@bobfrankston/npmglobalize 1.0.220 → 1.0.221

package/README.md

@@ -172,15 +172,57 @@ exits 0 — e.g. `@bobfrankston/msger`'s postinstall copies its native binary
 into the per-user bin dir its launcher reads from, and skipping it leaves a
 stale exe behind a green checkmark.
 
-npmglobalize therefore allowlists **your own packages** on the global install
-it performs — it just built and published them from your source, so they're
-trusted — and leaves third-party packages gated:
-
-```
-> npm install -g @bobfrankston/winpos@2.0.51 --allow-scripts @bobfrankston/winpos,@bobfrankston/msger,@bobfrankston/msgcommon
-```
-
-Anything npm skips is reported rather than buried in the captured output:
+A **project** install is the opposite case: npm *rejects* `--allow-scripts`
+there and reads the policy from the `allowScripts` field of the root
+`package.json` (maintained by `npm approve-scripts` / `npm deny-scripts`),
+falling back to `allow-scripts` in `.npmrc` only when the field is absent.
+Until that field covers everything installed, every `npm install` ends with a
+`npm warn allow-scripts … not yet covered by allowScripts` block.
+
+npmglobalize keeps that field current, once per run, right after the
+node_modules check:
+
+- **Own-scope packages and `file:` deps are approved without asking** — they
+  are your source.
+- **Each third-party package is asked about**, showing the script npm would
+  run and whether it is a prebuilt-binary fetcher:
+
+  ```
+  npm gates install scripts for 2 third-party package(s) in @bobfrankston/whts. Approvals are recorded in package.json "allowScripts" (name-only) and honored on the global install too.
+    Allow install scripts for sharp@0.33.5 (install: node install/check)?  [y]es / [n]o, deny / [a]ll remaining / [s]kip for now: y
+    Allow install scripts for koffi@2.14.1|2.16.1 (install: node src/cnoke/cnoke.js --prebuild) — prebuilt-binary fetcher, the package ships binaries?  [y]es / [n]o, deny / [a]ll remaining / [s]kip for now: y
+    ✓ allowScripts: approved @bobfrankston/msger, com-wrapper, sharp, koffi (2 own/local approved automatically)
+  ```
+
+  `y` approves, `n` records a deny (`"pkg": false`, npm's own mechanism — the
+  question is not repeated; delete the entry to reconsider), `a` approves
+  everything remaining, `s` leaves it pending for next time. Approvals are
+  **name-only** (`--no-allow-scripts-pin`): a version pin would re-open the
+  question on every bump. Without a terminal (piped stdin) nothing is asked;
+  the pending packages are listed with the command to approve them.
+- The field is written by npm itself, so a linked dep gets the key npm wants
+  for it — the `file:` spec, e.g. `"file:../../../../projects/com/com-wrapper": true`
+  (relative to the link's parent directory, not the project).
+
+The **global** install then allowlists your own packages — it just built and
+published them from your source, so they're trusted — plus whatever the
+project's `allowScripts` approved (a `file:` key is mapped to that dep's
+published name) and your user `.npmrc` `allow-scripts` list, minus anything
+the project denied. Third-party packages you never approved stay gated:
+
+```
+> npm install -g @bobfrankston/winpos@2.0.51 --allow-scripts @bobfrankston/winpos,@bobfrankston/msger,@bobfrankston/msgcommon,sharp
+```
+
+npm takes the allowlist from the *first* source that has one rather than
+merging — CLI flag, then `package.json`, then `.npmrc` — which is why the
+`.npmrc` list is folded into the flag here, and why npm prints
+`.npmrc allow-scripts setting is being ignored because package.json declares
+its own allowScripts field` on project installs once the field exists. That
+warning is npm's layering at work, not a problem.
+
+Anything npm skips on the global install is reported rather than buried in
+the captured output:
 
 ```
   · Skipped koffi@2.16.3 install script — prebuilt-binary fetcher, the package ships binaries; normally harmless.

package/cli.js

@@ -2,7 +2,7 @@
 /**
  * npmglobalize CLI - Transform file: dependencies to npm versions for publishing
  */
-import { globalize, globalizeWorkspace, installCleanupHandlers, readConfig, readPackageJson, readUserNpmConfig, writeConfig, writePackageJson, getBuildIssues, clearBuildIssues, ensureFileDepModules, buildProject, buildFileDepsTopologically, reportTs7Deprecations, fixTs7Deprecations, canonicalCase } from './lib.js';
