@bobfrankston/npmglobalize 1.0.219 → 1.0.221

package/README.md

@@ -172,15 +172,57 @@ exits 0 — e.g. `@bobfrankston/msger`'s postinstall copies its native binary
 into the per-user bin dir its launcher reads from, and skipping it leaves a
 stale exe behind a green checkmark.
 
-npmglobalize therefore allowlists **your own packages** on the global install
-it performs — it just built and published them from your source, so they're
-trusted — and leaves third-party packages gated:
-
-```
-> npm install -g @bobfrankston/winpos@2.0.51 --allow-scripts @bobfrankston/winpos,@bobfrankston/msger,@bobfrankston/msgcommon
-```
-
-Anything npm skips is reported rather than buried in the captured output:
+A **project** install is the opposite case: npm *rejects* `--allow-scripts`
+there and reads the policy from the `allowScripts` field of the root
+`package.json` (maintained by `npm approve-scripts` / `npm deny-scripts`),
+falling back to `allow-scripts` in `.npmrc` only when the field is absent.
+Until that field covers everything installed, every `npm install` ends with a
+`npm warn allow-scripts … not yet covered by allowScripts` block.
+
+npmglobalize keeps that field current, once per run, right after the
+node_modules check:
+
+- **Own-scope packages and `file:` deps are approved without asking** — they
+  are your source.
+- **Each third-party package is asked about**, showing the script npm would
+  run and whether it is a prebuilt-binary fetcher:
+
+  ```
+  npm gates install scripts for 2 third-party package(s) in @bobfrankston/whts. Approvals are recorded in package.json "allowScripts" (name-only) and honored on the global install too.
+    Allow install scripts for sharp@0.33.5 (install: node install/check)?  [y]es / [n]o, deny / [a]ll remaining / [s]kip for now: y
+    Allow install scripts for koffi@2.14.1|2.16.1 (install: node src/cnoke/cnoke.js --prebuild) — prebuilt-binary fetcher, the package ships binaries?  [y]es / [n]o, deny / [a]ll remaining / [s]kip for now: y
+    ✓ allowScripts: approved @bobfrankston/msger, com-wrapper, sharp, koffi (2 own/local approved automatically)
+  ```
+
+  `y` approves, `n` records a deny (`"pkg": false`, npm's own mechanism — the
+  question is not repeated; delete the entry to reconsider), `a` approves
+  everything remaining, `s` leaves it pending for next time. Approvals are
+  **name-only** (`--no-allow-scripts-pin`): a version pin would re-open the
+  question on every bump. Without a terminal (piped stdin) nothing is asked;
+  the pending packages are listed with the command to approve them.
+- The field is written by npm itself, so a linked dep gets the key npm wants
+  for it — the `file:` spec, e.g. `"file:../../../../projects/com/com-wrapper": true`
+  (relative to the link's parent directory, not the project).
+
+The **global** install then allowlists your own packages — it just built and
+published them from your source, so they're trusted — plus whatever the
+project's `allowScripts` approved (a `file:` key is mapped to that dep's
+published name) and your user `.npmrc` `allow-scripts` list, minus anything
+the project denied. Third-party packages you never approved stay gated:
+
+```
+> npm install -g @bobfrankston/winpos@2.0.51 --allow-scripts @bobfrankston/winpos,@bobfrankston/msger,@bobfrankston/msgcommon,sharp
+```
+
+npm takes the allowlist from the *first* source that has one rather than
+merging — CLI flag, then `package.json`, then `.npmrc` — which is why the
+`.npmrc` list is folded into the flag here, and why npm prints
+`.npmrc allow-scripts setting is being ignored because package.json declares
+its own allowScripts field` on project installs once the field exists. That
+warning is npm's layering at work, not a problem.
+
+Anything npm skips on the global install is reported rather than buried in
+the captured output:
 
 ```
   · Skipped koffi@2.16.3 install script — prebuilt-binary fetcher, the package ships binaries; normally harmless.
@@ -756,7 +798,7 @@ As with import maps, these have historically been built only by a second `.vscod
 Before building, `npmglobalize` looks for sub-projects, in this order:
 
 1. `.vscode/tasks.json` has a task that runs `tsc` or `importgen` with `"options": { "cwd": "${workspaceFolder}/client" }`, or runs `tsc` with `-p`/`--project` naming a sub-directory (authoritative — it's how the project is actually built today; the task's `label` is quoted back in the prompt).
