* refactor: harmonize flow and script settings layout
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep the priority input open while it is edited
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: confirm run-as on flow and script deploy, mute from editor menu
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep settings rows open while edited and name the deploying user for non-admins
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: reread the deployed run-as user after a deploy that keeps the editor open
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: write a setting before its row opens and show its real state while edited
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: slide settings rows open to their full height
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: send the popover's deployment message when Deploy is clicked
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: remount a settings row's fields when its toggle turns it on
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: send the popover's deployment message from Deploy & Stay here
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: clear the deployment message after a successful deploy
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: read the deployed row before muting from the menu, title Deploy only when icon-only
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: app conversations through the memory_id query parameter, chat-mode flows included
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: regenerate the mcp session instructions
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: type backendAsync's memoryId option in the eval diagnostics
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: pin git-sync hub scripts to windmill-cli 1.849.0
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: memoryId option on the sync backend call too
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: bump the ui builder artifact for the memoryId option
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: shared-utils 1.0.14
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: cli takes shared-utils 1.0.14 for the memoryId option
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: pin the app conversation scoping and the memoryId signatures
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: assert the ownership refusal, not any refusal
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: match the memoryId option in the cli wmill.ts signature tests
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: file an app's turns as the deployed flow's conversation, preview included
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: drop superseded list replies after a workspace or filter change
* fix: build resources filter suggestions from the visible tab
* test: pin that latestRequest peek never supersedes a request
* fix: keep a superseded email trigger load from ending the loading state
* fix: stop the breadcrumb sliding when switching sessions
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: state the band offset constraint without the old arrangement
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: render mcp run tools as an mcp apps run card
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: back off run card polling and pin its run summary
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep the run card polling after a failed get_run
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: add run details, run form, diff and item views to the mcp card
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: guard the mcp card's run form and diff errors
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: honour the host's dark theme in the mcp card without its colours
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep untouched run form arguments and drop stale run refreshes
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: let the run form re-send references and label diff links by target
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: parse literals typed over run form references by field type
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: version the mcp card uri and declare its empty csp
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: keep the mcp card to runs, group loop and branch steps, restyle it
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: say when the mcp card cannot read a finished run's details
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: show runs, run tables and deploy reviews through dedicated mcp tools
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: review the whole draft before deploying from the mcp card
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: follow host card guidelines: header link, collapsible steps, review summary, no run form
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep fullscreen review diffs whole and match drafts by storage path first
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: link to windmill where a host has no fullscreen, cap inline logs, shrink the card back
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: say in the review summary why a draft cannot be deployed from the card
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: link the review to compare and deploy, cap inline tables, open long results
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: flag a cut result or log by what was kept, keep a lone log line
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: mark the mcp card's fullscreen buttons with the expand icon
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: capitalize the mcp card's windmill link labels
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: add a show_item card for workspace items, collapsible sections in fullscreen
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: apply windmill brand guidelines to the mcp card and show errors as windmill does
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: show more windmill result kinds in the mcp run card
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: tidy the mcp card layout and let oversized drafts deploy from the review
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: name a shown run by its summary, cap long item values, drop variable cards
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: link an app draft's card to its editor
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: show a running flow's progress in the mcp card, open cut blocks on click, link each step
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: read only a running step's log tail and skip the preprocessor in the progress bar
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: mcp card headers carry a kind icon, and a summary names the item over its path
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: skip result streams in log tail reads, keep the cut-result link when it fits
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: link app drafts and agents to their own pages, offer Cancel only to tokens that can cancel
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: simple inline mcp cards with a tabbed fullscreen run view and step drill-in
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: draw the mcp card's tabs as windmill's underlined tabs
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: link to windmill for what an mcp card hides when the host has no fullscreen
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: mcp run card steps as a tree beside the selected step, nested progress, danger cancel
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: draw image results in the mcp run card, and a collapse control in fullscreen
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: copy controls on the mcp card's results, logs and code
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: mcp card links read as text, hover tint only on buttons
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: windmill's names, icons, status colours and type scale in the mcp card, within the hosts' rules
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep images out of mcp run table rows, and re-read only single-field image results
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: measure a re-read mcp image result as postgres prints it, so wrapped images draw
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: mcp review deploys the selected drafts, loops list every iteration's result, branches and subflows named
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: mcp review diffs open on demand, as on the compare page
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: mcp script cards fade their code in inline, item sections open whole in fullscreen
