* refactor: unify eval pipeline with production chat code path
Extract a shared headless runChatLoop() that both AIChatManager
(production) and the eval runner use, with injectable SDK clients.
Drop OpenRouter — evals now use direct provider APIs (OpenAI SDK,
Anthropic SDK) with streaming, matching production behavior.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: re-read tools/helpers/systemMessage/model on each loop iteration
The old chatRequest() re-read this.tools, this.helpers, this.systemMessage,
and getCurrentModel() on every iteration. This matters because changeModeTool
(Navigator → Script/Flow) reassigns all of these mid-loop. Use JS getters
in the config object so runChatLoop picks up changes each iteration.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: move basic git sync from EE to CE with runtime user count gating
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref.txt for git sync CE migration
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* refactor: keep git sync impl in private repo, revert oss to stub
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref.txt
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref.txt
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref.txt after merge
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: use LICENSE_KEY check instead of get_license_plan for runtime gating
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref.txt
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: improve git sync CE UX — use "Community Edition" wording, mention user limit
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: use "workspace members" instead of "users" in git sync messaging
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: lower CE git sync limit from 3 to 2 workspace members
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref.txt
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref.txt
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: simplify git sync CE alerts to warn about EE feature with member limit
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: add EE feature restrictions detail to CE git sync warning
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: show git sync settings even when >2 members, with disabled warning
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: show error alert when git sync settings exist but members exceed CE limit
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: mention CE git sync limit is for testing and hobbyist use
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to 79eeacccc0438010d7dfa60207a5cbdaf2eda08d
This commit updates the EE repository reference after PR #476 was merged in windmill-ee-private.
Previous ee-repo-ref: c4d69c6e700c16d44f909d9c7b6738b07043db98
New ee-repo-ref: 79eeacccc0438010d7dfa60207a5cbdaf2eda08d
Automated by sync-ee-ref workflow.
* chore: update sqlx cache
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: regenerate full sqlx cache after main merge
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update sqlx cache
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref and regenerate sqlx cache with private feature
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: use LICENSE_KEY_VALID for EE check, allow delete without access check, extract helpers
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref.txt
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* refactor: use compile-time cfg(enterprise) gating instead of runtime license checks
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref.txt
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to 6171a91da38d6d16a88aeb1a3a4f4df78f995383
This commit updates the EE repository reference after PR #481 was merged in windmill-ee-private.
Previous ee-repo-ref: 52681940cda6d70f65aeeb7144288f060b4d736e
New ee-repo-ref: 6171a91da38d6d16a88aeb1a3a4f4df78f995383
Automated by sync-ee-ref workflow.
* chore: update ee-repo-ref.txt
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to b5c8af4df9ba2c39fdd494d7a40f9a92fbff8abc
This commit updates the EE repository reference after PR #482 was merged in windmill-ee-private.
Previous ee-repo-ref: 6e5b2741831468a7b30b26c0df1241e6141c6833
New ee-repo-ref: b5c8af4df9ba2c39fdd494d7a40f9a92fbff8abc
Automated by sync-ee-ref workflow.
* fix: gate CE_GIT_SYNC_MAX_USERS behind cfg(not(enterprise))
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* [ee] fix: serve index disk storage sizes from /srch/ endpoint
On multi-container deployments, the API server doesn't have the index
files on its local disk, so disk size was always reported as 0.0B.
Added a new GET /srch/index/storage/disk endpoint that calculates disk
sizes on the indexer process (which owns the files). The frontend now
fetches disk sizes from this endpoint in parallel with the status call.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to 71aab648925f31cde37efd31d79a7f3a977fd42a
This commit updates the EE repository reference after PR #480 was merged in windmill-ee-private.
Previous ee-repo-ref: b3e0000e2528809302c18f36930aebf3d004747a
New ee-repo-ref: 71aab648925f31cde37efd31d79a7f3a977fd42a
Automated by sync-ee-ref workflow.
* chore: update ee-repo-ref to indexer-disk-storage-zero branch
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update sqlx metadata and ee-repo-ref
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* [ee] chore: update tantivy from 0.24 to 0.26
- Rebase windmill-labs/tantivy fork onto upstream 0.26
- Bump serde pin from 1.0.219 to 1.0.220 (required by tantivy 0.26's time dependency)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to ec613f2db9e72e32e9131181546dcd679405a782
This commit updates the EE repository reference after PR #479 was merged in windmill-ee-private.
