* test: run the isolated-forks rule test in its own workspace
PROTECTION_RULES_CACHE is process-wide and keyed by workspace id, so the
other base-fixture tests in protection_rules.rs, running concurrently on
their own databases, could cache test-workspace's rules without the
RequireIsolatedForks ruleset and let the fork through to the data table
copy (400 instead of 403) on main.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: match nsjail profile lines so the envar check passes on CRLF checkouts
script_profiles_take_envars_before_their_fixed_ones searched for
"\n{ENVARS}\n", which a Windows checkout (CRLF) never contains, failing
cargo_test_windows since v1.834.0.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: route the python SDK's S3 client settings through the S3 proxy
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: drop the boto3 config key and expose the proxied bucket to polars
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: proxy S3 settings only for server-signed tokens and keep tls verify
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: isolate fork object storage under a per-fork prefix with read-through
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: guard fork storage isolation against traversal, shared lakes and orphaning
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: serialize fork purges with same-id creation and guard shared middle forks
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: drop fork storage mappings on every replica and lock fork deletion against child creation
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* wip: require isolated forks rule
* feat: add a Require isolated forks protection rule
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: recheck isolated forks under the datatable lock and judge bypass in the base
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 455681e55eb7cdfcfdb7cd79cbae75b333e07943
This commit updates the EE repository reference after PR #893 was merged in windmill-ee-private.
Previous ee-repo-ref: 93f26e3cf816e4eb97b7d4dbbb5fc97fdf9821af
New ee-repo-ref: 455681e55eb7cdfcfdb7cd79cbae75b333e07943
Automated by sync-ee-ref workflow.
* fix: exempt only datatables the base does not own, compact fork data choices
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: pin the isolated-forks owner check, fix its docs wording
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: route the python SDK's S3 client settings through the S3 proxy
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: drop the boto3 config key and expose the proxied bucket to polars
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: proxy S3 settings only for server-signed tokens and keep tls verify
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: isolate fork object storage under a per-fork prefix with read-through
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: guard fork storage isolation against traversal, shared lakes and orphaning
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: serialize fork purges with same-id creation and guard shared middle forks
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: drop fork storage mappings on every replica and lock fork deletion against child creation
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 455681e55eb7cdfcfdb7cd79cbae75b333e07943
This commit updates the EE repository reference after PR #893 was merged in windmill-ee-private.
Previous ee-repo-ref: 93f26e3cf816e4eb97b7d4dbbb5fc97fdf9821af
New ee-repo-ref: 455681e55eb7cdfcfdb7cd79cbae75b333e07943
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: route the python SDK's S3 client settings through the S3 proxy
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: drop the boto3 config key and expose the proxied bucket to polars
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: proxy S3 settings only for server-signed tokens and keep tls verify
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to cd3395013d8484cd3917cdb6ee7837b6ac91e577
This commit updates the EE repository reference after PR #889 was merged in windmill-ee-private.
Previous ee-repo-ref: e90873bba9dde1e899741d111137f94dde2e5ff8
New ee-repo-ref: cd3395013d8484cd3917cdb6ee7837b6ac91e577
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: one Entra app for the Teams bot and ms_teams Graph connect
Adds the ms_teams registry provider (Microsoft Graph) and moves the Teams OAuth setting
from key teams to ms_teams: a migration copies the entry and keeps teams for rolling
upgrades, and readers fall back to teams. The Graph connect URLs come from the setting's
tenant. The settings tile is no longer EE-locked; the bot stays enterprise-only.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: read the Teams setting from ms_teams in the workspace and alert views
Only drop the legacy teams key when the Teams tile was switched off.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to c8e450396ff4210c3bc253b1fa83b913c1a24c45
This commit updates the EE repository reference after PR #881 was merged in windmill-ee-private.
Previous ee-repo-ref: 618749ff7884f7202b75b091bd4de4790fef202d
New ee-repo-ref: c8e450396ff4210c3bc253b1fa83b913c1a24c45
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* oauth: add zendesk provider
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* oauth: default zendesk auth-code scopes in the connect template
Templated providers build the instance client's connect_config from
connect_config_template, so the top-level scopes never reached the
authorization-code dialog.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019pZhg9BJcsnU56GP4WzzrU
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: verify Bot Framework JWT on incoming Teams activities
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: bump ee-repo-ref for Teams JWKS review fixes
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to bd6a7f4fd07578710b072dc3bd4d9e31d4561f8e
This commit updates the EE repository reference after PR #888 was merged in windmill-ee-private.