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: mcp item cards link what a schedule or trigger runs, show a trigger's key settings and a schedule's arguments as rows
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: mcp card lists a loop's latest 10 iterations, trigger topics by name
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: mcp trigger cards open their other settings from a last table row
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: mcp draft badge in windmill's indigo without a spinner, show-more as a list's last row
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: consistent mcp cards: one expand icon and rule, aligned tables, path titles, error and empty states
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: mcp item cards offer fullscreen for cut values and overflowing code, name script steps by path
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: mcp cards show ai agents: their answer, named tool calls, what a waiting agent asks, saved agents
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: mcp saved-agent runs label tool calls by tool, never by the internal root step
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: a saved agent's run card names its steps tab Tool calls
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: an mcp card says an agent waits only while its run is going
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: mcp card paths wrap at slashes beside their icon; oauth approval offers all workspaces to a user in none
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: mcp card view read carries the cache hints 2026-07-28 clients require
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: mcp card leaves leaving fullscreen to the host's own close control
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: mcp cards name a saved agent's test run by the agent's path, without .chat
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* perf: mcp get_run builds no card data; the run card refreshes through show_run
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: mcp show_deploy_review refuses a token that cannot deploy, not only hides from it
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: mcp session tools carry a title and explicit read-only, destructive and open-world hints
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: mcp run card reads only the end of a run's log; create_datatable_migration is destructive
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: mcp run card counts log offsets from 1 and reads a finished run's archived log in full
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: mcp item card rechecks clipped code on resize; oauth hint hides once the toggle is on
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: mcp item card uncuts a code block once a wider card fits it
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: guidance for building standalone ai agents in ai sessions
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: agent guidance for resource-only sessions, no flow tools
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: tell the user to deploy a drafted tool script with its agent
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: scope plain agent values, document tool_inputs, list agents in get_instructions
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: test and run ai agents from ai sessions, open agents in their editor
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: full-bleed agent editor tabs, back to the run form for agent tests
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: describe read-and-run as running agents too, pin agent run links
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: host the agent editor natively in session tabs
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: switch the agent editor to tabs below 900px
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: name an agent's session tab after its summary
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: show deployed agents in session tabs, open and run them from the chat
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: deploy agents from the chat, report agent tabs as the active editor
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: pick agents from the tab picker, name their tabs, scope the agent page to its workspace
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: leave open editors alone on agent writes, read the agent page's workspace user
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: refresh an agent's deployed page when the chat deploys or deletes it
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: name agent tabs before they load, mark agents in the changes drawer, stay on a deleted agent's tab
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep a cleared agent summary out of its tab name
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep the resource drawer's json option that the resources list still passes
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: open an agent in an AI session from its pages, fix review findings on agent tabs
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: name the reserved agent tool names in the agent guidance
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: reload an agent's editor on a discard, open a new agent in a session
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: show agents as agents on compare and deploy, name a never-deployed one by its path
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep a deployed agent's type in its draft diff
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: link a fork row to the agent editor only on the side that holds the agent
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: guard agent page paths, mark drafted agents in the picker, side-aware agent rows on fork compare
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: harmonize flow and script settings layout
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep the priority input open while it is edited
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep settings rows open while edited and name the deploying user for non-admins
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: write a setting before its row opens and show its real state while edited
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: slide settings rows open to their full height
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: remount a settings row's fields when its toggle turns it on
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: put the AI prompt behind a settings toggle
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: summarize active runtime and permission settings on the metadata tab
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: move the active settings chips into the settings header
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: bring back the active setting icons on the settings tabs
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* feat: show the draft badge on Home's favorite and recent cards
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: show the draft badge on Home's agent cards
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: remove the home and AI sessions composer view transition
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* docs: drop view transition rationale from composer comments
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The proxy rebuilds the hub URL instead of passing the request through, so a
`?version=` on it was dropped and the current version exported in its place.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: add ai review to deployment requests
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: bound ai review fetches and surface unreadable items
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: add fix in ai session and model picker to deployment ai review
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: add workspace instructions for deployment ai review
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: read review instructions from the parent and bind ai review to the fork
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: pin the fix-all session preview to the fork's compare page
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: drop workspace-settings instructions from deployment ai review
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: review the selected items with ai on compare and deploy
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: mark an ai review out of date when its items change
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: post all ai review findings as comments at once
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 77703cf32e58964906d87ee83ddda44b5b8d1b7e
This commit updates the EE repository reference after PR #926 was merged in windmill-ee-private.
