Serve the caller's usable roles and the default one alongside the tree, so
the badge costs no extra round trip per data table. Shown only where naming
the role says something: a data table without permissions, or one whose only
usable role is the implicit admin, gets none.
The left-pane filter also matches schema names now.
The New table / New schema rows now show under every data table, not only
the one the manager is pointed at. Creating outside it switches to that data
table first, and the request rides through the parent because the switch
re-mounts the manager.
Tree rows also read uniformly now — the background alone marks the current
one — with the create rows set apart in secondary.
Picking a table now also makes it the current one, previewed on the right —
across data tables too, which re-mounts the manager, so the picked
schema/table travel through the input the drawer keeps.
The table picker for raw apps had its own checkbox tree next to the
manager's navigator. Now that the navigator is itself a data table ->
schema -> table tree, the picker is the same tree with a checkbox in
place of the chevron and row menu, so a pick can span data tables.
Also aligns the indent step between tree levels at 16px.
* fix: require item read scope on workspace tarball export
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix: accept a wildcard path grant for whole-domain scope checks
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix: let a wildcard path grant delegate the unqualified scope
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* fix: scope capture deletion to the workspace in the request path
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* test: layer the capture fixture on base instead of duplicating it
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
* fix: keep raw-app files within their app folder on sync pull
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* fix: validate raw-app file keys as stored, closing nul and duplicate-field bypasses
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* fix: guard raw-app runnable ids too and fail closed on unparseable value
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* fix: strip only a leading slash on raw-app file keys to match backend
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* fix: strip only a leading slash on raw-app file keys to match backend
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* fix: require an unscoped token to read the workspace encryption key
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix: hold the encryption key's write path to the same token bar
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix: audit a workspace export only once nothing can still reject it
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* chore: carry the new audit operation into the served openapi spec
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
* test: assert the unpacked repo symlink without following it
`unpack_keeps_a_link_that_stays_in_the_repo` read through the link it had just
unpacked. Windows stores a symlink's target verbatim and its object manager
rejects the `/` in a POSIX one, so `read_to_string` came back with
`ERROR_INVALID_NAME` and the release's `cargo_test_windows` job was red.
Pin what the function is responsible for on every platform — the link is kept
and materialized — and read through it only where a POSIX relative target
resolves.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P3WRtxdKNGdomWX9vaAYGx
* test: key the cli sync-map fixtures with the platform separator
A sync map is keyed with the platform separator on both sides — `FSFSElement`
walks the tree with `path.join`, and the remote `ZipFSElement` starts at
`"." + SEP` and joins from there — while an `!inline` reference is always
forward-slash. `lock_dedup.ts` follows that convention; the fixtures did not,
so on Windows they built a map shape the CLI never produces and 12 of them
failed. `getTypeStrFromPath` is the same story: it matches
`"dependencies" + SEP`, and the test handed it a forward-slashed path.
Build the fixture keys through the separator, leaving the `!inline` references
and the `present` map forward-slash, as `sync.ts` hands them over.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P3WRtxdKNGdomWX9vaAYGx
* ci: skip the discord comment relay when the thread lookup returns none
A rate-limited or unauthorized Discord response carries no thread list, and
under `bash -e` that aborted the step — jq cannot iterate null, nor parse the
HTML error page Cloudflare answers a 429 with — before it reached the "thread
not found, skipping" branch right below. Three comment relays failed that way
on the 1.794.0 head.
Keep the step green for both, but tell them apart: a response with no thread
list is a delivery that was dropped for a reason worth seeing, so it warns with
the body it got, while a PR that genuinely has no thread stays quiet.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P3WRtxdKNGdomWX9vaAYGx
* feat: show the date on the runs dashboard chart axes
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019UA8Kikr1QD28g2fyWoSbj
* fix: keep the runs chart date visible on sub-day ranges
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019UA8Kikr1QD28g2fyWoSbj
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: size job token to the premium cloud job timeout
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: give the job token setup headroom and drop dead MAX_TIMEOUT_DURATION
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: cap job token setup slack so self-hosted tokens stay at 7d
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: keep workflow-as-code scripts off dedicated workers
A dedicated subprocess calls the script's `main`. A workflow-as-code v2
entrypoint exports none, so a WAC script configured as a dedicated worker
failed every run with `entry.module.main is not a function`, and its
checkpoint/dispatch round-trip never ran at all.