-2. An immediate sub-directory containing its own `package.json` or `tsconfig.json`. A sub-package without a build script gets one set up the same way the root does (importgen, `tsc`, its own sub-projects) before the root delegates to it. Build output and vendored trees (`node_modules`, `prev`, `dist`, `built`, `out`, `wwwroot`, `coverage`, `temp`, `preflight`, dot-directories) are never scanned.
+2. An immediate sub-directory that is a build of its own: a `package.json` with a `build` script or an import map to regenerate (a sub-package gets its build script set up the same way the root does — importgen, `tsc`, its own sub-projects — before the root delegates to it), or a `tsconfig.json` the root `tsconfig.json` does not already compile. A `package.json` that only holds dependencies for files the root `tsc` compiles (`whts/pdfToImg`) is not a sub-project. Build output and vendored trees (`node_modules`, `prev`, `dist`, `built`, `out`, `wwwroot`, `coverage`, `temp`, `preflight`, dot-directories) are never scanned.
 
 Nothing is detected when the root `tsconfig.json` uses project `references` — that build graph belongs to `tsc -b` and isn't second-guessed.
 

package/cli.js

@@ -2,7 +2,7 @@
 /**
  * npmglobalize CLI - Transform file: dependencies to npm versions for publishing
  */
-import { globalize, globalizeWorkspace, installCleanupHandlers, readConfig, readPackageJson, readUserNpmConfig, writeConfig, writePackageJson, getBuildIssues, clearBuildIssues, ensureFileDepModules, buildProject, buildFileDepsTopologically, reportTs7Deprecations, fixTs7Deprecations, canonicalCase } from './lib.js';
+import { globalize, globalizeWorkspace, installCleanupHandlers, readConfig, readPackageJson, readUserNpmConfig, writeConfig, writePackageJson, getBuildIssues, clearBuildIssues, ensureFileDepModules, ensureAllowScripts, buildProject, buildFileDepsTopologically, reportTs7Deprecations, fixTs7Deprecations, canonicalCase } from './lib.js';
 import fs from 'fs';
 import path from 'path';
 import { colors } from './colors.js';
@@ -609,6 +609,11 @@ export async function main() {
         }
         if (!modulesOk)
             console.log(colors.warn('Continuing with -force despite npm install failure...'));
+        // 2026-09-07 — Claude Code (Fable 5.1), at Bob's direction: keep package.json
+        // "allowScripts" current — own/file: deps approved, third-party ones asked about —
+        // so npm's install-script gate stops warning and the global install honors it.
+        if (modulesOk)
+            await ensureAllowScripts(cwd, { dryRun: !!cliOptions.dryRun, verbose: !!cliOptions.verbose });
         const depsOk = await buildFileDepsTopologically(cwd, { verbose: !!cliOptions.verbose, force: !!cliOptions.force, forceBuild: !!cliOptions.forceBuild });
         if (!depsOk && !cliOptions.force) {
             printBuildSummary();

package/lib.d.ts

@@ -397,16 +397,6 @@ export declare function missingDeps(pkgDir: string, pkg: any): string[];
  *  re-run" (partial-sync) cases. Also covers `cwd` itself on the first call.
  *  Cycle-safe via the shared `visited` set. */
 export declare function ensureFileDepModules(cwd: string, verbose?: boolean, visited?: Set<string>): Promise<boolean>;
-/** Cheap freshness check so the build cascade can skip packages whose output is
- *  already current. Returns true only when provably up to date:
- *  - outDir projects: newest source (.ts/.tsx/.mts/.cts + tsconfig*.json) must
- *    not be newer than the newest file under outDir.
- *  - side-by-side projects: every source must have an emitted sibling
- *    (.js/.jsx/.mjs/.cjs or declaration) at least as new.
