* feat: retry transient AI provider failures before output reaches readers
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep completed AI streams, stop retrying prompt blocks, bound retry-after
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: share the AI send-error retry rule between agent and proxy
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: accept a clean end of stream from OpenAI-compatible providers
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: classify AI provider errors the way the reference clients do
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: count a Gemini function call as the end of its turn
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: count an Anthropic stop_reason as the end of its stream
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: accept a Gemini answer that reports usage and no output
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: accept a Gemini stream that closes cleanly with no output
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* feat: let operators compose full-code apps when the workspace grants it
Adds operator_settings.builder_apps, the second builder right, granted
independently of flows because the two are not equally verifiable: a composed
flow is checked in full server-side, while a full-code app is a browser-built
bundle no check can read. The app right rests instead on forced sandbox
isolation, a refusal of Viewer execution mode, and a deploy-time check of every
runnable the app can reach.
BuilderKind arrives with the second kind and is a mandatory argument, so no gate
can mean "either" by accident: one that did would authorize an app write on a
flows-only workspace. The only surfaces reading .any() are the ones that are
genuinely not per-kind, the seat a membership costs and listing drafts.
validate_operator_composed_app checks two surfaces rather than one, because they
are not the same list: the policy's triggerables and the runnableByPath entries
in the app value, which is what the deployed bundle actually resolves against.
Every colon in a triggerable key is a possible split, since execute_component
looks up "<component>:<path>" with an unrestricted component string.
create_app_raw_source stays closed: it compiles caller-supplied sources with a
bundler job on a worker, which is arbitrary code execution. Builders lose
nothing, since the browser and the CLI both bundle locally and deploy through
the multipart endpoints.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Dsf6VC4MVLisiEoeQkgbr4
* fix: list a builder's app drafts and refuse inline code in them
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 6d15ff957df4dcd5129e1ab217eab1a13af62fbb
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: check a builder app as it will be stored
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: show the home list edit button to builder operators
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: pause the raw app preview for an app an operator deployed
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: let app builders save a full-code app's deploy settings
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: record the builder app settings path, public apps and the editor preview
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: cache the merged EE seat usage query
The EE query now reads audit_partitioned and skips service accounts, so the
cached entry for its builder_apps predicate no longer matched and offline EE
builds failed with no cached data.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: pause the raw app preview for loaded drafts and unknown authors
A draft loaded from an operator ran in the viewer's preview because the pause
only checked the app's last deployer, and an author no longer in the workspace
read as a developer. The pause now checks a loaded draft's owner, records it
in the viewer's draft until the preview is run or deployed, and holds when the
author cannot be found.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: name guest apps among the modes a builder may deploy
Guest runs as the publisher with no Viewer fallback, like Publisher and
Anonymous, and RestrictGuestAppDeployment refuses it per workspace.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep a loaded draft's preview paused in AI sessions and chat edits
The session draft codec and the chat's draft save dropped loaded_from, so
opening a paused operator draft in an AI session, or editing it through the
chat, ran it with the viewer's session.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: pin builder refusals for low-code apps and unreviewed previews
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep the operator mark when loading a developer's copy of a draft
Loading another user's draft recorded only who saved it, so a developer's
copy of an operator draft they never previewed opened unpaused for the next
person who loaded it, running the operator's code with their session.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: let builders restore a full-code app from deployment history
Restore always sends allow_kind_change, which the builder check refused even
for a full-code version restored over a full-code app. Builders now drop the
flag, so the locked kind check still refuses an actual conversion.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* style: rustfmt the builder checks in jobs.rs
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: record the builder kind-check race as an accepted risk
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: never trust the owner name a loaded draft carries
A loaded draft's loaded_from is written by its owner, so an operator could
name a developer, or leave it empty, and the next person to load the draft
previewed it unpaused. A loaded draft that carries any mark now stays
paused as unattributable; an unmarked one is still checked against its
real owner.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: record viewer-supplied resources in builder apps as an accepted risk
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: say that the app right lets operators write frontend code
The settings section and the docs told admins builder operators "still
cannot write code", but the app right has them write the app's frontend
bundle. Only backend code stays out of reach.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: state the raw-source closure once and drop an unreachable preview case
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* perf: look up only the author when deciding whether to pause the preview
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: pin that the app right alone bills operators as developers
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: point ee-repo-ref at the EE seat test
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: drop the editor preview pause now that sandboxed apps preview isolated
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: refuse a builder operator's app draft without the sandbox
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: turn the sandbox on when a builder operator opens the app editor
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: refuse builder app drafts naming runnables they cannot read
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: note the editor preview asks before minting a builder app token
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: trim the builder app check comments to the constraints
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: refuse an app runnable whose runType is not script, flow or hub
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: check builder app draft policy keys like a deploy does
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: count main's half-seat service accounts in the builder billing test
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: name the builder policy check for drafts as well as deploys
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: let a builder app draft autosave with a stale triggerables_v2
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: check the script version a builder app would run, not any version
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: refuse viewer mode in a builder app draft as on deploy
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: hold builder app drafts and deploys to one check
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: say a builder's script may not have finished deploying
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: cap builder app triggerable keys before reading every colon split
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: refuse a builder app draft that runs as someone else
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: conform builder app drafts saved by the AI chat as the editor does
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: record that a deployed builder draft runs as its deployer
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: refuse builder app runnables not written as plain text
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: a builder draft may carry its builder's own run identity
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: offer builders Start with AI only when it opens a session
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: name full-code apps in the builder rights confirmation
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: name only the granted builder rights in the confirmation
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: note a wm_deployers builder may keep another run identity
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: give builders a starter app that calls no missing runnables
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: seed the builder starter under the picker for builders
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: qualify the builder run identity comment for wm_deployers
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: resolve builder app script hashes before opening the RLS transaction
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: run the builder app tests serially to share the rights cache safely
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: give builders the builder starter on a fresh editor load
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: drop a new-app load overtaken while waiting for the workspace list
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep main's 401 for operators previewing without the app right
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 5d7726c4979070ee8db4fb9e8014152872a641ba
This commit updates the EE repository reference after PR #816 was merged in windmill-ee-private.
Previous ee-repo-ref: 7151060bfc02908e97d9344b3820ee33a4951322
New ee-repo-ref: 5d7726c4979070ee8db4fb9e8014152872a641ba
Automated by sync-ee-ref workflow.
* refactor: let the app row's edit button trust its write flag
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: point ee-repo-ref at the merged EE companion
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: note the session raw-app editor does not conform builder drafts yet
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: add a jobs:run:dependencies token scope for lock generation
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: pin lock-job reads to the dependencies scope
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: align scope labels with and without a restrict paths button
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: match a lock job's stored path literally on job reads
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: drop the dependency-lock warning from the jobs scope heading
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KNiYsRRDyvkRYwkHda6uyf
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: sync hub resource types daily from the server
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: retire the legacy hub_sync script and its schedule
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: sync only from the hub on the daily schedule
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: sync resource types through the endpoint in e2e setup
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: honor ACCEPT_INVALID_CERTS in the hub resource type sync
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: audit manual hub resource type syncs that change types
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: show the AI step's resource type sync as a setting card
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep the hub_sync opt-out and move sync state to task state
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: hold the daily hub sync until the legacy hub_sync is retired
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: turn off the daily sync when an edited hub_sync is scheduled
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: make the daily hub resource type sync opt-in
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: bring back the setup wizard's daily resource type sync toggle
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: apply the image's resource types on every SYNC_CACHED_RT start
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: let workspace admins delete another user's draft
* feat: delete every draft at a path when no username is given
* fix: leave the editor cleanly after deleting the last draft at a path
* fix: drain autosave before a path-wide draft delete
* fix: resume a parked autosave when a path-wide draft delete fails
* fix: set WM_END_USER_EMAIL on direct script and flow runs
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: pass the end user to workflow-as-code tasks
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: describe when WM_END_USER_EMAIL is set
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: pin the end user a job token passes on
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: export worker cpu, memory and occupancy metrics
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: refresh the exported memory limit with the cgroup readings
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: per-script resource rollup and heaviest scripts table
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: pin the companion ee commit and drop job cpu entries on every exit
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: count the cpu time of suspended workflow rounds
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: count suspended workflow rounds' runtime and guard empty averages
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* perf: flush the runnable rollup hourly in key order and drop its workspace fk
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: order the rollup upsert in sql and sweep rows of deleted workspaces
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* perf: keep the rollup orphan sweep on a primary key range
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to a1c00d73a05f227a61d2bf37cc86cd9f5bb1777a
This commit updates the EE repository reference after PR #866 was merged in windmill-ee-private.
Previous ee-repo-ref: c6bcb1bbb5a7e85e870f9de232a0ad1540acf2bd
New ee-repo-ref: a1c00d73a05f227a61d2bf37cc86cd9f5bb1777a
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: add an api base url instance setting for displayed urls
* feat: show the api base url as cli remote, keep mcp url on origin
* fix: keep push captures on origin and load the api base url on svix page
* fix: reject shell metacharacters in webhook and api base urls
* test: drop the trivial api base url resolver test
* feat: hide the api base url setting behind a toggle
* fix: let the quick setup toggle reveal the api base url field
* chore: update ee-repo-ref to 017710bdd0a10de857f0f40800dde238cdb1ad24
This commit updates the EE repository reference after PR #863 was merged in windmill-ee-private.
Previous ee-repo-ref: f67cd621bd45840e6389e0469a67378864f269a0
New ee-repo-ref: 017710bdd0a10de857f0f40800dde238cdb1ad24
Automated by sync-ee-ref workflow.
---------
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: let a job see that its worker is draining
* fix: gate worker draining check on job visibility and export sdk helper
* fix: keep draining across re-registration and ignore parked jobs
* fix: reset draining only on worker startup registration
* chore: update ee-repo-ref to 55feb2e84332179faa4e17aeb419f7f480df79a6
This commit updates the EE repository reference after PR #857 was merged in windmill-ee-private.
Previous ee-repo-ref: e5010fa046a3aba93595d1bf44eb6a0cef2b5273
New ee-repo-ref: 55feb2e84332179faa4e17aeb419f7f480df79a6
Automated by sync-ee-ref workflow.
---------
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* perf: load public raw apps without the loading screen
* fix: keep license store and drop stale prefetches on public app pages
* fix: answer raw app requests with an error when the job bridge fails to load
---------
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* feat: add retry to runScriptByPathAsync and runScriptByHashAsync
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: refuse retry with invisible_to_owner and keep the parent priority bump
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: refuse retry when a preprocessor would run and export the options type on jsr
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep the dispatching job as parent of a retried run
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: cancel pending native retries with their caller and stop the chain on cancel
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: describe exponential retry as multiplier × seconds^attempt in openflow schema
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: update folded exponential retry description in openapi-deref.yaml
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: phrase exponential retry summary per n-th retry, matching seconds field
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to acb254ac509aff244849c09e50a8d39aae185138
This commit updates the EE repository reference after PR #852 was merged in windmill-ee-private.
Previous ee-repo-ref: 9cc330f1a8e80bc075a6ad9839966d3b344f8ddd
New ee-repo-ref: acb254ac509aff244849c09e50a8d39aae185138
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* feat: improve data table roles and grants UX
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep selected bordered badges the same height as unselected ones
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: refuse taking over roles with members and test grant statements
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep grant filter chips while a filter is set
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: check a taken-over role can log in with the new password
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: select several grant filter tags at once
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: explain where schema and table permissions are set
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep the grant create row on one line
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: show grants as a role and its privileges
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: show grants in a table with role, privileges and scope
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: hide the grant scope when it can only be the object itself
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: grant schema usage along with grants inside the schema
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: confirm before closing the roles drawer with unsaved changes
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to c4002f777f56d90bb0471164291889850c85179d
This commit updates the EE repository reference after PR #848 was merged in windmill-ee-private.
Previous ee-repo-ref: 7937634a52d04caeb083da94e189705cd00796b3
New ee-repo-ref: c4002f777f56d90bb0471164291889850c85179d
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: audit instance settings writes and bulk job cancels
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: audit each setting of a bulk save as it is written
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to acb254ac509aff244849c09e50a8d39aae185138
This commit updates the EE repository reference after PR #852 was merged in windmill-ee-private.
Previous ee-repo-ref: 3dfc563bc95881183fb6c49d39984023b9b83075
New ee-repo-ref: acb254ac509aff244849c09e50a8d39aae185138
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: isolate the raw-app editor preview when the app opts into sandboxing
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: gate job reads from a sandboxed editor preview like the deployed app
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: send a plain user in a sandboxed raw app's startup message
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: pin ui_builder to d3fdb70
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: count OIDC signatures and reuse server-side tokens
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: update ee ref
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: update ee ref
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: update ee ref
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to cbda28f632d773fd44e9bef8bea36dcb5e35b55d
This commit updates the EE repository reference after PR #847 was merged in windmill-ee-private.
Previous ee-repo-ref: cec12fc52eb1bb5d3f4f4ae489d86a64e96c6c0c
New ee-repo-ref: cbda28f632d773fd44e9bef8bea36dcb5e35b55d
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* fix: serve the raw-app preview shell sandboxed, load a blob copy in the editor
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: give the preview shell the deployed app wrapper's sandbox flags
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: confine jobs:read to the runnable paths it names
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: filter job lists by read scopes alone and keep a job's own flow run readable
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: search slow runs filters by time windows instead of timing out
* fix: cancel a pending runs page when its listing is reset
* fix: keep runs scan windows disjoint at microsecond precision
* fix: race the single runs request against the window scan
* fix: list the cursor window when a runs scan starts at the oldest job
* fix: show the runs history scan as an info alert
* fix: show runs scan progress as a bar and keep the session button on the searchbar row
* fix: stop a runs scan whose windows are no faster when narrower
* fix: right-align the runs searchbar row when the header wraps
* fix: keep the runs scan stop button inside a narrow list pane
A team plan canceled mid-month now keeps premium until the 1st, capped at the
executions its final invoice paid for. That reuses the past-due cap, so the job
refusal and the UI toast said "your last invoice is unpaid". Word both for a
canceled plan, and show it on the plan settings page.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: let legacy draft-only items be discarded from the home page
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: describe the legacy draft move guard as it now is
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: add a cancel-only jobs:cancel token scope, optionally path-scoped
jobs:cancel grants the four cancel routes (cancel, force cancel, cancel
selection, cancel persistent) and nothing else; jobs:write keeps covering
them. With paths, the handlers only cancel a job whose own runnable path,
or a parent flow's, matches; others get the invisible-job NotFound.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: confine cancel_selection like the by-id cancel routes
A token that also carries a path-scoped jobs:run scope is confined to
those runnables on the by-id cancels (through the job read check), so
apply the same run confinement to each selected job.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: confine persistent cancels, admit agent runs, batch selection checks
cancel_persistent applies the run-scope confinement the other cancel routes
apply; a path-scoped jobs:cancel admits agent runs under the agent's path,
recognized as the run-scope read check does; cancel_selection checks the
cancel scope in one query.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: let a jobs:cancel grant stand on its own on the cancel routes
Intersecting cancels with the token's jobs:run scopes did not hold: the
token could mint itself a child carrying only the cancel scope. The cancel
routes now apply the cancel paths and the usual per-job visibility, and
leave the run-scope read confinement to reads, as jobs:write does.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: add test key button to AI resource drawers
* fix: scope-check inline AI resource values and keep test model editable
* fix: keep test model editable for unsaved resources, own-key provider check
* fix: make RunForm schedule props optional and expect 403 for operator drafts
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: serialize concurrent approval resumes on the flow's queue row
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: read flow status after taking the resume lock
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* refactor: route every approval decrement through one helper
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: make hub integrations usable as examples in global chat
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: keep web search guidance in sync with provider capability
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: resync web search guidance before the request is built
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: carry loop web search availability into every prompt rebuild
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: drop web search guidance on the completions api fallback
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* docs: correct onBeforeIteration contract for the fallback re-entry
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat: give the ai chat hub script descriptions and integration metadata
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix: treat authored hub metadata as evidence the scripts were curated
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix: treat hub curated as three-state and speak only for a stated true
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* test: let the benchmark hub serve integration metadata
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* test: benchmark the hub tool against a real integration's scripts and metadata
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* test: cover two more real integrations where the scripts already answer
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* test: report metadata_source from whether the fixture has authored meta
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix: parse the hub resource type schema instead of relaying it as a string
