hugocasaandClaude Opus 5.5 0b980546b1 feat: agents run on behalf of their deployer (#11430) ...

* Revert "docs: agent editor comments describe runs as the caller"

This reverts commit d94919c9fe.

* Revert "refactor: agents run as the caller, with a note on what a shared one needs"

This reverts commit 0748a2fb51.

* fix: a run as an identity continues only the caller's own conversation

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: an agent run as its identity takes only attachments its caller may read

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: the resource editor keeps an agent's identity on an admin's save

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* chore: regenerate workspace tool schemas for preserve_on_behalf_of

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: the rust client sets preserve_on_behalf_of on resource writes

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* feat: agents run on behalf of their identity only when they opt in

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: an agent holds an identity only while it runs on behalf of it

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* chore: reduce the agent identity migration to clearing untrusted keys

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: refuse decoded variable references in inputs to an agent run as its identity

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: user renames and offboarding re-point an agent's identity

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: refuse model-written tool arguments that the tool's job would interpolate

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* chore: agent on-behalf-of migration after main's

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: the agent identity migration also clears trashed agents

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-15 19:31:21 +02:00

..

fixtures

feat: add trigger, tag, run-as and digest claims to job OIDC tokens (#11481)

2026-10-02 19:02:17 +02:00

app_access_mode_unit.test.ts

fix: keep an app's deployed policy on wmill push (#11049)

2026-09-10 17:19:02 +02:00

app_dev_path_schema_fetch.test.ts

fix: populate wmill.d.ts schemas in wmill app dev (#8882)

2026-04-20 17:22:31 +00:00

app_dev_wmill_dts_unit.test.ts

fix(cli): preserve case in raw-app runnable filenames (#8940)

2026-04-27 04:02:39 +00:00

app_inline_script_delete.test.ts

fix: handle inline script deletion in sync push + flow new nonDottedPaths (#8553)

2026-03-27 11:54:45 +00:00

app_inline_script_ordering_unit.test.ts

fix(cli): stable auto-numbered inline-script names in app pull (#9071)

2026-05-07 13:26:32 +00:00

app_isolation_unit.test.ts

feat(cli): declare app sandbox and frontend api scopes in app yaml (#11703)

2026-10-12 17:28:38 +00:00

app_lint_viewer_identity_unit.test.ts

warn when a raw app sql viewer-identity input is not a ctx field (#11704)

2026-10-12 17:30:29 +00:00

app_policy_bundle_unit.test.ts

fix: derive a raw app's policy on deploy, and default an omitted execution_mode (#10733)

2026-08-18 01:52:10 +02:00

audit_token_commands.test.ts

feat(cli): add job, group, audit, token commands and schedule enable/disable (#8581)

2026-03-28 09:18:55 +00:00

base_url_workspace_resolution_unit.test.ts

fix(cli): say which workspace id is targeted, and when wmill.yaml is bypassed (#11006)

2026-09-07 16:18:39 +02:00

cargo_backend_example.standalone.ts

refactor(cli): migrate CLI from Deno to Bun/Node.js (#8041)

2026-02-21 21:19:04 +00:00

cargo_backend.ts

chore(cli): separate unit tests from integration tests and fix test cleanup (#8562)

2026-03-27 16:13:33 +00:00

case_insensitive_collisions_unit.test.ts

fix(cli): reconcile case-only path drift during sync on case-insensitive filesystems (WIN-2020) (#9485)

2026-06-09 08:09:04 +00:00

codebase_digest_unit.test.ts

feat(cli): include extra paths in codebase digest for monorepo imports (#11327)

2026-09-24 14:54:13 +02:00

conf_branch_override_unit.test.ts

feat: unify CLI config to workspaces, deprecate gitBranches/environments (#8767)

2026-04-09 19:46:34 +00:00

containerized_backend.ts

feat(cli): detect missing folders on sync push and add 'wmill folder add-missing' (#8011)

