* feat: edit variables, resources and triggers in their own session tab
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: take a trigger's flow kind from its config and name the written trigger
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* refactor: one operating-workspace context for editors acting on a session's workspace
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: reload page item tabs only in sessions acting on the tool's workspace
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: resolve open in workspace for every preview tab kind in one place
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: guard every component under a session editor against the navigation workspace
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: show a page item tab whose item is gone instead of mounting its editor
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: follow a saved page item in the tab's own workspace and restore in-frame rows
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat: close a page item tab from its editor header
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: judge trigger permissions by the user acting in the session workspace
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: judge every session-editor permission by the user acting in that workspace
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: keep session permissions reactive to the acting role and restore tabs as last seen
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: default Path's owner controls to the user acting in its workspace
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* fix: avoid content shift on home page load and in the script editor logs pane
The tutorial banner rendered by default and was removed once an API round-trip
resolved that it should not show, jumping everything below it up by 58px on
every home page load. It now caches the last resolved state in localStorage and
paints that first, so the first frame already matches what the sync concludes; a
device with nothing cached stays hidden until the sync answers.
The logs header spinner was an unsized lucide icon (24px) where the settled
state renders a 12px Timer, so the row grew 7px while a job was queued and
shrank back when it started, shoving the log body down and up again.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: keep the tutorial banner hidden when dismissed mid-sync
The banner is interactive while the initial tutorial-progress request is still
in flight, so a dismiss or a skip can land before the sync resolves. The
continuation then overwrote the user's choice and brought the banner back.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: pin the result placeholder row height across the spinner swap
Sizing the spinner to the font size still left it 6px short of the text-sm line
box it replaces, so the row contracted instead of growing. Pin the height on the
container so it holds in both states and tracks the root font size.
Also assign state before persisting it, and collapse the duplicated rationale
above the banner cache.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: stop the test panel splitpanes resting one header too tall
The panes carried `!max-h-[calc(100%-{...}px)]`, but the arbitrary value is
built by string interpolation so Tailwind never emitted a rule for it: the
class was inert and the computed max-height was `none`. The panes then took
their 100% height, ignoring the header row above them, and overflowed the
column by exactly the header. Flex only applied the shrink transiently, so a
reflow during a run snapped the whole logs & result region up ~12px and back.
min-h-0 lets flex size the panes to the space that is actually left, which is
what the clamp was reaching for and is correct for the debug and bottom layouts
too, without their hardcoded 83/43/0 pixel guesses.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat: record and replay raw app sessions step by step
* fix: address review findings on raw app session recorder
* fix: stamp replay target before pruning the snapshot clone
* fix: redact step metadata, lock down replayed frames, fix control pre-state
* feat: add a checkpoint timeline to the app recording player
* fix: parser-based replay CSP, fold label clicks, drop stale frame indices
* fix: scrub redacted attributes, keep scroll, neutralize replay navigation
* fix: bound replay payloads, strip namespaced nav links, keep control pre-frames
* fix: strip SMIL navigation, redact metadata sources, capture pre-edit on beforeinput
* fix: redact template content, drop shadow templates, make replays inert
* test: pin snapshot redaction and replay sanitization with DOM tests
* fix: allow-list no-record attributes and cover a marked document root
* fix: classify input types positively so pickers get pre-change frames
* fix: one step per control interaction and bound step metadata
* fix: keep button inputs recordable and coalesce only continuous controls
* fix: no frames for coalesced repeats and drop inline styles when redacting
* fix: fold only the label's own click and keep marked stylesheets out
* fix: keep label-forwarded and radio-group pre-frames, fold submitter clicks
* fix: bound key pre-frames to their gesture and clear ancestor pointer frames
* fix: age-bound pre-frames and treat a radio group as one target
* fix: consume pre-frames per interaction and coalesce on the browser repeat flag
* fix: spend only the pre-frame a step actually used
* fix: settle a step from its successor's pre-state and drop stale pointer frames
* fix: bound remote frame payloads and snapshot stylesheets as rendered
* fix: let a control change spend its own frame and dedupe Enter activations
* fix: record Escape on controls and drop disabled stylesheets
* feat: collapse the replay step list by default behind a toggle
* fix: neutralize disabled sheets in place and fold Enter submissions
* fix: withhold redacted control state, fold key repeats, validate remote metadata
* fix: drop noscript markup and fold implicit form submissions
* fix: mask a select whose chosen option is redacted
* fix: mask redacted select choices before the clone diverges
* fix: run clone-paired passes before removals and fold only Enter submissions
* feat: record a raw app demo from the publish flow instead of the viewer
* fix: wait for in-flight runnable jobs before settling a step
* feat: record from the editor menu and replay publicly at /replay
* feat: export the app recording player and its loader for the hub
* feat: publish from folders only, drop iframe sharing
* fix: observe runnable responses where they land and mount the hub recording route
* fix: respect the app's sandbox opt-in when recording a session
