@bobfrankston/npmglobalize 1.0.198 → 1.0.199

package/lib.js

@@ -3514,28 +3514,58 @@ function allowOwnScriptsArgs(dir) {
     const own = ownScopePackages(dir);
     return own.length ? ['--allow-scripts', own.join(',')] : [];
 }
+/** Install-script runners that fetch or select a prebuilt binary and only
+ *  compile when no prebuild matches the platform. A package using one of these
+ *  ships working binaries in its tarball, so a skipped script is very rarely
+ *  the thing that breaks it — koffi (cnoke) is the standing example: it carries
+ *  build/koffi/<platform>/koffi.node for every platform it supports. */
+const PREBUILT_SCRIPT_RUNNERS = /\b(prebuild-install|node-gyp-build|prebuildify|cnoke|napi-postinstall)\b/;
 /** A skipped postinstall can leave a package broken at runtime (puppeteer
  *  without its browser, native modules unbuilt), so surface the warning
  *  instead of burying it in the captured output. Own-scope packages are
  *  reported separately and louder: those were supposed to be allowed, so
- *  one showing up here means the allowlist missed it. */
-function warnSkippedScripts(combined, allowed = []) {
-    const pkgs = [...combined.matchAll(/^npm warn allow-scripts\s+(\S+@[^\s(]+) \(/gm)];
+ *  one showing up here means the allowlist missed it.
+ *
+ *  npm names the script it skipped in the warn line — "(install: node
+ *  src/cnoke/cnoke.js ... --prebuild)" — so the report can say WHICH script
+ *  and whether it's the kind that has a prebuilt fallback, rather than
+ *  flatly claiming every skip may have broken something. */
+function warnSkippedScripts(combined, allowed = [], pkgSpec) {
+    const pkgs = [...combined.matchAll(/^npm warn allow-scripts\s+(\S+@[^\s(]+) \(([^)]*)\)/gm)]
+        .map(m => ({ spec: m[1], detail: m[2] }));
     if (!pkgs.length)
         return;
     const nameOf = (spec) => spec.replace(/@[^@]+$/, '');
     const first = allowed[0] || '';
     const scope = first.startsWith('@') ? first.slice(0, first.indexOf('/') + 1) : '';
-    const ours = scope ? pkgs.filter(m => nameOf(m[1]).startsWith(scope)) : [];
-    const others = pkgs.filter(m => !ours.includes(m));
+    const ours = scope ? pkgs.filter(p => nameOf(p.spec).startsWith(scope)) : [];
+    const others = pkgs.filter(p => !ours.includes(p));
     if (ours.length) {
-        console.log(colors.red(`  ⚠ Own-scope install scripts still skipped: ${ours.map(m => m[1]).join(', ')}`));
+        console.log(colors.red(`  ⚠ Own-scope install scripts still skipped: ${ours.map(p => p.spec).join(', ')}`));
         console.log(colors.red(`    npmglobalize allowlisted ${allowed.length} own package(s) but missed these — likely transitive deps not present in the local node_modules tree.`));
     }
     if (others.length) {
-        const names = [...new Set(others.map(m => nameOf(m[1])))];
-        console.log(colors.yellow(`  ⚠ npm skipped install scripts for third-party packages: ${others.map(m => m[1]).join(', ')}`));
-        console.log(colors.yellow(`    Package may be broken at runtime. Allow with: npm install -g <pkg> --allow-scripts ${names.join(',')}`));
+        const prebuilt = others.filter(p => PREBUILT_SCRIPT_RUNNERS.test(p.detail));
+        const unknown = others.filter(p => !prebuilt.includes(p));
+        for (const p of prebuilt) {
+            const script = p.detail.split(':')[0];
+            console.log(colors.dim(`  · Skipped ${p.spec} ${script} script — prebuilt-binary fetcher, the package ships binaries; normally harmless.`));
+        }
+        if (unknown.length) {
+            console.log(colors.yellow(`  ⚠ npm skipped install scripts for third-party packages: ${unknown.map(p => p.spec).join(', ')}`));
+            for (const p of unknown)
+                console.log(colors.yellow(`      ${p.spec} (${p.detail})`));
+            console.log(colors.yellow(`    These may be broken at runtime — no prebuilt fallback recognized.`));
+        }
+        // The re-run command must carry the OWN packages too: npm takes the
+        // allowlist from the first source that has one, so a command listing
+        // only the third-party name silently re-gates ours (msger's postinstall
+        // copies its native binary — losing it is the failure this all exists
+        // to prevent). Print the whole list, and the real spec rather than a
+        // <pkg> placeholder nobody can paste.
+        const rerun = [...allowed, ...new Set(others.map(p => nameOf(p.spec)))].join(',');
+        const target = pkgSpec ?? '<pkg>';
+        console.log(colors.dim(`    To run them anyway: npm install -g ${target} --allow-scripts ${rerun}`));
     }
 }
 /** Run npm install -g with retries for registry propagation delay.
@@ -3568,7 +3598,7 @@ async function installGlobalWithRetry(pkgSpec, cwd, isNewPackage = false, maxRet
             const added = combined.match(/^(?:added|changed|removed) \d+ packages?.*$/m);
             if (added)
                 console.log(colors.dim(`  ${added[0]}`));
-            warnSkippedScripts(combined, allowArgs.length ? allowArgs[1].split(',') : []);
+            warnSkippedScripts(combined, allowArgs.length ? allowArgs[1].split(',') : [], pkgSpec);
             // A truncated puppeteer browser extraction exits 0, so the install
             // LOOKS fine while the cache is poisoned for every future install.
             // Verify now, while the leftover archive still allows a repair.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/npmglobalize",
-  "version": "1.0.198",
+  "version": "1.0.199",
   "description": "Transform file: dependencies to npm versions for publishing",
   "main": "index.js",
   "type": "module",