mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-10-16 00:03:02 +00:00
5ebae08b7556a7e28beffc100ad7aa261ceb8352
15266
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Guilhem Lemouel
|
5ebae08b75 |
Merge remote-tracking branch 'origin/main' into operator-fork-workspace-ruleset
# Conflicts: # backend/ee-repo-ref.txt # frontend/src/lib/components/sidebar/WorkspacePickerBody.svelte # frontend/src/lib/components/workspaceSettings/RulesetEditor.svelte |
||
 AlexRV12
|
7da2344813 |
fix: let raw app SDK tokens read the viewer's identity without a toggle (#11790)
* feat: grant raw app SDK tokens identity access without a toggle * test: pin the implicit identity scope on raw app SDK tokens * refactor: let raw app SDK tokens reach whoami at the route check |
||
 GuilhemandClaude Opus 5.5
|
1f1df1254e |
fix: relock scripts and flow steps whose code changed on deploy (#11794)
* fix: relock scripts deployed from a draft that carries the deployed lock Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore: reword fetchDeployed lock comment Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: drop the lock of flow steps whose code the chat changed Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: drop stale flow step locks at deploy, from drafts and the flow editor Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: keep locks of copied flows and never block a deploy on the lock check Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: keep the lock of a renamed or duplicated flow step with unchanged code Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> |
||
 
|
f9513e82ee |
feat: run duckdb jobs out of process under job isolation, drop the engine fork, bump to 1.5.6 (#11780)
* feat: prototype running duckdb jobs out of process inside nsjail Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: bound runner output, honor force install outside the jail, set oom score before exec Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: gate the duckdb runner bin behind a feature and decode pre-install errors Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: allowlist-only policy inside the duckdb jail, with its own extension cache Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: run duckdb jobs out of process under job isolation and drop the engine fork Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: runner everywhere, stock duckdb engine, no sql fence Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: update ee-repo-ref to 24bdc6615b3f651141fb740e2cacf9c3c2d81252 This commit updates the EE repository reference after PR #884 was merged in windmill-ee-private. Previous ee-repo-ref: 73452bbc280cc9ca33cf0fe325d26c2fbf3aace4 New ee-repo-ref: 24bdc6615b3f651141fb740e2cacf9c3c2d81252 Automated by sync-ee-ref workflow. * fix: pass the windows system env and TZ to the duckdb runner Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: cap a jailed duckdb job's disk use from the worker, 6GiB by default on cloud Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep a disk-backed jail tmp under the duckdb disk cap Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: drop the benchmark scaffolding and bump duckdb to 1.5.6 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |
||
|
GuilhemandClaude Opus 5
|
8c0185d55a |
feat: let operators save resource and variable drafts (#11736)
* feat: operators get AI sessions `prefersSessionHandoff` stops taking the role, so every AI entry point an operator can reach — Ask AI, the home composer, Open in session, the flow editor's hand-off, the raw-app template picker — opens a session for them like anyone else. The sessions page drops its refusal, and the layout stops keeping them on the docked chat. In the sidebar they now get the Workspace/AI Sessions switch and session mode, and lose the Ask AI entry that stood in for them, since the pane behind it is no longer the one they are sent to. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat: operators get run-oriented examples in the home composer Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * docs: note builder_flows in the operator composer examples comment Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * feat: gate session tools and editors on operator rights Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * feat: keep operator AI sessions behind a browser opt-in Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: keep flows refused in the prompt for operators without builder rights Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * refactor: decide every frontend edit check through one editRights module Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: let admins who are also operators open session editors, as drafts.rs does Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * feat: let operators with manage rights save schedule and trigger drafts Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: keep rebase_draft from operators who can only draft schedules and triggers Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * feat: let operators save resource and variable drafts Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: name deploy and delete tools only where a kind is left to act on Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: list an operator's draft-only resources and variables while they may draft them Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> |
||
|
|
64e1630d49 |
fix: let Teams handlers post with job tokens again (#11792)
* fix: let job tokens post Teams messages to their own workspace's team * chore: point ee-repo-ref at the Teams job-token check * chore: update ee-repo-ref to 3b6bd2b15d9bddb0bb8f1de08b30b897db0415b4 This commit updates the EE repository reference after PR #885 was merged in windmill-ee-private. Previous ee-repo-ref: e8e4bcd63d6fc804d29e67d42ca6d4163b144a33 New ee-repo-ref: 3b6bd2b15d9bddb0bb8f1de08b30b897db0415b4 Automated by sync-ee-ref workflow. --------- Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> Co-authored-by: Ruben Fiszel <ruben@windmill.dev> |
||
|
|
3ce2f653c9 |
count homepage ai session hero removals and re-pins (#11781)
* feat: count homepage ai session hero removals and re-pins Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore: update ee-repo-ref to 0253ffdd6c0b0f1ba162a43d19aed56bc7bd7a71 This commit updates the EE repository reference after PR #882 was merged in windmill-ee-private. Previous ee-repo-ref: a5d4fd2b21ffd0a6ced604c34d39a5747d9ea940 New ee-repo-ref: 0253ffdd6c0b0f1ba162a43d19aed56bc7bd7a71 Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> Co-authored-by: Ruben Fiszel <ruben@windmill.dev> |
||
|
GuilhemandClaude Opus 5.5
|
3bee9c9401 |
fix: show the app's summary in the app viewer's page header (#11782)
The viewer registered its header item with the path only, so a deployed app's summary never reached the band. It is read from the lite app endpoint the viewer already calls, which also covers sandboxed low-code apps whose content loads in an iframe. Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> |
||
|
GuilhemandClaude Opus 5.5
|
6d76781d4e |
drop the breadcrumb navigation picker on sessions (#11793)
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> |
||
|
Ruben FiszelandClaude Opus 5.5
|
aca7fed33d |
fix: relock apps in place so imported script changes reach them (#11789)
* fix: relock apps in place so imported script changes reach them Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: requeue an app relock whose version was rewritten meanwhile Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: relock every component of the version a superseded app relock requeues Also share raw-app runnable dependency extraction between the worker and the dependency-map rebuild, and take no-key-update row locks, which still order against a deploy's UPDATE without blocking app_script inserts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: relock every component when an app relock runs on a newer version Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: resolve a requeued app relock's components when it runs Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: regenerate every lock when an app relock relocks every component Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
Ruben FiszelandClaude Opus 5.5
|
f662828a30 |
test: fix backend integration tests broken since #11777 (#11791)
* test: expect app scoping to refuse a foreign app_script id in app_preview_auth #11777 scopes run-mode app_script ids to their app, so another app's id is now refused with 401 before the content-hash pin check is reached. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: run end_user_email inline scripts through the deployed app_script id #11777 runs inline code only through the app_script rows the deployed lite value references once it exists, so id-less raw_code is refused. Shape the fixtures like real apps (nested inlineScript) and run by the deployed id. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: wait for both dedicated worker jobs on one listener The second completed-job listener was opened only after the first job completed, so a second job that finished first was never seen and the test hung until the 90s worker timeout. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