Leave such a script unregistered in the dedicated worker map instead. The
worker still holds the script's dedicated tag, so the job falls through to
the regular executor on the same worker and runs correctly; rejecting it at
push time would strand it, since nothing else pulls that tag.
`is_wac_v2` covers only the languages whose executor actually routes a
workflow through the WAC runner: Deno runs a WAC-shaped script as a plain
`main`, so claiming it is WAC would deny it a path it uses correctly today.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VMNiDoBuUY9jzqcuFLT2wU
* chore: update ee-repo-ref to ac02c4696ea0be6a8b8ae154ddd7521bc1c3bbc0
This commit updates the EE repository reference after PR #740 was merged in windmill-ee-private.
Previous ee-repo-ref: bf742f6ea4d435bd47c9ee0ac5ad800925d79672
New ee-repo-ref: ac02c4696ea0be6a8b8ae154ddd7521bc1c3bbc0
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* fix: keep every value of a repeated multipart field
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* chore: drop pre-change narration from a multipart test comment
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
* test: assert the unpacked repo symlink without following it
`unpack_keeps_a_link_that_stays_in_the_repo` read through the link it had just
unpacked. Windows stores a symlink's target verbatim and its object manager
rejects the `/` in a POSIX one, so `read_to_string` came back with
`ERROR_INVALID_NAME` and the release's `cargo_test_windows` job was red.
Pin what the function is responsible for on every platform — the link is kept
and materialized — and read through it only where a POSIX relative target
resolves.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P3WRtxdKNGdomWX9vaAYGx
* test: key the cli sync-map fixtures with the platform separator
A sync map is keyed with the platform separator on both sides — `FSFSElement`
walks the tree with `path.join`, and the remote `ZipFSElement` starts at
`"." + SEP` and joins from there — while an `!inline` reference is always
forward-slash. `lock_dedup.ts` follows that convention; the fixtures did not,
so on Windows they built a map shape the CLI never produces and 12 of them
failed. `getTypeStrFromPath` is the same story: it matches
`"dependencies" + SEP`, and the test handed it a forward-slashed path.
Build the fixture keys through the separator, leaving the `!inline` references
and the `present` map forward-slash, as `sync.ts` hands them over.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P3WRtxdKNGdomWX9vaAYGx
* ci: skip the discord comment relay when the thread lookup returns none
A rate-limited or unauthorized Discord response carries no thread list, and
under `bash -e` that aborted the step — jq cannot iterate null, nor parse the
HTML error page Cloudflare answers a 429 with — before it reached the "thread
not found, skipping" branch right below. Three comment relays failed that way
on the 1.794.0 head.
Keep the step green for both, but tell them apart: a response with no thread
list is a delivery that was dropped for a reason worth seeing, so it warns with
the body it got, while a PR that genuinely has no thread stays quiet.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P3WRtxdKNGdomWX9vaAYGx
* chore: bump git-sync hub scripts to windmill-cli 1.794.0
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* test: assert the unpacked repo symlink without following it
`unpack_keeps_a_link_that_stays_in_the_repo` read through the link it had just
unpacked. Windows stores a symlink's target verbatim and its object manager
rejects the `/` in a POSIX one, so `read_to_string` came back with
`ERROR_INVALID_NAME` and the release's `cargo_test_windows` job was red.
Pin what the function is responsible for on every platform — the link is kept
and materialized — and read through it only where a POSIX relative target
resolves.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P3WRtxdKNGdomWX9vaAYGx
* test: key the cli sync-map fixtures with the platform separator
A sync map is keyed with the platform separator on both sides — `FSFSElement`
walks the tree with `path.join`, and the remote `ZipFSElement` starts at
`"." + SEP` and joins from there — while an `!inline` reference is always
forward-slash. `lock_dedup.ts` follows that convention; the fixtures did not,
so on Windows they built a map shape the CLI never produces and 12 of them
failed. `getTypeStrFromPath` is the same story: it matches
`"dependencies" + SEP`, and the test handed it a forward-slashed path.
