The JSON editors parse a flushed buffer in an effect, so the check reads
the registry after a tick, as RunForm and the page drawer already do. The
message says the editor is in the preview.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
That text never reaches the draft, and the move closes the editor holding
it. The move now refuses before closing anything, as opening a session
from a page drawer already does.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
- The chat manager refuses sends, retries and message edits while a move
runs, from its first step, handing the text back. The composer was
locked but a retry or an edit could still start a turn in the parent.
- A move into an existing fork checks again for a running turn after
saving that fork's pending edits.
- repoint_unresolvable_draft_identities documents that it authorizes
nothing and when its unscoped form may be used.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Closing an editor drops an edit it has not yet handed to its draft save,
so a keystroke typed just before the move could be lost. The editors are
now flushed while still mounted, and closed right after with no await in
between.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* refactor: harmonize flow and script settings layout
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep the priority input open while it is edited
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep settings rows open while edited and name the deploying user for non-admins
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: write a setting before its row opens and show its real state while edited
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: slide settings rows open to their full height
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: remount a settings row's fields when its toggle turns it on
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: put the AI prompt behind a settings toggle
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: summarize active runtime and permission settings on the metadata tab
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: move the active settings chips into the settings header
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: bring back the active setting icons on the settings tabs
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* feat: show the draft badge on Home's favorite and recent cards
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: show the draft badge on Home's agent cards
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: remove the home and AI sessions composer view transition
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* docs: drop view transition rationale from composer comments
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: add ai review to deployment requests
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: bound ai review fetches and surface unreadable items
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: add fix in ai session and model picker to deployment ai review
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: add workspace instructions for deployment ai review
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: read review instructions from the parent and bind ai review to the fork
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: pin the fix-all session preview to the fork's compare page
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: drop workspace-settings instructions from deployment ai review
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: review the selected items with ai on compare and deploy
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: mark an ai review out of date when its items change
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: post all ai review findings as comments at once
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 77703cf32e58964906d87ee83ddda44b5b8d1b7e
This commit updates the EE repository reference after PR #926 was merged in windmill-ee-private.
Previous ee-repo-ref: e30ab9e69d1854fcaed5620c934ace32acb0a729
New ee-repo-ref: 77703cf32e58964906d87ee83ddda44b5b8d1b7e
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: configurable public base url for the MCP gateway
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep mcpTokenUrlDisabled's doc comment on its function
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: build MCP OAuth urls from the api base url, narrowable per surface
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: save and discard companion setting keys in the per-category settings flow
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: show the protection-rule bypass toggle inline
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: make the bypass toggle small and red
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
- Monaco's Editor registers in pendingEditorFlush next to SimpleEditor,
and the move drains that registry, so SimpleEditor buffers (step input
expressions, resource and variable JSON fields) also land before it.
The separate keystroke registry is gone.
- A flow, script or app editor tab closed for a move says it reopens
once the move ends, instead of showing the parent's viewer.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
They keep their edits as drafts like the other editors, so an edit during
the move could save one in the workspace being left. Their state lives in
the draft, so closing them loses nothing; they reopen in the fork.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat(ai-agent): built-in approval tool that parks the agent
An AI agent step can now be given a built-in "Request approval" tool. The model
calls `request_approval` with a message; the agent stores its conversation in
the new `ai_agent_checkpoint` table, releases its worker by parking its own
queue row like a workflow-as-code parent, and resumes with the answer (approved,
approver, comment) or a timeout once someone answers from the run page.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(ai-agent): tie approval answers to their request and hold the turn
- A turn that asks for approval runs none of its other calls; they are refused
so the model repeats them after the answer.
- The run page sends the request's call id. An answer naming another request is
ignored and the agent parks again for the time left; `suspend` is zeroed when
the answer is read, so answers sent while the agent runs are refused.
