mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-10-30 00:16:53 +00:00
3ce2f653c99b4e268dca3c2d962c128ed988643b
1256
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
  Ruben FiszelandClaude Opus 5.5
|
aca7fed33d |
fix: relock apps in place so imported script changes reach them (#11789)
* fix: relock apps in place so imported script changes reach them Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: requeue an app relock whose version was rewritten meanwhile Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: relock every component of the version a superseded app relock requeues Also share raw-app runnable dependency extraction between the worker and the dependency-map rebuild, and take no-key-update row locks, which still order against a deploy's UPDATE without blocking app_script inserts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: relock every component when an app relock runs on a newer version Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: resolve a requeued app relock's components when it runs Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: regenerate every lock when an app relock relocks every component Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
526da60da9 |
feat: let raw app backend runnables import each other (#11777)
* fix: iterate workspace picker nav items without spreading a NodeList Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: let raw app backend runnables import each other Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: preview only imported sibling runnables and reserve the main id Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: resolve a module's workspace imports from the entrypoint's folder Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: scope run-mode app scripts to their app and key bundles on module imports Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: clone app_version_lite into forks with remapped app_script ids Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: update the run-mode raw_code comment for app-scoped ids Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: run module-bearing app scripts only from the deployed version Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: run deployed inline code only through the deployed version's rows Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: in-workspace app viewers run through the deployed rows Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: let the app embed token read the app's lite value Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: pass sibling modules to the agent-worker Python preview resolver Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: list the lite route in the app embed scope comment Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: update ee-repo-ref to 455f98540fb042d4f624dcec681dab88b2c8df22 This commit updates the EE repository reference after PR #883 was merged in windmill-ee-private. Previous ee-repo-ref: 927d3592a6b2127ffe16fb14eb47f5bd66afc026 New ee-repo-ref: 455f98540fb042d4f624dcec681dab88b2c8df22 Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |
||
 GuilhemandClaude Opus 5
|
74c5f82c67 |
feat: let operators with manage rights save schedule and trigger drafts (#11646)
* feat: operators get AI sessions `prefersSessionHandoff` stops taking the role, so every AI entry point an operator can reach — Ask AI, the home composer, Open in session, the flow editor's hand-off, the raw-app template picker — opens a session for them like anyone else. The sessions page drops its refusal, and the layout stops keeping them on the docked chat. In the sidebar they now get the Workspace/AI Sessions switch and session mode, and lose the Ask AI entry that stood in for them, since the pane behind it is no longer the one they are sent to. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat: operators get run-oriented examples in the home composer Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * docs: note builder_flows in the operator composer examples comment Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * feat: gate session tools and editors on operator rights Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * feat: keep operator AI sessions behind a browser opt-in Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: keep flows refused in the prompt for operators without builder rights Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * refactor: decide every frontend edit check through one editRights module Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: let admins who are also operators open session editors, as drafts.rs does Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * feat: let operators with manage rights save schedule and trigger drafts Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: keep rebase_draft from operators who can only draft schedules and triggers Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: list operators' schedule and trigger drafts under their draft rights Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * docs: say which drafts write_draft gates now that schedules and triggers have their own Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> |
||
|
Ruben FiszelandClaude Opus 5.5
|
9a5ec223bc |
feat: workspace settings as one document, applied server-side (#11740)
* feat: add the workspace settings document, applied server-side * feat: add wmill workspace get-settings and apply-settings * fix: warn on unknown settings keys and refuse ee-only ones in the dry run Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: stub the settings document endpoint in the push settings unit tests Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: refuse mistyped settings and keep 4xx status on a partial settings apply Reject non-boolean switches and non-string Slack credentials instead of coercing them into destructive writes, preserve the failing endpoint's status when wrapping a partial-apply error, keep the stored Slack secret when an older CLI pushes one encrypted under another workspace's key, print the plan's warnings in apply-settings, and state the admin check load_settings_document leaves to its caller. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: compare handler arguments verbatim and type-check scalar settings A handler's extra_args is stored as sent and its nulls reach the job as arguments, so an added or removed null argument is now a change. Scalar settings are type-checked in the plan so a dry run never reports a change the endpoint then refuses, and an error handler's omitted mute flags compare as the false the endpoint stores. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: require a 32-bit integer rate limit in the settings plan Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: data table permissions and protection rules in the settings document The settings document gains datatable_permissions, each data table's roles named by their Postgres role name and written by catalog id, and protection_rules, keyed by rule name. Both are managed only when stated and stated as a whole. The dev workspace lock stays with the dev workspace setting. wmill sync carries datatable_permissions only with includeDatatablePermissions (or --include-datatable-permissions), since tenants and roles are specific to a workspace and an instance. protection_rules stay out of settings.yaml: protection-rules.yaml syncs them. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: validate the default data table role and plan permissions against a replaced datatable Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
Ruben Fiszel
|
49147827d6 |
fix: fork data tables sharing one database into a single copy (#11755)
* fix: give data tables forked from one database a single shared copy * fix: key shared-copy cleanup by server as well as database name * fix: refuse dropping a shared resource-backed copy another clone still uses |
||
|
|
b7b3306195 |
feat: read data as the job's identity, viewer is opt-in per runnable (#11744)
* feat: connect a data table as the job's own identity unless the runnable opts into its viewer Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: key cached results by the data table mode and keep the flag across ai edits Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: hash the cache key's mode and viewer as fixed fields so no argument name can forge them Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: update ee-repo-ref to 2f74548ad1ec50c8e1faf17e42d5648160e833f1 This commit updates the EE repository reference after PR #878 was merged in windmill-ee-private. Previous ee-repo-ref: 4ad768a777fff9f1ecc86a2803bc27d80f8242d6 New ee-repo-ref: 2f74548ad1ec50c8e1faf17e42d5648160e833f1 Automated by sync-ee-ref workflow. * feat: rename the flag to viewer_data_access and apply it to object storage permission rules Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: describe viewer_data_access as covering object storage rules too Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: update ee-repo-ref to 0ffb633473c5465513576afc6f54d18f93c7f1e1 This commit updates the EE repository reference after PR #879 was merged in windmill-ee-private. Previous ee-repo-ref: e9e06a9eb94168f46b378276b01fa0117dc7d8ed New ee-repo-ref: 0ffb633473c5465513576afc6f54d18f93c7f1e1 Automated by sync-ee-ref workflow. * feat: show the viewer data access control as an icon button Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |
||
 Alexander PetricandClaude Opus 5.5
|
c7ee201655 |
fix: encrypt ai session backups with aes-256-gcm (#11734)
* fix: encrypt ai session backups with aes-256-gcm Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * test: cover ai session backups written with aes-256-gcm Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: name the release ai session readers ship in Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: hold ai session gcm writes until old servers are rolled out Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> |
||
|
Ruben FiszelandClaude Opus 5.5
|
130adfdd20 |
fix: show the email handler's SMTP status to non-superadmin admins (#11745)
* fix: show the email handler's SMTP status to non-superadmin workspace admins Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep the SMTP status check out of the not-configured warning Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
Ruben FiszelandClaude Opus 5.5
|
89e6bdbcf5 |
fix: widen variable.value without breaking live servers' cached queries (#11737)
* fix: widen variable.value only once every process can recover from it Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: wait out the previous release's servers before widening variable.value Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: write a v2 secret too long for the narrow column in cbc until it is widened Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
|
7558ce27a9 |
feat: record each instance's python version and start new ones on 3.13 (#11656)
* feat: pin the default python version of an instance at initialization Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: detect a new instance from the schema it created, not from its age Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: record the python baseline on the migration connection Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor: record the instance python version in the setting itself Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: start new instances on python 3.15 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep the forced python version ahead of the stored one when a worker reads it late Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: start new instances on python 3.14 rather than 3.15 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: start new instances on python 3.13 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: update ee-repo-ref to 06610ecc950ed64a2709d7f1aa8c7b49a95fdbae This commit updates the EE repository reference after PR #869 was merged in windmill-ee-private. Previous ee-repo-ref: 599eae0034b34c5e0d3d42df37cf18bbe01f9b49 New ee-repo-ref: 06610ecc950ed64a2709d7f1aa8c7b49a95fdbae Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |
||
|
|
a298ed3fc1 |
feat: add the viewer's roles to unnamed data table connections (#11709)
* feat: connect to a data table with every role of the job's viewer Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: key a cached result by the run's recorded viewer Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: pin the per-viewer cache key and fix a stale doc sentence Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: length-prefix the viewer in the result cache key Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: drop data table role set logins unused for 30 days Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: pin the ee ref with the set login sweep fixes Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: pin the ee ref with the sweep retry fix Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: give the cache key test its own migrated database Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: add the viewer's roles to a data table connection that names none The default role of a data table under roles is now a floor: a connection naming no role also holds the roles its viewer is a tenant of, unless the default is admin. This replaces the explicit as=viewer option, which is removed from the reference parser, the executors and both clients. The roles drawer warns while the default is admin and confirms before removing the default role. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: let a data table have no default role A connection naming no role then holds its viewer's roles only and is refused without any. The roles drawer offers the choice, states what an unnamed connection gets for the current settings, says who gets admin while it is the default, and notes who owns a table created over several roles. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: start a data table's roles with admin open to everyone Turning roles on from the drawer seeded admin with no tenant, which refused every non-admin member's job as soon as it was saved. It now starts open to everyone, so the toggle changes nothing until the roles are edited, and the drawer warns for as long as everyone can connect as admin. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: update ee-repo-ref to 40ab35596e6fcb82a4dfc56e186befb807f8e2af This commit updates the EE repository reference after PR #873 was merged in windmill-ee-private. Previous ee-repo-ref: a5def184a29fffab8ed42c70c5a7445b2b3cbe98 New ee-repo-ref: 40ab35596e6fcb82a4dfc56e186befb807f8e2af Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |
||
 hugocasaandClaude Opus 5.5
|
7bbe03227d |
fix: bump git sync hub scripts to cli 1.830.0 (#11681)
Claude-Session: https://claude.ai/code/session_011BzU9zd53JsTShCsbKzYzB Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> |
||
|
|
4942149b05 |
feat: encrypt workspace secrets with AES-256-GCM (#11678)
* feat: encrypt workspace secrets with AES-256-GCM Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * docs: note the aead gate covers workers only and is one-way Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: skip secrets the upgrade cannot store and clear its guard on panic Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: start aead secret writes one release after read support Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore: update ee-repo-ref to 06610ecc950ed64a2709d7f1aa8c7b49a95fdbae This commit updates the EE repository reference after PR #869 was merged in windmill-ee-private. Previous ee-repo-ref: 599eae0034b34c5e0d3d42df37cf18bbe01f9b49 New ee-repo-ref: 06610ecc950ed64a2709d7f1aa8c7b49a95fdbae Automated by sync-ee-ref workflow. * feat: widen variable.value to fit AES-GCM ciphertext of the longest legacy secret Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: refuse legacy secrets longer than 15000 chars so every secret can be upgraded Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: cap legacy secrets at 15000 chars with a check constraint so every writer is covered Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |
||
|
|
157183ae9c |
feat: external signer for OIDC tokens and a log line per mint (#11614)
* feat: sign OIDC tokens with an external signer and log every mint * fix: init the signer in sqs_trigger builds and show signer reachability from results * fix: key the OIDC key rows by source and kid * chore: bump ee ref and list the oidc-signer subcommand only where it exists * fix: advertise the actual signing algorithm in OIDC discovery Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: harden the external signer startup, agent workers and failed mints Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: bump ee ref for the stored key listing fix Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: list the oidc signing settings page only with an external signer Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: update ee-repo-ref to 1e538620a9b2f08b044997d032e71d8720ecbd5c This commit updates the EE repository reference after PR #859 was merged in windmill-ee-private. Previous ee-repo-ref: 84fa325737df98407c7b9f79c09d6e9378c46147 New ee-repo-ref: 1e538620a9b2f08b044997d032e71d8720ecbd5c Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |
||
|
|
afbbc0b1b2 |
feat: audit declarative instance config writes (#11684)
* feat: audit declarative instance config writes Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep early logs, base url and license plan for declarative writers Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor: require an observer on every config apply, drop license loading Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: export only audit events from the declarative subcommands Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: update ee-repo-ref to d6a6cdd343e7744ea49c610f9534c8013c8ffc2a This commit updates the EE repository reference after PR #872 was merged in windmill-ee-private. Previous ee-repo-ref: fc51c31bafb5975694fffe1da51f7b41fbf127a6 New ee-repo-ref: d6a6cdd343e7744ea49c610f9534c8013c8ffc2a Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |
||
|
Ruben FiszelandClaude Opus 5.5
|
74c9b0cb2e |
feat: add python 3.14 and 3.15 to the supported instance versions (#11654)
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
02e4697157 |
feat: let operators compose full-code apps when the workspace grants it (#11229)
* feat: let operators compose full-code apps when the workspace grants it Adds operator_settings.builder_apps, the second builder right, granted independently of flows because the two are not equally verifiable: a composed flow is checked in full server-side, while a full-code app is a browser-built bundle no check can read. The app right rests instead on forced sandbox isolation, a refusal of Viewer execution mode, and a deploy-time check of every runnable the app can reach. BuilderKind arrives with the second kind and is a mandatory argument, so no gate can mean "either" by accident: one that did would authorize an app write on a flows-only workspace. The only surfaces reading .any() are the ones that are genuinely not per-kind, the seat a membership costs and listing drafts. validate_operator_composed_app checks two surfaces rather than one, because they are not the same list: the policy's triggerables and the runnableByPath entries in the app value, which is what the deployed bundle actually resolves against. Every colon in a triggerable key is a possible split, since execute_component looks up "<component>:<path>" with an unrestricted component string. create_app_raw_source stays closed: it compiles caller-supplied sources with a bundler job on a worker, which is arbitrary code execution. Builders lose nothing, since the browser and the CLI both bundle locally and deploy through the multipart endpoints. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Dsf6VC4MVLisiEoeQkgbr4 * fix: list a builder's app drafts and refuse inline code in them Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: update ee-repo-ref to 6d15ff957df4dcd5129e1ab217eab1a13af62fbb Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: check a builder app as it will be stored Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: show the home list edit button to builder operators Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: pause the raw app preview for an app an operator deployed Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: let app builders save a full-code app's deploy settings Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: record the builder app settings path, public apps and the editor preview Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: cache the merged EE seat usage query The EE query now reads audit_partitioned and skips service accounts, so the cached entry for its builder_apps predicate no longer matched and offline EE builds failed with no cached data. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: pause the raw app preview for loaded drafts and unknown authors A draft loaded from an operator ran in the viewer's preview because the pause only checked the app's last deployer, and an author no longer in the workspace read as a developer. The pause now checks a loaded draft's owner, records it in the viewer's draft until the preview is run or deployed, and holds when the author cannot be found. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: name guest apps among the modes a builder may deploy Guest runs as the publisher with no Viewer fallback, like Publisher and Anonymous, and RestrictGuestAppDeployment refuses it per workspace. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep a loaded draft's preview paused in AI sessions and chat edits The session draft codec and the chat's draft save dropped loaded_from, so opening a paused operator draft in an AI session, or editing it through the chat, ran it with the viewer's session. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: pin builder refusals for low-code apps and unreviewed previews Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep the operator mark when loading a developer's copy of a draft Loading another user's draft recorded only who saved it, so a developer's copy of an operator draft they never previewed opened unpaused for the next person who loaded it, running the operator's code with their session. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: let builders restore a full-code app from deployment history Restore always sends allow_kind_change, which the builder check refused even for a full-code version restored over a full-code app. Builders now drop the flag, so the locked kind check still refuses an actual conversion. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * style: rustfmt the builder checks in jobs.rs Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: record the builder kind-check race as an accepted risk Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: never trust the owner name a loaded draft carries A loaded draft's loaded_from is written by its owner, so an operator could name a developer, or leave it empty, and the next person to load the draft previewed it unpaused. A loaded draft that carries any mark now stays paused as unattributable; an unmarked one is still checked against its real owner. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: record viewer-supplied resources in builder apps as an accepted risk Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: say that the app right lets operators write frontend code The settings section and the docs told admins builder operators "still cannot write code", but the app right has them write the app's frontend bundle. Only backend code stays out of reach. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: state the raw-source closure once and drop an unreachable preview case Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * perf: look up only the author when deciding whether to pause the preview Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: pin that the app right alone bills operators as developers Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: point ee-repo-ref at the EE seat test Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor: drop the editor preview pause now that sandboxed apps preview isolated Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: refuse a builder operator's app draft without the sandbox Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: turn the sandbox on when a builder operator opens the app editor Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: refuse builder app drafts naming runnables they cannot read Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: note the editor preview asks before minting a builder app token Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor: trim the builder app check comments to the constraints Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: refuse an app runnable whose runType is not script, flow or hub Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: check builder app draft policy keys like a deploy does Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: count main's half-seat service accounts in the builder billing test Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor: name the builder policy check for drafts as well as deploys Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: let a builder app draft autosave with a stale triggerables_v2 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: check the script version a builder app would run, not any version Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: refuse viewer mode in a builder app draft as on deploy Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor: hold builder app drafts and deploys to one check Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: say a builder's script may not have finished deploying Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: cap builder app triggerable keys before reading every colon split Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: refuse a builder app draft that runs as someone else Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: conform builder app drafts saved by the AI chat as the editor does Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: record that a deployed builder draft runs as its deployer Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: refuse builder app runnables not written as plain text Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: a builder draft may carry its builder's own run identity Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: offer builders Start with AI only when it opens a session Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: name full-code apps in the builder rights