* feat: run a workspace handler when a secret variable expires
Secret variables gain an optional `value_expires_at`, and a workspace can point
at a script or flow to run once that date passes, so a rotation is driven by the
platform instead of tracked out of band.
The secret never leaves the database. The sweep selects the path, description and
expiry and nothing else, so the handler is given a reference to rotate rather than
a value to handle. Job results are stored in cleartext and shown in Runs, which is
what makes that a boundary rather than a preference; a test asserts the job's args
never contain the value.
Each row is claimed by writing `expiration_dispatched_for` in the same transaction
as the push, so a failed push un-claims it and a lost race claims nothing. Moving
the date re-arms the row; re-saving the same date does not. A pass takes at most
100 rows under a transaction-scoped advisory lock, and orders so that one broken
workspace cannot starve the rest.
Dispatch runs as `g/variable_expiration_handler`, exempt from the CE group limit
and from non-premium exec metering the way the error and schedule handlers already
are. A handler that keeps failing backs off and raises a critical alert instead of
retrying every pass, and the back-off ends when the handler is repointed.
The expiry travels with the variable through workspace clone, tarball export and
workspace comparison. The dispatch marker deliberately does not, so a fork re-arms
on its own copy.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat(frontend): expose variable value expiration in the UI
The variable drawer takes an optional expiry on a secret value, and the variables
list badges it, turning red once the date has passed. A workspace settings tab
picks the handler, its extra args, and whether variables under `u/` are skipped.
That mute flag is stored inside the handler setting, so the toggle stays disabled
until a handler is picked: saving it on its own would clear the setting it lives
in and still report success.
The expiry is carried as a tri-state through the draft deploy and copilot paths —
absent leaves the remote value alone, an explicit null clears it — so deploying a
draft cannot silently drop a date someone set elsewhere.
The settings tab names the one case where the configured identity does not apply:
a handler script carrying `on_behalf_of` runs as that user rather than as
`g/variable_expiration_handler`, which matters because the same tab asks the admin
to grant that group write access to the variables it rotates.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat(cli): sync variable expiry and the workspace expiration handler
`wmill sync` carries `value_expires_at` on variables in both directions, and
pushes the workspace handler alongside the error and success handlers in the
grouped settings format. Dropping the key from a variable's yaml clears the
remote expiry, so the file stays canonical rather than accumulating fields that
can only ever be added.
The handler follows the same rule, with the caveat recorded where the type is
declared: an omitted handler only reaches the clear when some other setting
differs, because the push short-circuits on a comparison that walks the local
object's keys and so never sees a missing one. That gate is shared with the two
existing handlers and is left as it is here.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(frontend): open the variable expiration handler template in a new tab
The "Create a handler" button hands its script template to /scripts/add through
the URL hash, which `load` reads from `window.location`. A client-side navigation
leaves the previous page's hash in place, so the payload was dropped and the
editor opened on the default template at a `u/` path. `target="_blank"` forces a
full page load, matching the success handler's "Create from template" button.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(frontend): make the variable expiry field state its own status
The expiry field rendered a DateTimeInput whose time defaults to 12:00 when it
holds no value, so a variable with no expiry looked like one already configured,
and "cleared" looked identical to "never set". Setting an expiry is optional, so
the field has to say which it is.
Rebuild it on the shape ScriptAdvancedSettings already uses for Timeout, Cache and
Concurrency limits: a toggle whose checked state is the stored value being present,
seeding a date on enable rather than revealing an empty picker, with the input
under its own label. Drop `clearable` with it, so the toggle is the single way to
mean "no expiry" instead of competing with an X.
Stop the surrounding copy promising a run that may not happen. A handler is only
dispatched if the workspace has one configured and does not skip u/ paths, so the
list tooltip now states the date alone, and the form hedges both conditions,
naming the u/ mute only on personal paths where it can apply.
