* fix: keep preserve_step_tags on saved branch and loop flow nodes
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* style: format reduce_flow call
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* chore: upgrade the native runtime to the current deno crates and v8 150
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep data and blob fetches working under no_network
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: pin the simdutf v8 archive and keep telemetry on http exporters
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: force the http otlp exporter for native telemetry and pin v8
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: retry transient AI provider failures before output reaches readers
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep completed AI streams, stop retrying prompt blocks, bound retry-after
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: share the AI send-error retry rule between agent and proxy
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: accept a clean end of stream from OpenAI-compatible providers
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: classify AI provider errors the way the reference clients do
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: count a Gemini function call as the end of its turn
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: count an Anthropic stop_reason as the end of its stream
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: accept a Gemini answer that reports usage and no output
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: accept a Gemini stream that closes cleanly with no output
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* feat: let operators compose full-code apps when the workspace grants it
Adds operator_settings.builder_apps, the second builder right, granted
independently of flows because the two are not equally verifiable: a composed
flow is checked in full server-side, while a full-code app is a browser-built
bundle no check can read. The app right rests instead on forced sandbox
isolation, a refusal of Viewer execution mode, and a deploy-time check of every
runnable the app can reach.
BuilderKind arrives with the second kind and is a mandatory argument, so no gate
can mean "either" by accident: one that did would authorize an app write on a
flows-only workspace. The only surfaces reading .any() are the ones that are
genuinely not per-kind, the seat a membership costs and listing drafts.
validate_operator_composed_app checks two surfaces rather than one, because they
are not the same list: the policy's triggerables and the runnableByPath entries
in the app value, which is what the deployed bundle actually resolves against.
Every colon in a triggerable key is a possible split, since execute_component
looks up "<component>:<path>" with an unrestricted component string.
create_app_raw_source stays closed: it compiles caller-supplied sources with a
bundler job on a worker, which is arbitrary code execution. Builders lose
nothing, since the browser and the CLI both bundle locally and deploy through
the multipart endpoints.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Dsf6VC4MVLisiEoeQkgbr4
* fix: list a builder's app drafts and refuse inline code in them
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 6d15ff957df4dcd5129e1ab217eab1a13af62fbb
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: check a builder app as it will be stored
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: show the home list edit button to builder operators
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: pause the raw app preview for an app an operator deployed
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: let app builders save a full-code app's deploy settings
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: record the builder app settings path, public apps and the editor preview
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: cache the merged EE seat usage query
The EE query now reads audit_partitioned and skips service accounts, so the
cached entry for its builder_apps predicate no longer matched and offline EE
builds failed with no cached data.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: pause the raw app preview for loaded drafts and unknown authors
A draft loaded from an operator ran in the viewer's preview because the pause
only checked the app's last deployer, and an author no longer in the workspace
read as a developer. The pause now checks a loaded draft's owner, records it
in the viewer's draft until the preview is run or deployed, and holds when the
author cannot be found.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: name guest apps among the modes a builder may deploy
Guest runs as the publisher with no Viewer fallback, like Publisher and
Anonymous, and RestrictGuestAppDeployment refuses it per workspace.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep a loaded draft's preview paused in AI sessions and chat edits
The session draft codec and the chat's draft save dropped loaded_from, so
opening a paused operator draft in an AI session, or editing it through the
chat, ran it with the viewer's session.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: pin builder refusals for low-code apps and unreviewed previews
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep the operator mark when loading a developer's copy of a draft
Loading another user's draft recorded only who saved it, so a developer's
copy of an operator draft they never previewed opened unpaused for the next
person who loaded it, running the operator's code with their session.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: let builders restore a full-code app from deployment history
Restore always sends allow_kind_change, which the builder check refused even
for a full-code version restored over a full-code app. Builders now drop the
flag, so the locked kind check still refuses an actual conversion.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* style: rustfmt the builder checks in jobs.rs
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: record the builder kind-check race as an accepted risk
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: never trust the owner name a loaded draft carries
A loaded draft's loaded_from is written by its owner, so an operator could
name a developer, or leave it empty, and the next person to load the draft
previewed it unpaused. A loaded draft that carries any mark now stays
paused as unattributable; an unmarked one is still checked against its
real owner.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: record viewer-supplied resources in builder apps as an accepted risk
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: say that the app right lets operators write frontend code
The settings section and the docs told admins builder operators "still
cannot write code", but the app right has them write the app's frontend
bundle. Only backend code stays out of reach.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: state the raw-source closure once and drop an unreachable preview case
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* perf: look up only the author when deciding whether to pause the preview
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: pin that the app right alone bills operators as developers
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: point ee-repo-ref at the EE seat test
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: drop the editor preview pause now that sandboxed apps preview isolated
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: refuse a builder operator's app draft without the sandbox
