* feat: add a navigation picker after the breadcrumb's last segment
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: open the navigation picker among the current page's siblings
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* style: size the navigation chevron like the workspace chevron
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* style: keep one-line picker lists at one-line row height
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: show the navigation chevron only once the item's path is known
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: highlight a draft in the navigation picker by its storage path
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: key the picker's current item on the header path outside editors
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: count navigation picker picks in feature_usage
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: shrink the page header in stages and let the bar fold page actions
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: fold the runs header through the bar and wrap its filter to a second row
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: truncate the run id and fold run actions into one menu on a narrow bar
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: keep an item's summary and drop its path on a narrow page header
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: show the full summary and path read-only when they cannot be edited
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: keep secondary detail actions in menus and the star beside the summary
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: show secondary detail actions as buttons while the bar has room for them
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to 346bd5417537b76591465e63b9d15bd081e9228c
This commit updates the EE repository reference after PR #868 was merged in windmill-ee-private.
Previous ee-repo-ref: 581b18cac39a4bee2671fd1aa86f91b9e702e8f5
New ee-repo-ref: 346bd5417537b76591465e63b9d15bd081e9228c
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* feat: operators get AI sessions
`prefersSessionHandoff` stops taking the role, so every AI entry point an operator
can reach — Ask AI, the home composer, Open in session, the flow editor's hand-off,
the raw-app template picker — opens a session for them like anyone else. The
sessions page drops its refusal, and the layout stops keeping them on the docked
chat.
In the sidebar they now get the Workspace/AI Sessions switch and session mode, and
lose the Ask AI entry that stood in for them, since the pane behind it is no longer
the one they are sent to.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat: operators get run-oriented examples in the home composer
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* docs: note builder_flows in the operator composer examples comment
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: gate session tools and editors on operator rights
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: keep operator AI sessions behind a browser opt-in
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep flows refused in the prompt for operators without builder rights
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* refactor: decide every frontend edit check through one editRights module
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: let admins who are also operators open session editors, as drafts.rs does
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat: let operators with manage rights save schedule and trigger drafts
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep rebase_draft from operators who can only draft schedules and triggers
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: list operators' schedule and trigger drafts under their draft rights
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* docs: say which drafts write_draft gates now that schedules and triggers have their own
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* oauth: add onedrive, sharepoint and microsoft_excel providers
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* oauth: rename microsoft_excel provider to excel, add msword icon
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* oauth: rename providers to msonedrive, mssharepoint, msexcel
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* oauth: use underscore slugs ms_onedrive, ms_sharepoint, ms_excel, ms_word
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: read and change workspace settings from ai sessions and mcp
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: cover wmill workspace settings commands in the settings guidance
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: say unknown settings keys are warned and ee-only ones refused
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: cover datatable_permissions and protection_rules in the settings guidance
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: add the workspace settings document, applied server-side
* feat: add wmill workspace get-settings and apply-settings
* fix: warn on unknown settings keys and refuse ee-only ones in the dry run
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: stub the settings document endpoint in the push settings unit tests
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: refuse mistyped settings and keep 4xx status on a partial settings apply
Reject non-boolean switches and non-string Slack credentials instead of
coercing them into destructive writes, preserve the failing endpoint's
status when wrapping a partial-apply error, keep the stored Slack secret
when an older CLI pushes one encrypted under another workspace's key,
print the plan's warnings in apply-settings, and state the admin check
load_settings_document leaves to its caller.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: compare handler arguments verbatim and type-check scalar settings
A handler's extra_args is stored as sent and its nulls reach the job as
arguments, so an added or removed null argument is now a change. Scalar
settings are type-checked in the plan so a dry run never reports a change
the endpoint then refuses, and an error handler's omitted mute flags
compare as the false the endpoint stores.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: require a 32-bit integer rate limit in the settings plan
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: data table permissions and protection rules in the settings document
The settings document gains datatable_permissions, each data table's roles
named by their Postgres role name and written by catalog id, and
protection_rules, keyed by rule name. Both are managed only when stated and
stated as a whole. The dev workspace lock stays with the dev workspace
setting.
