From aa28a85520aff6251836840d3d66f4e717b89ab7 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Wed, 26 Nov 2025 11:00:59 +0000
Subject: [PATCH] fix(cli): improve back-compatibility with app.yaml with
 policy still present

---
 cli/src/commands/app/apps.ts  | 9 +++++++--
 cli/src/commands/sync/sync.ts | 3 ++-
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/cli/src/commands/app/apps.ts b/cli/src/commands/app/apps.ts
index 0fefd7afbc..9ed1c0d158 100644
--- a/cli/src/commands/app/apps.ts
+++ b/cli/src/commands/app/apps.ts
@@ -25,6 +25,9 @@ export interface AppFile {
 
 const alreadySynced: string[] = [];
 
+export function isExecutionModeAnonymous(app: any) {
+  return app?.["policy"]?.["execution_mode"] == "anonymous";
+}
 export async function pushApp(
   workspace: string,
   remotePath: string,
@@ -46,7 +49,7 @@ export async function pushApp(
   } catch {
     //ignore
   }
-  if (app?.["policy"]?.["execution_mode"] == "anonymous") {
+  if (isExecutionModeAnonymous(app)) {
     app.public = true;
   }
   // console.log(app);
@@ -85,7 +88,9 @@ export async function pushApp(
   }
 
   replaceInlineScripts(localApp.value);
-  await generatingPolicy(localApp, remotePath, localApp?.["public"] ?? false);
+  // console.log(localApp, localApp?.["policy"]);
+  await generatingPolicy(localApp, remotePath, localApp?.["public"] ?? (localApp.policy ? isExecutionModeAnonymous(localApp) : false));
+  // console.log(localApp, localApp?.["policy"]);
   if (app) {
     if (isSuperset(localApp, app)) {
       log.info(colors.green(`App ${remotePath} is up to date`));
diff --git a/cli/src/commands/sync/sync.ts b/cli/src/commands/sync/sync.ts
index d145b03490..3ea6ced18c 100644
--- a/cli/src/commands/sync/sync.ts
+++ b/cli/src/commands/sync/sync.ts
@@ -67,6 +67,7 @@ import {
   PathAssigner,
 } from "../../../windmill-utils-internal/src/path-utils/path-assigner.ts";
 import { extractInlineScripts as extractInlineScriptsForFlows } from "../../../windmill-utils-internal/src/inline-scripts/extractor.ts";
+import { isExecutionModeAnonymous } from "../app/apps.ts";
 
 // Merge CLI options with effective settings, preserving CLI flags as overrides
 function mergeCliWithEffectiveOptions<
@@ -415,7 +416,7 @@ function ZipFSElement(
               };
             }
 
-            if (app?.["policy"]?.["execution_mode"] == "anonymous") {
+            if (isExecutionModeAnonymous(app)) {
               app.public = true;
             }
             app.policy = undefined;