Merge remote-tracking branch 'upstream/development' into development

Author: github-actions[bot]

.claude/hooks/audit-log.sh

@@ -13,9 +13,9 @@ set -uo pipefail
 # ---------------------------------------------------------------------------
 INPUT="$(cat)"
 
-TOOL_NAME="$(printf '%s' "$INPUT" | python3 -c "import sys,json; print(json.load(sys.stdin).get('tool_name','unknown'))" 2>/dev/null || echo "unknown")"
+TOOL_NAME="$(printf '%s' "$INPUT" | jq -r '.tool_name // "unknown"' 2>/dev/null || echo "unknown")"
 
-COMMAND="$(printf '%s' "$INPUT" | python3 -c "import sys,json; print(json.load(sys.stdin).get('tool_input',{}).get('command',''))" 2>/dev/null || echo "")"
+COMMAND="$(printf '%s' "$INPUT" | jq -r '.tool_input.command // ""' 2>/dev/null || echo "")"
 
 # ---------------------------------------------------------------------------
 # 2. Determine log file path (relative to project root)

.claude/hooks/validate-bash-command.sh

@@ -14,14 +14,15 @@ set -euo pipefail
 # ---------------------------------------------------------------------------
 INPUT="$(cat)"
 
-TOOL_NAME="$(printf '%s' "$INPUT" | python3 -c "import sys,json; print(json.load(sys.stdin).get('tool_name',''))" 2>/dev/null || true)"
+TOOL_NAME="$(printf '%s' "$INPUT" | jq -r '.tool_name // ""' 2>/dev/null || true)"
 
-# Only validate Bash commands — allow everything else through
-if [[ "$TOOL_NAME" != "Bash" ]]; then
+# Only validate Bash commands — allow everything else through.
+# If TOOL_NAME is empty (parse failure), fall through to check the command anyway (fail closed).
+if [[ -n "$TOOL_NAME" && "$TOOL_NAME" != "Bash" ]]; then
   exit 0
 fi
 
-COMMAND="$(printf '%s' "$INPUT" | python3 -c "import sys,json; print(json.load(sys.stdin).get('tool_input',{}).get('command',''))" 2>/dev/null || true)"
+COMMAND="$(printf '%s' "$INPUT" | jq -r '.tool_input.command // ""' 2>/dev/null || true)"
 
 if [[ -z "$COMMAND" ]]; then
   exit 0
@@ -136,20 +137,19 @@ BLOCKED_PATTERNS=(
 # ---------------------------------------------------------------------------
 check_command() {
   local cmd="$1"
-  # Trim leading/trailing whitespace
-  cmd="$(echo "$cmd" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')"
+  # Trim leading/trailing whitespace using parameter expansion
+  cmd="${cmd#"${cmd%%[![:space:]]*}"}"
+  cmd="${cmd%"${cmd##*[![:space:]]}"}"
 
   if [[ -z "$cmd" ]]; then
     return 0
   fi
 
-  # Convert to lowercase for case-insensitive matching
-  local cmd_lower
-  cmd_lower="$(echo "$cmd" | tr '[:upper:]' '[:lower:]')"
+  # Convert to lowercase using parameter expansion
+  local cmd_lower="${cmd,,}"
 
   for pattern in "${BLOCKED_PATTERNS[@]}"; do
-    local pattern_lower
-    pattern_lower="$(echo "$pattern" | tr '[:upper:]' '[:lower:]')"
+    local pattern_lower="${pattern,,}"
 
     # shellcheck disable=SC2254
     if [[ "$cmd_lower" == $pattern_lower ]]; then
@@ -164,8 +164,12 @@ check_command() {
 # ---------------------------------------------------------------------------
 # 4. Split on pipes and command chains, then check each sub-command
 # ---------------------------------------------------------------------------
-# Replace common chain operators with a delimiter
-NORMALIZED="$(echo "$COMMAND" | sed 's/&&/\n/g; s/||/\n/g; s/;/\n/g; s/|/\n/g')"
+# Replace common chain operators with newlines using parameter expansion
+# Order matters: replace && and || before | to avoid double-splitting ||
+NORMALIZED="${COMMAND//&&/$'\n'}"
+NORMALIZED="${NORMALIZED//||/$'\n'}"
+NORMALIZED="${NORMALIZED//;/$'\n'}"
+NORMALIZED="${NORMALIZED//|/$'\n'}"
 
 while IFS= read -r subcmd; do
   check_command "$subcmd"

content/en/docs/deployment/on-premises-design/ms-windows/_index.md

@@ -45,7 +45,7 @@ Before starting this how-to, make sure you have the following prerequisites:
 