2026-02-24 08:38:17 +00:00

datatable_migrations_unit.test.ts

feat: sync data table migrations to git, gated by a new object type (#10436)

2026-07-31 23:33:47 +02:00

datatable_pg_wire_unit.test.ts

feat: CLI datatable serve / psql (#9267)

2026-05-20 16:56:50 +00:00

datatable_settings_sync.test.ts

feat: add datatable config support to CLI settings sync and backend export (#8024)

2026-03-14 04:44:11 +00:00

datatable_virtual_catalog_unit.test.ts

feat: CLI datatable serve / psql (#9267)

2026-05-20 16:56:50 +00:00

dbt_module_tracker_unit.test.ts

feat: run dbt projects as a first-class Windmill runtime (#10326)

2026-08-01 11:58:05 +00:00

dbt_optional_descriptor_unit.test.ts

fix: keep a local dbt descriptor under sync pull --keep-deleted (#10911)

2026-08-31 23:31:27 +02:00

dependency_tree_unit.test.ts

fix(cli): resolve lockgen imports through modules a push leaves alone (#11160)

2026-09-16 10:53:24 +02:00

deploy_labels_unit.test.ts

fix: carry labels when deploying variables, resources and folders (#11222)

2026-09-25 18:15:08 +02:00

deploy_on_behalf_of_unit.test.ts

feat: agents run on behalf of their deployer (#11430)

2026-10-15 19:31:21 +02:00

dev_recorder_bundle_unit.test.ts

feat: add session recording to wmill app dev (#10457)

2026-08-02 22:54:37 +02:00

dev_recorder_routes_unit.test.ts

feat: add session recording to wmill app dev (#10457)

2026-08-02 22:54:37 +02:00

dev_server.test.ts

fix(cli): include script modules in wmill dev previews (#11787)

2026-10-15 12:01:33 +00:00

duckdb_macros_unit.test.ts

fix(cli): macro-library parity in --local pipeline graph + read-only run --dry-run (#9942)

2026-07-06 01:36:42 +02:00

elements_to_map_branch_specific_unit.test.ts

feat: run dbt projects as a first-class Windmill runtime (#10326)

2026-08-01 11:58:05 +00:00

esbuild_loader_unit.test.ts

fix(cli): fall back to esbuild-wasm on native host/binary mismatch (#9629)

2026-06-17 02:33:18 +02:00

fileset_sync_unit.test.ts

fix(cli): sync push crashed on edited fileset children; reject non-canonical fileset dirs (#10572)

2026-08-11 13:16:45 +00:00

flow_notes_ordering_unit.test.ts

fix: preserve flow notes/groups and field ordering in generate-metadata (#8641) (#8642)

2026-03-31 13:48:22 +00:00

folder_default_permissioned_as.test.ts

fix: omit default_permissioned_as from tarball export when empty

2026-04-22 19:31:37 +00:00

folder_missing_meta.test.ts

fix(cli): correct misleading delete-fork command description (#9870)

2026-07-01 23:49:25 +02:00

folder_schedule_push.test.ts

refactor(cli): migrate CLI from Deno to Bun/Node.js (#8041)

2026-02-21 21:19:04 +00:00

fork_branch_id_unit.test.ts

feat(cli): improve agent prompts/skills and workspace fork workflow (#9531)

2026-06-12 00:16:16 +02:00

fork_branch_profile_resolution_unit.test.ts

feat(cli): clarify fork-branch workspace auto-targeting in output (#9988)

2026-07-07 17:08:09 +00:00

fork_merge.test.ts

feat: add CLI workspace merge command and enhance fork with datatable/color support (#8756)

2026-04-08 05:29:48 +00:00

fork_specific_items_unit.test.ts

fix(cli): resolve fork specific items from the parent workspace entry (#11436)

2026-09-30 10:41:59 +02:00

generate_metadata_unit.test.ts

fix: keep a resource default set in the schema when the script is redeployed (#11495)

2026-10-03 08:57:04 +02:00

git_unit.test.ts

feat(cli): sync an app's custom path as a workspace-specific file (#11786)