confirmation Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: name only the granted builder rights in the confirmation Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: note a wm_deployers builder may keep another run identity Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: give builders a starter app that calls no missing runnables Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: seed the builder starter under the picker for builders Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: qualify the builder run identity comment for wm_deployers Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: resolve builder app script hashes before opening the RLS transaction Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: run the builder app tests serially to share the rights cache safely Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: give builders the builder starter on a fresh editor load Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: drop a new-app load overtaken while waiting for the workspace list Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep main's 401 for operators previewing without the app right Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: update ee-repo-ref to 5d7726c4979070ee8db4fb9e8014152872a641ba This commit updates the EE repository reference after PR #816 was merged in windmill-ee-private. Previous ee-repo-ref: 7151060bfc02908e97d9344b3820ee33a4951322 New ee-repo-ref: 5d7726c4979070ee8db4fb9e8014152872a641ba Automated by sync-ee-ref workflow. * refactor: let the app row's edit button trust its write flag Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: point ee-repo-ref at the merged EE companion Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: note the session raw-app editor does not conform builder drafts yet Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |
||
|
Ruben FiszelandClaude Opus 5.5
|
863f216eee |
gate cgroup cpu stat parsers to non-windows builds (#11652)
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
hugocasaandClaude Opus 5.5
|
2b55a8afbc |
feat: replace the hub_sync script with an opt-in daily server sync (#11624)
* feat: sync hub resource types daily from the server Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: retire the legacy hub_sync script and its schedule Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: sync only from the hub on the daily schedule Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: sync resource types through the endpoint in e2e setup Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: honor ACCEPT_INVALID_CERTS in the hub resource type sync Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: audit manual hub resource type syncs that change types Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor: show the AI step's resource type sync as a setting card Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep the hub_sync opt-out and move sync state to task state Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: hold the daily hub sync until the legacy hub_sync is retired Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: turn off the daily sync when an edited hub_sync is scheduled Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor: make the daily hub resource type sync opt-in Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: bring back the setup wizard's daily resource type sync toggle Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: apply the image's resource types on every SYNC_CACHED_RT start Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
hugocasaandClaude Opus 5.5
|
2bdeceba7f |
fix: set WM_END_USER_EMAIL on direct script and flow runs (#11636)
* fix: set WM_END_USER_EMAIL on direct script and flow runs Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: pass the end user to workflow-as-code tasks Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: describe when WM_END_USER_EMAIL is set Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: pin the end user a job token passes on Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
|
442357dbe8 |
feat: per-script resource rollup and heaviest scripts table (#11631)
* feat: export worker cpu, memory and occupancy metrics Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: refresh the exported memory limit with the cgroup readings Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: per-script resource rollup and heaviest scripts table Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: pin the companion ee commit and drop job cpu entries on every exit Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: count the cpu time of suspended workflow rounds Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: count suspended workflow rounds' runtime and guard empty averages Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * perf: flush the runnable rollup hourly in key order and drop its workspace fk Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: order the rollup upsert in sql and sweep rows of deleted workspaces Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * perf: keep the rollup orphan sweep on a primary key range Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: update ee-repo-ref to a1c00d73a05f227a61d2bf37cc86cd9f5bb1777a This commit updates the EE repository reference after PR #866 was merged in windmill-ee-private. Previous ee-repo-ref: c6bcb1bbb5a7e85e870f9de232a0ad1540acf2bd New ee-repo-ref: a1c00d73a05f227a61d2bf37cc86cd9f5bb1777a Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |
||
|
Ruben Fiszelandwindmill-internal-app[bot]
|
6acf185854 |
feat: add an api base url instance setting for displayed urls (#11628)
* feat: add an api base url instance setting for displayed urls * feat: show the api base url as cli remote, keep mcp url on origin * fix: keep push captures on origin and load the api base url on svix page * fix: reject shell metacharacters in webhook and api base urls * test: drop the trivial api base url resolver test * feat: hide the api base url setting behind a toggle * fix: let the quick setup toggle reveal the api base url field * chore: update ee-repo-ref to 017710bdd0a10de857f0f40800dde238cdb1ad24 This commit updates the EE repository reference after PR #863 was merged in windmill-ee-private. Previous ee-repo-ref: f67cd621bd45840e6389e0469a67378864f269a0 New ee-repo-ref: 017710bdd0a10de857f0f40800dde238cdb1ad24 Automated by sync-ee-ref workflow. --------- Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |
||
|
Alexander PetricandClaude Opus 5.5
|
987c321ebc |
fix: uniform decrypt error and clear stored credentials on logout (#11632)
* fix: uniform decrypt error and clear stored credentials on logout Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Kv72vdCDggCZEjJSmNCwnX * fix: also clear mcp-oauth-callback on logout, cover the new keys in the logout test Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Kv72vdCDggCZEjJSmNCwnX --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> |
||
|
|
5d90f96863 |
feat: export worker cpu, memory and occupancy metrics (#11629)
* feat: export worker cpu, memory and occupancy metrics Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: refresh the exported memory limit with the cgroup readings Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: update ee-repo-ref to e128a9b9bedd0b6a46d355b69db13bf8f650c4e6 This commit updates the EE repository reference after PR #864 was merged in windmill-ee-private. Previous ee-repo-ref: b286a486c69e74ec0742a2aac9d4cb1161eb0c6b New ee-repo-ref: e128a9b9bedd0b6a46d355b69db13bf8f650c4e6 Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |
||
|
Ruben Fiszelandwindmill-internal-app[bot]
|
588d8463df |
feat: let a job see that its worker is draining (#11612)
* feat: let a job see that its worker is draining * fix: gate worker draining check on job visibility and export sdk helper * fix: keep draining across re-registration and ignore parked jobs * fix: reset draining only on worker startup registration * chore: update ee-repo-ref to 55feb2e84332179faa4e17aeb419f7f480df79a6 This commit updates the EE repository reference after PR #857 was merged in windmill-ee-private. Previous ee-repo-ref: e5010fa046a3aba93595d1bf44eb6a0cef2b5273 New ee-repo-ref: 55feb2e84332179faa4e17aeb419f7f480df79a6 Automated by sync-ee-ref workflow. --------- Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |
||
|
d7d18f00af |
feat: improve data table roles and grants UX (#11562)
