* feat: WAC workflow diagram visualization in script editor
Add WASM-powered workflow diagram for WAC scripts in the script editor,
inspired by Cloudflare's workflow diagrams approach. Parses WAC code
client-side via WASM and renders an interactive DAG using @xyflow/svelte.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: show WAC diagram on script detail page
Show the workflow diagram below the run form on the script detail page
for WAC scripts, matching how flows display their graph.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: handle try/catch and while loops in WAC diagram
Instead of rejecting these patterns with validation errors, render them
as graph nodes:
- try/catch → Branch node with "try"/"catch" edge labels
- while loops → LoopStart/LoopEnd with condition as iter_source
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: remove dead code from WAC parser and add pkg-wac to publish script
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: use published windmill-parser-wasm-wac@1.668.5
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: handle undefined language prop in WacDiagram usage
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: resolve windmill-parser-wasm-wac from npm registry in lockfile
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: create actual merge nodes for branch/try-catch convergence points
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* perf: enable S3 bundle cache for PHP previews without lock file
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: resolve borrow-after-move of lock in php cache save
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* refactor: use DB-based lockfile cache for PHP previews instead of requirements-only key
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: prevent stale lockfile TTL refresh in PHP preview cache
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* chore: add sqlx offline cache entry for PHP lockfile resolution query
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
fallback_service on a router with no explicit routes is invisible to
axum's nest() — requests never reach the nested fallback, resulting in
404s. route_service("/", service) registers an actual route so nest()
forwards correctly.
Also reverts layer back to route_layer for the ApiAuthed extractor
since there is now a real route to match against.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
DuckDB's information_schema.columns returns IS_NULLABLE as a boolean,
but the ColumnDef struct expects a string ('YES'/'NO'). This caused
deserialization to fail with "invalid type: boolean, expected a string"
when expanding WM_INTERNAL_DB markers (e.g. COUNT) for Ducklake tables.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: widen login rate limit defaults to reduce false positives
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: increase rate limits further for large-scale deployments
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: harden login rate limiting with CLOUD_HOSTED gating, memory eviction, and race fix
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: replace global DashMap with atomics and move extract_client_ip inside conditional
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(cli): phantom diffs, flow push safety, error messages, digest stability
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(cli): differentiate stale vs missing metadata warnings on script push
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(cli): job list --limit off-by-one, deps push double error
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(cli): flow get shows nested steps, lint works on specific directories
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat(cli): add lint --watch mode for continuous validation
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(cli): email trigger template missing local_part, trigger get shows all fields
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(cli): fix CI — flow push warns instead of failing, lint subdir detection
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(cli): app push crash, lint entry point, push --message, run arg validation, history timestamps
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(cli): update sqlx cache and fix second history query missing created_at
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore(cli): regenerate system prompts after new CLI options
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(cli): fix 13 CLI bugs — exit codes, sync tar fallback, variable encryption, JSON output, parent dirs
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(cli): address PR review — TarAsZip.folder(), retry timeout, stderr hint
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(cli): update resource-type list test to handle empty state message
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: add DB health diagnostic dashboard for superadmins
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Update SQLx metadata
* fix: improve db health query performance
Bound large_results scan to last N jobs (configurable via scan_limit
query param, default 10K) instead of full-table pg_column_size sort.
Replace N+1 datatable size queries with single batched pg_class lookup.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Update SQLx metadata
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* sqlx
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* feat(cli): add job, group, audit, token commands and schedule enable/disable
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore(cli): regenerate system prompts after new commands
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(cli): address PR review feedback
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore(cli): regenerate system prompts after review fixes
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* refactor(cli): extract shared formatTimestamp util and remove unused resolveWorkspace in token
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: replace label with div for filter value editor to fix focus stealing
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref.txt
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to 02c0d34e54e71c9293f9cefb56f68652cf0db8a5
This commit updates the EE repository reference after PR #497 was merged in windmill-ee-private.
Previous ee-repo-ref: 44d665af35ad23cd3549b1d094f5d6633237deb4
New ee-repo-ref: 02c0d34e54e71c9293f9cefb56f68652cf0db8a5
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* fix(cli): address 28 DX friction points across CLI commands
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* chore(cli): regenerate system prompts after help text updates
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(cli): address PR review feedback
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(cli): update removeType tests to match lenient behavior
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(cli): address CE/EE sync friction and improve JSON output
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(cli): revert instance config masking to avoid breaking push flow
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(cli): mask instance secrets by default with interactive prompt
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* chore(cli): regenerate system prompts
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(cli): use stderr for errors, optimize skipped-files scan, rename --auto to --auto-metadata
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat(cli): improve workspace fork lifecycle — delete-fork fallback, list-forks, --workspace override
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(cli): update fork merge instructions to reference all merge methods
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(cli): clarify skipped-files warning comment re DynFSElement traversal
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* [ee] fix: update ee-repo-ref to fix deprecated rand API in CI
Updates ee-repo-ref.txt to point to a commit that replaces deprecated
rand::thread_rng().gen() with rand::rng().random() in the MITM proxy
cert generation, fixing the check_ee_full CI failure.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to 9316adc693d7f1a668df661e000109bb48b93375
This commit updates the EE repository reference after PR #495 was merged in windmill-ee-private.