Previous ee-repo-ref: 66bed6266c5836dcae4e34c6dbe3f917c29c0500
New ee-repo-ref: bd6a7f4fd07578710b072dc3bd4d9e31d4561f8e
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* feat: add a toggle to leave forks of non-dev workspaces out of dev isolation
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: track the non-dev forks toggle reactively and bound the forking rule checks
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: point ee-repo-ref at the skip non-dev forks telemetry registration
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep forks of archived dev workspaces isolated and warn about forkable non-dev forks
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: reset tag lineage caches on every archive and unarchive
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* perf: cache the token dev lineage lookup and trim isolation hot-path costs
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: point ee-repo-ref at the merged skip non-dev forks telemetry registration
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: route dev workspace and fork jobs to their own worker groups
* fix: harden dev workspace isolation against review findings
* fix: verify hashed dedicated tags and keep dev lineage across renames
* fix: let tag-scoped tokens reach jobs queued on dev workspace tags
* fix: expand tag scopes only in dev workspaces and forks
* fix: expand tag scopes only while dev workspace isolation is on
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: collapse the dev workspace isolation section by default
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: count dev workspace isolation toggles and dev-serving group flags
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: validate the dev workspace tag suffix on every instance config writer
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 71e9c0de8317e839f955ebef6a819062f20ac418
This commit updates the EE repository reference after PR #892 was merged in windmill-ee-private.
Previous ee-repo-ref: b5ab84e1705f939c399f6315a03f88b55bce1804
New ee-repo-ref: 71e9c0de8317e839f955ebef6a819062f20ac418
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* fix(ai-chat): tell the session chat that an agent is an ai_agent resource
Asked about an agent by name, the chat looked for a flow, script or app
of that path and concluded the agent does not exist. The rule tells it to
read the agent as a resource, and to leave deploys to the agent's page,
whose editor validates the config.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(ai-chat): gate agent drafting on write_draft, share the ai_agent fact
The drafting sentence now reaches only users who can write resource
drafts, and the fact that an agent is an ai_agent resource also lives in
system_prompts/base/resources.md so the CLI skills get it.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: give inline script runs their own job dir
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: remove the inline job dir when the run is dropped
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: require variables:read for the token variable of an mcp resource
A token scoped to resources:read/write on an MCP resource could have the API
decrypt the variable the resource's `token` points at and send it as a bearer
to the resource's URL. The url and header `$var:` references already required
variables:read on the variable; the token reference now does too, checked before
the OAuth refresh touches that variable.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: let an mcp resource's scope cover the variables it references
A scoped token reading or calling an MCP resource resolved its token variable
with the resource scope alone, but its url and header variables also needed
variables:read on each. The resource scope now covers all three; RLS still
bounds them to secrets the caller can read. Reverts the token-side check from
the previous commit.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: scope resource references when they are written, not when they are read
A token scoped to a resource now reads everything that resource references
(`$var:`, `$jsonvar:`, `$res:`), through get_value_interpolated and the MCP
tool routes alike. What makes that safe moves to the write: create, update,
update_value and version restore refuse a scoped token adding a reference it
holds no read scope on. References the stored value already carries are kept,
since whoever put them there was allowed to.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: hold every resource reference writer to its own user's read rights
A resource-scoped reader resolves stored references as itself, so an unscoped
session could plant a reference to a secret its own user cannot read and have
a reader's scoped token resolve it. Adding a reference now also requires the
writer's user to see its target under RLS. A reference to nothing yet stays
allowed, since a promotion pushes resources before the secrets they use.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: vet only variable references on write and keep nested resources scoped
A nested `$res:` brought along the variables of a resource the writer could see
but whose references it could not read, and what it references can change after
it is written. It needs its own read scope again, and the write check covers
only `$var:`/`$jsonvar:`.
