* fix: warn when an autoscaled worker group has no tags to count
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: drop warning autoscaling events when rolling the migration back
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: drop the autoscaling warning event and its migration
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: tell agent groups to match custom tags to their token tags
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to a673d2e3fe12927921be86c3a52bd9c956759c65
This commit updates the EE repository reference after PR #898 was merged in windmill-ee-private.
Previous ee-repo-ref: bbb21dad8a18f0593a2e1a2f2930b427f44404cd
New ee-repo-ref: a673d2e3fe12927921be86c3a52bd9c956759c65
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: let agent workers authenticate with a workload identity token
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: throttle failed workload identity key fetches per issuer
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep stale workload identity keys through an issuer outage
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: refuse workload identity rules with an empty claim value
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: validate workload identity issuers in declarative sync and share the JWKS cache
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: say workload identity issuers are optional in agent worker settings
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 96e8e2aa15bdc5968a1dae10f4e81d47d7ea49e0
This commit updates the EE repository reference after PR #897 was merged in windmill-ee-private.
Previous ee-repo-ref: 0e98880edb8db269d53120ca606025c81f320f5c
New ee-repo-ref: 96e8e2aa15bdc5968a1dae10f4e81d47d7ea49e0
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* fix: gate unix-only bun staging items so the Windows worker build compiles
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: compile bun_install_can_stage only where it is used
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* perf: opt into sqlx test templates through SQLX_TEST_TEMPLATE
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: raise the sqlx test connection cap so concurrent tests cannot starve
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: pass --save-text-lockfile only to bun installs
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: run bun and npm installs under nsjail sandboxing
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: strip workspace-dependencies header from npm-mode package.json
* chore: bump npm in worker images to 12
* docs: describe npm 12 install-script policy in install comment
* fix: mount npmrc cafile paths given with ${VAR} or ~ in the install jail
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* perf: keep bun's cache hardlinks for jailed installs
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: harden the bun install staging dir and npm-mode jail mounts
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: reach the bun staging dir only through no-follow descriptors
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: create bun staging files new and check outputs after the move
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: add DISABLE_BUN_INSTALL_SANDBOX to run bun installs unjailed
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: retry npm installs refused git or remote fetches with a deprecation warning
* fix: point the npm fetch fallback warning at config that works on CE too
* fix: read npm fetch refusals from its debug log and honor every npm config source
* fix: force text output for the npm config check
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* test: stop backend tests waiting out real time they do not need
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: delete the unused workspace_dependencies fixture
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* test: fix error handler test flake and merge handler test binaries
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: tighten workspace handler test comments
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* perf: clone sqlx test databases from a migrated template
* perf: lock sqlx test templates shared while cloning
* chore: note the tag that keeps the sqlx fork rev fetchable
* fix: pass --save-text-lockfile only to bun installs
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: run bun and npm installs under nsjail sandboxing
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: mount npmrc cafile paths given with ${VAR} or ~ in the install jail
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* perf: keep bun's cache hardlinks for jailed installs
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: harden the bun install staging dir and npm-mode jail mounts
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: reach the bun staging dir only through no-follow descriptors
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: create bun staging files new and check outputs after the move
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: add DISABLE_BUN_INSTALL_SANDBOX to run bun installs unjailed
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: add a no_network annotation for sandboxed python, bash, bun and r jobs
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep nodejs relative imports and dedicated workers working under no_network
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: bundle bun no_network jobs so relative imports resolve before the run
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: point ee-repo-ref at the runner group no_network fix
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: state the no_network token rule once
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: refuse no_network jobs whose workspace imports would be fetched at run time
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: let type-only workspace imports through the no_network import check
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to ca4a1959a0d2257d413a57349939053ac3473c6b
This commit updates the EE repository reference after PR #895 was merged in windmill-ee-private.