Build the fixture keys through the separator, leaving the `!inline` references
and the `present` map forward-slash, as `sync.ts` hands them over.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P3WRtxdKNGdomWX9vaAYGx
* ci: skip the discord comment relay when the thread lookup returns none
A rate-limited or unauthorized Discord response carries no thread list, and
under `bash -e` that aborted the step — jq cannot iterate null, nor parse the
HTML error page Cloudflare answers a 429 with — before it reached the "thread
not found, skipping" branch right below. Three comment relays failed that way
on the 1.794.0 head.
Keep the step green for both, but tell them apart: a response with no thread
list is a delivery that was dropped for a reason worth seeing, so it warns with
the body it got, while a PR that genuinely has no thread stays quiet.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P3WRtxdKNGdomWX9vaAYGx
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: do not read an unloaded workspace list as a non-membership
`roleForWorkspace` settled `not_a_member` from `userWorkspaces` alone. That store and
`superadmin` both start undefined and load asynchronously, so an unloaded list read as an
empty one: a chat operating on any workspace other than the one being browsed advertised no
pages and reported an access denial. The root layout gives up after its retries, so a load
that fails leaves the denial permanent, with `whoami` never attempted.
Settle a non-membership only once both stores have resolved; treat unresolved as unknown
and fall through to the `whoami` lookup.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: build the global chat's prompt identity from the operating workspace
The prompt's path conventions and folder guidance came from the ambient `userStore`, which
describes the workspace being browsed rather than the one the chat operates on. Three of
those fields are per-workspace and wrong whenever the two differ: the username (that
workspace's `usr` row), the writable/readable folder sets (its ACLs), and `is_admin`, which
decides whether the folder list reads as exhaustive. The backend still enforces the ACLs, so
the cost is prompt quality — paths the model cannot write to, and a 403 to recover from.
Resolve the identity for the operating workspace and feed that to the prompt, refreshed
alongside skills and MCP servers and settled in `beforeSend` so the cached system-prompt
prefix stays stable for the turn. An unresolved role now leaves the folder sets undefined
rather than empty, so the guidance is dropped instead of claiming there is nothing to write
to, and `create_folder` credits the workspace it wrote to.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: read the AI provider resource types lazily
`Object.keys(AI_PROVIDERS)` at module scope made `AI_PROVIDERS` a load-time requirement for
every importer of this module, the global chat included. `AIChatManager.test.ts` mocks
`../lib` without it and has been unable to load since the catalog was introduced; no CI
workflow runs vitest, so nothing reported it.
The constant is read in two places, both inside functions, so deferring it removes the
load-time dependency without changing behaviour.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: confine job tokens to workspace-scoped API routes
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: keep the object-storage connection test reachable from a job token
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: keep the workspace-exists check the CLI makes reachable from a job
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* test: reconcile the job-token caps after #10124
The workspace-confinement middleware answers a workspace-less route before the
privilege gate behind it runs, so the cases #10124 added on those routes now see
403 rather than 401. Rejection is what they assert, but two of them needed more
than a status change:
- `list_worker_groups` asserted only that the response body omits the static env
value, which an error body satisfies for the wrong reason. It now asserts the
status, keeping the secret check as a second assertion.
- `require_super_admin` lost its only unshadowed route. `GET
/api/w/{workspace}/users/list_addable` is gated solely by that call and names a
workspace, so it reaches the gate and pins it at 401.
The module doc states the two-layer rule once; the file covers both caps, so it
is no longer named for either one alone.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* docs: correct the workspaces/exists rationale and the parquet gate note
`workspace` carries no row-level security, so `exists_workspace` running through
`user_db` does not filter by membership as the comment claimed. State what the
route actually discloses — whether a workspace id is taken.
The object-storage case explained why a 404 would satisfy the assertion for the
wrong reason, which described the earlier `assert_ne!(403)`; against the 422 it
now asserts, a 404 fails. Say instead why the case is gated on the feature.
