* feat: let flow builder operators build AI agents
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: check linked agents' bound tools and type, validate on the write's transaction
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: bound the linked-agent walk by sorting bound tool ids
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: let builders bind only the agent tool inputs left to the model
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: check every agent tool sharing a bound id
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: show builders the agent's own tool inputs read-only and name agents in the setting
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: show the agent's own tool inputs with the read-only step viewer
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* style: give the agent-set inputs heading the input label style
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* style: label the agent's fixed tool inputs static inputs
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: address cubic review on agent builder rights
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: check agent writes against the role's flows capability
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: name the flows capability as the agent builder right
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: gate agent evals on the role's code capability
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: move the composed-flow check into windmill-api-auth
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: configurable workspace roles with per-workspace overrides
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: close role review gaps in pickers, declarative sync and removal
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: keep resolve_role_name doc on its function
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: validate overrides on instance role changes and bill admins fully
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: allow pipeline drafts and keep role checks on one connection
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: list data pipelines in operator_can_draft
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: expect a 403 role refusal when an operator resolves jobs
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: require a valid license for custom workspace roles
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: freeze workspace roles when the license lapses
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: pin the ee companion for workspace roles
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: broadcast role override changes from the write path, not a trigger
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to b5294d38db082bdd104d5358a47695390694c05d
This commit updates the EE repository reference after PR #891 was merged in windmill-ee-private.
Previous ee-repo-ref: 688e00c5982865b14098f530d54280e2311994c0
New ee-repo-ref: b5294d38db082bdd104d5358a47695390694c05d
Automated by sync-ee-ref workflow.
* fix: let an admin row that kept the operator flag hold full rights everywhere
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: treat superadmin members as admins and return role names from get user
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
hugocasaandClaude Opus 5.5
