* feat: add R language support
Add R as a new supported scripting language in Windmill, following the
same pattern used for Ruby. Includes:
- Backend: ScriptLang::Rlang enum variant, DB migration, tree-sitter-r
parser crate with tests, WASM parser binding, R executor with NSJail
sandboxing, job dispatch and signature parsing
- Frontend: language picker, R icon, syntax highlighting, editor bar
insertions (Sys.getenv, get_variable, get_resource), schema inference,
init code template, BETA badge
- CLI: .r extension mapping, sync support, bootstrap template
R scripts use `main <- function(...)` syntax, jsonlite for JSON
serialization, and system curl for the Windmill client helper.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat: add R package resolution and installation
Parse library()/require() calls from R scripts to extract dependencies.
Resolve versions from CRAN, cache lockfiles in pip_resolution_cache,
and install packages to a shared R library cache. The run step sets
R_LIBS_USER so installed packages are available to the script.
- Parser: parse_r_requirements() extracts package names from AST
- Executor: resolve() generates lockfile, install() installs from CRAN
- Worker lockfiles: wire up R resolve for dependency jobs
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat: add nsjail sandboxing for R resolve and install phases
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: fix R get_variable/get_resource and add sandbox annotation + e2e tests
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: fix R arg inference with JS fallback parser and get_variable/get_resource
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix flake
* nsjail
* nits
* fix: R install improvements - suppress verbose output, flat lockfile logging, Dockerfile R support, rlimits
- Suppress renv verbose output during resolve and install (controlled by #verbose annotation)
- Filter renv from install list (already loaded, causes noisy restart message)
- Log compact "resolved N packages" instead of full renv.lock JSON
- Add R (r-base, r-cran-renv) to DockerfileFull and DockerfileFullEe
- Use disable_rl for nsjail install config (R compiles from source)
- Reduce default concurrency from 20 to 5
- Add rlang to openflow.openapi.yaml
- Fix MainArgSignature (no_main_func -> auto_kind) after main merge
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* final
* fix: remove accidental R install from multiplayer Dockerfile
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: remove R from Windows build and DockerfileExtra
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: rename R migration to avoid timestamp collision with trigger_filter_logic
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* all
* fix: R install improvements - suppress verbose output, flat lockfile logging, Dockerfile R support, rlimits
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: add clear error when Rscript binary is missing
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: fix type errors in R fallback parser, use format! in wrap(), add R system prompts
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: pyranota <pyra@duck.com>
* feat: use Nix profiles in sandbox Docker image
Replace manual tool installs (rustup, nodesource, curl installers) in
sandbox-image/Dockerfile.sandbox with a single `nix profile install .#sandbox`.
All tools (Rust, Node, Bun, Deno, Go, gh, sqlx-cli, cargo-watch, Chromium,
Playwright, etc.) are now managed declaratively via flake.nix.
- Add `packages.sandbox` and `packages.sandbox-full` buildEnv outputs to flake.nix
- Add `sandbox-env` helper script for browser tooling env vars
- Update playwrightWrapper to export PLAYWRIGHT_BROWSERS_PATH
- Rewrite Dockerfile.sandbox: Nix replaces ~50 lines of manual installs
- Update entrypoint.sh to source Nix profile PATH
- Delete deprecated root Dockerfile.sandbox
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: sandbox image runs as non-root user with wmdev
- Rewrite entrypoint.sh to start PostgreSQL as current user (no
chown/su needed), fixing "Operation not permitted" when wmdev
runs containers with --user
- Add chmod -R 777 /root and passwd entry for UID 1000 so non-root
containers can access bashrc, nix-profile, and tool configs
- Remove apt postgresql server (Nix profile provides it)
- Fix bash history expansion errors from literal `!` in system prompt
- Fix asciinema path reference (available on PATH, not hardcoded)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: wrap pkg-config in sandbox profiles to bake in Nix search path
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: add openssh-client and sudo to sandbox image for full root access
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: use useradd instead of manual passwd entry for sandbox agent user
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* refactor: rewrite flake.nix from scratch for clarity and modularity
Rewrite the Nix flake with clean separation of concerns, organized
let-bindings, and 4 purpose-specific devShells instead of a monolithic
default shell with broken package outputs.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat: add CLI tools to default devShell (gh, aws, playwright, mermaid, asciinema)
Add tools needed for AI agent workflows and dev tooling:
- gh (GitHub CLI)
- awscli2
- asciinema (terminal recording)
- playwright-driver with Nix-managed browsers
- mermaid-cli (diagram generation)
Playwright browsers are provided via nixpkgs' playwright-driver.browsers.
Mermaid/Puppeteer reuses the headless_shell from the same browser set.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: move wm-minio scripts to default devShell
MinIO (local S3) is needed for regular development, not just the full
profile.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: use playwright wrapper + chromium for browser tools
Replace playwright-driver (library, no CLI) with:
- A `playwright` wrapper script that calls the Nix playwright-core CLI
(version-matched to its own Nix-provided browsers)
- pkgs.chromium for Mermaid/Puppeteer (which respects PUPPETEER_EXECUTABLE_PATH)
This fixes playwright screenshot and mermaid diagram generation.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat: auto-load .env.local from main worktree in all devShells
Gitignored files like .env.local don't exist in git worktrees.
Add a shared shellHook that resolves back to the main tree via
git-common-dir and sources .env.local if present. This ensures
AWS credentials and other secrets are available in worktrees.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: replace deprecated pkgs.hostPlatform with stdenv.hostPlatform
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore: remove AWS CLI from flake and sandbox images
Pastebin is sufficient for screenshot sharing; AWS credentials
add unnecessary complexity.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: address PR review — ruby mismatch, quoting, shell dedup
- Fix pkgs.ruby → pkgs.ruby_3_4 in extraRuntimeVars to match extraRuntimes
- Replace $* with "$@" in all helper scripts (wm, wm-build, wm-caddy,
wm-bench, wm-cli) to correctly preserve argument boundaries
- Extract coreBuildInputs, browserVars, and playwrightWrapper as shared
let-bindings to eliminate duplication between default and full shells
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore: remove .env.local auto-loading from devShells
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* fix: flake nix devshell clang/mold/openssl compatibility
- Add mold linker to buildInputs
- Pin cargo linker to clang 18 (stdenv's clang 21 causes SIGSEGV with mold)
- Embed OpenSSL rpath via rustflags instead of LD_LIBRARY_PATH to avoid leaking into git/ssh
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* more fixes
* fix
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* Improve minio on flake.nix
* Add first asset parsing logic for ansible
* Correct html gt sign
* Decouple s3 file picker from drawer
* Factor duplicate code into snippet
* Update S3FilePickerInner to be compatible
* Fix pane shrinking issue
* Git repo viewer
* Change GitRepoViewer
* Endpoints for git repo visualizer
* Move git repo viewer to its own component
* Add button to populate git repo viewer
* Update parser yaml for new ansisble features (repo viewer)
* Reflect parser changes for ansible
* Add button to add the git repo mode of declaration for ansible
* Factor function
* Playbook + inventories into the drawer
* Add button to add inventories from s3
* Move tests to lib.rs
* Inventory loading from s3
* Move get github app token logic to be reused by ansible
* Update parser and ansible executor
* Use the correct path for inventories
* Add nushell to flake for wasm builds
* Add published parser
* Update hubPaths with clone and upload to s3
* Update ee-repo to the branch ref
* Fix npm run check
* Update cargo.lock
* Change labels on buttons
* Remove debug log
* Update ee-repo-ref
* Fix ee issues
* Update ee-repo ref
* Fix typo
* Fix ee
* Update ee-repo-ref
* Fix missing imports
* Unused var
* Fix typo
* Layout improvents
* Fix typos
* Remove unused function and log
---------
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* Add create_ephemeral workspace endpoint
* Add cli devShell
* List ephemeral workspaces + improve endpoint
* Add postgres function to clone a workspace (to be revisited)
* Clone workspace using the postgres function
* Add first iteration of ephemeral workspaces command
* Update display of forked workspaces
* Remove SQLX_OFFLINE
* Add UI to create ephemeral workspace
* Add option to exclude repository from being inherited to forks
* WIP: reworking cloning logic
* Fix cloning
* Fix redirect after creating fork
* Clean up cloning behaviour
* Rename ephemeral to fork
* emove ephemeral_workspaces table in favour of columns in workspaces
* Fix display of forked workspaces
* Fix skip inherit git sync repo setting
* Fix fork invite display + creating fork as user
* Fix SideMenu bug
* Fix alignment
* Simplify migrations
* Update deletion of workspaces
* Delete forked workspace from cli
* Deleting fork workspaces from the UI as non-admin
* Update cli sync and fork creation to adapt to branches and forks
* Update fork prefix
* Remove skip tracking toggle
* Fix npm check warnings
* Fix last npm check
* fix: force stdin to Stdio::null for all user code execution (#6575)
Set stdin to Stdio::null for all Commands that execute user code across all supported languages to prevent unwanted input consumption. This affects Python, Deno, Bash, PowerShell, Go, Rust, PHP, Ruby, Java, C#, Ansible, Nu, and Bun executors.
The dedicated worker handler was intentionally left unchanged as it requires stdin for inter-process communication.
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* Update ee-repo ref
* Update SQLx metadata
* Fix typos
---------
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
In > 7.10.0 regression was introduced breaking our build process.
This commit reverts the change and fixes tests
Signed-off-by: pyranota <pyra@duck.com>
* feat: Add runScriptByPath and runScriptByHash methods to SDK clients
- Add runScriptByPath and runScriptByHash methods to TypeScript client
- Add run_script_by_path and run_script_by_hash methods to Python client
- Split functionality from existing methods that took both path and hash parameters
- Add deprecation warnings to existing run_script methods
- Maintain backward compatibility while encouraging use of focused methods
Closes#6251
Co-authored-by: Ruben Fiszel <rubenfiszel@users.noreply.github.com>
* Refactor SDK methods to eliminate code duplication
- Extract common logic into internal helper methods
- Python client: _run_script_async_internal() and _run_script_internal()
- TypeScript client: _runScriptAsyncInternal() and _runScriptInternal()
- Eliminate duplicated parameter processing and HTTP setup
- Maintain exact same public API surface and functionality
- Reduce lines of code while preserving all existing behaviors
Co-authored-by: Ruben Fiszel <rubenfiszel@users.noreply.github.com>
* fix ts and dev.nu for python
* trade warnings.warn for logging.warning
Signed-off-by: pyranota <pyra@duck.com>
---------
Signed-off-by: pyranota <pyra@duck.com>
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <rubenfiszel@users.noreply.github.com>
Co-authored-by: pyranota <pyra@duck.com>
* feat: critical alert if disk near full
* update logic to cover edge-case
* update logic
* windows support
* Update README.md
Co-authored-by: ellipsis-dev[bot] <65095814+ellipsis-dev[bot]@users.noreply.github.com>
* make it periodically
* add extra safety
* respect killpills
* do not check every 3 secs
* move to monitor.rs
* rework
* alter readme
* extending functionality
* fix worker_mode
* fix compilation
* fix typo
* make use of AI suggestion
* update ee-repo-ref
* update ee ref
* logs are CE
* update ee repo ref
* remove systemstat from worker crate
* fix comp error + sync cargo.lock
* more comptime fixing
* Update ee-repo-ref.txt
* fix compilation error
---------
Co-authored-by: ellipsis-dev[bot] <65095814+ellipsis-dev[bot]@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* Ansible vault + roles
* Clone arbitrary repos
* Fix cloning logic after merge
* Make function for cloning without history any commit
* Cloning repos and lockfile on the commit
* Improve error messages
* Create lockfile for roles and collections
* Simplify ansible ssh identity interface
* Ansible vault password: pass just a variable instead of 2 step approach
* Lock lockfiles for roles and collections
* fix typo
* Change git ssh identity section name
* Rename variable
* Update init script for ansible
* Suppress error when no roles
---------
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* nit: replace `KJQXZ` with more meaningful notation
Originally this string is located in all places, where modification is needed in order to add new language support
* relative -> related
* revert shebang in substitue.sh
* remove '}'
* feat: add nu (nushell) support
* add worker tests
* deactivate tables and non-any types below top-level
full support will come in V1
for V0 it's better to keep things minimal and simple
* add syntax highlighting
used python's grammar, since nushell isn't supported by monaco nor svelte-highlights
for V1 nu will get it`s own grammar
* add logo
* partially implement plugin support
* change logo + ability to deploy + nsjail draft
* static variables + get_resource + get_variable
* lsp/dev.nu + initial nu lsp (not working yet)
* make it work with nsjail
* nullguard
* Much more flexible signature parsing and better error-messages
* add init script
* rename nulsp to nu
* install nu to dockerfile
* fix merge
* implement Default for MainArgSignature
* stage NU_CACHE_DIR
* improve dockerfiles
* dev.nu for parser-wasm + flake.nix
* update code for windows
* add nushell to flake
* upload Cargo.lock
* make build.sh work on nixos
* build wasm cli parsers
* add docs to README_DEV.md
* add helper script docker/dev.nu
* improve docker/dev.nu
* fix windows
* commit frontend/package(lock).json
* update cargo.lock
* correctly update cargo.lock
* remove lsp
* update flake.nix to include svelte server and nushell
* Revert base.sql to main
* remove PLUGIN_USE_RE
* make CARGO_PATH private
* add nu to cli
* Change flags to build wasm-nu-parser
* remove flake.nix from parser-wasm
* update wasm-build target
* remove unused import
* add cli support for nu
* update github workflows
* wasm-build 0.17 -> 0.19
* update build script
* update cargo.lock
* Fix typographical error
* start working on java
* do java boilerplate
* implement parser for java
* update Cargo.lock
* update ENV_SETTINGS
* use published nu parser
* update package.lock
* java is S3 + Caching enabled
* install nsjail backup
* commit v0
* fix nsjail
* v0.1
* rewrite parser in tree-sitter
* implement parser from scratch
* polishing
* change init script to match new parser
* fix imports
* fix cli build
* fix cli build
* refactor install phase
* implement .valid.windmill atomic verification
* implement java init functionality
* remove quick-xml
* fix windows not recognizing 'mvn'
* create empty settings.xml if there is no config provided
* clean up
* change default settings.xml
* change classpath format for windows
* docs to helper
* java copy bin cache instead of symlink
* remove comments
* merge
* fix package.json
* fix package.json 2
* minor fixing
* migrate to Coursier
* update misc
* Http(s) Proxy + CA certs
* remove unused .wasm
* make requirements insensitive to spaces
* update handle_child refs
* rework save_cache for directories
* fix s3 bug
* compile .wasm for cli
* remove uuid import
* fix compilation
* use reference
* fix zero-dep failure
* removing unsafe stuff
* remove unneeded imports
* revert: we still need winapi
* remove nix store from nsjail
* do not create cache_nomount
* add java to dnt
* remove duplicated dependency in init script
* fix typos
* fix CI
* use published parser
* feat: add nu (nushell) support
* add worker tests
* deactivate tables and non-any types below top-level
full support will come in V1
for V0 it's better to keep things minimal and simple
* add syntax highlighting
used python's grammar, since nushell isn't supported by monaco nor svelte-highlights
for V1 nu will get it`s own grammar
* add logo
* partially implement plugin support
* change logo + ability to deploy + nsjail draft
* static variables + get_resource + get_variable
* lsp/dev.nu + initial nu lsp (not working yet)
* make it work with nsjail
* nullguard
* Much more flexible signature parsing and better error-messages
* add init script
* rename nulsp to nu
* install nu to dockerfile
* fix merge
* implement Default for MainArgSignature
* stage NU_CACHE_DIR
* improve dockerfiles
* dev.nu for parser-wasm + flake.nix
* update code for windows
* add nushell to flake
* upload Cargo.lock
* make build.sh work on nixos
* build wasm cli parsers
* add docs to README_DEV.md
* add helper script docker/dev.nu
* improve docker/dev.nu
* fix windows
* commit frontend/package(lock).json
* update cargo.lock
* correctly update cargo.lock
* remove lsp
* update flake.nix to include svelte server and nushell
* Revert base.sql to main
* remove PLUGIN_USE_RE
* make CARGO_PATH private
* add nu to cli
* Change flags to build wasm-nu-parser
* remove flake.nix from parser-wasm
* update wasm-build target
* remove unused import
* add cli support for nu
* update github workflows
* wasm-build 0.17 -> 0.19
* update build script
* update cargo.lock
* Fix typographical error
* update Cargo.lock
* update ENV_SETTINGS
* use published nu parser
* update package.lock
* rewrite parser in tree-sitter
* implement parser from scratch
* polishing
* change init script to match new parser
* fix imports
* fix cli build
* fix cli build
* merge
* update wasm
* use MiniPulledJob
* update cli
* change cli wasm schema
* change cli
* update deno.json
* make wasm modules load lazily
* regenerate parsers
* remove leftover
* update cargo.lock
* clean up dnt.ts
* add docs to cli/test.nu
* add schema validation option
* add Nu to try_validate_schema
* reference frontend to new parser version
