Add a migration that runs just before 20260318000000 (add_permissioned_as).
For each trigger table, if the email column still exists, update edited_by
to the trigger's email when the user is not in the workspace but is a
superadmin. This ensures the subsequent permissioned_as migration stores
the raw email instead of an invalid u/{username} reference.
If 20260318000000 was already applied, the migration is a no-op (email
column is gone, guarded by information_schema check).
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: correct raw app flow inputs
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* refactor: remove raw app legacy migration
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* fix: strip f/ prefix from folder paths when deploying from workspace forks
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* refactor: extract folderName helper for f/ prefix stripping
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: validate rd redirect on login with same rules as logout
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: sanitize rd at source in login callback to prevent leaking to goto
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: validate rd redirect in Login component for fresh login flow
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: add R language support
Add R as a new supported scripting language in Windmill, following the
same pattern used for Ruby. Includes:
- Backend: ScriptLang::Rlang enum variant, DB migration, tree-sitter-r
parser crate with tests, WASM parser binding, R executor with NSJail
sandboxing, job dispatch and signature parsing
- Frontend: language picker, R icon, syntax highlighting, editor bar
insertions (Sys.getenv, get_variable, get_resource), schema inference,
init code template, BETA badge
- CLI: .r extension mapping, sync support, bootstrap template
R scripts use `main <- function(...)` syntax, jsonlite for JSON
serialization, and system curl for the Windmill client helper.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat: add R package resolution and installation
Parse library()/require() calls from R scripts to extract dependencies.
Resolve versions from CRAN, cache lockfiles in pip_resolution_cache,
and install packages to a shared R library cache. The run step sets
R_LIBS_USER so installed packages are available to the script.
- Parser: parse_r_requirements() extracts package names from AST
- Executor: resolve() generates lockfile, install() installs from CRAN
- Worker lockfiles: wire up R resolve for dependency jobs
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat: add nsjail sandboxing for R resolve and install phases
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: fix R get_variable/get_resource and add sandbox annotation + e2e tests
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: fix R arg inference with JS fallback parser and get_variable/get_resource
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix flake
* nsjail
* nits
* fix: R install improvements - suppress verbose output, flat lockfile logging, Dockerfile R support, rlimits
- Suppress renv verbose output during resolve and install (controlled by #verbose annotation)
- Filter renv from install list (already loaded, causes noisy restart message)
- Log compact "resolved N packages" instead of full renv.lock JSON
- Add R (r-base, r-cran-renv) to DockerfileFull and DockerfileFullEe
- Use disable_rl for nsjail install config (R compiles from source)
- Reduce default concurrency from 20 to 5
- Add rlang to openflow.openapi.yaml
- Fix MainArgSignature (no_main_func -> auto_kind) after main merge
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* final
* fix: remove accidental R install from multiplayer Dockerfile
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: remove R from Windows build and DockerfileExtra
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: rename R migration to avoid timestamp collision with trigger_filter_logic
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* all
* fix: R install improvements - suppress verbose output, flat lockfile logging, Dockerfile R support, rlimits
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: add clear error when Rscript binary is missing
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: fix type errors in R fallback parser, use format! in wrap(), add R system prompts
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: pyranota <pyra@duck.com>
* fix: prevent browser freeze when approval form number field has no default value
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: disable approval buttons and keep polling after approve/deny action
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: restore approval page link and prevent double resume in flow viewer
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: guard against NaN fallback in Range and reset actionTaken on new approval step
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix approval page url
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* fix: use fully qualified tmux pane targets in webmux systemPrompt
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: anchor tmux pane targets to $TMUX_PANE for stability across window switches
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: add configurable preview job tag override in default tags settings
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: skip re-tagging for FlowPreview jobs when preview override is active
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: support hub flows in raw app runnables
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: support hub flow previews in app ui
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* refactor: move trigger context into flow graph viewer
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: use script viewer for hub flow steps
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: stretch raw app flow previews to pane height
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: improve hub flow run links
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: stabilize hub flow preview drawer
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: align hub flow id validation
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* style: fix runnable panel indentation
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* fix: improve CLI flow log streaming, sub-job listing, and failure handling
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat: add hierarchical flow status in job get and aggregated flow logs
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: remove duplicate ansi color hint in job logs output
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* docs: update cli-commands skill with new job/flow features
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* test: add integration tests for flow job inspection and log aggregation
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore: remove internal friction discovery doc from branch
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* docs: trim cli-commands skill to reduce context bloat
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* docs: update job command descriptions and regenerate skills.ts
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore: commit auto-generated files from system_prompts
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: address review comments on flow streaming and test assertions
- Move for-loop waiting logic outside --silent guard (Cubic #2)
- Break outer loop when for-loop module fails (Cubic #3)
- Strengthen test assertion: toContain("a") -> toContain("a: Generate data") (Cubic #1)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: generator regex truncating descriptions with parentheses
The .command() regex used [^)]+ for the second arg, stopping at the
first ')' inside description strings like "(machine-friendly)".
Now matches quoted strings properly before falling back.
Fixes 6 truncated descriptions across job, flow, and script commands.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* feat: support sensitive/secret fields for non-string types
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* refactor: restrict sensitive toggle to object type, move after showExpr
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: show sensitive toggle in PropertyEditor at bottom, after children
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* refactor: gate sensitive toggle with showSensitiveToggle prop
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: process secret args in flow test and script test paths
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* refactor: inline SecretArgInput into ArgInput, delete component
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: address CI review feedback
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: pass showSensitiveToggle to flow input schema editors
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: use explicit prop syntax to satisfy svelte-check
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: narrow try/catch to only processSecretArgs
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: 5x request size limit for raw app bundle uploads
Raw app bundle endpoints (create_raw, update_raw) now get 5x the
configured request size limit. Also improves error messages when
multipart uploads exceed the limit to include the actual limit
and mention it's adjustable in instance settings.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: mention size limit as possible cause, not definitive
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: support multiline secrets in resource password fields
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: wire minRows through to password textarea instead of disabling it
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* refactor: auto-detect multiline in password field instead of always using textarea
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: switch to textarea on Enter keypress in password field
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: focus textarea after switching from single-line password input
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* refactor: simplify Password multiline logic and fix cursor position bug
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: set 300s timeout on python client httpx to prevent ducklake query timeouts
The httpx.Client was using the default 5s timeout, causing ducklake SQL
queries (which run synchronously via run_inline_preview_script) to timeout
for any query taking longer than 5 seconds.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: disable timeout on python client httpx
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Update client.py
* Update client.py
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: compute highest workspace role across all instance groups when adding user to group
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref.txt
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* test: add regression tests for instance group role precedence
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to 15dd361793564ab50bc485b71b042da4cfc1d32c
This commit updates the EE repository reference after PR #501 was merged in windmill-ee-private.
Previous ee-repo-ref: 7e9d0e7ec0b52585cab368b7351e3a5654da3589
New ee-repo-ref: 15dd361793564ab50bc485b71b042da4cfc1d32c
Automated by sync-ee-ref workflow.
* refactor: extract compute_highest_workspace_role helper and clean up role logic
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref.txt
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to e08a87450627bef9013498e40ee93a47bedda7ee
This commit updates the EE repository reference after PR #502 was merged in windmill-ee-private.
Previous ee-repo-ref: a4ba20109813332320839488da5ecf83ca8f70b4
New ee-repo-ref: e08a87450627bef9013498e40ee93a47bedda7ee
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: expose getJob and getJobLogs as MCP tools
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* test: add integration test for getJob/getJobLogs MCP endpoint tools
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* test: add MCP client integration test for getJob and getJobLogs
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: add OR logic support to kafka/websocket trigger filters
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref for OR logic filter support
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: add filter_logic to OpenAPI spec/save utils, fix websocket derive, show capture group ID
- Add filter_logic field to all 6 Kafka/WebSocket OpenAPI schemas so it
is included in the generated frontend client types
- Include filter_logic in save request bodies (kafka/utils.ts, websocket/utils.ts)
- Fix misplaced #[derive(FromRow)] on WebsocketConfig (was on the default fn)
- Show copyable "Test group ID" in Kafka capture UI
- Remove capture event-loss warning for Kafka (uses separate consumer group)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* update sqlx
* update ee ref
* chore: regenerate system prompts for filter_logic schema changes
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: remove banned $bindable(default_value) pattern in TriggerFilters
Use $bindable() without default and $derived with ?? for the effective
value, per CLAUDE.md rules.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: make filterLogic prop required in TriggerFilters
All callers always pass it, no need for optional + derived fallback.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to 5ee1382dfb23b6a1516e3c7586058cec8240fdf2
This commit updates the EE repository reference after PR #498 was merged in windmill-ee-private.
Previous ee-repo-ref: bbd674991c07bff1cb2f3744e71fda10df53f09d
New ee-repo-ref: 5ee1382dfb23b6a1516e3c7586058cec8240fdf2
Automated by sync-ee-ref workflow.
* fix: reset filterLogic to 'and' in openNew for kafka/websocket editors
Prevents stale OR logic from carrying over when creating a new trigger
after editing one with OR filters.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: hugocasa <hugo@casademont.ch>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Prevents excessive memory/query load from large per_page values on the
inputs/history endpoint in cloud environments.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: add plain_emails_telemetry notification handler
Listen for plain_emails_telemetry setting changes via the global settings
notification channel, matching the workspace_telemetry_enabled pattern.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref.txt
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to 780857855e231c9d71f02fefd8253c254542ef32
This commit updates the EE repository reference after PR #500 was merged in windmill-ee-private.
Previous ee-repo-ref: 393c9c4ebd317d09466866ab17cc1ee9fc25582a
New ee-repo-ref: 780857855e231c9d71f02fefd8253c254542ef32
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: WAC workflow diagram visualization in script editor
Add WASM-powered workflow diagram for WAC scripts in the script editor,
inspired by Cloudflare's workflow diagrams approach. Parses WAC code
client-side via WASM and renders an interactive DAG using @xyflow/svelte.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: show WAC diagram on script detail page
Show the workflow diagram below the run form on the script detail page
for WAC scripts, matching how flows display their graph.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: handle try/catch and while loops in WAC diagram
Instead of rejecting these patterns with validation errors, render them
as graph nodes:
- try/catch → Branch node with "try"/"catch" edge labels
- while loops → LoopStart/LoopEnd with condition as iter_source
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: remove dead code from WAC parser and add pkg-wac to publish script
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: use published windmill-parser-wasm-wac@1.668.5
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: handle undefined language prop in WacDiagram usage
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: resolve windmill-parser-wasm-wac from npm registry in lockfile
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: create actual merge nodes for branch/try-catch convergence points
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* perf: enable S3 bundle cache for PHP previews without lock file
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: resolve borrow-after-move of lock in php cache save
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* refactor: use DB-based lockfile cache for PHP previews instead of requirements-only key
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: prevent stale lockfile TTL refresh in PHP preview cache
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* chore: add sqlx offline cache entry for PHP lockfile resolution query
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
fallback_service on a router with no explicit routes is invisible to
axum's nest() — requests never reach the nested fallback, resulting in
404s. route_service("/", service) registers an actual route so nest()
forwards correctly.
Also reverts layer back to route_layer for the ApiAuthed extractor
since there is now a real route to match against.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