Previous ee-repo-ref: 920cf601b0651b7ba94493668ea051e00f3e74bf
New ee-repo-ref: ec613f2db9e72e32e9131181546dcd679405a782
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* fix: use /apps_raw/get/ redirect URL for raw apps set as workspace default
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update sqlx cache for default_app query
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: add selfApproval option to WAC waitForApproval + inline approval buttons
Add self-approval configuration to WAC workflows and inline
approve/reject buttons in WorkflowTimeline.
- TS SDK: add selfApproval option to waitForApproval()
- Python SDK: add self_approval param to wait_for_approval()
- Backend: store approval_conditions in flow_status for WAC,
enforce self-approval checks on resume endpoints
- Frontend: show Approve/Reject buttons in timeline with form
support (EE), gated by user permissions
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: revert sqlx query change + regenerate system prompts
- Revert get_suspended_flow_info to use original sqlx::query_as!
with COALESCE to avoid sqlx offline cache mismatch in CI
- Detect WAC by checking if FlowStatus parsing fails + suspend > 0
- Re-fetch flow_status column separately for WAC approval conditions
- Regenerate auto-generated system prompt files for SDK changes
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: use resume URLs for WAC inline approval buttons
- Backend generates HMAC-signed resume/cancel URLs when creating
WAC approval, stores them in timeline entry and approval meta
- Frontend uses anonymous resume endpoint (like classic flows)
with fallback to resumeSuspendedFlowAsOwner for admins
- Buttons show for everyone when URLs are present; server-side
self_approval_disabled check enforces restrictions
- Show warning for admins/owners when self-approval is disabled
- selfApproval: false requires EE (errors at dispatch on CE)
- self_approval_disabled check moved outside user_auth_required
gate so it works independently
- WAC detection no longer requires task import
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: add resume_suspended and approval_info endpoints
- New approval_token DB table for token-based approval access
- New POST /jobs_u/flow/resume_suspended/{job_id} endpoint:
- OptAuthed: works with login or approval_token
- Checks approval_conditions (self_approval, groups, auth)
- Admins/owners bypass rules
- New GET /jobs_u/flow/approval_info/{job_id} endpoint:
- Returns form, rules, can_approve status
- HMAC anonymous endpoint now bypasses all approval_conditions
(secret = full capability)
- getResumeUrls approvalPage URL now uses token format
- WAC approval dispatch generates and stores approval tokens
- Mark resumeSuspendedFlowAsOwner as legacy
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: simplify frontend to use resume_suspended endpoint
- OpenAPI spec updated with resume_suspended and approval_info endpoints
- WorkflowTimeline: removed URL parsing, now calls single
resumeSuspended endpoint for both approve and reject
- Buttons show for any logged-in user viewing the job (backend
enforces authorization rules)
- Kept self-approval warning for admins
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: stateless approval tokens, new approval page, FlowStatusWaitingForEvents update
- Replace DB-stored approval tokens with stateless HMAC derivation:
token = HMAC(workspace_key, job_id + "approval_token")
Verifiable without DB lookup, not reversible to resume secret
- Drop approval_token migration (no DB table needed)
- FlowStatusWaitingForEvents: use resumeSuspended endpoint instead
of URL parsing + resumeSuspendedFlowAsOwner
- New approval page route /approve/{ws}/{job}?token= that uses
approval_info and resume_suspended endpoints
- Old approval page route kept for back-compat
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: match old approval page content in new approval page
- Add FlowMetadata, JobArgs, FlowGraphV2, DisplayResult
- Add approvers with tooltips, flow arguments section
- Add admin self-approval bypass warning
- Add "Open run details" link
- Fetch full job alongside approval_info for all UI data
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: filter _MODULES from args, show 'workflow' for WAC approvals
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: remove deno template from approval/prompt SuspendDrawer
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: approval page form display + hide deno from approval script picker
- Fix form schema rendering on new approval page by wrapping flat
WAC form schemas in { properties, order } for SchemaForm
- Hide deno from the approval step language picker in flow editor
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: remove deno from canHaveApproval in script_helpers.ts
The insert menu uses canHaveApproval() from script_helpers.ts via
FlowInputsQuick, not the displayLang function in FlowInputs.svelte.