Ruben FiszelandClaude Opus 5.5
|
718aad7396 |
feat(cli): sync an app's custom path as a workspace-specific file (#11786)
* fix(cli): keep a raw app's custom_path on sync pull The pull rendered raw_app.yaml without custom_path, so every pull removed the line and every push --dry-run listed the file as modified, while the deployed app still had it and push still sent it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(cli): send custom_path on app update only when it changed The backend requires admin for any update carrying custom_path, so the value a pull now writes into raw_app.yaml made every non-admin push of that app fail. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(cli): sync an app's custom path as a workspace-specific file Unless app routes are workspace-prefixed, a custom path is unique across the instance, so a value carried in the app file every workspace shares can never be promoted. Sync now renders it as <app>.<workspace>.custom_path.yaml next to the app folder, always workspace-specific. A push applies only the target workspace's file and leaves the deployed custom path alone without one; a checkout that still has custom_path in its app file converges on push, and the next pull moves it out. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(cli): drop the custom_path rationale repeated from changedCustomPath Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(cli): apply a custom path pushed with its raw app, and converge a cleared one The raw-app bundle collapse kept one change per group and dropped the custom-path file grouped with it, so a push editing both deployed only the app. App files and their custom-path file now group under the app path in both folder layouts, and the collapse keeps the custom-path change. A cleared custom path (custom_path: '') has no file in the export, so the push diff listed it as added forever; an empty value with nothing deployed is now in sync. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(cli): never read a file inside a flow or app folder as workspace-specific The workspace-name segment of the workspace-specific patterns spans '/', so a raw-app asset such as settings.prod.custom_path.json was taken for a workspace's file and dropped from the pull. Like fileset children, files inside a flow or app folder are content of that item, whatever their name. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(cli): recognize a custom-path file only beside its app isCustomPathFile excluded app and flow folders but still matched a fileset child such as data.fileset/settings.custom_path.json, so a push dropped edits to it and a pull renamed it. A custom-path file is now identified by where it sits: its name is <app>[.<workspace>].custom_path.<ext> and no part of its directory is an item's folder. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
Ruben FiszelandClaude Opus 5.5
|
7eee210d76 |
perf: drive schedule already-exists check from an indexed queue lookup (#11783)
* perf: drive schedule already-exists check from v2_job_queue Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * perf: index v2_job_queue by workspace and scheduled_for Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
 hugocasaandClaude Opus 5.5
|
ab8983543b |
fix: send Azure Foundry gpt-5.5+ models to the Responses API (#11788)
* fix: send Azure Foundry gpt-5.5+ models to the Responses API Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: name Azure AI Foundry in the reasoning summary notice Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
hugocasa
|
b563f5cb51 |
fix(cli): include script modules in wmill dev previews (#11787)
* fix(cli): include script modules in wmill dev previews * fix(cli): keep dotted script paths whole on wmill dev edits |
||
|
|
526da60da9 |
feat: let raw app backend runnables import each other (#11777)
* fix: iterate workspace picker nav items without spreading a NodeList Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: let raw app backend runnables import each other Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: preview only imported sibling runnables and reserve the main id Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: resolve a module's workspace imports from the entrypoint's folder Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: scope run-mode app scripts to their app and key bundles on module imports Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: clone app_version_lite into forks with remapped app_script ids Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: update the run-mode raw_code comment for app-scoped ids Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: run module-bearing app scripts only from the deployed version Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: run deployed inline code only through the deployed version's rows Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: in-workspace app viewers run through the deployed rows Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: let the app embed token read the app's lite value Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: pass sibling modules to the agent-worker Python preview resolver Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: list the lite route in the app embed scope comment Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: update ee-repo-ref to 455f98540fb042d4f624dcec681dab88b2c8df22 This commit updates the EE repository reference after PR #883 was merged in windmill-ee-private. Previous ee-repo-ref: 927d3592a6b2127ffe16fb14eb47f5bd66afc026 New ee-repo-ref: 455f98540fb042d4f624dcec681dab88b2c8df22 Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |
||
|
hugocasaandClaude Opus 5.5
|
813c080d46 |
feat: sandbox new low-code and raw apps by default (#11760)
* feat: sandbox new low-code and raw apps by default Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: navigate the top page from plain links in a sandboxed low-code app Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: allow clipboard and fullscreen in sandboxed raw-app frames Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: leave non-http links to the browser in the sandboxed app frame Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: let a link's own click handlers run before relaying it out of the frame Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: read link attributes so SVG anchors relay correctly Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor: tidy the app deploy drawer to the brand guidelines Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor: show enabled frontend api scopes as badges, rename runs-as section Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep frontend api access collapsed by default, badges next to its title Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor: lead the run-on-behalf-of section with the user picker Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: explain publisher execution and WM_END_USER_EMAIL in the run-on-behalf-of tooltip Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: shorten the run-on-behalf-of tooltip, mention viewer data access for raw apps Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: tell the AI what breaks in a sandboxed raw app and that turning it off is a security risk Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: warn in the deploy drawer when an app is not isolated Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor: drop the sandbox toggle help line Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: say when to turn sandbox isolation off in the toggle tooltip Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor: show who a non-deployer's app runs as, read-only Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: show a new app runs as the deployer, gray read-only user line Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor: read-only on-behalf-of display as an opt-in selector prop Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: show a folder's default run-as user on a new app instead of the deployer Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: deploy an app under a group folder default without a mismatched email Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * revert: leave a new app's run-as user unselected, as on main Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: warn in the app deploy drawer when a deploy changes the run-as user Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: snapshot the deployed policy so later edits don't change the saved app Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
Ruben FiszelandClaude Opus 5.5
|
4f712318c3 |