An MCP token stored as a bare path resolved as a variable without being vetted
on write. It now needs its own variables:read scope, and the `$var:` prefix is
parsed with strip_prefix, as the write check does.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep variable scopes on result-cache resources
The worker writes job output to g/results/<hash> straight to the table, so its
references never pass the write check. A token scoped to such a resource still
needs read scope on the variables it references.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: require read rights on kept references and pin result-cache resources to g/results/
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: check resource variable references at read time, with wildcard resource scopes covering matching variables
Returns to the read-time rule: a variable a resource references needs
variables:read on it, unless it is the resource's linked secret or a wildcard
pattern in the token's resources: scopes matches it. The MCP token reference is
now held to that rule like the url and header references.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: name mcp script and flow tools after their last path segment
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: skip suffix expansion for mcp tool names longer than any short name
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: truncate long row titles next to a title badge
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: show the full row title on hover
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: let deployed low-code apps run runtime-built inline queries again
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: limit id-less app runs to the database studio's sql languages
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: cover the deployed-row exclusion with sql content
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: accept Ed25519-signed license keys alongside RSA
* fix: gate the Ed25519 renewal flag on the worker fleet version
* chore: update ee-repo-ref to 664708fff04d4f9e0660bcae3edb307fb2c9481b
This commit updates the EE repository reference after PR #887 was merged in windmill-ee-private.
Previous ee-repo-ref: 5c18fdde212aa1185c405be9c5e194209c5a8ee9
New ee-repo-ref: 664708fff04d4f9e0660bcae3edb307fb2c9481b
Automated by sync-ee-ref workflow.
---------
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: make the frontend installable as a progressive web app
* fix: keep public app pages out of the console manifest
* fix: link the manifest from the console layout so no shared page is installable
* fix: emit a single email claim in job OIDC tokens
Bumps the EE ref to drop the duplicate standard email claim from the job
token mint, and asserts the raw payload carries one email key.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: note the single-email check in the OIDC claim test doc
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to d29a7c0dad120e137105b1186d0bbe3ea1504b5d
This commit updates the EE repository reference after PR #886 was merged in windmill-ee-private.
Previous ee-repo-ref: d64df5c1787e4404c99a41a97fca22668a669c4d
New ee-repo-ref: d29a7c0dad120e137105b1186d0bbe3ea1504b5d
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* Revert "docs: agent editor comments describe runs as the caller"
This reverts commit d94919c9fe.
* Revert "refactor: agents run as the caller, with a note on what a shared one needs"
This reverts commit 0748a2fb51.
* fix: a run as an identity continues only the caller's own conversation
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: an agent run as its identity takes only attachments its caller may read
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: the resource editor keeps an agent's identity on an admin's save
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: regenerate workspace tool schemas for preserve_on_behalf_of
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: the rust client sets preserve_on_behalf_of on resource writes
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: agents run on behalf of their identity only when they opt in
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: an agent holds an identity only while it runs on behalf of it
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: reduce the agent identity migration to clearing untrusted keys
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: refuse decoded variable references in inputs to an agent run as its identity
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: user renames and offboarding re-point an agent's identity
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: refuse model-written tool arguments that the tool's job would interpolate
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: agent on-behalf-of migration after main's
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: the agent identity migration also clears trashed agents
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: share AI sessions read-only by link, optionally public
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: render shared session snapshots from an allowlist, without mermaid or remote images
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* style: make the session share button icon-only
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: safe reasoning links, artifact list and full-load exits on shared sessions
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: resolve canceled jobs and batch re-run them in limited batches
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: offer the re-run batch limit only for failed or canceled filters
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: label an unresolved canceled run as canceled in its status badge
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: tell the user that sources a batch could not re-run block the next batch
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: warn when a re-run batch includes resolved runs and offer to hide them
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: say in the re-run confirmation that failed or canceled sources get resolved
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: grant raw app SDK tokens identity access without a toggle
* test: pin the implicit identity scope on raw app SDK tokens
* refactor: let raw app SDK tokens reach whoami at the route check
* fix: relock scripts deployed from a draft that carries the deployed lock
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: reword fetchDeployed lock comment
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: drop the lock of flow steps whose code the chat changed
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: drop stale flow step locks at deploy, from drafts and the flow editor
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep locks of copied flows and never block a deploy on the lock check
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep the lock of a renamed or duplicated flow step with unchanged code
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: prototype running duckdb jobs out of process inside nsjail
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: bound runner output, honor force install outside the jail, set oom score before exec
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: gate the duckdb runner bin behind a feature and decode pre-install errors
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: allowlist-only policy inside the duckdb jail, with its own extension cache
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: run duckdb jobs out of process under job isolation and drop the engine fork
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: runner everywhere, stock duckdb engine, no sql fence
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 24bdc6615b3f651141fb740e2cacf9c3c2d81252
This commit updates the EE repository reference after PR #884 was merged in windmill-ee-private.
Previous ee-repo-ref: 73452bbc280cc9ca33cf0fe325d26c2fbf3aace4
New ee-repo-ref: 24bdc6615b3f651141fb740e2cacf9c3c2d81252
Automated by sync-ee-ref workflow.
