* feat: prototype running duckdb jobs out of process inside nsjail
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: bound runner output, honor force install outside the jail, set oom score before exec
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: gate the duckdb runner bin behind a feature and decode pre-install errors
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: allowlist-only policy inside the duckdb jail, with its own extension cache
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: run duckdb jobs out of process under job isolation and drop the engine fork
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: runner everywhere, stock duckdb engine, no sql fence
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 24bdc6615b3f651141fb740e2cacf9c3c2d81252
This commit updates the EE repository reference after PR #884 was merged in windmill-ee-private.
Previous ee-repo-ref: 73452bbc280cc9ca33cf0fe325d26c2fbf3aace4
New ee-repo-ref: 24bdc6615b3f651141fb740e2cacf9c3c2d81252
Automated by sync-ee-ref workflow.
* fix: pass the windows system env and TZ to the duckdb runner
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: cap a jailed duckdb job's disk use from the worker, 6GiB by default on cloud
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep a disk-backed jail tmp under the duckdb disk cap
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: drop the benchmark scaffolding and bump duckdb to 1.5.6
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* fix: relock apps in place so imported script changes reach them
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: requeue an app relock whose version was rewritten meanwhile
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: relock every component of the version a superseded app relock requeues
Also share raw-app runnable dependency extraction between the worker and the dependency-map rebuild, and take no-key-update row locks, which still order against a deploy's UPDATE without blocking app_script inserts.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: relock every component when an app relock runs on a newer version
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: resolve a requeued app relock's components when it runs
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: regenerate every lock when an app relock relocks every component
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: iterate workspace picker nav items without spreading a NodeList
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: let raw app backend runnables import each other
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: preview only imported sibling runnables and reserve the main id
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: resolve a module's workspace imports from the entrypoint's folder
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: scope run-mode app scripts to their app and key bundles on module imports
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: clone app_version_lite into forks with remapped app_script ids
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: update the run-mode raw_code comment for app-scoped ids
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: run module-bearing app scripts only from the deployed version
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: run deployed inline code only through the deployed version's rows
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: in-workspace app viewers run through the deployed rows
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: let the app embed token read the app's lite value
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: pass sibling modules to the agent-worker Python preview resolver
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: list the lite route in the app embed scope comment
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 455f98540fb042d4f624dcec681dab88b2c8df22
This commit updates the EE repository reference after PR #883 was merged in windmill-ee-private.
Previous ee-repo-ref: 927d3592a6b2127ffe16fb14eb47f5bd66afc026
New ee-repo-ref: 455f98540fb042d4f624dcec681dab88b2c8df22
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: allow early return on steps inside a branch to one
The "Early return for sync webhooks" flow setting could only point at a
top-level step. It can now also point at a step inside a branch to one,
in any branch including the default one, and through nested branches to
one.
When the branch is taken, the sync call returns that step's result as
soon as it completes while the rest of the flow keeps running. When it
is not taken, the call returns the flow's final result. The sync wait
loops already resolved nested steps and fell back to the final result,
so they are unchanged.
Worker: check_if_early_return_or_last_in_early_return_parent now
accepts a job whose step id matches early_return at any depth, as long
as every job between it and the root is a branch to one. A loop
iteration or a subflow reusing the same id does not take the stream.
The existing case, the last step of a branch to one that is itself the
early-return step, is unchanged.
Frontend: the native <select> is replaced by EarlyReturnPicker, a
searchable list in flow order where each nested step shows its path
(e.g. `a › Branch 1`). Branch to all and loops inside a branch to one,
and the steps inside them, are not offered: the results lookup cannot
resolve them when nested. Picking a nested step shows a hint that it
only runs if its branch is taken.
