* refactor: extract windmill-api-scripts and windmill-api-users subcrates
Split the monolithic windmill-api crate by extracting scripts.rs, flows.rs,
users.rs, and users_oss.rs into dedicated subcrates. This reduces incremental
rebuild times when editing these modules.
Changes:
- Create windmill-api-scripts crate (scripts.rs + flows.rs, ~4.3K lines)
- Create windmill-api-users crate (users.rs + users_oss.rs, ~2.4K lines)
- Move clear_schedule to windmill-queue (shared by scripts, flows, workspaces)
- Move username utilities (VALID_USERNAME, INVALID_USERNAME_CHARS,
generate_instance_wide_unique_username) to windmill-common/src/usernames.rs
- Move COOKIE_DOMAIN, IS_SECURE, WithStarredInfoQuery, BulkDeleteRequest,
WebhookShared to windmill-common for cross-crate access
- Original files in windmill-api become thin stubs with pub use re-exports
- EE-dependent route handlers remain in windmill-api (create_user, rename_user,
set_password, reset_password, etc.)
- Feature forwarding for enterprise, private, parquet, no_auth
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* refactor: extract windmill-api-workspaces subcrate (Step 3)
Move workspaces.rs, workspaces_extra.rs, workspaces_oss.rs, and
workspaces_ee.rs into a new windmill-api-workspaces crate (~7K lines).
Routes that depend on windmill-api internals (AI copilot, teams,
tarball export, critical alerts, stripe) remain in the windmill-api
stub. The subcrate handles all other workspace management routes.
Also moved send_email_if_possible to windmill-common/email_oss.rs
to make it available across subcrates without circular deps.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* all
* refactor: extract windmill-api-groups subcrate (groups.rs + folders.rs)
Extract groups.rs (1,093 lines) and folders.rs (833 lines) into a new
windmill-api-groups subcrate. Both modules had clean dependencies on
already-extracted crates (windmill-api-auth, windmill-common,
windmill-api-workspaces). Also removes unused re-exports of
get_instance_username_or_create_pending and INVALID_USERNAME_CHARS
from windmill-api/src/utils.rs.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* refactor: add granular_acls.rs and folder_history.rs to windmill-api-groups
Extract granular_acls.rs (395 lines) and folder_history.rs (68 lines) into
the windmill-api-groups subcrate. Both modules only depend on already-extracted
crates and belong to the same access-control domain as groups and folders.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: remove unused imports and dead code from subcrate extraction
- Remove unused BASE_URL import from lib.rs
- Remove workspaces_extra.rs and workspaces_oss.rs re-export stubs (no consumers in windmill-api)
- Remove dead send_email_if_possible OSS stub (callers moved to windmill-api-users)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* all
* chore: bust CI cargo cache for subcrate split
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: re-export BASE_URL for EE files that use crate::BASE_URL
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: forward no_auth feature to windmill-api-users, remove dead code
- Add "windmill-api-users/no_auth" to windmill-api's no_auth feature
so the login bypass in users.rs:1600 activates correctly
- Remove dead send_email_if_possible from windmill-api-users/users_oss.rs
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore: re-enable cargo cache for backend tests
Cache was disabled to bust stale entries from before subcrate split.
Now that a clean build has run, re-enable for faster CI.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore: install mold+clang in CI workflows
The .cargo/config.toml uses mold linker for x86_64-linux.
Build scripts require linking even during cargo check.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore: increase cargo test timeout to 30 min
Exit code 143 (SIGTERM) means the 20-min timeout was hit during
compilation without cache. Bump to 30 min as safety net.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: limit cargo build jobs to 4 to prevent OOM in CI
Exit code 143 (SIGTERM) after 8 min = OOM kill during compilation.
8 parallel LLVM codegen jobs exhaust memory on ubicloud-standard-8.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* refactor: isolate deno_core into windmill-runtime-nativets subcrate
Remove deno_core from flow eval and isolate nativets V8 runtime into a
dedicated subcrate so deno_core compilation no longer blocks
windmill-worker or windmill-api.