     * Suitable database servers are MariaDB, MS SQL Server, MySQL, Oracle Database and PostgreSQL. See [System Requirements](/refguide/system-requirements/#databases) for more information
 
-* A local or domain user with the *“log on as a service”* local security policy set
+* A local user, domain user or group managed service account (gMSA) with the *“log on as a service”* local security policy set
 
 ## Installing the Mendix Service Console {#service-console}
 
@@ -88,32 +88,36 @@ To deploy a Mendix app using the Mendix Service Console, follow these steps:
     * **Display name** – the description of the app which is visible as a tooltip for the app in the left bar of the Mendix Service Console or as a column in the list of Windows services
     * **Description** – a description of the application that will be visible in the Mendix Service Console
     * **Startup type** – select whether you want the app to be started automatically when the server starts, started with a delay, started manually, or disabled altogether
-    * **User name** and **Password** – the app will always run under the user account given here, and the service will be installed with this user account configured (for more information, see [Prerequisites](#Prerequisites))
+    * **User name** and **Password** – the app will run under the user account given here, and the service will be installed with this user account configured (for more information, see [Prerequisites](#Prerequisites))
+    * **Install service with LocalSystem account** – optionally, select the checkbox if you want to use a gMSA account for a Mendix app instead of the user account given under **User name** and **Password**.
+    
+4. Click **Next >**. 
 
-4. Click **Next >**.
+5. Optionally, if you selected the **Install service with LocalSystem account** checkbox while creating the app, install the service once your app is created. The service will be installed with the LocalSystem account. (You can verify the service account type in the Services app of Windows.) Execute the following command in the administrator command prompt to change the account type to your gMSA: `sc.exe config MyServiceName obj= "YOURDOMAIN\MyGMSAAccount$"`. 
+Configure folder access permissions for gMSA account on the directory selected in the **Preferences** setting. For more information, refer to the [Installing the Mendix Service Console](/developerportal/deploy/deploy-mendix-on-microsoft-windows/#service-console) section above.
 
-    {{< figure src="/attachments/deployment/on-premises-design/ms-windows/18580728.png" >}}
+    {{< figure src="/attachments/deployment/on-premises-design/ms-windows/gmsa.png" >}}
 
-5. On the **Project Files** screen, click **Select app…**.
+6. On the **Project Files** screen, click **Select app…**.
 
     {{< figure src="/attachments/deployment/on-premises-design/ms-windows/service_console_selectapp.png" >}}
 
-6. Now select the **MDA** file that was [created in Mendix Studio Pro](/refguide/create-deployment-package-dialog/) and contains your application logic. After the installation of your MDA file, you will see which Mendix server (Mendix Runtime) version is needed.
+7. Now select the **MDA** file that was [created in Mendix Studio Pro](/refguide/create-deployment-package-dialog/) and contains your application logic. After the installation of your MDA file, you will see which Mendix server (Mendix Runtime) version is needed.
 
-7. Configure the **Database Settings**:
+8. Configure the **Database Settings**:
 
     * **Type** – the database server type
     * **Host** – the IP address or host name of the database server
     * **Name** – the database name
     * **User name** and **Password** – the database user name and password
 
-8. Click **Next >**.
+9. Click **Next >**.
 
     {{< figure src="/attachments/deployment/on-premises-design/ms-windows/18580726.png" >}}
 
-9. On the **Common Configuration** screen, keep the default settings. These settings should only be changed if this is needed for your application setup.
+10. On the **Common Configuration** screen, keep the default settings. These settings should only be changed if this is needed for your application setup.
 
-10. Click **Finish** and start the application.
+11. Click **Finish** and start the application.
 
