Windshift v0.5.0-rc2

Windshift v0.5.0-rc2

---

Suitable for small-scale production use.

Windshift is maturing and can now be used for small-scale production workloads. Be aware that APIs, data formats, and configuration may still change between releases without guaranteed migration paths. We recommend keeping backups and testing upgrades in a staging environment before applying them.

If you encounter issues or have ideas, please open an issue. Your feedback at this stage is incredibly valuable.

---

What's New in rc2

Security

• Fix user email exposure — Resolved an issue where user emails were exposed in portal comments and the V1 REST API.
• Public board item limit — Reduced the public board item limit from 1000 to 500.

Internationalization

• Chinese locale support — Added Chinese (zh-CN) locale.

Time Tracking

• Customer required for projects — Customer is now a required field when creating or editing projects.

UI Fixes

• Dark mode fix in asset manager — Corrected styling issues in the asset manager under dark mode.
• Public board improvements — Various polish and usability improvements to public boards.

Internal

• Workspace handler refactor — Workspace handler refactored to the repository pattern.
• About page scope reduced — Trimmed the about page to essential information.

---

Highlights (rc1)

Workspace Analytics

• Analytics dashboard — New workspace analytics page with cumulative flow, cycle time, and velocity charts.
• Monte Carlo forecast — Forecast panel using Monte Carlo simulation to project completion dates based on historical throughput.

Public Boards

• Shareable public links — Share a read-only board view via public link. No login required for viewers.
• Item detail modal — Two-column layout with description and comments on the left, properties sidebar on the right.
• Property display — Shows status, priority, type, assignee, due date, story points, and labels on public items.

Rate Limiter Improvements

• Per-user keying — Authenticated routes now key rate limits by user ID instead of IP address, preventing shared-IP users (NAT, office networks) from exhausting each other's buckets.
• Configurable IP limiting — New --disable-ip-rate-limit flag to disable IP-based rate limiting for unauthenticated requests.
• AI rate limit increase — AI endpoint rate limit raised from 5/min to 20/min.

Internal Comments

• Workspace setting — New internal_comments_enabled workspace setting for internal/private notes outside portal requests.
• Settings UI toggle — Enable or disable internal comments from workspace settings.
• Plugin comment creation — Host functions for plugin comment creation with SuppressNotifications option.

Upload Validation Hardening

• Stricter upload checks — Hardened file upload validation for attachments and logbook entries with additional content-type and size checks.

Collections & Navigation

• Collection breadcrumbs — Improved breadcrumb navigation for collections.
• Iteration timeline — New iteration timeline widget for visualizing iteration progress.
• Upcoming deadlines — Enhanced upcoming deadlines widget.

Permission Hardening

• Broader permission coverage — Additional permission checks across label, asset link, comment, and diagram handlers.

Windshift v0.5.0-rc1

Windshift v0.5.0-rc1

---

Not recommended for production use.

Windshift is an early release that is still undergoing internal testing. APIs, data formats, and configuration may change between releases without migration paths. We publish this release to invite early exploration, testing, and feedback - not to support production workloads.

If you encounter issues or have ideas, please open an issue. Your feedback at this stage is incredibly valuable.

---

Highlights

Workspace Analytics

• Analytics dashboard — New workspace analytics page with cumulative flow, cycle time, and velocity charts.
• Monte Carlo forecast — Forecast panel using Monte Carlo simulation to project completion dates based on historical throughput.

Public Boards

• Shareable public links — Share a read-only board view via public link. No login required for viewers.
• Item detail modal — Two-column layout with description and comments on the left, properties sidebar on the right.
• Property display — Shows status, priority, type, assignee, due date, story points, and labels on public items.

Rate Limiter Improvements

• Per-user keying — Authenticated routes now key rate limits by user ID instead of IP address, preventing shared-IP users (NAT, office networks) from exhausting each other's buckets.
• Configurable IP limiting — New --disable-ip-rate-limit flag to disable IP-based rate limiting for unauthenticated requests.
• AI rate limit increase — AI endpoint rate limit raised from 5/min to 20/min.

Internal Comments

• Workspace setting — New internal_comments_enabled workspace setting for internal/private notes outside portal requests.
• Settings UI toggle — Enable or disable internal comments from workspace settings.
• Plugin comment creation — Host functions for plugin comment creation with SuppressNotifications option.

Upload Validation Hardening

• Stricter upload checks — Hardened file upload validation for attachments and logbook entries with additional content-type and size checks.