* feat: improve data table roles and grants UX Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: keep selected bordered badges the same height as unselected ones Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: refuse taking over roles with members and test grant statements Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: keep grant filter chips while a filter is set Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: check a taken-over role can log in with the new password Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * feat: select several grant filter tags at once Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * feat: explain where schema and table permissions are set Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: keep the grant create row on one line Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * feat: show grants as a role and its privileges Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * feat: show grants in a table with role, privileges and scope Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: hide the grant scope when it can only be the object itself Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * feat: grant schema usage along with grants inside the schema Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * feat: confirm before closing the roles drawer with unsaved changes Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore: update ee-repo-ref to c4002f777f56d90bb0471164291889850c85179d This commit updates the EE repository reference after PR #848 was merged in windmill-ee-private. Previous ee-repo-ref: 7937634a52d04caeb083da94e189705cd00796b3 New ee-repo-ref: c4002f777f56d90bb0471164291889850c85179d Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |
||
|
|
95c4b3096c |
feat: pause a worker group without stopping its workers (#11596)
* feat: pause a worker group without stopping its workers * chore: bump ee ref * fix: keep dedicated workers running across a pause toggle * fix: edit a copy of the worker group config in the drawer * fix: stable priority tag order, keep pause-only configs in the drawer * fix: keep inherited worker tags when saving from the drawer * fix: keep an explicit empty tag list when leaving dedicated mode * fix: keep inherited tags when creating a config from the drawer Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore: update ee-repo-ref to 6f23819e947b18878000e580ddefccfd01a73166 This commit updates the EE repository reference after PR #853 was merged in windmill-ee-private. Previous ee-repo-ref: 6cf802bdbe17b4a66757016515044b8a9ef9ef19 New ee-repo-ref: 6f23819e947b18878000e580ddefccfd01a73166 Automated by sync-ee-ref workflow. * feat: confirm before applying a worker config change that restarts workers Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore: pin the ee commit that compiles against main Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore: retrigger ci after the github outage dropped the push event Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |
||
|
Ruben FiszelandClaude Opus 5.5
|
afa9ced84c |
[ee] feat: job cancel signals (oidc refusal, agent 5s ping, job.canceled) (#11592)
* feat: faster agent cancel detection, job.canceled event, worker_group span attribute Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: report no unix signal in job.canceled where none is sent Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * refactor: agent workers ping every 5s instead of a 2s read-only cancel check Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: emit job.canceled on windows when the process exits unsignaled Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore: pin ee ref with the queue delay gauge main requires Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> |
||
|
|
75653496e5 |
feat: export queue delay as OTel and Prometheus metrics (#11588)
* feat: export queue delay as OTel and Prometheus metrics * chore: update ee-repo-ref to afd5f322346baee24d9402ca18a95de29d5c2fde This commit updates the EE repository reference after PR #850 was merged in windmill-ee-private. Previous ee-repo-ref: 450df01188ce0cfef1165bf5334bb34c26b921ee New ee-repo-ref: afd5f322346baee24d9402ca18a95de29d5c2fde Automated by sync-ee-ref workflow. --------- Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> Co-authored-by: Ruben Fiszel <ruben@windmill.dev> |
||
|
|
0792332859 |
feat: audit instance settings writes, stable audit OTel target (#11593)
* feat: audit instance settings writes and bulk job cancels Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: audit each setting of a bulk save as it is written Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore: update ee-repo-ref to acb254ac509aff244849c09e50a8d39aae185138 This commit updates the EE repository reference after PR #852 was merged in windmill-ee-private. Previous ee-repo-ref: 3dfc563bc95881183fb6c49d39984023b9b83075 New ee-repo-ref: acb254ac509aff244849c09e50a8d39aae185138 Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |
||
|
|
e277735788 |
feat: count OIDC signatures and reuse server-side tokens (#11556)
* feat: count OIDC signatures and reuse server-side tokens Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore: update ee ref Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore: update ee ref Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore: update ee ref Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore: update ee-repo-ref to cbda28f632d773fd44e9bef8bea36dcb5e35b55d This commit updates the EE repository reference after PR #847 was merged in windmill-ee-private. Previous ee-repo-ref: cec12fc52eb1bb5d3f4f4ae489d86a64e96c6c0c New ee-repo-ref: cbda28f632d773fd44e9bef8bea36dcb5e35b55d Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |
||
|
|
d493eff237 |
feat: job_token_scopes OIDC claim (#11551)
* feat: refuse unscoped tokens of restricted jobs, add OIDC scopes claim Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: keep restricted job_perms rows by a stamp that survives retention Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore: log refused unscoped job tokens at warn Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: key the unrestricted cache by token, keep restricted rows on bulk delete Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: clear a sweep stamp raced onto a queued job Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: stamp restricted job_perms rows under a row lock Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * test: give the memo test's job token scopes Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * refactor: keep only the OIDC claim, drop the server-side refusal A relying party can already tell a restricted job from the claim, which is absent when the presented token carries no scopes. The auth-layer refusal, its lookup cache and the job_perms retention it needed are removed. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore: update ee-repo-ref to 065c2c64c3904d5c0b2766b424210d34f9e54d2d This commit updates the EE repository reference after PR #845 was merged in windmill-ee-private. Previous ee-repo-ref: ea5354477cdf281598a816a5e16ad1f476d42afb New ee-repo-ref: 065c2c64c3904d5c0b2766b424210d34f9e54d2d Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |
||
|
|
3aee181574 |
feat: bill team-plan service accounts as half a seat (#11298)
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Ruben Fiszel <ruben@windmill.dev> |
||
|
Ruben Fiszel
|
92fbfc03d2 | fix: bound s3 ai attachment downloads before encoding (#11534) | ||
|
Ruben Fiszel
|
4acb5b8f18 |
chore: bump go to 1.27.1 in the worker and extra images (#11537)
* chore: bump go to 1.27.1 in the worker and extra images * chore: move the lsp scratch go.mod to go 1.27 |
||
|
|
3cba8a7e4c |
feat: add an AI decision flow step (TypeSafe's Jev, Cloudflare's Clef) (#11474)
* feat: add an AI decision flow step on TypeSafe's Jev An `aidecision` step asks TypeSafe's Jev typed questions (choice, score, yes/no) about a state and returns calibrated answers. It is a plain step: a flow routes on the answers with a Branch to one after it, which the editor builds and keeps in step with the questions. It can also be an AI agent tool, where the calling model supplies the state. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: read single-quoted branch conditions and flag branches on a removed question Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: route decision tools by their tag and keep structured questions as JSON The questions editor writes only on an edit, so opening a step leaves its value untouched, and questions the cards cannot hold stay in a JSON editor. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: re-pick the questions editor mode when the value is replaced from elsewhere Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep the questions JSON editor's text in step with the value Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: recreate the questions JSON editor when the value is replaced from elsewhere Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: run AI decisions on Cloudflare's Clef as well as TypeSafe's Jev A `cloudflare` provider kind reads the hub's `cloudflare` resource (token and account id), calls the model's Workers AI URL, and unwraps Workers AI's `result` envelope. Like TypeSafe, it serves decision steps only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019sEUVZVYBjkzkaVkjbFeAL * feat: branch from each AI decision question, and align its editor with the brand guidelines "Branch on this question" now sits in each choice question's card, which also links to the Branch to one that routes it and flags options it misses or branches it no longer matches. Labels, errors, cards and icons follow the form guidelines and the Branch to one's cards. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019sEUVZVYBjkzkaVkjbFeAL * feat: branch on an AI decision from its graph node A decision with a choice question nothing branches on yet shows a button beside its node that inserts the Branch to one, as its question card does. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019sEUVZVYBjkzkaVkjbFeAL * fix: resolve Cloudflare resources in the AI proxy, and use the design-system button on the graph Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019sEUVZVYBjkzkaVkjbFeAL * fix: put the decision_inputs test's doc comment back on it Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019sEUVZVYBjkzkaVkjbFeAL * chore: regenerate the flow schema in prompts and the chat after the AiDecision description edit Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019sEUVZVYBjkzkaVkjbFeAL * feat: switch AI decision questions between the form and JSON JSON is always available; the form is offered whenever its cards can hold the questions, and a value they cannot hold still opens in JSON. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019sEUVZVYBjkzkaVkjbFeAL * fix: show step ids as badges and use the JSON toggle of the run forms Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019sEUVZVYBjkzkaVkjbFeAL * fix: quote option names in the AI decision branch alerts Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019sEUVZVYBjkzkaVkjbFeAL * feat: remove stale branches from the AI decision question card An empty branch is removed directly; one with steps asks first, naming how many steps go with it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019sEUVZVYBjkzkaVkjbFeAL * feat: branch on yes/no AI decision questions, and test a decision step from the AI chat A yes/no question branches like a choice: "Branch on this question" writes one "yes" branch on `noul >= 0.5`, with the default as "no", and the helper still reads it once the threshold is tuned. The AI chat's step test runs a decision alone as a one-step preview, taking the state the chat passes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019sEUVZVYBjkzkaVkjbFeAL * fix: record removing several stale branches as one undo step Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019sEUVZVYBjkzkaVkjbFeAL * fix: name the typesafe resource type TypeSafe Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019sEUVZVYBjkzkaVkjbFeAL * fix: store TypeSafe as the typesafe resource type's display name, not in the word map Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019sEUVZVYBjkzkaVkjbFeAL * fix: leave the typesafe and cloudflare resource types to the hub instead of seeding them Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019sEUVZVYBjkzkaVkjbFeAL * docs(AGENTS): resource types ship through the hub, not migrations Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019sEUVZVYBjkzkaVkjbFeAL * fix: show the questions JSON format beside the JSON toggle Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019sEUVZVYBjkzkaVkjbFeAL * fix: give the questions JSON format in the field's description Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019sEUVZVYBjkzkaVkjbFeAL * fix: style the decision's graph branch button like Add branch Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019sEUVZVYBjkzkaVkjbFeAL * fix: show the questions JSON format only in JSON mode Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019sEUVZVYBjkzkaVkjbFeAL * feat: show each question's branching under the questions JSON editor Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019sEUVZVYBjkzkaVkjbFeAL * fix: drop the redundant In JSON prefix from the questions format Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019sEUVZVYBjkzkaVkjbFeAL * fix: shorten the decision state's description and show an example as its placeholder Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019sEUVZVYBjkzkaVkjbFeAL * fix: escape a schema placeholder before the JSON editor renders it as HTML Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019sEUVZVYBjkzkaVkjbFeAL * fix: give the decision state's placeholder a text and an object example Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019sEUVZVYBjkzkaVkjbFeAL * chore: update ee-repo-ref to 154cbccb6b8d47bf662b5507882917b5933d5a45 This commit updates the EE repository reference after PR #839 was merged in windmill-ee-private. Previous ee-repo-ref: eaf38c1388f3cc5bece163404fffa959ede8cae0 New ee-repo-ref: 154cbccb6b8d47bf662b5507882917b5933d5a45 Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |
||
|
Ruben FiszelandClaude Opus 5.5
|
26856b8061 |
fix: cancel an abandoned pg query and close failed connections cleanly (#11511)
* fix: cancel the query of a timed out or cancelled postgresql job Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019cpWeGy8jRMtWqvuRBpgu4 * test: fail the cancelled-query test unless the cancel happened Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019cpWeGy8jRMtWqvuRBpgu4 * fix: leave a failed pg job's connection clean for a pooler before closing it Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019cpWeGy8jRMtWqvuRBpgu4 * fix: cancel a failed pg job's unread results and roll back only inside a transaction Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019cpWeGy8jRMtWqvuRBpgu4 * fix: redo a pg connection's closing reset when a late cancel lands on it Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019cpWeGy8jRMtWqvuRBpgu4 * fix: let a late cancel land on the settle query without skipping the reset Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019cpWeGy8jRMtWqvuRBpgu4 --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> |
||
|
Ruben FiszelandClaude Opus 5.5
|
33f6de0cd2 |
fix: apply the pg keepalive settings to the postgres trigger connection (#11512)
Claude-Session: https://claude.ai/code/session_019cpWeGy8jRMtWqvuRBpgu4 Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> |
||
|
GuilhemandClaude Opus 5.5
|
35ec16d127 |
fix: delete a flow chat turn with its flow run, not its step jobs (#11477)
* fix: delete a flow chat turn with its flow run, not its step jobs Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: give flow-written answers and overlapping turns their own flow run Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> |
||
|
|
e7fc1b2e2e |
feat: restricted job tokens per script and flow (#11484)
* feat: restricted job tokens (job_token_scopes on scripts and flows) Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: admit flow-run reads, skip dedicated workers, gate on worker version Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: keep restricted jobs off flow runners, preserve scopes on rename and promotion Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: keep restricted jobs off every dedicated handoff, confine progress flow id Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: exclude restricted runnables from dedicated worker startup Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: gate restrictions on the release after 1.821.0 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: store per-job scopes on job_perms instead of v2_job, pin inline runs to the checked version Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * feat: step-level job_token_scopes for flow steps and agent tools Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014FHGE3ynoAu6yrgeg4kLwL * fix: fail closed on perms read errors, refuse restricted queue imports, gate step scopes in previews Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014FHGE3ynoAu6yrgeg4kLwL * fix: carry a job's scopes on its completion so a re-run keeps the caller's cap Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014FHGE3ynoAu6yrgeg4kLwL * fix: carry a zombie job's scopes into its completion Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014FHGE3ynoAu6yrgeg4kLwL * fix: leave a zombie for the next sweep when its scopes cannot be read Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014FHGE3ynoAu6yrgeg4kLwL * docs: correct the QueuedJobV2 completion comment Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014FHGE3ynoAu6yrgeg4kLwL * fix: validate step scopes in batch flows, fail closed on unvalidated step scopes Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014FHGE3ynoAu6yrgeg4kLwL * fix: refuse flows with step or tool restrictions at push while an older worker is live Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014FHGE3ynoAu6yrgeg4kLwL * fix: apply the step-scope worker gate to flow restarts Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014FHGE3ynoAu6yrgeg4kLwL * fix: list the job token toggle with the other step and flow settings Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014FHGE3ynoAu6yrgeg4kLwL * chore: pin the EE companion merged with EE main Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014FHGE3ynoAu6yrgeg4kLwL * perf: skip scope lookups for unrestricted jobs; list job token setting last Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014FHGE3ynoAu6yrgeg4kLwL * style: rustfmt scopes tests Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014FHGE3ynoAu6yrgeg4kLwL * fix: confine restricted job tokens to their own run lineage; drop remaining extra lookups Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014FHGE3ynoAu6yrgeg4kLwL * chore: update ee-repo-ref to 259ad3bfeef5285ba80eedc86309b11dca001220 This commit updates the EE repository reference after PR #843 was merged in windmill-ee-private. Previous ee-repo-ref: 2b77c0225dca441235daf7bf0a06ba968df0c927 New ee-repo-ref: 259ad3bfeef5285ba80eedc86309b11dca001220 Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |
||
|
Ruben FiszelandClaude Opus 5.5
|
d7227726be |
feat: log pg job progress, warn on stalls, detect dead db connections (#11491)
* feat: log pg job progress, warn on stalls, detect dead db connections Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KHjj2iG8kKPCaFuK6bqXvi * fix: log only slow pg steps to keep job log writes off fast statements Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KHjj2iG8kKPCaFuK6bqXvi * fix: say when a slow connect included a failed cached-connection reset Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KHjj2iG8kKPCaFuK6bqXvi --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> |
||
|
|
d949484e7b |
feat: read the OIDC signing key from a file and rotate it (#11482)
* feat: read the OIDC signing key from a file and rotate it Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore: bump ee ref Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore: bump ee ref Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore: bump ee ref Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore: bump ee ref Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012rmQBQKBgsrd4dJ55vv8n5 * chore: update ee-repo-ref to fe47a306d3760ac2d5a8e14365f05a3503a3ac35 This commit updates the EE repository reference after PR #841 was merged in windmill-ee-private. Previous ee-repo-ref: 7bd97ee7ce32188a171df9190af990d84586752b New ee-repo-ref: fe47a306d3760ac2d5a8e14365f05a3503a3ac35 Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |
||
|
|
99e96d3f78 |
fix: let instances withhold signing secrets from the settings API (#11483)
* fix: never return the instance signing secrets from the settings API Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: tell wmill instance get-config users that jwt_secret is not exported Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore: point ee-repo-ref at the oidc signing key fix Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: block rsa_keys from agent workers and keep get-config stdout pure yaml Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: keep server secrets in exports by default behind EXPORT_SERVER_SECRETS Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore: update ee-repo-ref to 43b2ce8866a393b2666b17647ddb1466afc70bb1 This commit updates the EE repository reference after PR #842 was merged in windmill-ee-private. Previous ee-repo-ref: 3a0d0c3f45eeb9f5fe8d50ce3798239aa9101a22 New ee-repo-ref: 43b2ce8866a393b2666b17647ddb1466afc70bb1 Automated by sync-ee-ref workflow. * fix: withhold server secrets on any non-true EXPORT_SERVER_SECRETS value Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |
||
|
|
4beb1f9420 |
feat: add trigger, tag, run-as and digest claims to job OIDC tokens (#11481)
* feat: add trigger, tag, run-as and digest claims to job OIDC tokens Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: parse digest floats exactly and derive the codebase digest like push Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: give flows that reference flow nodes no digest and keep --json clean Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: list flow step digests from module positions only Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * test: skip the pulled module-script digest check on windows Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore: update ee-repo-ref to 71b8c1042fd8188c2d2882476f12b671cb5ba421 This commit updates the EE repository reference after PR #840 was merged in windmill-ee-private. Previous ee-repo-ref: ba1870536789a43c5b6ec18522a93edb9cb07f3d New ee-repo-ref: 71b8c1042fd8188c2d2882476f12b671cb5ba421 Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |
||
|
Ruben FiszelandClaude Opus 5.5
|
3d1d249556 |
feat: add an instance setting routing all dependency jobs to one tag (#11486)
* feat: add an instance setting routing all dependency jobs to one tag Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: keep bunnative locks on bun and explain the default dependency routing Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> |
||
|
Ruben FiszelandClaude Opus 5.5
|
1c6758a656 |
fix(npm-proxy): support _auth and username/_password basic auth from npmrc (#11467)
* fix: send npmrc basic auth (_auth, username/_password) from the npm proxy Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: resolve npmrc credentials from parent paths like npm Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: honor empty npmrc overrides and keep registry credentials to its origin Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> |
||
|
|
227e934210 |
feat: harden job OIDC tokens with version claims, jti and a lifetime cap (#11457)
* feat: harden job OIDC tokens with version claims, jti and a lifetime cap Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: count restarted flow nodes as latest only if the current version uses them Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: follow stored loop and branch bodies when resolving current flow nodes Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: bind current flow nodes to their step id and skip non-numeric node keys Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * refactor: derive flow step currency from the flow above it and restarts Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: treat every restarted job but a version-checked flow as not latest Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * feat: count a restarted body as latest when the run it came from was current Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore: update ee-repo-ref to b469efc9ceddfaaa1040e4cb2c18993822f92c78 This commit updates the EE repository reference after PR #838 was merged in windmill-ee-private. Previous ee-repo-ref: 25e0b9ae1c6c60419a479fa38d5dc5928832790a New ee-repo-ref: b469efc9ceddfaaa1040e4cb2c18993822f92c78 Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |
||
|
Ruben FiszelandClaude Opus 5.5
|
d2830cb4a0 |
fix: stop running deleted script versions from worker caches (#11456)
* fix: stop running deleted script versions from worker caches Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * refactor: reuse script cache invalidate and test the deletion notify payload Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: keep a deleted copy from shadowing the same hash in another workspace Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: drop deletions missed while down and fills racing the eviction Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: batch deletion events, evict path caches and cover version pruning Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: evict the raw-import cache on both passes and split large deletion events Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> |
||
|
Ruben FiszelandClaude Opus 5.5
|
c25bb1ed90 |
feat: add //no_network annotation for native scripts (#11445)
* feat: add //no_network annotation to deny all network access in native scripts Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: close no_network bypasses (quic dns, header parsing, token, non-native) Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: refuse //no_network on deno regardless of //native, derive disabled ops from deno_net Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * refactor: scope //no_network to native scripts only, drop bun/deno refusal Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> |
||
|
|
ca44043e12 |
feat: let operators compose flows when the workspace grants the right (#11228)