2026-10-15 13:49:44 +00:00

gitsync_converter_unit.test.ts

feat: sync data table migrations to git, gated by a new object type (#10436)

2026-07-31 23:33:47 +02:00

gitsync_deploy_branch_config.test.ts

fix(cli): sync workspace dependency files on Windows and fix CLI tests (#11288)

2026-09-22 12:13:11 +00:00

gitsync_deploy_push_unit.test.ts

fix(cli): stage a rewritten shared lockfile on git-sync deploy push (#11126)

2026-09-14 23:16:37 +02:00

gitsync_promotion.test.ts

feat(git-sync): enable per-item promotion mode on dev workspaces (#10205)

2026-07-21 17:07:52 +00:00

gitsync_settings_features.test.ts

refactor(cli): migrate CLI from Deno to Bun/Node.js (#8041)

2026-02-21 21:19:04 +00:00

group_commands.test.ts

feat(cli): add job, group, audit, token commands and schedule enable/disable (#8581)

2026-03-28 09:18:55 +00:00

guidance_writer_unit.test.ts

feat(cli): improve agent prompts/skills and workspace fork workflow (#9531)

2026-06-12 00:16:16 +02:00

headers_env_var.test.ts

fix(cli-tests): stabilize flow lock-gen race + Windows path (#9080)

2026-05-08 07:43:21 +02:00

http_guards_unit.test.ts

fix(cli): detect upstream auth-gateway HTML responses and add poll heartbeat (#9065)

2026-05-06 23:48:32 +00:00

include_flags_bypass_filtering.test.ts

refactor(cli): migrate CLI from Deno to Bun/Node.js (#8041)

2026-02-21 21:19:04 +00:00

init_bind_flow.test.ts

feat: unify CLI config to workspaces, deprecate gitBranches/environments (#8767)

2026-04-09 19:46:34 +00:00

init_no_git_sync.test.ts

feat: stop offering deno for new scripts, ship it only on full images (#11648)

2026-10-09 19:15:08 +02:00

init_template_unit.test.ts

feat: stop offering deno for new scripts, ship it only on full images (#11648)

2026-10-09 19:15:08 +02:00

inline_scripts_failure_preprocessor_unit.test.ts

fix(cli): consistent flow inline lock filenames for compound extensions (#9555)

2026-06-12 17:20:54 +02:00

instance_configs_unit.test.ts

fix(cli): stub the API client over its real exports in tests (#11363)

2026-09-25 17:43:08 +00:00

item_digest_unit.test.ts

feat: add trigger, tag, run-as and digest claims to job OIDC tokens (#11481)

2026-10-02 19:02:17 +02:00

job_commands.test.ts

feat: improve CLI flow log streaming and job inspection (#8644)

2026-03-31 18:22:18 +00:00

labels_export.test.ts

feat: add optional labels to scripts, flows, apps, schedules, triggers (#8609)

2026-04-03 17:39:32 +00:00

lint_command_unit.test.ts

feat: share AI guidance with the CLI skills and lint flow groups (#11397)

2026-09-29 14:47:42 +02:00

lint_locks_unit.test.ts

chore(cli): separate unit tests from integration tests and fix test cleanup (#8562)

2026-03-27 16:13:33 +00:00

lint_orphan_metadata_unit.test.ts

feat: report script metadata with no content file in wmill lint (#11053)

2026-09-10 09:15:44 +02:00

list_get_new_commands.test.ts

feat: add Azure Event Grid triggers (#8888)

2026-04-23 16:30:18 +00:00

local_encryption_unit.test.ts

refactor(cli): migrate CLI from Deno to Bun/Node.js (#8041)

2026-02-21 21:19:04 +00:00

lock_cache_unit.test.ts

fix(cli): include lock-relevant script content in lock cache key (#9528)

2026-06-11 07:43:45 +00:00

lock_dedup_unit.test.ts

fix(ci): unbreak the windows test jobs and the discord comment relay (#10799)