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix: match integration suggestions on slug words instead of substrings
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix: search the integration a query names outright instead of ranking past it
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix: reject hub integration slugs that would re-target the proxied request
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix: add a mentioned integration's hits instead of filtering the search to it
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix: keep named-integration hits under the content cap and unmangle fixture placeholders
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix: cut the middle of a capped hub result instead of repeating its tail
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix: cap hub results by keeping the best of the ranked and named hits
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix: keep a named integration that ranking placed below the content cap
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix: let plan mode use the hub integration lookup
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* feat: mark which hub integrations carry authored provider knowledge
The hub flags the integrations whose document holds hand-written provider
knowledge, so a caller can tell before spending a call on the metadata
endpoint: 18 of ~216 qualify, and for the rest the endpoint returns what
was inferred from the same scripts a search already hands back.
Carry the flag onto search results, where the model first meets a slug, so
get_hub_integration is aimed at the few instead of guessed at. A hub that
predates the flag omits it and nothing is marked.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix: stop the documented mark reading as a reason not to call
The flag says the hub additionally holds provider knowledge checked against
the live API. It is not a signal to skip the lookup elsewhere: that call
still returns the resource type and the usage-ranked examples, neither of
which a search result carries, and neither guessable.
The prompt said to read a script instead when the mark is absent, which
traded those for a guess on the ~198 undocumented integrations.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix: keep the benchmark's documented flag true to what it serves
The eval hub reported Baremetrics and Holded as undocumented while its
metadata endpoint handed back their authored notes, so a case could teach
the model the flag means nothing. Derive it from both fixture sources, and
pin the agreement.
Also trims the documentedIntegrations comment to the four lines AGENTS.md
allows, keeping the case-folding constraint.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix: keep the benchmark hub mostly undocumented, like the real one
Adding holded and baremetrics to the documented set resolved the fixture's
contradiction the wrong way: it left five of six integrations marked, against
the live hub's 18 of ~216, and claimed authored notes for two the hub reports
as having none. Drop the notes instead. Their auth and endpoints are in their
shipped scripts, which is what the cases that use them are about.
Also drops the last two places still describing the flag as a reason to spend
or skip the metadata call.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* refactor: let the model name the integration instead of guessing it from the query
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* refactor: word web search guidance conditionally instead of tracking provider capability
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix: open the hub metadata route to job tokens and share one integrations fetch
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix: record a copied hub script's source where write_script keeps it
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* test: pin that a query narrows to the integration it was given
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix: match integration suggestions on the name the hub curates
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix: name an integration the hub leaves unnamed from the local word table
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat: list agents on the home page and create them from the new menu
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep runnables out of the agents view and anchor a new agent once saved
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: autosave a new agent's first edit and list agents past one page
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: add agent detail and editor pages
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: explain when an agent cannot be run and drop the broken agent move
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep query params and a unique path when creating an agent
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: lead the home list with agents and keep rows while the agent view loads
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: treat a loading agent as undeployed when leaving the editor page
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: agent detail page config panel, run page on form runs, chat badge
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: agent configuration modal and draft paths like other new items
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep a new agent draft-free until the first input, land agents with runnables
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: place AI agent after apps in the new menu and describe chat and flow use
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: new agents start with managed memory, editor form says how to turn it off
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: clearer managed memory hint in the agent editor form
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* refactor: share the agent editor's pane notice as a PaneNotice component
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: name a new agent after a path no resource holds
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: tell repeated tool names apart and hide permissions on draft-only agents
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: agent configuration beside the model in the chat composer and above the form
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: center the agent run form, configuration beside its Run button
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: icon-only agent configuration button beside Run
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: agents run on behalf of their deployer through a run-by-path endpoint
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: agents keep their run-as identity in their value, preserved by the CLI
The identity an agent runs as lives in `value.on_behalf_of` instead of a column. Every write
of an agent resolves it server-side as a flow's is: the writer's own, unless an admin or
wm_deployers member asks to keep it, and a folder default on create. Retyping a resource into
an agent resolves its value the same way. Export leaves it out; the run endpoint reads it and
drops it from the step's inputs.
