feat: gate guest apps by their mode and the protection rule alone (#12061)

* feat: gate guest apps by their mode and the protection rule alone

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: keep apps that admitted no guest closed on upgrade

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* chore: update ee-repo-ref to 0605eac866b49f0de913ab41c1168b79eec31ca0

This commit updates the EE repository reference after PR #931 was merged in windmill-ee-private.

Previous ee-repo-ref: 1f643a1aaa697578b36d67982358299ee20af7f4

New ee-repo-ref: 0605eac866b49f0de913ab41c1168b79eec31ca0

Automated by sync-ee-ref workflow.

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>

cli/src/commands/sync/sync.ts

@@ -14,7 +14,7 @@ import { colors } from "@cliffy/ansi/colors";
 import { Command } from "@cliffy/command";
 import { Confirm } from "@cliffy/prompt/confirm";
 import * as log from "../../core/log.ts";
-import { SETTINGS_MANAGED_ONLY_WHEN_PRESENT } from "../../core/settings.ts";
+import { RETIRED_SETTINGS, SETTINGS_MANAGED_ONLY_WHEN_PRESENT } from "../../core/settings.ts";
 import * as path from "node:path";
 import { sep as SEP } from "node:path";
 import {
@@ -2606,6 +2606,10 @@ const isWorkspaceSettingsFile = (p: string) =>
 function stripUnappliedSettingsFields(local: any, remote: any) {
   delete local?.name;
   delete remote?.name;
+  for (const key of RETIRED_SETTINGS) {
+    delete local?.[key];
+    delete remote?.[key];
+  }
   for (const key of ["operator_settings", ...SETTINGS_MANAGED_ONLY_WHEN_PRESENT]) {
     if (local?.[key] === undefined) delete remote?.[key];
   }

cli/src/core/settings.ts

@@ -72,7 +72,6 @@ export interface SimplifiedSettings {
   deploy_ui?: any;
   teams_command_script?: string | null;
   public_app_execution_limit_per_minute?: number | null;
-  guest_access_enabled?: boolean;
   guest_jwt_public_key?: string | null;
   guest_jwt_jwks_url?: string | null;
   error_handler_fallback_to_instance_alerts?: boolean;
@@ -89,7 +88,6 @@ export const SETTINGS_MANAGED_ONLY_WHEN_PRESENT = [
   "deploy_ui",
   "teams_command_script",
   "public_app_execution_limit_per_minute",
-  "guest_access_enabled",
   "guest_jwt_public_key",
   "guest_jwt_jwks_url",
   "error_handler_fallback_to_instance_alerts",
@@ -97,6 +95,10 @@ export const SETTINGS_MANAGED_ONLY_WHEN_PRESENT = [
   "variable_expiration_handler",
 ] as const;
 
+/** Keys earlier versions wrote that no longer configure anything; the server ignores them,
+ * so a file that still carries one must not show as differing from the workspace. */
+export const RETIRED_SETTINGS = ["guest_access_enabled"] as const;
+
 // Legacy settings interface for reading old settings.yaml files
 interface LegacySimplifiedSettings {
   auto_invite_enabled?: boolean;

cli/src/guidance/skills.gen.ts

@@ -8509,7 +8509,7 @@ write a secret you were not given: keep the placeholder.
 | \`slack_command_script\` / \`teams_command_script\` | Script or flow handling the Slack / Teams command. |
 | \`slack_oauth_client_id\` / \`slack_oauth_client_secret\` | The workspace's own Slack OAuth app. Clearing either removes both. |
 | \`public_app_execution_limit_per_minute\` | Rate limit for public apps, \`null\` for none. |
-| \`guest_access_enabled\`, \`guest_jwt_public_key\`, \`guest_jwt_jwks_url\` | Guest access to public apps and the key that signs guest JWTs. |
+| \`guest_jwt_public_key\`, \`guest_jwt_jwks_url\` | The key that signs guest JWTs for apps set to Guests. |
 | \`add_admins_and_developers_to_forks\` | Add the workspace's admins and developers to each fork. |
 | \`color\` | Workspace color, \`#rrggbb\`. |
 
@@ -8527,8 +8527,8 @@ With \`includeSettings: true\` in \`wmill.yaml\`, \`wmill sync pull\` writes the
 \`wmill sync push\` applies it. Unlike a partial apply, a push treats the file as the whole
 document: a setting the file omits is cleared, except \`operator_settings\`, \`color\`, the auto-invite
 instance groups, and the keys \`ducklake\`, \`dbt_warehouses\`, \`deploy_ui\`, \`teams_command_script\`,
-\`public_app_execution_limit_per_minute\`, \`guest_access_enabled\`, \`guest_jwt_public_key\`,
-\`guest_jwt_jwks_url\`, \`error_handler_fallback_to_instance_alerts\` and
+\`public_app_execution_limit_per_minute\`, \`guest_jwt_public_key\`, \`guest_jwt_jwks_url\`,
+\`error_handler_fallback_to_instance_alerts\` and
 \`add_admins_and_developers_to_forks\`, which are managed only when the file states them.
 \`datatable_permissions\` is pushed only with \`includeDatatablePermissions: true\` (or
 \`--include-datatable-permissions\`). A push ignores \`protection_rules\`: \`protection-rules.yaml\` and