mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-10-27 08:02:39 +00:00
812ff6ea5e1144e38d4ba00a48de7d35bd6178bd
1199
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
   
|
7a29abc7ee |
feat: run a workspace handler when a variable's value expires (#10837)
* feat: run a workspace handler when a secret variable expires Secret variables gain an optional `value_expires_at`, and a workspace can point at a script or flow to run once that date passes, so a rotation is driven by the platform instead of tracked out of band. The secret never leaves the database. The sweep selects the path, description and expiry and nothing else, so the handler is given a reference to rotate rather than a value to handle. Job results are stored in cleartext and shown in Runs, which is what makes that a boundary rather than a preference; a test asserts the job's args never contain the value. Each row is claimed by writing `expiration_dispatched_for` in the same transaction as the push, so a failed push un-claims it and a lost race claims nothing. Moving the date re-arms the row; re-saving the same date does not. A pass takes at most 100 rows under a transaction-scoped advisory lock, and orders so that one broken workspace cannot starve the rest. Dispatch runs as `g/variable_expiration_handler`, exempt from the CE group limit and from non-premium exec metering the way the error and schedule handlers already are. A handler that keeps failing backs off and raises a critical alert instead of retrying every pass, and the back-off ends when the handler is repointed. The expiry travels with the variable through workspace clone, tarball export and workspace comparison. The dispatch marker deliberately does not, so a fork re-arms on its own copy. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(frontend): expose variable value expiration in the UI The variable drawer takes an optional expiry on a secret value, and the variables list badges it, turning red once the date has passed. A workspace settings tab picks the handler, its extra args, and whether variables under `u/` are skipped. That mute flag is stored inside the handler setting, so the toggle stays disabled until a handler is picked: saving it on its own would clear the setting it lives in and still report success. The expiry is carried as a tri-state through the draft deploy and copilot paths — absent leaves the remote value alone, an explicit null clears it — so deploying a draft cannot silently drop a date someone set elsewhere. The settings tab names the one case where the configured identity does not apply: a handler script carrying `on_behalf_of` runs as that user rather than as `g/variable_expiration_handler`, which matters because the same tab asks the admin to grant that group write access to the variables it rotates. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(cli): sync variable expiry and the workspace expiration handler `wmill sync` carries `value_expires_at` on variables in both directions, and pushes the workspace handler alongside the error and success handlers in the grouped settings format. Dropping the key from a variable's yaml clears the remote expiry, so the file stays canonical rather than accumulating fields that can only ever be added. The handler follows the same rule, with the caveat recorded where the type is declared: an omitted handler only reaches the clear when some other setting differs, because the push short-circuits on a comparison that walks the local object's keys and so never sees a missing one. That gate is shared with the two existing handlers and is left as it is here. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(frontend): open the variable expiration handler template in a new tab The "Create a handler" button hands its script template to /scripts/add through the URL hash, which `load` reads from `window.location`. A client-side navigation leaves the previous page's hash in place, so the payload was dropped and the editor opened on the default template at a `u/` path. `target="_blank"` forces a full page load, matching the success handler's "Create from template" button. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(frontend): make the variable expiry field state its own status The expiry field rendered a DateTimeInput whose time defaults to 12:00 when it holds no value, so a variable with no expiry looked like one already configured, and "cleared" looked identical to "never set". Setting an expiry is optional, so the field has to say which it is. Rebuild it on the shape ScriptAdvancedSettings already uses for Timeout, Cache and Concurrency limits: a toggle whose checked state is the stored value being present, seeding a date on enable rather than revealing an empty picker, with the input under its own label. Drop `clearable` with it, so the toggle is the single way to mean "no expiry" instead of competing with an X. Stop the surrounding copy promising a run that may not happen. A handler is only dispatched if the workspace has one configured and does not skip u/ paths, so the list tooltip now states the date alone, and the form hedges both conditions, naming the u/ mute only on personal paths where it can apply. Also anchor the mute toggle's tooltip: Popover's trigger is a span around a block-level label, which stretched to the full width of its SettingCard and left the popup floating beside the card rather than under the control. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(rust-client): initialize value_expires_at in the variable models The generated `CreateVariable` / `EditVariable` structs gain the field from openapi.yaml, and client.rs builds both with exhaustive literals. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(frontend): drop extra_args when the variable expiration handler is cleared Clearing the handler nulls the whole setting server-side, extra_args included, but the tab kept its loaded copy. A handler picked afterwards without reloading was persisted with the cleared one's arguments, which the tab does not display. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat: back the variable expiration handler's built-in Slack and Teams destinations Backfills the Slack bot token grant for g/variable_expiration_handler, mirroring 20231016142659 for g/error_handler: the slack_bot folder's extra_perms is written once at Slack connect and never refreshed, and disconnecting leaves the folder behind, so workspaces that already connected Slack cannot pick the grant up from the creation-time list alone. Adds run_variable_expiration_test_job so an admin can exercise the handler on demand rather than waiting for a real expiry, which may be months away. It goes through push_variable_expiration_handler so the test run proves what matters: the handler resolves, and the group can read what it needs, under the same identity and argument shape the sweep uses. Also covers extra_args on the edit endpoint, which the settings tab now writes for the built-ins' channel. The endpoint rebuilds the setting from the request, so an omitted extra_args erases it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Do7wJTnL6MG6ngFpCGW4DG * feat(frontend): offer Slack and Teams as variable expiration handlers Gives the variable expiration tab the same no-code destinations the workspace error handler has, so "tell #ops before this credential expires" no longer requires writing a script. A sibling component rather than a fourth mode of ErrorOrRecoveryHandler: that one is shared with the workspace error handler and the three schedule handlers, and its stripped-args list, hub path suffixes and Email tab are all error-shaped. This reuses the pieces that are already generic (SlackConnectionStatus, TeamsConnectionStatus, ChannelSelector, ScriptPicker, SchemaForm) and leaves those five call sites untouched. extra_args stops being an API/CLI-only escape hatch now that the built-ins write their channel into it, so it joins the unsaved-changes comparison and the discard path, normalised through the existing helper that drops the two auto-managed keys. The two hub ids are placeholders until the scripts are pushed to the hub. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Do7wJTnL6MG6ngFpCGW4DG * fix(frontend): scope the handler identity notice to the chosen destination The notice told every admin to grant g/variable_expiration_handler write access to the variables it rotates. That is right for a custom handler and wrong for the built-ins, which only post a message and are granted the Slack bot token by migration. Following it for a Slack handler would hand a group write access to the workspace's secrets for no reason. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Do7wJTnL6MG6ngFpCGW4DG * feat(frontend): flag the Slack and Teams handlers as EE Connecting a workspace to Slack or Teams is EE-only (oauth2_oss.rs returns "Slack only available on enterprise"), so on CE those two tabs can never be completed. Says so up front, the way the error/success handler tab does, instead of leaving the user at a "not connected" badge with no working path. Only on those two tabs: a custom script or flow handler is CE. Drops the "Connect Slack first" alert, now that the banner and the connection badge above it already say it twice. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Do7wJTnL6MG6ngFpCGW4DG * chore(backend): regenerate the sqlx cache after the merge The merged workspace_settings column list in change_workspace_id is a new query text, so it needs a new cached entry. Drops the two pre-merge entries it supersedes; both had been left with conflict markers by the merge, since rename/rename markers are eight characters and escape the usual scan. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Do7wJTnL6MG6ngFpCGW4DG * fix(cli): narrow the expiry-clear check to a variable that exists remotely Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Do7wJTnL6MG6ngFpCGW4DG * feat(frontend): point the built-in handlers at their published hub scripts Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * chore(backend): regenerate the sqlx cache after the merge Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(frontend): disable the Slack and Teams handler controls without a license Matches the workspace error handler, which greys out its built-in destinations and hides the test button on an unlicensed instance. The custom destination stays editable: unlike the error handler, the variable expiration handler itself is not an EE feature. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * feat: record which destination a variable expiration handler uses handler_configured now counts slack, teams, custom or cleared instead of set or cleared, so usage shows whether the built-in destinations are picked. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix(frontend): let the variable expiration handler template run on any worker Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: guard the variable expiration test endpoint and correct its help text * fix: reuse the error handler's slack arg and built-in path helpers * docs: trim variable expiration sweep and backfill comments * feat: put the variable value expiration under an advanced section * fix: restrict the expiration test job to built-ins and keep expiry on conflict reload * fix: link the expiry hint to the variable's workspace and document built-in test paths * fix: give the expiration sweep its own lock id and reuse double_option * fix: pin the variable expiration presets so the hub-paths test accepts them * feat: let the variable expiration handler set how far ahead it runs * fix: give the notify before expiry setting its own card * feat: remind the variable expiration handler at a set interval * fix: tighten the gap between the Slack channel field and its test button * feat: refuse a value expiry on variables linked to an OAuth account * refactor: reuse the shared handler form for variable expiration * refactor: sweep expiring variables round-robin and check the handler exists * chore: trim comments to the constraints they record * fix: compare expiry dates by moment when deploying a variable draft * refactor: rename value_expires_at to value_valid_until * fix: neutralize variable fields in expiration handler args * fix: reserve the variable_expiration_handler group name for admins * fix: send first expiry notices before reminders * test: pin that a handler failing to start leaves its rows unclaimed * chore: say any hub handler path skips the existence check * fix: empty a pre-existing handler group before granting it the Slack token * docs: correct the registered feature usage counts * fix: let a workspace whose handler failed to start sit out for an hour * fix: send first notices before reminders across workspaces * fix: end a failed handler's wait as soon as it is redeployed * fix: show an expiry-only variable change in the AI fork diff * chore: regenerate workspace tool schemas * test: keep one variable expiration guard per behavior * fix: use the renamed hub expiration handlers and template * feat: carry the variable expiry in windmill-utils-internal 1.8.4 * fix: keep the variable expiry through MCP drafts * chore: bump windmill-utils-internal to 1.8.4 * fix: keep the variable expiry through mcp deploys * fix: disable saving a slack or teams expiry handler without ee * fix: skip the failure mark when the expiry handler was saved mid-sweep * fix: count expiry telemetry only where the expiry changed * test: assert the exact variable expiry in export and cli push tests * fix: stamp an expiry handler failure with the pass's read time * fix: wait for a pending handler lock instead of marking it failed * test: isolate expiry handler tests from the deployed-script cache * fix: retry a failing expiry handler every pass instead of waiting an hour * chore: update ee-repo-ref to b6e23d229966cf0019c0a1926a254fda658d8def This commit updates the EE repository reference after PR #744 was merged in windmill-ee-private. Previous ee-repo-ref: c52c06d145b13a6fb04459e85ca5818bf3c1bff4 New ee-repo-ref: b6e23d229966cf0019c0a1926a254fda658d8def Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> Co-authored-by: hugocasa <hugo@casademont.ch> |
||
|
f6f3a0a1f2 |
fix: return variable.value as text so widening it changes no result type (#11976)
* fix: return variable.value as text so widening it changes no result type Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: update ee-repo-ref to 16858ac4cf7326ed3d5a6fae1a97fcade5a97af7 This commit updates the EE repository reference after PR #920 was merged in windmill-ee-private. Previous ee-repo-ref: dcf6219b5635fc93f11dcb2fd0564c1c5f8407b3 New ee-repo-ref: 16858ac4cf7326ed3d5a6fae1a97fcade5a97af7 Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |
||
|
|
c89a82750e |
fix: run unstamped git auto-pulls as a superadmin when no admin (#11973)
* [ee] fix: run unstamped git auto-pulls as a superadmin when the workspace has no admin Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * bump ee ref: log the fallback identity Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: update ee-repo-ref to 6858e4cbd515b52713afea8dc32b23072af2248c This commit updates the EE repository reference after PR #918 was merged in windmill-ee-private. Previous ee-repo-ref: 03d89d10bdd9fba9d1184dc75f8582a5ad3741a8 New ee-repo-ref: 6858e4cbd515b52713afea8dc32b23072af2248c Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |
||
|
hugocasaandClaude Opus 5.5
|
e5dedd147e |
feat: let flow builder operators build AI agents (#11898)
* feat: let flow builder operators build AI agents Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: check linked agents' bound tools and type, validate on the write's transaction Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: bound the linked-agent walk by sorting bound tool ids Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: let builders bind only the agent tool inputs left to the model Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: check every agent tool sharing a bound id Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: show builders the agent's own tool inputs read-only and name agents in the setting Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor: show the agent's own tool inputs with the read-only step viewer Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * style: give the agent-set inputs heading the input label style Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * style: label the agent's fixed tool inputs static inputs Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: address cubic review on agent builder rights Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: check agent writes against the role's flows capability Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: name the flows capability as the agent builder right Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: gate agent evals on the role's code capability Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor: move the composed-flow check into windmill-api-auth Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
Ruben FiszelandClaude Opus 5.5
|
fb193d7a81 |
fix: list usr columns explicitly in whoami's user lookup (#11970)
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
Ruben FiszelandClaude Opus 5.5
|
6d1e3952be |
settle async diff tallies in workspace comparison tests (#11963)
test_compare_secret_variables_by_value planted workspace_diff rows with a plain INSERT after a DELETE, but the variable creates tally those rows from a spawned git-sync task that can land between the two, failing with a workspace_diff_pkey violation. Upsert the plant instead. test_rename_records_the_vacated_path could read the inline create's `write` event, or have it overwrite `rename_from`, since both deploys tally from their own spawned task. Wait for the create's tally before the rename and poll for the event that replaces it. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
AlexRV12andRuben Fiszel
|
0dd131b380 |
fix: compare fork secret variables by decrypted value (#11952)
* fix: compare fork secret variables by decrypted value * test: restore MIN_VERSION even when the secret compare test fails * fix: re-evaluate cached variable diffs once after the secret compare fix * refactor: decrypt already-loaded secret rows when comparing variables * docs: state the authorization contract of decrypt_secret_value * fix: compare external-backend secrets by their resolved values --------- Co-authored-by: Ruben Fiszel <ruben@windmill.dev> |
||
|
hugocasaandClaude Opus 5.5
|
c6a93a9b56 |
feat: chat with a saved agent from a raw app through an agent runnable (#11921)
* feat(chat-sdk): chat through a raw app's backend runnable Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(chat-sdk): finish a lost stream and wait out a stopped turn in streamChatTurn Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(chat-sdk): show the answer when a stream is lost before a tool call Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(chat-sdk): send attachments through the raw app runnable Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(chat-sdk): point sandboxed attachments at the runnable section Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: agent runnables for raw apps Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: build agent runnables without the parquet feature, cache the agent check query Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: address review nits on the agent picker and the CLI schema doc Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: run an agent runnable once when it is given no memory_id Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: accept previous_messages on agent runs, read-checking the files it quotes Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: refuse an anonymous agent turn while one with the same memory still runs Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: show the agent's settings in the raw-app runnable panel, size its button like the row Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: offer an agent runnable memory_id or previous_messages after the agent's memory Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: take previous_messages in a memory-off agent's run form, type agent attachments as s3object Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: file an anonymous agent turn as a conversation, so its memory is collected and its turns serialized Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: own anonymous agent conversations under a fixed name that fits created_by Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: own anonymous agent conversations as anonymous and keep them out of conversation lists Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: point file_chat_turn at the anonymous conversation owner Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: title the runnable picker after what it lists, in sentence case Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: start a chat with local history listing its stored conversations Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: chat through a raw app's agent runnable with { wmill, runnable } Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: key an agent runnable chat's local history by its app as well Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: address review findings on agent runnables Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: offer memory_id to an agent runnable over an older auto memory Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: drop inherited static inputs from an agent runnable, show the memory-off note only when it is off Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
|
dc1fb5087b |
feat: let native triggers act through per-user or shared connections (#11352)
* fix: only let an oauth account's creator or readers link it to a variable Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: drop an oauth account link the caller may not hold instead of failing Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: cover relinking an oauth account through a variable update Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: cover a permitted relink through a variable update Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep an oauth account's creator in step with the user's username Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: follow a non-member superadmin's instance username on the OAuth accounts they created Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor: link a variable to its OAuth account only in the connect flow The variable endpoints no longer take an account link from the caller. The connect flows create the token variable first and pass its path to create_account, which links it server-side. This replaces the creator check and the created_by bookkeeping, along with both migrations. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: keep the MCP secret variable test's formatting Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: link the account to the token variable AppConnect created, even if the path is edited mid-save Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: stop exporting the OAuth account a variable links, and regenerate the chat tool schema Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: pin the EE refresh and linking checks Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: delete AppConnect's token variable when linking its account fails, so Save can be retried Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep the resource AppConnect fills when linking its account fails Deleting a variable also deletes the resource at its path, so the rollback is skipped when filling an existing resource. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor: create an OAuth token variable and its account in one request createAccount takes the variable and the store creates both in one transaction, so a connect is either fully saved or not at all. The connect flows make that single call instead of creating the variable and linking it afterwards. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: stop listing the ignored account input in the chat's write_variable instructions Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: drop the account visibility helper the oauth refresh route no longer uses Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: let native triggers act through per-user or shared connections Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: bind native trigger oauth state to its user and follow connection renames Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: authorize oauth account links and scope native trigger disconnects Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: order the native trigger connection migration after account ownership Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: delete only the scope-checked triggers when disconnecting Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: skip triggers moved since their scope check when disconnecting Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: scope-check the connection path when connecting, keep a connection still in use Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: key token write-back by account and serialize trigger creation with disconnect Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: let an admin share one native trigger connection with the whole workspace Members can use the shared connection without reading its token. It reuses workspace_integrations.resource_path, so existing workspace connections stay usable by members after upgrading. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: pick the workspace connection like other workspace resources, connect and disconnect from the picker Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: label the disconnect action in the connection picker Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: drop the own-account note from the workspace connection field Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: let admins share any connection, serialize service removal with trigger creation An admin can already read every connection, so restricting sharing to their own added nothing. Removing a service now takes each connection's lock and keeps everything if a trigger was created meanwhile. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: show each native trigger service's OAuth app status and keep removal apart Remove now only appears with a workspace OAuth app, since a workspace using the instance app has nothing of its own to remove. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: configure a native trigger service's OAuth app in a dialog The card states once which OAuth app is in use, with a single Configure action, and the form follows the design system. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: drop a stray brace from the OAuth app dialog binding Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: lead the OAuth app row with which app is in use, with a link to change it Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: compact the native trigger service card Edit and Remove sit on the workspace OAuth app row, and the workspace connection reads as part of the same section. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: show the OAuth app status in each native trigger card's header App actions move into a menu, the card body holds only the shared account, and service descriptions name what fires the trigger. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: say who configured each native trigger service, and name removal for what it removes Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: say what members can do with each native trigger service, keep the shared account optional Nextcloud, whose webhooks need an admin account, offers connecting and sharing one directly instead. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: pick the shared account with an inline select, and keep Nextcloud's own-account path in its wording Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: one status line per native trigger service, a Nextcloud admin hint, and clearer refusals The shared account is a regular form field, Nextcloud shows an alert while no admin account is shared, a non-admin Nextcloud account gets a message saying why it cannot create triggers, and the OAuth dialog only accepts a full server URL. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: point native trigger error hints at the account picker and the shared account Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: say members can browse what a shared native trigger account can access Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: make the OAuth app dialog's open prop required Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep pre-connection triggers working, and guard reconnects and service removal - The migration recovers a service's connection when the workspace row lost its path, which saving the OAuth app or an abandoned instance connect used to do. - A trigger created without a connection uses the shared account, as older clients and trigger specs expect. - Only whoever connected a path, or an admin, may reconnect over it. - Removing a service or sharing an account checks a path-scoped token against what it touches. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: connect native trigger accounts at a chosen path through the resource drawer, and reconnect from the picker Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: date the native trigger connection migration after main's newest Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: say a disconnect deletes the triggers other members created on the account Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: offer Reconnect next to an existing trigger's account and point the refresh hints at it Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: date the native trigger connection migration after main's newest Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: update ee-repo-ref to da49c12e3006fc77de789277f1462a4d8d7d92ce This commit updates the EE repository reference after PR #829 was merged in windmill-ee-private. Previous ee-repo-ref: 58681a2e7eafb5689ed739cd2560fa0f5d82c3dc New ee-repo-ref: da49c12e3006fc77de789277f1462a4d8d7d92ce Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |
||
|
|
d6adac8b75 |
fix: link a variable to its OAuth account only in the connect flow (#11361)
* fix: only let an oauth account's creator or readers link it to a variable Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: drop an oauth account link the caller may not hold instead of failing Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: cover relinking an oauth account through a variable update Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: cover a permitted relink through a variable update Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep an oauth account's creator in step with the user's username Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: follow a non-member superadmin's instance username on the OAuth accounts they created Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor: link a variable to its OAuth account only in the connect flow The variable endpoints no longer take an account link from the caller. The connect flows create the token variable first and pass its path to create_account, which links it server-side. This replaces the creator check and the created_by bookkeeping, along with both migrations. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: keep the MCP secret variable test's formatting Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: link the account to the token variable AppConnect created, even if the path is edited mid-save Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: stop exporting the OAuth account a variable links, and regenerate the chat tool schema Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: pin the EE refresh and linking checks Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: delete AppConnect's token variable when linking its account fails, so Save can be retried Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep the resource AppConnect fills when linking its account fails Deleting a variable also deletes the resource at its path, so the rollback is skipped when filling an existing resource. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor: create an OAuth token variable and its account in one request createAccount takes the variable and the store creates both in one transaction, so a connect is either fully saved or not at all. The connect flows make that single call instead of creating the variable and linking it afterwards. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: stop listing the ignored account input in the chat's write_variable instructions Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: drop the account visibility helper the oauth refresh route no longer uses Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: update ee-repo-ref to da49c12e3006fc77de789277f1462a4d8d7d92ce This commit updates the EE repository reference after PR #829 was merged in windmill-ee-private. Previous ee-repo-ref: 58681a2e7eafb5689ed739cd2560fa0f5d82c3dc New ee-repo-ref: da49c12e3006fc77de789277f1462a4d8d7d92ce Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |
||
|
|
34de8bc06d |
feat: slack agents through a workspace's own slack app (#11912)
* feat: let Slack agents answer through a workspace's own Slack app, with signing secrets set from the UI The instance Slack app's signing secret can be set in its OAuth setting as well as SLACK_SIGNING_SECRET, and a workspace's own Slack app takes its own in the workspace settings. Each secret only vouches for the workspaces connected through its app, so /windmill keeps working for a workspace whose app has none set. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep Slack signing secrets out of logs and verify an own app without a secret with the instance's Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: report a workspace app's own signing secret in the Slack agents status Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: check Slack approval callbacks against the instance signing secret only An approval can be sent through any Slack resource, so the team's workspace connections do not tell which app signed its callback. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: share the Slack app setup instructions and require the signing secret for agents Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: tidy the Slack signing secret copy and show a set secret as masked Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: check a workspace app only against its own signing secret, and approvals against their workspace's Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: accept a Slack approval signed by the workspace's app or the instance's Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: check Slack's signature on approvals only when sent through the workspace's Slack connection Any other Slack resource may belong to any Slack app, so its callbacks rest on the payload HMAC alone. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: address review findings on Slack signature checks and the signing secret field - reject Slack signatures older than five minutes, so a captured request cannot be replayed - let a reachable workspace's command script take a message before another workspace's help reply - remove a saved workspace signing secret from its field: the button reads Remove when it is empty - set the signing secret on connect only when one was entered - tell non-admins who can set the signing secret Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep SLACK_SIGNING_SECRET for workspace apps without a secret, and route a verified request only to its workspaces - a workspace on its own app with no secret of its own is checked against SLACK_SIGNING_SECRET, which may hold that app's secret from before workspaces had one; the instance setting's secret still never applies to it - once a secret verifies a request, only the workspaces it verified take it, command scripts included: it proves which app sent the request - compute the replay window with abs_diff, which cannot overflow Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: update ee-repo-ref to c8d562aa9d75a7e99bf0ecd1ac224f532452a07e This commit updates the EE repository reference after PR #907 was merged in windmill-ee-private. Previous ee-repo-ref: 0864b0ab943defa8b8d55838ef09ab7dacfac17f New ee-repo-ref: c8d562aa9d75a7e99bf0ecd1ac224f532452a07e Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |
||
|
|
892334f008 |
feat: serve the ai session toolset over mcp at /api/mcp (#11738)
* feat: add a workspace mcp server with the ai session toolset Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep workspace mcp tool calls on their own routes Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep a token's job tag fence on workspace mcp tool calls Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: state the workspace mcp token rule in its refusal message Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: let the workspace mcp server span workspaces chosen per token Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: let the mcp url form choose between the tools and workspace servers Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: serve the workspace mcp server as windmill mcp v2 at /api/mcp/v2 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: add read-and-run access to windmill mcp v2 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: serve the full windmill mcp experience at /api/mcp, sign-in first Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: align the mcp url form with the brand guidelines Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: serve every mcp token from /api/mcp, with one access picker Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: rename mcp access levels and keep selections to scripts and flows on /api/mcp Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: name the mcp access levels in the url caption Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: name the mcp server windmill Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: lead the mcp access picker with build and run, and spell out what a selection excludes Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: show the tools each mcp access level gives Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: list the mcp tools in a collapsible section under the access row Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: offer all scripts and flows as typed mcp tools again, as wildcard scopes Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: label the mcp selection access as scripts and flows as tools Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: link mcp run, app draft and deploy results to their windmill pages Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: mirror the session tool changes from main in the mcp server Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep an ai agent's identity when the ai chat deploys its resource Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor: call the api in-process from the mcp session tools Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep a draft that rebase_draft could not return whole Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: let read-and-run mcp tokens run scripts and flows that take secrets Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: ask mcp clients to open windmill links in a browser the user sees Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: send mcp clients condensed instructions and serve the full rules on demand Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor: put the core rules first in the mcp instructions instead of condensing them Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: go straight to the mcp sign-in page after login, without the workspace picker Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: no workspace error toast on the mcp sign-in page while logged out Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: open raw app previews on the preview alone, from mcp links and in sessions Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: link mcp script, flow and agent drafts to their editors, and agents to their page Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep the session preview's saved sidebar choice, fold the build log in preview-only views Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: hold mcp tokens below full access to their level on the per-workspace urls Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: revoke tokens with the new mcp scopes when the migration is reverted Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep an mcp token's scopes when its editor is saved without changing access Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: mint one jwt per mcp tool call, accept the old approve body, list the new scopes Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: reset the mcp token editor's picker state for each token Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor: mark only mcp selections, read levels imply no endpoint tools Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: update ee-repo-ref to b3fd7d49f2ba58f5080fabc3a5686c34a0b2684c This commit updates the EE repository reference after PR #877 was merged in windmill-ee-private. Previous ee-repo-ref: 9e960246d51401a2b0487dcffcadd0b43cd67d39 New ee-repo-ref: b3fd7d49f2ba58f5080fabc3a5686c34a0b2684c Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> Co-authored-by: Ruben Fiszel <ruben@windmill.dev> |
||
|
|
21d2a49971 |
feat: configurable workspace roles with per-workspace overrides (#11821)
* feat: configurable workspace roles with per-workspace overrides Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: close role review gaps in pickers, declarative sync and removal Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: keep resolve_role_name doc on its function Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: validate overrides on instance role changes and bill admins fully Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: allow pipeline drafts and keep role checks on one connection Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: list data pipelines in operator_can_draft Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: expect a 403 role refusal when an operator resolves jobs Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: require a valid license for custom workspace roles Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: freeze workspace roles when the license lapses Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: pin the ee companion for workspace roles Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor: broadcast role override changes from the write path, not a trigger Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: update ee-repo-ref to b5294d38db082bdd104d5358a47695390694c05d This commit updates the EE repository reference after PR #891 was merged in windmill-ee-private. Previous ee-repo-ref: 688e00c5982865b14098f530d54280e2311994c0 New ee-repo-ref: b5294d38db082bdd104d5358a47695390694c05d Automated by sync-ee-ref workflow. * fix: let an admin row that kept the operator flag hold full rights everywhere Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: treat superadmin members as admins and return role names from get user Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |
||
 Alexander PetricandClaude Opus 5.5
|
c04477723c |
fix: revoke mcp oauth grants on password change and reset (#11908)
* fix: revoke mcp oauth grants on password change and reset Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: revoke pending mcp codes and serialize grants against revocation Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: run mcp refresh theft check on the grant transaction Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: log commit failures of rejected mcp oauth exchanges Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> |
||
|
|
8ddb358198 |
fix: refresh oauth tokens without holding a pool connection (#11905)
* fix: refresh oauth tokens without holding a connection across the exchange Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: pin ee ref for the oauth refresh fix Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: update sqlx cache for the oauth refresh queries Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: coalesce forced oauth refreshes and drop the redundant mcp visibility check Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: store refreshed oauth tokens at every linked variable and only reuse a fresh one Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: date oauth expiry from the exchange and fan out only to secret variables Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: update ee-repo-ref to 3546b6b080e0234335ed2c8e2e9cc3d595bbadca This commit updates the EE repository reference after PR #906 was merged in windmill-ee-private. Previous ee-repo-ref: 12d1fb5978e66af462398c789b861706a2367ed0 New ee-repo-ref: 3546b6b080e0234335ed2c8e2e9cc3d595bbadca Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |
||
|
|
2c559b452f |
fix: stop holding a pool connection while waiting for another (#11902)
* fix: stop holding a pool connection while waiting for another Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: count only earlier occurrences as schedule handler history Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: update ee-repo-ref to ac53164fd27fe962a020f3ee944949df1f760603 This commit updates the EE repository reference after PR #904 was merged in windmill-ee-private. Previous ee-repo-ref: 047764f902f10fce0156138c4240ba5d1a2e969a New ee-repo-ref: ac53164fd27fe962a020f3ee944949df1f760603 Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |
||
|
hugocasaandClaude Opus 5.5
|
c3112f8e07 |
add missing sqlx cache entry for the Slack disconnect query (#11892)
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
|
35b250e767 |
feat: let AI agents answer in Slack (#11630)
* feat: let AI agents answer in Slack Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: dedupe Slack deliveries by message and route only connected workspaces Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: key Slack conversations with the workspace secret and require signed Slack requests Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep a named agent on its thread after an empty question and flag a missing Slack signing secret Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: register the slack_agents token scope domain Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: name the Slack bot, offer Slack only for chat agents, align the agent API tab with webhooks Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: warn when Slack can't be reached instead of showing a placeholder bot name Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: chat SDK, streaming examples and a copyable integration prompt on the agent API tab Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep the base path in the chat SDK example, list slack_agents token scopes, bound the bot name lookup Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: opt into the AI agent Slack scopes at connect, store the signing secret in instance settings, surface the integration prompt Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: dispatch Slack agents only on a verified request, warn when the connection lacks the agent scopes, register the callback redirect URLs Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: point the agent chat examples at @windmill-labs/chat-sdk Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: build the agent API examples on the configured API base URL Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: say that a channel's default agent takes its /windmill commands Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: list the channels answered by an agent in the workspace Slack settings Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor: keep the Slack signing secret in SLACK_SIGNING_SECRET, warn at connect when it is missing, move the integration prompt to a tab Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: wrap copyable code blocks at word boundaries Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: open the agent panel on its API tab, put the AI prompt first, list channels like the critical alert channels, cap the manifest's height Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: group the agent API examples by AI prompt, TypeScript and HTTP, with React and framework-free chat SDK examples Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: have the agent integration prompt read the token from WINDMILL_TOKEN Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: trim the agent API tab intro, name the Slack app in mentions, define the SDK example's output Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: share agents in selected Slack channels, run as their identity Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: share agents in Slack channels with anyone or workspace members only Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: set who can ask an agent in Slack and its channels from its settings Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: treat a missing Slack audience as workspace members Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: list Slack channels before who can ask, name the run-as user in each choice Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: name the next deploy's run-as user in Slack choices, turn agents on by default when connecting Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: answer agents on mentions only, group agent settings into sections Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: show how to ask an agent in Slack first, keep agent scopes opt-in Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: list agents shared in Slack in a setting card and table Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: update ee-repo-ref to 10bc314c95094c0851743cbca31b50a3b37d42fd This commit updates the EE repository reference after PR #865 was merged in windmill-ee-private. Previous ee-repo-ref: 47d8fbac461171bd93d888b49cc1c7730a2b3f96 New ee-repo-ref: 10bc314c95094c0851743cbca31b50a3b37d42fd Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Ruben Fiszel <ruben@windmill.dev> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |
||
|
Ruben FiszelandClaude Opus 5.5
|
6a12e7ea49 |
test: fix error handler test flake and merge handler test binaries (#11850)
* test: fix error handler test flake and merge handler test binaries Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: tighten workspace handler test comments Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
Ruben FiszelandClaude Opus 5.5
|
09a59110d9 |
fix: scope delete_jobs side-table deletes to the request workspace (#11836)
* fix: scope delete_jobs side-table deletes to the request workspace The /jobs/delete purge deleted resume_job, v2_job_runtime, v2_job_status and concurrency_key rows by job id alone. Those tables have no workspace_id, so a workspace admin could pass another workspace's job ids and wipe its flow status, runtime, resume and concurrency rows. Scope each delete through v2_job, as zombie_job_counter already is. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor: filter delete_jobs ids to the workspace once Resolve the request's job ids against v2_job up front and run every delete on that filtered list, instead of repeating the v2_job subquery in each side-table delete. The workspace scoping lives in one place and the side-table deletes keep their plain id form. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
|
9375805fdf |
feat: isolate fork object storage under a per-fork prefix (#11829)
* feat: route the python SDK's S3 client settings through the S3 proxy Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: drop the boto3 config key and expose the proxied bucket to polars Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: update ee-repo-ref Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: proxy S3 settings only for server-signed tokens and keep tls verify Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: update ee-repo-ref Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: isolate fork object storage under a per-fork prefix with read-through Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: guard fork storage isolation against traversal, shared lakes and orphaning Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: serialize fork purges with same-id creation and guard shared middle forks Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: drop fork storage mappings on every replica and lock fork deletion against child creation Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: update ee-repo-ref Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: update ee-repo-ref Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: update ee-repo-ref Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: update ee-repo-ref to 455681e55eb7cdfcfdb7cd79cbae75b333e07943 This commit updates the EE repository reference after PR #893 was merged in windmill-ee-private. Previous ee-repo-ref: 93f26e3cf816e4eb97b7d4dbbb5fc97fdf9821af New ee-repo-ref: 455681e55eb7cdfcfdb7cd79cbae75b333e07943 Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |
||
|
Ruben FiszelandClaude Opus 5.5
|
07560168a1 |
[ee] feat: add a toggle to not isolate forks of non-dev workspaces (#11830)
* feat: add a toggle to leave forks of non-dev workspaces out of dev isolation Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: track the non-dev forks toggle reactively and bound the forking rule checks Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: point ee-repo-ref at the skip non-dev forks telemetry registration Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep forks of archived dev workspaces isolated and warn about forkable non-dev forks Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: reset tag lineage caches on every archive and unarchive Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * perf: cache the token dev lineage lookup and trim isolation hot-path costs Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: point ee-repo-ref at the merged skip non-dev forks telemetry registration Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
|
6e565b0dcb |
feat: route dev workspace and fork jobs to their own worker groups (#11811)
* feat: route dev workspace and fork jobs to their own worker groups * fix: harden dev workspace isolation against review findings * fix: verify hashed dedicated tags and keep dev lineage across renames * fix: let tag-scoped tokens reach jobs queued on dev workspace tags * fix: expand tag scopes only in dev workspaces and forks * fix: expand tag scopes only while dev workspace isolation is on Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: collapse the dev workspace isolation section by default Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: count dev workspace isolation toggles and dev-serving group flags Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: validate the dev workspace tag suffix on every instance config writer Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: update ee-repo-ref to 71e9c0de8317e839f955ebef6a819062f20ac418 This commit updates the EE repository reference after PR #892 was merged in windmill-ee-private. Previous ee-repo-ref: b5ab84e1705f939c399f6315a03f88b55bce1804 New ee-repo-ref: 71e9c0de8317e839f955ebef6a819062f20ac418 Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |
||
|
Ruben FiszelandClaude Opus 5.5
|
7c63a30edd |
fix: let deployed low-code apps run database studio queries again (#11816)
* fix: let deployed low-code apps run runtime-built inline queries again Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: limit id-less app runs to the database studio's sql languages Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: cover the deployed-row exclusion with sql content Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
hugocasaandClaude Opus 5.5
|
0b980546b1 |
feat: agents run on behalf of their deployer (#11430)
* Revert "docs: agent editor comments describe runs as the caller" This reverts commit |
||
|
Ruben FiszelandClaude Opus 5.5
|
a9aa2b8229 |
feat: share AI sessions read-only by link, optionally public (#11799)
* feat: share AI sessions read-only by link, optionally public Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: render shared session snapshots from an allowlist, without mermaid or remote images Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * style: make the session share button icon-only Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: safe reasoning links, artifact list and full-load exits on shared sessions Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
Ruben FiszelandClaude Opus 5.5
|
f827ba0566 |
feat: resolve canceled jobs and re-run them in limited batches (#11797)
* feat: resolve canceled jobs and batch re-run them in limited batches Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: offer the re-run batch limit only for failed or canceled filters Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: label an unresolved canceled run as canceled in its status badge Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: tell the user that sources a batch could not re-run block the next batch Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: warn when a re-run batch includes resolved runs and offer to hide them Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: say in the re-run confirmation that failed or canceled sources get resolved Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
|
64e1630d49 |
fix: let Teams handlers post with job tokens again (#11792)
* fix: let job tokens post Teams messages to their own workspace's team * chore: point ee-repo-ref at the Teams job-token check * chore: update ee-repo-ref to 3b6bd2b15d9bddb0bb8f1de08b30b897db0415b4 This commit updates the EE repository reference after PR #885 was merged in windmill-ee-private. Previous ee-repo-ref: e8e4bcd63d6fc804d29e67d42ca6d4163b144a33 New ee-repo-ref: 3b6bd2b15d9bddb0bb8f1de08b30b897db0415b4 Automated by sync-ee-ref workflow. --------- Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> Co-authored-by: Ruben Fiszel <ruben@windmill.dev> |
||
|
Ruben FiszelandClaude Opus 5.5
|
aca7fed33d |
fix: relock apps in place so imported script changes reach them (#11789)
* fix: relock apps in place so imported script changes reach them Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: requeue an app relock whose version was rewritten meanwhile Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: relock every component of the version a superseded app relock requeues Also share raw-app runnable dependency extraction between the worker and the dependency-map rebuild, and take no-key-update row locks, which still order against a deploy's UPDATE without blocking app_script inserts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: relock every component when an app relock runs on a newer version Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: resolve a requeued app relock's components when it runs Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: regenerate every lock when an app relock relocks every component Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
Ruben FiszelandClaude Opus 5.5
|
7eee210d76 |
perf: drive schedule already-exists check from an indexed queue lookup (#11783)
* perf: drive schedule already-exists check from v2_job_queue Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * perf: index v2_job_queue by workspace and scheduled_for Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
|
526da60da9 |
feat: let raw app backend runnables import each other (#11777)
* fix: iterate workspace picker nav items without spreading a NodeList Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: let raw app backend runnables import each other Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: preview only imported sibling runnables and reserve the main id Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: resolve a module's workspace imports from the entrypoint's folder Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: scope run-mode app scripts to their app and key bundles on module imports Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: clone app_version_lite into forks with remapped app_script ids Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: update the run-mode raw_code comment for app-scoped ids Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: run module-bearing app scripts only from the deployed version Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: run deployed inline code only through the deployed version's rows Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: in-workspace app viewers run through the deployed rows Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: let the app embed token read the app's lite value Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: pass sibling modules to the agent-worker Python preview resolver Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: list the lite route in the app embed scope comment Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: update ee-repo-ref to 455f98540fb042d4f624dcec681dab88b2c8df22 This commit updates the EE repository reference after PR #883 was merged in windmill-ee-private. Previous ee-repo-ref: 927d3592a6b2127ffe16fb14eb47f5bd66afc026 New ee-repo-ref: 455f98540fb042d4f624dcec681dab88b2c8df22 Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |
||
|
08319a004c |
feat: allow early return on steps inside branches (#11733)
* feat: allow early return on steps inside a branch to one The "Early return for sync webhooks" flow setting could only point at a top-level step. It can now also point at a step inside a branch to one, in any branch including the default one, and through nested branches to one. When the branch is taken, the sync call returns that step's result as soon as it completes while the rest of the flow keeps running. When it is not taken, the call returns the flow's final result. The sync wait loops already resolved nested steps and fell back to the final result, so they are unchanged. Worker: check_if_early_return_or_last_in_early_return_parent now accepts a job whose step id matches early_return at any depth, as long as every job between it and the root is a branch to one. A loop iteration or a subflow reusing the same id does not take the stream. The existing case, the last step of a branch to one that is itself the early-return step, is unchanged. Frontend: the native <select> is replaced by EarlyReturnPicker, a searchable list in flow order where each nested step shows its path (e.g. `a › Branch 1`). Branch to all and loops inside a branch to one, and the steps inside them, are not offered: the results lookup cannot resolve them when nested. Picking a nested step shows a hint that it only runs if its branch is taken. * fix: stream the last step when the early return branch is not taken Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep the stream off the last step once the early return step ran Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor: list early return steps by id only Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor: use the standard select for the early return step Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: match the early return step by its flow scope, not its path Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep branch to all and loop steps off the early return stream Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: allow early return on steps inside a branch to all Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: resolve a nested branch to all or loop as the early return step Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: pin which step streams for an early return inside branches Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: return an empty nested loop or branch to all as its early return list Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * revert: read an empty container's early return status from the root An empty nested loop or branch to all falls back to the flow's final result again, so an empty top-level loop that failed keeps its real status. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: stefan <stefan.radovanovic@ip-paris.fr> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
Ruben FiszelandClaude Opus 5.5
|
9a5ec223bc |
feat: workspace settings as one document, applied server-side (#11740)
* feat: add the workspace settings document, applied server-side * feat: add wmill workspace get-settings and apply-settings * fix: warn on unknown settings keys and refuse ee-only ones in the dry run Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: stub the settings document endpoint in the push settings unit tests Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: refuse mistyped settings and keep 4xx status on a partial settings apply Reject non-boolean switches and non-string Slack credentials instead of coercing them into destructive writes, preserve the failing endpoint's status when wrapping a partial-apply error, keep the stored Slack secret when an older CLI pushes one encrypted under another workspace's key, print the plan's warnings in apply-settings, and state the admin check load_settings_document leaves to its caller. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: compare handler arguments verbatim and type-check scalar settings A handler's extra_args is stored as sent and its nulls reach the job as arguments, so an added or removed null argument is now a change. Scalar settings are type-checked in the plan so a dry run never reports a change the endpoint then refuses, and an error handler's omitted mute flags compare as the false the endpoint stores. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: require a 32-bit integer rate limit in the settings plan Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: data table permissions and protection rules in the settings document The settings document gains datatable_permissions, each data table's roles named by their Postgres role name and written by catalog id, and protection_rules, keyed by rule name. Both are managed only when stated and stated as a whole. The dev workspace lock stays with the dev workspace setting. wmill sync carries datatable_permissions only with includeDatatablePermissions (or --include-datatable-permissions), since tenants and roles are specific to a workspace and an instance. protection_rules stay out of settings.yaml: protection-rules.yaml syncs them. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: validate the default data table role and plan permissions against a replaced datatable Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
|
b7b3306195 |
feat: read data as the job's identity, viewer is opt-in per runnable (#11744)
* feat: connect a data table as the job's own identity unless the runnable opts into its viewer Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: key cached results by the data table mode and keep the flag across ai edits Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: hash the cache key's mode and viewer as fixed fields so no argument name can forge them Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: update ee-repo-ref to 2f74548ad1ec50c8e1faf17e42d5648160e833f1 This commit updates the EE repository reference after PR #878 was merged in windmill-ee-private. Previous ee-repo-ref: 4ad768a777fff9f1ecc86a2803bc27d80f8242d6 New ee-repo-ref: 2f74548ad1ec50c8e1faf17e42d5648160e833f1 Automated by sync-ee-ref workflow. * feat: rename the flag to viewer_data_access and apply it to object storage permission rules Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: describe viewer_data_access as covering object storage rules too Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: update ee-repo-ref to 0ffb633473c5465513576afc6f54d18f93c7f1e1 This commit updates the EE repository reference after PR #879 was merged in windmill-ee-private. Previous ee-repo-ref: e9e06a9eb94168f46b378276b01fa0117dc7d8ed New ee-repo-ref: 0ffb633473c5465513576afc6f54d18f93c7f1e1 Automated by sync-ee-ref workflow. * feat: show the viewer data access control as an icon button Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |
||
|
Alexander PetricandClaude Opus 5.5
|
add042ef2f |
fix: end other sessions when a user changes their password (#11710)
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> |
||
|
|
157183ae9c |
feat: external signer for OIDC tokens and a log line per mint (#11614)
* feat: sign OIDC tokens with an external signer and log every mint * fix: init the signer in sqs_trigger builds and show signer reachability from results * fix: key the OIDC key rows by source and kid * chore: bump ee ref and list the oidc-signer subcommand only where it exists * fix: advertise the actual signing algorithm in OIDC discovery Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: harden the external signer startup, agent workers and failed mints Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: bump ee ref for the stored key listing fix Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: list the oidc signing settings page only with an external signer Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: update ee-repo-ref to 1e538620a9b2f08b044997d032e71d8720ecbd5c This commit updates the EE repository reference after PR #859 was merged in windmill-ee-private. Previous ee-repo-ref: 84fa325737df98407c7b9f79c09d6e9378c46147 New ee-repo-ref: 1e538620a9b2f08b044997d032e71d8720ecbd5c Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |
||
|
Ruben FiszelandClaude Opus 5.5
|
1e3aef877c |
test: fix flaky success handler integration tests (#11691)
* test: stop success handler tests sharing the deployed script cache Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: drop the sqlx cache entry of the removed test query Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
|
02e4697157 |
feat: let operators compose full-code apps when the workspace grants it (#11229)
* feat: let operators compose full-code apps when the workspace grants it Adds operator_settings.builder_apps, the second builder right, granted independently of flows because the two are not equally verifiable: a composed flow is checked in full server-side, while a full-code app is a browser-built bundle no check can read. The app right rests instead on forced sandbox isolation, a refusal of Viewer execution mode, and a deploy-time check of every runnable the app can reach. BuilderKind arrives with the second kind and is a mandatory argument, so no gate can mean "either" by accident: one that did would authorize an app write on a flows-only workspace. The only surfaces reading .any() are the ones that are genuinely not per-kind, the seat a membership costs and listing drafts. validate_operator_composed_app checks two surfaces rather than one, because they are not the same list: the policy's triggerables and the runnableByPath entries in the app value, which is what the deployed bundle actually resolves against. Every colon in a triggerable key is a possible split, since execute_component looks up "<component>:<path>" with an unrestricted component string. create_app_raw_source stays closed: it compiles caller-supplied sources with a bundler job on a worker, which is arbitrary code execution. Builders lose nothing, since the browser and the CLI both bundle locally and deploy through the multipart endpoints. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Dsf6VC4MVLisiEoeQkgbr4 * fix: list a builder's app drafts and refuse inline code in them Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: update ee-repo-ref to 6d15ff957df4dcd5129e1ab217eab1a13af62fbb Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: check a builder app as it will be stored Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: show the home list edit button to builder operators Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: pause the raw app preview for an app an operator deployed Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: let app builders save a full-code app's deploy settings Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: record the builder app settings path, public apps and the editor preview Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: cache the merged EE seat usage query The EE query now reads audit_partitioned and skips service accounts, so the cached entry for its builder_apps predicate no longer matched and offline EE builds failed with no cached data. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: pause the raw app preview for loaded drafts and unknown authors A draft loaded from an operator ran in the viewer's preview because the pause only checked the app's last deployer, and an author no longer in the workspace read as a developer. The pause now checks a loaded draft's owner, records it in the viewer's draft until the preview is run or deployed, and holds when the author cannot be found. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: name guest apps among the modes a builder may deploy Guest runs as the publisher with no Viewer fallback, like Publisher and Anonymous, and RestrictGuestAppDeployment refuses it per workspace. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep a loaded draft's preview paused in AI sessions and chat edits The session draft codec and the chat's draft save dropped loaded_from, so opening a paused operator draft in an AI session, or editing it through the chat, ran it with the viewer's session. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: pin builder refusals for low-code apps and unreviewed previews Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep the operator mark when loading a developer's copy of a draft Loading another user's draft recorded only who saved it, so a developer's copy of an operator draft they never previewed opened unpaused for the next person who loaded it, running the operator's code with their session. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: let builders restore a full-code app from deployment history Restore always sends allow_kind_change, which the builder check refused even for a full-code version restored over a full-code app. Builders now drop the flag, so the locked kind check still refuses an actual conversion. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * style: rustfmt the builder checks in jobs.rs Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: record the builder kind-check race as an accepted risk Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: never trust the owner name a loaded draft carries A loaded draft's loaded_from is written by its owner, so an operator could name a developer, or leave it empty, and the next person to load the draft previewed it unpaused. A loaded draft that carries any mark now stays paused as unattributable; an unmarked one is still checked against its real owner. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: record viewer-supplied resources in builder apps as an accepted risk Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: say that the app right lets operators write frontend code The settings section and the docs told admins builder operators "still cannot write code", but the app right has them write the app's frontend bundle. Only backend code stays out of reach. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: state the raw-source closure once and drop an unreachable preview case Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * perf: look up only the author when deciding whether to pause the preview Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: pin that the app right alone bills operators as developers Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: point ee-repo-ref at the EE seat test Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor: drop the editor preview pause now that sandboxed apps preview isolated Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: refuse a builder operator's app draft without the sandbox Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: turn the sandbox on when a builder operator opens the app editor Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: refuse builder app drafts naming runnables they cannot read Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: note the editor preview asks before minting a builder app token Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor: trim the builder app check comments to the constraints Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: refuse an app runnable whose runType is not script, flow or hub Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: check builder app draft policy keys like a deploy does Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: count main's half-seat service accounts in the builder billing test Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor: name the builder policy check for drafts as well as deploys Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: let a builder app draft autosave with a stale triggerables_v2 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: check the script version a builder app would run, not any version Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: refuse viewer mode in a builder app draft as on deploy Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor: hold builder app drafts and deploys to one check Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: say a builder's script may not have finished deploying Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: cap builder app triggerable keys before reading every colon split Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: refuse a builder app draft that runs as someone else Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: conform builder app drafts saved by the AI chat as the editor does Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: record that a deployed builder draft runs as its deployer Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: refuse builder app runnables not written as plain text Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: a builder draft may carry its builder's own run identity Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: offer builders Start with AI only when it opens a session Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: name full-code apps in the builder rights confirmation Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: name only the granted builder rights in the confirmation Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: note a wm_deployers builder may keep another run identity Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: give builders a starter app that calls no missing runnables Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: seed the builder starter under the picker for builders Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: qualify the builder run identity comment for wm_deployers Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: resolve builder app script hashes before opening the RLS transaction Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: run the builder app tests serially to share the rights cache safely Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: give builders the builder starter on a fresh editor load Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: drop a new-app load overtaken while waiting for the workspace list Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep main's 401 for operators previewing without the app right Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: update ee-repo-ref to 5d7726c4979070ee8db4fb9e8014152872a641ba This commit updates the EE repository reference after PR #816 was merged in windmill-ee-private. Previous ee-repo-ref: 7151060bfc02908e97d9344b3820ee33a4951322 New ee-repo-ref: 5d7726c4979070ee8db4fb9e8014152872a641ba Automated by sync-ee-ref workflow. * refactor: let the app row's edit button trust its write flag Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: point ee-repo-ref at the merged EE companion Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: note the session raw-app editor does not conform builder drafts yet Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |
||
|
Ruben FiszelandClaude Opus 5.5
|
cda78830fd |
feat: stop offering deno for new scripts, ship it only on full images (#11648)
* feat: stop offering deno for new scripts and ship it only on full images Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep deno in the integration test worker and narrow the missing-deno error Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep deno selectable on existing deno scripts when the saved order omits it Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: drop the deno workloads from the benchmark suite Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: run bun instead of deno in tests that are not about the deno runtime Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: drop the deno cases from the integration suite Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: update the app policy hash for the bun inline script Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
hugocasaandClaude Opus 5.5
|
1dc4ed5e7f |
feat: add a jobs:run:dependencies token scope for lock generation (#11643)
* feat: add a jobs:run:dependencies token scope for lock generation Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: pin lock-job reads to the dependencies scope Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: align scope labels with and without a restrict paths button Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: match a lock job's stored path literally on job reads Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: drop the dependency-lock warning from the jobs scope heading Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KNiYsRRDyvkRYwkHda6uyf --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
hugocasaandClaude Opus 5.5
|
2b55a8afbc |
feat: replace the hub_sync script with an opt-in daily server sync (#11624)
* feat: sync hub resource types daily from the server Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: retire the legacy hub_sync script and its schedule Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: sync only from the hub on the daily schedule Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: sync resource types through the endpoint in e2e setup Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: honor ACCEPT_INVALID_CERTS in the hub resource type sync Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: audit manual hub resource type syncs that change types Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor: show the AI step's resource type sync as a setting card Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep the hub_sync opt-out and move sync state to task state Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: hold the daily hub sync until the legacy hub_sync is retired Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: turn off the daily sync when an edited hub_sync is scheduled Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor: make the daily hub resource type sync opt-in Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: bring back the setup wizard's daily resource type sync toggle Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: apply the image's resource types on every SYNC_CACHED_RT start Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
Ruben Fiszel
|
68376fc011 |
feat: let workspace admins delete other users' drafts (#11644)
* feat: let workspace admins delete another user's draft * feat: delete every draft at a path when no username is given * fix: leave the editor cleanly after deleting the last draft at a path * fix: drain autosave before a path-wide draft delete * fix: resume a parked autosave when a path-wide draft delete fails |
||
|
|
442357dbe8 |
feat: per-script resource rollup and heaviest scripts table (#11631)
* feat: export worker cpu, memory and occupancy metrics Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: refresh the exported memory limit with the cgroup readings Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: per-script resource rollup and heaviest scripts table Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: pin the companion ee commit and drop job cpu entries on every exit Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: count the cpu time of suspended workflow rounds Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: count suspended workflow rounds' runtime and guard empty averages Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * perf: flush the runnable rollup hourly in key order and drop its workspace fk Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: order the rollup upsert in sql and sweep rows of deleted workspaces Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * perf: keep the rollup orphan sweep on a primary key range Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: update ee-repo-ref to a1c00d73a05f227a61d2bf37cc86cd9f5bb1777a This commit updates the EE repository reference after PR #866 was merged in windmill-ee-private. Previous ee-repo-ref: c6bcb1bbb5a7e85e870f9de232a0ad1540acf2bd New ee-repo-ref: a1c00d73a05f227a61d2bf37cc86cd9f5bb1777a Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |
||
|
|
8f28a58605 |
fix: store a WAC parent's first start and wall duration (#11625)
* fix: store a workflow-as-code parent's first start and wall duration Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep a parked child's first start in its parent's timeline Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: record a parked step with its whole span in the flow, cover inline checkpoints Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: update ee-repo-ref to ab8476e5feedc98b727f7d83acffa1807b3b9c5b This commit updates the EE repository reference after PR #861 was merged in windmill-ee-private. Previous ee-repo-ref: d5d95f51bb175944874e585e5931acb1eddd637a New ee-repo-ref: ab8476e5feedc98b727f7d83acffa1807b3b9c5b Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |
||
|
Ruben Fiszelandwindmill-internal-app[bot]
|
588d8463df |
feat: let a job see that its worker is draining (#11612)
* feat: let a job see that its worker is draining * fix: gate worker draining check on job visibility and export sdk helper * fix: keep draining across re-registration and ignore parked jobs * fix: reset draining only on worker startup registration * chore: update ee-repo-ref to 55feb2e84332179faa4e17aeb419f7f480df79a6 This commit updates the EE repository reference after PR #857 was merged in windmill-ee-private. Previous ee-repo-ref: e5010fa046a3aba93595d1bf44eb6a0cef2b5273 New ee-repo-ref: 55feb2e84332179faa4e17aeb419f7f480df79a6 Automated by sync-ee-ref workflow. --------- Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |
||
|
hugocasaandClaude Opus 5.5
|
3f3b1c2c30 |
fix: add retry to runScriptByPathAsync and runScriptByHashAsync (#11485)
* feat: add retry to runScriptByPathAsync and runScriptByHashAsync Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: refuse retry with invisible_to_owner and keep the parent priority bump Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: refuse retry when a preprocessor would run and export the options type on jsr Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep the dispatching job as parent of a retried run Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: cancel pending native retries with their caller and stop the chain on cancel Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
|
95c4b3096c |
feat: pause a worker group without stopping its workers (#11596)
* feat: pause a worker group without stopping its workers * chore: bump ee ref * fix: keep dedicated workers running across a pause toggle * fix: edit a copy of the worker group config in the drawer * fix: stable priority tag order, keep pause-only configs in the drawer * fix: keep inherited worker tags when saving from the drawer * fix: keep an explicit empty tag list when leaving dedicated mode * fix: keep inherited tags when creating a config from the drawer Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore: update ee-repo-ref to 6f23819e947b18878000e580ddefccfd01a73166 This commit updates the EE repository reference after PR #853 was merged in windmill-ee-private. Previous ee-repo-ref: 6cf802bdbe17b4a66757016515044b8a9ef9ef19 New ee-repo-ref: 6f23819e947b18878000e580ddefccfd01a73166 Automated by sync-ee-ref workflow. * feat: confirm before applying a worker config change that restarts workers Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore: pin the ee commit that compiles against main Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore: retrigger ci after the github outage dropped the push event Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |
||
|
Ruben FiszelandClaude Opus 5.5
|
afa9ced84c |
[ee] feat: job cancel signals (oidc refusal, agent 5s ping, job.canceled) (#11592)
* feat: faster agent cancel detection, job.canceled event, worker_group span attribute Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: report no unix signal in job.canceled where none is sent Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * refactor: agent workers ping every 5s instead of a 2s read-only cancel check Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: emit job.canceled on windows when the process exits unsignaled Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore: pin ee ref with the queue delay gauge main requires Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> |
||
|
Ruben Fiszel
|
b1af8b0e03 |
[ee] fix: concurrency limit over-admits when counter row is missing (#11587)
* fix: concurrency limit over-admits when the counter row is missing * chore: bump ee ref * fix: restore sqlx entry for the locked counter read and bump ee ref |
||
|
|
3aee181574 |
feat: bill team-plan service accounts as half a seat (#11298)
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Ruben Fiszel <ruben@windmill.dev> |