Also anchor the mute toggle's tooltip: Popover's trigger is a span around a
block-level label, which stretched to the full width of its SettingCard and left
the popup floating beside the card rather than under the control.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(rust-client): initialize value_expires_at in the variable models
The generated `CreateVariable` / `EditVariable` structs gain the field from
openapi.yaml, and client.rs builds both with exhaustive literals.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(frontend): drop extra_args when the variable expiration handler is cleared
Clearing the handler nulls the whole setting server-side, extra_args included,
but the tab kept its loaded copy. A handler picked afterwards without reloading
was persisted with the cleared one's arguments, which the tab does not display.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat: back the variable expiration handler's built-in Slack and Teams destinations
Backfills the Slack bot token grant for g/variable_expiration_handler, mirroring
20231016142659 for g/error_handler: the slack_bot folder's extra_perms is written
once at Slack connect and never refreshed, and disconnecting leaves the folder
behind, so workspaces that already connected Slack cannot pick the grant up from
the creation-time list alone.
Adds run_variable_expiration_test_job so an admin can exercise the handler on
demand rather than waiting for a real expiry, which may be months away. It goes
through push_variable_expiration_handler so the test run proves what matters:
the handler resolves, and the group can read what it needs, under the same
identity and argument shape the sweep uses.
Also covers extra_args on the edit endpoint, which the settings tab now writes
for the built-ins' channel. The endpoint rebuilds the setting from the request,
so an omitted extra_args erases it.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Do7wJTnL6MG6ngFpCGW4DG
* feat(frontend): offer Slack and Teams as variable expiration handlers
Gives the variable expiration tab the same no-code destinations the workspace
error handler has, so "tell #ops before this credential expires" no longer
requires writing a script.
A sibling component rather than a fourth mode of ErrorOrRecoveryHandler: that
one is shared with the workspace error handler and the three schedule handlers,
and its stripped-args list, hub path suffixes and Email tab are all
error-shaped. This reuses the pieces that are already generic
(SlackConnectionStatus, TeamsConnectionStatus, ChannelSelector, ScriptPicker,
SchemaForm) and leaves those five call sites untouched.
extra_args stops being an API/CLI-only escape hatch now that the built-ins write
their channel into it, so it joins the unsaved-changes comparison and the
discard path, normalised through the existing helper that drops the two
auto-managed keys.
The two hub ids are placeholders until the scripts are pushed to the hub.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Do7wJTnL6MG6ngFpCGW4DG
* fix(frontend): scope the handler identity notice to the chosen destination
The notice told every admin to grant g/variable_expiration_handler write access
to the variables it rotates. That is right for a custom handler and wrong for
the built-ins, which only post a message and are granted the Slack bot token by
migration. Following it for a Slack handler would hand a group write access to
the workspace's secrets for no reason.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Do7wJTnL6MG6ngFpCGW4DG
* feat(frontend): flag the Slack and Teams handlers as EE
Connecting a workspace to Slack or Teams is EE-only (oauth2_oss.rs returns
"Slack only available on enterprise"), so on CE those two tabs can never be
completed. Says so up front, the way the error/success handler tab does,
instead of leaving the user at a "not connected" badge with no working path.
Only on those two tabs: a custom script or flow handler is CE.
Drops the "Connect Slack first" alert, now that the banner and the connection
badge above it already say it twice.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Do7wJTnL6MG6ngFpCGW4DG
* chore(backend): regenerate the sqlx cache after the merge
The merged workspace_settings column list in change_workspace_id is a new
query text, so it needs a new cached entry. Drops the two pre-merge entries
it supersedes; both had been left with conflict markers by the merge, since
rename/rename markers are eight characters and escape the usual scan.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Do7wJTnL6MG6ngFpCGW4DG
* fix(cli): narrow the expiry-clear check to a variable that exists remotely
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Do7wJTnL6MG6ngFpCGW4DG
* feat(frontend): point the built-in handlers at their published hub scripts
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* chore(backend): regenerate the sqlx cache after the merge
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix(frontend): disable the Slack and Teams handler controls without a license
Matches the workspace error handler, which greys out its built-in destinations
and hides the test button on an unlicensed instance. The custom destination stays
editable: unlike the error handler, the variable expiration handler itself is not
an EE feature.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: record which destination a variable expiration handler uses
handler_configured now counts slack, teams, custom or cleared instead of
set or cleared, so usage shows whether the built-in destinations are picked.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(frontend): let the variable expiration handler template run on any worker
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: guard the variable expiration test endpoint and correct its help text
* fix: reuse the error handler's slack arg and built-in path helpers
* docs: trim variable expiration sweep and backfill comments
* feat: put the variable value expiration under an advanced section
* fix: restrict the expiration test job to built-ins and keep expiry on conflict reload
* fix: link the expiry hint to the variable's workspace and document built-in test paths
* fix: give the expiration sweep its own lock id and reuse double_option
* fix: pin the variable expiration presets so the hub-paths test accepts them
* feat: let the variable expiration handler set how far ahead it runs
* fix: give the notify before expiry setting its own card
* feat: remind the variable expiration handler at a set interval
* fix: tighten the gap between the Slack channel field and its test button
* feat: refuse a value expiry on variables linked to an OAuth account
* refactor: reuse the shared handler form for variable expiration
* refactor: sweep expiring variables round-robin and check the handler exists
* chore: trim comments to the constraints they record
* fix: compare expiry dates by moment when deploying a variable draft
* refactor: rename value_expires_at to value_valid_until
* fix: neutralize variable fields in expiration handler args
* fix: reserve the variable_expiration_handler group name for admins
* fix: send first expiry notices before reminders
* test: pin that a handler failing to start leaves its rows unclaimed
* chore: say any hub handler path skips the existence check
* fix: empty a pre-existing handler group before granting it the Slack token
* docs: correct the registered feature usage counts
* fix: let a workspace whose handler failed to start sit out for an hour
* fix: send first notices before reminders across workspaces
* fix: end a failed handler's wait as soon as it is redeployed
* fix: show an expiry-only variable change in the AI fork diff
* chore: regenerate workspace tool schemas
* test: keep one variable expiration guard per behavior
* fix: use the renamed hub expiration handlers and template
* feat: carry the variable expiry in windmill-utils-internal 1.8.4
* fix: keep the variable expiry through MCP drafts
* chore: bump windmill-utils-internal to 1.8.4
* fix: keep the variable expiry through mcp deploys
* fix: disable saving a slack or teams expiry handler without ee
* fix: skip the failure mark when the expiry handler was saved mid-sweep
* fix: count expiry telemetry only where the expiry changed
* test: assert the exact variable expiry in export and cli push tests
* fix: stamp an expiry handler failure with the pass's read time
* fix: wait for a pending handler lock instead of marking it failed
* test: isolate expiry handler tests from the deployed-script cache
* fix: retry a failing expiry handler every pass instead of waiting an hour
* chore: update ee-repo-ref to b6e23d229966cf0019c0a1926a254fda658d8def
This commit updates the EE repository reference after PR #744 was merged in windmill-ee-private.
Previous ee-repo-ref: c52c06d145b13a6fb04459e85ca5818bf3c1bff4
New ee-repo-ref: b6e23d229966cf0019c0a1926a254fda658d8def
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Co-authored-by: hugocasa <hugo@casademont.ch>
* [ee] fix: run unstamped git auto-pulls as a superadmin when the workspace has no admin
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* bump ee ref: log the fallback identity
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 6858e4cbd515b52713afea8dc32b23072af2248c
This commit updates the EE repository reference after PR #918 was merged in windmill-ee-private.
Previous ee-repo-ref: 03d89d10bdd9fba9d1184dc75f8582a5ad3741a8
New ee-repo-ref: 6858e4cbd515b52713afea8dc32b23072af2248c
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: let flow builder operators build AI agents
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: check linked agents' bound tools and type, validate on the write's transaction
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: bound the linked-agent walk by sorting bound tool ids
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: let builders bind only the agent tool inputs left to the model
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: check every agent tool sharing a bound id
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: show builders the agent's own tool inputs read-only and name agents in the setting
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: show the agent's own tool inputs with the read-only step viewer
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* style: give the agent-set inputs heading the input label style
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* style: label the agent's fixed tool inputs static inputs
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: address cubic review on agent builder rights
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: check agent writes against the role's flows capability
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: name the flows capability as the agent builder right
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: gate agent evals on the role's code capability
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: move the composed-flow check into windmill-api-auth
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: change an app's access mode under the deploy row lock
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: defer a mode change to deploy on an app run as another user
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: hold the access toggle while its change is in flight
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* revert: leave the deploy panel's access toggle to the settings drawer PR
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep the caller's draft on a mode-only app update
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: refuse a builder's mode-only change on an unsandboxed app
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: let non-admins write audit rows for jobs run as another user
* fix: keep logging audit failures on pool connections
* chore: point ee-repo-ref at the import fix
* chore: update ee-repo-ref to 06b2eb32cd7d40fd93078285d8b6150648384602
This commit updates the EE repository reference after PR #910 was merged in windmill-ee-private.
Previous ee-repo-ref: da546d93c846192ed599b02a5aa3edd5d1ecdcfd
New ee-repo-ref: 06b2eb32cd7d40fd93078285d8b6150648384602
Automated by sync-ee-ref workflow.
---------
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: configurable workspace roles with per-workspace overrides
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: close role review gaps in pickers, declarative sync and removal
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: keep resolve_role_name doc on its function
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: validate overrides on instance role changes and bill admins fully
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: allow pipeline drafts and keep role checks on one connection
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: list data pipelines in operator_can_draft
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: expect a 403 role refusal when an operator resolves jobs
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: require a valid license for custom workspace roles
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: freeze workspace roles when the license lapses
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: pin the ee companion for workspace roles
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: broadcast role override changes from the write path, not a trigger
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to b5294d38db082bdd104d5358a47695390694c05d
This commit updates the EE repository reference after PR #891 was merged in windmill-ee-private.
Previous ee-repo-ref: 688e00c5982865b14098f530d54280e2311994c0
New ee-repo-ref: b5294d38db082bdd104d5358a47695390694c05d
Automated by sync-ee-ref workflow.
* fix: let an admin row that kept the operator flag hold full rights everywhere
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: treat superadmin members as admins and return role names from get user
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* fix(worker): render TEMP_SCRIPT_REFS placeholder in Python runner-group loader.py
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: drop unrelated rustfmt churn in python_executor.rs
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: cover relative imports in a python runner group, keep the raw loader private
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 32784f3907f0a25fee4a9f96fa172420f17b3fea
This commit updates the EE repository reference after PR #908 was merged in windmill-ee-private.
Previous ee-repo-ref: 6c36ef6e94dda5e43e04a5a08c00ef7eabb6d9a8
New ee-repo-ref: 32784f3907f0a25fee4a9f96fa172420f17b3fea
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* fix: stop handler, app and agent jobs resolving untrusted references
* perf: skip decoding untrusted args that hold no dollar or escape
* test: drop the transaction the recovery handler no longer takes
* fix: flag reserved names in object keys and tighten the jsonb parity test
* fix: stop holding a pool connection while waiting for another
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: count only earlier occurrences as schedule handler history
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to ac53164fd27fe962a020f3ee944949df1f760603
This commit updates the EE repository reference after PR #904 was merged in windmill-ee-private.
Previous ee-repo-ref: 047764f902f10fce0156138c4240ba5d1a2e969a
New ee-repo-ref: ac53164fd27fe962a020f3ee944949df1f760603
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* test: stop backend tests waiting out real time they do not need
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: delete the unused workspace_dependencies fixture
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* test: fix error handler test flake and merge handler test binaries
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: tighten workspace handler test comments
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep script and flow deploys off a second pool connection
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: raise a folder default's errors only when it applies
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: scope delete_jobs side-table deletes to the request workspace
The /jobs/delete purge deleted resume_job, v2_job_runtime, v2_job_status
and concurrency_key rows by job id alone. Those tables have no
workspace_id, so a workspace admin could pass another workspace's job ids
and wipe its flow status, runtime, resume and concurrency rows. Scope
each delete through v2_job, as zombie_job_counter already is.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: filter delete_jobs ids to the workspace once
Resolve the request's job ids against v2_job up front and run every
delete on that filtered list, instead of repeating the v2_job subquery in
each side-table delete. The workspace scoping lives in one place and the
side-table deletes keep their plain id form.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* test: run the isolated-forks rule test in its own workspace
PROTECTION_RULES_CACHE is process-wide and keyed by workspace id, so the
other base-fixture tests in protection_rules.rs, running concurrently on
their own databases, could cache test-workspace's rules without the
RequireIsolatedForks ruleset and let the fork through to the data table
copy (400 instead of 403) on main.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: match nsjail profile lines so the envar check passes on CRLF checkouts
script_profiles_take_envars_before_their_fixed_ones searched for
"\n{ENVARS}\n", which a Windows checkout (CRLF) never contains, failing
cargo_test_windows since v1.834.0.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: route the python SDK's S3 client settings through the S3 proxy
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: drop the boto3 config key and expose the proxied bucket to polars
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: proxy S3 settings only for server-signed tokens and keep tls verify
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: isolate fork object storage under a per-fork prefix with read-through
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: guard fork storage isolation against traversal, shared lakes and orphaning
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: serialize fork purges with same-id creation and guard shared middle forks
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: drop fork storage mappings on every replica and lock fork deletion against child creation
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* wip: require isolated forks rule
* feat: add a Require isolated forks protection rule
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: recheck isolated forks under the datatable lock and judge bypass in the base
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 455681e55eb7cdfcfdb7cd79cbae75b333e07943
This commit updates the EE repository reference after PR #893 was merged in windmill-ee-private.
