* feat: support multiple secret variables during resource creation
When creating a resource, users can now select multiple fields to be
stored as secret variables. If only one field is selected, behavior
is unchanged (single variable with same path as resource). If multiple
fields are selected, each gets its own variable with _field_name appended
to the resource path.
Closes#8384
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* fix: delete all linked secret variables when resource is deleted
When a resource with multiple secret fields is deleted, also delete
variables matching the {path}_{field_name} pattern in addition to
the exact path variable. Each deleted variable gets its own deployment
metadata update and webhook notification.
Co-authored-by: Diego Imbert <diegoimbert@users.noreply.github.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Update backend/windmill-store/src/resources.rs
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
* fix: only delete linked variables that are actually referenced in resource value
Instead of deleting variables purely based on path prefix matching
(which could accidentally delete unrelated variables), the deletion
now reads the resource value first, extracts all $var: references,
and only deletes variables that are actually used in the resource.
Co-authored-by: Diego Imbert <diegoimbert@users.noreply.github.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Co-authored-by: Diego Imbert <diegoimbert@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Diego Imbert <70353967+diegoimbert@users.noreply.github.com>
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
The /updatesqlx workflow was checking out windmill-ee-private at its
default branch HEAD, ignoring the specific commit pinned in
backend/ee-repo-ref.txt. This could cause sqlx metadata to be generated
against a mismatched EE version.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
OutputPickerInner.updateLastJob() unconditionally returned testJob
(from individual step tests) even when flowStateStore had newer results
from a flow test. Now testJob only takes priority when a step test is
actively running/streaming; otherwise flowStateStore is the source of
truth.
Also reset stepHistoryLoader initial flags when a flow test completes
so the "Run loaded from history" indicator doesn't persist.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The enterprise feature was not being forwarded to windmill-api-schedule
in windmill-api's Cargo.toml, causing the #[cfg(not(feature = "enterprise"))]
guards in create_schedule to remain active even in EE builds. This made
on_recovery, on_success, and on_failure_times>1 incorrectly rejected
with "only available in enterprise version" for enterprise customers.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* docs: add nonDottedPaths convention to CLAUDE.md
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* docs(cli): update generated skills to use non-dotted path conventions
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(cli): make generated skills respect nonDottedPaths config
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(cli): inject nonDottedPaths placeholders in generate.py for skills.ts
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: default system prompts to non-dotted path conventions
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(frontend): prevent duplicate and reserved agent tool names
Extend tool name validation to detect duplicates within an agent step
and reserved names (like 'preprocessor', 'failure'). Show specific error
messages in the editor panel and red styling in the graph view.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(frontend): remove duplicate banner for agent tool name errors
The inline per-tool error messages are sufficient — the panel-level
banner was redundant and showed a double error.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: resource drawer opening behind dialog in chat mode
Integrate Modal into the Disposable z-index stacking system so drawers
opened from within a modal (e.g. "Add a new resource") correctly appear
above the dialog instead of behind it.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: resource drawer opening behind dialog in chat mode
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* refactor: simplify minZIndex tracking by removing unnecessary refcount
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: use map-based minZIndex tracking and conditional chat elevation
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: use plain object instead of Map for reactive minZIndex tracking
$state(new Map()) is not deeply reactive in Svelte 5 — only plain
objects and arrays are proxied. Replaced with Record<string, number>
so that property assignments properly trigger $derived updates.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* fix(cli): suppress verbose lock generation messages in generate-metadata
Pass noStaleMessage flag through to updateRawAppRunnables and
updateAppInlineScripts to suppress verbose "Generating lock for..."
messages when running generate-metadata command. Also fixes a stray
`}` character in a template literal.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat(cli): show updated inline scripts in generate-metadata output
Display inline script names that were relocked when processing flows
and apps in the generate-metadata command output. For example:
[4/5] app u/admin/test__raw_app: a, b, c
This provides visibility into what work was done without verbose
per-script logging that clutters the output.
