windmill-labs/windmill · warning

Warning: You are not an admin or member of 'wm_deployers'. T

Error message

Warning: You are not an admin or member of 'wm_deployers'. The following ${wouldChangeItems.length} item(s) will have their permissioned_as/email changed to your user (${userEmail}):
${itemList}

What it means

During `wmill push`, if items on the server are owned (permissioned_as) by another user/email and the current user is neither an admin nor a member of the 'wm_deployers' group, the CLI must reassign ownership to the pushing user. This warning (or interactive confirm) tells you which items will have their permissioned_as/email changed to your user, because non-admins cannot preserve another owner's identity.

Source

Thrown at cli/src/core/permissioned_as.ts:187

    }

    if (currentOwner && currentOwner !== userEmail) {
      wouldChangeItems.push({ path: change.path, currentOwner });
    }
  }

  if (wouldChangeItems.length === 0) return;

  const itemList = wouldChangeItems
    .map((item) => `  - ${item.path} (current owner: ${item.currentOwner})`)
    .join("\n");

  const message =
    `You are not an admin or member of 'wm_deployers'. The following ${wouldChangeItems.length} item(s) ` +
    `will have their permissioned_as/email changed to your user (${userEmail}):\n${itemList}`;

  if (acceptOverride) {
    log.warn(colors.yellow(`Warning: ${message}`));
    return;
  }

  if (isInteractive) {
    log.warn(colors.yellow(message));
    const proceed = await Confirm.prompt({
      message:
        "Do you want to proceed? (use --accept-overriding-permissioned-as-with-self to skip this prompt)",
      default: false,
    });
    if (!proceed) {
      log.info("Push cancelled.");
      process.exit(0);
    }
  } else {
    log.error(
      colors.red(
        `${message}\n\nUse --accept-overriding-permissioned-as-with-self to proceed anyway.`

View on GitHub (pinned to e474e8803c)

Solutions

1. Add your deploy account to the 'wm_deployers' group (as admin) so it can preserve original ownership.
2. Run push with `wmill push --allow-...`/accept override if you accept the re-ownership (non-interactive flag).
3. Run as an admin account or use an admin token for the push.
4. Review the listed items; if the ownership change is intended, confirm interactively.

Example fix

// before (non-admin push re-owners items)
wmill push  # Warning: 12 item(s) will have their permissioned_as/email changed
// after: admin adds deploy account to deployers group, then
wmill push  # no warning, ownership preserved

// before pushing, check membership
const groups = await fetch(`${baseUrl}/api/w/<ws>/groups`, { headers: { Authorization: `Bearer ${token}` } }).then(r => r.json());
const isDeployer = groups.some(g => g.name === 'wm_deployers');
if (!isDeployer) console.warn('Non-deployer push will re-own foreign items');

null

// interactive: answer the Confirm prompt explicitly
const proceed = await Confirm.prompt('Re-own listed items?');
if (!proceed) throw new Error('push aborted by user');

When it happens

Trigger: Running `wmill push` while logged in as a non-admin, non-wm_deployers user, on a workspace where some pushed items are permissioned_as another user or have a different email; items would be silently re-owned, so the CLI warns/prompts.

Common situations: Deploying with a personal service account instead of a shared deployer account; pushing a teammate's exported scripts; CI bot account lacking wm_deployers membership; after workspace permission restructuring.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

• Warning: ${message}
• pointerErrors.join("\n")
• Invalid native trigger file path: ${filePath}. Expected form
• npm exited with ${exitCode === null ? "a signal" : `code ${e
• Could not generate tsconfig: ${error instanceof Error ? erro

AI-assisted analysis of windmill-labs/windmill@e474e8803c (2026-09-03). Data as JSON: /api/errors/5ff6e427cd301f58. Report an issue: GitHub.