- Create windmill-jseval crate: QuickJS-based JS eval for flow
expressions and batch rerun, extracted from windmill-worker
- Create windmill-runtime-nativets crate: all deno_core/V8 deps and
nativets script execution, with build.rs snapshot generation
- Simplify windmill-worker: remove all deno_* direct deps, empty
build.rs, gate nativets behind optional dep
- Update windmill-api: use windmill-jseval for batch rerun instead of
deno_core, remove deno_core feature entirely
- Add nativets integration tests (nativets_jobs.rs) and parallel
stress test (nativets_stress.rs, 8 workers x 200 jobs)
- Remove dead code: deno flow eval path, USE_QUICKJS env var,
parity tests (replaced with 63 standalone expected-value tests)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: address PR review feedback for deno_core isolation
- Deduplicate unsafe_raw() into windmill-common/src/utils.rs (single source)
- Delete orphaned runtime.js and windmill-client.js from windmill-worker/src/
- Fix operator precedence in windmill-jseval with explicit parentheses
- Remove unnecessary return keyword in heap limit callback
- Remove redundant as usize casts
- Remove ~150 lines of commented-out code from runtime.js
- Remove commented-out #[cfg] in build.rs
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* otel ee
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* refactor: make aws-config and related deps optional in windmill-common
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: gate python version listing on inline_preview feature
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* refactor: extract windmill-dep-map crate for parallel api/worker compilation
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: resolve WebhookShared type mismatch and missing enterprise propagation
- Make windmill-api webhook_util re-export from windmill-common instead of
duplicating types, fixing Extension<WebhookShared> mismatch between
windmill-store and windmill-api
- Add windmill-api-jobs/enterprise to windmill-trigger enterprise feature
so check_license_key_valid is available when trigger subcrates enable
enterprise on windmill-trigger
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: stop trigger features from unconditionally enabling enterprise
Move enterprise propagation for all trigger subcrates from individual
trigger feature definitions to the enterprise feature itself, so
enterprise is only enabled when explicitly requested.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* refactor: remove unused pub use re-exports and disable CI cargo cache
- Remove unused re-exports from windmill-worker/src/lib.rs:
trigger_dependents_to_recompute_dependencies, handle_job_error,
and unused bun/otel items
- Fix callers to use direct module paths instead
- Add windmill-dep-map as dev-dependency for tests
- Disable cargo cache in backend-check CI (faster from-scratch builds)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: restore bun re-exports used by tests
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* all
* chore: re-enable cargo cache for check_ee_full CI job
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* refactor: extract windmill-api into 4 subcrates (api-auth, store, api-sse, api-jobs)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* refactor: eliminate refresh_token OnceLock bridge in windmill-store
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* refactor: eliminate FromRequestParts OnceLock bridge in windmill-api-auth
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* refactor: wire subcrates into workspace and clean up unused re-exports
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: resolve cargo check --all-features errors in subcrate wiring
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* sqlx
* all
* chore: update ee-repo-ref for warning fixes
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* refactor: extract windmill-trigger crate and expand windmill-api-jobs
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* refactor: extract windmill-trigger-kafka crate from windmill-api
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* refactor: extract windmill-trigger-postgres crate from windmill-api
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* refactor: extract windmill-trigger-websocket and windmill-trigger-mqtt crates
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* refactor: extract windmill-trigger-nats, sqs, gcp, and email crates
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* refactor: extract windmill-trigger-http crate from windmill-api
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* refactor: move token creation and permission helpers to windmill-api-auth
