mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-08-21 00:02:23 +00:00
abcd920964e583bd0bda7ed28126ae4862828495
7979 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 hugocasa
|
e9e72fbbf8 |
feat: edit scopes on existing API tokens (#8967)
* feat: edit scopes on existing API tokens Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix: address PR review feedback on token scope edit - add SECURITY DEFINER to notify_token_scopes_change so trigger fires under windmill_user/admin roles (cubic P1) - drop banned $bindable(default) on optional props (CLAUDE.md): make ScopesPicker.value and EditTokenScopesModal.open required - detect MCP only when *every* scope starts with mcp: so mixed/null-scope tokens fall back to standard picker without dropping non-mcp scopes - audit log scope payload via serde_json instead of Rust {:?} Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
 Ruben Fiszel
|
de0b6b1528 |
feat: workspace-shared ui/ folder reusable across raw apps (#8974)
* feat: add workspace-shared ui/ folder reusable across raw apps Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat: add shared ui/ drawer in raw app editor sidebar Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat: forward workspace shared ui/ to raw app editor iframe Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * all * all --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
Ruben Fiszel
|
1169d9bfd3 |
feat: add delete_after_secs and sensitive_inputs for raw app runnables (#8975)
* feat: add delete_after_secs and sensitive_inputs to raw app policy Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * chore: simplify sensitive toggle label Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * chore: use tertiary text for sensitive toggle label Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * chore: unset sensitive field when toggled off Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix: address PR review feedback - plumb force_viewer_sensitive_inputs/delete_after_secs so editor preview matches deployed-mode encryption - reuse resolve_delete_after_secs helper for consistency with scripts/flows - log+ignore schedule_job_deletion errors so a failed schedule doesn't surface as an execute_component failure - fix text-primay typo in CacheTtlPopup and DeleteAfterUsePopup - tighten extraFields return type to Partial<Pick<...>> Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
Ruben Fiszel
|
8627d3c5ae |
fix: show skipped label on flow progress bar (#8973)
* fix: show skipped label on flow progress bar for skipped flows Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * refactor: narrow is_skipped via 'in' operator on Job union Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
 centdix
|
b883f9a9d2 |
feat: add ai chat schedule and trigger tools (#8961)
* feat: add ai chat schedule and trigger tools * refactor: use zod for ai chat workspace tools * refactor: let ai provide runnable target fields * refactor: generate ai chat workspace tool schemas * fix: add object type to composed tool schemas * fix: avoid top-level trigger schema unions Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: block undeployed workspace ai tools Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: inject ai workspace tool target Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * test: add ai evals for workspace tools Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * test: make workspace tool eval prompts realistic Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: surface workspace tool errors * fix: show workspace tool success details * fix: describe workspace tool path format * fix: clarify workspace path examples * fix: tighten workspace tool validation * fix: align workspace tool prompts * chore: mark generated chat schemas * chore: mark generated cli skills --------- Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> |
||
|
centdix
|
34b549cfe2 |
perf: optimize datatable app chat schemas (#8960)
* perf: optimize datatable app chat schemas Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * perf: optimize datatable catalog queries Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * refactor: narrow datatable chat optimization Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: restrict datatable schema lookups Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: block system datatable schema lookups Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: handle datatable context edge cases Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: handle datatable schema edge cases Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> |
||
|
hugocasa
|
c0eeea9c83 |
feat: support S3Object input args in native SQL scripts (#8954)
* feat: support S3Object input args in native SQL scripts Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: review fixes from local-review Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * update parser --------- Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> |
||
|
hugocasa
|
c95642863e |
feat: support restart from steps inside BranchOne, ForLoop, Subflow (#8955)
* feat: support restart from steps inside BranchOne, ForLoop, Subflow Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix: preserve original job kind in nested restart, support expanded subflow steps Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix: read selected iteration from graph state for nested ForLoop restart Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat: iteration selectors per ForLoop in restart popup, more nested restart tests Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * refactor: extract useNestedRestartState composable Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * test: cover deployed-subflow + FlowDependencies path in nested restart Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * chore: update sqlx prepare cache Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix: detect BranchOne/ForLoop ancestors inside expanded subflows for nested restart Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix: hide restart button for non-restartable steps (parallel containers, untaken branches) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix: address review feedback on nested restart PR - preview FlowRestartButton: hide nested case (chain UUIDs aren't resolvable in preview path; users can use the run page for nested restart instead) - branchOneAncestorMatchesOriginal: be permissive when status isn't reachable (don't hide the button for BranchOnes nested deeper than top-level) - worker_flow.rs: apply nested_restart_payload swap on the is_simple ForLoop fast path too, so simple iterations don't bypass restart spawn interception - FlowStatusViewer: reset expandedSubflows cache on jobId change; drop $bindable({}) banned pattern for the new prop - API resolver: validate the leaf step exists before returning (fail-fast) - doc fix: branch_or_iteration_n is 0-based, not 1-based - selectedJobStepIsTopLevel reset on early-return in composable - comment iterationCounts collision caveat - new HTTP-level integration tests covering the API endpoint contract: happy path (top-level + nested), unknown step, out-of-range iteration, parallel-loop rejection Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * revert: remove unreachable nested-restart swap on is_simple ForLoop fast path The swap is unreachable in valid flows: `is_simple_modules` requires the body to be a single `script` / `rawscript` / `flowscript` (per `FlowModule::is_simple`), none of which spawn flow-kind children. Any nested-restart chain targeting a leaf inside such an iteration is rejected by the API at leaf validation. Even if a chain reached the worker via `JobPayload::RawFlow.restarted_from`, the resulting `RestartedFlow` would fail to push (script kind isn't a flow kind). Replaced the swap with an explanatory comment so the next reader knows why the symmetry with the non-simple path was deliberately not added. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix: handle undefined expandedSubflows + tighten branchOne match check Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
hugocasa
|
70b90c41dc |
fix: prevent React app editor from overwriting files on theme switch (#8965)
* fix: prevent React app editor from overwriting files on theme switch The ui_builder iframe src embeds the dark-mode flag, so toggling theme reloads it. iframeLoaded was sticky-true, so the populate effect didn't refire and the iframe's default "Hello World" template clobbered the user's files via its initial setFiles message. Reset iframeLoaded on darkMode change and suppress inbound setFiles from the iframe until our files are re-pushed. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix: cancel suppress timer on rapid theme toggles On a second theme toggle while the previous reload's clear-timer was still pending, that timer would fire mid-reload and drop suppression before the iframe finished booting — letting the iframe's default template setFiles overwrite the user's files. Track the timer ID, cancel it whenever we re-assert suppression, and fold the two 500ms timers into one. Race identified by cubic. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
Ruben Fiszel
|
1d279e7a1e |
feat: add min release age instance settings for bun and uv (#8956)
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> |
||
|
Ruben Fiszel
|
b2004f357d |
chore(main): release 1.692.0 (#8950)
* chore(main): release 1.692.0 * Apply automatic changes --------- Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com> |
||
 Guilhem
|
eebe24d8b0 |
feat(cli): wmill dev with per-flow proxy and responsive Dev UI (#8529)
* feat(cli): add `wmill flow dev` subcommand with per-flow reverse proxy and launch.json Also generates .claude/launch.json for existing flow folders during `wmill init`. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: responsive dev layout and hide splitter for single-pane views Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: clamp flow graph height between minHeight and maxHeight Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * feat(cli): enhance app new with Claude Desktop integration and better defaults - Add .claude/launch.json to generated app scaffold for Claude Code preview support - Add "Open in Claude Desktop?" prompt that creates a CLI session and opens it in Claude Desktop Code mode via the claude://resume deep link - Improve default CSS template with body background, system fonts, and padding Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix(cli): handle both .flow and __flow suffixes in wmill dev The flow detection in loadPaths only checked the configured suffix (dotted or non-dotted), so users with nonDottedPaths=true who had .flow folders (or vice versa) would see inline script edits treated as standalone script changes instead of flow changes. Now checks both suffix forms everywhere: type classification, folder path extraction, path stripping, and loadWmPath lookup. Also adds raw_app launch.json generation to init and sync pull. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * docs(cli): update generated skills with dev workflow and preview commands Update cli-commands, write-flow, and raw-app skills to document the new local dev workflow (wmill dev --path, --proxy-port, .claude/launch.json). Add wmill script preview and wmill flow preview to all script/flow skills so agents know how to test without deploying. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix(cli): include path in dev URL and use open.default for browser - Append &path= to the printed/opened URL when --path is specified - Use open.default(url) instead of open.openApp for more reliable browser opening Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat(cli): add Claude CLI/Desktop detection hints in wmill flow new Show contextual instructions for previewing flows based on available tools. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: regenerate auto-generated CLI skills for new dev flags Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(cli): handle mixed flow suffixes in dev file watcher The ignore() function uses isFlowPath() which only checks the configured suffix (__flow or .flow), causing files in the other variant to be silently ignored. Bypass the ignore check for any file inside a flow folder and force flow type detection regardless of suffix configuration. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat(cli): drop default proxy in flow folders, open browser, add --no-browser Manual `wmill dev` in a flow folder should not implicitly enable the reverse proxy. Both proxy and legacy modes now open the browser; the new --no-browser flag opts out. Claude Code launch.json templates pass --no-browser so the IDE preview doesn't fight a system browser window. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(cli): gate dev broadcasts by --path and push currentLastEdit on connect When --path (or auto-detected flow path) is set, drop file events for any other path so the dev page stays locked to the requested resource and currentLastEdit can never reflect an unrelated edit. The connection handler proactively pushes currentLastEdit so the page renders without waiting for the first file change. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(frontend): prefer WebSocket for flow round-trip when wmill dev is connected updateFlow used isInIframe priority, which routed Claude Code's iframe preview through postMessage (no listener) and silently dropped flow edits. Flip the priority: when the wmill dev WebSocket is open, use it (covers standalone tabs and Claude Code's preview); fall back to postMessage only when no WS is connected (the VS Code extension's iframe URL has no `local=true`, so it never opens one). Also stop assigning lastSent before a channel actually accepted the message, so a CONNECTING WS doesn't silently swallow the first change. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(dev): url is source of truth for path; add workspace file picker Drops the server-side --path gate added in |
||
|
Ruben Fiszel
|
e636f589a5 |
fix: prevent flow-dep job stalls under row-lock contention (#8952)
* refactor: split flow-dep job tx so subprocesses don't hold row locks Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat: link flow version from run page to pinned flow viewer Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix: time-out dep job phase 1/3 db ops and surface error on flow page Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix: dissolve dep_map in phase 1 and recheck flow version unconditionally Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix: address PR review — view-latest reload, decimal truncation, app version Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix: keep dissolve in phase 3 for relative-import dep jobs Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * chore: trim verbose comments and refresh sqlx offline cache Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix: address cubic — propagate dissolve errors, include workspace in reload key Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
Guilhem
|
02f1581e5b |
align folders page empty state with table style (#8920)
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
 Diego Imbert
|
15bba79ef2 |
fix: Audit logs filters UI spacing (#8944)
* fix: Audit logs filters UI spacing * nit |
||
|
Ruben Fiszel
|
e8f7589d7a |
fix: delete instance settings cleared via bulk endpoint (#8949)
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
Ruben Fiszel
|
76108ed5b2 |
chore(main): release 1.691.1 (#8941)
* chore(main): release 1.691.1 * Apply automatic changes --------- Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com> |
||
|
Ruben Fiszel
|
ddf14a51d8 |
refactor: split git repo viewer effects to remove redundant calls (#8943)
* refactor: split git repo viewer effects to remove redundant calls Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * refactor: compact file preview header in s3 file picker Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * refactor: skip empty preview status row when no message applies Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
Ruben Fiszel
|
b8fcb7f04b |
fix: preserve s3 rootPath when reloading git repo viewer (#8942)
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
Ruben Fiszel
|
612a39bcfc |
chore(main): release 1.691.0 (#8931)
* chore(main): release 1.691.0 * Apply automatic changes --------- Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com> |
||
|
centdix
|
483fb1fb9a |
perf: reduce app ai chat token usage (#8928)
* test: add app chat token usage evals Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * perf: make app file listing metadata only Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * perf: reduce app datatable prompt context Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * test: add app datatable persistence eval Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * test: fix file manager rename app eval Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * test: remove selected app context eval cases Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: address app eval review feedback Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> |
||
|
hugocasa
|
a1a73309fd |
refactor: remove force_branch from git sync settings (#8934)
* [ee] refactor: remove force_branch from git sync settings Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * chore: update ee-repo-ref to 680885a4e8c8de5185650cddeb56b926e722718f This commit updates the EE repository reference after PR #549 was merged in windmill-ee-private. Previous ee-repo-ref: 37fe2e1286a162119df885062e50461400631850 New ee-repo-ref: 680885a4e8c8de5185650cddeb56b926e722718f Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |
||
|
hugocasa
|
8a986500b9 |
feat: WM_TESTED_RUNNABLE env var + wildcards in test: annotation (#8926)
* feat: WM_TESTED_RUNNABLE env var + wildcards in test: annotation
Extends the CI test feature so a single test script can cover multiple
runnables and branch on which one triggered it.
- test: annotation now supports glob wildcards: `*` matches one path
segment, `**` matches any depth. A new `ci_test_path_matches` helper
in windmill-common compiles patterns to anchored regexes with a small
quick_cache LRU.
- New migration adds a Postgres GENERATED `has_wildcard` column + partial
index on ci_test_reference so exact-match lookups keep using the
primary index and only wildcard rows are scanned for regex matching.