feat: run previews as the runnable's on_behalf_of identity (#11778)
* feat: run script and flow previews on behalf of another user Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: refuse operators and detect servers that drop preview on_behalf_of Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: editor previews run as the configured on_behalf_of identity Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: probe before submitting, keep step and viewer data identity in previews Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: never let a job token request viewer data access on a preview Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: open impersonated preview logs with who they run as and who asked Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
Ruben FiszelandClaude Opus 5.5
|
4efd9177ce |
iterate workspace picker nav items without spreading a NodeList (#11772)
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
 Ruben Fiszelandrubenfiszel
|
5954a510af |
chore(main): release 1.835.0 (#11771)
* chore(main): release 1.835.0 * Apply automatic changes --------- Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com>v1.835.0 |
||
|
08319a004c |
feat: allow early return on steps inside branches (#11733)
* feat: allow early return on steps inside a branch to one The "Early return for sync webhooks" flow setting could only point at a top-level step. It can now also point at a step inside a branch to one, in any branch including the default one, and through nested branches to one. When the branch is taken, the sync call returns that step's result as soon as it completes while the rest of the flow keeps running. When it is not taken, the call returns the flow's final result. The sync wait loops already resolved nested steps and fell back to the final result, so they are unchanged. Worker: check_if_early_return_or_last_in_early_return_parent now accepts a job whose step id matches early_return at any depth, as long as every job between it and the root is a branch to one. A loop iteration or a subflow reusing the same id does not take the stream. The existing case, the last step of a branch to one that is itself the early-return step, is unchanged. Frontend: the native <select> is replaced by EarlyReturnPicker, a searchable list in flow order where each nested step shows its path (e.g. `a › Branch 1`). Branch to all and loops inside a branch to one, and the steps inside them, are not offered: the results lookup cannot resolve them when nested. Picking a nested step shows a hint that it only runs if its branch is taken. * fix: stream the last step when the early return branch is not taken Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep the stream off the last step once the early return step ran Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor: list early return steps by id only Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor: use the standard select for the early return step Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: match the early return step by its flow scope, not its path Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep branch to all and loop steps off the early return stream Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: allow early return on steps inside a branch to all Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: resolve a nested branch to all or loop as the early return step Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: pin which step streams for an early return inside branches Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: return an empty nested loop or branch to all as its early return list Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * revert: read an empty container's early return status from the root An empty nested loop or branch to all falls back to the flow's final result again, so an empty top-level loop that failed keeps its real status. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: stefan <stefan.radovanovic@ip-paris.fr> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
GuilhemandClaude Opus 5.5
|
c1a561f5ec |
feat: search the workspace picker dropdown past 8 workspaces (#11761)
* feat: add search to the workspace picker dropdown past 8 workspaces Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: keep focus in workspace search when the menu opens from the keyboard Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: reach workspace picker actions from the search field by keyboard Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: ignore IME keys and reset workspace search state only on input Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: reach the cloud upgrade entry from the workspace search by keyboard Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> |
||
|
AlexRV12
|
717162eab4 | fix: show native triggers in the operator sidebar (#11769) | ||
|
AlexRV12
|
d788f16c40 | feat: run global ai eval cases under builder operator profiles (#11768) | ||
|
GuilhemandClaude Opus 5.5
|
6a7540792a |
make RulesetEditor's onClose required so npm run check passes (#11770)
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> |
||
|
Ruben Fiszelandrubenfiszel
|
e1cab8912c |
chore(main): release 1.834.0 (#11754)
* chore(main): release 1.834.0 * Apply automatic changes --------- Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com>v1.834.0 |
||
|
|
9653318c17 |
feat: add a navigation picker after the breadcrumb's last segment (#11649)
* feat: add a navigation picker after the breadcrumb's last segment Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: open the navigation picker among the current page's siblings Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * style: size the navigation chevron like the workspace chevron Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * style: keep one-line picker lists at one-line row height Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: show the navigation chevron only once the item's path is known Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: highlight a draft in the navigation picker by its storage path Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: key the picker's current item on the header path outside editors Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * feat: count navigation picker picks in feature_usage Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * feat: shrink the page header in stages and let the bar fold page actions Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * feat: fold the runs header through the bar and wrap its filter to a second row Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * feat: truncate the run id and fold run actions into one menu on a narrow bar Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * feat: keep an item's summary and drop its path on a narrow page header Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * feat: show the full summary and path read-only when they cannot be edited Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * feat: keep secondary detail actions in menus and the star beside the summary Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * feat: show secondary detail actions as buttons while the bar has room for them Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore: update ee-repo-ref to 346bd5417537b76591465e63b9d15bd081e9228c This commit updates the EE repository reference after PR #868 was merged in windmill-ee-private. Previous ee-repo-ref: 581b18cac39a4bee2671fd1aa86f91b9e702e8f5 New ee-repo-ref: 346bd5417537b76591465e63b9d15bd081e9228c Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> Co-authored-by: Ruben Fiszel <ruben@windmill.dev> |
||
|
GuilhemandClaude Opus 5
|
74c5f82c67 |
feat: let operators with manage rights save schedule and trigger drafts (#11646)
* feat: operators get AI sessions `prefersSessionHandoff` stops taking the role, so every AI entry point an operator can reach — Ask AI, the home composer, Open in session, the flow editor's hand-off, the raw-app template picker — opens a session for them like anyone else. The sessions page drops its refusal, and the layout stops keeping them on the docked chat. In the sidebar they now get the Workspace/AI Sessions switch and session mode, and lose the Ask AI entry that stood in for them, since the pane behind it is no longer the one they are sent to. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat: operators get run-oriented examples in the home composer Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * docs: note builder_flows in the operator composer examples comment Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * feat: gate session tools and editors on operator rights Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * feat: keep operator AI sessions behind a browser opt-in Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: keep flows refused in the prompt for operators without builder rights Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * refactor: decide every frontend edit check through one editRights module Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: let admins who are also operators open session editors, as drafts.rs does Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * feat: let operators with manage rights save schedule and trigger drafts Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: keep rebase_draft from operators who can only draft schedules and triggers Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: list operators' schedule and trigger drafts under their draft rights Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * docs: say which drafts write_draft gates now that schedules and triggers have their own Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> |