Previous ee-repo-ref: 3841923cfd117b6b907ac3e84b26f07bde41f8ed
New ee-repo-ref: ca4a1959a0d2257d413a57349939053ac3473c6b
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* fix: refuse dot segments in AI proxy paths
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: refuse spaces, query and fragment markers in AI proxy paths
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: refuse percent signs in AI proxy paths
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: let ALLOW_PRIVATE_AI_BASE_URLS name the private hosts it allows
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: refuse loose and wildcard allowlist entries, judge embedded v4
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: never admit local-use NAT64 addresses through an allowlist net
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep script and flow deploys off a second pool connection
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: raise a folder default's errors only when it applies
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: skip the fork lock when a fork creation has no storage to purge
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: word the fork lock skip for both purge callers
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: refuse dot segments in AI proxy paths
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: refuse spaces, query and fragment markers in AI proxy paths
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: refuse percent signs in AI proxy paths
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: scope delete_jobs side-table deletes to the request workspace
The /jobs/delete purge deleted resume_job, v2_job_runtime, v2_job_status
and concurrency_key rows by job id alone. Those tables have no
workspace_id, so a workspace admin could pass another workspace's job ids
and wipe its flow status, runtime, resume and concurrency rows. Scope
each delete through v2_job, as zombie_job_counter already is.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: filter delete_jobs ids to the workspace once
Resolve the request's job ids against v2_job up front and run every
delete on that filtered list, instead of repeating the v2_job subquery in
each side-table delete. The workspace scoping lives in one place and the
side-table deletes keep their plain id form.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* test: run the isolated-forks rule test in its own workspace
PROTECTION_RULES_CACHE is process-wide and keyed by workspace id, so the
other base-fixture tests in protection_rules.rs, running concurrently on
their own databases, could cache test-workspace's rules without the
RequireIsolatedForks ruleset and let the fork through to the data table
copy (400 instead of 403) on main.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: match nsjail profile lines so the envar check passes on CRLF checkouts
script_profiles_take_envars_before_their_fixed_ones searched for
"\n{ENVARS}\n", which a Windows checkout (CRLF) never contains, failing
cargo_test_windows since v1.834.0.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: route the python SDK's S3 client settings through the S3 proxy
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: drop the boto3 config key and expose the proxied bucket to polars
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: proxy S3 settings only for server-signed tokens and keep tls verify
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: isolate fork object storage under a per-fork prefix with read-through
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: guard fork storage isolation against traversal, shared lakes and orphaning
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: serialize fork purges with same-id creation and guard shared middle forks
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: drop fork storage mappings on every replica and lock fork deletion against child creation
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* wip: require isolated forks rule
* feat: add a Require isolated forks protection rule
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: recheck isolated forks under the datatable lock and judge bypass in the base
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 455681e55eb7cdfcfdb7cd79cbae75b333e07943
This commit updates the EE repository reference after PR #893 was merged in windmill-ee-private.
Previous ee-repo-ref: 93f26e3cf816e4eb97b7d4dbbb5fc97fdf9821af
New ee-repo-ref: 455681e55eb7cdfcfdb7cd79cbae75b333e07943
Automated by sync-ee-ref workflow.
* fix: exempt only datatables the base does not own, compact fork data choices
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: pin the isolated-forks owner check, fix its docs wording
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: route the python SDK's S3 client settings through the S3 proxy
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: drop the boto3 config key and expose the proxied bucket to polars
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: proxy S3 settings only for server-signed tokens and keep tls verify
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: isolate fork object storage under a per-fork prefix with read-through
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: guard fork storage isolation against traversal, shared lakes and orphaning
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: serialize fork purges with same-id creation and guard shared middle forks
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: drop fork storage mappings on every replica and lock fork deletion against child creation
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 455681e55eb7cdfcfdb7cd79cbae75b333e07943
This commit updates the EE repository reference after PR #893 was merged in windmill-ee-private.
Previous ee-repo-ref: 93f26e3cf816e4eb97b7d4dbbb5fc97fdf9821af
New ee-repo-ref: 455681e55eb7cdfcfdb7cd79cbae75b333e07943
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: route the python SDK's S3 client settings through the S3 proxy
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: drop the boto3 config key and expose the proxied bucket to polars
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: proxy S3 settings only for server-signed tokens and keep tls verify
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to cd3395013d8484cd3917cdb6ee7837b6ac91e577
This commit updates the EE repository reference after PR #889 was merged in windmill-ee-private.
Previous ee-repo-ref: e90873bba9dde1e899741d111137f94dde2e5ff8
New ee-repo-ref: cd3395013d8484cd3917cdb6ee7837b6ac91e577
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: one Entra app for the Teams bot and ms_teams Graph connect
Adds the ms_teams registry provider (Microsoft Graph) and moves the Teams OAuth setting
from key teams to ms_teams: a migration copies the entry and keeps teams for rolling
upgrades, and readers fall back to teams. The Graph connect URLs come from the setting's
tenant. The settings tile is no longer EE-locked; the bot stays enterprise-only.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: read the Teams setting from ms_teams in the workspace and alert views
Only drop the legacy teams key when the Teams tile was switched off.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to c8e450396ff4210c3bc253b1fa83b913c1a24c45
This commit updates the EE repository reference after PR #881 was merged in windmill-ee-private.
Previous ee-repo-ref: 618749ff7884f7202b75b091bd4de4790fef202d
New ee-repo-ref: c8e450396ff4210c3bc253b1fa83b913c1a24c45
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* oauth: add zendesk provider
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* oauth: default zendesk auth-code scopes in the connect template
Templated providers build the instance client's connect_config from
connect_config_template, so the top-level scopes never reached the
authorization-code dialog.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019pZhg9BJcsnU56GP4WzzrU
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: verify Bot Framework JWT on incoming Teams activities
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: bump ee-repo-ref for Teams JWKS review fixes
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to bd6a7f4fd07578710b072dc3bd4d9e31d4561f8e
This commit updates the EE repository reference after PR #888 was merged in windmill-ee-private.
Previous ee-repo-ref: 66bed6266c5836dcae4e34c6dbe3f917c29c0500
New ee-repo-ref: bd6a7f4fd07578710b072dc3bd4d9e31d4561f8e
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* feat: add a toggle to leave forks of non-dev workspaces out of dev isolation
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: track the non-dev forks toggle reactively and bound the forking rule checks
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: point ee-repo-ref at the skip non-dev forks telemetry registration
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep forks of archived dev workspaces isolated and warn about forkable non-dev forks
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: reset tag lineage caches on every archive and unarchive
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* perf: cache the token dev lineage lookup and trim isolation hot-path costs
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: point ee-repo-ref at the merged skip non-dev forks telemetry registration
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: route dev workspace and fork jobs to their own worker groups
* fix: harden dev workspace isolation against review findings
* fix: verify hashed dedicated tags and keep dev lineage across renames
* fix: let tag-scoped tokens reach jobs queued on dev workspace tags
* fix: expand tag scopes only in dev workspaces and forks
* fix: expand tag scopes only while dev workspace isolation is on
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: collapse the dev workspace isolation section by default
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: count dev workspace isolation toggles and dev-serving group flags
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: validate the dev workspace tag suffix on every instance config writer
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 71e9c0de8317e839f955ebef6a819062f20ac418
This commit updates the EE repository reference after PR #892 was merged in windmill-ee-private.
Previous ee-repo-ref: b5ab84e1705f939c399f6315a03f88b55bce1804
New ee-repo-ref: 71e9c0de8317e839f955ebef6a819062f20ac418
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* fix: give inline script runs their own job dir
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: remove the inline job dir when the run is dropped
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: require variables:read for the token variable of an mcp resource
A token scoped to resources:read/write on an MCP resource could have the API
decrypt the variable the resource's `token` points at and send it as a bearer
to the resource's URL. The url and header `$var:` references already required
variables:read on the variable; the token reference now does too, checked before
the OAuth refresh touches that variable.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: let an mcp resource's scope cover the variables it references
A scoped token reading or calling an MCP resource resolved its token variable
with the resource scope alone, but its url and header variables also needed
variables:read on each. The resource scope now covers all three; RLS still
bounds them to secrets the caller can read. Reverts the token-side check from
the previous commit.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: scope resource references when they are written, not when they are read
A token scoped to a resource now reads everything that resource references
(`$var:`, `$jsonvar:`, `$res:`), through get_value_interpolated and the MCP
tool routes alike. What makes that safe moves to the write: create, update,
update_value and version restore refuse a scoped token adding a reference it
holds no read scope on. References the stored value already carries are kept,
since whoever put them there was allowed to.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: hold every resource reference writer to its own user's read rights
A resource-scoped reader resolves stored references as itself, so an unscoped
session could plant a reference to a secret its own user cannot read and have
a reader's scoped token resolve it. Adding a reference now also requires the
writer's user to see its target under RLS. A reference to nothing yet stays
allowed, since a promotion pushes resources before the secrets they use.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: vet only variable references on write and keep nested resources scoped
A nested `$res:` brought along the variables of a resource the writer could see
but whose references it could not read, and what it references can change after
it is written. It needs its own read scope again, and the write check covers
only `$var:`/`$jsonvar:`.
An MCP token stored as a bare path resolved as a variable without being vetted
on write. It now needs its own variables:read scope, and the `$var:` prefix is
parsed with strip_prefix, as the write check does.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep variable scopes on result-cache resources
The worker writes job output to g/results/<hash> straight to the table, so its
references never pass the write check. A token scoped to such a resource still
needs read scope on the variables it references.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: require read rights on kept references and pin result-cache resources to g/results/
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: check resource variable references at read time, with wildcard resource scopes covering matching variables
Returns to the read-time rule: a variable a resource references needs
variables:read on it, unless it is the resource's linked secret or a wildcard
pattern in the token's resources: scopes matches it. The MCP token reference is
now held to that rule like the url and header references.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: name mcp script and flow tools after their last path segment
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: skip suffix expansion for mcp tool names longer than any short name
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: let deployed low-code apps run runtime-built inline queries again
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: limit id-less app runs to the database studio's sql languages
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: cover the deployed-row exclusion with sql content
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: accept Ed25519-signed license keys alongside RSA
* fix: gate the Ed25519 renewal flag on the worker fleet version
* chore: update ee-repo-ref to 664708fff04d4f9e0660bcae3edb307fb2c9481b
This commit updates the EE repository reference after PR #887 was merged in windmill-ee-private.
Previous ee-repo-ref: 5c18fdde212aa1185c405be9c5e194209c5a8ee9
New ee-repo-ref: 664708fff04d4f9e0660bcae3edb307fb2c9481b
Automated by sync-ee-ref workflow.
---------
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* fix: emit a single email claim in job OIDC tokens
Bumps the EE ref to drop the duplicate standard email claim from the job
token mint, and asserts the raw payload carries one email key.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: note the single-email check in the OIDC claim test doc
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to d29a7c0dad120e137105b1186d0bbe3ea1504b5d
This commit updates the EE repository reference after PR #886 was merged in windmill-ee-private.
Previous ee-repo-ref: d64df5c1787e4404c99a41a97fca22668a669c4d
New ee-repo-ref: d29a7c0dad120e137105b1186d0bbe3ea1504b5d
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* Revert "docs: agent editor comments describe runs as the caller"
This reverts commit d94919c9fe.
* Revert "refactor: agents run as the caller, with a note on what a shared one needs"
This reverts commit 0748a2fb51.
* fix: a run as an identity continues only the caller's own conversation
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: an agent run as its identity takes only attachments its caller may read
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: the resource editor keeps an agent's identity on an admin's save
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: regenerate workspace tool schemas for preserve_on_behalf_of
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: the rust client sets preserve_on_behalf_of on resource writes
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: agents run on behalf of their identity only when they opt in
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: an agent holds an identity only while it runs on behalf of it
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: reduce the agent identity migration to clearing untrusted keys
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: refuse decoded variable references in inputs to an agent run as its identity
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: user renames and offboarding re-point an agent's identity
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: refuse model-written tool arguments that the tool's job would interpolate
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: agent on-behalf-of migration after main's
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: the agent identity migration also clears trashed agents
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: share AI sessions read-only by link, optionally public
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: render shared session snapshots from an allowlist, without mermaid or remote images
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* style: make the session share button icon-only
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: safe reasoning links, artifact list and full-load exits on shared sessions
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: resolve canceled jobs and batch re-run them in limited batches
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: offer the re-run batch limit only for failed or canceled filters
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: label an unresolved canceled run as canceled in its status badge
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: tell the user that sources a batch could not re-run block the next batch
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: warn when a re-run batch includes resolved runs and offer to hide them
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: say in the re-run confirmation that failed or canceled sources get resolved
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: grant raw app SDK tokens identity access without a toggle
* test: pin the implicit identity scope on raw app SDK tokens
* refactor: let raw app SDK tokens reach whoami at the route check
* feat: prototype running duckdb jobs out of process inside nsjail
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: bound runner output, honor force install outside the jail, set oom score before exec
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: gate the duckdb runner bin behind a feature and decode pre-install errors
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: allowlist-only policy inside the duckdb jail, with its own extension cache
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: run duckdb jobs out of process under job isolation and drop the engine fork
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: runner everywhere, stock duckdb engine, no sql fence
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 24bdc6615b3f651141fb740e2cacf9c3c2d81252
This commit updates the EE repository reference after PR #884 was merged in windmill-ee-private.
Previous ee-repo-ref: 73452bbc280cc9ca33cf0fe325d26c2fbf3aace4
New ee-repo-ref: 24bdc6615b3f651141fb740e2cacf9c3c2d81252
Automated by sync-ee-ref workflow.
* fix: pass the windows system env and TZ to the duckdb runner
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: cap a jailed duckdb job's disk use from the worker, 6GiB by default on cloud
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep a disk-backed jail tmp under the duckdb disk cap
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: drop the benchmark scaffolding and bump duckdb to 1.5.6
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
AlexRV12