* fix: pass the windows system env and TZ to the duckdb runner
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: cap a jailed duckdb job's disk use from the worker, 6GiB by default on cloud
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep a disk-backed jail tmp under the duckdb disk cap
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: drop the benchmark scaffolding and bump duckdb to 1.5.6
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: operators get AI sessions
`prefersSessionHandoff` stops taking the role, so every AI entry point an operator
can reach — Ask AI, the home composer, Open in session, the flow editor's hand-off,
the raw-app template picker — opens a session for them like anyone else. The
sessions page drops its refusal, and the layout stops keeping them on the docked
chat.
In the sidebar they now get the Workspace/AI Sessions switch and session mode, and
lose the Ask AI entry that stood in for them, since the pane behind it is no longer
the one they are sent to.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat: operators get run-oriented examples in the home composer
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* docs: note builder_flows in the operator composer examples comment
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: gate session tools and editors on operator rights
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: keep operator AI sessions behind a browser opt-in
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep flows refused in the prompt for operators without builder rights
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* refactor: decide every frontend edit check through one editRights module
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: let admins who are also operators open session editors, as drafts.rs does
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: let operators with manage rights save schedule and trigger drafts
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep rebase_draft from operators who can only draft schedules and triggers
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: let operators save resource and variable drafts
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: name deploy and delete tools only where a kind is left to act on
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: list an operator's draft-only resources and variables while they may draft them
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: let job tokens post Teams messages to their own workspace's team
* chore: point ee-repo-ref at the Teams job-token check
* chore: update ee-repo-ref to 3b6bd2b15d9bddb0bb8f1de08b30b897db0415b4
This commit updates the EE repository reference after PR #885 was merged in windmill-ee-private.
Previous ee-repo-ref: e8e4bcd63d6fc804d29e67d42ca6d4163b144a33
New ee-repo-ref: 3b6bd2b15d9bddb0bb8f1de08b30b897db0415b4
Automated by sync-ee-ref workflow.
---------
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* feat: count homepage ai session hero removals and re-pins
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to 0253ffdd6c0b0f1ba162a43d19aed56bc7bd7a71
This commit updates the EE repository reference after PR #882 was merged in windmill-ee-private.
Previous ee-repo-ref: a5d4fd2b21ffd0a6ced604c34d39a5747d9ea940
New ee-repo-ref: 0253ffdd6c0b0f1ba162a43d19aed56bc7bd7a71
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
The viewer registered its header item with the path only, so a deployed app's
summary never reached the band. It is read from the lite app endpoint the viewer
already calls, which also covers sandboxed low-code apps whose content loads in
an iframe.
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: relock apps in place so imported script changes reach them
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: requeue an app relock whose version was rewritten meanwhile
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: relock every component of the version a superseded app relock requeues
Also share raw-app runnable dependency extraction between the worker and the dependency-map rebuild, and take no-key-update row locks, which still order against a deploy's UPDATE without blocking app_script inserts.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: relock every component when an app relock runs on a newer version
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: resolve a requeued app relock's components when it runs
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: regenerate every lock when an app relock relocks every component
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* test: expect app scoping to refuse a foreign app_script id in app_preview_auth
#11777 scopes run-mode app_script ids to their app, so another app's id is
now refused with 401 before the content-hash pin check is reached.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: run end_user_email inline scripts through the deployed app_script id
#11777 runs inline code only through the app_script rows the deployed lite
value references once it exists, so id-less raw_code is refused. Shape the
fixtures like real apps (nested inlineScript) and run by the deployed id.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: wait for both dedicated worker jobs on one listener
The second completed-job listener was opened only after the first job
completed, so a second job that finished first was never seen and the test
hung until the 90s worker timeout.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(cli): keep a raw app's custom_path on sync pull
The pull rendered raw_app.yaml without custom_path, so every pull removed
the line and every push --dry-run listed the file as modified, while the
deployed app still had it and push still sent it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(cli): send custom_path on app update only when it changed
The backend requires admin for any update carrying custom_path, so the value
a pull now writes into raw_app.yaml made every non-admin push of that app fail.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(cli): sync an app's custom path as a workspace-specific file
Unless app routes are workspace-prefixed, a custom path is unique across the
instance, so a value carried in the app file every workspace shares can never
be promoted. Sync now renders it as <app>.<workspace>.custom_path.yaml next
to the app folder, always workspace-specific. A push applies only the target
workspace's file and leaves the deployed custom path alone without one; a
checkout that still has custom_path in its app file converges on push, and
the next pull moves it out.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(cli): drop the custom_path rationale repeated from changedCustomPath
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(cli): apply a custom path pushed with its raw app, and converge a cleared one
The raw-app bundle collapse kept one change per group and dropped the
custom-path file grouped with it, so a push editing both deployed only the
app. App files and their custom-path file now group under the app path in
both folder layouts, and the collapse keeps the custom-path change.
A cleared custom path (custom_path: '') has no file in the export, so the
push diff listed it as added forever; an empty value with nothing deployed
is now in sync.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(cli): never read a file inside a flow or app folder as workspace-specific
The workspace-name segment of the workspace-specific patterns spans '/', so a
raw-app asset such as settings.prod.custom_path.json was taken for a
workspace's file and dropped from the pull. Like fileset children, files
inside a flow or app folder are content of that item, whatever their name.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(cli): recognize a custom-path file only beside its app
isCustomPathFile excluded app and flow folders but still matched a fileset
child such as data.fileset/settings.custom_path.json, so a push dropped
edits to it and a pull renamed it. A custom-path file is now identified by
where it sits: its name is <app>[.<workspace>].custom_path.<ext> and no part
of its directory is an item's folder.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* perf: drive schedule already-exists check from v2_job_queue
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* perf: index v2_job_queue by workspace and scheduled_for
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: send Azure Foundry gpt-5.5+ models to the Responses API
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: name Azure AI Foundry in the reasoning summary notice
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: iterate workspace picker nav items without spreading a NodeList
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: let raw app backend runnables import each other
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: preview only imported sibling runnables and reserve the main id
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: resolve a module's workspace imports from the entrypoint's folder
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: scope run-mode app scripts to their app and key bundles on module imports
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: clone app_version_lite into forks with remapped app_script ids
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: update the run-mode raw_code comment for app-scoped ids
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: run module-bearing app scripts only from the deployed version
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: run deployed inline code only through the deployed version's rows
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: in-workspace app viewers run through the deployed rows
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: let the app embed token read the app's lite value
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: pass sibling modules to the agent-worker Python preview resolver
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: list the lite route in the app embed scope comment
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 455f98540fb042d4f624dcec681dab88b2c8df22
This commit updates the EE repository reference after PR #883 was merged in windmill-ee-private.
Previous ee-repo-ref: 927d3592a6b2127ffe16fb14eb47f5bd66afc026
New ee-repo-ref: 455f98540fb042d4f624dcec681dab88b2c8df22
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: sandbox new low-code and raw apps by default
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: navigate the top page from plain links in a sandboxed low-code app
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: allow clipboard and fullscreen in sandboxed raw-app frames
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: leave non-http links to the browser in the sandboxed app frame
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: let a link's own click handlers run before relaying it out of the frame
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: read link attributes so SVG anchors relay correctly
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: tidy the app deploy drawer to the brand guidelines
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: show enabled frontend api scopes as badges, rename runs-as section
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep frontend api access collapsed by default, badges next to its title
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: lead the run-on-behalf-of section with the user picker
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: explain publisher execution and WM_END_USER_EMAIL in the run-on-behalf-of tooltip
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: shorten the run-on-behalf-of tooltip, mention viewer data access for raw apps
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: tell the AI what breaks in a sandboxed raw app and that turning it off is a security risk
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: warn in the deploy drawer when an app is not isolated
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: drop the sandbox toggle help line
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: say when to turn sandbox isolation off in the toggle tooltip
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: show who a non-deployer's app runs as, read-only
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: show a new app runs as the deployer, gray read-only user line
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: read-only on-behalf-of display as an opt-in selector prop
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: show a folder's default run-as user on a new app instead of the deployer
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: deploy an app under a group folder default without a mismatched email
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* revert: leave a new app's run-as user unselected, as on main
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: warn in the app deploy drawer when a deploy changes the run-as user
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: snapshot the deployed policy so later edits don't change the saved app
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: run script and flow previews on behalf of another user
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: refuse operators and detect servers that drop preview on_behalf_of
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: editor previews run as the configured on_behalf_of identity
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: probe before submitting, keep step and viewer data identity in previews
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: never let a job token request viewer data access on a preview
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: open impersonated preview logs with who they run as and who asked
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Ruben FiszelandClaude Opus 5.5
AlexRV12
GuilhemandClaude Opus 5.5