||
|
hugocasaandClaude Opus 5.5
|
247202c1c5 |
oauth: add ms_onedrive, ms_sharepoint and ms_excel providers (#11735)
* oauth: add onedrive, sharepoint and microsoft_excel providers Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * oauth: rename microsoft_excel provider to excel, add msword icon Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * oauth: rename providers to msonedrive, mssharepoint, msexcel Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * oauth: use underscore slugs ms_onedrive, ms_sharepoint, ms_excel, ms_word Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
GuilhemandClaude Opus 5.5
|
a0e0fde52c |
align the protection rule drawer with the drawer guidelines (#11752)
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> |
||
|
AlexRV12
|
c5e6f67d53 |
feat: give full-code app previews the deployed app's window.ctx (#11763)
* feat: give full-code app previews the deployed app's window.ctx * chore: pin the UI Builder build that sets window.ctx in the preview * fix: hold the editor preview until the viewer belongs to the app's workspace * fix: let Rebuild retry a failed viewer lookup in the editor preview |
||
|
Ruben FiszelandClaude Opus 5.5
|
468cf1d994 |
feat: read and change workspace settings from ai sessions and mcp (#11741)
* feat: read and change workspace settings from ai sessions and mcp Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: cover wmill workspace settings commands in the settings guidance Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: say unknown settings keys are warned and ee-only ones refused Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: cover datatable_permissions and protection_rules in the settings guidance Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
hugocasaandClaude Opus 5.5
|
a2ee052e03 |
fix(cli): keep script run waiting on long jobs and flaky log streaming (#11766)
* fix(cli): keep script run waiting on long jobs and flaky log streaming Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(cli): back off job result polling after an error Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(cli): keep skipped jobs successful and color early completions Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(cli): fall back to the polled result when the final job fetch fails Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
Ruben FiszelandClaude Opus 5.5
|
cd7813e354 |
refuse data table tenants that name nobody and report every error at once (#11767)
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
Ruben FiszelandClaude Opus 5.5
|
b543b43d73 |
feat: add a yaml mode to the workspace settings page (#11751)
* feat: add a yaml mode to the workspace settings page Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: confirm before leaving yaml mode with unsaved edits Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: guard pane edits when entering yaml mode and harden the yaml load Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: refresh the active ai config after a yaml apply Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: tie the yaml document to its workspace and reset cleared form state Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
Ruben FiszelandClaude Opus 5.5
|
9a5ec223bc |
feat: workspace settings as one document, applied server-side (#11740)
* feat: add the workspace settings document, applied server-side * feat: add wmill workspace get-settings and apply-settings * fix: warn on unknown settings keys and refuse ee-only ones in the dry run Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: stub the settings document endpoint in the push settings unit tests Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: refuse mistyped settings and keep 4xx status on a partial settings apply Reject non-boolean switches and non-string Slack credentials instead of coercing them into destructive writes, preserve the failing endpoint's status when wrapping a partial-apply error, keep the stored Slack secret when an older CLI pushes one encrypted under another workspace's key, print the plan's warnings in apply-settings, and state the admin check load_settings_document leaves to its caller. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: compare handler arguments verbatim and type-check scalar settings A handler's extra_args is stored as sent and its nulls reach the job as arguments, so an added or removed null argument is now a change. Scalar settings are type-checked in the plan so a dry run never reports a change the endpoint then refuses, and an error handler's omitted mute flags compare as the false the endpoint stores. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: require a 32-bit integer rate limit in the settings plan Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: data table permissions and protection rules in the settings document The settings document gains datatable_permissions, each data table's roles named by their Postgres role name and written by catalog id, and protection_rules, keyed by rule name. Both are managed only when stated and stated as a whole. The dev workspace lock stays with the dev workspace setting. wmill sync carries datatable_permissions only with includeDatatablePermissions (or --include-datatable-permissions), since tenants and roles are specific to a workspace and an instance. protection_rules stay out of settings.yaml: protection-rules.yaml syncs them. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: validate the default data table role and plan permissions against a replaced datatable Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
|
17fefcf777 |
fix: unify cron builder control sizes and widths (#11764)
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Co-authored-by: Ruben Fiszel <ruben@windmill.dev> |
||
|
GuilhemandClaude Opus 5.5
|
009482a677 |
feat: list the user's own forks first in fork pickers (#11762)
* feat: list the user's own forks first in fork pickers Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: indent nested fork dividers and order the session rail tree the same way Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> |
||
|
Ruben FiszelandClaude Opus 5.5
|
1fab283cf9 |
let a legacy migration whose comment reads like a scope get a down (#11765)
* fix: let a legacy migration whose comment reads like a scope get a down Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: pin adding a down to a migration whose comment predates scopes Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
|
2410790c7e |
feat: scope data table migrations to the schemas they declare (#11756)
* feat: scope data table migrations to the schemas they declare Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep unschemed objects and unqualified sql out of per-schema scopes Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: order snapshot prerequisites and widen scopes to what they reference Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: point ee-repo-ref at the migration_scope allowlist entry Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: infer scopes only from generated ddl and snapshot every user object Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: snapshot every schema from one exported snapshot, infer only unedited sql Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor: keep the initial snapshot whole-database and scopes author-declared Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: warn before an out-of-order run when applied status is unknown Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: update ee-repo-ref to 57f4b973e2369f54a89817ff23dc44047ba7b9e4 This commit updates the EE repository reference after PR #880 was merged in windmill-ee-private. Previous ee-repo-ref: abb876d6234d5dfe7c644fdf12cf55f7bc1db1cc New ee-repo-ref: 57f4b973e2369f54a89817ff23dc44047ba7b9e4 Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |
||
|
Ruben Fiszel
|
49147827d6 |
fix: fork data tables sharing one database into a single copy (#11755)
* fix: give data tables forked from one database a single shared copy * fix: key shared-copy cleanup by server as well as database name * fix: refuse dropping a shared resource-backed copy another clone still uses |