* fix: let a job token keep the workspace-less routes that carry no workspace
Confinement refused every route outside the allowlist, including ones that
answer purely from the caller's own account or from the request body. Those
cross no workspace boundary, so refusing them buys nothing:
- `users/email` returns a value already inside the token, and
`workspaces/allowed_domain_auto_invite` tests the caller's own address against
a static list. Neither opens a transaction.
- `users/usage` reads the caller's own row; `users/tutorial_progress` reads and
upserts a UI bitfield keyed on the same email.
- `schedules/preview` takes no `ApiAuthed` at all — it computes the occurrences
of the cron expression in the body and returns nothing the caller did not send.
The rule, not the list, is what the doc comment states: answers from the caller's
own account, the request body, or content identical for every workspace; never
naming another workspace, never instance configuration. The candidates it
excludes are written down with their reasons, since `users/list_invites` reads as
caller-scoped until you notice the response carries a workspace id per invite.
Regression covers both directions — the new entries answer, and the rejected
caller-scoped reads stay refused.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* test: reach the privilege gates confinement hides
`require_devops_role` and `require_instance_admin` gate only workspace-less
routes, so confinement answers every request that would reach them: no HTTP case
can tell whether they still cap job tokens, and both could lose that check with
this suite green. `require_super_admin` has a workspace-scoped route to reach it;
these two have none, so call them directly instead.
The identity used is the fixture's real superadmin, so the passing half proves
the rejection keys off `job_id` rather than off the user.
Also separate two claims the write-allowlist doc had merged into one sentence:
no entry writes outside the caller's own account, but what each may read differs,
and the workspace-existence check answers for any id.
* docs: say that the object-storage probe writes
The write-allowlist lead claimed no entry writes state outside the caller's own
account. `test_s3_bucket` puts an object into the store the body names and
deletes it again, so it does write; a failure between the two leaves the object
behind. The invariant that holds is about Windmill state.
Say so in the lead, and describe the put/delete in the entry itself rather than
leaving "acts only on the store the request body describes" to imply a read.
* test: cover the last two job-token gates confinement hides
Seven guards key on `ApiAuthed::job_id`. Three keep a workspace-scoped route and
are exercised over HTTP; the other four are reachable only through workspace-less
routes, which confinement now answers first, so nothing observed whether they
still cap job tokens.
`require_devops_role` and `require_instance_admin` were already called directly.
Add the two that were not: `forbid_superadmin_job_token`, and
`forbid_elevated_job_token`, whose call sites are `create_token`,
`update_token_scopes` and `set_password` — all workspace-less.
Both key on two conditions rather than one, so all three combinations are pinned:
neither fires without job provenance, and neither fires for an unelevated
identity. The second matters — collapsing either into a blanket job-token refusal
would stop ordinary users creating tokens, and no other case would catch it.
The doc comment records which of the seven each route covers.
* docs: correct which job-token gates have no observable route
The previous commit put `forbid_elevated_job_token` among the guards reachable
only through workspace-less routes, and its message named three call sites. It
has six, and two are workspaced: `mint_app_embed_token` and
`mint_raw_app_sdk_token`. Its superadmin branch is therefore already exercised
over HTTP — the 401 the embed-token case asserts is this gate.
So three of the seven lack an observable route, not four. Its direct assertions
stay: the embed-token case only ever reaches it with an elevated identity, and
the unelevated-negative case is what would catch the gate being collapsed into a
blanket job-token refusal.
* test: pin is_instance_admin, and stop enumerating gates in prose
`is_instance_admin` is `authed.is_admin && authed.job_id.is_none()`, so a census
built by searching for `job_id.is_some()` could not see it. Both its call sites
are workspace-less, and it returns a bool that selects obfuscation rather than
refusing — a job token reading `true` leaks `env_vars_static` instead of being
turned away. Pin both directions.
The doc comment tried to account for every job-token guard and which route
exercised it. It was wrong three times running: the count, the call sites of
`forbid_elevated_job_token`, and the claim that the CUSTOM_INSTANCE_DB case
covers `is_super_admin_authed` when that path tests `job_id` inline. A table that
has to be rederived from six crates to stay true does not belong in a comment, so
it now states only why these calls are direct.