- *  Conservative: project references, allowJs, missing outputs, or unreadable
- *  tsconfig all report stale (→ build). package.json mtime is deliberately
- *  ignored — npmglobalize itself rewrites it around every publish, which would
- *  otherwise force a rebuild on every run. */
 export declare function isBuildUpToDate(cwd: string): boolean;
 /** Detect whether a package is an importgen project — a browser app whose HTML
  *  carries a generated `<script type="importmap">`. Signals, in order:
@@ -569,6 +559,33 @@ export declare function fixPuppeteerCorruptedCache(combined: string): {
  *  Returns [] for an unscoped package: there's no way to tell an unscoped
  *  package of ours from a third-party one by name alone. */
 export declare function ownScopePackages(dir: string): string[];
+/** The project's recorded install-script policy, as registry names. Keys in
+ *  `allowScripts` are `name`, `name@version`, or a `file:` / absolute path;
+ *  path keys are mapped to the target's manifest name so an approval given
+ *  to a linked dep carries over to the global install, where that same dep
+ *  arrives from the registry under its published name. */
+export declare function projectAllowScripts(dir: string): {
+    allowed: string[];
+    denied: string[];
+};
+/** Bring the project's package.json `allowScripts` up to date with what is
+ *  installed, so `npm install` stops warning and — once npm starts enforcing
+ *  the policy — keeps running the scripts this project depends on.
+ *
+ *  Own-scope packages and `file:` deps are approved without asking: they are
+ *  this user's source. Anything else is asked about, one package at a time,
+ *  showing the script npm would run. "no" records a deny (npm's own
+ *  mechanism, `npm deny-scripts`) so the question isn't repeated; "skip"
+ *  leaves it pending for next time. Approvals are name-only
+ *  (`--no-allow-scripts-pin`): a version pin would re-open the question on
+ *  every bump, which is exactly the churn this exists to remove.
+ *
+ *  Runs once per project root, not per cascade dep: npm reads the policy
+ *  from the root package.json only. ~1.5s (arborist loads the actual tree). */
+export declare function ensureAllowScripts(dir: string, opts?: {
+    dryRun?: boolean;
+    verbose?: boolean;
+}): Promise<void>;
 /** Run a command and return success status */
 export declare function runCommand(cmd: string, args: string[], options?: {
     silent?: boolean;

package/lib.js

@@ -2888,6 +2888,35 @@ function newestMtimeUnder(dir) {
  *  tsconfig all report stale (→ build). package.json mtime is deliberately
  *  ignored — npmglobalize itself rewrites it around every publish, which would
  *  otherwise force a rebuild on every run. */
+/** The directories a parsed tsconfig's `exclude` keeps out of the compile, as
+ *  lower-cased relative paths. Matches on the literal path prefix (glob tails
+ *  like "tests/**" reduce to "tests"). */
+function tsconfigExcludedDirs(tsconfig) {
+    return (Array.isArray(tsconfig?.exclude) ? tsconfig.exclude : [])
+        .filter((x) => typeof x === 'string')
+        .map((x) => x.replace(/^\.\//, '').replace(/[\\/]?\*.*$/, '').replace(/[\\/]+$/, '').toLowerCase())
+        .filter((x) => x.length > 0 && !x.includes('*'));
+}
+/** True when the root tsconfig in `cwd` already compiles the sources under
+ *  `rel`: it exists, doesn't narrow the compile with `files`/`include`, and
+ *  doesn't `exclude` the directory. Conservative — a root that uses `include`
+ *  is treated as not covering the sub-directory. */
+function rootTsconfigCompiles(cwd, rel) {
+    let tsconfig;
+    try {
+        tsconfig = JSON5.parse(fs.readFileSync(path.join(cwd, 'tsconfig.json'), 'utf-8'));
+    }
+    catch {
+        return false;
+    }
+    if (Array.isArray(tsconfig.files) || Array.isArray(tsconfig.include))
+        return false;
+    const target = normalizeProjectPath(rel).toLowerCase();
+    const parts = target.split('/');
+    const excludes = tsconfigExcludedDirs(tsconfig);
+    // Excluding a parent excludes everything under it.
+    return !parts.some((_, i) => excludes.includes(parts.slice(0, i + 1).join('/')));
+}
 export function isBuildUpToDate(cwd) {
     let tsconfig;
     try {
@@ -2901,12 +2930,8 @@ export function isBuildUpToDate(cwd) {
         return false;
     const outDir = typeof co.outDir === 'string' ? path.resolve(cwd, co.outDir) : null;
     // tsconfig "exclude" dirs aren't compiled, so their .ts files never get
-    // outputs — don't count them as sources. Match on the literal path prefix
-    // (glob tails like "tests/**" reduce to "tests").