Previous ee-repo-ref: e30ab9e69d1854fcaed5620c934ace32acb0a729
New ee-repo-ref: 77703cf32e58964906d87ee83ddda44b5b8d1b7e
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: configurable public base url for the MCP gateway
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep mcpTokenUrlDisabled's doc comment on its function
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: build MCP OAuth urls from the api base url, narrowable per surface
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: save and discard companion setting keys in the per-category settings flow
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: show the protection-rule bypass toggle inline
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: make the bypass toggle small and red
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat(ai-agent): built-in approval tool that parks the agent
An AI agent step can now be given a built-in "Request approval" tool. The model
calls `request_approval` with a message; the agent stores its conversation in
the new `ai_agent_checkpoint` table, releases its worker by parking its own
queue row like a workflow-as-code parent, and resumes with the answer (approved,
approver, comment) or a timeout once someone answers from the run page.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(ai-agent): tie approval answers to their request and hold the turn
- A turn that asks for approval runs none of its other calls; they are refused
so the model repeats them after the answer.
- The run page sends the request's call id. An answer naming another request is
ignored and the agent parks again for the time left; `suspend` is zeroed when
the answer is read, so answers sent while the agent runs are refused.
- The checkpoint is read whatever the current roster holds, the answer's
outcome is written by position, and a cancel that beats the park completes
the job as cancelled.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(ai-agent): say why calls beside an invalid approval request were refused
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(ai-agent): one approval form per request, none on a finished run
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(ai-agent): answer approval requests from a flow's chat
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(ai-agent): show chat approvals for agents that do not stream
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(ai-agent): approval as a per-tool setting, built-in tool asks a question
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(ai-agent): say when a nested agent leaves out tools that require approval
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(ai-agent): show chat approvals and questions on the tool's own card
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(ai-agent): question choices, and approval buttons shared with approval steps
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(ai-agent): show a waiting agent as suspended, and refused calls as not run
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(ai-agent): each added chat card shows its own call, answered marker keyed by job
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(ai-agent): approve and reject a held call through resume_suspended
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(ai-agent): require approval in a tool settings tab, plain descriptions on built-in tool panes
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(ai-agent): sentence case for the web search tool label
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(ai-agent): built-in tool drawers explain themselves in the header subtitle
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(ai-agent): clearer question tool subtitle
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(ai-agent): badge the tool settings tab like run settings
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore(ai-agent): regenerate system prompts and MCP session files
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: detect attached -c and --no-config in DENO_FLAGS
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep tracing span on handle_deno_job
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: serve new MCP OAuth sign-ins the session toolset on /api/mcp/gateway
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep the mcp:session marker across every token scope edit
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: serve marked MCP sign-ins the session toolset on the per-workspace URL too
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: let a restricted caller re-save a token's mcp:session marker
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: preselect build and run when an MCP client requests every scope
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: advertise only granting MCP scopes in protected resource metadata
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: apply the blanket-request default on the consent page only
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: treat only an mcp:all request with both narrowings as blanket
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: name the previewed item in an empty session's composer instead of greeting
* feat: name the item's kind in the empty session's composer placeholder
* fix: name the previewed item as its tab does, so view tabs get the summary
* fix: add job_id, step_id and flow_path to every executor's step error
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: take the step error's flow_path from the pulled job, not a query
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: add step context to native ts errors in the executor instead of process_result
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: add a home setting to hide empty folders
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep empty folders listed in a workspace holding nothing else
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep a folder created from home listed while empty folders are hidden
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: say which kinds keep a folder listed when hiding empty folders
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: hide the empty-folders toggle where it has no effect, honour it beside pipelines
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep empty folders listed when the item count request fails
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep the tree when only non-empty folders remain past the loaded window
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* refactor: hide empty folders inside the tree only, keep main's empty-state choice
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: stop starred items showing a starred removal in the editor diff
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: ignore starred in every value diff
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* docs(readme): modernize the code examples, cover in-browser AI building, trim the env var table
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(license): move the re-expose and internal-use terms from the README into LICENSE, summarize them in the README
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(readme): use a data table in the script example, add a data section (data tables, DuckDB, DuckLake, pipelines)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* docs(readme): drop the local dev setup section, point to README_DEV.md
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(readme): drop the contributors section
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* docs(readme): lead with code-first workflows, apps and AI agents, and the review guardrails for AI-built code
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(readme): name Lovable among the alternatives
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(readme): name n8n among the alternatives
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: authenticate Windmill AI to Anthropic with per-user Workload Identity Federation
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: reject WIF-only Anthropic resources in agent steps, scale token refresh margin
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: move Anthropic WIF to a separate anthropic_federated resource type
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: point agent steps at an anthropic resource instead of a federated one
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: report a federated resource missing a field instead of reading it as standard
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: count Anthropic federated token exchanges in feature_usage
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 747336910e5c7498544613ad7863cea59f4db6a1
This commit updates the EE repository reference after PR #923 was merged in windmill-ee-private.