* feat: let a workspace withdraw operator schedule and trigger writes Operators can create, edit and delete schedules and triggers today through the API, CLI and MCP, while the operator_settings flags beside them only hide those pages. An admin who wants operators to see what is scheduled without letting them change it cannot express that. Add manage_schedules and manage_triggers as enforced settings, gated at the schedule handlers and at the generic TriggerCrud routes so every trigger kind is covered by one check. They name capabilities operators already hold, so they are granted unless withdrawn, and absence has to mean "never configured" rather than a value. The read coalesces to true; the update endpoint merges into the stored jsonb with the two fields as Option<bool>, so an omitted key keeps what is stored. operator_settings is git-synced as a whole object, so a settings file written before these keys existed reaches the endpoint on every pull, and a serde or SQL default of either polarity would turn that pull into a silent withdrawal or restoration. The rights are read through a per-process cache, so withdrawing one publishes a notify_event that drops the entry on every replica. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Dsf6VC4MVLisiEoeQkgbr4 * feat: let operators compose flows when the workspace grants the right Adds operator_settings.builder_flows: a workspace setting that lets every operator compose flows out of runnables that already exist. It does not make them authors. The boundary the operator role draws is authoring code and running arbitrary code, and this does not move it: check_flow_is_composition_only walks the value and refuses anything carrying code, including the shapes an obvious walk misses (code hoisted into a flow_node, an AI agent step's tools, and a linked ai_agent resource whose tool list is resolved at run time). What the walk cannot settle it returns for the caller to authorize under RLS: the worker tags the steps pin, every runnable they reference, and the (path, hash) of every version-pinned step. Composing a path is enough to run it and to run it as whoever it runs as, since the worker resolves a step's path with the root DB handle and adopts that runnable's on_behalf_of. A pinned hash needs its own check because dispatch ignores the path beside it. The gate runs on every write and on both request-supplied-value paths, flow preview and flow dependencies, or either becomes the way to run what the write path refuses. Operators of a builder workspace consume a full author seat; the EE companion carries the counting. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Dsf6VC4MVLisiEoeQkgbr4 * feat: enforce operator write rights on the router and in the UI Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: close the capture gap and gate the trigger editors' write actions Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: gate acl writes and the native trigger drawer behind manage rights Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: refuse operator writes with 403 and gate sharing at the drawer Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * perf: resolve identity in the operator write gate only for writes Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: gate the suspended-jobs actions and stop the route check refusing reads Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: explain the empty-state create button when operator writes are withdrawn Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: audit operator settings changes and fold path writes into native rows Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: open locked editors read-only and group the operator settings Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: skip email and azure lookups on editor open while triggers are locked Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * docs: state each operator-rights rationale once in comments Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: address CI review findings on operator write rights Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: keep capture move gated and skip it in the builders while locked Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: refuse builder-rights violations with 403 so operators stay logged in Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * refactor: trim duplication in the operator builder gates Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: hide build app from builder operators on the flow page Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore: point at the companion EE PR merged with EE main Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: keep a builder's drafts list loading past drafts they cannot write Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: hide saved agents from builder operators in the step picker Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore: note the inlined seat rule and drop orphaned sqlx entries Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: stop a builder's step test from logging them out Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: refuse a builder's dependency job on a path it cannot write Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: keep builders from adding dynamic dropdown code to a flow A flow's dropdown code runs as whoever loads its form, so a builder may keep or drop the code stored on the flow it updates, never add or change it. The builder's editor hides the dropdown types and code, and previews options through the deployed flow; the inline dropdown refusal is a 403 so it no longer logs operators out. Also trims rationale comments repeated across sites. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: show why saving operator settings failed The seat-cap refusal on granting builder rights explains what to do; the toast now carries the server's message instead of a generic failure. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: check builder flow drafts like deploys and treat dropdown code as code A developer who loads a builder's flow draft in the editor runs its dynamic dropdown code as themselves, so a builder's draft now passes the same checks as a deploy. Dropdown code is refused like step code rather than kept or dropped, which also removes the exact-match comparison that refused builders over whitespace. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: bill a builder workspace's operators as developers on cloud The cloud seat count behind the Premium page, the sidebar usage and the fork cap still weighed every operator at half a seat, while the builder right makes them authors. The out-of-repo invoicing job must follow the same rule. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: check a builder's flow draft as it will be stored Draft storage strips NUL escapes after the builder check, so a key ending in one (value\u0000, x-windmill-dyn-select-code\u0000) passed the check as an unknown field and was stored under its plain name. The check now reads the sanitized text. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: list a builder's flow drafts and hide hub imports from builders A builder's undeployed flows now appear in the home list, the flow list and the folder counts. Hub project imports and templates bring scripts and apps along, so builders are no longer offered them. The docs record builders' JavaScript expressions as an accepted risk. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: keep the stored builder right when a settings payload omits it A git-synced settings file written before the key existed withdrew the right on every push. builder_flows now follows the manage_* rights: an omitted key leaves the stored value, and the CLI does not count it as a difference. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: word builder refusals by what the flow contains, test the tag refusal A builder refused on a developer's flow never changed its code, so the refusals now describe the flow ("has inline code, so only a developer can edit this flow") rather than an authoring attempt. The grant confirmation uses the neutral dialog: granting changes billing but destroys nothing. The integration test pins the refusal of a worker tag the workspace cannot use. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: read builder rights from the operating workspace, gate the flow page's audit logs entry Builder rights now come from useOperatorBuilderFlows(), next to the schedule and trigger locks, so an editor embedded for another workspace answers about that workspace; the legacy AI chat, one instance for the whole app, reads the navigation workspace. The flow page's Audit logs entry follows the operator audit_logs setting now that builders open that menu. Operator settings reset every value on load, null settings included, so nothing carries over from the previous workspace. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: pick a dynamic dropdown's code source by the operating user's role The flow input editor, the flow test panel and the flow chat send the dropdown request to the operating workspace, so they now also choose inline versus deployed code by the role held there, through useOperatingUser(), instead of the navigation workspace's. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore: update ee-repo-ref to 40ac1c5f8cbce3843b582d9b392d3f3cc7eca3e6 This commit updates the EE repository reference after PR #815 was merged in windmill-ee-private. Previous ee-repo-ref: 31c9e66884b8ca805b20bbfad41fc428fbedbc0e New ee-repo-ref: 40ac1c5f8cbce3843b582d9b392d3f3cc7eca3e6 Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |