* fix(cli): prevent duplicate 'Using non-dotted paths' log message
Add a flag to track whether the message has already been logged,
so it only prints once even if setNonDottedPaths is called multiple times.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat(cli): add --branch option to sync pull/push commands
Add a --branch argument that allows overriding the current git branch
for sync operations. This enables:
- Using branch-specific settings even when not in a git repository
- Overriding the detected git branch when needed
The branch override is applied to:
- getEffectiveSettings() for branch-specific config overrides
- getSpecificItemsForCurrentBranch() for branch-specific items
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(cli): correct log message for workspace fork branches
Use rawGitBranch instead of currentBranch in the log message when
showing the origin of a workspace fork branch.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat(cli): extend --branch support to specificItems functionality
Update getBranchSpecificPath and isCurrentBranchFile to accept optional
branchOverride parameter. This ensures that branch-specific file handling
(for variables, resources, triggers) works correctly with --branch flag.
Updated functions:
- getBranchSpecificPath(): now accepts branchOverride
- isCurrentBranchFile(): now accepts branchOverride
- elementsToMap(): now accepts branchOverride
- compareDynFSElement(): now accepts branchOverride
- prettyChanges(): now accepts branchOverride
All call sites updated to pass opts.branch through the call chain.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(cli): resolve TypeScript type errors
- Fix Timeout type in dev.ts using ReturnType<typeof setTimeout>
- Add proper type casts for unknown error types
- Cast FlowModule to any to resolve generated type mismatch
- Cast Uint8Array to BlobPart for Blob constructor compatibility
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* test(cli): add unit tests for branch detection and --branch override
- Add specific_items.test.ts with 35 tests covering:
- toBranchSpecificPath and fromBranchSpecificPath conversions
- isSpecificItem pattern matching
- isBranchSpecificFile detection
- Round-trip path conversions
- branchOverride parameter functionality
- Add conf_branch_override.test.ts with 6 tests covering:
- getEffectiveSettings with branchOverride parameter
- Branch-specific overrides application
- promotionOverrides precedence
- Fallback to top-level settings
- Fix containerized_backend.ts to use dynamic paths instead of
hardcoded user home directories
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* chore(cli): add conf.ts barrel file for test imports
Re-exports from src/core/conf.ts to support existing test imports.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* all
* fix(cli): pass --branch override to workspace resolution
Previously, the --branch flag was only used for config resolution but
not for workspace resolution. This caused confusing log messages that
showed the git branch (e.g., master) before showing the override branch.
Changes:
- Add branchOverride parameter to tryResolveBranchWorkspace()
- Add branchOverride parameter to resolveWorkspace()
- Pass opts.branch from sync pull/push to resolveWorkspace()
- Log "Using branch override" early in workspace resolution
- Remove duplicate log from getEffectiveSettings()
Now when using --branch foobar, the logs show:
Using branch override: foobar
Applied settings for Git branch: foobar
...
Instead of the confusing previous output that mentioned both master
and foobar.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* refactor(cli): remove redundant branch detection in elementsToMap
isCurrentBranchFile() already validates that a branch exists (via
branchOverride or git detection) before returning true. No need to
pre-compute currentBranch before calling it.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
When logs stream quickly at job start, preamble content (job metadata,
execution headers) appears before the [windmill] compacted log marker.
The LogViewer now searches for the marker within the first 2000 chars
and renders the "Show more..." button inline at the correct position.
Optimizations:
- Fast early bail-out using short '[windmill]' search before long prefix matching
- Skip expensive ansi_to_html computation when splitHtml is active
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Multiple fixes to make nsjail work correctly:
1. Use absolute paths for python3 and bun binaries (/usr/bin/python3,
/usr/bin/bun) since nsjail's execve doesn't use PATH
2. Update cwd to use temp directory when code is written there, so
nsjail can find the script files (was using /debugger as cwd before)
3. Bind-mount /tmp from host instead of using tmpfs, so the temp
directories with scripts are accessible inside the sandbox
4. Add /debugger directory mount so Python debugger server script
is accessible inside nsjail
5. Add PATH environment variable to nsjail config
All debugger tests now pass with ENABLE_NSJAIL=true.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
The nsjail debugger mode was failing with "chdir('/tmp'): No such file
or directory" because without a config file, nsjail uses minimal mounts
that don't include /tmp or other necessary directories.
Added nsjail.debug.config.proto with proper mounts:
- /bin, /lib, /lib64, /usr, /etc (system directories)
- /tmp as tmpfs (for script execution)
- /dev/null, /dev/random, /dev/urandom (device nodes)
- /root as tmpfs (for bun cache)
Also updated:
- entrypoint-extra.sh: Pass --nsjail-config when ENABLE_NSJAIL=true
- DockerfileExtra: Copy nsjail config, update ports to 3003
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
The public key decoding from JWKS was missing base64url padding, causing
JWT signature verification to fail with "invalid jwt token" errors in
production. The `jwk.x` value needs proper padding before base64 decoding.
Fixed by using the existing `base64urlDecode` helper function which
correctly adds padding, instead of manually doing the conversion.
This resolves JWT verification failures when REQUIRE_SIGNED_DEBUG_REQUESTS
is enabled.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