Previous ee-repo-ref: 3ea70adff288448f7318ff20b41225fd726ca8d1
New ee-repo-ref: 747336910e5c7498544613ad7863cea59f4db6a1
Automated by sync-ee-ref workflow.
* feat: authenticate AI agent steps with anthropic_federated resources (#11999)
* feat: authenticate AI agent steps with anthropic_federated resources
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep get_id_token's signature for its EE callers
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 747336910e5c7498544613ad7863cea59f4db6a1
This commit updates the EE repository reference after PR #923 was merged in windmill-ee-private.
Previous ee-repo-ref: 3ea70adff288448f7318ff20b41225fd726ca8d1
New ee-repo-ref: 747336910e5c7498544613ad7863cea59f4db6a1
Automated by sync-ee-ref workflow.
* feat: switch between anthropic and anthropic_federated when adding a resource
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep registryCcCapable's doc comment on it
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* chore: update node to 26 in the docker image and CI
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: pin node to 24.22.1 in the worker image for CVE-2026-111497
The unpinned NodeSource install was served from the build cache, so images
built after the security release still shipped 24.22.0. Reverts the node 26
bump.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* chore: tighten file handling in deno/bun, stricter codebase tarball, executor isolation
* fix(worker): gate now-unused extract_tar behind its enterprise+parquet caller
Removing the codebase-bundle caller of global_cache::extract_tar left its only
remaining caller, pull_from_tar, gated on enterprise+parquet, so under other
feature sets the function (and its tokio::time::Instant import) became dead code
and failed CI's -D warnings build. Gate the definition and the import with the
same cfg as the caller so they appear and disappear together.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
812ff6ea5e was squashed from a branch based before 8af48429 and reverted its
changes to these three files. Restore them as they were in 8af48429.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
The database name of a Postgres resource was the bare positional argument of
pg_dump and the value of psql's --dbname. Both forms are interpreted: as a
positional argument a name opening with `-` is read as an option of pg_dump
(`--file=`, `--restrict-key=`), and in both forms a name holding `=` is
expanded as a libpq connection string that overrides the host, port and user
Windmill passed before it. libpq reads PGDATABASE as a plain name, neither
parsed nor expanded, so the name now goes there.
The change is in the shared helpers, so it covers every caller:
import_pg_database, export_pg_schema, datatable_clone::make_copy,
generate_initial_datatable_migration and pg_import_dump. pg_dump's invocation
is extracted into pg_dump_command() beside the existing psql_command() so the
argument vector can be asserted on directly.
Beside that:
- resolve_pg_source_checked_with_kind() now refuses a name opening with `-`
for every source and target it resolves, where validate_dbname() only ever
reached a target. The check is deliberately narrower than validate_dbname():
a source is any database a user already has, and `2024_archive`, `my.db` or
a non-ASCII name are all names Postgres accepts and resources carry today.