Previous ee-repo-ref: d311a3c6ecb50c086fb86b1f4fa3f9e62ff40df5
New ee-repo-ref: 9316adc693d7f1a668df661e000109bb48b93375
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* test: add x509-parser dev-dep for MITM proxy cert tests
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref.txt for ssl-verify-fix branch
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref.txt
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to a90b083660b372bf1da1c18769cbd50936ea8040
This commit updates the EE repository reference after PR #494 was merged in windmill-ee-private.
Previous ee-repo-ref: db665a09d5b9a485977d73c22908629e3dda6200
New ee-repo-ref: a90b083660b372bf1da1c18769cbd50936ea8040
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: add IAM RDS auth support for PostgreSQL worker resources
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* refactor: use Config builder for IAM RDS connections
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: address PR review feedback for IAM RDS auth
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore: update ee-repo-ref to ebea6ef1e5bfcfc3f0151da9687dac6c61bbfab6
This commit updates the EE repository reference after PR #493 was merged in windmill-ee-private.
Previous ee-repo-ref: 1228561a98c5195bb97a81d4a57ce2bb2ecfca79
New ee-repo-ref: ebea6ef1e5bfcfc3f0151da9687dac6c61bbfab6
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* fix(cli): preserve inline script files during flow generate-locks
Three bugs caused `wmill flow generate-locks` to destroy inline script
content and rename files:
1. YAML parser stripped unquoted `!inline` tags (treated as YAML tag,
not string prefix), leaving just the filename as script content.
Fix: register custom YAML tags for `!inline` and `!inline_fileset`.
2. Inline script files were renamed based on step summaries because
`extractInlineScriptsForFlows` was called with empty mapping `{}`.
Fix: call existing `extractCurrentMapping()` before replacement and
pass the mapping to preserve original filenames.
3. Lock file paths were derived from the assigner instead of the mapped
content path, causing inconsistent naming.
Fix: derive lock base path from mapped content path when available.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* test(cli): add unit tests for !inline YAML tag and mapping preservation
- YAML tag tests: unquoted/quoted !inline parsing, !inline_fileset,
nested structures, round-trip stability
- Mapping tests: path preservation with mapping, fallthrough without
mapping, lock path derivation from mapped content path, mixed
mapped/unmapped modules, dotted path handling
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(cli): correct yaml parse type cast and inline prefix check
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(cli): harden lock path for extensionless files and merge customTags
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* improve logging for github app operations
* ee ref
* chore: update ee-repo-ref to 0b9e92f9e089293c6d523b77ed2c11edbc7a99c0
This commit updates the EE repository reference after PR #489 was merged in windmill-ee-private.
Previous ee-repo-ref: b259642e7f36b83a991034d5b28ae616f94ee5fc
New ee-repo-ref: 0b9e92f9e089293c6d523b77ed2c11edbc7a99c0
Automated by sync-ee-ref workflow.
---------
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* test: add OTEL coverage tests
Add 38 unit tests covering OpenTelemetry infrastructure:
- OtelSettings serde (empty, partial, full, roundtrip, skip_serializing)
- OtelTracingProxySettings serde (defaults, languages, dedup, rejection)
- ScriptLang rename cases
- LogCounter initialization and CountingLayer event counting
- Targets filter suppression of windmill:job_log
- get_otel_context_envs traceparent format verification
- Worker OtelTracingProxySettings (HashSet variant)
Companion EE PR adds tests for span_cx_from_job_id, metric functions,
proto conversion, SpanBuilder, and tracing proxy handler.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* test: add E2E OTEL tests with in-memory exporters
Add integration tests that verify metrics and spans flow correctly
through the OpenTelemetry pipeline using in-memory exporters:
Metrics (1 comprehensive test):
- All 20 metric names registered correctly
- Counter values (push/delete/pull/zombie/execution/failed/started)
- Gauge values with attributes (queue count by tag, worker busy, db pool, health)
- Histogram values (execution duration, pull duration)
- Health status phase encoding (healthy=1, degraded=0, unhealthy=0)
Spans (6 tests):
- Root job span created with "full_job" name and Ok status
- Error status with "Job failed" description on failure
- trace_id derived from job UUID
- span_id derived from job UUID low bits
- Child jobs (with parent_job) produce no span
- Attribute values (job_id, workspace_id, script_path) match job data
Also:
- Add testing feature to opentelemetry_sdk for InMemoryMetricExporter
- Update otel_oss.rs for SdkTracer type rename in 0.30
- Add opentelemetry/opentelemetry_sdk to dev-dependencies
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* refactor: remove unit tests in favor of E2E OTEL tests
The E2E integration tests in backend/tests/otel.rs cover the same
ground more thoroughly with in-memory exporters.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* [ee] fix: update ee-repo-ref for dedicated worker job_dir fix
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* [ee] fix: update ee-repo-ref
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to 5e8b1bcfc2c9ade9db39c839f2faed4f82da5efc
This commit updates the EE repository reference after PR #490 was merged in windmill-ee-private.
Previous ee-repo-ref: d958cd3b8a9a17b5f3cb6cb411c8ebba0c380fdd
New ee-repo-ref: 5e8b1bcfc2c9ade9db39c839f2faed4f82da5efc
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Ruben Fiszelandrubenfiszel
centdixandClaude Opus 4.5
Diego ImbertandClaude Opus 4.6
Pyra
