backwards compat: add a flag to enable theis behaviour

defaults to enabled on wmill init, but preserves old behaviour if
wmill.yaml already present without the flag. Upgrade is also simple

cli/src/commands/sync/sync.ts

@@ -2571,30 +2571,33 @@ export async function push(
       return;
     }
 
-    // Build permissioned_as context
-    const user = await wmill.whoami({ workspace: workspace.workspaceId });
-    const userIsAdminOrDeployer =
-      user.is_admin || (user.groups ?? []).includes("wm_deployers");
-    log.debug(`permissioned_as: user=${user.email}, is_admin=${user.is_admin}, groups=${JSON.stringify(user.groups)}, isAdminOrDeployer=${userIsAdminOrDeployer}`);
-    const validatedRules = validatePermissionedAsRules(
-      opts.defaultPermissionedAs,
-      "wmill.yaml"
-    );
-    log.debug(`permissioned_as: ${validatedRules.length} rules loaded`);
-    const permissionedAsContext: PermissionedAsContext = {
-      rules: validatedRules,
-      emailToUsernameCache: new Map<string, string>(),
-      userIsAdminOrDeployer,
-    };
+    // Build permissioned_as context (only when respectVirtualUserPermissions is enabled)
+    let permissionedAsContext: PermissionedAsContext | undefined = undefined;
+    if (opts.respectVirtualUserPermissions) {
+      const user = await wmill.whoami({ workspace: workspace.workspaceId });
+      const userIsAdminOrDeployer =
+        user.is_admin || (user.groups ?? []).includes("wm_deployers");
+      log.debug(`permissioned_as: user=${user.email}, is_admin=${user.is_admin}, groups=${JSON.stringify(user.groups)}, isAdminOrDeployer=${userIsAdminOrDeployer}`);
+      const validatedRules = validatePermissionedAsRules(
+        opts.defaultPermissionedAs,
+        "wmill.yaml"
+      );
+      log.debug(`permissioned_as: ${validatedRules.length} rules loaded`);
+      permissionedAsContext = {
+        rules: validatedRules,
+        emailToUsernameCache: new Map<string, string>(),
+        userIsAdminOrDeployer,
+      };
 
-    // Pre-check: warn non-admin/non-deployer users about permissioned_as changes
-    await preCheckPermissionedAs(
-      changes,
-      user.email,
-      userIsAdminOrDeployer,
-      opts.acceptOverridingPermissionedAsWithSelf ?? false,
-      !!process.stdin.isTTY
-    );
+      // Pre-check: warn non-admin/non-deployer users about permissioned_as changes
+      await preCheckPermissionedAs(
+        changes,
+        user.email,
+        userIsAdminOrDeployer,
+        opts.acceptOverridingPermissionedAsWithSelf ?? false,
+        !!process.stdin.isTTY
+      );
+    }
 
     if (
       !opts.yes &&

cli/src/core/conf.ts

@@ -104,6 +104,7 @@ export interface SyncOptions {
   lint?: boolean;
   locksRequired?: boolean;
   defaultPermissionedAs?: PermissionedAsRule[];
+  respectVirtualUserPermissions?: boolean;
 }
 
 export interface Codebase {
@@ -352,6 +353,7 @@ export const DEFAULT_SYNC_OPTIONS: Readonly<
       | "includeSettings"
       | "includeKey"
       | "nonDottedPaths"
+      | "respectVirtualUserPermissions"
     >
   >
 > = {
@@ -375,6 +377,7 @@ export const DEFAULT_SYNC_OPTIONS: Readonly<
   includeKey: false,
   skipWorkspaceDependencies: false,
   nonDottedPaths: false,
+  respectVirtualUserPermissions: true,
 } as const;
 
 export async function mergeConfigWithConfigFile<T>(