- export_pg_schema and import_pg_database now require the `code` capability,
the one the data table migration endpoints next door already ask for. Both
make the API server run pg_dump/psql as children of its own process against
a database the request names, so the role that may not run code should not
reach them; they stay open to every author, who can run pg_dump in a job
anyway. The frontend offers both only from the database manager.
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Recognise the worker's own init and periodic scripts through a single helper shared by the bash and PowerShell executors, based on the workspace, identity and tag they are queued with.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Set `keep_caps: false` in the python, ruby and R dependency install/lock profiles, matching the run profiles, and build the uv argument list in `download_deps.py.sh` directly instead of through a command string.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Run `cargo sweep` and `cargo generate-lockfile` from a worker-owned scratch directory instead of the job directory, pointing at the crate with `--manifest-path`.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
A PR whose body contains `[skip-ai-review]` no longer triggers the
automatic Codex, Pi and Claude reviews on open/ready/synchronize, and is
left out of the weekly merged-PR summary. Explicit requests (workflow_call
from the review commands) still run.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* oauth: linkedin OIDC default scopes + scope_options, quickbooks asks isSandBox
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: leave quickbooks connect fields to #11960
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
The change-versions job on the release PR failed to push after the branch
was deleted on merge, so v1.848.0 shipped with only version.txt bumped.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: run a workspace handler when a secret variable expires
Secret variables gain an optional `value_expires_at`, and a workspace can point
at a script or flow to run once that date passes, so a rotation is driven by the
platform instead of tracked out of band.
The secret never leaves the database. The sweep selects the path, description and
expiry and nothing else, so the handler is given a reference to rotate rather than
a value to handle. Job results are stored in cleartext and shown in Runs, which is
what makes that a boundary rather than a preference; a test asserts the job's args
never contain the value.
Each row is claimed by writing `expiration_dispatched_for` in the same transaction
as the push, so a failed push un-claims it and a lost race claims nothing. Moving
the date re-arms the row; re-saving the same date does not. A pass takes at most
100 rows under a transaction-scoped advisory lock, and orders so that one broken
workspace cannot starve the rest.
Dispatch runs as `g/variable_expiration_handler`, exempt from the CE group limit
and from non-premium exec metering the way the error and schedule handlers already
are. A handler that keeps failing backs off and raises a critical alert instead of
retrying every pass, and the back-off ends when the handler is repointed.
The expiry travels with the variable through workspace clone, tarball export and
workspace comparison. The dispatch marker deliberately does not, so a fork re-arms
on its own copy.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat(frontend): expose variable value expiration in the UI
The variable drawer takes an optional expiry on a secret value, and the variables
list badges it, turning red once the date has passed. A workspace settings tab
picks the handler, its extra args, and whether variables under `u/` are skipped.
That mute flag is stored inside the handler setting, so the toggle stays disabled
until a handler is picked: saving it on its own would clear the setting it lives
in and still report success.
The expiry is carried as a tri-state through the draft deploy and copilot paths —
absent leaves the remote value alone, an explicit null clears it — so deploying a
draft cannot silently drop a date someone set elsewhere.
The settings tab names the one case where the configured identity does not apply:
a handler script carrying `on_behalf_of` runs as that user rather than as
`g/variable_expiration_handler`, which matters because the same tab asks the admin
to grant that group write access to the variables it rotates.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat(cli): sync variable expiry and the workspace expiration handler
`wmill sync` carries `value_expires_at` on variables in both directions, and
pushes the workspace handler alongside the error and success handlers in the
grouped settings format. Dropping the key from a variable's yaml clears the
remote expiry, so the file stays canonical rather than accumulating fields that
can only ever be added.
The handler follows the same rule, with the caveat recorded where the type is
declared: an omitted handler only reaches the clear when some other setting
differs, because the push short-circuits on a comparison that walks the local
object's keys and so never sees a missing one. That gate is shared with the two
existing handlers and is left as it is here.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(frontend): open the variable expiration handler template in a new tab
The "Create a handler" button hands its script template to /scripts/add through
the URL hash, which `load` reads from `window.location`. A client-side navigation
leaves the previous page's hash in place, so the payload was dropped and the
editor opened on the default template at a `u/` path. `target="_blank"` forces a
full page load, matching the success handler's "Create from template" button.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(frontend): make the variable expiry field state its own status
The expiry field rendered a DateTimeInput whose time defaults to 12:00 when it
holds no value, so a variable with no expiry looked like one already configured,
and "cleared" looked identical to "never set". Setting an expiry is optional, so
the field has to say which it is.