* docs: name the right is_instance_admin caller
The comment credited "the concurrency-group listing" with obfuscating rows. The
second caller is `prune_concurrency_group`, which returns PermissionDenied; the
obfuscating one is `list_worker_groups`. Keep the claim to that single caller,
which is what makes this guard fail by leaking `env_vars_static` rather than by
admitting a request.
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: ground the chat's AI agent provider in the workspace's models
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: never reject an AI agent model the catalog could not confirm
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* test: benchmark AI agent provider grounding in ai_evals
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: only reject an AI agent model an exhaustive listing rules out
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: keep instance-level AI settings out of the workspace provider catalog
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: keep untrusted model ids out of the chat's context
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* refactor: carry completeness on the model listing itself
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* docs: correct two comments left behind by the catalog rework
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: bound the model listing and verify the default against it
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: honour a workspace default a filtered listing names
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: recognise a workspace default past the prompt's model cap
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: keep an aliasing provider's unlisted model ids permissive
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat: support application default credentials for gcp pub/sub triggers
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix: address review findings on gcp application default credentials
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix: address review nits on gcp application default credentials
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix: key the gcp credential-mode permission off the loaded mode
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix: gate enabling an ADC gcp trigger on workspace admin
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix: lock the gcp trigger row while authorizing a mode change
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix: skip admin-only gcp listing when the caller cannot use those credentials
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 54bf630681000c8ed87a7067e357118e015123b1
This commit updates the EE repository reference after PR #738 was merged in windmill-ee-private.
Previous ee-repo-ref: 91d0e228a0ad226625278b400c64f96a61404a10
New ee-repo-ref: 54bf630681000c8ed87a7067e357118e015123b1
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* feat: inline login errors and a narrower single-column login card
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: address login review findings (overflow, error leak, a11y, dev gate)
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: scope login form ids per instance
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: drop the duplicate dark mode toggle and tighten the login heading gap
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: replay the login shake on every retry, not just the first
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: address standards and spec review findings on the login page
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: put the login error under the field it is about
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: attribute a login failure to the credentials it was sent with
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: hide the third-party toggle once the password form is open
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat: brand the logged-out pages from one top header instead of a centered logo
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat: remember the login method that last worked on this browser
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat: lead the login card with the last used method and anchor its layout
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: address review round findings on the login card
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: key third-party buttons by method kind and drop a history comment
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* fix: let the MCP createScript tool deploy without a parent hash
The tool advertised creating a new script with `parent_hash` left unset, but
`parent_hash` was one of its declared arguments — and a client that requires
every declared argument to be filled has no way to leave it unset. The values
such a caller invents (`""`, `"0"`, a zero hash) are all rejected by
`/scripts/create`, so no script was ever created.
`parent_hash` is now gone from the tool, and the MCP layer sends `auto_parent`
in its place: the server resolves the lineage from the path, creating the script
when the path is free and deploying a new version of it when it is not. That is
what the tool already claimed to do, and it no longer asks the caller to track a
hash to do it.
`x-mcp-tool-fixed-fields` is the general mechanism behind this — body fields the
MCP layer fills in itself, absent from the tool schema. A null argument is also
dropped from the assembled body now, for the same reason the placeholder hashes
were a problem: it is how a caller with no value to give says so, and the API
rejects it rather than falling back to the field's default.
Fixes GIT-973
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix: hash a script version once auto_parent has resolved its parent
`create_script` hashed the incoming script before the `auto_parent` block filled
in `parent_hash`, and the version hash covers that field. A deploy that let the
server resolve the parent was therefore hashed as if the path had no history, so
redeploying content the path had held before collided with that archived version
and returned "A script with same hash ... already exists!" instead of becoming a
new version of the lineage. Reverting a script to an earlier state was impossible
for any caller relying on auto_parent alone, which is now every MCP caller.
The hash and the duplicate-hash check move below the resolution, so an
auto_parent deploy hashes the lineage it will actually be attached to. Callers
passing an explicit `parent_hash` are unaffected: the resolution block leaves
their `ns` untouched, so they hash exactly as before.