The CLI follows the app model: a pushed agent never takes its identity from the tracked file,
an unchanged agent compares equal to the deployed one, and an admin or deployer push claims
the deployed identity back. The owner-change pre-check lists agents.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: deploying an agent draft from review keeps its deployed identity
As for an app: an agent draft carries no identity, so the review page claims the deployed one
back, which the backend honours for an admin or wm_deployers member. The draft diff leaves the
deployed identity out, since a draft never holds one.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: deploying an agent to another workspace offers the run-as choice
An agent deployed to prod/staging, merged from a fork or promoted with `wmill workspace merge`
gets the same identity choice as a flow or an app: the target's current one, the deployer, or
a picked user, sent as a principal the way a trigger's is. The source workspace's principal is
never copied, and a difference in identity alone is not a change in the workspace compare or
its diff.
The frontend consumes the published windmill-utils-internal, so its deploy provider carries the
same rewrite until that version ships.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: agent identity on fork, agent-scoped job reads, and the run license gate
A fork re-points an agent's identity at its creator when they may not preserve someone else's,
and at the creator when it names nobody in the fork, as it does an app's. A token scoped to
`jobs:run:agents:<path>` reads back the runs it starts, chat turns included. The agent run
endpoint checks the enterprise license like every other run entrypoint.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: a CLI push decides agent identity handling by the tracked file's type
An agent retyped into another resource by a push kept neither its value's `on_behalf_of` as the
file stated it nor clear of the old agent's identity. The file's type now decides, and only a
deployed agent's identity is claimed back.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* refactor: agents run as the caller, with a note on what a shared one needs
Drops the agent run-as identity: its storage in the agent value, the backfill, the resolution
on every write, and its handling in export, the CLI, draft and cross-workspace deploys, forks
and the workspace compare. The run endpoint runs as the caller, so an operator or reader runs an
agent with their own access. The editor tells the author of a folder agent that anyone running
it needs access to its AI resource and to what its tools use.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* docs: agent editor comments describe runs as the caller
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* refactor: agent editor pane notes use Alert
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* refactor: agent editor pane notes render as Alert
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: agent editor notes as regular Alerts, not banners
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: agent path as its own editor level, and evals on the agent page
The path leaves the agent form: the editor dialog opens it as a level, as it does evals, and the
editor page in a drawer. The agent page gains Evals, in a dialog. The page supplies the run
form, keeping it out of the editor the flow editor reaches.
The draft edit gate no longer throws when a focused, changed field is removed: the `change` that
removal fires lands mid-teardown, so the gate opens just after instead.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: agent settings as the resource editor's header fields, behind a cog
The agent's own settings (path, labels, workspace specific, description) open from a cog as
the flow and script editors' do, laid out as the top of the resource editor. The folder note is
gone.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: agent settings fields and cog, completing the rename
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: evals open as a dialog over the agent editor page
The editor page opens an agent's evals over itself, as the agent page does, with the unsaved
edits offered to a run; the editor dialog keeps evals as a level of its own. The two pages share
the dialog.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: the unreachable model provider note reads like the unreachable agent one
Same warning level and wording as the note above it, with the path inline rather than in
parentheses that lost their spaces.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: the unreachable model provider note offers editing the agent too
Editing the agent to use a provider the reader can access is often the simpler way out; offered
when the reader can write the agent, with Unlink and asking for access.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: provider note lists asking for access as its own option
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: shorter provider note, without the header's buttons repeated
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: evals only for those who can edit the agent
Evaluating builds datasets and runs against the agent, which is authoring: the agent page and the
editor offer it only with write access to the agent.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: agent page actions ordered as the script and flow pages
The menu leads and Edit comes last, as DetailPageHeader lays them out.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: the agent editor dialog's levels slide in built on the first visit
Warmed, as the evals pane's levels are, so settings and evals are mounted before the first
navigation rather than inside its transition. Evals are only in the strip where they can be
opened.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: the agent's settings report path errors, and hold nothing a reader can edit
The path field reads its error back, so it shows it and keeps deploy blocked on it.