Rebuild it on the shape ScriptAdvancedSettings already uses for Timeout, Cache and
Concurrency limits: a toggle whose checked state is the stored value being present,
seeding a date on enable rather than revealing an empty picker, with the input
under its own label. Drop `clearable` with it, so the toggle is the single way to
mean "no expiry" instead of competing with an X.
Stop the surrounding copy promising a run that may not happen. A handler is only
dispatched if the workspace has one configured and does not skip u/ paths, so the
list tooltip now states the date alone, and the form hedges both conditions,
naming the u/ mute only on personal paths where it can apply.
Also anchor the mute toggle's tooltip: Popover's trigger is a span around a
block-level label, which stretched to the full width of its SettingCard and left
the popup floating beside the card rather than under the control.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(rust-client): initialize value_expires_at in the variable models
The generated `CreateVariable` / `EditVariable` structs gain the field from
openapi.yaml, and client.rs builds both with exhaustive literals.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(frontend): drop extra_args when the variable expiration handler is cleared
Clearing the handler nulls the whole setting server-side, extra_args included,
but the tab kept its loaded copy. A handler picked afterwards without reloading
was persisted with the cleared one's arguments, which the tab does not display.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat: back the variable expiration handler's built-in Slack and Teams destinations
Backfills the Slack bot token grant for g/variable_expiration_handler, mirroring
20231016142659 for g/error_handler: the slack_bot folder's extra_perms is written
once at Slack connect and never refreshed, and disconnecting leaves the folder
behind, so workspaces that already connected Slack cannot pick the grant up from
the creation-time list alone.
Adds run_variable_expiration_test_job so an admin can exercise the handler on
demand rather than waiting for a real expiry, which may be months away. It goes
through push_variable_expiration_handler so the test run proves what matters:
the handler resolves, and the group can read what it needs, under the same
identity and argument shape the sweep uses.
Also covers extra_args on the edit endpoint, which the settings tab now writes
for the built-ins' channel. The endpoint rebuilds the setting from the request,
so an omitted extra_args erases it.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Do7wJTnL6MG6ngFpCGW4DG
* feat(frontend): offer Slack and Teams as variable expiration handlers
Gives the variable expiration tab the same no-code destinations the workspace
error handler has, so "tell #ops before this credential expires" no longer
requires writing a script.
A sibling component rather than a fourth mode of ErrorOrRecoveryHandler: that
one is shared with the workspace error handler and the three schedule handlers,
and its stripped-args list, hub path suffixes and Email tab are all
error-shaped. This reuses the pieces that are already generic
(SlackConnectionStatus, TeamsConnectionStatus, ChannelSelector, ScriptPicker,
SchemaForm) and leaves those five call sites untouched.
extra_args stops being an API/CLI-only escape hatch now that the built-ins write
their channel into it, so it joins the unsaved-changes comparison and the
discard path, normalised through the existing helper that drops the two
auto-managed keys.
The two hub ids are placeholders until the scripts are pushed to the hub.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Do7wJTnL6MG6ngFpCGW4DG
* fix(frontend): scope the handler identity notice to the chosen destination
The notice told every admin to grant g/variable_expiration_handler write access
to the variables it rotates. That is right for a custom handler and wrong for
the built-ins, which only post a message and are granted the Slack bot token by
migration. Following it for a Slack handler would hand a group write access to
the workspace's secrets for no reason.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Do7wJTnL6MG6ngFpCGW4DG
* feat(frontend): flag the Slack and Teams handlers as EE
Connecting a workspace to Slack or Teams is EE-only (oauth2_oss.rs returns
"Slack only available on enterprise"), so on CE those two tabs can never be
completed. Says so up front, the way the error/success handler tab does,
instead of leaving the user at a "not connected" badge with no working path.
Only on those two tabs: a custom script or flow handler is CE.
Drops the "Connect Slack first" alert, now that the banner and the connection
badge above it already say it twice.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Do7wJTnL6MG6ngFpCGW4DG
* chore(backend): regenerate the sqlx cache after the merge
The merged workspace_settings column list in change_workspace_id is a new
query text, so it needs a new cached entry. Drops the two pre-merge entries
it supersedes; both had been left with conflict markers by the merge, since
rename/rename markers are eight characters and escape the usual scan.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Do7wJTnL6MG6ngFpCGW4DG
* fix(cli): narrow the expiry-clear check to a variable that exists remotely
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Do7wJTnL6MG6ngFpCGW4DG
* feat(frontend): point the built-in handlers at their published hub scripts
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* chore(backend): regenerate the sqlx cache after the merge
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix(frontend): disable the Slack and Teams handler controls without a license
Matches the workspace error handler, which greys out its built-in destinations
and hides the test button on an unlicensed instance. The custom destination stays
editable: unlike the error handler, the variable expiration handler itself is not
an EE feature.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: record which destination a variable expiration handler uses
handler_configured now counts slack, teams, custom or cleared instead of
set or cleared, so usage shows whether the built-in destinations are picked.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(frontend): let the variable expiration handler template run on any worker
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: guard the variable expiration test endpoint and correct its help text
* fix: reuse the error handler's slack arg and built-in path helpers
* docs: trim variable expiration sweep and backfill comments
* feat: put the variable value expiration under an advanced section
* fix: restrict the expiration test job to built-ins and keep expiry on conflict reload
* fix: link the expiry hint to the variable's workspace and document built-in test paths
* fix: give the expiration sweep its own lock id and reuse double_option
* fix: pin the variable expiration presets so the hub-paths test accepts them
* feat: let the variable expiration handler set how far ahead it runs
* fix: give the notify before expiry setting its own card
* feat: remind the variable expiration handler at a set interval
* fix: tighten the gap between the Slack channel field and its test button
* feat: refuse a value expiry on variables linked to an OAuth account
* refactor: reuse the shared handler form for variable expiration
* refactor: sweep expiring variables round-robin and check the handler exists
* chore: trim comments to the constraints they record
* fix: compare expiry dates by moment when deploying a variable draft
* refactor: rename value_expires_at to value_valid_until
* fix: neutralize variable fields in expiration handler args
* fix: reserve the variable_expiration_handler group name for admins
* fix: send first expiry notices before reminders
* test: pin that a handler failing to start leaves its rows unclaimed
* chore: say any hub handler path skips the existence check
* fix: empty a pre-existing handler group before granting it the Slack token
* docs: correct the registered feature usage counts
* fix: let a workspace whose handler failed to start sit out for an hour
* fix: send first notices before reminders across workspaces
* fix: end a failed handler's wait as soon as it is redeployed
* fix: show an expiry-only variable change in the AI fork diff
* chore: regenerate workspace tool schemas
* test: keep one variable expiration guard per behavior
* fix: use the renamed hub expiration handlers and template
* feat: carry the variable expiry in windmill-utils-internal 1.8.4
* fix: keep the variable expiry through MCP drafts
* chore: bump windmill-utils-internal to 1.8.4
* fix: keep the variable expiry through mcp deploys
* fix: disable saving a slack or teams expiry handler without ee
* fix: skip the failure mark when the expiry handler was saved mid-sweep
* fix: count expiry telemetry only where the expiry changed
* test: assert the exact variable expiry in export and cli push tests
* fix: stamp an expiry handler failure with the pass's read time
* fix: wait for a pending handler lock instead of marking it failed
* test: isolate expiry handler tests from the deployed-script cache
* fix: retry a failing expiry handler every pass instead of waiting an hour
* chore: update ee-repo-ref to b6e23d229966cf0019c0a1926a254fda658d8def
This commit updates the EE repository reference after PR #744 was merged in windmill-ee-private.
Previous ee-repo-ref: c52c06d145b13a6fb04459e85ca5818bf3c1bff4
New ee-repo-ref: b6e23d229966cf0019c0a1926a254fda658d8def
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Co-authored-by: hugocasa <hugo@casademont.ch>
dependabot[bot]
GuilhemandClaude Opus 5.5
hugocasaandClaude Opus 5.5
AlexRV12
Ruben Fiszelandrubenfiszel
Alexander PetricandClaude Opus 4.8