Files
windmill/cli
hugocasaandClaude Opus 5 d8d7332eb6 feat: add per-route CORS origin allowlist for HTTP triggers (#10833)
* feat: add per-route CORS origin allowlist for HTTP triggers

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix: fail closed on cold router cache and invalid origin input

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix: resolve CORS route from the decoded path like the request handler

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* feat: add instance-wide default allowed origins for HTTP routes

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix: let non-superadmins read the default allowed origins setting

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* feat: badge the advanced section when a route's origins are restricted

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix: state inherited origins on the control and use one hint row

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix: trim the origins tooltip and relabel the toggle when a default exists

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix: keep the origins format hint visible until an entry is wrong

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix: state the at-least-one requirement in the origins hint

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix: import the origins validator in the trigger-http tests

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix: make an empty allowlist deny rather than fall back to the default

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix: address review nits on origin validation and the CORS editor

* fix: derive the origins error from the stored list and tighten host validation

* fix: parse real IPv6 hosts and refuse a newly emptied allowlist

* refactor: make origin validation advisory except for null and non-ascii

* feat: let an empty allowlist be saved as deny every origin

* docs: document the empty allowlist as deny every origin

* fix: bound allowlists, reject commas, and decide cors after the handler

* chore: revert unrelated rustfmt churn in windmill-common tests

* chore: revert unrelated rustfmt churn in windmill-common

* chore: drop the route types the cors restructure replaced

* fix: take the stricter cors decision from before and after the handler

* fix: strip runnable cors headers when the routers are unavailable

* docs: document the allowlist bounds in the openapi schema

* fix: let an unavailable cors read defer to one that resolved

* refactor: carry the resolved cors policy from the handler to the middleware

* docs: describe why an unavailable read fails closed on the paths that reach it

* fix: validate the default origins on the declarative settings path

* test: keep the webhook doc comment with the test it describes

* fix: warn on impossible schemes and ports, and validate the instance setting

* feat: treat an empty allowlist as unset at both levels

* perf: decode the cors path only when the fallback needs it

* docs: document the empty allowlist as unset in the api schema

* docs: describe an empty allowlist as unset in the frontend comments

* docs: say what a null allowlist resolves to, not what it meant before the default existed

* docs: state what the validator refuses and why methods stay broad

* feat: exempt static asset routes from the origin allowlist

* fix: hide the origin control for every static target, not just websites

* fix: exempt only static websites, not single-file static assets

* fix: warn on an unclosed ipv6 host in the origins advisory

* fix: require assets present, not just the static website flag

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-09-14 11:36:01 +02:00
..
2022-11-01 15:53:28 +01:00
2023-02-03 19:49:46 +01:00
2026-02-23 09:09:16 +00:00
2025-12-26 20:32:42 +00:00

Windmill CLI

A simple CLI allowing interactions with windmill from the command line.

You can find more information in Windmill Docs

Installation

Install the wmill CLI tool using npm install -g windmill-cli.

Update to the latest version using wmill upgrade.

Workspaces

To get started run wmill workspace add or use the instructions from the workspace settings.

Running Flows & Scripts

Run a script or flow using wmill flow/script run u/username/path/to/script and pass any inputs using --data + Inputs specified as a JSON string or a file using @ <filename> or stdin using @-.

Curl-style syntax using -d @- for stdin or -d @<filename> is also supported.

Flow Steps and Logs will be streamed during execution automatically.

CLI input example

Pushing Resources, Scripts & More

The CLI can push specifications to a windmill instance. See the examples/ folder for formats.

Switch to a different workspace

wmill workspace switch <workspace_name>

Sync a workspace

Pull

wmill sync pull

Push

wmill sync push

We recommend using the --yaml option to use yaml instead of json as the encoding format. Yaml will be made the default soon.

Pushing individual files

You can push individual resources using wmill <type> push <file_name> \<remote_name\>. This does not require a special folder layout or file name, as this is given at runtime.

Listing

All commands support listing by just not providing a subcommand, ie wmill script will result in a list of scripts. Some allow additional options, learn about this by specifying --help.

User Management

You can add & remove users via wmill user add/remove, and list them using wmill user

Pulling

You can pull the entire workspace using wmill pull

Completion

The CLI comes with completions out of the box via wmill completions <shell>. (Via cliffy)

Bash

To enable bash completions add the following line to your ~/.bashrc:

source <(wmill completions bash)

Fish

To enable fish completions add the following line to your ~/.config/fish/config.fish:

source (wmill completions fish | psub)

Zsh

To enable zsh completions add the following line to your ~/.zshrc:

source <(wmill completions zsh)

Development

AI Guidance Variants

wmill init can now materialize alternate AI guidance bundles without changing the generated defaults in the repo, but this is exposed as internal env-var overrides rather than public CLI flags.

Examples:

WMILL_INIT_AI_SKILLS_SOURCE=/path/to/custom/skills wmill init --use-default
WMILL_INIT_AI_SKILLS_SOURCE=/path/to/custom/skills WMILL_INIT_AI_AGENTS_SOURCE=/path/to/AGENTS.md wmill init --use-default
WMILL_INIT_AI_SKILLS_SOURCE=/path/to/custom/skills WMILL_INIT_AI_CLAUDE_SOURCE=/path/to/CLAUDE.md wmill init --use-default

This is the same guidance-writing path used by the benchmark CLI under ai_evals/, so the benchmark harness and wmill init now generate the same project guidance shape:

  • AGENTS.md
  • CLAUDE.md
  • .agents/skills/*
  • .claude/skills/*

windmill-yaml-validator

wmill lint imports the sibling windmill-yaml-validator package from source rather than from npm, so its schemas always match the OpenAPI specs of the current checkout. bun install regenerates them through this package's preinstall script; run it again after editing openflow.openapi.yaml or backend/windmill-api/openapi.yaml:

npm --prefix ../windmill-yaml-validator run gen

Running Tests

Prerequisites:

  • PostgreSQL running locally (default: postgres://postgres:changeme@localhost:5432)
  • Rust toolchain installed

Run tests locally (full features):

bun test test/

Run tests in CI mode (minimal features, skips EE tests):

CI_MINIMAL_FEATURES=true bun test test/
Variable Description
CI_MINIMAL_FEATURES Set to true to skip EE-dependent tests
DATABASE_URL PostgreSQL connection string
EE_LICENSE_KEY Enterprise license key for EE features