- The checkpoint is read whatever the current roster holds, the answer's
outcome is written by position, and a cancel that beats the park completes
the job as cancelled.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(ai-agent): say why calls beside an invalid approval request were refused
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(ai-agent): one approval form per request, none on a finished run
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(ai-agent): answer approval requests from a flow's chat
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(ai-agent): show chat approvals for agents that do not stream
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(ai-agent): approval as a per-tool setting, built-in tool asks a question
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(ai-agent): say when a nested agent leaves out tools that require approval
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(ai-agent): show chat approvals and questions on the tool's own card
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(ai-agent): question choices, and approval buttons shared with approval steps
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(ai-agent): show a waiting agent as suspended, and refused calls as not run
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(ai-agent): each added chat card shows its own call, answered marker keyed by job
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(ai-agent): approve and reject a held call through resume_suspended
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(ai-agent): require approval in a tool settings tab, plain descriptions on built-in tool panes
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(ai-agent): sentence case for the web search tool label
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(ai-agent): built-in tool drawers explain themselves in the header subtitle
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(ai-agent): clearer question tool subtitle
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(ai-agent): badge the tool settings tab like run settings
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore(ai-agent): regenerate system prompts and MCP session files
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Variable, resource and trigger editors save on click and write no draft,
so closing them during a move protected nothing and lost a half-filled
form when the move stopped. Only the editors that save drafts close, and
the pipeline tab names the move instead of Use mode.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
An edit in the session's preview during a move saves a draft in the
workspace being left, after the move listed what it brings, at any of
its awaits. The session now reads as read-only for the whole move, so
the preview shows its items without an editor until the move ends.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The move's fork gate checked only the workspace's forking rule. A role
missing a capability would get the default role in a fork it creates, so
the gate also refuses restricted roles, as the workspace picker does.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Creating the fork takes seconds, during which an edit in the session's
preview can save a draft in the parent that the move's list did not have.
The move now flushes and lists the drafts again before the transfer, and
reopens the dialog on the created fork when they changed.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: serve new MCP OAuth sign-ins the session toolset on /api/mcp/gateway
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep the mcp:session marker across every token scope edit
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: serve marked MCP sign-ins the session toolset on the per-workspace URL too
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: let a restricted caller re-save a token's mcp:session marker
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: preselect build and run when an MCP client requests every scope
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: advertise only granting MCP scopes in protected resource metadata
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: apply the blanket-request default on the consent page only
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: treat only an mcp:all request with both narrowings as blanket
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
A turn started while the move dialog was open owns the cross-tab hold the
move would take, and the move would release it while the turn still runs.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
- Move stays enabled while the dialog lists conflicts; confirming re-reads
them, so a draft discarded in the fork meanwhile no longer blocks it.
- A dialog left open while another tab moved the session closes instead of
moving from the old workspace.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
- replace_existing deletes only the fork drafts the transfer replaces, so a
draft discarded in the parent after the clone does not take the fork's
copy with it.
- Confirming a move lists the session's drafts again once no turn can
start, and sends the user back to the dialog if the list changed.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
- The tab doing a move disables its composer until the move ends, and the
move checks again for a running turn once a new fork exists.
- Saves still pending in editors open in an existing fork are flushed
before the transfer, so they surface as conflicts instead of landing on
the moved draft later.
- The transfer copies, conflict-checks and removes only the source rows it
locked and validated; a draft saved at a requested key after the lock is
left out.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: name the previewed item in an empty session's composer instead of greeting
* feat: name the item's kind in the empty session's composer placeholder
* fix: name the previewed item as its tab does, so view tabs get the summary
- A new fork now gets the same transfer as an existing one, with
replace_existing set only when this move created the fork, so a draft
saved after the clone reaches the fork and an existing fork's own drafts
still go through the conflict check.
- The transfer runs the operator composition check on each draft in the
target workspace, the same check as a direct save there.
- Editors already open on a moved item in the fork reload it from the
server.
- Other tabs on the session hold their composer during a move and adopt
the session's new workspace when it ends.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: add a home setting to hide empty folders
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep empty folders listed in a workspace holding nothing else
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep a folder created from home listed while empty folders are hidden
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: say which kinds keep a folder listed when hiding empty folders
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: hide the empty-folders toggle where it has no effect, honour it beside pipelines
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep empty folders listed when the item count request fails
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep the tree when only non-empty folders remain past the loaded window
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* refactor: hide empty folders inside the tree only, keep main's empty-state choice
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: stop starred items showing a starred removal in the editor diff
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: ignore starred in every value diff
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: authenticate Windmill AI to Anthropic with per-user Workload Identity Federation
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: reject WIF-only Anthropic resources in agent steps, scale token refresh margin
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: move Anthropic WIF to a separate anthropic_federated resource type
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: point agent steps at an anthropic resource instead of a federated one
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: report a federated resource missing a field instead of reading it as standard
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: count Anthropic federated token exchanges in feature_usage
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 747336910e5c7498544613ad7863cea59f4db6a1
This commit updates the EE repository reference after PR #923 was merged in windmill-ee-private.