The CLI masked this by sending `parent_hash` and `auto_parent` together, using
auto_parent only as a stale-hash fallback.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* docs: state the constraint that pins the script hash site
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix: reject a fixed-fields spec the MCP layer would not honour
`validate_fixed_fields` ran only for an operation that declares a request body,
and passed any body whose properties it could not see. Two shapes reached the
generated tool with fixed fields that are dropped at call time: an operation with
no `requestBody`, where the body builder returns before reading them, and a
pass-through body, which carries the runnable's own arguments and never receives
a key of ours. Both are now generation-time errors, so the only specs that get
the extension are the ones where it means something.
Also name the folder-derived `on_behalf_of` alongside `parent_hash` at the hash
site: both are written to `ns` before it, and a reader who knows about only one
could reintroduce the early hash.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix: keep fixed fields internal and catch a misspelled one
`EndpointTool` is what `list_tools` publishes as the tool catalogue, so deriving
`body_fixed_fields` into it put a field in the caller's view that is by definition
not the caller's to set, and that the OpenAPI schema does not declare. It is no
longer serialized.
The generator also only checked a fixed key against the exposed subset of the body
properties, which cannot tell a field deliberately left out of
`x-mcp-tool-include-fields` from a misspelling of one. A key the API does not
declare is now a generation-time error rather than one serde discards in silence,
and the extension must be a non-empty mapping — an empty list previously slipped
through the type check on its way to being ignored.
Narrow the hash-site comment to the ordering it actually constrains.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* feat: split the MCP script tools into createScript and updateScript
Scripts were the only entity in the MCP surface without the create/update pair
every other one has, because the REST API has no update route for them: a script
is immutably versioned, so `POST /scripts/create` is also its update, and one
tool had to infer which the caller meant from the state of the path.
That inference is what GIT-973 is. `parent_hash` told the two apart, and an MCP
client that requires every declared argument to be filled has no way to leave it
unset, so no script could be created: `""` is a 422, `"0"` is a 422, and
`"0000000000000000"` is a 400.
Naming the intent removes the field instead of the guard. `createScript` means
the path should be free and keeps refusing an occupied one; `updateScript` names
the version it supersedes in its URL, so the body carries no hash either. Picking
the wrong one now fails loudly rather than succeeding on the wrong script.
- New `POST /w/{workspace}/scripts/update/{path}`, deploying a new version of
the script the URL names. Its body `path` is the destination, defaulting to the
URL's, so setting a different one moves the script and keeps its history —
which no MCP client could ask for while `createScript` was the only tool.
- New `x-mcp-tool-optional-fields`, dropping a body field from the tool's
`required` where the handler defaults it. `updateScript` uses it for that
destination path: required, an agent has to restate the path on every edit, and
a value that drifts from the URL's silently moves the script.
- `assemble_request_body` drops null-valued arguments, matching what the
pass-through branch already did. A client that must fill in every argument says
"no value" with `null`, and the API rejects that for a bare `String` field
rather than falling back to its default.
Fixes GIT-973
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CEWFHpmTBauDBi93MnsT7s
* fix: confine updateScript to the token's script paths
`endpoint_path_policy` is what applies an `mcp:scripts:<pattern>` token's path
patterns to an endpoint tool, and a tool it does not name is not confined at all.
`updateScript` was not named, so a path-scoped token could deploy over, and move,
any script in the workspace: the proxy mints a bare `scripts:write` for a caller
whose only scopes are `mcp:`-prefixed, and nothing downstream held a pattern.
The destination path has to bind only when supplied — omitting it is how a caller
updates in place — so `PathArgs` grows `optional_fields`, checked when present and
never required. Empty reads as absent, matching the handler, which now takes an
empty body `path` for "leave it where it is" rather than moving the script to the
empty path: a caller obliged to fill in every field sends `""` as readily as null.
That shape also fixes `updateFlow`, whose entry named `path__path` for the URL
argument. The generator gives the URL path the plain name, so the lookup never
matched and every confined call failed closed on a missing argument.
Both sides now have a drift guard: a script/flow tool the URL addresses by path
must have a policy. The backend one lives in windmill-api, where the generated
catalogue is, since the policy is in windmill-mcp and neither crate sees both.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CEWFHpmTBauDBi93MnsT7s
* fix: address the review round on the script tool split
Four findings, three of them one bug: a destination path the caller left empty.