Previous ee-repo-ref: 93f26e3cf816e4eb97b7d4dbbb5fc97fdf9821af
New ee-repo-ref: 455681e55eb7cdfcfdb7cd79cbae75b333e07943
Automated by sync-ee-ref workflow.
* fix: exempt only datatables the base does not own, compact fork data choices
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: pin the isolated-forks owner check, fix its docs wording
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: add a toggle to leave forks of non-dev workspaces out of dev isolation
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: track the non-dev forks toggle reactively and bound the forking rule checks
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: point ee-repo-ref at the skip non-dev forks telemetry registration
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep forks of archived dev workspaces isolated and warn about forkable non-dev forks
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: reset tag lineage caches on every archive and unarchive
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* perf: cache the token dev lineage lookup and trim isolation hot-path costs
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: point ee-repo-ref at the merged skip non-dev forks telemetry registration
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: route dev workspace and fork jobs to their own worker groups
* fix: harden dev workspace isolation against review findings
* fix: verify hashed dedicated tags and keep dev lineage across renames
* fix: let tag-scoped tokens reach jobs queued on dev workspace tags
* fix: expand tag scopes only in dev workspaces and forks
* fix: expand tag scopes only while dev workspace isolation is on
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: collapse the dev workspace isolation section by default
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: count dev workspace isolation toggles and dev-serving group flags
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: validate the dev workspace tag suffix on every instance config writer
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 71e9c0de8317e839f955ebef6a819062f20ac418
This commit updates the EE repository reference after PR #892 was merged in windmill-ee-private.
Previous ee-repo-ref: b5ab84e1705f939c399f6315a03f88b55bce1804
New ee-repo-ref: 71e9c0de8317e839f955ebef6a819062f20ac418
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* fix: require variables:read for the token variable of an mcp resource
A token scoped to resources:read/write on an MCP resource could have the API
decrypt the variable the resource's `token` points at and send it as a bearer
to the resource's URL. The url and header `$var:` references already required
variables:read on the variable; the token reference now does too, checked before
the OAuth refresh touches that variable.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: let an mcp resource's scope cover the variables it references
A scoped token reading or calling an MCP resource resolved its token variable
with the resource scope alone, but its url and header variables also needed
variables:read on each. The resource scope now covers all three; RLS still
bounds them to secrets the caller can read. Reverts the token-side check from
the previous commit.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: scope resource references when they are written, not when they are read
A token scoped to a resource now reads everything that resource references
(`$var:`, `$jsonvar:`, `$res:`), through get_value_interpolated and the MCP
tool routes alike. What makes that safe moves to the write: create, update,
update_value and version restore refuse a scoped token adding a reference it
holds no read scope on. References the stored value already carries are kept,
since whoever put them there was allowed to.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: hold every resource reference writer to its own user's read rights
A resource-scoped reader resolves stored references as itself, so an unscoped
session could plant a reference to a secret its own user cannot read and have
a reader's scoped token resolve it. Adding a reference now also requires the
writer's user to see its target under RLS. A reference to nothing yet stays
allowed, since a promotion pushes resources before the secrets they use.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: vet only variable references on write and keep nested resources scoped
A nested `$res:` brought along the variables of a resource the writer could see
but whose references it could not read, and what it references can change after
it is written. It needs its own read scope again, and the write check covers
only `$var:`/`$jsonvar:`.
An MCP token stored as a bare path resolved as a variable without being vetted
on write. It now needs its own variables:read scope, and the `$var:` prefix is
parsed with strip_prefix, as the write check does.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep variable scopes on result-cache resources
The worker writes job output to g/results/<hash> straight to the table, so its
references never pass the write check. A token scoped to such a resource still
needs read scope on the variables it references.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: require read rights on kept references and pin result-cache resources to g/results/
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: check resource variable references at read time, with wildcard resource scopes covering matching variables
Returns to the read-time rule: a variable a resource references needs
variables:read on it, unless it is the resource's linked secret or a wildcard
pattern in the token's resources: scopes matches it. The MCP token reference is
now held to that rule like the url and header references.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: let deployed low-code apps run runtime-built inline queries again
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: limit id-less app runs to the database studio's sql languages
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: cover the deployed-row exclusion with sql content
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: emit a single email claim in job OIDC tokens
Bumps the EE ref to drop the duplicate standard email claim from the job
token mint, and asserts the raw payload carries one email key.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: note the single-email check in the OIDC claim test doc
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to d29a7c0dad120e137105b1186d0bbe3ea1504b5d
This commit updates the EE repository reference after PR #886 was merged in windmill-ee-private.
Previous ee-repo-ref: d64df5c1787e4404c99a41a97fca22668a669c4d
New ee-repo-ref: d29a7c0dad120e137105b1186d0bbe3ea1504b5d
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* Revert "docs: agent editor comments describe runs as the caller"
This reverts commit d94919c9fe.
* Revert "refactor: agents run as the caller, with a note on what a shared one needs"
This reverts commit 0748a2fb51.
* fix: a run as an identity continues only the caller's own conversation
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: an agent run as its identity takes only attachments its caller may read
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: the resource editor keeps an agent's identity on an admin's save
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: regenerate workspace tool schemas for preserve_on_behalf_of
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: the rust client sets preserve_on_behalf_of on resource writes
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: agents run on behalf of their identity only when they opt in
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: an agent holds an identity only while it runs on behalf of it
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: reduce the agent identity migration to clearing untrusted keys
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: refuse decoded variable references in inputs to an agent run as its identity
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: user renames and offboarding re-point an agent's identity
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: refuse model-written tool arguments that the tool's job would interpolate
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: agent on-behalf-of migration after main's
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: the agent identity migration also clears trashed agents
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: share AI sessions read-only by link, optionally public
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: render shared session snapshots from an allowlist, without mermaid or remote images
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* style: make the session share button icon-only
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: safe reasoning links, artifact list and full-load exits on shared sessions
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: resolve canceled jobs and batch re-run them in limited batches
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: offer the re-run batch limit only for failed or canceled filters
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: label an unresolved canceled run as canceled in its status badge
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: tell the user that sources a batch could not re-run block the next batch
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: warn when a re-run batch includes resolved runs and offer to hide them
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: say in the re-run confirmation that failed or canceled sources get resolved
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: let job tokens post Teams messages to their own workspace's team
* chore: point ee-repo-ref at the Teams job-token check
* chore: update ee-repo-ref to 3b6bd2b15d9bddb0bb8f1de08b30b897db0415b4
This commit updates the EE repository reference after PR #885 was merged in windmill-ee-private.
Previous ee-repo-ref: e8e4bcd63d6fc804d29e67d42ca6d4163b144a33
New ee-repo-ref: 3b6bd2b15d9bddb0bb8f1de08b30b897db0415b4
Automated by sync-ee-ref workflow.
---------
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* fix: relock apps in place so imported script changes reach them
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: requeue an app relock whose version was rewritten meanwhile
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: relock every component of the version a superseded app relock requeues
Also share raw-app runnable dependency extraction between the worker and the dependency-map rebuild, and take no-key-update row locks, which still order against a deploy's UPDATE without blocking app_script inserts.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: relock every component when an app relock runs on a newer version
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: resolve a requeued app relock's components when it runs
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: regenerate every lock when an app relock relocks every component
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* test: expect app scoping to refuse a foreign app_script id in app_preview_auth
#11777 scopes run-mode app_script ids to their app, so another app's id is
now refused with 401 before the content-hash pin check is reached.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: run end_user_email inline scripts through the deployed app_script id
#11777 runs inline code only through the app_script rows the deployed lite
value references once it exists, so id-less raw_code is refused. Shape the
fixtures like real apps (nested inlineScript) and run by the deployed id.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: wait for both dedicated worker jobs on one listener
The second completed-job listener was opened only after the first job
completed, so a second job that finished first was never seen and the test
hung until the 90s worker timeout.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: allow early return on steps inside a branch to one
The "Early return for sync webhooks" flow setting could only point at a
top-level step. It can now also point at a step inside a branch to one,
in any branch including the default one, and through nested branches to
one.
When the branch is taken, the sync call returns that step's result as
soon as it completes while the rest of the flow keeps running. When it
is not taken, the call returns the flow's final result. The sync wait
loops already resolved nested steps and fell back to the final result,
so they are unchanged.
Worker: check_if_early_return_or_last_in_early_return_parent now
accepts a job whose step id matches early_return at any depth, as long
as every job between it and the root is a branch to one. A loop
iteration or a subflow reusing the same id does not take the stream.
The existing case, the last step of a branch to one that is itself the
early-return step, is unchanged.
Frontend: the native <select> is replaced by EarlyReturnPicker, a
searchable list in flow order where each nested step shows its path
(e.g. `a › Branch 1`). Branch to all and loops inside a branch to one,
and the steps inside them, are not offered: the results lookup cannot
resolve them when nested. Picking a nested step shows a hint that it
only runs if its branch is taken.
* fix: stream the last step when the early return branch is not taken
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep the stream off the last step once the early return step ran
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: list early return steps by id only
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: use the standard select for the early return step
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: match the early return step by its flow scope, not its path
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep branch to all and loop steps off the early return stream
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: allow early return on steps inside a branch to all
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: resolve a nested branch to all or loop as the early return step
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: pin which step streams for an early return inside branches
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: return an empty nested loop or branch to all as its early return list
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* revert: read an empty container's early return status from the root
An empty nested loop or branch to all falls back to the flow's final result again,
so an empty top-level loop that failed keeps its real status.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: stefan <stefan.radovanovic@ip-paris.fr>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: let a legacy migration whose comment reads like a scope get a down
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: pin adding a down to a migration whose comment predates scopes
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep applied migrations and db settings in data table copies
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: scope copied db settings per transaction and send timestamps as iso
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: copy migrations and settings only into a fresh import target
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* ci: install the latest pg_dump for backend integration tests
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* ci: enable pgdg so the latest pg_dump is installed
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: connect a data table as the job's own identity unless the runnable opts into its viewer
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: key cached results by the data table mode and keep the flag across ai edits
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: hash the cache key's mode and viewer as fixed fields so no argument name can forge them
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 2f74548ad1ec50c8e1faf17e42d5648160e833f1
This commit updates the EE repository reference after PR #878 was merged in windmill-ee-private.
Previous ee-repo-ref: 4ad768a777fff9f1ecc86a2803bc27d80f8242d6
New ee-repo-ref: 2f74548ad1ec50c8e1faf17e42d5648160e833f1
Automated by sync-ee-ref workflow.
* feat: rename the flag to viewer_data_access and apply it to object storage permission rules
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: describe viewer_data_access as covering object storage rules too
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 0ffb633473c5465513576afc6f54d18f93c7f1e1
This commit updates the EE repository reference after PR #879 was merged in windmill-ee-private.
Previous ee-repo-ref: e9e06a9eb94168f46b378276b01fa0117dc7d8ed
New ee-repo-ref: 0ffb633473c5465513576afc6f54d18f93c7f1e1
Automated by sync-ee-ref workflow.
* feat: show the viewer data access control as an icon button
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* fix: encrypt ai session backups with aes-256-gcm
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* test: cover ai session backups written with aes-256-gcm
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: name the release ai session readers ship in
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: hold ai session gcm writes until old servers are rolled out
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: serve s3 proxy objects with nosniff and a sandbox csp
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* test: assert s3 proxy error responses carry nosniff and the sandbox csp
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to 196abc042c691ea16280ee10b89fb3b2fd527236
This commit updates the EE repository reference after PR #876 was merged in windmill-ee-private.