Revert the unnecessary FlowInputs.svelte change.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: return form schema and description in approval_info for classic flows
The approval_info endpoint was returning None for form_schema on
classic flows. Now fetches raw_flow to get suspend.resume_form
schema, hide_cancel, and the step's completed result for description.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: inline Login component on approval page instead of redirect
Show the Login component directly on the approval page when
authentication is required. On successful login, reloads user
and approval info without navigating away.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: show resume buttons for all users, not just owners
The resume_suspended endpoint handles authorization server-side,
so the frontend should always show the buttons. Remove isOwner
gate and the "cannot resume" message.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: prevent layout shift on resume by removing spinner from cancel button
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: prevent resume button expansion by using disabled instead of loading
The loading prop adds a Loader2 spinner that expands the button width.
Use disabled={loading} instead to prevent layout shift.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: approval page login redirects back with full page reload
Set rd to the full URL (starts with http) so Login.redirectUser()
uses window.location.href instead of goto(), triggering a full page
reload after login. This ensures the approval page re-fetches data
as an authenticated user.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: fetch flow definition from flow_version when raw_flow is null
Deployed flows don't store raw_flow on the job. Fall back to
flow_version table using runnable_id to get suspend settings
(form schema, hide_cancel) for the approval_info endpoint.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: show specific reasons when user cannot approve
Display whether denial is due to self-approval being disabled,
required group membership, or both.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: support both nested and flat form schema in waitForApproval
Users can now pass either:
waitForApproval({ form: { schema: { name: { type: "string" } } } })
or:
waitForApproval({ form: { name: { type: "string" } } })
Both WorkflowTimeline and approval page handle both formats.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: convert sqlx query macros to non-macro for CI offline cache
Replace sqlx::query! and sqlx::query_scalar! with sqlx::query and
sqlx::query_as to avoid SQLX_OFFLINE cache misses in CI.
Also remove unused LogIn import from approval page.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: suppress dead code warning + unused isOwner variable
- Add #[allow(dead_code)] to without_flow method (CI -D warnings)
- Rename isOwner to _isOwner in FlowStatusWaitingForEvents (unused)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: security and robustness fixes from PR review
- Add workspace_id verification in resume_suspended to prevent
cross-workspace approval (#3)
- Fix token leakage: use relative path for login redirect instead
of full URL with token (#4)
- Handle getJob failure independently from approval_info so the
page works for unauthenticated users (#7)
- Clear error state on successful data load (#13)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: address review feedback — shared token gen, rand resume_id, UX
- Move generate_approval_token to windmill-common::variables (shared
between windmill-api and windmill-worker, eliminates duplicate HMAC)
- Use rand::random::<u32>() for resume_id instead of DefaultHasher
- Stop polling after approve/reject on approval page
- Add cancelLoading state to WorkflowTimeline Reject button
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: add instance-level AI settings with workspace fallback
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat: add AI step to onboarding setup wizard
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: thread workspace prop through resource editor and disable chat offset
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Revert "fix: thread workspace prop through resource editor and disable chat offset"
This reverts commit 9fea9cc0c239f6432d1fef1487c45e74ab752e21.
* fix: set workspace store and disable chat offset during AI setup step
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: thread workspace and disableChatOffset props through resource editors
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: populate workspace and user stores for AI step path component
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: initialize AI clients for test key during onboarding
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* refactor: extract AI config state into InstanceAISettings component
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* refactor: move AI config state ownership into AISettings component
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Persist instance AI settings before navigation
* Reload effective workspace AI state after save
* Scope AI key tests to the rendered workspace
* Add post-create AI onboarding for new workspaces
* Unify instance AI settings header
* Fix instance AI drawer offset on workspace selection
* Add instance AI fallback settings behavior
* Update sqlx metadata
* Update sqlx metadata
* Clarify active instance AI in workspace settings
* Refresh workspace AI state after instance AI save
* Declare instance AI summary in API schema
* Normalize empty instance AI config handling
* Clean up workspace AI settings UI
* Unify AI config provider checks
* Split AI settings metadata from effective config
* Propagate instance AI cache invalidation across servers
* Fix AI settings dirty state tracking
* Update sqlx metadata
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* fix: use bind parameters for folder owner in jsonb_set queries
Replace format! string interpolation of owner into jsonb_set path
with proper $N bind parameters to prevent potential SQL injection.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref.txt
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: update ee-repo-ref to faeaa43bbe2ba4804f80b828b85fd4d6daef096c
This commit updates the EE repository reference after PR #477 was merged in windmill-ee-private.
Previous ee-repo-ref: 0d4444cb5825fa43629d856cc8565cc052512d4c
New ee-repo-ref: faeaa43bbe2ba4804f80b828b85fd4d6daef096c
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat: add flow group nodes core infrastructure
Add group data model (start_id/end_id boundary pairs), GroupEditor for
CRUD operations, groupDetectionUtils for membership computation and
validation, GroupedModulesProxy for reactive sync, and compound layout
support. Update openflow.openapi.yaml with group schema.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: add group UI components and rendering
Add GroupOverlay with bounding box and z-ordering, GroupHeader with
StepCountTab and ellipsis menu, GroupNodeCard, GroupNoteArea for inline
markdown notes, CollapsedGroupNode/CollapsedSubflowNode for collapsed
rendering, GroupEndNode/GroupHeadNode boundary markers, and group
actions in NodeContextMenu and SelectionBoundingBox.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: integrate groups into flow graph, builder, and existing components
Wire group support into FlowGraphV2 (overlays, collapsed rendering,
group-aware layout), graphBuilder (GroupedModule tree, container
collapse/expand, group boundary nodes), BaseEdge (drop targets for
group operations), ModuleNode (collapsed container rendering), and
flow map components (schema item grouping). Remove SubflowBound in
favor of CollapsedSubflowNode.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: remove banned $bindable(default) pattern and dead ternary
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* refactor: decouple collapse state from grouped module tree
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: pass groups prop to FlowGraphV2 and use GroupDisplayState via graphContext
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* refactor: remove group membership system, compute nesting depth from visual bounds
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* refactor: simplify GroupOverlay bounds, remove unused headerY and showNotes prop
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: populate innerNodeIds for expanded subflow overlay
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* refactor: remove expanded subflow overlay feature for separate PR
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: flatten groups in getContainerModules to prevent crash on collapsed containers
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: add drag-to-move support for group nodes
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: derive group boundaries from expanded membership to prevent splitting existing groups
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: catch group validation errors and display as flow graph alert
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* test: add unit tests for group validation in buildGroupedModules
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: reject virtual nodes (Input, Result, Trigger) from groups
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* test: add virtual node rejection tests for buildGroupedModules
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: exclude preprocessor and failure module from groups
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: disable Create group button when preprocessor is selected
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: reject selection entirely when it contains excluded nodes
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* refactor: remove unnecessary excludeIds from buildGroupedModules
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: remove debug console.log from FlowGraphV2
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: use cross-browser CSS grid trick for group summary input auto-sizing
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: hide group boundary edges and reformat GroupNoteArea
Hide edges between group header and first node, and between last node
and group-end, keeping them in the DOM but visually hidden.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* refactor: stop FlowGraphV2 from reading groups via groupEditorContext
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: show module previews with status, selection, and suspend popover in collapsed groups
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* refactor: extract collapsible implicit containers to separate branch
Remove collapse/expand functionality for implicit containers (forloops,
while loops, branches) from this branch. Backed up as
collapsible-implicit-containers-backup for later rebase.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* refactor: use original reactive modules for graph node data instead of proxy snapshots
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: prevent node loss when moving into forloop inside a group
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* refactor: replace GroupedModule proxy with structure-only FlowStructureNode tree
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: use "group-" prefix for group IDs instead of "note-"
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: update group boundaries when renaming a module ID
When a module at a group boundary (start_id or end_id) is renamed,
the group definitions now get updated before the reactive rebuild,
preventing stale references that would break the flow structure.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: update graph layout when removing a group note
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: add opaque background behind test run button to prevent see-through
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: detect and reject duplicate group IDs
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: simplify group creation validation with early marker normalization
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: use $state.raw in MiniFlowGraph to avoid xyflow performance warning
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* refactor: address code review feedback
- Revert backend traverse_modules change (not part of this feature)
- Use Map for node lookup in GroupOverlay (O(1) vs O(n) per group)
- Extract computeNodeExtraSpace to nodeExtraSpace.ts for testability
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* refactor: address PR review feedback
- Compute group depths from structure tree O(n) instead of O(n²) bounds comparison
- Remove unnecessary $derived(groups) in GroupOverlay
- Remove unused collapsed field from container types in OpenAPI spec
- Use NODE.width constant in GroupNodeCard instead of hardcoded 275px
- Add comment explaining intentional stale preservation in rebuild()
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: preserve flow groups during dependency job re-serialization
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: resolve Svelte state_referenced_locally warnings in GroupHeader and FlowGraphV2
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: show subflow groups when expanding a subflow in the graph
- Store both modules and groups when expanding a subflow
- Pass groups to buildStructureTree so group nodes render
- Include subflow groups in overlay rendering and collapse tracking
- Clone modules for prefix rewriting to avoid state_unsafe_mutation
- Register expanded subflow modules in moduleMap before prefix rewriting
- Disable group editing in expanded subflows and read-only views
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: restore accidentally removed code from main
- Restore subflowBound selection handling in selectionUtils
- Restore comments in SelectionBoundingBox
- Restore deletable={false} in FirstStepInputs
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* refactor: remove redundant adjacency check from MoveManager
The disableMoveIds check already prevents all invalid drop targets,
making the adjacencySourceId/adjacencyTargetId fields unnecessary.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: regenerate auto-generated files after OpenAPI schema change
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: regenerate cli skills after main merge
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: include groups in view_graph localStorage state
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* refactor: centralize canCreateGroup and replace group note with group creation
- Add canCreateGroup StateStore to GroupEditorContext, computed in FlowGraphV2
- Replace "Create group note" with "Create group" in FlowSelectionPanel
- Remove "Add note" from selection bounding box dropdown
- Remove unused NodeContextMenu component
- Wire createGroup through FlowModuleSchemaMap → FlowGraphV2
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: reject groups spanning parallel branches and surface ill-formed group errors
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: regenerate auto-generated files after main merge
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: ensure modules appears before groups in YAML export
Svelte 5's $state proxy registers groups as a tracked property before
it's explicitly set, causing it to appear before modules in Object.keys
iteration. Reorder the value object at export time for readable YAML.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* refactor: address second round of PR review feedback
- Add comment explaining duplicateMultiple bypasses structure tree
- Add warning log for inverted ranges in computeGroupModuleIds
- Use NODE.width constant in CollapsedGroupNode instead of hardcoded 275px
- Simplify redundant condition in getGroupsEmptiedBy
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* refactor: remove stored group ID, derive ephemeral key from start_id:end_id
Groups no longer store an `id` field. Instead, a `groupKey(g)` helper
derives an ephemeral key from `${start_id}:${end_id}` at read time.
This simplifies the schema while preserving all runtime functionality.
When boundaries shift (module deletion), runtime state (collapse,
note heights) is remapped to the new key via GroupDisplayState.remapGroupKey.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: add note button, save/cancel hints, and rename collapsed_by_default to autocollapse
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: propagate selection from collapsed group badges to external listeners
Pass eventHandlers to GroupModuleIcons so clicking a module badge
calls both selectionManager.selectId (visual highlight) and
eventHandlers.select (side panel propagation via onSelect).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: regenerate auto-generated files after main merge
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: hide In/Out popovers and actions during click-to-move
Replace isDragging with isMoving derived that covers both drag-move
and click-move states, disabling popovers, delete button, and test
run button during any move operation.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Git uses libcurl with GnuTLS on Debian, which doesn't read
SSL_CERT_FILE or CURL_CA_BUNDLE for CA trust. When the OTEL tracing
proxy is enabled, git clone fails with "certificate signer not trusted"
because it can't verify the proxy's MITM certificate.
Adding GIT_SSL_CAINFO pointing to the proxy CA cert fixes this.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* feat: add summary field for native triggers (nextcloud, google)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: add nullable to NativeTriggerData summary in openapi spec
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: include summary in native trigger search index
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: surface permissioned_as selector in trigger editor UI
Add OnBehalfOfSelector to TriggerEditorToolbar so users can see and
control who a trigger runs as. Admins/deployers can preserve the
current permissioned_as or pick a custom user; non-admins see the
current value but options are disabled.