2026-08-21 12:52:06 +00:00

lockfile_format_pinning_unit.test.ts

feat(cli): wmill-lock.yaml auto-fill + --rehash-only + path-prefix dedup (#8978)

2026-05-01 15:11:56 +00:00

mixed_case_paths.test.ts

fix(cli): reconcile case-only path drift during sync on case-insensitive filesystems (WIN-2020) (#9485)

2026-06-09 08:09:04 +00:00

mock_services.ts

fix(cli): stub the API client over its real exports in tests (#11363)

2026-09-25 17:43:08 +00:00

multi_instance_workspace.test.ts

refactor(cli): migrate CLI from Deno to Bun/Node.js (#8041)

2026-02-21 21:19:04 +00:00

new_commands_helpers.ts

test(cli): drain async dependency jobs after sync push to fix flake (#10293)

2026-07-24 10:23:18 +02:00

override_settings_behavior.test.ts

feat: unify CLI config to workspaces, deprecate gitBranches/environments (#8767)

2026-04-09 19:46:34 +00:00

parser_packages_unit.test.ts

fix(cli): publish all windmill-parser-wasm-* deps so local pipeline graph keeps write edges (#9926)

2026-07-05 12:14:22 +02:00

pending_script_lock_unit.test.ts

fix(cli): preserve committed script.lock on transient NULL lock during git-sync deploy (#9593)

2026-06-15 19:21:38 +02:00

permissioned_as_context_unit.test.ts

fix(cli): count superadmins as able to preserve ownership on push (#11653)

2026-10-09 20:06:01 +02:00

pipeline_bounded_cascade_unit.test.ts

fix(parsers): keep s3 asset path suffix verbatim to preserve storage distinction (#10241)

2026-07-21 16:25:06 +00:00

pipeline_enrich_unit.test.ts

feat(pipeline): local development for data pipelines (CLI --local + pipeline dev preview) (#9840)

2026-07-01 11:41:36 +02:00

pipeline_local_graph_unit.test.ts

feat: run dbt projects as a first-class Windmill runtime (#10326)

2026-08-01 11:58:05 +00:00

pipeline_partition_unit.test.ts

fix: pipeline dogfooding fixes — SCD2 data-test scope, --partition, s3object upload binding (#9875)

2026-07-02 12:04:54 +02:00

pipeline_upload_unit.test.ts

fix: pipeline dogfooding fixes — SCD2 data-test scope, --partition, s3object upload binding (#9875)

2026-07-02 12:04:54 +02:00

precheck_permissioned_as_apps_unit.test.ts

feat: agents run on behalf of their deployer (#11430)

2026-10-15 19:31:21 +02:00

preview_path_unit.test.ts

fix(cli): attach the right job path to preview runs (#10606)

2026-08-10 19:37:46 +02:00

preview.test.ts

test: fix CLI and Windows cargo test failures on 1.820.0 (#11429)

2026-09-29 22:36:32 +02:00

protection_rules_converter_unit.test.ts

feat: add wmill protection-rules pull/push CLI commands (#9240)

2026-05-19 17:40:34 +00:00

pull_on_behalf_of_marker.test.ts

fix(cli): stop emitting has_on_behalf_of/has_permissioned_as: false on pull (#10188)

2026-07-19 09:30:49 +02:00

push_diff_convergence_unit.test.ts

feat(cli): sync an app's custom path as a workspace-specific file (#11786)

2026-10-15 13:49:44 +00:00

push_workspace_key_unit.test.ts

fix(cli): stub the API client over its real exports in tests (#11363)

2026-09-25 17:43:08 +00:00

push_workspace_settings_auto_invite_unit.test.ts

feat: workspace settings as one document, applied server-side (#11740)

2026-10-14 12:35:08 +00:00

push_workspace_settings_identity_unit.test.ts

feat: workspace settings as one document, applied server-side (#11740)

