Diego ImbertandClaude Opus 5 493d19689c fix(cli): stop sync push from resetting an app's run-as, sandbox and execution mode ...

A raw app's policy was regenerated from the local sources alone on every push:
raw_app.yaml records only the access mode, so `on_behalf_of` was rewritten to
whoever ran the push, and `sandbox`, `frontend_sdk_scopes` and a `viewer`
execution mode were dropped. A CI job running `wmill sync push` silently
re-permissioned every raw app it touched.

Start the regenerated policy from the deployed one, so the fields nothing local
states carry over, and send `preserve_on_behalf_of` the way the low-code push
already does. Low-code apps went through the same regeneration, so they lost
`sandbox` too; both paths now share `deployedPolicyBase`, which drops the legacy
`triggerables` the backend folds into `triggerables_v2` rather than carrying
stale grants forward.

The deletion-driven re-push (a file removed inside a flow/app/raw-app folder)
also reached `pushObj` without the permissioned-as context, so it reset
ownership even where the normal path preserved it.

Fixes #11046

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MaJ9KHDeaWrWUdVsHeHQ8L

2026-09-09 16:33:25 +02:00

..

fixtures/yaml-snapshots

feat(cli): wmill-lock.yaml auto-fill + --rehash-only + path-prefix dedup (#8978)

2026-05-01 15:11:56 +00:00

app_access_mode_unit.test.ts

feat: guest app execution mode, a role that takes no seat (#10929)

2026-09-04 22:47:28 +02:00

app_dev_path_schema_fetch.test.ts

fix: populate wmill.d.ts schemas in wmill app dev (#8882)

2026-04-20 17:22:31 +00:00

app_dev_wmill_dts_unit.test.ts

fix(cli): preserve case in raw-app runnable filenames (#8940)

2026-04-27 04:02:39 +00:00

app_inline_script_delete.test.ts

fix: handle inline script deletion in sync push + flow new nonDottedPaths (#8553)

2026-03-27 11:54:45 +00:00

app_inline_script_ordering_unit.test.ts

fix(cli): stable auto-numbered inline-script names in app pull (#9071)

2026-05-07 13:26:32 +00:00

app_policy_bundle_unit.test.ts

fix: derive a raw app's policy on deploy, and default an omitted execution_mode (#10733)

2026-08-18 01:52:10 +02:00

audit_token_commands.test.ts

feat(cli): add job, group, audit, token commands and schedule enable/disable (#8581)

2026-03-28 09:18:55 +00:00

base_url_workspace_resolution_unit.test.ts

fix(cli): say which workspace id is targeted, and when wmill.yaml is bypassed (#11006)

2026-09-07 16:18:39 +02:00

cargo_backend_example.standalone.ts

refactor(cli): migrate CLI from Deno to Bun/Node.js (#8041)

2026-02-21 21:19:04 +00:00

cargo_backend.ts

chore(cli): separate unit tests from integration tests and fix test cleanup (#8562)

2026-03-27 16:13:33 +00:00

case_insensitive_collisions_unit.test.ts

fix(cli): reconcile case-only path drift during sync on case-insensitive filesystems (WIN-2020) (#9485)

2026-06-09 08:09:04 +00:00

conf_branch_override_unit.test.ts

feat: unify CLI config to workspaces, deprecate gitBranches/environments (#8767)

2026-04-09 19:46:34 +00:00

containerized_backend.ts

feat(cli): detect missing folders on sync push and add 'wmill folder add-missing' (#8011)

2026-02-24 08:38:17 +00:00

datatable_migrations_unit.test.ts

feat: sync data table migrations to git, gated by a new object type (#10436)

2026-07-31 23:33:47 +02:00

datatable_pg_wire_unit.test.ts

feat: CLI datatable serve / psql (#9267)

2026-05-20 16:56:50 +00:00

datatable_settings_sync.test.ts

feat: add datatable config support to CLI settings sync and backend export (#8024)

2026-03-14 04:44:11 +00:00

datatable_virtual_catalog_unit.test.ts

feat: CLI datatable serve / psql (#9267)

2026-05-20 16:56:50 +00:00

dbt_module_tracker_unit.test.ts

feat: run dbt projects as a first-class Windmill runtime (#10326)

