* feat: mount session list pages in process instead of iframes
* fix: seed filter defaults from the query, not the cached search params
* fix: type trigger list rows from the generated trigger types
* fix: judge hosted lists by the operating workspace's rules and keep role-gated filters
* fix: keep the user folders filter key for every role, hidden where it does not apply
* fix: drop the user folders filter for users it is not offered to
* fix: wait for a known user before dropping the user folders filter
* style: tint trigger rows for every kind and align the schedules footer wording
* fix: stamp edited_at when a schedule is updated
---------
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
The band is a single element whose placement is styled rather than branched: a page
registering a side-panel inset used to swap it between two `{#if}` arms, destroying the
header and rebuilding it a frame later — a blink of no header with the content sliding
up into the gap.
The workspace and its fork become one breadcrumb part: the name leads home (inert in a
session, where the workspace is the session's scope rather than a place to go) and one
chevron opens the picker, which already expands a family to reach its forks. The
picker's panel hangs from the part's left edge, opens with the active family expanded,
and closes before the switch runs — the switch renames the workspace, which moves the
trigger the panel hangs from, and floating-ui was chasing it across the viewport.
The item's path is a plain label rather than a row of pickers: same separators and
weight, and a click copies it with its own confirmation. The kind icon goes, the page
below says what kind it is.
Around them: a "prod" badge for a root workspace, the session's acting fork beside the
session's name rather than in the breadcrumb, the edit-in-dev affordance as a button in
the header, the drafts count as a sentence, and a fade when the workspace changes under
a page that stays mounted.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat: add cosmetic dev/staging label for dev workspaces
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat: prefill dev fork name and use a link to switch its label
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* style: reword the dev/staging label link copy
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* style: preview the dev/staging label as a badge in the switch link
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat: show the dev/staging badge in the session diff drawer header
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat: add dev workspaces paired with a lockable prod workspace
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* fix: gate dev-workspace prod-lock on admin and prevent attach cycles
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* feat: redirect locked-prod edits into the dev workspace
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* fix: make dev-workspace settings tab available on CE (was EE-gated)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* feat: lock prod against forking too and funnel edits to the dev workspace
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* feat: open dev item page on edit and tailor dev-workspace lock messages
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* feat: prevent nested dev workspaces and hide dev option when one exists
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* chore: drop the redundant already-has-dev hint on the fork form
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* feat: badge dev workspaces and sort them ahead of forks in the tree/switcher
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* feat: label dev workspaces as 'Dev workspace of X' instead of 'Fork of X'
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* feat: label edit as 'Edit in <dev>', cover editor headers, auto-expand dev in tree
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* feat: split prod lock into separate block-deploy and prevent-forking toggles
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* feat: make resources/variables workspace-specific from compare page
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* feat: steer AI-chat sessions to the dev workspace
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* feat: refine session fork options and lock guidance for dev/prod
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* fix: session picker reads prod's real rules, default to current ws
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* feat: copy members into forks and clarify dev-workspace root labeling
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* style: place the workspace id field under the fork name
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* fix: address dev-workspace review findings and harden fork detection
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* chore: regenerate sqlx offline cache
Restores entries dropped during the origin/main merge and adds the
dev-workspace queries (is_dev_workspace, ws_specific, has_parent).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* fix: address second-round dev-workspace review findings
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* fix: address Pi and Codex review findings on dev-workspace endpoints
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* fix: gate locked-dev git-branch fork on admin and validate ws_specific path
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* fix: clear prod dev-lock when deleting an attached dev workspace
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* refactor: consolidate dev-workspace migration and scope all-group join to attach
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* fix: restore dev-workspace CHECK into consolidated migration and scope all-group join
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* refactor: drop copy_members from the dev-workspace attach path
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* fix: dev-workspace lifecycle/auth fixes from Codex review round
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* feat: explicit create-in-other for workspace-specific items
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* fix: make create-in-other strictly create-only (never overwrite target)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* fix: return 403 (not 401) for dev-workspace permission denials
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* feat: allow attaching a same-family fork as a dev workspace
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* style: emphasize the go-to-dev action in the no-direct-deploy alert
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* fix: seed a resource's linked variables when creating it in the other workspace
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* fix: judge workspace deploy/fork locks against the user's identity in that workspace
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* style: clarify create-in help text in workspace-specific panel
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* fix: admin-gate dev-workspace creation and harden lock/seed edges
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* fix: preserve a staged fork's source on picker create-mode re-entry
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* fix: clear dev flag on archive and check dev existence server-side
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* fix: make create-in-other atomically create-only via direct create
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* fix: create-only resource insert, ws-specific list scopes, archive lock guard
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* fix: reserve the dev_workspace_lock protection-rule name from the public API
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* docs: reattach create_protection_rule doc comment to its function
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* refactor: make dev-archive pairing teardown atomic with the archive
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* fix: follow deploy_to on root rename; show dev pairing to non-member prod admins
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* fix: copy creator metadata on fork; invalidate fork routing cache on rename
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* fix: accept g/ paths in set_ws_specific; gate copy_members to dev workspaces
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* Add frontend for the workspace proctection rules
* api to add and update workspace protection rules
* Fix bypasser selection
* Fix Select bug on refocus
* Change rulesets to use bitflags
* Messages for protection rules errors
* claude remove ui for rules
* Hide edit buttons when rule
* No edit refactor pt1
* Update edit buttons to be disabled when rule is active
* Merge deploy ui and rulsets in one tab
* Remove not cleaned line in migration
* multiple fixes
* Remove old protection rule logic
* Add prrotection rule for deploying through Merge UI
* Add Alert on legacy Deploy UI
* Add backend enforcing of workspace rules
* Finish backend blocking on rulsets
* Last changes to api ruleset blocks
* Prepare sqlx
* Remove unused import and argument
* Update SQLx metadata
* fix npm run check
* Re trigger CI
---------
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Guilhem Lemouel
Diego ImbertandRuben Fiszel
hugocasaandClaude Opus 4.8
wendrul