2026-10-14 12:35:08 +00:00

raw_app_missing_css_unit.test.ts

fix: raw apps with no stylesheet were permanently un-deployable (#10364)

2026-07-27 22:32:57 +02:00

raw_app_path_traversal_unit.test.ts

fix: keep raw-app files within their app folder on sync pull (#10796)

2026-08-22 10:00:52 +00:00

raw_app_push_policy_unit.test.ts

fix(cli): stub the API client over its real exports in tests (#11363)

2026-09-25 17:43:08 +00:00

raw_app_recordings_skip_unit.test.ts

feat: add session recording to wmill app dev (#10457)

2026-08-02 22:54:37 +02:00

raw_app_svelte_compiler_resolution_unit.test.ts

fix(cli): load the app's ESM svelte compiler, not its CJS one (#10622)

2026-08-10 21:50:03 +02:00

raw_app_svelte_plugin_unit.test.ts

fix(cli): keep svelte component styles in the raw-app bundle (#10838)

2026-08-26 20:24:34 +02:00

raw_app_sync.test.ts

test: fix CLI and Windows cargo test failures on 1.820.0 (#11429)

2026-09-29 22:36:32 +02:00

raw_app_workspace_deps_unit.test.ts

fix: apply default workspace dependencies to raw app runnables (#10427)

2026-07-31 11:42:43 +02:00

relative_imports_skip.test.ts

feat(cli): better stale scripts detection #3 (#8480)

2026-03-23 18:20:19 +00:00

relative_imports_wasm.test.ts

feat(cli): better stale scripts detection #3 (#8480)

2026-03-23 18:20:19 +00:00

replace_path_scripts_unit.test.ts

chore(cli): separate unit tests from integration tests and fix test cleanup (#8562)

2026-03-27 16:13:33 +00:00

repro_diffname.test.ts

test: fix repro_diffname CLI flake by draining the app dependency job (#10659)

2026-08-12 13:10:26 +02:00

resource_folders_unit.test.ts

feat: run dbt projects as a first-class Windmill runtime (#10326)

2026-08-01 11:58:05 +00:00

resource_push_agent_obo_unit.test.ts

feat: agents run on behalf of their deployer (#11430)

2026-10-15 19:31:21 +02:00

resource_types_unit.test.ts

fix: compile resource types with no properties instead of throwing (#10730)

2026-08-17 22:14:07 +02:00

schedule_history_commands.test.ts

feat(cli): add job, group, audit, token commands and schedule enable/disable (#8581)

2026-03-28 09:18:55 +00:00

schedule_push_permissioned_as_unit.test.ts

fix(cli): stub the API client over its real exports in tests (#11363)

2026-09-25 17:43:08 +00:00

script_envs_sync.test.ts

refactor(cli): migrate CLI from Deno to Bun/Node.js (#8041)

2026-02-21 21:19:04 +00:00

script_modules_unit.test.ts

fix(cli): resolve module script metadata on windows path separators (#10358)

2026-07-27 16:00:08 +02:00

script_push_metadata_unit.test.ts

fix: align script push metadata warning with generated locks (#8690)

2026-04-03 11:41:31 +00:00

script_push_up_to_date.test.ts

fix(cli): keep script settings on push and repair the up-to-date check (#10741)

2026-08-18 12:26:41 +02:00

script_runtime_settings_sync.test.ts

fix(cli): keep script settings on push and repair the up-to-date check (#10741)

2026-08-18 12:26:41 +02:00

secret_bearing_deletions_unit.test.ts

fix(cli): say where a sync push deleted variable or resource went (#10851)

2026-09-14 19:07:33 +02:00

settings_unit.test.ts

feat: make the fork lineage the only deploy relationship (#10410)

2026-07-30 14:20:27 +00:00

setup.ts

fix(cli): keep svelte component styles in the raw-app bundle (#10838)

2026-08-26 20:24:34 +02:00

shared_ui_diff_unit.test.ts

fix(cli): stub the API client over its real exports in tests (#11363)

2026-09-25 17:43:08 +00:00

slack_settings_sync.test.ts

feat(cli): non-interactive Slack connect/disconnect + sync round-trip fixes (#8935)

2026-04-24 17:14:08 +00:00

specific_items_unit.test.ts

feat: add workspace-specific flag for resources and variables (#8836)

2026-05-07 13:35:54 +00:00

standalone_commands.test.ts

feat: guide the AI when no resource type fits a service (#11615)

2026-10-14 10:24:10 +02:00

sync_config_resolution.test.ts

refactor(cli): migrate CLI from Deno to Bun/Node.js (#8041)

2026-02-21 21:19:04 +00:00

sync_pull_push.test.ts

fix(cli): sync workspace dependency files on Windows and fix CLI tests (#11288)

2026-09-22 12:13:11 +00:00

sync_push_auto_metadata_repro.test.ts

fix(cli): resolve lockgen imports through modules a push leaves alone (#11160)

2026-09-16 10:53:24 +02:00

sync_push_script_metadata_only.test.ts

fix(cli): resolve module script metadata on windows path separators (#10358)

2026-07-27 16:00:08 +02:00

tar_creation_unit.test.ts

chore(cli): separate unit tests from integration tests and fix test cleanup (#8562)

2026-03-27 16:13:33 +00:00

test_backend.ts

chore(cli): separate unit tests from integration tests and fix test cleanup (#8562)

2026-03-27 16:13:33 +00:00

test_config_helpers.ts

refactor(cli): migrate CLI from Deno to Bun/Node.js (#8041)

2026-02-21 21:19:04 +00:00

test_fixtures.ts

feat(cli): better stale scripts detection #3 (#8480)

2026-03-23 18:20:19 +00:00

trash_commands.test.ts

feat(cli): list, get and restore trashed items with wmill trash (#11125)

2026-09-14 20:06:56 +00:00

unified_generate_metadata.test.ts

remove dead legacyBehaviour param from metadata functions (#8695)

2026-04-03 12:01:34 +00:00

utils_unit.test.ts

fix(ci): unbreak the windows test jobs and the discord comment relay (#10799)

2026-08-21 12:52:06 +00:00

variable_ciphertext_shape_unit.test.ts

fix: prevent variable push from corrupting is_secret variables (#9705)

2026-06-23 12:45:36 +02:00

variable_resource_push.test.ts

feat(git-sync): sync extra_perms for variables (#11004)

2026-09-07 15:57:09 +02:00

wmill_lock_unit.test.ts

feat(cli): wmill-lock.yaml auto-fill + --rehash-only + path-prefix dedup (#8978)

2026-05-01 15:11:56 +00:00

workspace_conflicts_unit.test.ts

chore(cli): separate unit tests from integration tests and fix test cleanup (#8562)

2026-03-27 16:13:33 +00:00

workspace_deps_filter.test.ts

fix: skip generate-metadata confirmation prompt in non-interactive CI (#8678)

2026-04-02 19:28:39 +00:00

workspace_deps_path_unit.test.ts

fix(cli): sync workspace dependency files on Windows and fix CLI tests (#11288)

2026-09-22 12:13:11 +00:00

workspace_key_filename_integration.test.ts

fix(cli): keep permissioned_as on single-item push, as sync push does (#11000)

2026-09-07 16:46:35 +02:00

workspaces_config.test.ts

feat: unify CLI config to workspaces, deprecate gitBranches/environments (#8767)

2026-04-09 19:46:34 +00:00

ws_specific_flag_only_unit.test.ts

feat: add workspace-specific flag for resources and variables (#8836)

2026-05-07 13:35:54 +00:00

yaml_format_snapshot_unit.test.ts

feat(cli): wmill-lock.yaml auto-fill + --rehash-only + path-prefix dedup (#8978)

2026-05-01 15:11:56 +00:00

yaml_inline_tag.test.ts

fix(cli): preserve inline script files during flow generate-locks (#8561)

2026-03-27 19:27:56 +00:00