* fix: stream the last step when the early return branch is not taken
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep the stream off the last step once the early return step ran
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: list early return steps by id only
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: use the standard select for the early return step
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: match the early return step by its flow scope, not its path
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep branch to all and loop steps off the early return stream
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: allow early return on steps inside a branch to all
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: resolve a nested branch to all or loop as the early return step
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: pin which step streams for an early return inside branches
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: return an empty nested loop or branch to all as its early return list
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* revert: read an empty container's early return status from the root
An empty nested loop or branch to all falls back to the flow's final result again,
so an empty top-level loop that failed keeps its real status.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: stefan <stefan.radovanovic@ip-paris.fr>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: let a linked agent step override the model and reasoning effort
* fix: only honor model and effort overrides the step authored
* fix: treat an authored empty effort override as no effort
* fix: keep a static empty override from reading caller arguments or the saved effort
* fix: keep step tests and multi-agent chats from inventing an effort override
* fix: keep the saved model fallback when linked steps differ only on effort
* fix: show the agent override hint on the input's own help row
* fix: align the override hint spacing between static and expression inputs
* fix: keep the override rows a dropdown whatever the model is set to
* fix: give the override hint the 4px form gap and drop its trailing period
* fix: space the override hint with a margin so it is not clipped
* test: pin the saved model fallback when linked steps differ only on effort
* fix: keep the saved model fallback across agents that saved different efforts
* fix(worker): keep script env vars off the nsjail launcher process
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(worker): keep script env off the ruby gem-install nsjail launcher
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(worker): keep script env off the unjailed javac compile step
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(worker): gate script_overrides on the executors that use it
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: connect a data table as the job's own identity unless the runnable opts into its viewer
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: key cached results by the data table mode and keep the flag across ai edits
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: hash the cache key's mode and viewer as fixed fields so no argument name can forge them
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 2f74548ad1ec50c8e1faf17e42d5648160e833f1
This commit updates the EE repository reference after PR #878 was merged in windmill-ee-private.
Previous ee-repo-ref: 4ad768a777fff9f1ecc86a2803bc27d80f8242d6
New ee-repo-ref: 2f74548ad1ec50c8e1faf17e42d5648160e833f1
Automated by sync-ee-ref workflow.
* feat: rename the flag to viewer_data_access and apply it to object storage permission rules
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: describe viewer_data_access as covering object storage rules too
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 0ffb633473c5465513576afc6f54d18f93c7f1e1
This commit updates the EE repository reference after PR #879 was merged in windmill-ee-private.
Previous ee-repo-ref: e9e06a9eb94168f46b378276b01fa0117dc7d8ed
New ee-repo-ref: 0ffb633473c5465513576afc6f54d18f93c7f1e1
Automated by sync-ee-ref workflow.
* feat: show the viewer data access control as an icon button
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: pin the default python version of an instance at initialization
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: detect a new instance from the schema it created, not from its age
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: record the python baseline on the migration connection
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: record the instance python version in the setting itself
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: start new instances on python 3.15
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep the forced python version ahead of the stored one when a worker reads it late
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: start new instances on python 3.14 rather than 3.15
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: start new instances on python 3.13
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 06610ecc950ed64a2709d7f1aa8c7b49a95fdbae
This commit updates the EE repository reference after PR #869 was merged in windmill-ee-private.
Previous ee-repo-ref: 599eae0034b34c5e0d3d42df37cf18bbe01f9b49
New ee-repo-ref: 06610ecc950ed64a2709d7f1aa8c7b49a95fdbae
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* chore: pass --system-certs to uv instead of the deprecated --native-tls
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 06610ecc950ed64a2709d7f1aa8c7b49a95fdbae
This commit updates the EE repository reference after PR #869 was merged in windmill-ee-private.