wmill sync carries datatable_permissions only with includeDatatablePermissions
(or --include-datatable-permissions), since tenants and roles are specific to
a workspace and an instance. protection_rules stay out of settings.yaml:
protection-rules.yaml syncs them.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: validate the default data table role and plan permissions against a replaced datatable
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: let a legacy migration whose comment reads like a scope get a down
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: pin adding a down to a migration whose comment predates scopes
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: scope data table migrations to the schemas they declare
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep unschemed objects and unqualified sql out of per-schema scopes
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: order snapshot prerequisites and widen scopes to what they reference
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: point ee-repo-ref at the migration_scope allowlist entry
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: infer scopes only from generated ddl and snapshot every user object
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: snapshot every schema from one exported snapshot, infer only unedited sql
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: keep the initial snapshot whole-database and scopes author-declared
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: warn before an out-of-order run when applied status is unknown
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 57f4b973e2369f54a89817ff23dc44047ba7b9e4
This commit updates the EE repository reference after PR #880 was merged in windmill-ee-private.
Previous ee-repo-ref: abb876d6234d5dfe7c644fdf12cf55f7bc1db1cc
New ee-repo-ref: 57f4b973e2369f54a89817ff23dc44047ba7b9e4
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* fix: give data tables forked from one database a single shared copy
* fix: key shared-copy cleanup by server as well as database name
* fix: refuse dropping a shared resource-backed copy another clone still uses
* fix: keep applied migrations and db settings in data table copies
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: scope copied db settings per transaction and send timestamps as iso
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: copy migrations and settings only into a fresh import target
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* ci: install the latest pg_dump for backend integration tests
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* ci: enable pgdg so the latest pg_dump is installed
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: let a linked agent step override the model and reasoning effort
* fix: only honor model and effort overrides the step authored
* fix: treat an authored empty effort override as no effort
* fix: keep a static empty override from reading caller arguments or the saved effort
* fix: keep step tests and multi-agent chats from inventing an effort override
* fix: keep the saved model fallback when linked steps differ only on effort
* fix: show the agent override hint on the input's own help row
* fix: align the override hint spacing between static and expression inputs
* fix: keep the override rows a dropdown whatever the model is set to
* fix: give the override hint the 4px form gap and drop its trailing period
* fix: space the override hint with a margin so it is not clipped
* test: pin the saved model fallback when linked steps differ only on effort
* fix: keep the saved model fallback across agents that saved different efforts
* fix(worker): keep script env vars off the nsjail launcher process
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(worker): keep script env off the ruby gem-install nsjail launcher
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(worker): keep script env off the unjailed javac compile step
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(worker): gate script_overrides on the executors that use it
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: show a raw app's document.title in the page tab
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: drop unrelated formatting changes
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: restore the page title only while the tab shows the app's
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: connect a data table as the job's own identity unless the runnable opts into its viewer
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: key cached results by the data table mode and keep the flag across ai edits
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: hash the cache key's mode and viewer as fixed fields so no argument name can forge them
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 2f74548ad1ec50c8e1faf17e42d5648160e833f1
This commit updates the EE repository reference after PR #878 was merged in windmill-ee-private.
Previous ee-repo-ref: 4ad768a777fff9f1ecc86a2803bc27d80f8242d6
New ee-repo-ref: 2f74548ad1ec50c8e1faf17e42d5648160e833f1
Automated by sync-ee-ref workflow.
* feat: rename the flag to viewer_data_access and apply it to object storage permission rules
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: describe viewer_data_access as covering object storage rules too
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 0ffb633473c5465513576afc6f54d18f93c7f1e1
This commit updates the EE repository reference after PR #879 was merged in windmill-ee-private.
Previous ee-repo-ref: e9e06a9eb94168f46b378276b01fa0117dc7d8ed
New ee-repo-ref: 0ffb633473c5465513576afc6f54d18f93c7f1e1
Automated by sync-ee-ref workflow.
* feat: show the viewer data access control as an icon button
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* fix: encrypt ai session backups with aes-256-gcm
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* test: cover ai session backups written with aes-256-gcm
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: name the release ai session readers ship in
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: hold ai session gcm writes until old servers are rolled out
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* oauth: rename outlook provider to msoutlook
Microsoft 365 products are ms<product> (msteams, msoutlook). Renames the
oauth_connect.json key and the icon map key.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* oauth: use ms_outlook, not msoutlook
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: show the email handler's SMTP status to non-superadmin workspace admins
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep the SMTP status check out of the not-configured warning
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: widen variable.value only once every process can recover from it
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: wait out the previous release's servers before widening variable.value
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: write a v2 secret too long for the narrow column in cbc until it is widened
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: serve s3 proxy objects with nosniff and a sandbox csp
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* test: assert s3 proxy error responses carry nosniff and the sandbox csp
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to 196abc042c691ea16280ee10b89fb3b2fd527236
This commit updates the EE repository reference after PR #876 was merged in windmill-ee-private.