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: turn the sandbox on when a builder operator opens the app editor
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: refuse builder app drafts naming runnables they cannot read
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: note the editor preview asks before minting a builder app token
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: trim the builder app check comments to the constraints
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: refuse an app runnable whose runType is not script, flow or hub
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: check builder app draft policy keys like a deploy does
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: count main's half-seat service accounts in the builder billing test
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: name the builder policy check for drafts as well as deploys
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: let a builder app draft autosave with a stale triggerables_v2
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: check the script version a builder app would run, not any version
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: refuse viewer mode in a builder app draft as on deploy
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: hold builder app drafts and deploys to one check
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: say a builder's script may not have finished deploying
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: cap builder app triggerable keys before reading every colon split
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: refuse a builder app draft that runs as someone else
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: conform builder app drafts saved by the AI chat as the editor does
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: record that a deployed builder draft runs as its deployer
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: refuse builder app runnables not written as plain text
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: a builder draft may carry its builder's own run identity
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: offer builders Start with AI only when it opens a session
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: name full-code apps in the builder rights confirmation
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: name only the granted builder rights in the confirmation
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: note a wm_deployers builder may keep another run identity
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: give builders a starter app that calls no missing runnables
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: seed the builder starter under the picker for builders
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: qualify the builder run identity comment for wm_deployers
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: resolve builder app script hashes before opening the RLS transaction
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: run the builder app tests serially to share the rights cache safely
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: give builders the builder starter on a fresh editor load
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: drop a new-app load overtaken while waiting for the workspace list
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep main's 401 for operators previewing without the app right
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 5d7726c4979070ee8db4fb9e8014152872a641ba
This commit updates the EE repository reference after PR #816 was merged in windmill-ee-private.
Previous ee-repo-ref: 7151060bfc02908e97d9344b3820ee33a4951322
New ee-repo-ref: 5d7726c4979070ee8db4fb9e8014152872a641ba
Automated by sync-ee-ref workflow.
* refactor: let the app row's edit button trust its write flag
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: point ee-repo-ref at the merged EE companion
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: note the session raw-app editor does not conform builder drafts yet
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: stop offering deno for new scripts and ship it only on full images
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep deno in the integration test worker and narrow the missing-deno error
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep deno selectable on existing deno scripts when the saved order omits it
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: drop the deno workloads from the benchmark suite
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: run bun instead of deno in tests that are not about the deno runtime
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: drop the deno cases from the integration suite
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: update the app policy hash for the bun inline script
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: add a jobs:run:dependencies token scope for lock generation
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: pin lock-job reads to the dependencies scope
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: align scope labels with and without a restrict paths button
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: match a lock job's stored path literally on job reads
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: drop the dependency-lock warning from the jobs scope heading
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KNiYsRRDyvkRYwkHda6uyf
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: sync hub resource types daily from the server
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: retire the legacy hub_sync script and its schedule
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: sync only from the hub on the daily schedule
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: sync resource types through the endpoint in e2e setup
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: honor ACCEPT_INVALID_CERTS in the hub resource type sync
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: audit manual hub resource type syncs that change types
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: show the AI step's resource type sync as a setting card
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep the hub_sync opt-out and move sync state to task state
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: hold the daily hub sync until the legacy hub_sync is retired
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: turn off the daily sync when an edited hub_sync is scheduled
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: make the daily hub resource type sync opt-in
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: bring back the setup wizard's daily resource type sync toggle
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: apply the image's resource types on every SYNC_CACHED_RT start
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: let workspace admins delete another user's draft
* feat: delete every draft at a path when no username is given
* fix: leave the editor cleanly after deleting the last draft at a path
* fix: drain autosave before a path-wide draft delete
* fix: resume a parked autosave when a path-wide draft delete fails
* fix: advertise the actual signing algorithm in OIDC discovery
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 5f5d03a47e58d1ea1e3970ad141ec24bd6c5f068
This commit updates the EE repository reference after PR #867 was merged in windmill-ee-private.
