Files
windmill/cli
hugocasaandClaude Opus 5.5 813c080d46 feat: sandbox new low-code and raw apps by default (#11760)
* feat: sandbox new low-code and raw apps by default

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: navigate the top page from plain links in a sandboxed low-code app

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: allow clipboard and fullscreen in sandboxed raw-app frames

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: leave non-http links to the browser in the sandboxed app frame

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: let a link's own click handlers run before relaying it out of the frame

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: read link attributes so SVG anchors relay correctly

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* refactor: tidy the app deploy drawer to the brand guidelines

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* refactor: show enabled frontend api scopes as badges, rename runs-as section

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: keep frontend api access collapsed by default, badges next to its title

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* refactor: lead the run-on-behalf-of section with the user picker

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* docs: explain publisher execution and WM_END_USER_EMAIL in the run-on-behalf-of tooltip

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* docs: shorten the run-on-behalf-of tooltip, mention viewer data access for raw apps

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* docs: tell the AI what breaks in a sandboxed raw app and that turning it off is a security risk

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* feat: warn in the deploy drawer when an app is not isolated

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* refactor: drop the sandbox toggle help line

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* docs: say when to turn sandbox isolation off in the toggle tooltip

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* refactor: show who a non-deployer's app runs as, read-only

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: show a new app runs as the deployer, gray read-only user line

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* refactor: read-only on-behalf-of display as an opt-in selector prop

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: show a folder's default run-as user on a new app instead of the deployer

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: deploy an app under a group folder default without a mismatched email

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* revert: leave a new app's run-as user unselected, as on main

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* feat: warn in the app deploy drawer when a deploy changes the run-as user

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: snapshot the deployed policy so later edits don't change the saved app

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-15 12:54:00 +02:00
..
2022-11-01 15:53:28 +01:00
2023-02-03 19:49:46 +01:00
2026-02-23 09:09:16 +00:00
2025-12-26 20:32:42 +00:00

Windmill CLI

A simple CLI allowing interactions with windmill from the command line.

You can find more information in Windmill Docs

Installation

Install the wmill CLI tool using npm install -g windmill-cli.

Update to the latest version using wmill upgrade.

Workspaces

To get started run wmill workspace add or use the instructions from the workspace settings.

Running Flows & Scripts

Run a script or flow using wmill flow/script run u/username/path/to/script and pass any inputs using --data + Inputs specified as a JSON string or a file using @ <filename> or stdin using @-.

Curl-style syntax using -d @- for stdin or -d @<filename> is also supported.

Flow Steps and Logs will be streamed during execution automatically.

CLI input example

Pushing Resources, Scripts & More

The CLI can push specifications to a windmill instance. See the examples/ folder for formats.

Switch to a different workspace

wmill workspace switch <workspace_name>

Sync a workspace

Pull

wmill sync pull

Push

wmill sync push

We recommend using the --yaml option to use yaml instead of json as the encoding format. Yaml will be made the default soon.

Pushing individual files

You can push individual resources using wmill <type> push <file_name> \<remote_name\>. This does not require a special folder layout or file name, as this is given at runtime.

Listing

All commands support listing by just not providing a subcommand, ie wmill script will result in a list of scripts. Some allow additional options, learn about this by specifying --help.

User Management

You can add & remove users via wmill user add/remove, and list them using wmill user

Pulling

You can pull the entire workspace using wmill pull

Completion

The CLI comes with completions out of the box via wmill completions <shell>. (Via cliffy)

Bash

To enable bash completions add the following line to your ~/.bashrc:

source <(wmill completions bash)

Fish

To enable fish completions add the following line to your ~/.config/fish/config.fish:

source (wmill completions fish | psub)

Zsh

To enable zsh completions add the following line to your ~/.zshrc:

source <(wmill completions zsh)

Development

AI Guidance Variants

wmill init can now materialize alternate AI guidance bundles without changing the generated defaults in the repo, but this is exposed as internal env-var overrides rather than public CLI flags.

Examples:

WMILL_INIT_AI_SKILLS_SOURCE=/path/to/custom/skills wmill init --use-default
WMILL_INIT_AI_SKILLS_SOURCE=/path/to/custom/skills WMILL_INIT_AI_AGENTS_SOURCE=/path/to/AGENTS.md wmill init --use-default
WMILL_INIT_AI_SKILLS_SOURCE=/path/to/custom/skills WMILL_INIT_AI_CLAUDE_SOURCE=/path/to/CLAUDE.md wmill init --use-default

This is the same guidance-writing path used by the benchmark CLI under ai_evals/, so the benchmark harness and wmill init now generate the same project guidance shape:

  • AGENTS.md
  • CLAUDE.md
  • .agents/skills/*
  • .claude/skills/*

windmill-yaml-validator

wmill lint imports the sibling windmill-yaml-validator package from source rather than from npm, so its schemas always match the OpenAPI specs of the current checkout. bun install regenerates them through this package's preinstall script; run it again after editing openflow.openapi.yaml or backend/windmill-api/openapi.yaml:

npm --prefix ../windmill-yaml-validator run gen

Running Tests

Prerequisites:

  • PostgreSQL running locally (default: postgres://postgres:changeme@localhost:5432)
  • Rust toolchain installed

Run tests locally (full features):

bun test test/

Run tests in CI mode (minimal features, skips EE tests):

CI_MINIMAL_FEATURES=true bun test test/
Variable Description
CI_MINIMAL_FEATURES Set to true to skip EE-dependent tests
DATABASE_URL PostgreSQL connection string
EE_LICENSE_KEY Enterprise license key for EE features