Previous ee-repo-ref: 599eae0034b34c5e0d3d42df37cf18bbe01f9b49
New ee-repo-ref: 06610ecc950ed64a2709d7f1aa8c7b49a95fdbae
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* fix(cli): count superadmins as able to preserve ownership on push
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011BzU9zd53JsTShCsbKzYzB
* fix: resolve variables in the url and headers of an mcp resource
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep resolved mcp secrets out of header warnings and userinfo urls
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: drop the url from mcp client errors before rmcp logs them
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: run rmcp's reqwest client without a log subscriber
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: scrub the request target from mcp error bodies
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: drop server error bodies from mcp transport errors
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: fail closed when an mcp error message has no status prefix
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: connect to a data table with every role of the job's viewer
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: key a cached result by the run's recorded viewer
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: pin the per-viewer cache key and fix a stale doc sentence
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: length-prefix the viewer in the result cache key
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: drop data table role set logins unused for 30 days
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: pin the ee ref with the set login sweep fixes
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: pin the ee ref with the sweep retry fix
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: give the cache key test its own migrated database
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: add the viewer's roles to a data table connection that names none
The default role of a data table under roles is now a floor: a connection
naming no role also holds the roles its viewer is a tenant of, unless the
default is admin. This replaces the explicit as=viewer option, which is
removed from the reference parser, the executors and both clients. The roles
drawer warns while the default is admin and confirms before removing the
default role.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: let a data table have no default role
A connection naming no role then holds its viewer's roles only and is
refused without any. The roles drawer offers the choice, states what an
unnamed connection gets for the current settings, says who gets admin while
it is the default, and notes who owns a table created over several roles.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: start a data table's roles with admin open to everyone
Turning roles on from the drawer seeded admin with no tenant, which refused
every non-admin member's job as soon as it was saved. It now starts open to
everyone, so the toggle changes nothing until the roles are edited, and the
drawer warns for as long as everyone can connect as admin.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 40ab35596e6fcb82a4dfc56e186befb807f8e2af
This commit updates the EE repository reference after PR #873 was merged in windmill-ee-private.
Previous ee-repo-ref: a5def184a29fffab8ed42c70c5a7445b2b3cbe98
New ee-repo-ref: 40ab35596e6fcb82a4dfc56e186befb807f8e2af
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: support array arguments in snowflake scripts
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: cast the parsed snowflake list to array in the guidance
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: parse a json array default of a sql list argument as a list
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep ai agent schema property order stable across jobs
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep tool parameter order when filtering preset inputs
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: resolve $var: references in mcp resource headers
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: require variables:read scope to resolve mcp header variables
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep preserve_step_tags on saved branch and loop flow nodes
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* style: format reduce_flow call
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: retry transient AI provider failures before output reaches readers
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep completed AI streams, stop retrying prompt blocks, bound retry-after
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: share the AI send-error retry rule between agent and proxy
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: accept a clean end of stream from OpenAI-compatible providers
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: classify AI provider errors the way the reference clients do
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: count a Gemini function call as the end of its turn
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: count an Anthropic stop_reason as the end of its stream
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: accept a Gemini answer that reports usage and no output
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: accept a Gemini stream that closes cleanly with no output
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* feat: stop offering deno for new scripts and ship it only on full images
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep deno in the integration test worker and narrow the missing-deno error
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep deno selectable on existing deno scripts when the saved order omits it
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: drop the deno workloads from the benchmark suite
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: run bun instead of deno in tests that are not about the deno runtime
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: drop the deno cases from the integration suite
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: update the app policy hash for the bun inline script
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: set WM_END_USER_EMAIL on direct script and flow runs
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: pass the end user to workflow-as-code tasks
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: describe when WM_END_USER_EMAIL is set
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: pin the end user a job token passes on
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: export worker cpu, memory and occupancy metrics
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: refresh the exported memory limit with the cgroup readings
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: per-script resource rollup and heaviest scripts table
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: pin the companion ee commit and drop job cpu entries on every exit
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: count the cpu time of suspended workflow rounds
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: count suspended workflow rounds' runtime and guard empty averages
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* perf: flush the runnable rollup hourly in key order and drop its workspace fk
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: order the rollup upsert in sql and sweep rows of deleted workspaces
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* perf: keep the rollup orphan sweep on a primary key range
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to a1c00d73a05f227a61d2bf37cc86cd9f5bb1777a
This commit updates the EE repository reference after PR #866 was merged in windmill-ee-private.
Previous ee-repo-ref: c6bcb1bbb5a7e85e870f9de232a0ad1540acf2bd
New ee-repo-ref: a1c00d73a05f227a61d2bf37cc86cd9f5bb1777a
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: export worker cpu, memory and occupancy metrics
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: refresh the exported memory limit with the cgroup readings
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to e128a9b9bedd0b6a46d355b69db13bf8f650c4e6
This commit updates the EE repository reference after PR #864 was merged in windmill-ee-private.
