windmill-labs/windmill · warning

This workspace has folder default_permissioned_as rules that

Error message

This workspace has folder default_permissioned_as rules that affect ${folderDefaultAnnotations.size} item(s) being pushed, but syncBehavior is not set in wmill.yaml. Add 'syncBehavior: v1' to enable ownership preservation on update and on_behalf_of stripping on pull.

What it means

When pushing, if the workspace has folder-level default_permissioned_as rules that apply to items being pushed but the wmill.yaml does not declare `syncBehavior: v1`, the CLI warns that ownership preservation (on update) and on_behalf_of stripping (on pull) are disabled. Without syncBehavior, pushed items may get their ownership/permissioned_as overwritten by folder defaults unexpectedly.

Source

Thrown at cli/src/commands/sync/sync.ts:5572

      );
      permissionedAsContext = {
        userCache: new Map(),
        userIsAdminOrDeployer,
        userEmail: user.email,
      };

      // ws_specific_flag changes have no content payload, so they don't
      // affect permissioned_as resolution — filter them out before the
      // pre-check (which expects only added/edited/deleted).
      await preCheckPermissionedAs(
        changes.filter((c) => c.name !== "ws_specific_flag"),
        user.email,
        userIsAdminOrDeployer,
        opts.acceptOverridingPermissionedAsWithSelf ?? false,
        !!process.stdin.isTTY,
      );
    } else if (folderDefaultAnnotations && folderDefaultAnnotations.size > 0) {
      log.warn(
        colors.yellow(
          `This workspace has folder default_permissioned_as rules that affect ${folderDefaultAnnotations.size} item(s) being pushed, ` +
            `but syncBehavior is not set in wmill.yaml. Add 'syncBehavior: v1' to enable ownership preservation on update and on_behalf_of stripping on pull.`,
        ),
      );
    }

    // Reject malformed datatable migrations (duplicate timestamps, orphan downs)
    // before touching the remote, scanning only the data tables in this push.
    const migrationDatatables = new Set(
      changes
        .map((c) => parseDatatableMigrationPath(c.path)?.datatable)
        .filter((d): d is string => !!d),
    );
    if (migrationDatatables.size > 0) {
      const migrationErrors = validateLocalMigrations(migrationDatatables);
      if (migrationErrors.length > 0) {
        log.error(

View on GitHub (pinned to e474e8803c)

Solutions

1. Add `syncBehavior: v1` to the top level of wmill.yaml.
2. Re-run the push and confirm the warning disappears.
3. Review pushed items' ownership after push if you choose not to enable syncBehavior, since folder defaults may reassign permissioned_as.

Example fix

// before (wmill.yaml)
include:
  - u/**
// after
syncBehavior: v1
include:
  - u/**

// Before push, ensure wmill.yaml declares syncBehavior when folder defaults exist:
const conf = yaml.parse(fs.readFileSync('wmill.yaml', 'utf8'));
if (!conf.syncBehavior && hasFolderPermissionedAsDefaults()) {
  console.warn('Add syncBehavior: v1 to wmill.yaml to preserve ownership');
}

function hasSyncBehaviorV1(conf: unknown): conf is { syncBehavior: 'v1' } {
  return typeof conf === 'object' && conf !== null &&
    (conf as any).syncBehavior === 'v1';
}

When it happens

Trigger: `wmill sync push` against a workspace where folder default_permissioned_as annotations exist for ≥1 pushed item, while `syncBehavior` is absent from wmill.yaml.

Common situations: Workspaces using folder-level permissioned_as defaults (enterprise feature) synced with configs created before syncBehavior was introduced; teams upgrading CLI and inheriting old wmill.yaml files.

Related errors

• Error reading dir: ${localP}, ${e}
• Error reading variable ${path} to check for secrets
• Failed to pull shared UI folder: ${e}
• Workspace folder not found, are you in the right directory?
• Not a fileset resource path: ${changePath}

AI-assisted analysis of windmill-labs/windmill@e474e8803c (2026-09-03). Data as JSON: /api/errors/e20717b119c5c0c8. Report an issue: GitHub.