Previous ee-repo-ref: 25feaf41aa84d47f8e4adb4def2576b443a66374
New ee-repo-ref: 196abc042c691ea16280ee10b89fb3b2fd527236
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* fix(cli): count superadmins as able to preserve ownership on push
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011BzU9zd53JsTShCsbKzYzB
* fix: resolve variables in the url and headers of an mcp resource
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep resolved mcp secrets out of header warnings and userinfo urls
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: drop the url from mcp client errors before rmcp logs them
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: run rmcp's reqwest client without a log subscriber
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: scrub the request target from mcp error bodies
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: drop server error bodies from mcp transport errors
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: fail closed when an mcp error message has no status prefix
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: recheck app read access on every publisher-mode component run
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: pin that app read grants and revocations apply to the next run
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: cache only app permit grants, for 60s, instead of rechecking every run
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: fill raw app ctx inputs on the server, not from the request
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: read declared ctx inputs from the deployed app at run time
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: count the revocation's cache invalidation apart from the deploy's
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: drop the deploy-time cache eviction trigger, rely on the cache ttl
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: audit declarative instance config writes
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep early logs, base url and license plan for declarative writers
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: require an observer on every config apply, drop license loading
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: export only audit events from the declarative subcommands
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to d6a6cdd343e7744ea49c610f9534c8013c8ffc2a
This commit updates the EE repository reference after PR #872 was merged in windmill-ee-private.
Previous ee-repo-ref: fc51c31bafb5975694fffe1da51f7b41fbf127a6
New ee-repo-ref: d6a6cdd343e7744ea49c610f9534c8013c8ffc2a
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* test: stop success handler tests sharing the deployed script cache
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: drop the sqlx cache entry of the removed test query
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: resolve $var: references in mcp resource headers
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: require variables:read scope to resolve mcp header variables
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep preserve_step_tags on saved branch and loop flow nodes
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* style: format reduce_flow call
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: stop offering deno for new scripts and ship it only on full images
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep deno in the integration test worker and narrow the missing-deno error
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep deno selectable on existing deno scripts when the saved order omits it
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: drop the deno workloads from the benchmark suite
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: run bun instead of deno in tests that are not about the deno runtime
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: drop the deno cases from the integration suite
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: update the app policy hash for the bun inline script
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: add a jobs:run:dependencies token scope for lock generation
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: pin lock-job reads to the dependencies scope
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: align scope labels with and without a restrict paths button
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: match a lock job's stored path literally on job reads
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: drop the dependency-lock warning from the jobs scope heading
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KNiYsRRDyvkRYwkHda6uyf
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: sync hub resource types daily from the server
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: retire the legacy hub_sync script and its schedule
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: sync only from the hub on the daily schedule
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: sync resource types through the endpoint in e2e setup
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: honor ACCEPT_INVALID_CERTS in the hub resource type sync
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: audit manual hub resource type syncs that change types
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: show the AI step's resource type sync as a setting card
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep the hub_sync opt-out and move sync state to task state
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: hold the daily hub sync until the legacy hub_sync is retired
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: turn off the daily sync when an edited hub_sync is scheduled
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: make the daily hub resource type sync opt-in
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: bring back the setup wizard's daily resource type sync toggle
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: apply the image's resource types on every SYNC_CACHED_RT start
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: let workspace admins delete another user's draft
* feat: delete every draft at a path when no username is given
* fix: leave the editor cleanly after deleting the last draft at a path
* fix: drain autosave before a path-wide draft delete
* fix: resume a parked autosave when a path-wide draft delete fails
* fix: set WM_END_USER_EMAIL on direct script and flow runs
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: pass the end user to workflow-as-code tasks
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: describe when WM_END_USER_EMAIL is set
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: pin the end user a job token passes on
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: export worker cpu, memory and occupancy metrics
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: refresh the exported memory limit with the cgroup readings
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to e128a9b9bedd0b6a46d355b69db13bf8f650c4e6
This commit updates the EE repository reference after PR #864 was merged in windmill-ee-private.
Previous ee-repo-ref: b286a486c69e74ec0742a2aac9d4cb1161eb0c6b
New ee-repo-ref: e128a9b9bedd0b6a46d355b69db13bf8f650c4e6
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* fix: store a workflow-as-code parent's first start and wall duration
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep a parked child's first start in its parent's timeline
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: record a parked step with its whole span in the flow, cover inline checkpoints
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to ab8476e5feedc98b727f7d83acffa1807b3b9c5b
This commit updates the EE repository reference after PR #861 was merged in windmill-ee-private.
Previous ee-repo-ref: d5d95f51bb175944874e585e5931acb1eddd637a
New ee-repo-ref: ab8476e5feedc98b727f7d83acffa1807b3b9c5b
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Alexander Petric
GuilhemandClaude Opus 5.5