Previous ee-repo-ref: b286a486c69e74ec0742a2aac9d4cb1161eb0c6b
New ee-repo-ref: e128a9b9bedd0b6a46d355b69db13bf8f650c4e6
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* fix: store a workflow-as-code parent's first start and wall duration
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep a parked child's first start in its parent's timeline
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: record a parked step with its whole span in the flow, cover inline checkpoints
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to ab8476e5feedc98b727f7d83acffa1807b3b9c5b
This commit updates the EE repository reference after PR #861 was merged in windmill-ee-private.
Previous ee-repo-ref: d5d95f51bb175944874e585e5931acb1eddd637a
New ee-repo-ref: ab8476e5feedc98b727f7d83acffa1807b3b9c5b
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: let a job see that its worker is draining
* fix: gate worker draining check on job visibility and export sdk helper
* fix: keep draining across re-registration and ignore parked jobs
* fix: reset draining only on worker startup registration
* chore: update ee-repo-ref to 55feb2e84332179faa4e17aeb419f7f480df79a6
This commit updates the EE repository reference after PR #857 was merged in windmill-ee-private.
Previous ee-repo-ref: e5010fa046a3aba93595d1bf44eb6a0cef2b5273
New ee-repo-ref: 55feb2e84332179faa4e17aeb419f7f480df79a6
Automated by sync-ee-ref workflow.
---------
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* fix: keep capturing job logs after a non-UTF-8 output line
The worker read child stdout/stderr with `lines()`, which errors on a line that
is not valid UTF-8; handle_child then logged "error reading output" and stopped
capturing logs for the rest of the job. Read raw segments and decode lossily
instead, so a bad byte becomes U+FFFD and later lines still arrive.
PowerShell on Windows writes redirected output in the console code page
(e.g. CP850), so any umlaut triggered this. Set [Console]::OutputEncoding and
$OutputEncoding to UTF-8 in wrapper.ps1 so pwsh output is UTF-8 on every OS.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: state the pwsh encoding constraint without history
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep pwsh's native-command decoding on the console code page
Forcing [Console]::OutputEncoding to UTF-8 also changes how pwsh decodes
native-command output captured into variables, turning OEM-encoded
characters from legacy tools into U+FFFD inside script values and
results. The worker's lossy decode already keeps log capture going.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to acb254ac509aff244849c09e50a8d39aae185138
This commit updates the EE repository reference after PR #852 was merged in windmill-ee-private.
Previous ee-repo-ref: 9cc330f1a8e80bc075a6ad9839966d3b344f8ddd
New ee-repo-ref: acb254ac509aff244849c09e50a8d39aae185138
Automated by sync-ee-ref workflow.
* fix: share the lossy line decoder with the dedicated worker
Make `decode_output_line` pub(crate) so the dedicated worker (EE) reads
child output through it instead of panicking on a non-UTF-8 line, point
ee-repo-ref at the companion branch, and word two comments as the code
is rather than as it was.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to e5689bf58a125ff46aabb6b5d0f030a7e5c715d3
This commit updates the EE repository reference after PR #855 was merged in windmill-ee-private.
Previous ee-repo-ref: 07bb29070f6419e710c9d167aa7c8553039d6c5b
New ee-repo-ref: e5689bf58a125ff46aabb6b5d0f030a7e5c715d3
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* feat: pause a worker group without stopping its workers
* chore: bump ee ref
* fix: keep dedicated workers running across a pause toggle
* fix: edit a copy of the worker group config in the drawer
* fix: stable priority tag order, keep pause-only configs in the drawer
* fix: keep inherited worker tags when saving from the drawer
* fix: keep an explicit empty tag list when leaving dedicated mode
* fix: keep inherited tags when creating a config from the drawer
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to 6f23819e947b18878000e580ddefccfd01a73166
This commit updates the EE repository reference after PR #853 was merged in windmill-ee-private.
Previous ee-repo-ref: 6cf802bdbe17b4a66757016515044b8a9ef9ef19
New ee-repo-ref: 6f23819e947b18878000e580ddefccfd01a73166
Automated by sync-ee-ref workflow.
