.
Refs WIN-1985
* chore: update ee-repo-ref to 974ed42067d9f63acb42332b671b8c01ffd4b625
This commit updates the EE repository reference after PR #589 was merged in windmill-ee-private.
Previous ee-repo-ref: f7dbc3cc2ba21c396f4828881e3b9d9ab6f50c69
New ee-repo-ref: 974ed42067d9f63acb42332b671b8c01ffd4b625
Automated by sync-ee-ref workflow.
* [ee] fix(service-accounts): unhardcode role in superadmin user list
Two review issues from the merged #9307 / #589:
1. P1 — The global Users tab in #superadmin-settings still pinned every
service account to "Operator". Now it shows the actual role
(Admin / Operator / Developer), derived from the SA's usr row.
- `list_users_as_super_admin`: replaced `true as operator_only` with
the real `operator` value, and added `is_workspace_admin` from the
row (NULL for password users since their admin status is
per-workspace).
- `global_whoami`: when the email belongs to a service account, look
up its real `operator` / `is_admin` instead of pinning to operator.
- `SuperadminSettingsInner.svelte`: drop the hardcoded "Operator"
badge; render Admin / Operator / Developer using the new fields,
matching the workspace-level view.
2. P2 — Regenerate the bundled `openapi-deref.{yaml,json}` so the
`createServiceAccount` body (now exposing `is_admin`, `operator`,
`add_to_deployers`) and the new `GlobalUserInfo.is_workspace_admin`
field show up at runtime in `/api/openapi.{yaml,json}`.
Bumps `ee-repo-ref.txt` to the EE follow-up that adds the offline
seat-cap check on `create_service_account`.
Refs WIN-1985
* chore: update ee-repo-ref to b7a6068c1f3dc845e012959268b2426f0de4d697
This commit updates the EE repository reference after PR #590 was merged in windmill-ee-private.
Previous ee-repo-ref: 0b1307c21d1bfd6fb43a03c2ba39d2a8bf8e6470
New ee-repo-ref: b7a6068c1f3dc845e012959268b2426f0de4d697
Automated by sync-ee-ref workflow.
---------
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* fix(settings): skip workspaced-route duplicate checks on cloud
The pre-write validation hooks for `app_workspaced_route` and
`http_route_workspaced_route` query the DB for cross-workspace duplicates
and fail the save when any are found. On cloud both `custom_path_exists`
(apps) and `route_path_key_exists` (HTTP triggers) already scope lookups
by `workspace_id` regardless of these settings, so duplicates across
workspaces are expected and the validation has no runtime meaning. The
result was that any cloud super-admin attempting to save instance
settings with these toggles set to false received
`Duplicate HTTP route paths detected` even though the setting has no
effect on cloud routing.
Fixes WIN-1983
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(error): render JsonErr as readable text and return 400
`Error::JsonErr` previously rendered through `#[error("Error: {0:#?}")]`,
leaking Rust's `Debug` output (`Object { "error": String(...), "details":
Array [...] }`) into the HTTP response body, and was bucketed into the
catch-all 500 branch in `IntoResponse`. The result was a 500 status with
a wall of Rust debug syntax in the toast — confusing and user-hostile.
- Bucket `JsonErr` into 400 (Bad Request): every current call site
(workspaced-route duplicate checks, OAuth client errors, etc.) is a
client/validation issue, not an internal server fault.
- Add `format_json_err_message` which surfaces the `error` field as the
headline, summarises `details` (with a `- key=value` per entry), and
pretty-prints the rest as JSON for unknown shapes. The frontend toast
now reads e.g.
Duplicate HTTP route paths detected
- route_path=a, workspace_id=admins, http_method=post
- route_path=a, workspace_id=starter, http_method=post
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(toast): preserve newlines and escape HTML in multi-line errors
The toast renders via `{@html processMessage(message)}`, so server-side
error bodies that span multiple lines (e.g. the duplicate-route response
from the settings endpoint) collapsed into a single line because HTML
treats consecutive whitespace (including `\n`) as a single space.
When the message contains a newline, escape HTML first (defends against
injected markup in server error bodies) and convert `\n` to `<br />` so
multi-line errors stay readable in the toast.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fixup: address CI review feedback
- toast.ts: escape HTML unconditionally. The previous gate on `\n` left
single-line server error bodies unsafe under {@html}, which cubic
flagged as P0. The path regex below only inserts a `<span>` around a
`u/...` or `f/...` capture that can't contain HTML metacharacters, so
escaping the whole input is the simpler and correct fix.
- error.rs: add unit tests pinning the rendered shape of
`format_json_err_message` (error+details, error-only, truncation cap,
non-object fallback to pretty JSON).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(raw_apps): custom tab system for source / runnable / preview
Replaces the fixed split-pane layout with a tab bar inside the editor
area. Each frontend file is a tab, each selected runnable is a tab,
and the Preview is pinned to the right (non-closable). Tabs are an
alternative discoverability surface to the sidebar — both stay
functional, but tabs make navigation viable on small screens with
the sidebar collapsed.
A "Split with Preview" toggle in the tab bar's trailing slot pairs
the active tab with the preview side-by-side for wide-screen
multitasking. The toggle hides when Preview is already the active
tab.
The UI Builder, runnable editor, and preview iframe all stay mounted
across tab switches (toggled via `display`) — no bundler restarts, no
preview state loss, no editor remounts.
- New common/tabs/DraggableTabs.svelte: reusable tab strip with
drag-reorder (@windmill-labs/svelte-dnd-action), pinned-left/right
slots excluded from the drag zone, hover-revealed X close, middle-
click close, keyboard navigation (arrows / Enter / Backspace),
and a `trailing` snippet for inline toolbar add-ons.
- raw_apps/RawAppEditor.svelte:
- Tab state (`tabs`, `activeTabId`, `splitWithPreview`) lives in
Windmill. Persisted in localStorage keyed by workspace + app path.
- Sidebar file clicks (`handleSelectFile`) and runnable selection
(`selectedRunnable` via `bind:`) are mirrored into tabs via an
effect — the sidebar interaction is otherwise untouched.
- Listener augmented: `setActiveDocument` backfills tabs for files
VS Code opens by itself; `setFiles` / `runnables` updates drop
stale tabs.
- Bundler / inspector / rebuild toolbar moves into the tab bar's
trailing slot — always visible regardless of active tab.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(raw_apps): modern tab styling + resizable split-with-preview
Two polish passes on the new tab system:
DraggableTabs styling:
- Remove the bottom border on the tab strip + the accent-coloured
border-b-2 on the active tab. The active tab now shares the
surface background with the content area below it, so the
boundary visually "disappears" — modern IDE-style tabs.
- Inactive tabs sit on the darker surface-secondary tab strip and
get a subtle right separator so they don't blur into each other.
Split-with-Preview is now a real resizable Splitpanes:
- The content area is rendered as a Splitpanes (always), with the
source/runnable slot on the left and the preview iframe on the
right. The user can drag the divider to adjust the ratio when
the "Split with Preview" toggle is on.
- Iframes never remount across single↔split toggles — pane sizes
are driven reactively from (activeTabKind, splitWithPreview),
not by adding/removing the Splitpanes itself.
- The user's preferred split ratio is remembered while they're
dragging and reapplied next time split is enabled.
- The inner splitter is CSS-hidden in single mode so the toggle
button stays the single canonical way to flip layouts.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* refactor(raw_apps): split mode moves preview tab into the right pane
Cleaner mental model for split-with-preview. Instead of "split the
active tab + always keep the Preview tab around", the Split toggle
now physically moves the Preview tab out of the bar and into a
permanent right pane. When the user toggles split off, the Preview
tab reappears in the bar like any other tab.
- New `displayedTabs` derived: filters out the Preview tab when
splitWithPreview is on, so the user sees only file/runnable tabs
in the bar and a dedicated preview pane on the right.
- `toggleSplit` redirects the active tab to the most recent
file/runnable when the user toggles split on with Preview active,
so they don't end up staring at an empty left pane.
- Split toggle is now always visible — the user can flip both ways.
The button label flips between "Pin preview to the right" and
"Move preview back into a tab" to reflect what's about to happen.
- reorderTabs preserves the Preview tab in the underlying `tabs`
array even though it's filtered out of the drag set in split mode.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(raw_apps): VS Code-style "Preview" header on the right pane
In split mode, the right pane now shows a small "Preview" tab-styled
header anchored at its top-left — making the layout read like a real
VS Code editor split, where each group has its own tab bar.
- Header appears only when `splitWithPreview && activeTabKind !== 'preview'`
(i.e. when the right pane is meaningfully separate from the left's
content). In single mode with preview active, the right pane is the
only thing visible and the main tab bar already labels it.
- The header uses the same styling as an active tab: `bg-surface`
on a `bg-surface-secondary` strip, h-8, text-xs, no border.
- An X button next to the label toggles split off — equivalent to
closing the editor in VS Code's split view (preview goes back to
living as a tab in the main bar).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* refactor(raw_apps): VS Code-style symmetric tab bars per pane
Restructure the editor area so each pane is a self-contained "editor
group" with its own tab bar at the top. The Splitpanes is now the
topmost element — the divider runs floor-to-ceiling, splitting both
the tab bars and the content.
Layout (left pane = source / runnable, right pane = preview):
- Left pane top: DraggableTabs (file/runnable tabs, Preview tab when
split is off) + Split-toggle in the trailing slot.
- Right pane top: a custom preview header — "Preview" label styled
like an active tab on the left + the preview-affecting toolbar
(bundler, inspector, rebuild) on the right.
- Each pane independently sized via Splitpanes; iframes + the
runnable panel stay mounted and toggled via `display` so state
survives every transition.
Trade-off: in single-mode with Preview active (paneA=0), the left
tab bar is hidden along with the left pane. To switch back to a
file tab the user uses the sidebar — which is exactly the
discoverability surface tabs were meant to complement, not replace.
Button placement by semantic ownership:
- Layout control (Split toggle) — left side, with the editor.
- Preview-affecting controls (bundler, inspector, rebuild) — right
side, with the preview. No close-X on the right; the Split toggle
on the left is the canonical way to flip layouts.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(raw_apps): keep tab bar visible when Preview is active in single mode
The "VS Code-style" restructure put the tab bar inside the left
Pane. When activeTabKind became 'preview' in single mode, the left
pane collapsed to width 0 and the entire tab bar disappeared with
it — leaving the user with no way to switch back to a file tab
except via the sidebar.
Move the main tab bar back above the inner Splitpanes (full width,
always visible). The preview pseudo-header stays inside the right
pane, carrying the bundler / inspector / rebuild toolbar. The
splitter only goes through the content area below the tab bar,
which is acceptable given how much friction the disappearing-tabs
edge case caused.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* refactor(raw_apps): per-pane tab bars with mirrored single-mode lists
Replace the single tab bar above the inner Splitpanes with one
DraggableTabs per pane. Splitter now goes floor-to-ceiling through
tabs AND content in split mode.
In single mode both bars mirror the full tab list, so the visible
pane always carries every tab — fixes the bug where activating
Preview hid the tab strip. Clicking Preview while in split mode is
a no-op (Preview is permanently visible in the right pane).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* refactor(raw_apps): polish tab strip and sync editor font to text-xs
* feat(raw_apps): move logs overlay onto the preview pane
* refactor(splitpanes): extract pixel-aware minSize helper
* fix(raw_apps): tab hydration loads correct file; closeTab in split mode
* fix(raw_apps): lazy-mount UI Builder iframe + add dev:ui-builder script
* feat(raw_apps): default split view, blue preview tab, fix dnd ghosting
* fix(raw_apps): remove 1px splitter sliver beside preview in single view
* fix(raw_apps): tab scrollbar on hover, fix thumb height + resize staleness
* refactor(raw_apps): don't persist tab/split layout in localStorage
* refactor(raw_apps): derive pane sizes + binding setter instead of effects
* style(raw_apps): trim verbose comments
* feat(raw_apps): accept appendLogs delta from the UI Builder iframe
* fix(raw_apps): exit inspect mode on Escape
* fix(raw_apps): Escape clears lingering inspector selection after pick
* style(raw_apps): accent-selected styling for active tab, bg-surface strip
* fix(raw_apps): address PR review nits (drop debug log, timer/reorder/pane-setter, dev script restore)
* fix(raw_apps): clear inspector overlay on the preview iframe, not the source
* style(raw_apps): neutral tab look (surface-tertiary/text-emphasis selected, text-hint idle)
* chore(raw_apps): bump bundled ui_builder to 61b6fdd
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(ai-chat): align footer bar, use DropdownV2 for mode/autonomy selectors
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(dropdown): add `selected` item prop rendering a trailing check
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* style(ai-chat): add small spacing between chat input and footer bar
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(ai-chat): always offer the 3 autonomy options in the auto-accept picker
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(ai-chat): default autonomy mode to auto-accept on
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* refactor(ai-chat): use Button component for footer dropdown triggers
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* style(ai-chat): use a hand icon for the auto-accept-off autonomy state
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* style(ai-chat): use subtle Button variant for mode and model selectors
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* style(ai-chat): tighten spacing between input and footer bar
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(ai-chat): reword autonomy levels as ask/auto-accept/bypass permissions
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(button): add 2xs unified size with tighter padding
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(ai-chat): compact footer bar — 2xs buttons, AtSign context icon, short Yolo label, discreet model
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* style(ai-chat): widen the permission selector dropdown
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(dropdown): group shortcut + selected check to avoid ml-auto collision
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* test(ai-chat): cover getPersistedAutonomyMode default; clarify default comment
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(queue): audit-log workspace-fairness cap transitions
When the cloud per-workspace fairness mechanism adds a workspace to the
capped set or releases one, write `workspace_fairness.capped` /
`workspace_fairness.uncapped` audit-log entries to the affected workspace.
The cluster admin can review the full timeline from the `admins` workspace
audit view with `all_workspaces=true`; per-workspace owners see their own
events in their normal audit list.
Only the per-cycle refresh winner emits entries (matching where the heavy
aggregation runs), so a fleet of N workers does not produce N duplicates
per transition. The diff is computed against the value already in
`background_task_state` rather than the winner's in-memory cache, so a
freshly-restarted process winning the claim does not spuriously emit
"newly capped" entries for workspaces that were already capped before it
started.
Audit writes are best-effort: failures are logged via tracing and do not
abort the refresh cycle.
Fixes WIN-1984
* feat(queue): scope fairness audit to admins workspace + queue-metrics pane
- Write `workspace_fairness.capped` / `workspace_fairness.uncapped` to the
`admins` workspace (was: per-affected-workspace) with the affected
workspace_id moved to the `resource` field. Cluster admins now get the
full timeline in one place without `all_workspaces=true`.
- Add `GET /workers/workspace_fairness_events` returning the last 100
events. Cloud-gated (returns `[]` on non-cloud) and devops-only.
- Add a `WorkspaceFairnessEvents` Section to the Queue Metrics drawer,
rendered only when `isCloudHosted()` is true. Shows time / event
badge / workspace / parameters with a refresh button.
Fixes WIN-1984
A token scoped to a single resource (e.g. `resources:read:u/alice/foo`)
could call `GET /api/w/{w}/resources/list_search` and receive `path` and
`value` for unrelated resources in the workspace. Route-level scope
checks only validate `domain:action`; per-resource handlers do a
`check_scopes` against the path, but the listing endpoints did not —
leaking integration credentials, API keys, and other secrets stored as
resource values to narrowly-scoped tokens.
Add `build_scope_path_predicate` to `windmill-api-auth` (mirrors
`check_scopes` semantics but parses the token's scopes once, suitable
for filtering many rows). Apply it to `list_search_resources`,
`list_resources`, `list_names` (resources) and `list_variables`
(non-secret value leak), so a scope-restricted token only ever sees the
paths it is authorized to read. Unscoped tokens and tokens whose only
scopes are `if_jobs:filter_tags:*` are unaffected.
Includes regression tests covering: unscoped, tag-filter-only,
single-resource, wildcard, wrong-domain, and write-implies-read.
Fixes WIN-1981
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
tristantrandClaude Opus 4.8
GuilhemandClaude Opus 4.7
Ruben Fiszel
hugocasa
centdix