Previous ee-repo-ref: 35b86ab80275397d9196fd80ec70befac5afd0fa
New ee-repo-ref: 5f5d03a47e58d1ea1e3970ad141ec24bd6c5f068
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* fix: set WM_END_USER_EMAIL on direct script and flow runs
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: pass the end user to workflow-as-code tasks
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: describe when WM_END_USER_EMAIL is set
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: pin the end user a job token passes on
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: export worker cpu, memory and occupancy metrics
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: refresh the exported memory limit with the cgroup readings
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: per-script resource rollup and heaviest scripts table
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: pin the companion ee commit and drop job cpu entries on every exit
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: count the cpu time of suspended workflow rounds
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: count suspended workflow rounds' runtime and guard empty averages
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* perf: flush the runnable rollup hourly in key order and drop its workspace fk
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: order the rollup upsert in sql and sweep rows of deleted workspaces
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* perf: keep the rollup orphan sweep on a primary key range
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to a1c00d73a05f227a61d2bf37cc86cd9f5bb1777a
This commit updates the EE repository reference after PR #866 was merged in windmill-ee-private.
Previous ee-repo-ref: c6bcb1bbb5a7e85e870f9de232a0ad1540acf2bd
New ee-repo-ref: a1c00d73a05f227a61d2bf37cc86cd9f5bb1777a
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* fix(python): map pptx, OpenSSL, win32api, ruamel, speech_recognition imports
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: drop import mapping parser test
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: add an api base url instance setting for displayed urls
* feat: show the api base url as cli remote, keep mcp url on origin
* fix: keep push captures on origin and load the api base url on svix page
* fix: reject shell metacharacters in webhook and api base urls
* test: drop the trivial api base url resolver test
* feat: hide the api base url setting behind a toggle
* fix: let the quick setup toggle reveal the api base url field
* chore: update ee-repo-ref to 017710bdd0a10de857f0f40800dde238cdb1ad24
This commit updates the EE repository reference after PR #863 was merged in windmill-ee-private.
Previous ee-repo-ref: f67cd621bd45840e6389e0469a67378864f269a0
New ee-repo-ref: 017710bdd0a10de857f0f40800dde238cdb1ad24
Automated by sync-ee-ref workflow.
---------
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: export worker cpu, memory and occupancy metrics
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: refresh the exported memory limit with the cgroup readings
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to e128a9b9bedd0b6a46d355b69db13bf8f650c4e6
This commit updates the EE repository reference after PR #864 was merged in windmill-ee-private.
Previous ee-repo-ref: b286a486c69e74ec0742a2aac9d4cb1161eb0c6b
New ee-repo-ref: e128a9b9bedd0b6a46d355b69db13bf8f650c4e6
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* fix: store a workflow-as-code parent's first start and wall duration
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep a parked child's first start in its parent's timeline
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: record a parked step with its whole span in the flow, cover inline checkpoints
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to ab8476e5feedc98b727f7d83acffa1807b3b9c5b
This commit updates the EE repository reference after PR #861 was merged in windmill-ee-private.