Previous ee-repo-ref: 3ea70adff288448f7318ff20b41225fd726ca8d1
New ee-repo-ref: 747336910e5c7498544613ad7863cea59f4db6a1
Automated by sync-ee-ref workflow.
* feat: authenticate AI agent steps with anthropic_federated resources (#11999)
* feat: authenticate AI agent steps with anthropic_federated resources
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep get_id_token's signature for its EE callers
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 747336910e5c7498544613ad7863cea59f4db6a1
This commit updates the EE repository reference after PR #923 was merged in windmill-ee-private.
Previous ee-repo-ref: 3ea70adff288448f7318ff20b41225fd726ca8d1
New ee-repo-ref: 747336910e5c7498544613ad7863cea59f4db6a1
Automated by sync-ee-ref workflow.
* feat: switch between anthropic and anthropic_federated when adding a resource
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep registryCcCapable's doc comment on it
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
The change-versions job on the release PR failed to push after the branch
was deleted on merge, so v1.848.0 shipped with only version.txt bumped.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: run a workspace handler when a secret variable expires
Secret variables gain an optional `value_expires_at`, and a workspace can point
at a script or flow to run once that date passes, so a rotation is driven by the
platform instead of tracked out of band.
The secret never leaves the database. The sweep selects the path, description and
expiry and nothing else, so the handler is given a reference to rotate rather than
a value to handle. Job results are stored in cleartext and shown in Runs, which is
what makes that a boundary rather than a preference; a test asserts the job's args
never contain the value.
Each row is claimed by writing `expiration_dispatched_for` in the same transaction
as the push, so a failed push un-claims it and a lost race claims nothing. Moving
the date re-arms the row; re-saving the same date does not. A pass takes at most
100 rows under a transaction-scoped advisory lock, and orders so that one broken
workspace cannot starve the rest.
Dispatch runs as `g/variable_expiration_handler`, exempt from the CE group limit
and from non-premium exec metering the way the error and schedule handlers already
are. A handler that keeps failing backs off and raises a critical alert instead of
retrying every pass, and the back-off ends when the handler is repointed.
The expiry travels with the variable through workspace clone, tarball export and
workspace comparison. The dispatch marker deliberately does not, so a fork re-arms
on its own copy.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat(frontend): expose variable value expiration in the UI
The variable drawer takes an optional expiry on a secret value, and the variables
list badges it, turning red once the date has passed. A workspace settings tab
picks the handler, its extra args, and whether variables under `u/` are skipped.
That mute flag is stored inside the handler setting, so the toggle stays disabled
until a handler is picked: saving it on its own would clear the setting it lives
in and still report success.
The expiry is carried as a tri-state through the draft deploy and copilot paths —
absent leaves the remote value alone, an explicit null clears it — so deploying a
draft cannot silently drop a date someone set elsewhere.
The settings tab names the one case where the configured identity does not apply:
a handler script carrying `on_behalf_of` runs as that user rather than as
`g/variable_expiration_handler`, which matters because the same tab asks the admin
to grant that group write access to the variables it rotates.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat(cli): sync variable expiry and the workspace expiration handler
`wmill sync` carries `value_expires_at` on variables in both directions, and
pushes the workspace handler alongside the error and success handlers in the
grouped settings format. Dropping the key from a variable's yaml clears the
remote expiry, so the file stays canonical rather than accumulating fields that
can only ever be added.
The handler follows the same rule, with the caveat recorded where the type is
declared: an omitted handler only reaches the clear when some other setting
differs, because the push short-circuits on a comparison that walks the local
object's keys and so never sees a missing one. That gate is shared with the two
existing handlers and is left as it is here.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(frontend): open the variable expiration handler template in a new tab
The "Create a handler" button hands its script template to /scripts/add through
the URL hash, which `load` reads from `window.location`. A client-side navigation
leaves the previous page's hash in place, so the payload was dropped and the
editor opened on the default template at a `u/` path. `target="_blank"` forces a
full page load, matching the success handler's "Create from template" button.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(frontend): make the variable expiry field state its own status
The expiry field rendered a DateTimeInput whose time defaults to 12:00 when it
holds no value, so a variable with no expiry looked like one already configured,
and "cleared" looked identical to "never set". Setting an expiry is optional, so
the field has to say which it is.
Rebuild it on the shape ScriptAdvancedSettings already uses for Timeout, Cache and
Concurrency limits: a toggle whose checked state is the stored value being present,
seeding a date on enable rather than revealing an empty picker, with the input
under its own label. Drop `clearable` with it, so the toggle is the single way to
mean "no expiry" instead of competing with an X.