2026-08-01 11:58:05 +00:00

dbt_optional_descriptor_unit.test.ts

fix: keep a local dbt descriptor under sync pull --keep-deleted (#10911)

2026-08-31 23:31:27 +02:00

dependency_tree_unit.test.ts

feat: support temp_script_refs in wmill dev for local relative imports (#9554)

2026-06-16 10:21:37 +02:00

deploy_on_behalf_of_unit.test.ts

fix: make on_behalf_of control permissions for scripts and flows (#10438)

2026-08-01 20:37:21 +02:00

dev_recorder_bundle_unit.test.ts

feat: add session recording to wmill app dev (#10457)

2026-08-02 22:54:37 +02:00

dev_recorder_routes_unit.test.ts

feat: add session recording to wmill app dev (#10457)

2026-08-02 22:54:37 +02:00

dev_server.test.ts

feat(cli): wmill dev with per-flow proxy and responsive Dev UI (#8529)

2026-04-27 20:14:21 +00:00

duckdb_macros_unit.test.ts

fix(cli): macro-library parity in --local pipeline graph + read-only run --dry-run (#9942)

2026-07-06 01:36:42 +02:00

elements_to_map_branch_specific_unit.test.ts

feat: run dbt projects as a first-class Windmill runtime (#10326)

2026-08-01 11:58:05 +00:00

esbuild_loader_unit.test.ts

fix(cli): fall back to esbuild-wasm on native host/binary mismatch (#9629)

2026-06-17 02:33:18 +02:00

fileset_sync_unit.test.ts

fix(cli): sync push crashed on edited fileset children; reject non-canonical fileset dirs (#10572)

2026-08-11 13:16:45 +00:00

flow_notes_ordering_unit.test.ts

fix: preserve flow notes/groups and field ordering in generate-metadata (#8641) (#8642)

2026-03-31 13:48:22 +00:00

folder_default_permissioned_as.test.ts

fix: omit default_permissioned_as from tarball export when empty

2026-04-22 19:31:37 +00:00

folder_missing_meta.test.ts

fix(cli): correct misleading delete-fork command description (#9870)

2026-07-01 23:49:25 +02:00

folder_schedule_push.test.ts

refactor(cli): migrate CLI from Deno to Bun/Node.js (#8041)

2026-02-21 21:19:04 +00:00

fork_branch_id_unit.test.ts

feat(cli): improve agent prompts/skills and workspace fork workflow (#9531)

2026-06-12 00:16:16 +02:00

fork_branch_profile_resolution_unit.test.ts

feat(cli): clarify fork-branch workspace auto-targeting in output (#9988)

2026-07-07 17:08:09 +00:00

fork_merge.test.ts

feat: add CLI workspace merge command and enhance fork with datatable/color support (#8756)

2026-04-08 05:29:48 +00:00

generate_metadata_unit.test.ts

chore(cli): separate unit tests from integration tests and fix test cleanup (#8562)

2026-03-27 16:13:33 +00:00

git_unit.test.ts

feat: sync data table migrations to git, gated by a new object type (#10436)

2026-07-31 23:33:47 +02:00

gitsync_converter_unit.test.ts

feat: sync data table migrations to git, gated by a new object type (#10436)

2026-07-31 23:33:47 +02:00

gitsync_promotion.test.ts

feat(git-sync): enable per-item promotion mode on dev workspaces (#10205)

2026-07-21 17:07:52 +00:00

gitsync_settings_features.test.ts

refactor(cli): migrate CLI from Deno to Bun/Node.js (#8041)

2026-02-21 21:19:04 +00:00

group_commands.test.ts

feat(cli): add job, group, audit, token commands and schedule enable/disable (#8581)

2026-03-28 09:18:55 +00:00

guidance_writer_unit.test.ts

feat(cli): improve agent prompts/skills and workspace fork workflow (#9531)

2026-06-12 00:16:16 +02:00

headers_env_var.test.ts

fix(cli-tests): stabilize flow lock-gen race + Windows path (#9080)

2026-05-08 07:43:21 +02:00

http_guards_unit.test.ts

fix(cli): detect upstream auth-gateway HTML responses and add poll heartbeat (#9065)