Applies to all trigger types: schedule, kafka, http, websocket,
postgres, nats, mqtt, sqs, gcp, and email.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* refactor: move permissioned_as selector from toolbar to config area
Move OnBehalfOfSelector out of TriggerEditorToolbar (too cluttered)
into a new PermissionedAsLine component rendered at the top of each
trigger editor's config body. Lighter footprint, same functionality.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: show explicit warning when saving will change permissioned_as
Use an Alert (warning/info) to clearly show who the trigger currently
runs as and whether saving will change it. Non-admin users see a
warning that it will switch to them. Admins see the OnBehalfOfSelector
to preserve or pick a custom user.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: make permissioned_as line subtle instead of big alert box
Replace the Alert component with a small inline text line using
text-2xs. Shows warning arrow + yellow text only when saving will
actually change the permissioned_as.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: split permissioned_as display for admin vs non-admin
Admins see just "Permissioned as" label + the OnBehalfOfSelector
(no duplicate username). Non-admins see the plain text line with
warning arrow when it will change.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: show warning for admins too when permissioned_as will change
Admins now see a yellow warning next to the selector when their
choice differs from the current permissioned_as value.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: use consistent warning text for permissioned_as change
Both admin and non-admin warnings now say
"will change to <user> on save" instead of using an arrow.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: bold permission strings in permissioned_as warnings
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: bold the non-editable permissioned_as value too
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: remove mono font from non-editable permissioned_as value
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: add consistent bottom margin to permissioned_as line
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: consistent spacing for permissioned_as line
Move PermissionedAsLine outside the gap-8 div in schedule editor
and increase margin to mb-4 for consistent spacing across all
trigger types.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: clean up stale dependency map entries for renamed scripts
When a script is renamed, trigger_dependents_to_recompute_dependencies()
could find the archived script at the old path and create a dependency
job for it. This job would process the old code and recreate stale
dependency_map entries, causing incorrect deployment warnings.
Add `AND archived = false` to the script lookup query so that renamed
(archived) scripts at old paths trigger clear_map_for_item() cleanup
instead of spawning dependency jobs for obsolete code.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: also filter archived flows in trigger_dependents
Apply the same archived check to the flow lookup query. The flow table
has an archived column, so when a flow is renamed/archived its
flow_version rows would still be found. Join against the flow table
and filter archived = false to trigger cleanup instead.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* revert: remove unnecessary flow archived check
Flow renames delete the old flow row and INSERT a new one at the new
path (for FK constraints on flow_version). There is no archived flow
row left behind, so the original query is already correct for flows.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Replace unsafe string interpolation (format!("'{}'", t)) with
sql_builder::quote() in SQL query construction. The tags parameter in
count_completed_jobs_detail was directly interpolated without escaping,
allowing authenticated users to inject arbitrary SQL via the query string.
Also hardens LIKE clauses, JSON operators, and JOIN conditions across
query.rs and variables.rs that used manual .replace("'", "''") instead
of the crate's quote() function, and converts format-interpolated bind
values to parameterized queries where possible.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Show effective isolation level on workers page, not configured
The workers page displayed the configured isolation level (nsjail/unshare)
even when the binary wasn't actually available, which was misleading.
Now shows "none (nsjail unavailable)" or "none (unshare unavailable)"
when the setting is enabled but the binary failed its startup test,
so admins can immediately see the mismatch from the UI.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Simplify: use standard 'none' value when isolation binary unavailable
Keep the string as one of the 3 known values (nsjail/unshare/none)
since the frontend checks === 'none' for the warning badge. Now if
nsjail/unshare is configured but the binary is unavailable, it
correctly reports 'none' so the warning badge shows up.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Debounce node works
* sqlx prepare
* sqlx prepare
* fix: address PR review issues for flow node debouncing
- Add sibling check in parent-walking loop to avoid killing branchall siblings
- Remove stale .sqlx cache files from earlier iterations
- Remove single-variant FlowNodeDebounceResult enum, use Result<()>
- Parse flow value once in version guard, recurse into nested modules
- Fix Svelte reactivity when switching selected flow modules
- Fix Tab indentation in FlowModuleComponent
- Use integer types in OpenAPI spec for debounce fields
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* ee repo ref
* nit sqlx
* add Debouncing: None
* ee repo ref
* ee repo
* sqlx update
* fix: reject node-level debouncing inside branches (branchall/branchone)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Revert "fix: reject node-level debouncing inside branches (branchall/branchone)"
This reverts commit fa4820dde2.