`update_script` read it as "leave it where it is", the confinement check skipped
it on the strength of that, and `update_flow` did neither — it takes the empty
string literally and moves the flow there, so the skipped check was the only
thing standing in front of that move. A database constraint refuses the empty
path, so nothing was reachable through it, but the confinement was relying on a
property of one handler that its sibling did not have.
The MCP layer now strips an empty optional destination from the arguments, so no
handler receives one and there is nothing left for the check to skip. Neither
tool depends on the other's reading of it any more.
`update_script` also resolved the head before opening the deploying transaction.
A version landing in between is caught — it leaves a child behind, and the
linear-lineage check refuses that — but an archive leaves none, and the hash of
an archived version still exists, so the deploy would have chained onto it and
revived the script the archive had just retired. The resolution moves into the
transaction.
The scope check on the URL path moves ahead of that resolution, so a path outside
the token's scope answers the same whether or not a script is there, rather than
telling the two apart through 404 against 403.
`x-mcp-tool-optional-fields` goes: the generator already strips a body field that
collides with a same-named path parameter from `required`, so the extension
regenerated byte-for-byte identical output. The test that pinned the destination
as optional stays — it pins the behavior, which is now the collision handling's.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CEWFHpmTBauDBi93MnsT7s
* fix: lock the head an updateScript supersedes
Moving the resolution into the deploying transaction narrowed the archive race
without closing it. The plain SELECT took no row lock, so an archive could still
land between it and the parent-existence check below, which finds the parent by
hash and never looks at `archived` — the deploy then chained onto the archived
version and inserted a live child, reviving the script the archive had retired.
`FOR UPDATE` on the resolution is what makes the row the head rather than a head
it once was: the archive either waits for the deploy, or wins and leaves the row
failing the `archived` qualifier on re-check, so no version resolves at all.
The regression test stages that interleaving rather than approximating it. It
holds the head row from a second connection so the deploy parks on it, waits for
a backend to actually be blocked before archiving — without that wait the request
loses to a local UPDATE and never reaches its resolution, which is the sequential
case the neighbouring test already covers — then asserts the update is refused.
It returns 201 and revives the script with the lock removed.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CEWFHpmTBauDBi93MnsT7s
* fix: have the MCP layer name the path an update keeps
The tool lets a caller omit the destination, and the endpoint was absorbing that
by accepting a body without a `path` and defaulting it from the URL. The OpenAPI
schema says `path` is required, so the two disagreed and a generated REST client
could not follow the contract the description promised.
The MCP layer fills the destination in instead, from the path the item is already
at, since that is what omitting it means. The endpoint then always receives a body
naming its own path and matches its schema, `update_script` takes a `NewScript`
rather than picking a JSON object apart to inject a default, and the empty string
stops being a value any handler has to interpret — `update_flow` reads one as the
empty path, which is why it was stripped a commit ago.
The alternative, an `EditScript` schema differing from `NewScript` only in whether
`path` is required, was measured and rejected: openapi-ts drops the `required` of
an `allOf` branch, so `NewScript` came out with every field optional and broke 15
frontend types. Loosening a schema every API consumer shares, to make one field
optional on one route, is the worse trade.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CEWFHpmTBauDBi93MnsT7s
* fix: tell a superseded update apart from a missing script
Locking the head made the loser of two concurrent deploys answer 404 "Script not
found" for a path the caller can see holds a script: its lock re-check finds the
row archived and filtered, and nothing looked further. It now looks — a live
version at the path means this deploy lost to one that superseded the version it
set out to supersede, which is a conflict to retry, not a script to go find.
The regression test stages that interleaving the way the archive one does, with
the winner leaving a live head behind rather than an archived path. It answers
404 with the branch removed.
The rationale for the lock also sat in two places; it stays at the query, which
is where dropping it would do the damage.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CEWFHpmTBauDBi93MnsT7s
* docs: drop the path default update_script no longer applies
The handler stopped defaulting the body's path when the MCP layer took the job
over; its doc comment still described the old contract.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CEWFHpmTBauDBi93MnsT7s
* docs: sync the deref YAML with the update route's path contract
The dereferenced bundle rewraps prose at its own width, so the edit that updated
the canonical spec and the JSON bundle matched nothing here and left the served
YAML still offering a default the endpoint no longer applies.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CEWFHpmTBauDBi93MnsT7s
* docs: stop the script tools describing a parent_hash they cannot take
`description` is read by two audiences: it documents the route, and it opens the
MCP tool's text. Written for the first, it told an agent that createScript
"does it too when given that version's `parent_hash`" — a field neither tool
exposes, and inviting exactly the call this branch exists to make impossible.
updateScript's told the agent to repeat the URL's path while its own instructions
say to omit it; both work, since the MCP layer fills it in, but only one of them
can be the advice.
Both now describe what the operation does and leave the mechanics to the text
that belongs to each caller: the request body's own description for REST, the
tool instructions for an agent.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CEWFHpmTBauDBi93MnsT7s
* docs: give the create route's two audiences their own description
Removing the `parent_hash` sentence took a true fact out of the REST
documentation: the create route does still deploy a new version, and still
rename, when the body names the version it supersedes. Nothing replaced the
explanation, and the field carried no description of its own.
`description` cannot serve both readers — it documents an endpoint whose schema
has `parent_hash`, and it opens a tool whose filtered schema deliberately does
not. `x-mcp-tool-description` stands in for it on the tool, the way
`x-mcp-tool-name` already does for the name, so the route keeps its full
contract and the agent is not told to send a field it has no way to send.
What `parent_hash` does now sits on the field, where a REST caller looks for it
and where `x-mcp-tool-include-fields` drops it before an agent sees it.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CEWFHpmTBauDBi93MnsT7s
* docs: tell an agent a new version is not runnable the instant it deploys
A deploy returns before its lockfile exists, so a script run straight after one
can still execute the previous version.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CEWFHpmTBauDBi93MnsT7s
* docs: say why a new version is not runnable the instant it deploys
Its lock is generated asynchronously, so a script run straight after a deploy
can still execute the previous version. On both script tools: a freshly created
script is no more immediately runnable than a freshly updated one.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CEWFHpmTBauDBi93MnsT7s
* docs: bound the wait after a deploy instead of naming a signal for it
`getScriptByPath` reports the new hash the instant the version exists, while its
lock is still null, so the previous version is what a run by path executes. There
is no signal that fixes this: the deploy evicts DEPLOYED_SCRIPT_HASH_CACHE, but
anything resolving the path before the lock lands re-populates it with the old
hash, and the lock landing evicts nothing. Waiting for a non-null lock is
necessary and not sufficient, so pointing at one would have been a second wrong
answer.
Measured: a run right after the lock lands still gets the previous version, and
the same run 65s later gets the new one, which is the cache's 60s TTL.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CEWFHpmTBauDBi93MnsT7s
---------
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
A field whose `showExpr` evaluates false skipped its `ArgInput` but still
rendered the padded row that wraps it, so the enclosing
ResizeTransitionWrapper measured 8px (16px with `largeGap`) of leftover
padding per hidden field. Simulating a `oneOf` with a selector and one
`showExpr` branch per variant stacked one such gap per unselected branch.
Move the `!hidden[argName]` check onto the row itself so nothing is
rendered for a hidden field and the wrapper collapses to 0px.
Claude-Session: https://claude.ai/code/session_01Lx7KEPQC4SXjVjYkkks7Za
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore: upgrade bun to 1.4.0 in dockerfiles and CI pins
* chore: move deno last in the language picker and relabel it Deno
* chore: move deno last in the pipeline language picker too
* chore: pin debugger image to bun 1.4.0 and trim the deno picker comment
* chore: state the deno picker constraint without referencing the old order
* fix: stamp bun lockfiles back to v1 while the fleet predates bun 1.4
* fix: ask bun for a v1 lockfile instead of rewriting one, and refuse an escalated lock
* chore: warn instead of silently storing a lockfile with no readable version
Diego Imbert
Ruben Fiszelandrubenfiszel
AlexRV12andClaude Opus 5
GuilhemandClaude Opus 5