2026-05-06 23:48:32 +00:00

include_flags_bypass_filtering.test.ts

refactor(cli): migrate CLI from Deno to Bun/Node.js (#8041)

2026-02-21 21:19:04 +00:00

init_bind_flow.test.ts

feat: unify CLI config to workspaces, deprecate gitBranches/environments (#8767)

2026-04-09 19:46:34 +00:00

init_no_git_sync.test.ts

feat: unify CLI config to workspaces, deprecate gitBranches/environments (#8767)

2026-04-09 19:46:34 +00:00

init_template_unit.test.ts

fix(cli): pipeline + workspace UX batch (init/bind stub, run errors, macro libs, lock-job report, upgrade errors) (#9929)

2026-07-05 16:24:04 +02:00

inline_scripts_failure_preprocessor_unit.test.ts

fix(cli): consistent flow inline lock filenames for compound extensions (#9555)

2026-06-12 17:20:54 +02:00

instance_configs_unit.test.ts

fix: move alert config from config table to global_settings (#8762)

2026-04-08 15:54:44 +00:00

job_commands.test.ts

feat: improve CLI flow log streaming and job inspection (#8644)

2026-03-31 18:22:18 +00:00

labels_export.test.ts

feat: add optional labels to scripts, flows, apps, schedules, triggers (#8609)

2026-04-03 17:39:32 +00:00

lint_command_unit.test.ts

fix(cli): lint against the checkout's schema, not the published validator (#10418)

2026-07-30 23:33:35 +02:00

lint_locks_unit.test.ts

chore(cli): separate unit tests from integration tests and fix test cleanup (#8562)

2026-03-27 16:13:33 +00:00

list_get_new_commands.test.ts

feat: add Azure Event Grid triggers (#8888)

2026-04-23 16:30:18 +00:00

local_encryption_unit.test.ts

refactor(cli): migrate CLI from Deno to Bun/Node.js (#8041)

2026-02-21 21:19:04 +00:00

lock_cache_unit.test.ts

fix(cli): include lock-relevant script content in lock cache key (#9528)

2026-06-11 07:43:45 +00:00

lock_dedup_unit.test.ts

fix(ci): unbreak the windows test jobs and the discord comment relay (#10799)

2026-08-21 12:52:06 +00:00

lockfile_format_pinning_unit.test.ts

feat(cli): wmill-lock.yaml auto-fill + --rehash-only + path-prefix dedup (#8978)

2026-05-01 15:11:56 +00:00

mixed_case_paths.test.ts

fix(cli): reconcile case-only path drift during sync on case-insensitive filesystems (WIN-2020) (#9485)

2026-06-09 08:09:04 +00:00

multi_instance_workspace.test.ts

refactor(cli): migrate CLI from Deno to Bun/Node.js (#8041)

2026-02-21 21:19:04 +00:00

new_commands_helpers.ts

test(cli): drain async dependency jobs after sync push to fix flake (#10293)

2026-07-24 10:23:18 +02:00

override_settings_behavior.test.ts

feat: unify CLI config to workspaces, deprecate gitBranches/environments (#8767)

2026-04-09 19:46:34 +00:00

parser_packages_unit.test.ts

fix(cli): publish all windmill-parser-wasm-* deps so local pipeline graph keeps write edges (#9926)

2026-07-05 12:14:22 +02:00

pending_script_lock_unit.test.ts

fix(cli): preserve committed script.lock on transient NULL lock during git-sync deploy (#9593)

2026-06-15 19:21:38 +02:00

pipeline_bounded_cascade_unit.test.ts

fix(parsers): keep s3 asset path suffix verbatim to preserve storage distinction (#10241)

2026-07-21 16:25:06 +00:00

pipeline_enrich_unit.test.ts

feat(pipeline): local development for data pipelines (CLI --local + pipeline dev preview) (#9840)

2026-07-01 11:41:36 +02:00

pipeline_local_graph_unit.test.ts

feat: run dbt projects as a first-class Windmill runtime (#10326)

2026-08-01 11:58:05 +00:00

pipeline_partition_unit.test.ts

fix: pipeline dogfooding fixes — SCD2 data-test scope, --partition, s3object upload binding (#9875)

2026-07-02 12:04:54 +02:00

pipeline_upload_unit.test.ts

fix: pipeline dogfooding fixes — SCD2 data-test scope, --partition, s3object upload binding (#9875)

2026-07-02 12:04:54 +02:00

preview_path_unit.test.ts

fix(cli): attach the right job path to preview runs (#10606)

2026-08-10 19:37:46 +02:00

preview.test.ts

fix(cli): attach the right job path to preview runs (#10606)

2026-08-10 19:37:46 +02:00

protection_rules_converter_unit.test.ts

feat: add wmill protection-rules pull/push CLI commands (#9240)

2026-05-19 17:40:34 +00:00

pull_on_behalf_of_marker.test.ts

fix(cli): stop emitting has_on_behalf_of/has_permissioned_as: false on pull (#10188)

2026-07-19 09:30:49 +02:00

push_diff_convergence_unit.test.ts

fix(cli): make a sync push into a fork converge on schedules and inline names (#10951)

2026-09-03 08:45:39 +02:00

push_workspace_key_unit.test.ts

fix(cli): make encryption key push non-interactive-safe + add --skip-reencrypt-on-key-change (#9402)

2026-06-02 07:11:29 +00:00

push_workspace_settings_name_unit.test.ts

feat: make the fork lineage the only deploy relationship (#10410)

2026-07-30 14:20:27 +00:00

raw_app_missing_css_unit.test.ts

fix: raw apps with no stylesheet were permanently un-deployable (#10364)

2026-07-27 22:32:57 +02:00

raw_app_path_traversal_unit.test.ts

fix: keep raw-app files within their app folder on sync pull (#10796)

2026-08-22 10:00:52 +00:00

raw_app_recordings_skip_unit.test.ts

feat: add session recording to wmill app dev (#10457)

2026-08-02 22:54:37 +02:00

raw_app_svelte_compiler_resolution_unit.test.ts

fix(cli): load the app's ESM svelte compiler, not its CJS one (#10622)

2026-08-10 21:50:03 +02:00

raw_app_svelte_plugin_unit.test.ts

fix(cli): keep svelte component styles in the raw-app bundle (#10838)

2026-08-26 20:24:34 +02:00

raw_app_sync.test.ts

fix(cli): stop sync push from resetting an app's run-as, sandbox and execution mode

2026-09-09 16:33:25 +02:00

raw_app_workspace_deps_unit.test.ts

fix: apply default workspace dependencies to raw app runnables (#10427)

2026-07-31 11:42:43 +02:00

relative_imports_skip.test.ts

feat(cli): better stale scripts detection #3 (#8480)

2026-03-23 18:20:19 +00:00

relative_imports_wasm.test.ts

feat(cli): better stale scripts detection #3 (#8480)

2026-03-23 18:20:19 +00:00

replace_path_scripts_unit.test.ts

chore(cli): separate unit tests from integration tests and fix test cleanup (#8562)

2026-03-27 16:13:33 +00:00

repro_diffname.test.ts

test: fix repro_diffname CLI flake by draining the app dependency job (#10659)

2026-08-12 13:10:26 +02:00

resource_folders_unit.test.ts

feat: run dbt projects as a first-class Windmill runtime (#10326)

2026-08-01 11:58:05 +00:00

resource_types_unit.test.ts

fix: compile resource types with no properties instead of throwing (#10730)

2026-08-17 22:14:07 +02:00

schedule_history_commands.test.ts

feat(cli): add job, group, audit, token commands and schedule enable/disable (#8581)

2026-03-28 09:18:55 +00:00

schedule_push_permissioned_as_unit.test.ts

chore(cli): restore module mocks so they stop leaking into later test files

2026-09-08 18:00:18 +02:00

script_envs_sync.test.ts

refactor(cli): migrate CLI from Deno to Bun/Node.js (#8041)

2026-02-21 21:19:04 +00:00

script_modules_unit.test.ts

fix(cli): resolve module script metadata on windows path separators (#10358)

2026-07-27 16:00:08 +02:00

script_push_metadata_unit.test.ts

fix: align script push metadata warning with generated locks (#8690)

2026-04-03 11:41:31 +00:00

script_push_up_to_date.test.ts

fix(cli): keep script settings on push and repair the up-to-date check (#10741)