* fix: let stop wait for the runnable the last step is still running
* fix: filter redacted class/id to styled tokens and gate publish on admin
* fix: drop marked sheets from the token vocabulary and bound the replay error
* test: pin the remote app-recording validator
* fix: carry in-flight runnables across a reload and fold held keys into one step
* fix: bind runnable responses off the request and honor base in the replay handoff
* fix: close the settling step when a new fill starts and always re-read stylesheets
* fix: empty the no-record marker so it carries nothing of its own
* fix: decode css escapes so utility classes survive redaction
* fix: read keyDriven from the frame the change starts from
* docs: condense recorder comments to the invariant each protects
* fix: rewrite only real url() tokens and accept leading css escapes
* feat: play flow, script and pipeline recordings on the public /replay page (#10327)
* feat: play flow, script and pipeline recordings on the public /replay page
* fix: render a recorded approval result inert while replaying
* fix: bound an asset sample's cell product and validate recording headers
* fix: make a replayed approval step inert and bound nested recording structures
* fix: stop recorded markup from fetching and bound flow/script render trees
* fix: gate recorded markdown at its renderer and close remaining render-budget gaps
* fix: replace per-key render caps with one structural budget per recorded value
* fix: bound component fan-out and text alongside the structural budget
* fix: make component fan-out cumulative and cap the parsed data-test checklist
* fix: bound the whole recording, graph contents, metadata strings and timer bursts
* fix: keep the published loader path, charge object keys, refuse huge serialized fan-out
* fix: cap flat maps a renderer turns into rows (args, schema properties)
* fix: refuse structure hidden past the depth ceiling and bound errored samples
* fix: count array-shaped argument collections against the row cap
* feat: paint canvas pixels into the snapshot
* fix: budget canvas encoding per snapshot and bound the unknown-kind error
* fix: cap flow graph overlay fan-out and condense budget comments
* docs: teach the raw-app prompt about data-wm-no-record
* fix(backend): authorize single-job read endpoints by job/flow visibility
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat(jobs): share read links + cached access checks for run visibility
- Cache the job read-access RLS probe (size-bounded LRU keyed by the caller's
authz-relevant identity + job id; no TTL since job-side inputs are immutable).
- Inherit visibility along the full parent_job chain so any flow you can see lets
you read its (deeply nested) steps.
- Share read links: GET /jobs/job_view_token/{id} mints a stateless
HMAC(workspace_key, job_id) token (only if the caller can read the job); the
token grants an authenticated member read of that job and its flow subtree via a
?view_token query param or X-View-Token header. Run page gains a Share button and
honors a ?view_token link.
- Denied-but-existing reads now return 403 with guidance to request a share link
(vs 404 for non-existent), and the run page renders that case with instructions.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(jobs): address PR review — scope-tag check on mint, constant-time view-token verify
- P1 (Codex): get_job_view_token now enforces the caller's if_jobs:filter_tags
scope before minting, so a tag-scoped token can't mint a transferable link for a
job outside its tags. Adds a scoped-token regression test (allowed + denied).
- Constant-time view-token verification (HmacSha256::verify_slice) instead of
comparing hex strings (Claude/Pi nit).
- get_completed_job_result: an authed reader passing an invalid suspended-secret
triple now falls through to the normal visibility gate instead of erroring out
(Claude nit); unauthenticated callers still rejected.
- Length-prefix the read-access cache key fields so no input values can collide.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* docs(api): add job_view_token to openapi spec; use generated client in run page
Addresses Codex review nit: the new GET /jobs/job_view_token/{id} endpoint was
missing from openapi.yaml (the source the frontend client is generated from). Adds
the path + operationId getJobViewToken, and switches the run page's Share button
from a raw fetch to JobService.getJobViewToken.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(frontend): carry view_token on share-link downloads
Addresses Codex review: download actions bypass the request interceptor that adds
X-View-Token (downloadViaClient uses raw fetch; cookie-mode downloads use plain
hrefs), so a share-link viewer got 403 downloading logs/results/args. Append the
view_token query param to the job download paths (result/logs/args/flow-all-logs)
via a new appendViewToken() helper, covering both client-fetch and href modes.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(jobs): enforce tag scope in require_job_read_access (view-token use side)
Addresses Codex P1: the view_token use-side bypassed if_jobs:filter_tags on
handlers that don't tag-filter their data query (result_by_id,
get_flow_job_debug_info, get_otel_traces) — a tag-scoped token could use someone
else's valid share token to read out-of-scope job data. Move the tag-scope check
into require_job_read_access (runs before any created_by/view_token/RLS grant), so
it applies uniformly to every gated handler; removes the now-redundant explicit
check in get_job_view_token. Adds a use-side regression test (scoped token + valid
out-of-scope view_token denied on otel/result_by_id; in-scope still allowed).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(frontend): include workspace in share read link
Addresses Codex P1: the copied share URL omitted the workspace. The token is
signed with the run's workspace key and the logged layout only switches
$workspaceStore when the URL carries workspace=, so a recipient whose persisted
active workspace differs would open the link against the wrong workspace and the
token would fail validation. Pin workspace= alongside view_token in the link.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(jobs): authorize get_result_maybe get_started branch for queued jobs
Addresses Codex P1: get_completed_job_result_maybe only gated when a completed row
existed; with ?get_started=true a non-reader reached the fallback branch and got
started:true for a running private job. Now fetches created_by and authorizes
(created_by/view_token/RLS, or anonymous for unauth) before disclosing
running-state; a non-existent job still returns started:false (leaks nothing).