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* refactor: extract windmill-native-triggers crate from windmill-api
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* sqlx
* all
* refactor: extract windmill-api-embeddings crate and fix CI warnings
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: resolve type mismatch in oauth2_oss and remaining warnings
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: use correct HTTP_CLIENT config in embeddings crate (30s timeout, cert override)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* all
* fix: gate oauth_refresh_ee on oauth2 feature to fix warnings
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* all
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* fix: move live index migrations to regular SQL migration
Live migrations that create indexes can fail on fresh installs because
they run from compiled code that may reference enum values no longer
present after rename migrations. Move all 16 index-related live
migrations into a regular SQL migration that runs during schema setup,
making fresh installs reliable. Existing installs skip the migration
via windmill_migrations check.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: remove useless windmill_migrations inserts
The live migration code that checked these names has been removed,
so inserting them serves no purpose.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: remove unnecessary DO block from migration
All statements are already idempotent via IF EXISTS / IF NOT EXISTS,
so the PL/pgSQL wrapper with its early return check is not needed.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* Add frontend for the workspace proctection rules
* api to add and update workspace protection rules
* Fix bypasser selection
* Fix Select bug on refocus
* Change rulesets to use bitflags
* Messages for protection rules errors
* claude remove ui for rules
* Hide edit buttons when rule
* No edit refactor pt1
* Update edit buttons to be disabled when rule is active
* Merge deploy ui and rulsets in one tab
* Remove not cleaned line in migration
* multiple fixes
* Remove old protection rule logic
* Add prrotection rule for deploying through Merge UI
* Add Alert on legacy Deploy UI
* Add backend enforcing of workspace rules
* Finish backend blocking on rulsets
* Last changes to api ruleset blocks
* Prepare sqlx
* Remove unused import and argument
* Update SQLx metadata
* fix npm run check
* Re trigger CI
---------
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* Refactor 1
* claude tmp1
* fixes1
* support for insert and update
* Fix returning
* docs: add nuanced mutex selection guidance to Rust backend skill (#7737)
Add "Mutex Selection in Async Code" section explaining when to use
std::sync::Mutex vs tokio::sync::Mutex based on official Tokio docs.
std::sync::Mutex is preferred for data protection as it's faster;
tokio::sync::Mutex only needed when holding locks across .await points.
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* fix(cli): revert findCodebase change that broke ../shared codebases (#7740)
* fix(cli): revert findCodebase relative_path check that broke ../shared codebases
The previous change added a check to ensure script paths start with the
codebase's relative_path. However, this broke cases where relative_path
uses parent directory references (e.g., "../shared") because:
1. path.join normalizes paths, so "/project/../shared/f/script.ts" becomes
"/shared/f/script.ts"
2. FSFSElement strips the cwd prefix, resulting in "f/script.ts"
3. The check "f/script.ts".startsWith("../shared/") failed
The original behavior was correct - relative_path indicates where to find
codebase files, while includes/excludes patterns match against the normalized
paths that get passed during sync.
Fixes regression reported in #7729 comments.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* test(cli): add preview test for codebase with imports
Tests that codebase bundling correctly includes imported modules,
which is the key functionality needed for ../shared codebases.
The test creates a helper module and a main script that imports
from it, then verifies the bundled script executes correctly.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* chore(main): release 1.621.2 (#7735)
* chore(main): release 1.621.2
* Apply automatic changes
---------
Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com>
* feat: workspace dedicated workers (#7741)
* feat: workspace dedicated workers
* ref
* chore: update ee-repo-ref to a18ac31062ac092cb9a5fc87629e217d97f4911d
This commit updates the EE repository reference after PR #398 was merged in windmill-ee-private.
Previous ee-repo-ref: 98cfe3fef764d9d815d326d5056c734a03689d33
New ee-repo-ref: a18ac31062ac092cb9a5fc87629e217d97f4911d
Automated by sync-ee-ref workflow.
