* fix: add CORS headers to static assets for iframe context sharing
Add Cross-Origin-Opener-Policy, Cross-Origin-Embedder-Policy, and
Cross-Origin-Resource-Policy headers to static assets served by the backend
to match the vite preview config. This enables the TypeScript worker to work
correctly when ui_builder is loaded in an iframe.
Fixes#7453
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* fix: add CORS headers only for /apps_raw paths and force reload on navigation
- Only add Cross-Origin-Opener-Policy, Cross-Origin-Embedder-Policy, and
Cross-Origin-Resource-Policy headers for /apps_raw/ paths (not all static assets)
- Add frontend navigation handler to force page reload when navigating from
non-apps_raw paths to /apps_raw/add or /apps_raw/edit
- This ensures the TypeScript worker works correctly while avoiding CORS issues
for external iframe embeds in other parts of the app
Co-authored-by: Ruben Fiszel <rubenfiszel@users.noreply.github.com>
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
* fix: also reload when navigating from /apps/get_raw/ to apps_raw editor
When viewing a raw app at /apps/get_raw/, the cross-origin isolation
headers are not present. Force a page reload when navigating from
this path to /apps_raw/add or /apps_raw/edit to ensure the headers
are fetched from the server.
Co-authored-by: Ruben Fiszel <rubenfiszel@users.noreply.github.com>
* Update +layout.svelte
---------
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Ruben Fiszel <rubenfiszel@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* Put back banner a new tutorial is available for a user that completed all his tutorials and never skipped all
* Create onboarding tutorial for operators in tutorial config file
* Add router and steps for onboarding tutorial for operators
* Improve onboarding tutorial for operators
* Improve the tutorial UX
* Refactor
* Remove cursor from last step of operator onboarding tutorial
* Improve filtering per role
* Add Runs page tutorial
* Improve Runs page tutorial
* Add failed run
* Simplify Runs tutorial with job clicks into one unique step
* Finish overall structure of Runs tutorial
* Improve wordings
* Prevent breaking animations by clicking on Next or Previous
* Add success and failure logo to step title
* Improve wording
* Create util function for moving cursor
* Nits
* Improve wordings
* Differentiate successfull and failed jobs steps
* Remove delete flows if operator to prevent permission errors
* Add comment
* feat(aichat): add get_lint_errors tool for script and flow mode
This adds a new `get_lint_errors` tool to the AI chat for script and flow modes,
similar to what exists for app mode.
For script mode:
- Added `getLintErrors` function to Editor.svelte that returns lint errors from Monaco
- Added `ScriptLintResult` and `ScriptLintError` interfaces
- Added `get_lint_errors` tool definition and implementation
- Updated system prompt to instruct AI to use the tool after code changes
For flow mode:
- Added `FlowLintResult` interface for flow-level lint results
- Added `get_lint_errors` tool that gets lint errors from the currently selected module
- Updated system prompt to include linting in the tool selection guide
The AI is now instructed to always use `get_lint_errors` after making code changes
and fix any errors before proceeding with testing.
Closes#7430🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* fix for script
* fix for flow
* cleaning
* fix DatatableCreationPolicy
---------
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Co-authored-by: centdix <farhadg110@gmail.com>
* fix frontend
Signed-off-by: pyranota <pyra@duck.com>
* chore: update ee-repo-ref to 5c2a8854e7ff014063a69dd8f7829a935129c31e
This commit updates the EE repository reference after PR #370 was merged in windmill-ee-private.
Previous ee-repo-ref: 8c75fc5b1372a790dc74b374cd72f9caf51a4595
New ee-repo-ref: 5c2a8854e7ff014063a69dd8f7829a935129c31e
Automated by sync-ee-ref workflow.
---------
Signed-off-by: pyranota <pyra@duck.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* refactor(ai): use responses API for OpenAI/Azure, create 'other' provider for completion endpoint
- Created new 'other.rs' provider using the OpenAI-compatible completion endpoint
- Refactored 'openai.rs' to use the Responses API for both text and image output
- Updated query_builder to route OpenAI/AzureOpenAI to OpenAIQueryBuilder
- All other providers (Mistral, DeepSeek, Groq, etc.) now use OtherQueryBuilder
- Updated OpenRouter to delegate to OtherQueryBuilder instead of OpenAIQueryBuilder
This prepares the codebase for adding websearch tool support using the Responses API.
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat(ai): add websearch as AI agent tool type
- Added WebsearchToolValue to ToolValue enum in flows.rs
- Updated all pattern matches to handle websearch tool type
- Added has_websearch parameter to run_agent function
- Websearch tools don't require additional configuration
This prepares the backend for provider-specific websearch implementations.
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat(frontend): add websearch as tool option in AI agent UI
- Added WebsearchTool type and utility functions to agentToolUtils.ts
- Added "Web Search" option in tool insertion menu (InsertModuleInner)
- Updated NewAIToolNode to handle pickWebsearchTool event
- Updated AIToolNode to render websearch tools properly
- Updated FlowModuleSchemaMap to create websearch tools
Users can now add websearch tools to AI agents through the UI.
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat(ai): implement websearch for OpenAI provider
- Added has_websearch parameter to BuildRequestArgs
- OpenAI provider now adds web_search tool to requests when enabled
- Uses OpenAI Responses API web_search tool type
- Websearch tool is added before other custom tools in the request
Implements websearch functionality for OpenAI and Azure OpenAI providers.
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat(ai): implement websearch for Anthropic provider
- Created anthropic.rs provider with native Anthropic API format
- Added web_search tool to Anthropic requests when enabled
- Anthropic uses /messages endpoint with x-api-key authentication
- Updated query_builder to route Anthropic to new provider
Implements websearch functionality for Anthropic Claude models.
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* feat(ai): implement websearch for Gemini/GoogleAI provider
- GoogleAI now uses completion endpoint (other.rs) for text instead of responses API
- Added Google Search grounding when websearch is enabled
- Uses google_search_retrieval tool in request when has_websearch is true
- Updated parse methods to use OtherQueryBuilder for completion endpoint
Implements websearch functionality for Google Gemini models.
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* fix frontend
* fix anthropic and openai
* better for gemini
* structured output
* cleaning
* fix validate tool
* fixes
* cleaning
* cleaning
* fix for openai
* no responses api for azure
* fixes
* fix
* add tests for ai agent
* avoid panic
* better tests
* test user images
* fix tool choice
* always use streaming backend side
* big cleaning
* show annotations plus agent action for open ai websearch use
* show annotations plus agent action for anthropic websearch use
* show annotations plus agent action for google websearch use
* nit forntend
* rm
* fix
* add test for image ouptut
* fix for azure
* add in openflow
* fix
* fix
* nit tests
* fixes
---------
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Co-authored-by: centdix <farhadg110@gmail.com>
* handle messages array for ai agent
* better
* nit
* make tool_calls and tool_call_id nullable
* fix empty json behavior
* nits
* cleaning
* feat(backend): replace messages/messages_context_length with history oneOf field
Replace the separate 'messages' array and 'messages_context_length' fields with
a single 'history' field that uses a oneOf discriminator.
The 'history' field can be either:
- 'auto' mode: automatically manages conversation history with memory, takes a
'context_length' number parameter
- 'manual' mode: bypasses memory and uses explicitly provided messages array
Backward compatibility is maintained: if 'messages_context_length' is provided
in the old schema format, it is automatically converted to 'auto' mode with the
specified context_length.
Co-authored-by: centdix <centdix@users.noreply.github.com>
* feat(frontend): replace messages/messages_context_length with history oneOf field
Replace the separate 'messages' array and 'messages_context_length' fields with
a single 'history' field in the AI agent schema.