Previous ee-repo-ref: 25feaf41aa84d47f8e4adb4def2576b443a66374
New ee-repo-ref: 196abc042c691ea16280ee10b89fb3b2fd527236
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: pin the default python version of an instance at initialization
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: detect a new instance from the schema it created, not from its age
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: record the python baseline on the migration connection
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: record the instance python version in the setting itself
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: start new instances on python 3.15
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep the forced python version ahead of the stored one when a worker reads it late
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: start new instances on python 3.14 rather than 3.15
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: start new instances on python 3.13
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 06610ecc950ed64a2709d7f1aa8c7b49a95fdbae
This commit updates the EE repository reference after PR #869 was merged in windmill-ee-private.
Previous ee-repo-ref: 599eae0034b34c5e0d3d42df37cf18bbe01f9b49
New ee-repo-ref: 06610ecc950ed64a2709d7f1aa8c7b49a95fdbae
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* chore: pass --system-certs to uv instead of the deprecated --native-tls
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 06610ecc950ed64a2709d7f1aa8c7b49a95fdbae
This commit updates the EE repository reference after PR #869 was merged in windmill-ee-private.
Previous ee-repo-ref: 599eae0034b34c5e0d3d42df37cf18bbe01f9b49
New ee-repo-ref: 06610ecc950ed64a2709d7f1aa8c7b49a95fdbae
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* chore: update ee ref
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 118785eaa78675089b9a676d24e5d0a2e03f3d9a
This commit updates the EE repository reference after PR #875 was merged in windmill-ee-private.
Previous ee-repo-ref: e8df378c5f8e5e07af8a2bad4c685c8ad6fe1491
New ee-repo-ref: 118785eaa78675089b9a676d24e5d0a2e03f3d9a
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* fix(cli): count superadmins as able to preserve ownership on push
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011BzU9zd53JsTShCsbKzYzB
* fix: resolve variables in the url and headers of an mcp resource
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep resolved mcp secrets out of header warnings and userinfo urls
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: drop the url from mcp client errors before rmcp logs them
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: run rmcp's reqwest client without a log subscriber
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: scrub the request target from mcp error bodies
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: drop server error bodies from mcp transport errors
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: fail closed when an mcp error message has no status prefix
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* oauth: add outlook (Microsoft Graph) provider
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* oauth: outlook defaults cover mail, calendar and contacts
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* fix: bump git sync hub scripts to cli 1.830.0
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011BzU9zd53JsTShCsbKzYzB
* fix: surface oauth provider errors returned with http 200
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee repo ref
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: show the unavailable sign-in option in the oauth resource form
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: name the oauth grant in both authentication card descriptions
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 0a7c28718872bb5cd624d77e32ad7d75c6ce42de
This commit updates the EE repository reference after PR #874 was merged in windmill-ee-private.
Previous ee-repo-ref: 11425053010c3cd4670bc06f3606fa18cccc2091
New ee-repo-ref: 0a7c28718872bb5cd624d77e32ad7d75c6ce42de
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* oauth: add hubspot provider
Registry entry (authorize + token URL, body credentials, least-privilege
default scopes, labelled scope_options) and the admin OAuth tile.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* oauth: send hubspot non-default scopes as optional_scope
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: recheck app read access on every publisher-mode component run
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: pin that app read grants and revocations apply to the next run
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: cache only app permit grants, for 60s, instead of rechecking every run
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: data table migration tools and role guidance in ai sessions
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: shared data table guidance and safer migration tool failures
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep a migration that fails to apply and let the session rewrite it
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: rewrite only a pending migration and qualify fork isolation
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* chore: bump frontend python parser wasm packages to 1.830.0
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: bump cli python parser wasm packages to 1.830.0
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: connect to a data table with every role of the job's viewer
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: key a cached result by the run's recorded viewer
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: pin the per-viewer cache key and fix a stale doc sentence
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: length-prefix the viewer in the result cache key
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: drop data table role set logins unused for 30 days
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: pin the ee ref with the set login sweep fixes
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: pin the ee ref with the sweep retry fix
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: give the cache key test its own migrated database
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: add the viewer's roles to a data table connection that names none
The default role of a data table under roles is now a floor: a connection
naming no role also holds the roles its viewer is a tenant of, unless the
default is admin. This replaces the explicit as=viewer option, which is
removed from the reference parser, the executors and both clients. The roles
drawer warns while the default is admin and confirms before removing the
default role.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: let a data table have no default role
A connection naming no role then holds its viewer's roles only and is
refused without any. The roles drawer offers the choice, states what an
unnamed connection gets for the current settings, says who gets admin while
it is the default, and notes who owns a table created over several roles.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: start a data table's roles with admin open to everyone
Turning roles on from the drawer seeded admin with no tenant, which refused
every non-admin member's job as soon as it was saved. It now starts open to
everyone, so the toggle changes nothing until the roles are edited, and the
drawer warns for as long as everyone can connect as admin.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 40ab35596e6fcb82a4dfc56e186befb807f8e2af
This commit updates the EE repository reference after PR #873 was merged in windmill-ee-private.