- Add AppLocksResult and FlowLocksResult types to track updated scripts
- Update internal functions to return lists of updated script names
- Display script names inline with progress in generate-metadata
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* Detect union types in TS
* display union type arguments
* Handle single values at accumulation time
* nit propagate otyp
* Python support
* npm package update
The backend already filters tokens by scope matching the script/flow
path. Remove the redundant client-side label prefix filter so that all
tokens with matching scopes are shown, not just those with a specific
label convention.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Files inside .raw_app/backend/ were incorrectly being processed by
`script generate-metadata` and `generate-metadata --skip-flows --skip-apps`
because the filter only checked isFlowPath and isAppPath, but not isRawAppPath.
This caused backend runnables to be treated as standalone scripts, creating
incorrect .script.yaml files at wrong locations.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* feat: collapse flow topbar buttons to icon-only mode in narrow panes
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat: show delete button on top-right of compact error handler
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: preserve bug icon and diff action bar in compact error handler
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: avoid duplicate delete buttons when diff action bar is active
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* refactor: use undefined instead of empty string for wrapperClasses
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* chore: remove wm-cursor, add local-review skill, update PR skill for EE
- Remove the unused wm-cursor script and all references to it in
README_WORKMUX_DEV.md and worktree-common.sh
- Add /local-review skill for code review (bugs + CLAUDE.md compliance)
- Add EE companion PR workflow to the /pr skill
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore: add wm-ts-nav tree-sitter navigator and fix format hooks
- Add wm-ts-nav: standalone tree-sitter code navigator with SQLite index
for fast symbol search, definition lookup, and file outlines across
Rust, TypeScript, and Svelte files (~12ms warm, ~1s cold for 482 files)
- Fix format hooks: surface errors instead of swallowing with 2>/dev/null,
use direct prettier path with svelte plugin, add success feedback
- Add wm-ts-nav commands to settings allow list
- Document wm-ts-nav usage in CLAUDE.md
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat(wm-ts-nav): add refs command and --parent filter
- refs: find usages of a symbol in code, skipping comments and strings
(tree-sitter AST walk, ~46ms for 482 files vs grep's 4ms but no noise)
- --parent filter on search: find all methods on a type across all files
(e.g. search "%" --kind function --parent ServiceName)
- Update CLAUDE.md with clearer when-to-use guidance
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat(wm-ts-nav): index refs in DB with import-path resolution
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat(wm-ts-nav): add body, callers, callees commands and refs --file/--caller
- body: extract a symbol's source code from disk using indexed line ranges
- callers: cross-file call graph via SQL join of refs + symbols tables
- callees: list all identifiers referenced within a symbol's body
- refs --file: scope results to files matching a substring
- refs --caller: annotate each ref with the containing function name
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat(wm-ts-nav): add auto-rebuilding wrapper script
The `wm-ts-nav/nav` wrapper checks if source files are newer than the
binary and rebuilds automatically. Invoked via `sh wm-ts-nav/nav` to
avoid needing executable permissions after clone.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* docs: tighten CLAUDE.md nav section for actionable guidance
Remove redundant question→command mapping, latency numbers, and
excessive examples. Lead with "prefer wm-ts-nav over Read to save
context window" and keep only the patterns that change behavior.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore: revert backend/Cargo.lock to main
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore: promote wm-ts-nav in workflow, copy binary to worktrees
- CLAUDE.md: integrate wm-ts-nav into Workflow step 1 and Core
Principles so agents use outline/body before full file reads
- workmux: copy built binary via files.copy
- worktree-common.sh: copy binary in wm_copy_dependencies for webmux
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(wm-ts-nav): fix double indexing, add TSX grammar, remove needless clone
- Reuse index stats from the pre-query update instead of indexing twice
on the Index command
- Add Lang::Tsx variant so .tsx/.jsx files use LANGUAGE_TSX instead of
LANGUAGE_TYPESCRIPT (Svelte stays on TS since script blocks are pure TS)
- Remove source.clone() for non-Svelte files — move directly instead
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(wm-ts-nav): fix svelte line numbers, add class methods, innermost caller
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* feat: add GitHub Enterprise Server (GHES) support for GitHub App git sync
Add a self-managed GitHub App mode alongside the existing managed
(stats.windmill.dev) mode, enabling git sync for GitHub Enterprise Server
and custom GitHub App installations.
Backend:
- Parameterize GitHub API URLs (no more hardcoded github.com)
- Add GITHUB_ENTERPRISE_APP_SETTING global setting
- Add OpenAPI specs for ghes_installation_callback and ghes_config endpoints
Frontend:
- Add instance settings UI for configuring self-managed GitHub Apps
with setup instructions and validation
- GHES installation flow in gh_success page
- Dynamic installation URL based on GHES config
- Increase git sync test connection timeout to 10s
- Block "Review changes" save when settings are invalid
EE companion PR: windmill-labs/windmill-ee-private#<PR_NUMBER>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore: update ee-repo-ref to c74c86b78a66b976fd9968b21f77903723e668ec
This commit updates the EE repository reference after PR #459 was merged in windmill-ee-private.
Previous ee-repo-ref: 45e4550110799525b5502cf072c8af8132492638
New ee-repo-ref: c74c86b78a66b976fd9968b21f77903723e668ec
Automated by sync-ee-ref workflow.
* sqlx
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* feat(cli): add unified generate-metadata command
- Add generate-metadata command that calls script, flow, and app handlers
- Export generateLocks from flow.ts and generateMetadata from script.ts
- Add deprecation warnings to individual metadata commands
* feat(cli): improve unified generate-metadata command
- Use internal handlers for single-pass collection of stale items
- Add --dry-run flag to show what would be updated
- Fix WASM parser init deprecation warning
- Add comprehensive tests for all flags
- Match original handler behavior for per-item messages
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat(cli): add skip flags and comprehensive tests for generate-metadata
- Add --skip-scripts, --skip-flows, --skip-apps flags for granular control
- --schema-only now properly skips flows and apps (they only have locks)
- Dynamic "Checking X, Y, Z..." message based on what's being processed
- Show warning when all types are skipped
- Add comprehensive tests for all flags:
- --dry-run shows stale items without updating
- --schema-only only processes scripts
- --skip-scripts, --skip-flows, --skip-apps work correctly
- skipping all types shows warning
- 'All metadata up-to-date' when nothing to update
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* improve output
Signed-off-by: pyranota <pyra@duck.com>
* refactor(cli): add shared test fixtures with cross-links
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat(cli): add folder argument to generate-metadata command
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Signed-off-by: pyranota <pyra@duck.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* add a hint to commit message on git sync for renames
* chore: update ee-repo-ref to 344e2aa60d8cafe08b8c57445d2f9555bad7625a
This commit updates the EE repository reference after PR #458 was merged in windmill-ee-private.
Previous ee-repo-ref: ad4c90cc96ad1b4511cba6b6ee28351895882156
New ee-repo-ref: 344e2aa60d8cafe08b8c57445d2f9555bad7625a
Automated by sync-ee-ref workflow.
---------
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
The windmill-indexer pod was crash-looping due to OOMKilled (exit 137)
with a 2Gi memory limit. Two concurrent tantivy IndexWriters each
allocating 300MB (600MB total), combined with large uncommitted batches
of 50K jobs, caused memory exhaustion during indexing.
- writer_memory_budget: 300MB → 150MB (2 writers = 300MB total)
- commit_job_max_batch_size: 50,000 → 10,000
- commit_log_max_batch_size: 10,000 → 5,000
These can still be overridden via env vars or global settings.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* ci: add freshness check for auto-generated system prompts
Add a CI workflow and script to verify system_prompts/auto-generated/
stays in sync with its source files (SDKs, schemas, CLI commands, etc).
Also remove the hardcoded CLI version from generated output to avoid
unnecessary churn on every release.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* imports
* imports
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* regenerate system prompts after rebase on main
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