Previous ee-repo-ref: d5d95f51bb175944874e585e5931acb1eddd637a
New ee-repo-ref: ab8476e5feedc98b727f7d83acffa1807b3b9c5b
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* fix: send hub script completions to the workspace handlers
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to a37413ccdd52e65bc240bad3e87084bf4100e119
This commit updates the EE repository reference after PR #858 was merged in windmill-ee-private.
Previous ee-repo-ref: 6e48f2012d73a6ef22130f4e28b987526b9c1057
New ee-repo-ref: a37413ccdd52e65bc240bad3e87084bf4100e119
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* fix: upload volume files rewritten to the same size
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: never match a volume file stamp with an unreadable change time
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: bump ee ref
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 127575148c84bb6132d2946c0a95c6dea0f58bb2
This commit updates the EE repository reference after PR #860 was merged in windmill-ee-private.
Previous ee-repo-ref: e06755ddd48c834e75537cf44da017fdc3a9585b
New ee-repo-ref: 127575148c84bb6132d2946c0a95c6dea0f58bb2
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: let a job see that its worker is draining
* fix: gate worker draining check on job visibility and export sdk helper
* fix: keep draining across re-registration and ignore parked jobs
* fix: reset draining only on worker startup registration
* chore: update ee-repo-ref to 55feb2e84332179faa4e17aeb419f7f480df79a6
This commit updates the EE repository reference after PR #857 was merged in windmill-ee-private.
Previous ee-repo-ref: e5010fa046a3aba93595d1bf44eb6a0cef2b5273
New ee-repo-ref: 55feb2e84332179faa4e17aeb419f7f480df79a6
Automated by sync-ee-ref workflow.
---------
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* perf: load public raw apps without the loading screen
* fix: keep license store and drop stale prefetches on public app pages
* fix: answer raw app requests with an error when the job bridge fails to load
---------
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* fix: keep capturing job logs after a non-UTF-8 output line
The worker read child stdout/stderr with `lines()`, which errors on a line that
is not valid UTF-8; handle_child then logged "error reading output" and stopped
capturing logs for the rest of the job. Read raw segments and decode lossily
instead, so a bad byte becomes U+FFFD and later lines still arrive.
PowerShell on Windows writes redirected output in the console code page
(e.g. CP850), so any umlaut triggered this. Set [Console]::OutputEncoding and
$OutputEncoding to UTF-8 in wrapper.ps1 so pwsh output is UTF-8 on every OS.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: state the pwsh encoding constraint without history
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep pwsh's native-command decoding on the console code page
Forcing [Console]::OutputEncoding to UTF-8 also changes how pwsh decodes
native-command output captured into variables, turning OEM-encoded
characters from legacy tools into U+FFFD inside script values and
results. The worker's lossy decode already keeps log capture going.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to acb254ac509aff244849c09e50a8d39aae185138
This commit updates the EE repository reference after PR #852 was merged in windmill-ee-private.
Previous ee-repo-ref: 9cc330f1a8e80bc075a6ad9839966d3b344f8ddd
New ee-repo-ref: acb254ac509aff244849c09e50a8d39aae185138
Automated by sync-ee-ref workflow.
* fix: share the lossy line decoder with the dedicated worker
Make `decode_output_line` pub(crate) so the dedicated worker (EE) reads
child output through it instead of panicking on a non-UTF-8 line, point
ee-repo-ref at the companion branch, and word two comments as the code
is rather than as it was.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to e5689bf58a125ff46aabb6b5d0f030a7e5c715d3
This commit updates the EE repository reference after PR #855 was merged in windmill-ee-private.
Previous ee-repo-ref: 07bb29070f6419e710c9d167aa7c8553039d6c5b
New ee-repo-ref: e5689bf58a125ff46aabb6b5d0f030a7e5c715d3
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* feat: add retry to runScriptByPathAsync and runScriptByHashAsync
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: refuse retry with invisible_to_owner and keep the parent priority bump
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: refuse retry when a preprocessor would run and export the options type on jsr
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep the dispatching job as parent of a retried run
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: cancel pending native retries with their caller and stop the chain on cancel
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: describe exponential retry as multiplier × seconds^attempt in openflow schema
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: update folded exponential retry description in openapi-deref.yaml
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: phrase exponential retry summary per n-th retry, matching seconds field
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to acb254ac509aff244849c09e50a8d39aae185138
This commit updates the EE repository reference after PR #852 was merged in windmill-ee-private.
Previous ee-repo-ref: 9cc330f1a8e80bc075a6ad9839966d3b344f8ddd
New ee-repo-ref: acb254ac509aff244849c09e50a8d39aae185138
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* feat: improve data table roles and grants UX
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep selected bordered badges the same height as unselected ones
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: refuse taking over roles with members and test grant statements
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep grant filter chips while a filter is set
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: check a taken-over role can log in with the new password
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: select several grant filter tags at once
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: explain where schema and table permissions are set
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep the grant create row on one line
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: show grants as a role and its privileges
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: show grants in a table with role, privileges and scope
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: hide the grant scope when it can only be the object itself
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: grant schema usage along with grants inside the schema
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: confirm before closing the roles drawer with unsaved changes
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to c4002f777f56d90bb0471164291889850c85179d
This commit updates the EE repository reference after PR #848 was merged in windmill-ee-private.
Previous ee-repo-ref: 7937634a52d04caeb083da94e189705cd00796b3
New ee-repo-ref: c4002f777f56d90bb0471164291889850c85179d
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: pause a worker group without stopping its workers
* chore: bump ee ref
* fix: keep dedicated workers running across a pause toggle
* fix: edit a copy of the worker group config in the drawer
* fix: stable priority tag order, keep pause-only configs in the drawer
* fix: keep inherited worker tags when saving from the drawer
* fix: keep an explicit empty tag list when leaving dedicated mode
* fix: keep inherited tags when creating a config from the drawer
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to 6f23819e947b18878000e580ddefccfd01a73166
This commit updates the EE repository reference after PR #853 was merged in windmill-ee-private.
Previous ee-repo-ref: 6cf802bdbe17b4a66757016515044b8a9ef9ef19
New ee-repo-ref: 6f23819e947b18878000e580ddefccfd01a73166
Automated by sync-ee-ref workflow.
* feat: confirm before applying a worker config change that restarts workers
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: pin the ee commit that compiles against main
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: retrigger ci after the github outage dropped the push event
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: pin python lockfile hashes and key the wheel cache by them
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep pinned python cache entries out of reach of unpinned installs
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: scope python cache entries of index-overriding workspaces by hashed id
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep the python cache scope consistent with the index urls read
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: read python index urls and their cache scope from one snapshot
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: drop hash pinning, keep only the workspace scope of the wheel cache
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: resolve pip index urls only after a resolution cache miss
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: faster agent cancel detection, job.canceled event, worker_group span attribute
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: report no unix signal in job.canceled where none is sent
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* refactor: agent workers ping every 5s instead of a 2s read-only cancel check
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: emit job.canceled on windows when the process exits unsignaled
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: pin ee ref with the queue delay gauge main requires
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: type snowflake columns in database manager insert and alter forms
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: scope insert-form type lowercasing to snowflake
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: send snowflake insert-form dates as yyyy-MM-dd
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to acb254ac509aff244849c09e50a8d39aae185138
This commit updates the EE repository reference after PR #852 was merged in windmill-ee-private.
Previous ee-repo-ref: 9cc330f1a8e80bc075a6ad9839966d3b344f8ddd
New ee-repo-ref: acb254ac509aff244849c09e50a8d39aae185138
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* feat: let the flow error handler mark the flow as successful
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: end the flow as a success when an inner error handler recovers
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep the recovery stop to parents that honor it
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to cbda28f632d773fd44e9bef8bea36dcb5e35b55d
This commit updates the EE repository reference after PR #847 was merged in windmill-ee-private.
Previous ee-repo-ref: b5a8e3631f657fbb0a7b4b4ef89ddb9ed2c43b1d
New ee-repo-ref: cbda28f632d773fd44e9bef8bea36dcb5e35b55d
Automated by sync-ee-ref workflow.
* fix: keep skip-failure loops going and mask the recovery flag at its source
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: recover keeps the steps that run and only turns the flow green
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: only the root flow turns green on a recovered failure
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: a flow-chaining error keeps the flow failed after a recovery
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: export queue delay as OTel and Prometheus metrics
* chore: update ee-repo-ref to afd5f322346baee24d9402ca18a95de29d5c2fde
This commit updates the EE repository reference after PR #850 was merged in windmill-ee-private.
Previous ee-repo-ref: 450df01188ce0cfef1165bf5334bb34c26b921ee
New ee-repo-ref: afd5f322346baee24d9402ca18a95de29d5c2fde
Automated by sync-ee-ref workflow.
---------
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* feat: audit instance settings writes and bulk job cancels
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: audit each setting of a bulk save as it is written
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to acb254ac509aff244849c09e50a8d39aae185138
This commit updates the EE repository reference after PR #852 was merged in windmill-ee-private.
Previous ee-repo-ref: 3dfc563bc95881183fb6c49d39984023b9b83075
New ee-repo-ref: acb254ac509aff244849c09e50a8d39aae185138
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: run AI decision steps on OpenAI's Decisions API
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: fail refused openai decisions and keep structured criteria
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: send only user message lists as openai decision messages
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: omit descriptions the openai decision step does not have
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: pass only exact openai user messages through as decision input
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: check the payload of openai decision message parts
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: concurrency limit over-admits when the counter row is missing
* chore: bump ee ref
* fix: restore sqlx entry for the locked counter read and bump ee ref
* feat: isolate the raw-app editor preview when the app opts into sandboxing
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: gate job reads from a sandboxed editor preview like the deployed app
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: send a plain user in a sandboxed raw app's startup message
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: pin ui_builder to d3fdb70
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: strip NUL from ai agent output and job args before jsonb writes
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: also strip NUL from tool call ids and citations
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: count OIDC signatures and reuse server-side tokens
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: update ee ref
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: update ee ref
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: update ee ref
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to cbda28f632d773fd44e9bef8bea36dcb5e35b55d
This commit updates the EE repository reference after PR #847 was merged in windmill-ee-private.
Previous ee-repo-ref: cec12fc52eb1bb5d3f4f4ae489d86a64e96c6c0c
New ee-repo-ref: cbda28f632d773fd44e9bef8bea36dcb5e35b55d
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: refuse unscoped tokens of restricted jobs, add OIDC scopes claim
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep restricted job_perms rows by a stamp that survives retention
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: log refused unscoped job tokens at warn
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: key the unrestricted cache by token, keep restricted rows on bulk delete
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: clear a sweep stamp raced onto a queued job
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: stamp restricted job_perms rows under a row lock
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* test: give the memo test's job token scopes
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* refactor: keep only the OIDC claim, drop the server-side refusal
A relying party can already tell a restricted job from the claim, which is
absent when the presented token carries no scopes. The auth-layer refusal,
its lookup cache and the job_perms retention it needed are removed.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to 065c2c64c3904d5c0b2766b424210d34f9e54d2d
This commit updates the EE repository reference after PR #845 was merged in windmill-ee-private.
Previous ee-repo-ref: ea5354477cdf281598a816a5e16ad1f476d42afb
New ee-repo-ref: 065c2c64c3904d5c0b2766b424210d34f9e54d2d
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Ruben FiszelandClaude Opus 5.5
Alexander PetricandClaude Opus 5.5
Diego ImbertandRuben Fiszel