Adds a regression test with a queued (no completed row) private job.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(flows): flag noLogs jobs and lazily resolve them in log panel
* fix appending to flag
* fix: preserve WM_LOGS_SKIPPED sentinel on SSE/replay completion
pickMoreCompleteLogs resolved both sentinel and undefined to '', so the
SSE completion event (whose job field is fetched .without_logs()) would
clobber the sentinel placed by flagSkippedLogs. The module log panel
then saw '' instead of the sentinel, defeating the lazy-resolve path.
Also wire onLogsResolved on the OutputPickerInner inline LogViewer so a
lazy resolve writes back to flowStateStore.previewLogs, matching
ModulePreviewResultViewer and avoiding repeated fetches on remount.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(frontend): branch download UI on shouldDownloadViaClient instead of intercepting in onclick
When OpenAPI.TOKEN is set, several download links rendered an `<a href>`
to the API and relied on an `onclick` handler to call `e.preventDefault()`
and route the request through `downloadViaClient`. This is fragile in
embedded contexts (e.g. the whitelabel React SDK) where Svelte's hydrated
event listener may not intercept the click in time, so the browser
follows the unauthenticated `href` straight to the API.
Mirror the drawer pattern already used in `LogViewer` and
`FlowStatusViewerInner`: render a `<button>` calling `downloadViaClient`
when `shouldDownloadViaClient()` is true, and fall back to the plain
`<a href download>` otherwise. Affects the LogViewer top bar, the large-
result download in DisplayResult, the inline S3 link in ObjectViewer,
the CSV link in ParqetCsvTableRenderer, and FileDownload.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(frontend): treat custom HEADERS / basic auth as token equivalents in shouldDownloadViaClient
Customers wiring the SDK with cookie-bypass auth via custom request
headers (e.g. `OpenAPI.HEADERS = getAuthHeaders()` returning a Bearer
header) had `shouldDownloadViaClient()` return false because it only
checked `OpenAPI.TOKEN`. The plain `<a href download>` branch then
followed the link without those headers, so authenticated downloads
silently degraded to the cookie path (or failed when there is no cookie).
Widen the check to any non-cookie auth: TOKEN, HEADERS, or USERNAME
(basic auth). Route `downloadViaClient` through the generated client's
`getHeaders` so all configured auth schemes are applied consistently
instead of hand-building an Authorization header for TOKEN only.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- duration/mem-peak labels replaced by Timer/Cpu icons with tooltips
- 'Auto scroll' -> 'auto-scroll' (lowercase, hyphenated, whitespace-nowrap)
- top bar gets overflow-x-auto so it scrolls horizontally instead of pushing the entire log panel into overflow when narrow
* feat: allow external domain override for user-facing links
* refactor: use plain var + setter for externalDomain
* chore: expose externalDomain in package exports
* Remove $$props.field usage
* Rename slots to ensure no hyphen
* _props
* _trigger
* OnSelectedIteration type correct capitalization
* rename _content
* Remove afterUpdate
* Migrate everything to svelte 5
* array bind
* Fix popover
* type never
* nit fixes
* Fixed many trivial errors
* onClick
* Fix errors
* use let:
* nit typing
* fix: wrap state_referenced_locally vars with untrack()
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Add untrack import
* Fix all syntax errors due to untrack migration
* Fix undefined errors
* Fix more undefined errors
* untrack(() => initialOpen)
* svelte-ignore
* Fix state_descriptors_fixed error in Chart.svelte
Use $state.snapshot() to pass plain copies of data/options to Chart.js
instead of $state proxies. Chart.js's listenArrayEvents tries to define
property descriptors on data arrays, which Svelte 5 proxies reject.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* nit typing
* Merge issue
* Fix "path is not set" error in resource picker / editor
* Fix InputTransformForm error when rerunning some flows
* fix npm run check
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
When logs stream quickly at job start, preamble content (job metadata,
execution headers) appears before the [windmill] compacted log marker.