 ## Configuring the Microsoft Internet Information Services Server{#configure-msiis}
 

content/en/docs/deployment/on-premises-design/ms-windows/automate-mendix-deployment-on-microsoft-windows.md

@@ -180,6 +180,48 @@ $appName = 'Name of Mendix app'
 Install-MxService $appName
 ```
 
+### Sample Script - Set App Runtime Settings
+
+The following script example demonstrates how to set runtime settings for your app. It applies custom runtime configuration settings to your application using a hashtable of key-value pairs.
+
+```text
+$appName = 'Name of Mendix app'
+$settings = @{
+    'MaxJavaHeapSize' = '2048'           
+    'DatabaseHost' = 'localhost'        
+}      
+
+# Set runtime settings
+Set-MxAppRuntimeSettings $appName -Settings $settings
+```
+
+### Sample Script - Set App Constant
+
+The following script example demonstrates how to set an application constant for your app. It updates a specific constant value in your Mendix app configuration.
+
+```text
+$appName = '{Name of your app}'
+$constants = @{
+    'constantName' = 'constantValue'
+    'constantName2' = 'constantValue2'
+}
+
+# Set application constant
+Set-MxAppConstants $appName -Constants $constants
+```
+
+### Sample Script - Get Server Id
+
+The `Start-MxApp` cmdlet automatically retrieves the Server ID (License ID) when starting a Mendix app. You can use this unique identifier for license tracking and application monitoring. The following script example demonstrates the process required to retrieve Server Id.
+
+```text
+# Start the Mendix app and get Server ID
+$app = Start-MxApp "MyAppName" -NoService -SynchronizeDatabase
+
+# Display the Server ID
+Write-Host "Server ID: $($app.ServerId)"
+```
+
 ## Troubleshooting
 
 If you encounter any issues while automating Mendix deployment on Windows using cmdlets, use the following troubleshooting tips to help you solve them.

content/en/docs/marketplace/platform-supported-content/modules/nanoflow-commons.md

@@ -48,6 +48,21 @@ The [Nanoflow Commons](https://marketplace.mendix.com/link/component/109515/) mo
 |                     | Get platform                               |
 |                     | Wait                                       |
 
+### Limitations of Get/Set Storage Item Actions {#limitations}
+
+The **Get storage item** and **Set storage item** actions use the device's native encrypted async storage mechanism (key-value storage). This storage is completely separate from the Mendix offline database and does not have any relationship with Mendix's entity model, entity access rules, or association capabilities.
+
+Below is a list of the key limitations:
+
+* No association support – When you store entities using **Set storage item object** or **Set storage item object list**, only the entity data itself is serialized and stored. Entity associations are not preserved. The storage mechanism has no concept of Mendix associations, referenced entities, or relational data structures.
+* No entity access rules – Security and entity access rules defined in your domain model do not apply to data stored in device storage. The storage actions bypass the Mendix data layer entirely.
+* Page state dependency – Mendix internally maintains a "page state" that tracks associated entities when objects are loaded into memory. This page state is session-scoped and is cleared when the user signs out or switches accounts on a native device. Any associations that depend on this page state are lost when the session ends.
+* Manual association reconstruction required – If your application needs to work with associated entities after retrieving objects from local storage, you must explicitly retrieve and reconstruct those associations in your nanoflow logic. For example, if Entity A references Entity B, you must separately retrieve Entity B after loading Entity A from storage.
+
+{{% alert color="warning" %}}
+The local storage actions are intended for simple key-value storage use cases such as caching user preferences, temporary state, or serialized data that does not rely on associations. For complex relational data or entities that require association traversal, use Mendix's offline database capabilities instead of the storage item actions.
+{{% /alert %}}
+
 ## Read More
 
 * [How to Build JavaScript Actions: Part 1 (Basic)](/howto/extensibility/write-javascript-actions/)

content/en/docs/private-platform/pmp-maia.md

@@ -38,7 +38,7 @@ Generators:
 
 ## Changing the LLM Provider for Maia
 
-Starting in Private Mendix Platform 2.6, instead of usign the default Large Language Model, you can connect Maia to several different models of your choice. Currently this includes the following LLMs:
+Starting in Private Mendix Platform 2.6, instead of usign the default Large Language Model, you can connect Maia to several different models of your choice. The quality of results has been verified on Claude Sonnet 4.5 and may vary for other providers and models. The following models have been tested for connectivity:
 
 * Anthropic
     * Small text model - Claude Haiku 4.5

content/en/docs/refguide/modeling/application-logic/workflows/workflow-elements/ai-agent-task.md

@@ -21,10 +21,6 @@ With **AI agent task**, you can select a [microflow](#microflow) that calls any
 
 If you do not yet have any agents configured, you can get started by following the guide on [creating your first agent](/appstore/modules/genai/how-to/howto-single-agent/).
 
-{{% alert color="info" %}}
-Support for configuring AI agents using an Agent Editor in Studio Pro is coming soon.
-{{% /alert %}}
-
 ## Properties
 
 AI agent task properties consist of the following sections: