* feat: count homepage ai session hero removals and re-pins
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to 0253ffdd6c0b0f1ba162a43d19aed56bc7bd7a71
This commit updates the EE repository reference after PR #882 was merged in windmill-ee-private.
Previous ee-repo-ref: a5d4fd2b21ffd0a6ced604c34d39a5747d9ea940
New ee-repo-ref: 0253ffdd6c0b0f1ba162a43d19aed56bc7bd7a71
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* fix: relock apps in place so imported script changes reach them
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: requeue an app relock whose version was rewritten meanwhile
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: relock every component of the version a superseded app relock requeues
Also share raw-app runnable dependency extraction between the worker and the dependency-map rebuild, and take no-key-update row locks, which still order against a deploy's UPDATE without blocking app_script inserts.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: relock every component when an app relock runs on a newer version
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: resolve a requeued app relock's components when it runs
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: regenerate every lock when an app relock relocks every component
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* test: expect app scoping to refuse a foreign app_script id in app_preview_auth
#11777 scopes run-mode app_script ids to their app, so another app's id is
now refused with 401 before the content-hash pin check is reached.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: run end_user_email inline scripts through the deployed app_script id
#11777 runs inline code only through the app_script rows the deployed lite
value references once it exists, so id-less raw_code is refused. Shape the
fixtures like real apps (nested inlineScript) and run by the deployed id.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: wait for both dedicated worker jobs on one listener
The second completed-job listener was opened only after the first job
completed, so a second job that finished first was never seen and the test
hung until the 90s worker timeout.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* perf: drive schedule already-exists check from v2_job_queue
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* perf: index v2_job_queue by workspace and scheduled_for
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: send Azure Foundry gpt-5.5+ models to the Responses API
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: name Azure AI Foundry in the reasoning summary notice
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: iterate workspace picker nav items without spreading a NodeList
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: let raw app backend runnables import each other
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: preview only imported sibling runnables and reserve the main id
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: resolve a module's workspace imports from the entrypoint's folder
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: scope run-mode app scripts to their app and key bundles on module imports
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: clone app_version_lite into forks with remapped app_script ids
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: update the run-mode raw_code comment for app-scoped ids
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: run module-bearing app scripts only from the deployed version
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: run deployed inline code only through the deployed version's rows
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: in-workspace app viewers run through the deployed rows
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: let the app embed token read the app's lite value
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: pass sibling modules to the agent-worker Python preview resolver
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: list the lite route in the app embed scope comment
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 455f98540fb042d4f624dcec681dab88b2c8df22
This commit updates the EE repository reference after PR #883 was merged in windmill-ee-private.
Previous ee-repo-ref: 927d3592a6b2127ffe16fb14eb47f5bd66afc026
New ee-repo-ref: 455f98540fb042d4f624dcec681dab88b2c8df22
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: run script and flow previews on behalf of another user
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: refuse operators and detect servers that drop preview on_behalf_of
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: editor previews run as the configured on_behalf_of identity
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: probe before submitting, keep step and viewer data identity in previews
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: never let a job token request viewer data access on a preview
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: open impersonated preview logs with who they run as and who asked
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: allow early return on steps inside a branch to one
The "Early return for sync webhooks" flow setting could only point at a
top-level step. It can now also point at a step inside a branch to one,
in any branch including the default one, and through nested branches to
one.
When the branch is taken, the sync call returns that step's result as
soon as it completes while the rest of the flow keeps running. When it
is not taken, the call returns the flow's final result. The sync wait
loops already resolved nested steps and fell back to the final result,
so they are unchanged.
Worker: check_if_early_return_or_last_in_early_return_parent now
accepts a job whose step id matches early_return at any depth, as long
as every job between it and the root is a branch to one. A loop
iteration or a subflow reusing the same id does not take the stream.
The existing case, the last step of a branch to one that is itself the
early-return step, is unchanged.
Frontend: the native <select> is replaced by EarlyReturnPicker, a
searchable list in flow order where each nested step shows its path
(e.g. `a › Branch 1`). Branch to all and loops inside a branch to one,
and the steps inside them, are not offered: the results lookup cannot
resolve them when nested. Picking a nested step shows a hint that it
only runs if its branch is taken.
* fix: stream the last step when the early return branch is not taken
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep the stream off the last step once the early return step ran
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: list early return steps by id only
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: use the standard select for the early return step
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: match the early return step by its flow scope, not its path
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep branch to all and loop steps off the early return stream
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: allow early return on steps inside a branch to all
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: resolve a nested branch to all or loop as the early return step
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: pin which step streams for an early return inside branches
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: return an empty nested loop or branch to all as its early return list
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* revert: read an empty container's early return status from the root
An empty nested loop or branch to all falls back to the flow's final result again,
so an empty top-level loop that failed keeps its real status.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: stefan <stefan.radovanovic@ip-paris.fr>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: add a navigation picker after the breadcrumb's last segment
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: open the navigation picker among the current page's siblings
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* style: size the navigation chevron like the workspace chevron
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* style: keep one-line picker lists at one-line row height
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: show the navigation chevron only once the item's path is known
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: highlight a draft in the navigation picker by its storage path
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: key the picker's current item on the header path outside editors
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: count navigation picker picks in feature_usage
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: shrink the page header in stages and let the bar fold page actions
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: fold the runs header through the bar and wrap its filter to a second row
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: truncate the run id and fold run actions into one menu on a narrow bar
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: keep an item's summary and drop its path on a narrow page header
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: show the full summary and path read-only when they cannot be edited
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: keep secondary detail actions in menus and the star beside the summary
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: show secondary detail actions as buttons while the bar has room for them
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to 346bd5417537b76591465e63b9d15bd081e9228c
This commit updates the EE repository reference after PR #868 was merged in windmill-ee-private.
Previous ee-repo-ref: 581b18cac39a4bee2671fd1aa86f91b9e702e8f5
New ee-repo-ref: 346bd5417537b76591465e63b9d15bd081e9228c
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* feat: operators get AI sessions
`prefersSessionHandoff` stops taking the role, so every AI entry point an operator
can reach — Ask AI, the home composer, Open in session, the flow editor's hand-off,
the raw-app template picker — opens a session for them like anyone else. The
sessions page drops its refusal, and the layout stops keeping them on the docked
chat.
In the sidebar they now get the Workspace/AI Sessions switch and session mode, and
lose the Ask AI entry that stood in for them, since the pane behind it is no longer
the one they are sent to.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat: operators get run-oriented examples in the home composer
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* docs: note builder_flows in the operator composer examples comment
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: gate session tools and editors on operator rights
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: keep operator AI sessions behind a browser opt-in
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep flows refused in the prompt for operators without builder rights
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* refactor: decide every frontend edit check through one editRights module
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: let admins who are also operators open session editors, as drafts.rs does
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: let operators with manage rights save schedule and trigger drafts
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep rebase_draft from operators who can only draft schedules and triggers
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: list operators' schedule and trigger drafts under their draft rights
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* docs: say which drafts write_draft gates now that schedules and triggers have their own
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* oauth: add onedrive, sharepoint and microsoft_excel providers
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* oauth: rename microsoft_excel provider to excel, add msword icon
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* oauth: rename providers to msonedrive, mssharepoint, msexcel
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* oauth: use underscore slugs ms_onedrive, ms_sharepoint, ms_excel, ms_word
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: read and change workspace settings from ai sessions and mcp
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: cover wmill workspace settings commands in the settings guidance
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: say unknown settings keys are warned and ee-only ones refused
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: cover datatable_permissions and protection_rules in the settings guidance
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: add the workspace settings document, applied server-side
* feat: add wmill workspace get-settings and apply-settings
* fix: warn on unknown settings keys and refuse ee-only ones in the dry run
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: stub the settings document endpoint in the push settings unit tests
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: refuse mistyped settings and keep 4xx status on a partial settings apply
Reject non-boolean switches and non-string Slack credentials instead of
coercing them into destructive writes, preserve the failing endpoint's
status when wrapping a partial-apply error, keep the stored Slack secret
when an older CLI pushes one encrypted under another workspace's key,
print the plan's warnings in apply-settings, and state the admin check
load_settings_document leaves to its caller.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: compare handler arguments verbatim and type-check scalar settings
A handler's extra_args is stored as sent and its nulls reach the job as
arguments, so an added or removed null argument is now a change. Scalar
settings are type-checked in the plan so a dry run never reports a change
the endpoint then refuses, and an error handler's omitted mute flags
compare as the false the endpoint stores.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: require a 32-bit integer rate limit in the settings plan
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: data table permissions and protection rules in the settings document
The settings document gains datatable_permissions, each data table's roles
named by their Postgres role name and written by catalog id, and
protection_rules, keyed by rule name. Both are managed only when stated and
stated as a whole. The dev workspace lock stays with the dev workspace
setting.
wmill sync carries datatable_permissions only with includeDatatablePermissions
(or --include-datatable-permissions), since tenants and roles are specific to
a workspace and an instance. protection_rules stay out of settings.yaml:
protection-rules.yaml syncs them.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: validate the default data table role and plan permissions against a replaced datatable
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: let a legacy migration whose comment reads like a scope get a down
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: pin adding a down to a migration whose comment predates scopes
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: scope data table migrations to the schemas they declare
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep unschemed objects and unqualified sql out of per-schema scopes
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: order snapshot prerequisites and widen scopes to what they reference
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: point ee-repo-ref at the migration_scope allowlist entry
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: infer scopes only from generated ddl and snapshot every user object
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: snapshot every schema from one exported snapshot, infer only unedited sql
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: keep the initial snapshot whole-database and scopes author-declared
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: warn before an out-of-order run when applied status is unknown
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 57f4b973e2369f54a89817ff23dc44047ba7b9e4
This commit updates the EE repository reference after PR #880 was merged in windmill-ee-private.
Previous ee-repo-ref: abb876d6234d5dfe7c644fdf12cf55f7bc1db1cc
New ee-repo-ref: 57f4b973e2369f54a89817ff23dc44047ba7b9e4
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* fix: give data tables forked from one database a single shared copy
* fix: key shared-copy cleanup by server as well as database name
* fix: refuse dropping a shared resource-backed copy another clone still uses
* fix: keep applied migrations and db settings in data table copies
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: scope copied db settings per transaction and send timestamps as iso
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: copy migrations and settings only into a fresh import target
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* ci: install the latest pg_dump for backend integration tests
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* ci: enable pgdg so the latest pg_dump is installed
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: let a linked agent step override the model and reasoning effort
* fix: only honor model and effort overrides the step authored
* fix: treat an authored empty effort override as no effort
* fix: keep a static empty override from reading caller arguments or the saved effort
* fix: keep step tests and multi-agent chats from inventing an effort override
* fix: keep the saved model fallback when linked steps differ only on effort
* fix: show the agent override hint on the input's own help row
* fix: align the override hint spacing between static and expression inputs
* fix: keep the override rows a dropdown whatever the model is set to
* fix: give the override hint the 4px form gap and drop its trailing period
* fix: space the override hint with a margin so it is not clipped
* test: pin the saved model fallback when linked steps differ only on effort
* fix: keep the saved model fallback across agents that saved different efforts
* fix(worker): keep script env vars off the nsjail launcher process
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(worker): keep script env off the ruby gem-install nsjail launcher
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(worker): keep script env off the unjailed javac compile step
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(worker): gate script_overrides on the executors that use it
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: show a raw app's document.title in the page tab
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: drop unrelated formatting changes
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: restore the page title only while the tab shows the app's
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: connect a data table as the job's own identity unless the runnable opts into its viewer
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: key cached results by the data table mode and keep the flag across ai edits
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: hash the cache key's mode and viewer as fixed fields so no argument name can forge them
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 2f74548ad1ec50c8e1faf17e42d5648160e833f1
This commit updates the EE repository reference after PR #878 was merged in windmill-ee-private.
Previous ee-repo-ref: 4ad768a777fff9f1ecc86a2803bc27d80f8242d6
New ee-repo-ref: 2f74548ad1ec50c8e1faf17e42d5648160e833f1
Automated by sync-ee-ref workflow.
* feat: rename the flag to viewer_data_access and apply it to object storage permission rules
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: describe viewer_data_access as covering object storage rules too
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 0ffb633473c5465513576afc6f54d18f93c7f1e1
This commit updates the EE repository reference after PR #879 was merged in windmill-ee-private.
Previous ee-repo-ref: e9e06a9eb94168f46b378276b01fa0117dc7d8ed
New ee-repo-ref: 0ffb633473c5465513576afc6f54d18f93c7f1e1
Automated by sync-ee-ref workflow.
* feat: show the viewer data access control as an icon button
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* fix: encrypt ai session backups with aes-256-gcm
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* test: cover ai session backups written with aes-256-gcm
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: name the release ai session readers ship in
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: hold ai session gcm writes until old servers are rolled out
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* oauth: rename outlook provider to msoutlook
Microsoft 365 products are ms<product> (msteams, msoutlook). Renames the
oauth_connect.json key and the icon map key.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* oauth: use ms_outlook, not msoutlook
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: show the email handler's SMTP status to non-superadmin workspace admins
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep the SMTP status check out of the not-configured warning
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: widen variable.value only once every process can recover from it
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: wait out the previous release's servers before widening variable.value
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: write a v2 secret too long for the narrow column in cbc until it is widened
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: serve s3 proxy objects with nosniff and a sandbox csp
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* test: assert s3 proxy error responses carry nosniff and the sandbox csp
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to 196abc042c691ea16280ee10b89fb3b2fd527236
This commit updates the EE repository reference after PR #876 was merged in windmill-ee-private.
Previous ee-repo-ref: 25feaf41aa84d47f8e4adb4def2576b443a66374
New ee-repo-ref: 196abc042c691ea16280ee10b89fb3b2fd527236
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: pin the default python version of an instance at initialization
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: detect a new instance from the schema it created, not from its age
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: record the python baseline on the migration connection
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: record the instance python version in the setting itself
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: start new instances on python 3.15
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep the forced python version ahead of the stored one when a worker reads it late
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: start new instances on python 3.14 rather than 3.15
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: start new instances on python 3.13
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 06610ecc950ed64a2709d7f1aa8c7b49a95fdbae
This commit updates the EE repository reference after PR #869 was merged in windmill-ee-private.