Collections & Navigation

• Collection breadcrumbs — Improved breadcrumb navigation for collections.
• Iteration timeline — New iteration timeline widget for visualizing iteration progress.
• Upcoming deadlines — Enhanced upcoming deadlines widget.

Permission Hardening

• Broader permission coverage — Additional permission checks across label, asset link, comment, and diagram handlers.

Windshift v0.4.9

Windshift v0.4.9

---

Not recommended for production use.

Windshift is an early release that is still undergoing internal testing. APIs, data formats, and configuration may change between releases without migration paths. We publish this release to invite early exploration, testing, and feedback - not to support production workloads.

If you encounter issues or have ideas, please open an issue. Your feedback at this stage is incredibly valuable.

---

Highlights

Issue Sync (GitHub)

• Bi-directional GitHub issue sync — Sync GitHub issues into Windshift workspaces as work items. Status changes in Windshift push back to GitHub, and vice versa.
• Comment sync — GitHub issue comments pull into Windshift items. Comments added in Windshift push back to GitHub with author attribution.
• Status mapping — Map GitHub issue states (open/closed) to Windshift statuses with configurable reverse mappings for push-back.
• Label sync — Three modes: none, mapped (explicit label mapping), or mirror (auto-create matching labels).
• Filtering — Restrict sync scope to issues with specific GitHub labels.
• Assignee and milestone mapping — Map GitHub usernames to Windshift users and GitHub milestones to Windshift iterations.
• Manual and automatic sync — Trigger syncs manually or let them run on a schedule. Sync status and errors are visible in the settings UI.

Collection Improvements

• Stale data fix — Navigating back to a collection after editing its query now shows fresh results instead of stale cached data. The route guard, refresh merge strategy, and collection cache have all been reworked.
• Server-side sorting — Collection list view now supports sortable columns. Sort requests are sent to the backend for correct ordering across pages.
• Pagination safety — The list view no longer shows a stale pagination bar (e.g., "337 results") when the items array is empty.
• Reactive board and backlog — Board and backlog views now derive data directly from the central collection store instead of maintaining local copies, eliminating an entire class of sync bugs.

Capability Manager

• New admin UI — Manage action capabilities including Docker container environments (image, memory, CPU, network), HTTP client configuration (URL patterns, headers, timeouts), and LLM connection settings.

AI Safety

• Prompt injection defense — AI-powered features now wrap user-provided content with injection defense markers, instructing the LLM to treat wrapped content as data extraction targets rather than executable instructions.

Windshift v0.4.8

Windshift v0.4.8

---

Not recommended for production use.

Windshift is an early release that is still undergoing internal testing. APIs, data formats, and configuration may change between releases without migration paths. We publish this release to invite early exploration, testing, and feedback - not to support production workloads.

If you encounter issues or have ideas, please open an issue. Your feedback at this stage is incredibly valuable.

---

Highlights

Portal Improvements

• Unified header across all views — Replaced the separate hamburger menu and compact request-view header with a single persistent header bar showing logo, title, settings, and profile across both the portal home and My Requests views.
• Inline edit mode — Added a fixed edit bar at the top of the viewport with a "Done" button. The portal header shifts down automatically to avoid overlap. Edit mode can also be toggled from the customize panel sidebar.
• Post-submission redirect — After submitting a request through the portal, users are now automatically taken to the request detail view instead of staying on the form.
• Open request badge — The "My Requests" button in the header now shows a count of open (non-completed) requests. Badge count loads on page load rather than only when navigating to the requests view.
• Status badges in My Requests — Request lists and detail views now display colored status badges (using status category colors) instead of plain text labels. Completed requests appear dimmed in the list.
• Customize panel updates — Edit mode toggle added to the customize panel sidebar. The modal backdrop is hidden while in edit mode so the portal remains interactive. An info banner indicates when edit mode is active.

Security

• Input sanitization — Added SanitizeTitle() and SanitizeCommentContent() to 8 backend handlers: statuses, priorities, link types, projects, iterations, test sets, time customers, and personal labels.
• XSS fixes — Replaced inline HTML injection with shared escapeHtml() in TestRunDetail and TimeReports print templates. Added server-side sanitization for test run names.
• CSRF Origin/Referer fallback — CSRF middleware now falls back to checking Origin and Referer headers when the Sec-Fetch-Site header is stripped by reverse proxies. Extracted a shared buildAllowedOrigins helper with full test coverage.

Windshift v0.4.7

Windshift v0.4.7

---

Not recommended for production use.

Windshift is an early release that is still undergoing internal testing. APIs, data formats, and configuration may change between releases without migration paths. We publish this release to invite early exploration, testing, and feedback - not to support production workloads.