The 'history' field uses a oneOf discriminator with two modes:
- 'auto': { mode: 'auto', context_length: number } - automatically manages
conversation history with memory
- 'manual': { mode: 'manual', messages: array } - bypasses memory and uses
explicitly provided messages
The schema includes comprehensive descriptions for each mode explaining the
behavior. The order array has been updated to include 'history' in place of
the old 'messages_context_length' and 'messages' fields.
Co-authored-by: centdix <centdix@users.noreply.github.com>
* fix(frontend): add support for 'mode' discriminator in oneOf rendering
Update ArgInput.svelte to properly handle oneOf schemas that use 'mode' as the
discriminator field, in addition to the existing 'kind' and 'label' support.
Changes:
- Updated tagKey derivation to check for 'mode' first, then 'kind', then 'label'
- Added 'mode' to the onOneOfChange function to track mode changes
- Added 'mode' to the list of keys excluded from enum validation
- Added 'mode' to hiddenArgs to prevent it from being shown in the form
- Added title fields to the history oneOf variants in flowInfers.ts
This allows the AI agent's history field to properly render with toggle buttons
for 'auto' and 'manual' modes.
Co-authored-by: centdix <centdix@users.noreply.github.com>
* fixes
* frontend fix
* nit
* cleaning
* cleaning
* better
* reword
* reword
---------
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: centdix <centdix@users.noreply.github.com>
* Fix MS SQL Numeric rounding
* Fix result collection to avoid JSON parsing
* don't reparse json through sqlx, pass raw string to postgres
* Revert "don't reparse json through sqlx, pass raw string to postgres"
This reverts commit 355691fa7d.
* mistake
---------
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
* fix: Migrate to astral-tokio-tar to address CVE-2025-62518
Migrates from the abandoned tokio-tar library to the actively maintained astral-tokio-tar to address CVE-2025-62518 (TARmageddon), a high-severity RCE vulnerability (CVSS 8.1). The vulnerability involves a boundary-parsing bug in PAX/ustar header handling that enables file smuggling attacks via malicious TAR archives.
This is a drop-in replacement requiring only dependency updates in Cargo.toml files. The astral-tokio-tar library uses the same tokio_tar module name, so no source code changes are needed. All references to the vulnerable tokio-tar v0.3.1 have been removed from Cargo.lock and replaced with the patched astral-tokio-tar v0.5.6.
Related to previous PR #6943 which was closed due to CLA issues. Security disclosure available at https://edera.dev/stories/tarmageddon and patch details at https://github.com/astral-sh/tokio-tar/releases/tag/v0.5.6
* update
---------
Co-authored-by: Devdatta Talele <devtalele0@gmail.com>
Co-authored-by: Devdatta Talele <50290838+devdattatalele@users.noreply.github.com>
* data tables settings ui
* install runed
* zod 4 fixes
* use new toJSONSchema
* Migrate ducklake catalogs to more generic custom instance databases
* fix compilation
* Safety conversion for old duckdb ffi
* data tables settings
* ts client basis
* inline run works
* datatables work
* Revert "datatables work"
This reverts commit 6e1588d59e.
* datatables work (without leaking pg credentials)
* println
* separate sqlUtils.ts
* nit
* Separate custom instance db Select and Wizard components
* nit
* nit wording
* add tags to custom instance dbs
* error when trying to use ducklake as datatable or opposite
* show status in dropdown
* data table instance setup works
* sqk function for ducklake
* factorize logic
* fix temp reactivity
* Data table assetexplore
* Migrate S3 permissions to modal
* Revert "Migrate S3 permissions to modal"
This reverts commit 0631d03cb0.