* feat: confirm before applying a worker config change that restarts workers
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: pin the ee commit that compiles against main
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: retrigger ci after the github outage dropped the push event
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: pin python lockfile hashes and key the wheel cache by them
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep pinned python cache entries out of reach of unpinned installs
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: scope python cache entries of index-overriding workspaces by hashed id
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep the python cache scope consistent with the index urls read
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: read python index urls and their cache scope from one snapshot
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: drop hash pinning, keep only the workspace scope of the wheel cache
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: resolve pip index urls only after a resolution cache miss
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: faster agent cancel detection, job.canceled event, worker_group span attribute
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: report no unix signal in job.canceled where none is sent
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* refactor: agent workers ping every 5s instead of a 2s read-only cancel check
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: emit job.canceled on windows when the process exits unsignaled
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: pin ee ref with the queue delay gauge main requires
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: type snowflake columns in database manager insert and alter forms
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: scope insert-form type lowercasing to snowflake
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: send snowflake insert-form dates as yyyy-MM-dd
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to acb254ac509aff244849c09e50a8d39aae185138
This commit updates the EE repository reference after PR #852 was merged in windmill-ee-private.
Previous ee-repo-ref: 9cc330f1a8e80bc075a6ad9839966d3b344f8ddd
New ee-repo-ref: acb254ac509aff244849c09e50a8d39aae185138
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* feat: let the flow error handler mark the flow as successful
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: end the flow as a success when an inner error handler recovers
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep the recovery stop to parents that honor it
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to cbda28f632d773fd44e9bef8bea36dcb5e35b55d
This commit updates the EE repository reference after PR #847 was merged in windmill-ee-private.
Previous ee-repo-ref: b5a8e3631f657fbb0a7b4b4ef89ddb9ed2c43b1d
New ee-repo-ref: cbda28f632d773fd44e9bef8bea36dcb5e35b55d
Automated by sync-ee-ref workflow.
* fix: keep skip-failure loops going and mask the recovery flag at its source
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: recover keeps the steps that run and only turns the flow green
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: only the root flow turns green on a recovered failure
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: a flow-chaining error keeps the flow failed after a recovery
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: run AI decision steps on OpenAI's Decisions API
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: fail refused openai decisions and keep structured criteria
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: send only user message lists as openai decision messages
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: omit descriptions the openai decision step does not have
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: pass only exact openai user messages through as decision input
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: check the payload of openai decision message parts
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: strip NUL from ai agent output and job args before jsonb writes
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: also strip NUL from tool call ids and citations
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: count OIDC signatures and reuse server-side tokens
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: update ee ref
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: update ee ref
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: update ee ref
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to cbda28f632d773fd44e9bef8bea36dcb5e35b55d
This commit updates the EE repository reference after PR #847 was merged in windmill-ee-private.
Previous ee-repo-ref: cec12fc52eb1bb5d3f4f4ae489d86a64e96c6c0c
New ee-repo-ref: cbda28f632d773fd44e9bef8bea36dcb5e35b55d
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* fix: honor custom timeout in setup phases and name the limit hit
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: label a shared-deadline phase timeout as the job's remaining budget
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: register dbt deploy jobs so their phase timeout is not called custom
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: python results with a KeyError-raising __getattr__ no longer fail
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep the stream probe on the instance so enum results still serialize
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: probe python results through class dicts, never their __getattr__
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: delete a flow chat turn with its flow run, not its step jobs
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: give flow-written answers and overlapping turns their own flow run
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: stop the pg executor cache from pinning a pooler slot
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* test: retry while the evicted pg backend exits
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: unstick postgres jobs on large results with custom-typed columns
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: carry the parked-rows delivery fix in the postgres fork
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: describe postgres queries before streaming instead of parking rows
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* perf: skip the postgres describe for statements that return no rows
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: look for returning in the whole postgres statement
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: read the leading postgres keyword past nested block comments
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: end leading postgres line comments at CR too
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: add //no_network annotation to deny all network access in native scripts
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: close no_network bypasses (quic dns, header parsing, token, non-native)
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: refuse //no_network on deno regardless of //native, derive disabled ops from deno_net
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* refactor: scope //no_network to native scripts only, drop bun/deno refusal
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: await async main and preprocessor in python scripts
* fix: reuse one event loop per python process for async main
* fix: reuse the event loop a python script sets at import
* docs: clarify python await helper comment
* test(cli): stop CLI tests resolving a just-published windmill-client
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* test: quote the Windows cert path in the pg attach assertion
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* test(cli): note when the windmill-client pin must move
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