Previous ee-repo-ref: 599eae0034b34c5e0d3d42df37cf18bbe01f9b49
New ee-repo-ref: 06610ecc950ed64a2709d7f1aa8c7b49a95fdbae
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* chore: pass --system-certs to uv instead of the deprecated --native-tls
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 06610ecc950ed64a2709d7f1aa8c7b49a95fdbae
This commit updates the EE repository reference after PR #869 was merged in windmill-ee-private.
Previous ee-repo-ref: 599eae0034b34c5e0d3d42df37cf18bbe01f9b49
New ee-repo-ref: 06610ecc950ed64a2709d7f1aa8c7b49a95fdbae
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* chore: update ee ref
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 118785eaa78675089b9a676d24e5d0a2e03f3d9a
This commit updates the EE repository reference after PR #875 was merged in windmill-ee-private.
Previous ee-repo-ref: e8df378c5f8e5e07af8a2bad4c685c8ad6fe1491
New ee-repo-ref: 118785eaa78675089b9a676d24e5d0a2e03f3d9a
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* fix(cli): count superadmins as able to preserve ownership on push
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011BzU9zd53JsTShCsbKzYzB
* fix: resolve variables in the url and headers of an mcp resource
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep resolved mcp secrets out of header warnings and userinfo urls
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: drop the url from mcp client errors before rmcp logs them
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: run rmcp's reqwest client without a log subscriber
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: scrub the request target from mcp error bodies
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: drop server error bodies from mcp transport errors
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: fail closed when an mcp error message has no status prefix
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* oauth: add outlook (Microsoft Graph) provider
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* oauth: outlook defaults cover mail, calendar and contacts
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* fix: bump git sync hub scripts to cli 1.830.0
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011BzU9zd53JsTShCsbKzYzB
* fix: surface oauth provider errors returned with http 200
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee repo ref
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: show the unavailable sign-in option in the oauth resource form
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: name the oauth grant in both authentication card descriptions
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 0a7c28718872bb5cd624d77e32ad7d75c6ce42de
This commit updates the EE repository reference after PR #874 was merged in windmill-ee-private.
Previous ee-repo-ref: 11425053010c3cd4670bc06f3606fa18cccc2091
New ee-repo-ref: 0a7c28718872bb5cd624d77e32ad7d75c6ce42de
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* oauth: add hubspot provider
Registry entry (authorize + token URL, body credentials, least-privilege
default scopes, labelled scope_options) and the admin OAuth tile.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* oauth: send hubspot non-default scopes as optional_scope
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: recheck app read access on every publisher-mode component run
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: pin that app read grants and revocations apply to the next run
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: cache only app permit grants, for 60s, instead of rechecking every run
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: data table migration tools and role guidance in ai sessions
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: shared data table guidance and safer migration tool failures
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep a migration that fails to apply and let the session rewrite it
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: rewrite only a pending migration and qualify fork isolation
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* chore: bump frontend python parser wasm packages to 1.830.0
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: bump cli python parser wasm packages to 1.830.0
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: connect to a data table with every role of the job's viewer
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: key a cached result by the run's recorded viewer
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: pin the per-viewer cache key and fix a stale doc sentence
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: length-prefix the viewer in the result cache key
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: drop data table role set logins unused for 30 days
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: pin the ee ref with the set login sweep fixes
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: pin the ee ref with the sweep retry fix
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: give the cache key test its own migrated database
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: add the viewer's roles to a data table connection that names none
The default role of a data table under roles is now a floor: a connection
naming no role also holds the roles its viewer is a tenant of, unless the
default is admin. This replaces the explicit as=viewer option, which is
removed from the reference parser, the executors and both clients. The roles
drawer warns while the default is admin and confirms before removing the
default role.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: let a data table have no default role
A connection naming no role then holds its viewer's roles only and is
refused without any. The roles drawer offers the choice, states what an
unnamed connection gets for the current settings, says who gets admin while
it is the default, and notes who owns a table created over several roles.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: start a data table's roles with admin open to everyone
Turning roles on from the drawer seeded admin with no tenant, which refused
every non-admin member's job as soon as it was saved. It now starts open to
everyone, so the toggle changes nothing until the roles are edited, and the
drawer warns for as long as everyone can connect as admin.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 40ab35596e6fcb82a4dfc56e186befb807f8e2af
This commit updates the EE repository reference after PR #873 was merged in windmill-ee-private.
Previous ee-repo-ref: a5def184a29fffab8ed42c70c5a7445b2b3cbe98
New ee-repo-ref: 40ab35596e6fcb82a4dfc56e186befb807f8e2af
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
hugocasaandClaude Opus 5.5
Alexander PetricandClaude Opus 5.5