Previous ee-repo-ref: a5def184a29fffab8ed42c70c5a7445b2b3cbe98
New ee-repo-ref: 40ab35596e6fcb82a4dfc56e186befb807f8e2af
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: encrypt workspace secrets with AES-256-GCM
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* docs: note the aead gate covers workers only and is one-way
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: skip secrets the upgrade cannot store and clear its guard on panic
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: start aead secret writes one release after read support
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to 06610ecc950ed64a2709d7f1aa8c7b49a95fdbae
This commit updates the EE repository reference after PR #869 was merged in windmill-ee-private.
Previous ee-repo-ref: 599eae0034b34c5e0d3d42df37cf18bbe01f9b49
New ee-repo-ref: 06610ecc950ed64a2709d7f1aa8c7b49a95fdbae
Automated by sync-ee-ref workflow.
* feat: widen variable.value to fit AES-GCM ciphertext of the longest legacy secret
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: refuse legacy secrets longer than 15000 chars so every secret can be upgraded
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: cap legacy secrets at 15000 chars with a check constraint so every writer is covered
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* fix(groups): recompute member roles when an instance group role is cleared
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: restore sqlx cache entry still used by the scim group delete
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: support array arguments in snowflake scripts
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: cast the parsed snowflake list to array in the guidance
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: parse a json array default of a sql list argument as a list
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: fill raw app ctx inputs on the server, not from the request
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: read declared ctx inputs from the deployed app at run time
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: count the revocation's cache invalidation apart from the deploy's
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: drop the deploy-time cache eviction trigger, rely on the cache ttl
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: sign OIDC tokens with an external signer and log every mint
* fix: init the signer in sqs_trigger builds and show signer reachability from results
* fix: key the OIDC key rows by source and kid
* chore: bump ee ref and list the oidc-signer subcommand only where it exists
* fix: advertise the actual signing algorithm in OIDC discovery
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: harden the external signer startup, agent workers and failed mints
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: bump ee ref for the stored key listing fix
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: list the oidc signing settings page only with an external signer
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to 1e538620a9b2f08b044997d032e71d8720ecbd5c
This commit updates the EE repository reference after PR #859 was merged in windmill-ee-private.
Previous ee-repo-ref: 84fa325737df98407c7b9f79c09d6e9378c46147
New ee-repo-ref: 1e538620a9b2f08b044997d032e71d8720ecbd5c
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: audit declarative instance config writes
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep early logs, base url and license plan for declarative writers
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor: require an observer on every config apply, drop license loading
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: export only audit events from the declarative subcommands
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: update ee-repo-ref to d6a6cdd343e7744ea49c610f9534c8013c8ffc2a
This commit updates the EE repository reference after PR #872 was merged in windmill-ee-private.
Previous ee-repo-ref: fc51c31bafb5975694fffe1da51f7b41fbf127a6
New ee-repo-ref: d6a6cdd343e7744ea49c610f9534c8013c8ffc2a
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* test: stop success handler tests sharing the deployed script cache
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore: drop the sqlx cache entry of the removed test query
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep ai agent schema property order stable across jobs
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep tool parameter order when filtering preset inputs
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Ruben Fiszelandrubenfiszel
hugocasaandClaude Opus 5.5
Alexander PetricandClaude Opus 5.5
AlexRV12andClaude Opus 5.5