* nit query -> fetch
* Custom instance setup new look
* run_language_executor separate fn
* run_inline param
* nit wording
* Better typed client
* Data tables display as assets in frontend
* asset db icon
* nit
* cleaner errors
* nit
* Fix sed calls in mac
* run_inline_script_preview in python client
* basic python datatable client
* datatable and datalake parser in python
* ducklake client python
* nit fix
* Fix migration producing NULL instead of {} when no custom databases
* merge conflict fail
* python ducklake client arg fix
* parse or infer sql types in ts client
* ts asset parser, detect datatable & ducklake R/W
* fix sql repl for other read ops than select
* export type SqlTemplateFunction
* rename list_custom_instance_pg_databases
* typecheck datatable and ducklake name in Typescript
* Fix typecheck datatable and ducklake in TS
* declare module overriding instead of extending
* infer_sql_type in python client
* SqlQuery object in python
* fix merge conflicts
* update const_format
* CI fix
* factor out to var_identifiers
* sqlx prepare
* unnecessary security (admin is required)
* clearer comment
* ee repo ref
* nit snake case
* claude step 1: detect var declarations
* move detect_sql_access_type to common mod
* claude step 2: detect when saved vars are queried
* Revert "claude step 2: detect when saved vars are queried"
This reverts commit 1e1f930568.
* Revert "claude step 1: detect var declarations"
This reverts commit f866f4819d.
* remove ducklake/datatable and default
* detect data table assigns in var_identifiers
* Python parser successfully infers R/W/RW from ducklake / datatable
* still register ducklake/datatable if not used as unknown R/W
* Go to settings button in Assets Dropdown on not found
* nit
* sqlx prepare fail
* manual fix, somehow sqlx prepare won't do it
* fix frontend ci
* ee repo ref
* ducklake_user doesnt exist in unit tests
* nit fix
* ui nit
* nit
* nit missing clone
* fork ducklakes and datatables
* fix surface hover bug
* stupid mistake
* better deeply reactive mutable derived
* Ducklake picker
* Editor bar data tables
* DuckDB supports datatables
* datatable in duckdb asset parser
* duckdb asset parser var_identifiers
* Revert "duckdb asset parser var_identifiers"
This reverts commit 88068b1a77.
* sqlx prepare
* Box pin in test_workflow_as_code to fix stack overflow
* stash
* sql asset parser parses most s3 literals
* nit
* Detect attach + handle returning RW
* detect assets used with dot notation
* detect implicit access with USE dl; syntax
* Add assets as unknown if var was never used
* Support default ducklake/datatable main in parser
* ignore asset parsing errors in frontend (avoid flow layout shift)
* super weird duplication (merge conflict ?)
* nits
* fix duckdb parser detecting too much as asset when RW ctx is unknown
* fix transparent assets btn
* missing arg
* nit styling
* asset parser specific table parsing
* fix resource specific table parsing
* More concise asset display in flows + better icons
* fix assets page filtering out resources with added table
* Fix frontend to support specific table assets
* Open DB Manager to specific table
* Specific table parser in Python and TS + unit tests
* Fix UPDATE setting access to None
* fix flow edge rendering on top of output picker
* python parser fix var override bug
* add ts test
* fix compilation
* sqlx prepare
* update parsers version
* fix missing schema key onDelete
* Grant permission to create schemas in custom instance databases
* Update pg query to return empty schemas
* Create schema
* Select nits
* support schemas in sql parser
* ts parser handle schema with sql parser result
* detect .schema() syntax
* detect schema syntax in python
* support .schema() in ts and py SDK
* open db manager to specific schema
* support reassignment in ts parser
* nit better unitest
* : syntax in ts
* datatable:schema syntax in python
* fix client py
* nit select dropdown darkmode
* object | null fetchOne
* ts client nits
* parse_sql_client_name fn
* getImportWmillTsStatement refactor in EditorBar
* text to json() in python client
* update parser versions
* pkg lock
* Sql query details in TS asset parser
* code transformation with type parameter in Editor
* Custom Language Worker, code substition works !
* Error marker mapping works
* hover info is correct
* completions work correctly
* other overrides
* type inference kinda works
* Position mapping tests
* refactor prepare_queries
* Refactor PgDatabase to share common code
* Pgdatabase in prepare_queries
* TokioPgConnection refactor
* refactor prepare_queries
* type parameter to sql function
* Fix deadlock
* nit fix
* Fix worker async call freezing because of svelte Proxy
* Force worker to recompute when we set queries
* nit refactor
* nits console logs
* wait that ts worker initialize
* monaco change file version
* update diagnostics
* Refactor for errors
* Show SQL errors in Monaco
* improve sdk
* cleaning refactor + MapResource + usePreparedAssetSqlQueries
* Fixes
* Fix error position mapping
* cache in typescript worker
* fix insert no values
* don't inject type if already present
* Support schema in prepare queries
* update parsers
* ChangeOnDeepInequality
* inferAsset ScriptEditor usage refactor
* sql query typecheck work in flow editor
* Assets and SQL Query check in Raw App Inline Editor
* pkg lock
* Fix DatatableSqlTemplateFunction nit
* prepare query schema nit
* duplicate diagnostics
* nit getScriptVersion mock
* Reprepare queries when switching workspaces
* nit fix
* nit fix
* fetch_one_scalar and execute in python client
* limit pg_connections
* -- prepare flag in postgres
* skip serializing
* fix destructuring undefined
* Prepare queries in workers instead of backend
* nit
* Execute search_path instructions normally
* nit fix
* Fix SET search_path issue in prepare
* only support preparing single-statement queries for now
* update parsers
* safety
* better remove_comments
* Fix getQueryStmtCountHeuristic
* getQueryStmtCountHeuristic tests
* comment out failing tests
* Fix getQueryStmtCountHeuristic impl
* only datatable
* Fix Python Enum and Literal schema generation with docstring descriptions
- Extract Enum class definitions and their string values
- Parse docstring Args: sections for parameter descriptions
- Map Enum type annotations to string enums with proper values
- Handle Enum.VALUE default values correctly
- Store descriptions in Arg.otyp field
- Add test case for enum with docstring parsing
* perf: optimize enum parser and fix default value handling
- Combine enum extraction and docstring parsing into single AST pass (2x performance improvement)
- Add support for IntEnum, StrEnum, Flag, IntFlag types
- Fix default values to use actual enum values (e.g., 'red') instead of member names (e.g., 'RED')
- Improve docstring parsing robustness with proper indentation tracking
- Clean up code structure with EnumInfo type for better maintainability
All tests pass. This addresses code review feedback for performance and correctness.
* perf: implement true lazy evaluation for enum parsing
- Only parse metadata when unknown types encountered
- Two-pass approach: parse types first, extract only if needed
- Zero overhead for scripts without enums
- Keyword checks + prepass filtering when extraction needed
* improve collapsible link
* do not show superadmin ws link when already in it
* improve OAuth UI
* sso/oauth instance settings ui
* refactor instance settings alerts WIP
* Indexer and Oauth to brand guidelines
* refactor ws error handler page
* Create a tab SMTP in the Instance Settings
* Ractivity isssue fix for tabs
* nit
* Add smtp settings status in Error handler
* Add smtp configuration status
* Display teams connection status for instance alerts
* nit
* Add critical alerts description
* nit
* nit
* improve ee display
* nit
* nit
* fix typo
* nit
* restore vit config
---------
Co-authored-by: Alexander Petric <alex@windmill.dev>
* fix: teams, need both guid and thread id format
* chore: update ee-repo-ref to 576abf6519d1aa12a2b989a58a123501206284fb
This commit updates the EE repository reference after PR #368 was merged in windmill-ee-private.
Previous ee-repo-ref: ae41589212f16ff0cec8516c66227f30e17c5564
New ee-repo-ref: 576abf6519d1aa12a2b989a58a123501206284fb
Automated by sync-ee-ref workflow.
---------
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