* ee repo
* sqlx prepare
* sqlx prepare
* feat: add MIN_VERSION_SUPPORTS_NODE_DEBOUNCING (1.658.0) version guard
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* docs: mark node-level debouncing as EE only in openflow schema
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: guard node debouncing against parallel steps (len > 1)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* generate system prompts
* system prompts
* chore: update ee-repo-ref to c04f3851c03758662e4936ff4b6e71bc56dbae7e
This commit updates the EE repository reference after PR #451 was merged in windmill-ee-private.
Previous ee-repo-ref: d140bb8944dfe3efb23cf8c12f556eacf30e2f87
New ee-repo-ref: c04f3851c03758662e4936ff4b6e71bc56dbae7e
Automated by sync-ee-ref workflow.
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* SQL Query builders in Rust
* Remove frontend sql scripts and substitute at execution
* fix null value bug
* Handle WM_INTERNAL_DB marker for apps deployed prior
* Revert policy handling
* Fix database studio empty string as where clause
* check policy
* Revert "check policy"
This reverts commit 3ea7899979.
* Revert "Fix database studio empty string as where clause"
This reverts commit 432fc87915.
* Revert
* legacy comments
* Move DDL queries to backend
* tests
* move bigquery bun scripts to backend
* expand markers + other nits
* fix: escape sql literals in query builders and async preview sql
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: quote all user-supplied identifiers in query builders to prevent SQL injection
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: suppress dead_code warnings for deserialization-only fields and test-only helpers
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: correct DDL test assertions and drop_table schema handling for non-schema DBs
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* MySQL fix
* Fix 0/1 bool
* MySQL fix Yes/No casing
* Better error toasts
* Fix ms sql ntext cast
* fix: quote table name in Snowflake SHOW PRIMARY KEYS query
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: quote schema and table in Snowflake SHOW IMPORTED KEYS query
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: quote BigQuery dataset name in metadata query
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: remove invalid + separator in MSSQL CONCAT for count query
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* feat: add typed request body schema to OpenAPI spec for runnables without preprocessor
For HTTP routes and webhooks whose runnables (scripts/flows) don't have a
preprocessor, generate a typed request body in the OpenAPI spec using the
runnable's argument schema. Routes with preprocessors or wrap_body keep
the existing generic default request body.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix sqlx
* fix: add warning logs for schema fetch failures and strip non-OpenAPI keys
- Log tracing::warn when DB queries for schema fail instead of silently
swallowing errors with .ok()
- Strip $schema and order keys from the JSON Schema before embedding in
the OpenAPI spec for broader client compatibility
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: add tracing dependency to windmill-api-openapi
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Fix worker panic when job_isolation changed to unshare at runtime
When an admin changes the Instance Setting "job_isolation" to "unshare"
while UNSHARE_PATH was never initialized (binary not available at startup),
the worker panics in build_command_with_isolation().
This happens because reload_job_isolation_setting() in monitor.rs validates
nsjail availability but not unshare availability before applying the setting.
Fix:
- Add unshare availability check in reload_job_isolation_setting(), matching
the existing nsjail check
- Replace panic! in build_command_with_isolation() with an error log and
graceful fallback to running without isolation
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Improve error logging for unshare/nsjail unavailability at startup
- Upgrade unshare init logs from warn/debug to error level with detailed
diagnostics (exit code, stderr, common causes, impact on job isolation)
- Upgrade nsjail init logs from info/warn to error level with clear
messaging about unavailability consequences
- Force both UNSHARE_PATH and NSJAIL_AVAILABLE initialization at worker
startup (not just when isolation is currently enabled) so availability
is always logged regardless of current config
- Add explicit startup warnings when worker is configured for isolation
but the binary is unavailable, referencing the init errors above
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
