Files
windmill/backend/windmill-common
796b6e5297 feat: back AI sessions up to the workspace object storage (#11116)
* feat: back AI sessions up to the workspace object storage

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SG5qEPM6Fmf7VerXS5nnWp

* fix: bind the backup key to the user and pack pushes within the server caps

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SG5qEPM6Fmf7VerXS5nnWp

* fix: keep refused and unavailable marks, one mark per key, stream the flush

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SG5qEPM6Fmf7VerXS5nnWp

* fix: settle only fully sent sessions, keep removals while backups are off, cap pull bodies

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SG5qEPM6Fmf7VerXS5nnWp

* fix: bound removal marks while backups are off and stale the sync rows instead of dropping them

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* fix: retry a lost lock, cap nested push lists and oversized pieces, drop a stale copy of a chat that outgrew the backup

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* fix: cap pieces per push, size requests in UTF-8, keep a move's removal for an off workspace, disclose the restore counter

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* fix: file a move's removal only once the new copy landed, retire marks through the sync row

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* fix: keep a session marked while deletes are carried over, drop only gone sessions' marks

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* fix: record what a refused flush already stored, stop early when every mark is retired

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* fix: restore past another workspace's removal mark, file a move's removal before its row, bound the first pulled session

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* fix: re-key the backups on workspace key rotation, accept only base64 images, carry a delete on the sync row when its mark cannot be written

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* fix: durable conditional re-key of session backups, re-push on a storage switch

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* fix: fail a push the key rotated under, settle no session split across storages, narrow the re-key module

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* fix: keep a delete filed during a push, bound the pull and re-key listings

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* fix: bound the session listing, mark the store's own user on a write that lands after a user switch

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* fix: list sessions through per-session index markers, hold a session's parts back after a failed one

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* fix: record a rotation on every build, list a session only on the part that completes its push

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* fix: leave an object larger than any push writes unread

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* fix: read each object against its listed size, carry a dirty mark that cannot be written on the sync row

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* fix: note the storages the re-key walk completed on, reach another user's rows on a failed mark, read a head at its cap

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* fix: read the replaced key under its row lock, carry a refused dirty bump on the sync row

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* fix: pull a session that outgrew one answer in pages, imported only whole

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* fix: build a pull page from the smallest keys of the whole listing, stage each page as it lands

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* fix: re-record a key rotated back to, admit earlier-page images, restage over a cut-short restore

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* refactor: delete the backups on key rotation instead of re-keying them

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* fix: end a pull page before an object that grew since the listing, prune what a cut-short restore staged

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* fix: delete the backups before the key commits, skip a planted object whatever its listing says, lock a restore across tabs, prune stale artifact versions

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* fix: keep the backups under a prefix named by the key, delete the previous key's prefix after the commit

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* fix: name the backup prefix by a generation the rotation bumps, never write an older record over a newer one on restore

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* fix: retire a removal only against the storage holding the backup, restart a paged pull whose listing moved

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* fix: fingerprint a pull page before reading it, answer the backup generation apart from the storage identity

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* fix: answer needs_head for a headless session push, prune restaged pieces by id

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* fix: serialize a session's push and removal, open whole pushes with the head, prune only own restores

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* fix: require a head on a whole push, prune before the record lands, restore only under Web Locks

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* fix: incremental pushes ride on a listed session, removals wait for every storage holding a copy

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* fix: a whole push replaces the backup under a per-push token, a pull page is checked after its reads

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* fix: fingerprint a pull page by entity tag and version too

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* fix: a moved session's removal mark names the storages holding the old copy

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* fix: restore a workspace family together, the newest copy of a moved session winning

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* fix: name the marker by the session's move count, abort a family restore a listing failed in

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* fix: list the family again before a restored record lands, require the pull fingerprint

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* fix: list the whole family once per restored workspace, off members included

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* fix: a push split over parts, incremental too, unlists the session until its last part

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* fix: refuse a partial push part that names no push

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* fix: keep a refused bump for a session with no row yet, probe an off workspace again

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* fix: backfill row-carried bumps after a reload, ask an off workspace again on a timer

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* fix: backfill a row for its bumps only when it carries some

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* fix: a backfilled mark that cannot be written counts from the page's counter

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* docs: say an off workspace is asked again, in the mirror's comments

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* chore: update ee-repo-ref to 1c1dab33563c4907aff8b0da825fb66db60af82a

This commit updates the EE repository reference after PR #796 was merged in windmill-ee-private.

Previous ee-repo-ref: 289b477ca3fc993da06ec09b11c8f55d5e4e39c1

New ee-repo-ref: 1c1dab33563c4907aff8b0da825fb66db60af82a

Automated by sync-ee-ref workflow.

* fix: unlist a session while an incremental push changes more than one object

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
2026-09-15 15:48:33 +00:00
..