* fix(frontend): workspace script in flow steps
---------
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* fix: remove uuid-ossp extension requirement for RDS compatibility
The uuid-ossp extension was created in the first migration but never
actually used - the codebase uses gen_random_uuid() which is built-in
to PostgreSQL 13+. This allows Windmill to run on AWS RDS where
application users may not have CREATE SCHEMA privileges.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: indexer build error (#7744)
* fix: indexer build error
* prepare sqlx
* Remove changes from Cargo.toml
* refactor: remove seed parameter from AI chat completions (#7745)
* better claude
* refactor: remove seed parameter from AI chat completions
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* fix: visibility bug on deployment UI (issue when renaming items) + add tracking of folders and resource types (#7739)
* fix: Raw apps deployment UI (and merge UI)
* Add folders and resource tpyes to merge UI
* claude first pass on adding the new arg for h_deploy_metadata
* Add missing argument to handle_deployment_metadata in all its calls
* Add support for folders and resource types in merge UI
* Update eereporef for CI
* Update ee repo
* Add migration to reset cached diff with potential artifacts
* fix type in frontend
* Preapare sqlx
* Remove unused import and logs
* update ee-repo
* Update eerepo
* chore: update ee-repo-ref to aca38475afd2cafaf63f4bbffc65be9437d57d86
This commit updates the EE repository reference after PR #397 was merged in windmill-ee-private.
Previous ee-repo-ref: 19c64cf8c61d83f45047b37660054b29658cd403
New ee-repo-ref: aca38475afd2cafaf63f4bbffc65be9437d57d86
Automated by sync-ee-ref workflow.
* Make integration test for workspace comparisons
* Update SQLx metadata
---------
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* fix: require AGENT_TOKEN and BASE_INTERNAL_URL for agent mode
- Add AgentConfig struct to validate required env vars on startup
- Change build_agent_http_client to require explicit token and URL
- Remove DEFAULT_BASE_INTERNAL_URL fallback (no more silent localhost:8000)
- Exit immediately if agent cannot connect to server on initial load
- Update integration tests to use dynamic port for BASE_INTERNAL_URL
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: forward teams error to client (#7746)
* fix: forward teams error to client
* chore: update ee-repo-ref to 9a3d71f2c6a41ed4d17111a8c05d8e1d4933898d
This commit updates the EE repository reference after PR #400 was merged in windmill-ee-private.
Previous ee-repo-ref: 25d35a8de1cd70e281dc876e51cd30402580b5c0
New ee-repo-ref: 9a3d71f2c6a41ed4d17111a8c05d8e1d4933898d
Automated by sync-ee-ref workflow.
* fix
* fix
* fix
* al
* sqlx
* sqlx
* all
* all
---------
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* feat: add token usage tracking to AI agent output (#7738)
* feat: add token usage tracking to AI agent output
Add TokenUsage struct to track input/output/cache tokens from AI providers.
Currently implemented for Bedrock provider, with infrastructure in place
for other providers. Usage is included in the AI agent result alongside
output and messages when available.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat: add token usage extraction for Anthropic provider
Extract usage from message_delta SSE event and convert to TokenUsage.
Includes input_tokens, output_tokens, cache_read_input_tokens, and
cache_creation_input_tokens (mapped to cache_write_input_tokens).
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat: add token usage extraction for Google AI/Gemini provider
Extract usage from usageMetadata in Gemini SSE events and convert to TokenUsage.
Maps promptTokenCount -> input_tokens, candidatesTokenCount -> output_tokens,
totalTokenCount -> total_tokens.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat: add token usage extraction for OpenAI Responses API provider
Extract usage from response.completed SSE event and convert to TokenUsage.
Maps input_tokens, output_tokens, and total_tokens directly.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat: add token usage extraction for Azure OpenAI / Chat Completions API
Add stream_options.include_usage to request and parse usage from final
SSE chunk for providers using the standard OpenAI Chat Completions API
(Azure OpenAI, Mistral, DeepSeek, Groq, TogetherAI, CustomAI).
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: cleanup token usage tracking - remove unused Image usage field and accumulate across iterations
- Remove unused `usage` field from ParsedResponse::Image variant
- Add TokenUsage::accumulate() method to sum usage across agent iterations
- Accumulate input/output/total/cache tokens instead of replacing with last iteration
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* fix: remove verbose debug logging from AI providers
Remove tracing::info!("[debug] ...") statements that were too verbose
for production. These logged raw events on every streaming event.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* feat: add retry mechanism for OpenAI-compatible providers without stream_options support
Some OpenAI-compatible providers don't support the stream_options parameter
for usage tracking. This adds a retry mechanism that:
- First attempts the request with stream_options.include_usage
- If it fails with 400 and error mentions stream_options/include_usage,
automatically retries without the parameter
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* fix: remove unnecessary text parsing overhead in image response handlers
Revert debugging changes that read response as text before parsing JSON.
Using response.json() directly is more efficient.
Co-Authored-By: Claude <noreply@anthropic.com>
* refactor: centralize TokenUsage conversion with constructor methods
Add new(), from_input_output(), and with_cache() constructors to TokenUsage
to eliminate duplicate conversion logic across providers. Also fixes potential
truncation in Bedrock cache token conversion by using i32::try_from with
fallback to i32::MAX.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* refactor: simplify Anthropic usage extraction and add Default derive
- Use idiomatic `if let` pattern instead of `is_some()` check for usage extraction
- Add Default derive to OpenAIChatUsage for consistency with other usage structs
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: use saturating_add to prevent overflow in token accumulation
In long-running agents with many iterations, token counts could
potentially overflow. Using saturating_add ensures values cap at
i32::MAX instead of wrapping around.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* better claude
* nit
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* chore(main): release 1.622.0 (#7742)
* chore(main): release 1.622.0
* Apply automatic changes
---------
Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com>
* fix npm check
* fix: add schema compatibility layer for MCP clients like n8n (#7747)
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* nit ui nextcloud triggers (#7749)
* feat: add PocketID OAuth provider support (#7318)
* feat(oauth): add Pocket-ID OAuth provider component
- Implements PocketIdSetting.svelte following Keycloak pattern
- Configures OIDC endpoints for Pocket-ID (/authorize, /api/oidc/*)
- Supports standard OIDC scopes (openid, profile, email)
- Uses passkey-only authentication via Pocket-ID
Refs #5678
* feat(oauth): register Pocket-ID in SSO provider list
- Import PocketIdSetting component
- Add Pocket-ID to provider list in SSO tab
- Update exclusion filter to prevent duplicate custom entries
Refs #5678
* fix(oauth): add missing PocketID icon and fix component integration
- Create PocketIdIcon.svelte component with user profile icon
- Register pocket-id in APP_TO_ICON_COMPONENT mapping
- Fix PocketIdSetting to use IconedResourceType pattern matching other OAuth providers
This resolves the issue where PocketID toggle was not appearing in SSO settings.
Refs #5678
* refactor: migrate PocketIdSetting to Svelte 5 runes syntax
- Use $props() with $bindable() for reactive prop binding
- Use $state() for local reactive state
- Use $derived() for computed values
- Use $effect() for reactive side effects
- Replace on:change with onchange event handler
- Pre-populate base URL from existing config when editing
- Clean up bracket notation to dot notation for value properties
Addresses reviewer feedback
* fix: rename pocket-id to pocketid for naming convention compliance
Change identifier from 'pocket-id' to 'pocketid' to match Windmill's naming convention.
No OAuth provider uses hyphens - all custom SSO providers (keycloak, authentik, authelia,
kanidm, zitadel) use no separator.
Changes:
- AuthSettings.svelte: oauths['pocket-id'] → oauths['pocketid'] (2 locations)
- PocketIdSetting.svelte: name={'pocket-id'} → name={'pocketid'}
- icons/index.ts: 'pocket-id': PocketIdIcon → pocketid: PocketIdIcon
Note: PocketID does not need oauth_connect.json entry as it's a custom SSO provider
with user-configured endpoints, similar to Keycloak/Authentik.
Addresses reviewer feedback
* fix: use TextInput component for consistency
---------
Co-authored-by: hugocasa <hugo@casademont.ch>
* fix: preserve script envs field during sync push
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* nit frontend fix
* chore(main): release 1.623.0 (#7748)
* chore(main): release 1.623.0
* Apply automatic changes
---------
Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com>
* fix: resolve infinite effect loop in PocketIdSetting component (#7753)
* fix: prevent retention cleanup from deleting jobs of active flows (#7755)
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* chore(main): release 1.623.1 (#7754)
* chore(main): release 1.623.1
* Apply automatic changes
---------
Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com>
* feat: default to quickjs on ce for flow eval (#7756)
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* feat: runtime assets (#7656)
* Runtime assets
* Nits
* Revert "Nits"
This reverts commit 3031a2ddd1.
* detection_kinds
* don't delete runtime assets
* Show latest executions
* conditional unique idx
* nit status
* refactor
* nit refactor
* prepare sql
* Detect assets in complex JSON input objects
* false positive prevent
* nit
* redundant idx
* Update frontend/src/lib/components/assets/AssetsUsageDrawer.svelte
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
* Update backend/migrations/20260122134517_runtime_assets.up.sql
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
* runtime assets are inserted in a loop
* nit
* nit fix
* Don't use lazy static
* fix compilation
* nits
* missing on conflict do nothing
* add index
* Fix max n logic
* created at
* nits
* remove pagination
* sqlx prepare
* Only detect resource assets in input
* get_runtime_asset_sender()
* use global get_runtime_asset_sender to avoid prop drilling
* nit refactor : register_runtime_asset
* get job_id from token
* job as a usage kind
* fixes
* ee
* nit refactor
* merge access types when same job uses same asset multiple times
* Refactor to support wmill s3 API
* nit
* parse_wmill_sdk_sql_assets refactor
* Detect datatable and ducklake usage
* nit order by
* Join with v2_job
* better UI
* add sequential id for cursor pagination
* useInfiniteQuery
* useScrollToBottom
* sql index
* claude code stash
* migration fixes
* Infinite scroll UI
* nit
* style nit
* runtime asset created at
* Asset filters
* fix usage kind filter
* also check runnable_path for jobs when filtering
* better filters
* avoid flickering
* debounced filters
* nit
* tooltips
* fix: update AssetUsage type to match new ListAssetsResponse structure
The ListAssetsResponse changed from an array to an object with an 'assets' property.
Updated the type extraction accordingly.
Co-authored-by: Diego Imbert <diegoimbert@users.noreply.github.com>
* sqlx prepare
* Delete .claude/hooks/.symlink-manifest
* unnecessary dep
* nit refactor
* nit comment
* nit naming
* CI fix attempt 1
* ee ref
* nit remove alerts
* nit
* chore: update ee-repo-ref to 138a4f5f868f3bded5bb7cb77b222b532c07e4af
This commit updates the EE repository reference after PR #395 was merged in windmill-ee-private.
Previous ee-repo-ref: 7d3a21d53066726e97dfea9f117373299bc9318c
New ee-repo-ref: 138a4f5f868f3bded5bb7cb77b222b532c07e4af
Automated by sync-ee-ref workflow.
---------
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: Diego Imbert <diegoimbert@users.noreply.github.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* fix: remove $schema field from Google AI output schema requests (#7765)
* fix: remove $schema field from Google AI output schema requests
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* test: add $schema field to all output schema integration tests
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: remove $schema field from Google AI tool parameter schemas
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* test: add workspace script tool test for AI agents
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* fix: Fix app multiselect not refreshing result when creating element (#7766)
* Fix returning
* asset columns are saved and displayed in the assets page
* runtime assets column detectionz
* frontend nits
* update regex parsers
* UI nits
* Display asset columns in flow graph
* Column hint directly in asset node
* nit bg
* sqlx prepare
* ee repo ref
* chore: update ee-repo-ref to 66a68df97e8c65c498b28f302a365ab8687cad9e
This commit updates the EE repository reference after PR #402 was merged in windmill-ee-private.
Previous ee-repo-ref: 0a32bc104cbaec9664a4d7cb1565823722c875a1
New ee-repo-ref: 66a68df97e8c65c498b28f302a365ab8687cad9e
Automated by sync-ee-ref workflow.
---------
Co-authored-by: centdix <40307056+centdix@users.noreply.github.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com>
Co-authored-by: hugocasa <hugo@casademont.ch>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Co-authored-by: wendrul <53628737+wendrul@users.noreply.github.com>
Co-authored-by: Alexander Petric <alpetric@users.noreply.github.com>
Co-authored-by: Devdatta Talele <50290838+devdattatalele@users.noreply.github.com>
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: Diego Imbert <diegoimbert@users.noreply.github.com>
* feat: add filters to Kafka triggers
- Introduced a new `filters` field in the Kafka trigger schema, allowing for JSONB array filters.
- Updated the WebSocket trigger to include the new `filters` functionality.
- Created a `TriggerFilters` component for managing filter inputs in the UI.
* update ref
* fix ci
* fix sqlx
---------
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* fix: Raw apps deployment UI (and merge UI)
* Add folders and resource tpyes to merge UI
* claude first pass on adding the new arg for h_deploy_metadata
* Add missing argument to handle_deployment_metadata in all its calls
* Add support for folders and resource types in merge UI
* Update eereporef for CI
* Update ee repo
* Add migration to reset cached diff with potential artifacts
* fix type in frontend
* Preapare sqlx
* Remove unused import and logs
* update ee-repo
* Update eerepo
* chore: update ee-repo-ref to aca38475afd2cafaf63f4bbffc65be9437d57d86
This commit updates the EE repository reference after PR #397 was merged in windmill-ee-private.
Previous ee-repo-ref: 19c64cf8c61d83f45047b37660054b29658cd403
New ee-repo-ref: aca38475afd2cafaf63f4bbffc65be9437d57d86
Automated by sync-ee-ref workflow.
* Make integration test for workspace comparisons
* Update SQLx metadata
---------
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
The uuid-ossp extension was created in the first migration but never
actually used - the codebase uses gen_random_uuid() which is built-in
to PostgreSQL 13+. This allows Windmill to run on AWS RDS where
application users may not have CREATE SCHEMA privileges.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat: workspace dedicated workers
* ref
* chore: update ee-repo-ref to a18ac31062ac092cb9a5fc87629e217d97f4911d
This commit updates the EE repository reference after PR #398 was merged in windmill-ee-private.
Previous ee-repo-ref: 98cfe3fef764d9d815d326d5056c734a03689d33
New ee-repo-ref: a18ac31062ac092cb9a5fc87629e217d97f4911d
Automated by sync-ee-ref workflow.
* fix(frontend): workspace script in flow steps
---------
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* fix: handle empty strings in AI resource fields via serde deserializer
Add `empty_string_as_none` deserializer that converts empty strings to None
during deserialization. Applied to base_url, api_key, region, and AWS
credential fields in AIStandardResource and ProviderResource.
This fixes the "relative URL without a base" error when creating Anthropic
resources with empty base_url fields.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* nit
* nit
* nit
* cleaning
* cleaning
* cleaning
* cleaning
* fix: apply empty_string_as_none deserializer to api_key field
Consistent with other fields in ProviderResource, empty strings are now
deserialized as None for the api_key field.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
The endpoint now returns all non-system schemas, including empty ones
without tables. This is useful for CLI and frontend features that need
to know about available schemas for autocompletion and app creation.
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* fix(mcp): use computed base_internal_url instead of static default
Pass the actual base_internal_url (computed from the runtime port) to
the MCP backend instead of using the static BASE_INTERNAL_URL which
defaults to http://localhost:8000. This fixes internal API calls when
the server runs on a non-default port.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix
* remove BASE_INTERNAL_URL
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* check endpoint
* use flag for cred check on worker
* use sdk for auth chat side
* cleaning
* cleaning
* also handle GET
* Add session token support in BedrockClient::from_credentials
Users with temporary STS credentials need session tokens for AWS
authentication. This adds the optional session_token parameter to
support these use cases.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Cache AWS SDK config loading to avoid repeated I/O
aws_config::load_defaults() performs environment variable lookups and
potentially file I/O on each call. Cache the result in a static OnceCell
to improve performance on high-frequency Bedrock requests.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Add debouncing to Bedrock credential check button
Prevent rapid clicks from spawning multiple concurrent flow preview
jobs for the worker credential check.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Remove orphaned SigV4 signing comment
The manual SigV4 signing code was removed in favor of the AWS SDK,
but this documentation comment was left behind.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Remove verbose tracing info and change-related comments
- Remove per-request auth method info logs (too verbose for production)
- Simplify from_env log to single debug-level message
- Remove comments describing future changes rather than current behavior
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* cleaning
* Fix Bedrock feature flag compilation warnings
Gate AWS-specific imports, struct fields, and methods behind the bedrock
feature flag to eliminate dead code warnings when building without the
bedrock feature enabled.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* bedrock flag
* cleaning
* Move BedrockCredentialsCheck from edit drawer to add drawer
The component was incorrectly shown when editing resources instead of
when adding new ones. Moved it from ResourceEditor.svelte to
ApiConnectForm.svelte.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* cleaning
* cleaning
* make aws-config optional
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
- Add permissions test suite covering scripts, flows, apps, resources,
variables, schedules, and folder-based permissions
- Add test for operator restrictions (cannot create/update/archive)
- Restrict operators from archiving scripts (archive_script_by_path,
archive_script_by_hash) for security consistency with flows/apps
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* refactor: replace v2 live migration with regular SQL migration
Remove the v2_finalize live migration that waited for workers to reach
v1.461+ and replace it with an idempotent SQL migration. Since enough
time has passed, all deployments are assumed to be on v1.461+.
Changes:
- Remove v2_finalize() function and spawn task from live_migrations.rs
- Remove MIN_VERSION_IS_AT_LEAST_1_461 constant from min_version.rs
- Add 20260125000000_v2_finalize.up.sql with all finalization steps
- All SQL operations use IF EXISTS/CASCADE for idempotency
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* refactor: remove migration-related delays and tighten CLI tests CI trigger
- Remove 5s backend initialization delay in cargo_backend.ts that was
needed for the v2 live migration (now replaced with SQL migration)
- Restrict CLI tests workflow to only trigger on cli/** changes
(removed backend/**, openapi.yaml, openflow.openapi.yaml paths)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: skip v2_finalize migration if live migration already ran
Wrap migration in DO block that checks for 'v2_finalize_job_completed'
in windmill_migrations table. If present (live migration already ran),
skip entirely to avoid unnecessary table locks on upgraded instances.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* feat: add workspace setting to disable error handler for u/ scripts/flows
Add a new workspace setting `error_handler_muted_on_user_path` that allows
disabling the error handler for jobs related to scripts/flows that start
with the "u/" prefix (user scripts/flows).
Changes:
- Add migration to add `error_handler_muted_on_user_path` column to workspace_settings
- Update WorkspaceSettings struct and get_settings query
- Update EditErrorHandler struct and edit_error_handler API endpoint
- Update error handler cache to include the new setting
- Add skip logic in send_error_to_workspace_handler for u/ paths
- Add toggle in workspace settings UI
The implementation uses the existing cached settings to avoid additional
database queries, making it efficient.
Closes#7633
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* all
* update ee private
* combine migrations
* sqlx
* fix: migration fixes for auto_invite JSONB column
- Fix TEXT[] to JSONB conversion using to_jsonb()
- Add GIN index on auto_invite for efficient ? operator queries
- Add index cleanup to down migration
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* sqlx
* all
* all
* all
---------
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Ruben Fiszel
wendrul
centdix
Diego Imbert
hugocasa
dieriba
Pyra
claude[bot]