2026-08-18 12:26:41 +02:00

script_runtime_settings_sync.test.ts

fix(cli): keep script settings on push and repair the up-to-date check (#10741)

2026-08-18 12:26:41 +02:00

settings_unit.test.ts

feat: make the fork lineage the only deploy relationship (#10410)

2026-07-30 14:20:27 +00:00

setup.ts

fix(cli): keep svelte component styles in the raw-app bundle (#10838)

2026-08-26 20:24:34 +02:00

shared_ui_diff_unit.test.ts

feat: add --keep-deleted flag to wmill sync pull and push (#10878)

2026-08-31 13:26:08 +00:00

slack_settings_sync.test.ts

feat(cli): non-interactive Slack connect/disconnect + sync round-trip fixes (#8935)

2026-04-24 17:14:08 +00:00

specific_items_unit.test.ts

feat: add workspace-specific flag for resources and variables (#8836)

2026-05-07 13:35:54 +00:00

standalone_commands.test.ts

test(cli): de-flake script run tests with retry + failure diagnostics (#9801)

2026-06-25 19:57:26 +02:00

sync_config_resolution.test.ts

refactor(cli): migrate CLI from Deno to Bun/Node.js (#8041)

2026-02-21 21:19:04 +00:00

sync_pull_push.test.ts

feat: add --keep-deleted flag to wmill sync pull and push (#10878)

2026-08-31 13:26:08 +00:00

sync_push_auto_metadata_repro.test.ts

fix(cli): resolve cross-folder relative imports during lockgen on fresh DB (#9048)

2026-05-05 21:06:53 +00:00

sync_push_script_metadata_only.test.ts

fix(cli): resolve module script metadata on windows path separators (#10358)

2026-07-27 16:00:08 +02:00

tar_creation_unit.test.ts

chore(cli): separate unit tests from integration tests and fix test cleanup (#8562)

2026-03-27 16:13:33 +00:00

test_backend.ts

chore(cli): separate unit tests from integration tests and fix test cleanup (#8562)

2026-03-27 16:13:33 +00:00

test_config_helpers.ts

refactor(cli): migrate CLI from Deno to Bun/Node.js (#8041)

2026-02-21 21:19:04 +00:00

test_fixtures.ts

feat(cli): better stale scripts detection #3 (#8480)

2026-03-23 18:20:19 +00:00

unified_generate_metadata.test.ts

remove dead legacyBehaviour param from metadata functions (#8695)

2026-04-03 12:01:34 +00:00

utils_unit.test.ts

fix(ci): unbreak the windows test jobs and the discord comment relay (#10799)

2026-08-21 12:52:06 +00:00

variable_ciphertext_shape_unit.test.ts

fix: prevent variable push from corrupting is_secret variables (#9705)

2026-06-23 12:45:36 +02:00

variable_resource_push.test.ts

feat(git-sync): sync extra_perms for variables (#11004)

2026-09-07 15:57:09 +02:00

wmill_lock_unit.test.ts

feat(cli): wmill-lock.yaml auto-fill + --rehash-only + path-prefix dedup (#8978)

2026-05-01 15:11:56 +00:00

workspace_conflicts_unit.test.ts

chore(cli): separate unit tests from integration tests and fix test cleanup (#8562)

2026-03-27 16:13:33 +00:00

workspace_deps_filter.test.ts

fix: skip generate-metadata confirmation prompt in non-interactive CI (#8678)

2026-04-02 19:28:39 +00:00

workspace_key_filename_integration.test.ts

fix(cli): keep permissioned_as on single-item push, as sync push does (#11000)

2026-09-07 16:46:35 +02:00

workspaces_config.test.ts

feat: unify CLI config to workspaces, deprecate gitBranches/environments (#8767)

2026-04-09 19:46:34 +00:00

ws_specific_flag_only_unit.test.ts

feat: add workspace-specific flag for resources and variables (#8836)

2026-05-07 13:35:54 +00:00

yaml_format_snapshot_unit.test.ts

feat(cli): wmill-lock.yaml auto-fill + --rehash-only + path-prefix dedup (#8978)

2026-05-01 15:11:56 +00:00

yaml_inline_tag.test.ts

fix(cli): preserve inline script files during flow generate-locks (#8561)

2026-03-27 19:27:56 +00:00