Labels are shown rather than editable without write access. Evals wait for the load
to know they can be opened, and the page layout builds no levels it never shows.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* refactor: one builder for an agent's run flow, and the agent page on the shared header
The run endpoint and evals build the agent's one-step flow through the same function.
The agent page uses DetailPageHeader, whose error handler, tag and trigger context are
now optional, and whose menu items keep their disabled state. The home row and the
page share the agent's menu and delete.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: the agent page's menu is built from its current path
Deploy settings are the workspace's, so they load once and the menu is derived from
them rather than fetched per path, where a superseded fetch could land after a
navigation. The shared run-flow builder lives with agent runs rather than evals.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: the scoped-read comment names the run-flow builder as it is
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: let a workspace withdraw operator schedule and trigger writes
Operators can create, edit and delete schedules and triggers today through the
API, CLI and MCP, while the operator_settings flags beside them only hide those
pages. An admin who wants operators to see what is scheduled without letting
them change it cannot express that. Add manage_schedules and manage_triggers as
enforced settings, gated at the schedule handlers and at the generic TriggerCrud
routes so every trigger kind is covered by one check.
They name capabilities operators already hold, so they are granted unless
withdrawn, and absence has to mean "never configured" rather than a value. The
read coalesces to true; the update endpoint merges into the stored jsonb with
the two fields as Option<bool>, so an omitted key keeps what is stored.
operator_settings is git-synced as a whole object, so a settings file written
before these keys existed reaches the endpoint on every pull, and a serde or SQL
default of either polarity would turn that pull into a silent withdrawal or
restoration.
The rights are read through a per-process cache, so withdrawing one publishes a
notify_event that drops the entry on every replica.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Dsf6VC4MVLisiEoeQkgbr4
* feat: let operators compose flows when the workspace grants the right
Adds operator_settings.builder_flows: a workspace setting that lets every
operator compose flows out of runnables that already exist. It does not make
them authors. The boundary the operator role draws is authoring code and running
arbitrary code, and this does not move it: check_flow_is_composition_only walks
the value and refuses anything carrying code, including the shapes an obvious
walk misses (code hoisted into a flow_node, an AI agent step's tools, and a
linked ai_agent resource whose tool list is resolved at run time).
What the walk cannot settle it returns for the caller to authorize under RLS:
the worker tags the steps pin, every runnable they reference, and the (path,
hash) of every version-pinned step. Composing a path is enough to run it and to
run it as whoever it runs as, since the worker resolves a step's path with the
root DB handle and adopts that runnable's on_behalf_of. A pinned hash needs its
own check because dispatch ignores the path beside it.
The gate runs on every write and on both request-supplied-value paths, flow
preview and flow dependencies, or either becomes the way to run what the write
path refuses.
Operators of a builder workspace consume a full author seat; the EE companion
carries the counting.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Dsf6VC4MVLisiEoeQkgbr4
* feat: enforce operator write rights on the router and in the UI
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: close the capture gap and gate the trigger editors' write actions
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: gate acl writes and the native trigger drawer behind manage rights
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: refuse operator writes with 403 and gate sharing at the drawer
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* perf: resolve identity in the operator write gate only for writes
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: gate the suspended-jobs actions and stop the route check refusing reads
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: explain the empty-state create button when operator writes are withdrawn
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: audit operator settings changes and fold path writes into native rows
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: open locked editors read-only and group the operator settings
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: skip email and azure lookups on editor open while triggers are locked
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* docs: state each operator-rights rationale once in comments
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: address CI review findings on operator write rights
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep capture move gated and skip it in the builders while locked
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: refuse builder-rights violations with 403 so operators stay logged in
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* refactor: trim duplication in the operator builder gates
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: hide build app from builder operators on the flow page
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: point at the companion EE PR merged with EE main
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep a builder's drafts list loading past drafts they cannot write
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: hide saved agents from builder operators in the step picker
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: note the inlined seat rule and drop orphaned sqlx entries
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: stop a builder's step test from logging them out
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: refuse a builder's dependency job on a path it cannot write
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep builders from adding dynamic dropdown code to a flow
A flow's dropdown code runs as whoever loads its form, so a builder may keep or drop the code stored on the flow it updates, never add or change it. The builder's editor hides the dropdown types and code, and previews options through the deployed flow; the inline dropdown refusal is a 403 so it no longer logs operators out. Also trims rationale comments repeated across sites.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: show why saving operator settings failed
The seat-cap refusal on granting builder rights explains what to do; the toast now carries the server's message instead of a generic failure.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: check builder flow drafts like deploys and treat dropdown code as code
A developer who loads a builder's flow draft in the editor runs its dynamic dropdown code as themselves, so a builder's draft now passes the same checks as a deploy. Dropdown code is refused like step code rather than kept or dropped, which also removes the exact-match comparison that refused builders over whitespace.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: bill a builder workspace's operators as developers on cloud
The cloud seat count behind the Premium page, the sidebar usage and the fork cap still weighed every operator at half a seat, while the builder right makes them authors. The out-of-repo invoicing job must follow the same rule.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: check a builder's flow draft as it will be stored
Draft storage strips NUL escapes after the builder check, so a key ending in one (value\u0000, x-windmill-dyn-select-code\u0000) passed the check as an unknown field and was stored under its plain name. The check now reads the sanitized text.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: list a builder's flow drafts and hide hub imports from builders
A builder's undeployed flows now appear in the home list, the flow list and the folder counts. Hub project imports and templates bring scripts and apps along, so builders are no longer offered them. The docs record builders' JavaScript expressions as an accepted risk.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep the stored builder right when a settings payload omits it
A git-synced settings file written before the key existed withdrew the right on every push. builder_flows now follows the manage_* rights: an omitted key leaves the stored value, and the CLI does not count it as a difference.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: word builder refusals by what the flow contains, test the tag refusal
A builder refused on a developer's flow never changed its code, so the refusals now describe the flow ("has inline code, so only a developer can edit this flow") rather than an authoring attempt. The grant confirmation uses the neutral dialog: granting changes billing but destroys nothing. The integration test pins the refusal of a worker tag the workspace cannot use.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: read builder rights from the operating workspace, gate the flow page's audit logs entry
Builder rights now come from useOperatorBuilderFlows(), next to the schedule and trigger locks, so an editor embedded for another workspace answers about that workspace; the legacy AI chat, one instance for the whole app, reads the navigation workspace. The flow page's Audit logs entry follows the operator audit_logs setting now that builders open that menu. Operator settings reset every value on load, null settings included, so nothing carries over from the previous workspace.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: pick a dynamic dropdown's code source by the operating user's role
The flow input editor, the flow test panel and the flow chat send the dropdown request to the operating workspace, so they now also choose inline versus deployed code by the role held there, through useOperatingUser(), instead of the navigation workspace's.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to 40ac1c5f8cbce3843b582d9b392d3f3cc7eca3e6
This commit updates the EE repository reference after PR #815 was merged in windmill-ee-private.
Previous ee-repo-ref: 31c9e66884b8ca805b20bbfad41fc428fbedbc0e
New ee-repo-ref: 40ac1c5f8cbce3843b582d9b392d3f3cc7eca3e6
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: open chat path pill actions from a hover menu
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* refactor: build the path pill menu rows from Button
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: resolve chat path pills by a draft's chosen name
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: alias a draft name only to an item of the same kind
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Ruben FiszelandClaude Opus 5.5
Alexander PetricandClaude Opus 5.5
Diego ImbertandRuben Fiszel
GuilhemandClaude Opus 5.5