-    const excludes = (Array.isArray(tsconfig.exclude) ? tsconfig.exclude : [])
-        .filter((x) => typeof x === 'string')
-        .map((x) => x.replace(/^\.\//, '').replace(/[\\/]?\*.*$/, '').replace(/[\\/]+$/, '').toLowerCase())
-        .filter((x) => x.length > 0 && !x.includes('*'));
+    // outputs — don't count them as sources.
+    const excludes = tsconfigExcludedDirs(tsconfig);
     const sources = [];
     const collect = (dir, rel) => {
         let entries;
@@ -3198,13 +3223,31 @@ function resolveOnDiskCase(base, rel) {
     }
     return out.length ? out.join('/') : null;
 }
-/** Classify `rel` under `cwd`: a package (its own package.json — its build
- *  script is set up by `ensureBuildScript` if it lacks one), a plain tsconfig
- *  sub-project, or null when it's neither. */
+/** Classify `rel` under `cwd`: a package (its own package.json with a build
+ *  script, or an importgen project — `ensureBuildScript` sets its script up),
+ *  a plain tsconfig sub-project the root tsc doesn't compile, or null when it
+ *  is neither.
+ *  2026-09-06 — Claude Code (Fable 5.1), at Bob's direction. whts/pdfToImg has
+ *  a package.json that only holds puppeteer/sharp for a file the root tsc
+ *  already compiles; treating every package.json as a sub-package gave it a
+ *  `build: tsc` it never needed and a second compile under its stale tsconfig.
+ *  A package.json is a build of its own only when it has something the root
+ *  can't do — its own build script, or an import map to regenerate. */
 function subProjectKind(cwd, rel) {
-    if (fs.existsSync(path.join(cwd, rel, 'package.json')))
-        return 'package';
-    return fs.existsSync(path.join(cwd, rel, 'tsconfig.json')) ? 'tsconfig' : null;
+    const dir = path.join(cwd, rel);
+    if (fs.existsSync(path.join(dir, 'package.json'))) {
+        let pkg = {};
+        try {
+            pkg = readPackageJson(dir);
+        }
+        catch { /* unreadable — treat as having no build script */ }
+        const hasBuild = typeof pkg?.scripts?.build === 'string' && pkg.scripts.build.trim();
+        if (hasBuild || detectImportgen(dir))
+            return 'package';
+    }
+    if (!fs.existsSync(path.join(dir, 'tsconfig.json')))
+        return null;
+    return rootTsconfigCompiles(cwd, rel) ? null : 'tsconfig';
 }
 /** The command the root build script runs for a sub-project. */
 function subProjectBuildCommand(s) {
@@ -3505,7 +3548,7 @@ export async function buildProject(cwd, opts = {}) {
     // tsconfig.json, which makes the freshness check correctly read as stale.
     const tsconfigSnapshot = new Map();
     const issueMark = markBuildIssues();
-    const migratedUpFront = fs.existsSync(path.join(cwd, 'tsconfig.json')) && migrateTsconfigDeprecations(cwd, tsconfigSnapshot);
+    let migratedUpFront = fs.existsSync(path.join(cwd, 'tsconfig.json')) && migrateTsconfigDeprecations(cwd, tsconfigSnapshot);
     const setup = await ensureBuildScript(cwd);
     if (!setup)
         return true;
@@ -3514,6 +3557,16 @@ export async function buildProject(cwd, opts = {}) {
     // freshness — one the user declined to wire in isn't this build's business.
     const finalBuild = typeof pkg.scripts?.build === 'string' ? pkg.scripts.build : '';
     const wiredSubs = detectSubProjects(cwd).filter(s => scriptBuildsSubProject(finalBuild, s.dir));
+    // 2026-09-06 — Claude Code (Fable 5.1), at Bob's direction.
+    // The sub-projects this build runs get the same TS7 migration as the root.
+    // whts: `tsc -p pdfToImg` failed on pdfToImg/tsconfig.json's
+    // `moduleResolution: node10` (TS5107) and the retry below re-migrated only
+    // the root chain, which had nothing left to fix — so no retry ever happened.
+    const migrateSubProjects = () => wiredSubs
+        .map(s => migrateTsconfigDeprecations(path.join(cwd, s.dir), tsconfigSnapshot))
+        .some(Boolean);
+    if (migrateSubProjects())
+        migratedUpFront = true;
     // A migration just changed how modules resolve — never report that as fresh;
     // the rebuild is what validates it (and what the revert path above needs).
     if (!opts.forceBuild && !migratedUpFront && isBuildUpToDate(cwd) && areSubProjectsUpToDate(cwd, wiredSubs)
@@ -3529,7 +3582,7 @@ export async function buildProject(cwd, opts = {}) {
         // We don't silence with ignoreDeprecations — the retry may now surface real
         // resolution errors, which are genuine bugs to fix, not deprecations.
         const out = (buildResult.stderr || '') + (buildResult.output || '');
-        if (/error TS510[17]\b/.test(out) && migrateTsconfigDeprecations(cwd, tsconfigSnapshot)) {
+        if (/error TS510[17]\b/.test(out) && [migrateTsconfigDeprecations(cwd, tsconfigSnapshot), migrateSubProjects()].some(Boolean)) {
             buildResult = await runCommandAsync('npm', ['run', 'build'], { cwd, silent: true });
         }
     }
@@ -4161,20 +4214,238 @@ export function ownScopePackages(dir) {
     walk(pkg, dir);
     return [...found];
 }
-/** npm args allowing install scripts for our own packages only. Empty when
- *  npm predates the policy (it runs the scripts anyway) or the package is
- *  unscoped.
- *
- *  Note: the CLI layer *replaces* the .npmrc layer rather than merging with
- *  it (first source with any config wins, per npm's resolve-allow-scripts),
- *  so passing this suppresses any allow-scripts entries in .npmrc for this
- *  install. Third-party approvals therefore belong on the command line too,
- *  not in .npmrc. */
-function allowOwnScriptsArgs(dir) {
+// 2026-09-07 — Claude Code (Fable 5.1), at Bob's direction ("I want you to handle
+// this", after `npm un itemgen` in whts warned about com-wrapper, msger and sharp).
+// The project side of the policy. npm REJECTS `--allow-scripts` on a project-scoped
+// install (EALLOWSCRIPTS), so the only place a project's approvals can live is the
+// `allowScripts` field of its package.json, maintained by `npm approve-scripts`.
+// npmglobalize now keeps that field current (ensureAllowScripts) and feeds it back
+// into the global install's `--allow-scripts` flag (allowScriptsArgs), so a package
+// is trusted once, in one place, for both kinds of install.
+/** Names of the project's `file:` dependencies as npm displays them in the
+ *  allowScripts pending list. A linked dep has no registry identity, so npm
+ *  falls back to the link target's directory name (`com-wrapper` for
+ *  `@bobfrankston/com-wrapper` at ../../projects/com/com-wrapper); the
+ *  manifest name is included too in case that fallback ever changes. */
+function localDepDisplayNames(dir) {
+    let pkg;
+    try {
+        pkg = readPackageJson(dir);
+    }
+    catch {
+        return [];
+    }
+    const names = [];
+    for (const key of ['dependencies', 'devDependencies', 'optionalDependencies']) {
+        const deps = pkg[key];
+        if (!deps || typeof deps !== 'object')
+            continue;
+        for (const spec of Object.values(deps)) {
+            if (typeof spec !== 'string' || !spec.startsWith('file:'))
+                continue;
+            const target = path.resolve(dir, spec.slice('file:'.length));
+            names.push(path.basename(target));
+            try {
+                const name = readPackageJson(target).name;
+                if (name)
+                    names.push(name);
+            }
+            catch { /* target missing or unreadable — the basename alone still identifies it */ }
+        }
+    }
+    return names;
+}
+/** The project's recorded install-script policy, as registry names. Keys in
+ *  `allowScripts` are `name`, `name@version`, or a `file:` / absolute path;
+ *  path keys are mapped to the target's manifest name so an approval given
+ *  to a linked dep carries over to the global install, where that same dep
+ *  arrives from the registry under its published name. */
+export function projectAllowScripts(dir) {
+    const allowed = [];
+    const denied = [];
+    let pkg;
+    try {
+        pkg = readPackageJson(dir);
+    }
+    catch {
+        return { allowed, denied };
+    }
+    const policy = pkg.allowScripts;
+    if (!policy || typeof policy !== 'object')
+        return { allowed, denied };
+    // A `file:` key written by `npm approve-scripts` is the link's saved spec,
+    // which npm records relative to the LINK's parent directory — verified on
+    // whts: package.json says `file:../../projects/com/com-wrapper`, the policy
+    // key came out `file:../../../../projects/com/com-wrapper`, i.e. relative to
+    // node_modules/@bobfrankston/. A hand-written key is relative to the
+    // project. Try both bases.
+    const bases = new Set([dir]);
+    for (const key of ['dependencies', 'devDependencies', 'optionalDependencies']) {
+        for (const [name, spec] of Object.entries(pkg[key] || {})) {
+            if (typeof spec === 'string' && spec.startsWith('file:'))
+                bases.add(path.dirname(path.join(dir, 'node_modules', name)));
+        }
+    }
+    const manifestName = (rel) => {
+        for (const base of bases) {
+            try {
+                return readPackageJson(path.resolve(base, rel)).name;
+            }
+            catch { /* not this base — try the next; the caller skips the key when none has it */ }
+        }
+        return null;
+    };
+    for (const [key, value] of Object.entries(policy)) {
+        let name;
+        if (key.startsWith('file:') || path.isAbsolute(key)) {
+            name = manifestName(key.startsWith('file:') ? key.slice('file:'.length) : key);
+        }
+        else {
+            // strip a trailing @version; a scoped name keeps its leading @
+            name = key.replace(/(.)@[^@]*$/, '$1');
+        }
+        if (!name)
+            continue;
+        (value === false ? denied : allowed).push(name);
+    }
+    return { allowed, denied };
+}
+/** Names from the user's own `allow-scripts` npm config (.npmrc layers).
+ *  npm's resolver takes the FIRST layer with any config and ignores the
+ *  rest, so a CLI flag would silently suppress these — merging them into the
+ *  flag keeps `npm config set allow-scripts=… --location=user` meaningful. */
+function npmrcAllowScripts() {
+    const r = runCommand('npm', ['config', 'get', 'allow-scripts'], { silent: true });
+    if (!r.success || isUnknownConfig(r.output))
+        return [];
+    return r.output.split(/[,\s]+/).map(s => s.trim()).filter(Boolean);
+}
+/** npm args allowing install scripts on a GLOBAL install: our own packages,
+ *  whatever the project's package.json `allowScripts` approves, and the
+ *  user's .npmrc list — minus anything the project denies. Empty when npm
+ *  predates the policy (it runs the scripts anyway) or nothing is allowed. */
+function allowScriptsArgs(dir) {
     if (!npmSupportsAllowScripts())
         return [];
-    const own = ownScopePackages(dir);
-    return own.length ? ['--allow-scripts', own.join(',')] : [];
+    const project = projectAllowScripts(dir);
+    const names = [...new Set([...ownScopePackages(dir), ...project.allowed, ...npmrcAllowScripts()])]
+        .filter(n => !project.denied.includes(n));
+    return names.length ? ['--allow-scripts', names.join(',')] : [];
+}
+/** Parse the text listing of `npm approve-scripts --allow-scripts-pending`:
+ *  one indented `name@version (event: cmd; event: cmd)` line per node,
+ *  the same package repeated when several versions are installed. */
+function parsePendingScripts(output) {
+    const byName = new Map();
+    for (const line of output.split('\n')) {
+        const m = line.match(/^  (\S+?)(?:@([^@\s]+))? \((.*)\)\s*$/);
+        if (!m)
+            continue;
+        const [, name, version, scripts] = m;
+        const entry = byName.get(name) ?? { name, versions: [], scripts };
+        if (version)
+            entry.versions.push(version);
+        byName.set(name, entry);
+    }
+    return [...byName.values()];
+}
+/** Bring the project's package.json `allowScripts` up to date with what is
+ *  installed, so `npm install` stops warning and — once npm starts enforcing
+ *  the policy — keeps running the scripts this project depends on.
+ *
+ *  Own-scope packages and `file:` deps are approved without asking: they are
+ *  this user's source. Anything else is asked about, one package at a time,
+ *  showing the script npm would run. "no" records a deny (npm's own
+ *  mechanism, `npm deny-scripts`) so the question isn't repeated; "skip"
+ *  leaves it pending for next time. Approvals are name-only
+ *  (`--no-allow-scripts-pin`): a version pin would re-open the question on
+ *  every bump, which is exactly the churn this exists to remove.
+ *
+ *  Runs once per project root, not per cascade dep: npm reads the policy
+ *  from the root package.json only. ~1.5s (arborist loads the actual tree). */
+export async function ensureAllowScripts(dir, opts = {}) {
+    if (!npmSupportsAllowScripts())
+        return;
+    let pkgName;
+    try {
+        pkgName = readPackageJson(dir).name;
+    }
+    catch {
+        return;
+    }
+    const listing = await runCommandAsync('npm', ['approve-scripts', '--allow-scripts-pending'], { cwd: dir, silent: true });
+    if (!listing.success) {
+        if (opts.verbose)
+            console.log(colors.dim(`  (could not list pending install scripts in ${pkgName}: ${(listing.stderr || listing.output).trim().split('\n')[0]})`));
+        return;
+    }
+    const pending = parsePendingScripts(listing.output);
+    if (!pending.length)
+        return;
+    const trusted = new Set([...ownScopePackages(dir), ...localDepDisplayNames(dir)]);
+    const auto = pending.filter(p => trusted.has(p.name));
+    const ask = pending.filter(p => !trusted.has(p.name));
+    const label = (p) => p.versions.length ? `${p.name}@${p.versions.join('|')}` : p.name;
+    if (opts.dryRun) {
+        console.log(colors.dim(`  [dry-run] allowScripts in ${pkgName}: would approve ${auto.map(label).join(', ') || '(none)'}; would ask about ${ask.map(label).join(', ') || '(none)'}`));
+        return;
+    }
+    const approve = auto.map(p => p.name);
+    const deny = [];
+    const skipped = [];
+    if (ask.length) {
+        if (!process.stdin.isTTY) {
+            console.log(colors.yellow(`  ⚠ ${ask.length} third-party package(s) in ${pkgName} have install scripts not yet covered by allowScripts (no terminal to ask): ${ask.map(label).join(', ')}`));
+            console.log(colors.dim(`    npm approve-scripts --no-allow-scripts-pin <pkg>   or   npm deny-scripts <pkg>`));
+            skipped.push(...ask.map(label));
+        }
+        else {
+            console.log(colors.cyan(`npm gates install scripts for ${ask.length} third-party package(s) in ${pkgName}. Approvals are recorded in package.json "allowScripts" (name-only) and honored on the global install too.`));
+            let allRemaining = false;
+            for (const p of ask) {
+                const prebuilt = PREBUILT_SCRIPT_RUNNERS.test(p.scripts) ? ' — prebuilt-binary fetcher, the package ships binaries' : '';
+                if (allRemaining) {
+                    approve.push(p.name);
+                    continue;
+                }
+                const answer = await promptChoice(`  Allow install scripts for ${label(p)} (${p.scripts})${prebuilt}?  [y]es / [n]o, deny / [a]ll remaining / [s]kip for now:`, ['y', 'n', 'a', 's']);
+                switch (answer) {
+                    case 'y':
+                        approve.push(p.name);
+                        break;
+                    case 'a':
+                        approve.push(p.name);
+                        allRemaining = true;
+                        break;
+                    case 'n':
+                        deny.push(p.name);
+                        break;
+                    default:
+                        skipped.push(label(p));
+                        break; // 's', or EOF ('' from promptChoice)
+                }
+            }
+        }
+    }
+    // `npm approve-scripts <name>` matches installed nodes by the same display
+    // name the pending listing used, and writes the right key for each kind
+    // (registry name, or the file: path for a linked dep).
+    if (approve.length) {
+        const r = await runCommandAsync('npm', ['approve-scripts', '--no-allow-scripts-pin', ...approve], { cwd: dir, silent: true });
+        if (r.success)
+            console.log(colors.green(`  ✓ allowScripts: approved ${approve.join(', ')}${auto.length ? ` (${auto.length} own/local approved automatically)` : ''}`));
+        else
+            console.log(colors.red(`  ✗ npm approve-scripts failed: ${(r.stderr || r.output).trim().split('\n').find(l => /npm error/.test(l)) ?? 'see output'}`));
+    }
+    if (deny.length) {
+        const r = await runCommandAsync('npm', ['deny-scripts', ...deny], { cwd: dir, silent: true });
+        if (r.success)
+            console.log(colors.yellow(`  ✓ allowScripts: denied ${deny.join(', ')} (remove the entry from package.json allowScripts to reconsider)`));
+        else
+            console.log(colors.red(`  ✗ npm deny-scripts failed: ${(r.stderr || r.output).trim().split('\n').find(l => /npm error/.test(l)) ?? 'see output'}`));
+    }
+    if (skipped.length)
+        console.log(colors.dim(`  · install scripts still unreviewed (asked again next run): ${skipped.join(', ')}`));
 }
 /** Install-script runners that fetch or select a prebuilt binary and only
  *  compile when no prebuild matches the platform. A package using one of these
@@ -4248,9 +4519,10 @@ async function installGlobalWithRetry(pkgSpec, cwd, isNewPackage = false, maxRet
     let attempt = 0;
     let cacheFixRounds = 0;
     // Our own packages are trusted — we just built and published them from
-    // this very directory — so their install scripts run. Everything else
-    // stays behind npm's allowScripts gate.
-    const allowArgs = allowOwnScriptsArgs(cwd);
+    // this very directory — so their install scripts run, along with whatever
+    // the project's package.json allowScripts approved (ensureAllowScripts)
+    // and the user's .npmrc list. Everything else stays behind npm's gate.
+    const allowArgs = allowScriptsArgs(cwd);
     while (true) {
         // 2026-09-01 10:15 EDT — Claude Code (Opus 5), at Bob's direction.
         // `--prefer-online`: this install always targets a version published
@@ -4570,13 +4842,15 @@ async function verifyWslGlobalBins(cwd) {
     }
 }
 export async function installInWsl(wslArgs, opts = {}) {
-    // Same trust rule as the Windows installs: allow our own packages'
-    // install scripts, leave third-party ones gated. Probed against WSL's
+    // Same trust rule as the Windows installs: our own packages plus the
+    // project's package.json approvals, minus its denies. The Windows .npmrc
+    // list is left out — WSL's npm has its own .npmrc. Probed against WSL's
     // npm, which is a separate install from the Windows one.
     if (opts.cwd && wslArgs.includes('install') && await wslNpmSupportsAllowScripts()) {
-        const own = ownScopePackages(opts.cwd);
-        if (own.length)
-            wslArgs = [...wslArgs, '--allow-scripts', own.join(',')];
+        const project = projectAllowScripts(opts.cwd);
+        const names = [...new Set([...ownScopePackages(opts.cwd), ...project.allowed])].filter(n => !project.denied.includes(n));
+        if (names.length)
+            wslArgs = [...wslArgs, '--allow-scripts', names.join(',')];
     }
     const runOnce = async () => {
         console.log(colors.cyan(`> wsl ${wslArgs.join(' ')}`));
@@ -6869,6 +7143,10 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
         }
         if (!modulesOk)
             console.log(colors.yellow('Continuing with -force despite npm install failure...'));
+        // 2026-09-07 — Claude Code (Fable 5.1): same allowScripts upkeep the CLI
+        // entrypoint does; the global install below reads the result.
+        if (modulesOk)
+            await ensureAllowScripts(cwd, { verbose });
     }
     // Run build step if package.json has a build script (skip if CLI already built)
     if (pkg.scripts?.build && !options._fromCli) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/npmglobalize",
-  "version": "1.0.219",
+  "version": "1.0.221",
   "description": "Transform file: dependencies to npm versions for publishing",
   "main": "index.js",
   "type": "module",
@@ -32,7 +32,7 @@
   },
   "dependencies": {
     "@bobfrankston/freezepak": "^0.1.9",
-    "@bobfrankston/importgen": "^0.1.40",
+    "@bobfrankston/importgen": "^0.1.42",
     "@bobfrankston/themecolors": "^0.1.9",
     "@bobfrankston/userconfig": "^1.0.11",
     "@npmcli/package-json": "^7.0.4",
@@ -60,7 +60,7 @@
   ".transformedSnapshot": {
     "dependencies": {
       "@bobfrankston/freezepak": "^0.1.9",
-      "@bobfrankston/importgen": "^0.1.40",
+      "@bobfrankston/importgen": "^0.1.42",
       "@bobfrankston/themecolors": "^0.1.9",
       "@bobfrankston/userconfig": "^1.0.11",
       "@npmcli/package-json": "^7.0.4",