The LogViewer now searches for the marker within the first 2000 chars
and renders the "Show more..." button inline at the correct position.
Optimizations:
- Fast early bail-out using short '[windmill]' search before long prefix matching
- Skip expensive ansi_to_html computation when splitHtml is active
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* feat: show position of job in queue when waiting for executor
- Added new API endpoint /queue/position/:id to get job's position in queue
- Modified DisplayResult.svelte to fetch and display queue position
- Shows 'Waiting for executor (position X in queue)' when job is queued
- Refreshes position every 2 seconds while waiting
Fixes#6553
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* iterate
* iterate
* all
* all
---------
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* prevent navigation in the flow when the preview is open
* keyboardNav with registration link
* Improve keyboard nav UI
* Focus log with keyboard nav
* Add native focus
* initialize focused on key down
* fix log expand not sticking
* Improve tree structure
* nit
* nit
* Update active section on click
* add tooltip for keyboard navigation
* componentize detail module
* Add logs tab
* add flow log viewer
* fetch logs
* handle subflows
* add forloop iteration picker
* polish
* expand steps log by default
* move logic handling to wrapper component
* improve iteration picker
* clean code
* polishing
* Add flow start and flow end rows
* fix infinite loop
* nit
* use list instead of table
* use custom id for collapsing subflow
* remove debug logs
* Use status dot instead of text
* fetch log from moduleState
* wip
* only fetch subflow jobs from cache if job is completed
* Add job polling for expanded steps
* handle subflows
* Init logs for steps
* update localModuleState logs
* use selected iteration from local module state
* handle branchone
* Add branch one and branch all label
* remove redondant innerModule prop
* Improve UX
* Add expand/collapse
* Add filter to hide result and inputs
* Steps are now flow children
* improve UX
* Open flow and steps sction when executing
* Handle empty subflows
* remove unnecessary sequence viewer component
* nit
* use iteration picker in log view
* Replace dot with step type icon
* indicate subflows
* add step number and progression
* Incorporate inputs and results in the list of steps
* Add error indicator when subflow has error
* improve topbar
* improve log polling
* Improve log polling
* Add root flow log fetching and polling
* Add debounce for loading subflow jobs
* write a function to build the tree view from the graph
* remove unnecessary log polling
* fix flow result display
* flag errors
* preprocessor
* remove all flow logs drawer
* grenerate graph from component
* wip
* Check module change before building graph
* nit
* fix log overflow
* fix log viewer borders
* mini jobs run preview fix
* elegent job logs loading
* nit
* nit
* nit
* all
* all
* all
* all
---------
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* Add service_log indexer file (ee)
* Rename to completed_run
* rename to service_logs
* Update lib.rs
* Make indexing of logs and simple frontend
* Add common ee file
* Update lib.rs
* Make log search global to fix openapi unused path param
* Prepare sqlx
* Show last indexed also when no jobs are found
* Adapt feature flags to service logs indexer
* Update api and main
* Build service log search page
* scope query to the min and max time
* Migrate modal, bug fixes
* Remove unused import
* Make the service logs page take the full screen
* improve quick access menu to service_logs, fix date stuff, hide 0 matches
---------
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* fix: Allow depolying frontend in a sub directory
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
* fix: Allow depolying frontend in a sub directory
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
* fix: Allow depolying frontend in a sub directory
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
* fix: Allow depolying frontend in a sub directory
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
* fix: Allow depolying frontend in a sub directory
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
* fix: Allow depolying frontend in a sub directory
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
* fix: Allow depolying frontend in a sub directory
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
* fix: Allow depolying frontend in a sub directory
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
* fix: Allow depolying frontend in a sub directory
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
* fix: Allow depolying frontend in a sub directory
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
* fix: Allow depolying frontend in a sub directory
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
* fix: Allow depolying frontend in a sub directory
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
* fix: Allow depolying frontend in a sub directory
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
* fix: Allow depolying frontend in a sub directory
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
* fix: Expose base path from $lib/navigation
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
* fix: Allow deploying frontend in sub directory
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
* fix: Allow deploying frontend in sub directory
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
* fix: Allow deploying frontend in sub directory
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
* fix: Allow deploying frontend in sub directory
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
* fix: Allow deploying frontend in sub directory
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
* update
* update
---------
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
Co-authored-by: Ruben Fiszel <ruben@rubenfiszel.com>
Ruben FiszelandClaude Opus 5.5
Guilhem
Ruben Fiszel
wendrulandRuben Fiszel
HugoCasa
Jacob Reynolds
Faton Ramadani