Stop the surrounding copy promising a run that may not happen. A handler is only
dispatched if the workspace has one configured and does not skip u/ paths, so the
list tooltip now states the date alone, and the form hedges both conditions,
naming the u/ mute only on personal paths where it can apply.
Also anchor the mute toggle's tooltip: Popover's trigger is a span around a
block-level label, which stretched to the full width of its SettingCard and left
the popup floating beside the card rather than under the control.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(rust-client): initialize value_expires_at in the variable models
The generated `CreateVariable` / `EditVariable` structs gain the field from
openapi.yaml, and client.rs builds both with exhaustive literals.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(frontend): drop extra_args when the variable expiration handler is cleared
Clearing the handler nulls the whole setting server-side, extra_args included,
but the tab kept its loaded copy. A handler picked afterwards without reloading
was persisted with the cleared one's arguments, which the tab does not display.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat: back the variable expiration handler's built-in Slack and Teams destinations
Backfills the Slack bot token grant for g/variable_expiration_handler, mirroring
20231016142659 for g/error_handler: the slack_bot folder's extra_perms is written
once at Slack connect and never refreshed, and disconnecting leaves the folder
behind, so workspaces that already connected Slack cannot pick the grant up from
the creation-time list alone.
Adds run_variable_expiration_test_job so an admin can exercise the handler on
demand rather than waiting for a real expiry, which may be months away. It goes
through push_variable_expiration_handler so the test run proves what matters:
the handler resolves, and the group can read what it needs, under the same
identity and argument shape the sweep uses.
Also covers extra_args on the edit endpoint, which the settings tab now writes
for the built-ins' channel. The endpoint rebuilds the setting from the request,
so an omitted extra_args erases it.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Do7wJTnL6MG6ngFpCGW4DG
* feat(frontend): offer Slack and Teams as variable expiration handlers
Gives the variable expiration tab the same no-code destinations the workspace
error handler has, so "tell #ops before this credential expires" no longer
requires writing a script.
A sibling component rather than a fourth mode of ErrorOrRecoveryHandler: that
one is shared with the workspace error handler and the three schedule handlers,
and its stripped-args list, hub path suffixes and Email tab are all
error-shaped. This reuses the pieces that are already generic
(SlackConnectionStatus, TeamsConnectionStatus, ChannelSelector, ScriptPicker,
SchemaForm) and leaves those five call sites untouched.
extra_args stops being an API/CLI-only escape hatch now that the built-ins write
their channel into it, so it joins the unsaved-changes comparison and the
discard path, normalised through the existing helper that drops the two
auto-managed keys.
The two hub ids are placeholders until the scripts are pushed to the hub.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Do7wJTnL6MG6ngFpCGW4DG
* fix(frontend): scope the handler identity notice to the chosen destination
The notice told every admin to grant g/variable_expiration_handler write access
to the variables it rotates. That is right for a custom handler and wrong for
the built-ins, which only post a message and are granted the Slack bot token by
migration. Following it for a Slack handler would hand a group write access to
the workspace's secrets for no reason.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Do7wJTnL6MG6ngFpCGW4DG
* feat(frontend): flag the Slack and Teams handlers as EE
Connecting a workspace to Slack or Teams is EE-only (oauth2_oss.rs returns
"Slack only available on enterprise"), so on CE those two tabs can never be
completed. Says so up front, the way the error/success handler tab does,
instead of leaving the user at a "not connected" badge with no working path.
Only on those two tabs: a custom script or flow handler is CE.
Drops the "Connect Slack first" alert, now that the banner and the connection
badge above it already say it twice.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Do7wJTnL6MG6ngFpCGW4DG
* chore(backend): regenerate the sqlx cache after the merge
The merged workspace_settings column list in change_workspace_id is a new
query text, so it needs a new cached entry. Drops the two pre-merge entries
it supersedes; both had been left with conflict markers by the merge, since
rename/rename markers are eight characters and escape the usual scan.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Do7wJTnL6MG6ngFpCGW4DG
* fix(cli): narrow the expiry-clear check to a variable that exists remotely
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Do7wJTnL6MG6ngFpCGW4DG
* feat(frontend): point the built-in handlers at their published hub scripts
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* chore(backend): regenerate the sqlx cache after the merge
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix(frontend): disable the Slack and Teams handler controls without a license
Matches the workspace error handler, which greys out its built-in destinations
and hides the test button on an unlicensed instance. The custom destination stays
editable: unlike the error handler, the variable expiration handler itself is not
an EE feature.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: record which destination a variable expiration handler uses
handler_configured now counts slack, teams, custom or cleared instead of
set or cleared, so usage shows whether the built-in destinations are picked.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(frontend): let the variable expiration handler template run on any worker
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: guard the variable expiration test endpoint and correct its help text
* fix: reuse the error handler's slack arg and built-in path helpers
* docs: trim variable expiration sweep and backfill comments
* feat: put the variable value expiration under an advanced section
* fix: restrict the expiration test job to built-ins and keep expiry on conflict reload
* fix: link the expiry hint to the variable's workspace and document built-in test paths
* fix: give the expiration sweep its own lock id and reuse double_option
* fix: pin the variable expiration presets so the hub-paths test accepts them
* feat: let the variable expiration handler set how far ahead it runs
* fix: give the notify before expiry setting its own card
* feat: remind the variable expiration handler at a set interval
* fix: tighten the gap between the Slack channel field and its test button
* feat: refuse a value expiry on variables linked to an OAuth account
* refactor: reuse the shared handler form for variable expiration
* refactor: sweep expiring variables round-robin and check the handler exists
* chore: trim comments to the constraints they record
* fix: compare expiry dates by moment when deploying a variable draft
* refactor: rename value_expires_at to value_valid_until
* fix: neutralize variable fields in expiration handler args
* fix: reserve the variable_expiration_handler group name for admins
* fix: send first expiry notices before reminders
* test: pin that a handler failing to start leaves its rows unclaimed
* chore: say any hub handler path skips the existence check
* fix: empty a pre-existing handler group before granting it the Slack token
* docs: correct the registered feature usage counts
* fix: let a workspace whose handler failed to start sit out for an hour
* fix: send first notices before reminders across workspaces
* fix: end a failed handler's wait as soon as it is redeployed
* fix: show an expiry-only variable change in the AI fork diff
* chore: regenerate workspace tool schemas
* test: keep one variable expiration guard per behavior
* fix: use the renamed hub expiration handlers and template
* feat: carry the variable expiry in windmill-utils-internal 1.8.4
* fix: keep the variable expiry through MCP drafts
* chore: bump windmill-utils-internal to 1.8.4
* fix: keep the variable expiry through mcp deploys
* fix: disable saving a slack or teams expiry handler without ee
* fix: skip the failure mark when the expiry handler was saved mid-sweep
* fix: count expiry telemetry only where the expiry changed
* test: assert the exact variable expiry in export and cli push tests
* fix: stamp an expiry handler failure with the pass's read time
* fix: wait for a pending handler lock instead of marking it failed
* test: isolate expiry handler tests from the deployed-script cache
* fix: retry a failing expiry handler every pass instead of waiting an hour
* chore: update ee-repo-ref to b6e23d229966cf0019c0a1926a254fda658d8def
This commit updates the EE repository reference after PR #744 was merged in windmill-ee-private.
Previous ee-repo-ref: c52c06d145b13a6fb04459e85ca5818bf3c1bff4
New ee-repo-ref: b6e23d229966cf0019c0a1926a254fda658d8def
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Co-authored-by: hugocasa <hugo@casademont.ch>
* fix: home's acting-on follows the workspace home switches to
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: say home's draft also follows its workspace on mount
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: home leaves a draft picked onto another workspace to the session page
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: home keeps its own draft across a workspace switch made on another page
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: home lets go of its draft once the session page takes it
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: fill docusign account_id and base_uri on connect
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: fill salesforce and quickbooks connect fields through connect_fields
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: note connect_fields source trust and pin sandbox inheritance
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 5517ff637a675aee66d4e417d3f37266045f0e0c
This commit updates the EE repository reference after PR #913 was merged in windmill-ee-private.
Previous ee-repo-ref: ba98803b236f018ed45199344f744ea1387afe2d
New ee-repo-ref: 5517ff637a675aee66d4e417d3f37266045f0e0c
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* fix: fork a raw app into the raw app builder, in its session when there
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep the source's sandbox and sdk scopes on a forked raw app
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: fork a raw app from the editor's content, not the server's copy
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: read-only ai sessions on protected workspaces with a use, plan and build picker
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: address local review findings on the use, plan and build picker
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: address CI review findings on use mode and protected sessions
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: hold test-run forms and pending protection lookups to use mode
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* refactor: fetch rules once per send and dedupe helpers and prompt text
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: send role-locked operators to an admin and cover it with an eval
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: count the work mode each session message runs in
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: regenerate the mcp session definitions after merging main
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: rename build to use & build and let the chat ask to switch modes
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: word a declined mode switch by the switch, not the mode
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to 55445977dd05c25791388070182c77f4dbc20c0e
This commit updates the EE repository reference after PR #915 was merged in windmill-ee-private.
Previous ee-repo-ref: 7f7bf7003e356346ce74395af02c5bdf14f38781
New ee-repo-ref: 55445977dd05c25791388070182c77f4dbc20c0e
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: open empty ai sessions with the home build-with-ai composer
* feat: vertically center the empty session composer
* fix: drop the stray indent on the session composer's rotating placeholder
* fix: give the starter composer a stable accessible name
* feat: pick workspace, fork and permission mode from the home composer
* fix: hand off the workspace home displays, not only an explicit pick
* feat: drop the starter prompt chips from the empty session
* feat: home and empty ai sessions share one session composer
* fix: keep session draft attachments across home and session page
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: drop superseded home ai-hidden responses
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: load home session starter lazily to keep monaco out of home
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: redesign home composer and items list
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: align the composer chat icon, share the folder row, add a home preview page
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* refactor: drop home tech debt, fix phone layout and keyboard access, remove the home preview page
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: suggest composer prompts from workspace signals
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: pass dev page placeholders through inputProps, key settled signals by role
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* perf: read filter chip positions before hiding any in clampRows
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: scope composer signal caches to the account, drop stale workspace answers
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to dd0c7087f9b2453260f3d73b0d589042b4393a1d
This commit updates the EE repository reference after PR #900 was merged in windmill-ee-private.
Previous ee-repo-ref: e922599943c472a6d0f736f629ae04081f866686
New ee-repo-ref: dd0c7087f9b2453260f3d73b0d589042b4393a1d
Automated by sync-ee-ref workflow.
* chore: update ee-repo-ref to dd0c7087f9b2453260f3d73b0d589042b4393a1d
This commit updates the EE repository reference after PR #900 was merged in windmill-ee-private.
Previous ee-repo-ref: e922599943c472a6d0f736f629ae04081f866686
New ee-repo-ref: dd0c7087f9b2453260f3d73b0d589042b4393a1d
Automated by sync-ee-ref workflow.
* feat: name workspace items and connections in composer pills
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: teach one Windmill concept per composer pill from the workspace
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: drop the failed-deploy pill, which reports a run outcome
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: read favorites from the workspace's own item list
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: regenerate mcp session guidance for the data table row
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: address cubic review of the composer signals and data table guidance
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* test: make the billing fixture's receipt step send what its summary says
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep loaded item kinds and drop stale loads in the composer playground
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: preview an instance admin who is a plain member in the composer playground
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: scope the enterprise note to external_instance and check receipt sends
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Diego Imbert <diego@windmill.dev>
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: let flow builder operators build AI agents
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: check linked agents' bound tools and type, validate on the write's transaction
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: bound the linked-agent walk by sorting bound tool ids
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: let builders bind only the agent tool inputs left to the model
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: check every agent tool sharing a bound id
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: show builders the agent's own tool inputs read-only and name agents in the setting
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: show the agent's own tool inputs with the read-only step viewer
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* style: give the agent-set inputs heading the input label style
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* style: label the agent's fixed tool inputs static inputs
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: address cubic review on agent builder rights
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: check agent writes against the role's flows capability
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: name the flows capability as the agent builder right
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: gate agent evals on the role's code capability
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: move the composed-flow check into windmill-api-auth
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: manage and create folders from the home tree view
* fix: drop empty folders under a kind filter, gate manage on visibility
* fix: show the tree in a folders-only workspace, record created folder
* fix: address review nits on the home folder menu
* fix: record created folder ownership, offer folder in empty-state menu
* fix: make the autoscaling Test scaling button run the integration
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: bump ee ref
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: bound the test scaling worker input at zero
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to a2a23aebcf91985778fb632a415a6990d022f7c8
This commit updates the EE repository reference after PR #917 was merged in windmill-ee-private.
Previous ee-repo-ref: c9e8c8853e2042a11797e322e1e4bb4be241380c
New ee-repo-ref: a2a23aebcf91985778fb632a415a6990d022f7c8
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Guilhem LemouelandClaude Opus 5.5
Ruben Fiszelandrubenfiszel
AlexRV12
hugocasaandClaude Opus 5.5