- ci_test trigger query and the UI `ci_test_results` / `ci_test_results_batch`
endpoints split into exact + wildcard paths; the batch endpoint now
issues one query per distinct kind instead of one per item.
- Worker injects `WM_TESTED_RUNNABLE={kind}/{path}` into CI test jobs,
derived from the trigger metadata stored at push time.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix: scope CI test job lookup by trigger + populate WM_TESTED_RUNNABLE in resource interpolation
Scope the ci_test_results LATERAL lookup by v2_job.trigger so multi-target
tests (via wildcards or multiple exact annotations) report the correct job
per target. Also pass the tested runnable through transform_json_value in
resources.rs for consistency with schedule_path.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to 489eb0d89702e5d1cc7c6e0f9ba9e0c8e5063741
This commit updates the EE repository reference after PR #546 was merged in windmill-ee-private.
Previous ee-repo-ref: e7534bcafcd8c27fcf870b2ea868e901b00b7960
New ee-repo-ref: 489eb0d89702e5d1cc7c6e0f9ba9e0c8e5063741
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
|
||
|
Ruben Fiszel
|
4cf53a44bb |
feat: add auto-login SSO provider instance setting (#8929)
* [ee] feat: add auto-login SSO provider instance setting Adds an instance-level `auto_login_provider` setting that, when set to an OAuth provider key (e.g. "okta") or "saml", causes the login page to auto-redirect users to the configured SSO flow on mount. Useful for orgs with a single SSO where the provider button grid adds a pointless extra click. - Backend: new global setting constant, read from DB in list_logins handler and returned as the `auto_login` field in the response - Frontend: Login.svelte auto-redirects in loadLogins() when the configured provider is actually present in the response - Escape hatch: `?no_sso=1` skips the auto-redirect and shows the normal login form (admin fallback when SSO is broken) - No redirect loop: if the `error` prop is set (SSO callback failed), the redirect is skipped - Admin UI: new text field under Auth/OAuth/SAML in instance settings Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix: skip auto-redirect on /user/login page Auto-redirect should only fire on embeds where the user did not explicitly navigate to a login screen (public app popup, approval pages). Visiting /user/login is an explicit sign-in action — often by an admin who needs password fallback — so we must never hijack it. Gate the logic on a new `autoRedirect` prop (default true). The main login page passes `autoRedirect={false}`. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * chore: update ee-repo-ref to b7157d55fb9f8d8f7aeb7b1fb69bc935af895a2f This commit updates the EE repository reference after PR #547 was merged in windmill-ee-private. Previous ee-repo-ref: e32a48499d206a24e0c12817b465775321b0ee41 New ee-repo-ref: b7157d55fb9f8d8f7aeb7b1fb69bc935af895a2f Automated by sync-ee-ref workflow. * fix: handle popup-blocked auto-redirect in popup mode When Login is embedded with popup=true (public app), auto-redirect funnels through window.open() without a user gesture — browsers block it by default, leaving the user stuck on "Signing you in…". Detect window.open returning null, clean up listeners, reset autoRedirecting so the provider button grid re-renders, and surface a toast pointing users at the manual button. The grid click retains its user gesture and passes the popup blocker. Also extracts a redirectSaml() helper so the SAML auto-redirect path and the SSO button click share the same logic. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |
||
|
Ruben Fiszel
|
161ec8d722 |
chore(main): release 1.690.0 (#8921)
* chore(main): release 1.690.0 * Apply automatic changes --------- Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com> |
||
|
Ruben Fiszel
|
664d0f838d |
fix: ensure schema is inferred on script/flow module load (#8927)
* fix: ensure schema is inferred on script/flow module load Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: memoize all WASM parser init promises Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> |
||
|
hugocasa
|
d6c642b170 |
feat: add Azure Event Grid triggers (#8888)
* feat: add Azure Event Grid triggers (EE)
Introduces a new enterprise trigger kind `azure` that supports three
modes via a single unified trigger type:
- basic_push: Azure Event Grid basic — custom topics, system topics
(Storage, Resource Manager, Key Vault, etc.), domains (push only)
- namespace_push: Event Grid Namespace topics (CloudEvents over HTTP push)
- namespace_pull: Event Grid Namespace topics (HTTP pull with lock-token
ack/reject for dead-lettering)
Auth uses a Service Principal resource (tenant_id, client_id,
client_secret, subscription_id). Subscriptions are created in
CloudEvents 1.0 schema so the push webhook handler and the pull listener
share one payload parser.
Backend
- New crate `windmill-trigger-azure` (OSS stubs + EE impl symlinked from
windmill-ee-private)
- Migration `azure_trigger` table with CHECK constraints enforcing
mode/columns coherence
- `TriggerKind::Azure`, `JobTriggerKind::Azure`,
`DeployedObject::AzureTrigger` variants
- Push route `/api/azure/w/{workspace}/*path` handles classic
Event Grid SubscriptionValidation handshake and CloudEvents 1.0
abuse-protection OPTIONS handshake
- Optional inbound JWT validation (audience check only for v1)
- Feature flag `azure_trigger` propagated through windmill-api,
windmill-store (resource helper), and added to ee_core
Frontend
- `triggers/azure/` editor with mode toggle (basic/namespace-push/
namespace-pull) and per-mode config (topic ARM id / namespace +
topic name / subscription / filters / push auth / pull options)
- Registered in icon map, display names, save functions, badge,
wrapper, editor, add-trigger menu
OpenAPI
- `AzureTrigger`, `AzureTriggerData`, `AzureMode`,
`AzureSubscriptionMode`, `AzureDeliveryConfig`, `TestAzureConnection`
schemas; `/azure_triggers/*` endpoints; client regenerated
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to eaa7c3a9cb37a9ccc93f10a2535d929365acd2d8
This commit updates the EE repository reference after PR #541 was merged in windmill-ee-private.
Previous ee-repo-ref: 9689014e8c12c36c1059fd8fa5758d550b8b8bc9
New ee-repo-ref: eaa7c3a9cb37a9ccc93f10a2535d929365acd2d8
Automated by sync-ee-ref workflow.
* feat(azure-trigger): secret-auth push, ARM discovery, capture isolation, CLI + parity
Frontend:
- Split mode selector into Namespace/Basic + Pull/Push
- ARM resource dropdowns (namespaces, Basic topics, namespace topics)
populated from the service principal; cascade with stale-selection
reset on SP / edition change
- Remove stale authenticate toggle + audience input (server-managed
push_auth_config has replaced them)
- Azure listing page: "Create from template" button; "Also delete Azure
subscription" toggle in the delete modal; simplified trigger label
falling back to path
- AzureCapture.svelte: "Test subscription name" with -wm-capture suffix
- CompareWorkspaces.svelte: wire Azure for fork/compare
- Drop Trigger-deployed/event-loss warning (capture subscription is
isolated with -wm-capture)
Backend:
- Shared-secret push auth (see EE crate for detail)
- JSONB push_auth_config column (renamed from delivery_config), #[serde(skip)]
so clients/CLI/exports never see it
- Drop redundant enabled column; mode supersedes
- Azure capture infra: AzureTriggerConfig + set_azure_trigger_config +
azure_payload route + TriggerKind::Azure arm; PT15M queue TTL on
capture subscriptions so they bound storage after tab close
- Granular ACLs, users offboarding, trash, git-sync deployed-object:
all include azure_trigger
CLI:
- Add azure to TRIGGER_TYPES, pushObj dispatch, getTypeStrFromPath,
trigger commands (get/update/create/list/template), sync delete
switch + regex; e2e test for `trigger new --kind azure`
- system_prompts: SCHEMA_MAPPINGS + schema_names include AzureTrigger;
auto-generated/* regenerated
Skill:
- .claude/skills/adding-a-trigger/ checklist covering every file that
needs editing when wiring a new trigger type (learned from this PR)
ee-repo-ref bumped to b0e490cbf3724b7b64c6a5b010e3bdf24acd873c.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(azure-trigger): ci — ShareModal Kind + regenerated system_prompts
- frontend/src/lib/components/ShareModal.svelte: add 'azure_trigger'
to the Kind type so the listing page's "Permissions" action compiles
(ts2345 — caught by npm_check on CI, missed by fast-check locally).
- system_prompts/auto-generated/: regenerate to drop the stale
delivery_config / AzureDeliveryConfig fields from the Azure schema
(check-freshness on CI).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* refactor(azure-trigger): use workspace constant_time_eq crate
Drop hand-rolled constant-time compare in favour of the workspace
constant_time_eq crate (same one used by http_trigger_auth).
ee-repo-ref bumped to 9659382d47286e7f7f66d01b6f5dd8d4ed34848b.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(azure-trigger): pass placeholder + disabled via inputProps
`TextInput`'s `placeholder` and `disabled` go through its `inputProps`
prop — CI's `npm run check` caught the stale top-level passing that
`npm run check:fast` missed. Align with the DefaultEmailConfigSection
pattern.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(azure-trigger): correct LATEST_GIT_SYNC_SCRIPT_PATH version to 28213
The hub deploy of the azure-aware sync-script is version 28213, not
28214. Backend was pinning a non-existent hub script, which broke the
git_sync_e2e suite (every deploy's sync step 404'd).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(azure-trigger): add azure_triggers to token scope selector + skill
- windmill-api/src/token.rs: `build_trigger_scope_domains` was missing
`("azure_triggers", "Azure Event Grid")`, so the CreateToken UI's scope
selector didn't surface azure_triggers:read/write. Backend already had
`ScopeDomain::AzureTriggers` wired (scopes.rs), this just exposes it.
- .claude/skills/adding-a-trigger/SKILL.md: capture both scope-related
files under the hardcoded-arrays section so future triggers don't miss
the UI surface.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* docs(adding-a-trigger-skill): clarify token.rs scope effect
Not a regression — nothing was working before. Skipping TRIGGER_DOMAINS
just means the scope works via API/CLI but has no UI checkbox.
* docs(adding-a-trigger-skill): trim token.rs bullet
* fix(azure-trigger): regen openapi-deref + swap textarea for TextInput
- Run build_openapi.sh to regenerate openapi-deref.{yaml,json} with the
12 azure_triggers paths + schemas. These files are served by the
runtime (include_str! in windmill-api/src/lib.rs) to external SDK
consumers; without this regen the new endpoints wouldn't be advertised.
- Replace the raw <textarea> for event type filters with the
design-system TextInput in textarea mode (frontend/CLAUDE.md bans raw
HTML elements).
Addresses cubic + claude PR review items.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
|
||
|
centdix
|
7fa924e67e |
fix: correct flow conversation pagination (#8919)
* fix: remove conversation after_id filter * fix: implement message after_id cursor * fix: use persisted cursor for chat polling Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * refactor: simplify message cursor ordering Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * refactor: use cte for message cursor Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * Update SQLx metadata * fix: use monotonic flow message cursor * Update SQLx metadata * fix: tighten flow message cursor pagination Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * Update SQLx metadata --------- Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com> |
||
|
centdix
|
132d8a61f9 |
fix: slim app ai chat context (#8922)
* fix: slim app ai chat context Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: remove stale app chat selection UI Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * refactor: trim app chat selected context Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * test: trim app chat context coverage Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * test: remove app tool assertion Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> |
||
|
centdix
|
07951e81ae |
fix: include endpoint descriptions in mcp tools (#8925)
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> |
||
|
Ruben Fiszel
|
dac29e7d23 |
fix: load job metadata on approval page via approval token (#8924)
* fix: load job metadata on approval page via approval token The approval page polled getJob without auth, which 400s for non-anonymous jobs. The page swallowed the error so approvers saw the form but no flow args, metadata, or graph. Accept the existing approval token on getJob and skip the non-anon-user check when it validates against the job's flow. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(approval): address review feedback - Validate approval token against URL job id directly before resolving the parent flow, saving a DB roundtrip on the happy path (approval URLs always carry the flow id). - Request getJob with no_code/no_logs from the approval page so a token-bearer only sees what the UI renders (args, raw_flow, metadata). - Tighten OpenAPI description for the approval_token query param. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
centdix
|
9a60ff2e77 |
feat: add ai agent conversation output control (#8915)
* feat: add ai agent chat output flag Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: suppress ai agent tool chat messages Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * refactor: rename ai agent conversation output flag Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * feat: expose ai agent conversation output toggle Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: gate ai agent chat tab by chat mode Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * chore: regenerate system prompts Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: address ai agent chat review feedback Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> |
||
|
Ruben Fiszel
|
6abe33109a |
chore(main): release 1.689.0 (#8894)
* chore(main): release 1.689.0 * Apply automatic changes --------- Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com> |
||
|
Guilhem
|
131dd0682f |
restore bottom padding on script run page (#8916)
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
Guilhem
|
932d183311 |
fix: persist flow groups from AI chat tool calls (#8906)
* fix: persist flow groups from AI chat tool calls Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix: validate group ids and coerce empty groups to undefined Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
centdix
|
aea74445a3 |
fix: add flow conversation token scope (#8903)
* fix: add flow conversation token scope Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * refactor: make flow conversations scope plural Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: update flow chat service import Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> |
||
|
centdix
|
1e83278fe2 |
fix: skip opus 4.7 sampling params (#8904)
* fix: skip opus 4.7 sampling params Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: keep opus 4.7 handling frontend side Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: generalize opus 4.7 model matching Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: stop normalizing opus 4.7 thinking Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> |
||
|
Ruben Fiszel
|
05baa4ab02 |
feat: allow hiding catalog picker and raw input on s3 form fields (#8902)
* feat: allow hiding catalog picker and raw input on s3 form fields Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * refactor: type itemsType.resourceType instead of casting to any Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
hugocasa
|
53badf1a8c |
fix: track dollar-quoted strings in SQL block splitter (#8891)
* fix: track dollar-quoted strings in SQL block splitter Queries like `CREATE FUNCTION ... AS $$ ... ; ... $$ LANGUAGE plpgsql;` were being shredded on every `;` inside the function body because the SQL splitter's state machine didn't recognize PostgreSQL dollar-quoted strings. Add an `InDollarQuote(tag)` state so `$$ ... $$` and `$tag$ ... $tag$` regions are treated as a single quoted span. Opt-in via a new `track_dollar_quotes` flag on `parse_sql_blocks`; enabled for PostgreSQL and DuckDB, disabled for MySQL/Oracle/BigQuery/ Snowflake which don't support the syntax. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix: make windmill-parser-wasm a self-contained workspace The wasm parser crate is excluded from the backend workspace (its nightly-only `cargo-features = ["panic-immediate-abort"]` would break stable cargo on the whole workspace), but its manifest still used `.workspace = true` inheritance — which fails with "failed to find a workspace root" once the parent no longer considers it a member. Declare the crate as its own workspace by adding `[workspace]`, `[workspace.package]`, and `[workspace.dependencies]` tables. Mirror the relevant entries from the parent `backend/Cargo.toml` (same version specs, same path targets) so resolution stays byte-identical to what the parent would have produced. Also: - Teach `.github/change-versions.sh` (+ mac variant) to update this crate's own `Cargo.toml` version and bulk-bump the `windmill-*` entries in its `Cargo.lock` on each release. - Bump the frontend's pinned `windmill-parser-wasm-regex` to 1.688.0 to match the freshly-built package, and refresh `package-lock.json`. - Regenerate the wasm crate's `Cargo.lock` from scratch (first build under the new workspace re-resolves the full graph; target-gated deps from sibling crates like `windmill-parser-py-imports` are now recorded in the lockfile but not compiled when targeting wasm32). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
Ruben Fiszel
|
18b1bf8f58 |
chore(main): release 1.688.0 (#8881)
* chore(main): release 1.688.0 * Apply automatic changes --------- Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com> |
||
|
Ruben Fiszel
|
10d1a932d5 |
fix: batch cancel dropping jobs from other workspaces (#8887)
* fix: batch cancel silently dropping jobs from other workspaces Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix: gate cross-workspace batch cancel on all_workspaces flag Enforce path workspace unless all_workspaces=true, so cross-workspace selections only succeed when the UI is actually in all-workspaces mode. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * sqlx * fix: gate cancel_selection all_workspaces on admins workspace Matches the convention used by count_queue_jobs and count_completed_jobs_detail in the same file — cross-workspace scope is only honored when the path workspace is "admins", preventing clients in regular workspaces from dropping workspace scoping by passing all_workspaces=true. Co-authored-by: Ruben Fiszel <rubenfiszel@users.noreply.github.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: Ruben Fiszel <rubenfiszel@users.noreply.github.com> |
||
|
Ruben Fiszel
|
7dde9824b0 |
toast and tag key mismatch in autoscaling test button (#8886)
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
 Avasis AI
|
88469e0be4 |
handle empty parallelism value to prevent null error (#8878)
Clearing the parallelism input field now sets parallelism to undefined instead of creating an object with an empty value, preventing the 'parallelism value is null' error on execution. Closes #7864 Assisted-by: GLM 5.1 Co-authored-by: Abhay <abhayjnayakpro@gmail.com> |
||
|
centdix
|
a5363ea4ed |
refactor: unify flow chat tree operations (#8862)
* refactor: make flow chat code edits explicit * refactor: centralize flow tree lookups Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * refactor: simplify flow chat tree mutations Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * refactor: reuse flow tree lookup in schema map Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * refactor: remove flow lookup alias Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * refactor: reuse flow tree in previous results Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * refactor: reuse canonical flow module lookup * fix: align rebased flow helpers Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * docs: remove flow chat cleanup plan Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * refactor: remove flow chat helper wrappers Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: preserve non-flowmodule AI agent tools in skeleton and previous_result Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * refactor: consolidate flow module ID collectors into flowTree Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: search full flow tree in test_run_step to find special modules Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: recurse into aiagent tools in collectAllFlowModuleIds Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> |
||
|
centdix
|
f35e10cc0a |
feat: add homepage connect drawer (#8880)
* feat: add homepage connect drawer Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: reset connect drawer state Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: polish home connect button Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: use standard home connect button style Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> |
||
|
centdix
|
46b2915a9d |
feat: improve app evals and localized app edits (#8863)
* chore: record app benchmark baseline Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * feat: strengthen app benchmark persistence checks Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * feat: seed inventory tracker benchmark case Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * feat: add deterministic app diagnostics Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * feat: add app chat patch_file tool Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * test: add app session id micro-edit case Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: narrow app patch file content Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: stop gating app evals on lint Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> |
||
|
Ruben Fiszel
|
e063db68c9 |
chore(main): release 1.687.0 (#8871)
* chore(main): release 1.687.0 * Apply automatic changes --------- Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com> |
||
|
Ruben Fiszel
|
0cfa131254 |
feat: add disable_password_login global setting (#8873)
Adds an instance-level toggle that hides the email/password form on the login page and rejects password login, password reset request, and password reset endpoints server-side. Useful for OAuth/SAML-only deployments. - New `disable_password_login` global setting + lazy_static AtomicBool - `load_disable_password_login` loader wired into monitor initial_load and notify_global_setting_change listener - Unauthenticated `GET /auth/is_password_login_disabled` endpoint so the login page can hide the password form when enabled - Toggle in Instance Settings → Auth/OAuth/SAML - Login.svelte hides the password form and the "Log in without third-party" toggle when the setting is on Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
Ruben Fiszel
|
1d2d12a27d |
fix: default null script/flow schema to empty in bg runnable (#8872)
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
hugocasa
|
4f998cc231 |
feat: add GitHub as a native trigger service (#8856)
* feat: add GitHub as a native trigger service Add GitHub webhooks as a native trigger, allowing users to trigger scripts/flows from repository events (push, PR, issues, etc.) via OAuth-based webhook management. Backend: - DB migration adding 'github' to native_trigger_service, TRIGGER_KIND, and job_trigger_kind enums - Full External trait implementation: create/update/delete/get webhooks, per-trigger sync verification, webhook payload preparation - Paginated repos endpoint (up to 1000 repos) - OAuth flow with admin:repo_hook and read:user scopes Frontend: - GitHub trigger form with repo picker and MultiSelect event selector - Workspace integration settings with setup instructions - Trigger badge, editor, and wrapper integration - GithubIcon updated to support size/class props (matching other icons) - Hub template reference for starter scripts Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: show GitHub in sidebar when triggers exist Add github_used to the getUsedTriggers endpoint so the sidebar picks up GitHub as an active trigger kind. Also document this step in the native- trigger skill so future services don't miss it. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: on-demand GitHub repo search instead of bulk fetch Replace the upfront pagination through all repos with a debounced search flow: load 30 most-recently-updated repos by default, then query GitHub's /search/repositories API (scoped to the authenticated user via user:@me and restricted to name matches via in:name) as the user types. Frontend uses runed's Debounced + resource to wire the Select's filterText to the backend query with 300ms debouncing. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: request `repo` OAuth scope to list private GitHub repos `admin:repo_hook` grants webhook management but not repo listing — so /user/repos and /search/repositories returned only public repos. Switch to `repo` (full repo scope, which is a superset and also covers webhook management). Users who already connected GitHub need to disconnect and reconnect to pick up the broader scope. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * revert: fetch all GitHub repos upfront instead of searching on demand Revert the debounced search flow — paginate through /user/repos (up to 1000) on form open. Simpler UX: repos are all there from the start, the Select's built-in client-side filter handles finding one. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: typed 404 detection + add GitHub flow template reference Replace fragile e.to_string().contains("404") matching with a proper http_error_status helper that downcasts through anyhow to the typed HttpRequestError and reads the StatusCode. Also wire the hub flow template (id 80) into NATIVE_TRIGGER_SERVICES. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: update GitHub script template hub ID to 28202 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: align GitHub trigger with Nextcloud/Google patterns Addresses review feedback from Claude and cubic. Backend: - `delete()` now only swallows NotFound (DB missing row) and 404 (API webhook already deleted); non-404/DB errors propagate so callers know cleanup failed. Matches Nextcloud's delete pattern exactly. - `get_owner_repo_from_db` returns `Result<Option<(String, String)>>` instead of an error on missing row (matches Google's delete flow). Frontend: - `loading: boolean` (required) + `$bindable()` with no default — matches Nextcloud, satisfies CLAUDE.md banned-pattern rule. - Wrap `loadRepos()` in `$effect` reacting to `$workspaceStore` so repos load once the store is available and refresh on workspace switch. - Replace raw `fetch('/api/.../native_triggers/github/repos')` with the generated `NativeTriggerService.listGithubRepos(...)` typed client. Adds `/repos` route + `GithubRepoEntry` schema to openapi.yaml. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> |