If you encounter issues or have ideas, please open an issue. Your feedback at this stage is incredibly valuable.

---

Highlights

MCP Server (Model Context Protocol)

Windshift now ships a built-in MCP server at /mcp, enabling AI assistants and external tools to interact with your workspace programmatically. The server uses stateless Streamable HTTP transport with Bearer token authentication.

Available tool categories:

• Items — list, get, create, update, delete, search, and get children of work items
• Workspaces — list and inspect accessible workspaces
• Comments — list and add comments on work items (plain text or TipTap JSON)
• Labels — list workspace labels and assign them to items
• Time Tracking — list projects, manage worklogs, start/stop timers

Integrated Terminal

The terminal panel has been overhauled into a full multi-tab terminal experience. In the Tauri desktop app it spawns native PTY sessions; drag-and-drop a work item into the terminal to generate a task prompt. The tab bar shows workspace info and ws.toml configuration status.

A new WsTomlProvisioner overlay guides first-time setup: one-click token generation, server URL configuration, and ws.toml creation for CLI authentication in project directories.

Collection Navigation Sidebar

A new dedicated sidebar appears when viewing a collection. It shows the collection name, available views (Backlog, Board, List, Tree, Map, Roadmap), and a backlog count badge. The sidebar is collapsible to a 48px icon-only rail and resizable between 180–320px.

Customer & Organisation Management

The Customers page has been restructured around organisations:

• Organisation detail view with tabs for Contacts, Files, and Tickets
• Contact detail view with tabs for Overview, Submissions, and Channels, plus inline editing and custom field support
• Left sidebar with organisation search and drag-and-drop contact-to-organisation assignment
• Document grid with thumbnails, status badges, and upload source tracking

---

New Features

• ChipPicker component — compact, searchable pill-shaped dropdown with keyboard navigation, used in the create modal and elsewhere
• Workspace path store — tracks workspace folder paths with localStorage persistence and ws.toml detection status
• Create modal improvements — stepped navigation (Type → Workspace → Item type) using ChipPicker, parent item support for child creation
• Collection view switcher — tab-style switcher with backlog count badge and context-aware styling
• Workspace data store auto-refresh — automatic 5-minute refresh intervals with granular field invalidation and race condition protection on workspace switches
• Logbook customer org filter — customer_organisation_id query parameter on GET /rest/api/v1/logbook/documents filters documents by organisation

Bug Fixes

• Empty collection query fallthrough — collections with no filter rules no longer fall through to workspace-level queries; they correctly return empty results
• Logbook model completeness — customer_organisation_id and portal_customer_id fields are now included in document queries and API responses

API Changes

• Added GET /mcp, POST /mcp, DELETE /mcp endpoints for the MCP server
• Added customer_organisation_id query parameter to GET /rest/api/v1/logbook/documents
• Added customer_organisation_id and portal_customer_id fields to logbook document responses

Removed

• CompactWorkspaceSelector — removed in favour of ChipPicker-based selection in the create modal

Windshift v0.4.6

Windshift v0.4.6

---

Not recommended for production use.

Windshift is an early release that is still undergoing internal testing. APIs, data formats, and configuration may change between releases without migration paths. We publish this release to invite early exploration, testing, and feedback - not to support production workloads.

If you encounter issues or have ideas, please open an issue. Your feedback at this stage is incredibly valuable.

---

Highlights

Fixed CLI Status Filtering

Status filtering in the CLI (ws task list -s done, ws task mine -s ~done) was silently broken because aliases stored status names instead of numeric IDs. The server's status_id parameter requires an integer, so name-based values were quietly ignored. Aliases now store numeric status IDs, and a fallback mechanism queries the server's completed-statuses endpoint when aliases are stale or missing.

Status Exclusion Filter (~done)

The CLI's negation syntax (-s ~done) now works end-to-end. A new status_id_not query parameter has been added to the items API, enabling server-side exclusion of a specific status.

Completed Statuses Endpoint

A new GET /rest/api/v1/workspaces/{id}/statuses/completed endpoint returns only statuses where the category is marked as completed. This powers the CLI's fallback resolution and is available for any integration that needs to identify "done" statuses programmatically.

ws config refresh Command

A new ws config refresh subcommand re-fetches workspace statuses from the server and regenerates status aliases with numeric IDs in ws.toml. Use this after renaming statuses on the server to keep your local aliases in sync.

---

Bug Fixes

• Status filter silently ignored: ws task list -s done now correctly sends numeric status IDs to the server instead of status names that fail strconv.Atoi silently
• Negation filter no-op: ws task list -s ~done now excludes the specified status via the new status_id_not server-side filter
• Stale alias resilience: If a status is renamed after ws init, the CLI falls back to the completed-statuses endpoint to resolve "done" dynamically

API Changes

• Added status_id_not query parameter to GET /rest/api/v1/items for excluding items by status
• Added GET /rest/api/v1/workspaces/{id}/statuses/completed endpoint

Windshift v0.4.5

Windshift v0.4.5

---

Not recommended for production use.

Windshift is an early release that is still undergoing internal testing. APIs, data formats, and configuration may change between releases without migration paths. We publish this release to invite early exploration, testing, and feedback - not to support production workloads.

If you encounter issues or have ideas, please open an issue. Your feedback at this stage is incredibly valuable.

---

Highlights

Improved Onboarding for Non-Admin Users

The onboarding flow now handles non-admin users who already have access to a workspace. Previously, these users could get stuck in the onboarding process; they are now guided directly into their available workspace.

Searchable Multi-Select for Iteration Filters

The CQL iteration IN / NOT IN filter UI has been upgraded from a plain checkbox list to a searchable multi-select dropdown, making it much easier to work with long lists of iterations.

Resizable Collections Sidebar

The collections sidebar can now be resized by dragging a handle on its edge, giving you control over how much screen space it occupies.

Workspace Key Cache

Workspace key resolution no longer requires a database lookup on every request. Keys are now cached in memory, improving response times for all workspace-scoped API calls.

---

Bug Fixes

• CQL Iteration Filter: Fixed iteration IN / NOT IN queries and corrected user group name resolution in CQL
• PostgreSQL Notification Settings: Fixed notification settings queries and the config set admin page failing on PostgreSQL

Other Changes

• Split large handler files into smaller, focused modules (planning, Jira importer, SCM, portal, AI)

Windshift v0.4.4

Improvements

• Logbook Container Image - The logbook service is now published to ghcr.io/windshiftapp/logbook with the same version tags as the main image, built in parallel across both CI/CD and the release script

Windshift v0.4.3

Windshift v0.4.3

---

Not recommended for production use.

Windshift is an early release that is still undergoing internal testing. APIs, data formats, and configuration may change between releases without migration paths. We publish this release to invite early exploration, testing, and feedback - not to support production workloads.

If you encounter issues or have ideas, please open an issue. Your feedback at this stage is incredibly valuable.

---

Highlights

Team Management

Create and manage teams with member assignments. Teams can be used in automation actions for round-robin task assignment, distributing work evenly across team members.

Round-Robin Assignment Action Node

A new automation action node (round_robin_assign) allows automatic assignment of items to team members in a rotating fashion. Supports skipping members who are on leave and using leave substitutes.

Hotkey & Modal Focus Fixes

Fixed an issue where global keyboard shortcuts (e.g., the 'c' create shortcut) could fire while a modal dialog was open, causing the dialog to appear to close unexpectedly. Three layers of defense were added:

• Hotkeys on buttons behind an open modal are now automatically blocked
• Keyboard events inside modals no longer propagate to global listeners
• Dropdown menus no longer incorrectly send focus to the document body on close

Terminal Panel Restricted to Desktop App

The terminal navigation link in the sidebar is now only visible when running inside the Tauri desktop app, where it is actually functional.

---

Bug Fixes

• Custom Field Dialog: Fixed dialog closing when typing after selecting a field type from the dropdown
• Dropdown Focus: Removed erroneous blur() call that sent focus to document.body when closing a dropdown menu

Other Changes

• Removed Playwright e2e test suite and related dependencies
• Added teams.manage permission for team administration

Windshift v0.4.2

Features

• Webhook Payload Consistency - Webhook payloads now use the REST API v1 DTO format for consistent structure across integrations
• Channel Config Testing - Webhook channel test endpoint now accepts the current config for live testing before saving

Improvements

• User Read Service - Centralized user queries (ListAll, CountActive) into a dedicated service, reducing duplication across handlers, auth policy stats, and briefing scheduler
• ws CLI Paginated Responses - Fixed workspace and milestone list commands to correctly parse paginated server responses
• ws CLI Non-Interactive Config - ws config init now supports non-interactive mode when --url and --token flags are provided
• Unified Version Management - Added VERSION file as single source of truth; release builds inject version, commit, and build date via ldflags

Fixes

• SCIM Deactivation - Fixed accidental user deactivation during SCIM provisioning
• SCIM Unique Constraint - Resolved unique constraint violation during SCIM user sync
• Workspace Item Scoping - Work items are now correctly limited by workspace