||
|
Ruben FiszelandClaude Opus 5.5
|
00a83f4d91 |
test: point the fork migrations test's DATABASE_URL at its own database (#11759)
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
Ruben FiszelandClaude Opus 5.5
|
0a34348500 |
ci: put the newest pg_dump first on PATH for backend tests (#11757)
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
hugocasaandClaude Opus 5.5
|
fe2571ea53 |
feat: list agents with runnables, let them be starred, and fill out their menu (#11651)
* feat: star agents and add runs, audit logs and copy path to their menu Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Vo7HXMdgqXJhR7p8YyVgjB * fix: list an agent's runs as the previews they are Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Vo7HXMdgqXJhR7p8YyVgjB * feat: list agents in the merged runnables stream so they sort with everything else Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Vo7HXMdgqXJhR7p8YyVgjB * perf: index agent paths so the merged listing and owner counts skip other resources Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Vo7HXMdgqXJhR7p8YyVgjB * feat: find agents in the ctrl+k search Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Vo7HXMdgqXJhR7p8YyVgjB * feat: open an agent's version history from its menu Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Vo7HXMdgqXJhR7p8YyVgjB --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
GuilhemandClaude Opus 5
|
998e6877c1 |
feat(sessions): run a deployed item from its own page, for the chat (#11468)
* feat(sessions): hand a deployed run to the item's own page A deployed `run_script` / `run_flow` opened a form in the chat and started the job itself. It now opens the item's deployed page in the preview panel, fills the run form that is already there with the arguments it proposed, and the call ends. The run is the reader's: they start it from the page they would have run it from anyway. **Why the tool stops owning the run.** What the tool could carry was arguments and nothing else, so the page had to hide the controls it could not forward — scheduling, tag override, invisible-to-owner — and "Schedule to run later" ran immediately. It also ran HEAD whatever version the page was pinned to. Handing the page over costs the model nothing it had: it never ran anything, it waited for a reader to press Run. Now it says so and moves on; `get_run` is there when it needs the outcome. A TEST run is unchanged. It executes the draft being written, which the deployed page does not show, so it keeps the chat's own form. So does the bypass posture, which answers for a reader who has already consented and would leave nobody to press Run. Plan mode is unaffected: its gate already sits before the form, so it refuses before anything opens. **On the page.** The arguments arrive narrowed against the deployed schema by the tool that fetched it, and a note above the form says where they came from; dismissing it drops the note and keeps the values. A chat flow has no run form — its page is a conversation — so the proposed `user_message` goes into the composer instead, for the reader to edit and send. The composer declines if they were already typing. **On the card.** The call settles as `Opened`, with the arguments it filled under Inputs and no outcome pane: nothing ran, and a Result tab could only say the run came back empty. The eye reopens the page. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(sessions): address review round 1 on the deployed-run handover - the chat-flow seed was latched before the composer existed, so a page opened fresh dropped the proposed message; the host's input is now reactive and the latch waits for an offer the composer actually took - that offer carries the run's other arguments too: a chat flow's schema can declare more than user_message, and the message alone would have run on saved values or schema defaults - the page takes its seeded arguments out of the runtime rather than reading them on every mount, so a later open of the same item is not re-seeded with an old turn's proposal - the card said "Done" beside "Opened", asserting a completion nothing claims - run_script / run_flow say what the call does in a session, and background / wait_seconds say they do not apply there - restored runFormCancelled's doc comment, displaced by the new helper Tests pin the three invariants the handover rests on: no job started, the model told the run has NOT happened, and neither a test run nor the bypass posture taking the branch. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(sessions): tell a mounting composer apart from a busy one The retry that waits for a chat flow's composer could not tell "not there yet" from "the reader is writing": both read as a declined offer, so the proposal stayed pending and would have landed in the box whenever the composer next changed — words appearing long after they were proposed. `composerReady` answers the first question on its own; past it the proposal is settled either way, and a reader's draft is left alone. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(sessions): address review round 2 on the deployed-run handover - a seed consumed into the viewer's own state carried no item key, so a tab re-pointed to another item got the first one's arguments pushed into its form, replacing its defaults, under a note crediting the agent for them - the handover ran after a stopped turn: the tool reads the item's schema first, and a stop during that read settles the card, which the handover then overwrote with a form so the card read `Opened` and hid the stop. The manager owns the turn, so the check lives there and declining hands the call to requestRunArgs, whose own stop guard settles it - the card kept the deployed schema in the persisted transcript although it never mounts a form - a chat flow's non-message inputs now land whether or not the message does, and the result string no longer asserts a fill the chat branch may not have made - the callback's `false` is documented by what actually causes it Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(sessions): mint a chat flow's secret arguments before its run A chat flow's inputs reach the job straight from the composer, with no RunForm between them to turn a password-marked value into a reference as it is typed. The handover put the proposed arguments there directly, so a literal secret was stored in the job's arguments, readable by anyone who can read the run — the form path had always minted it first. runFlowForChat now does, which covers the reader's own typed inputs as well as a proposal's. Also from round 2: - a viewer pinned to an older version kept that pin when the handover merely focused it, so Run executed a version the arguments were not prepared against - the proposal now decides every input the schema declares, including the ones it omits: merging let a value saved on an earlier visit ride along in a run the chat announced without it Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(sessions): apply a run proposal once, not on every remount The detail page remounts under its viewer whenever the item is deployed, refreshed or pinned to a version, and came back with its own latch reset — so the agent's proposal was pushed in again, over whatever the reader had typed since, bringing back a note they had dismissed. The proposal was made once. The viewer now holds it as pending until the page reports applying it, and says separately whether to credit the agent: the note stands until dismissed, the values land once. Also from the CI round's nits: - a pinned viewer the handover re-points is brought to the front, since the call is about to say the page is open - offerMessage's doc described inputs it no longer carries; applyInputs owns them, deliberately unconditional on the message landing Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(sessions): show the panel on a pinned handover, keep the eye alive after a stop Both regressions from the previous round's fixes. Re-pointing a pinned viewer did neither of the things `open` does besides re-targeting: a collapsed panel stayed collapsed while the call told the reader the page was open. The stop check sat on the method the card's eye calls too. The controller is per-turn and stays aborted once stopped, so the eye went dead on every card in a chat where any turn had been stopped. The tools now go through a guarded variant; the reader's own way in carries no turn check, because reopening a page they closed has nothing to do with a turn. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * docs(sessions): put the run-form doc comments back on their functions Inserting the two handover methods stranded handleRunFormSubmit's comment above one of them, and the host hook's comment still named a tool path that no longer reaches it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(sessions): run a deployed item from its own page, for the chat The run card stays in the chat by default. Preview opens the item's deployed page in the preview panel with the proposed arguments already filled, and Run there hands them back to the parked tool call — so the chat still owns the job and reports on its result. A chat flow has no run form to fill: its page is a conversation, so the proposed message goes into the composer and a strip above it says what was asked for. Sending it runs the flow in that conversation, which settles the call with a reason rather than a refusal — the card says "Handed off", not "Cancelled". Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(sessions): hand the call back when the page cannot honour it A page carries an adopted call only while it can run what the call asked for. Picking a version broke that silently: the tool starts its job by path, so Run on a page pinned to an older version ran the deployed one instead — the page said v1 and the job returned v3. The page now hands the call back when it is on a version, and the card takes its form back, which is where the call can still be confirmed as proposed. Whether the call is still waiting is the manager's answer, not the adoption map's. Reading it live covers the ends that reach no hook: a submit whose job never started, because the server refused it or plan mode blocked it after the arguments were handed over. Those left the page with a dead Run and no way out but the X. The page's Run also has to clear what the card's clears before the form mints a password into a workspace variable — plan mode, and a second press. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(sessions): bind a press on the page to the call it started against A call stops being pending the instant Run is pressed, well before its job exists. The page went back to running on its own in that gap, so a second press there started a job the chat never heard about. A press now holds the call until the job lands or the call settles. A press also kept reading its runner across `processSecretArgs`: cancelling while a password was being minted switched the press to the page's own runner, which then started a job the reader had just cancelled. The runner is read once, when the press begins. A chat flow's message waits on that same round trip. It needs nothing from it, but a composer filled ahead of the inputs can be sent ahead of them, and the run would carry the inputs the proposal was meant to replace. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(sessions): tell the form when a submitted call will never get a job A surface that confirmed a run waits for the job it was promised, and a refused start is the one end it cannot see: the call is neither pending nor cancelled. It was inferred from the call no longer being pending, which stopped working as soon as a press had to outlive that — the page then waited forever, offering a Run that reached nothing. `markRunFormEnded` is the mirror of `markRunFormStarted`: the server refused the job, a sensitive argument could not be stored, or plan mode blocked it after the arguments were handed over. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(sessions): bind the page's async work to the call it started with The page reads the call it is carrying from a derived, and every await on it outlives that read: a call can settle and the next request for the same item be adopted inside one `processSecretArgs` round trip. Read live on the far side, the page would submit one request's arguments to another, decline a proposal the reader had not been shown, or seed a composer over the one they were looking at. Each of these now holds the call it began with. The form's own press holds its guard too, so a replacement cannot have its latch released by the press before it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * refactor(sessions): let the tab carry the call, and leave chat flows alone The page that answers a parked run form was found by item, so anything on that page could resolve the call and act on it: a version picked after the fact, a press that outlived its call, a send in some other conversation. Each was fixed where it surfaced, and the next one surfaced somewhere else. The tab carries the call now, named in its url beside the version pin. Only the tab opened for a call can answer it, and re-pointing that tab anywhere drops the name, so a version picked on the page hands the call back with nothing to check for it. The item-keyed map and the lifecycle hooks around it are gone. A chat-enabled flow's page is a conversation with no run form, so it cannot answer a call at all: Preview opens it to look at and the card keeps the run, which is what the agent needs to report a result. That deletes the composer seeding, the strip above it, and the "Handed off" outcome that existed only to describe a run the agent never saw. Prefilling that composer is worth having on its own and comes back in its own PR. Running a deployed chat-enabled flow needs a memory id, which this path never sent: the card's Run answered with a 400. Each such run now starts its own conversation on the flow's page. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(sessions): keep the page's promises and its edits when it holds a call The dynamic-select helper runs its job when the field mounts, not when Run is pressed, so a form relocated to the page ran one under plan mode — which the card withholds for exactly that reason. The page owes the same promise while it is standing in for a card. Its form is a copy, so arguments typed there were dropped when the call went back to the card: it then offered, and ran, what the page had opened with. The call now carries them back. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(sessions): take no writes on a relocated form under plan mode A password field mints an ephemeral workspace variable as it is typed, so withholding the dynamic-select helper was half the promise: the field itself has to be unwritable. One flag now covers both, as the card's own form already did. The hand-back is keyed on the call rather than on the object naming it, which is rebuilt whenever the draft or the posture changes — its own write to that draft is what would have re-run it. It also hands back only what its own form held: the next call for this item re-points the same tab without remounting, and its seeding can land first. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(sessions): close the JSON route into a read-only run form Disabling the fields left the other way in: arguments written as JSON reach the same object, and a password set there is a plain literal until the schema field mounts onto it — which mints it whether or not that field is disabled. The editor's writes are refused while the form is read-only, and the toggle offering it is not drawn. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * refactor(sessions): hand the form back on destroy rather than from an effect Every way the page stops carrying a call and still holds edits destroys the component: the tab closes, or its url changes and `loadKey` remounts it. So the hand-back is a destroy hook, not a reaction to the call changing — which needed a key and two `untrack`s to keep its own write from re-running it. The call is the one this form was seeded for, captured where it is seeded. By the time the hook runs the tab has already stopped naming it, so reading it then would find nothing to hand back to. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * refactor(sessions): seed the run form as it is built, not after it mounts The form takes what it opens holding as a prop, and the page renders it under the call's id. A request arriving on a tab that is already open builds a new form already filled, so there is no mounted instance to reach for and nothing to wait on — which is all the seeding effect was doing. That also settles where the hand-back reads its call: with no instance to track, `onDestroy` reads the prop, which is still there. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(sessions): hand back only what a form actually held A tab closed while the deployed item was still being fetched handed the card an empty object, wiping the proposal it was still parked on: the page registers its destroy hook long before `RunForm` gives `args` a value. The comment above it also claimed every way out destroys the page. The next call re-pointing the same tab does not, and that page's edits stop there. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(sessions): hand back the PowerShell common parameters too `RunForm` keeps `_wm_ps_*` out of `args` and puts them back only as it submits, so handing `args` to the card dropped whatever the reader had chosen on the page — ErrorAction among them, which falls back to Stop. The form now answers with what a run would send. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * refactor(sessions): let the page edit the call's own draft The page kept a copy of the arguments and handed it back when it went away, so everything `RunForm` does to arguments on the way through had to be mirrored on the way out: the PowerShell split was the third thing found missing from that mirror. The form now binds the draft the card binds, so there is one set of arguments and nothing to carry anywhere. That removes the hand-back, the destroy hook holding it, the `initialArgs` the form was seeded through and the guard that stopped an unseeded form wiping the proposal. A call arriving on an open tab still rebuilds the form, which is what `{#key}` is for; it now opens on the draft rather than on a prop. The PowerShell section follows the rule the rest of the run settings already follow: a call carries arguments and nothing else, so the section is not offered while the form stands in for a card — nothing can be chosen there and lost. Its keys stay in the arguments when the section is not offered, so a proposal carrying them reaches the job either way. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(sessions): keep the submitted arguments on screen after Run Pressing Run settles the call, so the draft the form reads stops answering before the job exists: the form emptied for as long as the start took, and stayed empty when the server refused it — leaving the reader the run to make again with nothing to make it from. It falls back to what it submitted. The note on the PowerShell split also claimed the unoffered keys travel to the job. `SchemaForm` holds the arguments to the keys the schema declares, so they do not. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * docs(sessions): trim the comments on the adopted-run path Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * refactor(sessions): let the page run it and hand the call its job The page kept the chat's arguments in step and ran on the chat's behalf, which meant reproducing everything `RunForm` does to arguments on the way through — the PowerShell split was the third thing found missing from that. It now runs the way it runs anything, with its own form, its own version and its own arguments, and tells the call which job that was. The tool follows that job instead of starting one. The proposal reaches the form through the url hash the deployed pages already read for "Run again", so nothing seeds it. `PendingRun` is three members, and `RunForm` goes back untouched but for the plan-mode gate. Two classes go with the copy. A version pinned on the page is simply the version that runs, since the page starts the job. PowerShell common parameters travel with it for the same reason. Plan mode still has to reach the page: a `password` mints as it is typed and the dynamic-select helper runs on mount, both before Run is pressed, and the page's own Run would otherwise start a job the chat promised not to make. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: carry a run proposal on the call, not in the tab url The proposal reached the deployed page through the tab url's hash, which the page already reads for "Run again". Two things were wrong with that carrier: - A tab already open on the item does not remount when it is re-pointed, and both detail pages read the hash once at init — so a second proposal for the same item opened its form on the first one's arguments. - Tab urls are persisted with the session, so a draft holding file bytes or an un-minted `password` literal was written to IndexedDB. The transcript avoids both deliberately, through `redactFileArgs` and `MAX_PERSISTED_ARGS_LENGTH`. The call now carries its own proposal: `PendingRun.proposedArgs` reads the card's live draft, the page seeds its form from it at init, and the tab's url names only the call. `ItemViewerView`'s load key includes that name, so a tab re-pointed to another call builds its form again. Two more fixes on the same path: - `adopt` was read off the prop after awaiting job creation, so a call that settled during the request could be answered with another call's job. The press now captures the call it was made under. - An adopted job's arguments and version are the page's, which this tool cannot read, but the model was told `Ran with arguments: {}`. It is now told the user ran it on the item's own page, and that the arguments are the page's. - Adopting hands the carrying tab to the run, so the page no longer navigates there as well — that left two tabs open on the same job. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: refuse a run in the form, and show an adopted job's own arguments Two findings on the deployed page carrying a chat call. `RunForm.run()` mints a variable per `password` argument before it calls `runAction`, so the plan-mode gate in the detail pages ran after the write it was there to prevent — and the keybinding reached it without the button. The refusal moves into the form, as `runRefusal`: set, it takes no writes at all, its submit buttons are disabled, and `run()` says so and returns before the secret processing. The page also stops offering the JSON editor under plan mode, instead of leaving one mounted that silently discards what is typed. An adopted job's arguments are the page's, and the card had no way to show them: it kept rendering the proposal, so a reader who edited a field saw the wrong values and the model was told nothing. `adopt` now hands them over with the job id, and they go through the same redaction and size guard as a run this tool starts. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: keep the refused form on the side it is showing Closing the JSON editor when the form starts refusing writes mounted `SchemaForm` in its place, and `PasswordArgInput` mints a variable from the literal it opens on without consulting `disabled` — so a reader who typed a plaintext secret into JSON view had it stored by the act of entering plan mode, with no run and no Run press. The form no longer swaps sides while it refuses: `JsonInputs` takes `readOnly` and the editor stays mounted and uneditable. The JSON toggle is already hidden in that state, which is what keeps the fields from mounting from the other direction. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: redact an adopted run against the schema its page ran Redaction only visits the leaves the schema it is given declares, and the page runs the deployed version as it stands when Run is pressed. A deploy between this call reading the schema and that press can add a file argument ours never had, and its bytes then passed unredacted into the persisted card and the model's result, under the size limit that would have caught a large one. `adopt` hands over the schema it ran against alongside the job and arguments, and both redactions use it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: sit the parked-call banner in the form's own header row The banner was its own block directly above the form, so it sat flush against the first field. It now shares the row that carries the JSON toggle, where the existing input badges get their spacing from `min-h-12`. It goes ahead of the saved-input badge, whose reserved slot stays mounted while hidden and would otherwise push the banner off the left edge. The row's gate takes `pendingRun` as well, since a runnable with no schema properties renders no row and would drop the banner with it. The badge's reject button also takes the alert palette it sits on, through `tone`, instead of the neutral bordered one it had from the deprecated `color`/`size` props. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat: hand a proposed run to the page already showing it A reader who declines a proposal and asks for different arguments still has that item's page open, and the next proposal belongs on it — but it was parked on the card until Preview was pressed again. `requestRunArgs` now routes the call to that page itself, through `openRunOnDeployedPage` with `onlyIfAlreadyOpen`: a tab already on the item is re-pointed, and anything else — a tab showing a run included — answers no and leaves the form on the card. The card keeps a working form while a page carries the call, rather than reporting that its inputs are elsewhere. Only the chat's own form in a tab is exclusive with it, since that one is the same draft and two mounts each reorder the schema in place; a page builds its form from a copy of the proposal and shares nothing. So the card folds its row instead of emptying it, and expanding it is how a run goes from the transcript. `isRunFormTabOpen` answers that narrower question, and the collapse moves into the row's default so pressing Preview and being routed here behave alike. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: let one call start only one job across its two surfaces The card's form and the deployed page's are now live at the same time, and only the card took the manager's submission claim. The call stays pending until `adopt`, a round trip after the page sends its request, so a Run on the card in that window passed the claim and started a second job — with its own arguments, and unmentioned in the chat, which followed the card's. The page takes the same claim before it sends, and hands it back when no job came of it so a failed start can be retried. A successful start needs no release: adopting the job settles the call. Whichever surface is first owns the call; the other sends nothing and says so. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: leave a busy tab alone when handing it a proposal The re-point branch was written for Preview, which the reader presses on purpose, and now also runs for every proposal of an item whose page is open. Unasked for, two of the things it does are not wanted: `navigate` rebuilds the tab's url without the version the reader pinned, and `select` with `setCollapsed` pulls the panel off whatever tab they were reading. So the automatic path declines a pinned tab outright, leaving the pin and the call on the card, and moves the panel only when that tab is the one already on screen. An explicit Preview press keeps the behaviour it had. A hand-off still remounts the page, so text typed into its form is lost. That needs the page to report unsent edits upward, and is left out. Tests the routing gate: a deployed run is handed over, a test run and a chat-enabled flow are not — neither has a page with a form that could answer the call. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: claim a run before the form mints its secrets, not after The claim sat in `runAction`, which `RunForm.run()` reaches only after `processSecretArgs` has written a variable per `password` argument. So a press that lost the race still minted — and worse, it read the pending call after that round trip, by which point the winner had settled it: with no call to claim, the losing press started a job of its own. `runRefusal` already documents this boundary, saying a caller cannot gate in `runAction` because it comes after the mint. The claim belongs on the same side, so the form takes it through `claimRun` just before the first write and hands it back through `releaseRun` when the mint fails. The pages keep the call they claimed rather than re-reading it, so a claimed press either answers that call or does nothing. The chat card's own form already worked this way, taking the claim ahead of its `processSecretArgs`; the page was the asymmetric surface. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: hand a proposal only to the page the reader is looking at Re-pointing a tab reloads it and rebuilds its url. On a tab that is not on screen that silently drops whatever had been typed into its form and leaves the call on a page the reader cannot see, while the card folds because the call is carried — so the run is confirmable on neither surface in view. Declining instead leaves it on the card, which can run it. The automatic path therefore requires the matching tab to be the active one in an open panel, alongside the existing version-pin check, and the three ways of being busy read as one condition. An explicit Preview press still re-points, reveals and unpins, which is what pressing it asks for. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Revert "fix: claim a run before the form mints its secrets, not after" This reverts |
||
|
hugocasaandClaude Opus 5.5
|
11f0e3860e |
oauth: github scope_options add read:project, project (#11478)
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
Ruben FiszelandClaude Opus 5.5
|
694ed7a0eb |
fix: keep applied migrations and db settings in data table copies (#11753)
* fix: keep applied migrations and db settings in data table copies Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: scope copied db settings per transaction and send timestamps as iso Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: copy migrations and settings only into a fresh import target Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * ci: install the latest pg_dump for backend integration tests Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * ci: enable pgdg so the latest pg_dump is installed Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
Guilhem LemouelandClaude Opus 5.5
|
01e9cc456a |
fix: show Edit in fork to allowed operators in the app menu and folded run menu
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> |
||
|
hugocasaandClaude Opus 5.5
|
88c3cc0ced |
feat: guide the AI when no resource type fits a service (#11615)
* feat: guide the AI when no resource type fits a service Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: report a failed resource type search and model a synced instance in evals Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep named resource types first and list only related names on search failure Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: point the sync note at the hub sync button only Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor: list the instance's resource types when the search finds nothing Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: let the user create a resource type instead of syncing the hub Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: make the linked-variable resource the default, not the only option Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: add a cli eval for a service without a hub resource type Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: keep the resource type search fresh and serve it without embeddings Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: let the global chat create a resource type after the user confirms it Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: simulate create_resource_type in global evals and fix the in-house API checklists Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: reuse unchanged custom resource type vectors and match names case-insensitively Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: add the unsynced note whatever the resource type search returns Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: carry the no-type rule into flow inputs and script parameters, and ask the chat to relay the sync Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: tell script chat to hand the user the schema it cannot create Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: skip the resource type fingerprint query when no index is loaded Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: index resource types locally when the hub's embeddings cannot be fetched Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: match short service names in the resource type text fallback Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: name custom resource types with the c_ prefix the Resources page uses Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: require the c_ prefix in in-house API evals and a real sync mention Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: cover workspace scoping of the resource type text search Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: say the form adds the c_ prefix unless an admin turns it off Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: refresh resource type names and the resources tab after the chat creates a type Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * perf: fingerprint resource types without sorting every schema Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: tell the global chat in each message when the hub's types are not synced Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: send users who cannot deploy to an admin for a resource type, and have the cli list types first Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015YR13nJWziUSWktZwhC7dx * refactor: move the resource type search index changes to their own pull request Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015YR13nJWziUSWktZwhC7dx --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
hugocasa
|
9249aa02d5 |
feat: let a linked agent step override model and reasoning effort (#11685)
* feat: let a linked agent step override the model and reasoning effort * fix: only honor model and effort overrides the step authored * fix: treat an authored empty effort override as no effort * fix: keep a static empty override from reading caller arguments or the saved effort * fix: keep step tests and multi-agent chats from inventing an effort override * fix: keep the saved model fallback when linked steps differ only on effort * fix: show the agent override hint on the input's own help row * fix: align the override hint spacing between static and expression inputs * fix: keep the override rows a dropdown whatever the model is set to * fix: give the override hint the 4px form gap and drop its trailing period * fix: space the override hint with a margin so it is not clipped * test: pin the saved model fallback when linked steps differ only on effort * fix: keep the saved model fallback across agents that saved different efforts |