+import { globalize, globalizeWorkspace, installCleanupHandlers, readConfig, readPackageJson, readUserNpmConfig, writeConfig, writePackageJson, getBuildIssues, clearBuildIssues, ensureFileDepModules, ensureAllowScripts, buildProject, buildFileDepsTopologically, reportTs7Deprecations, fixTs7Deprecations, canonicalCase } from './lib.js';
 import fs from 'fs';
 import path from 'path';
 import { colors } from './colors.js';
@@ -609,6 +609,11 @@ export async function main() {
         }
         if (!modulesOk)
             console.log(colors.warn('Continuing with -force despite npm install failure...'));
+        // 2026-09-07 — Claude Code (Fable 5.1), at Bob's direction: keep package.json
+        // "allowScripts" current — own/file: deps approved, third-party ones asked about —
+        // so npm's install-script gate stops warning and the global install honors it.
+        if (modulesOk)
+            await ensureAllowScripts(cwd, { dryRun: !!cliOptions.dryRun, verbose: !!cliOptions.verbose });
         const depsOk = await buildFileDepsTopologically(cwd, { verbose: !!cliOptions.verbose, force: !!cliOptions.force, forceBuild: !!cliOptions.forceBuild });
         if (!depsOk && !cliOptions.force) {
             printBuildSummary();

package/lib.d.ts

@@ -559,6 +559,33 @@ export declare function fixPuppeteerCorruptedCache(combined: string): {
  *  Returns [] for an unscoped package: there's no way to tell an unscoped
  *  package of ours from a third-party one by name alone. */
 export declare function ownScopePackages(dir: string): string[];
+/** The project's recorded install-script policy, as registry names. Keys in
+ *  `allowScripts` are `name`, `name@version`, or a `file:` / absolute path;
+ *  path keys are mapped to the target's manifest name so an approval given
+ *  to a linked dep carries over to the global install, where that same dep
+ *  arrives from the registry under its published name. */
+export declare function projectAllowScripts(dir: string): {
+    allowed: string[];
+    denied: string[];
+};
+/** Bring the project's package.json `allowScripts` up to date with what is
+ *  installed, so `npm install` stops warning and — once npm starts enforcing
+ *  the policy — keeps running the scripts this project depends on.
+ *
+ *  Own-scope packages and `file:` deps are approved without asking: they are
+ *  this user's source. Anything else is asked about, one package at a time,
+ *  showing the script npm would run. "no" records a deny (npm's own
+ *  mechanism, `npm deny-scripts`) so the question isn't repeated; "skip"
+ *  leaves it pending for next time. Approvals are name-only
+ *  (`--no-allow-scripts-pin`): a version pin would re-open the question on
+ *  every bump, which is exactly the churn this exists to remove.
+ *
+ *  Runs once per project root, not per cascade dep: npm reads the policy
+ *  from the root package.json only. ~1.5s (arborist loads the actual tree). */
+export declare function ensureAllowScripts(dir: string, opts?: {
+    dryRun?: boolean;
+    verbose?: boolean;
+}): Promise<void>;
 /** Run a command and return success status */
 export declare function runCommand(cmd: string, args: string[], options?: {
     silent?: boolean;

package/lib.js

@@ -4214,20 +4214,238 @@ export function ownScopePackages(dir) {
     walk(pkg, dir);
     return [...found];
 }
-/** npm args allowing install scripts for our own packages only. Empty when
- *  npm predates the policy (it runs the scripts anyway) or the package is
- *  unscoped.
- *
- *  Note: the CLI layer *replaces* the .npmrc layer rather than merging with
- *  it (first source with any config wins, per npm's resolve-allow-scripts),
- *  so passing this suppresses any allow-scripts entries in .npmrc for this
- *  install. Third-party approvals therefore belong on the command line too,
- *  not in .npmrc. */
-function allowOwnScriptsArgs(dir) {
+// 2026-09-07 — Claude Code (Fable 5.1), at Bob's direction ("I want you to handle
+// this", after `npm un itemgen` in whts warned about com-wrapper, msger and sharp).
+// The project side of the policy. npm REJECTS `--allow-scripts` on a project-scoped
+// install (EALLOWSCRIPTS), so the only place a project's approvals can live is the
+// `allowScripts` field of its package.json, maintained by `npm approve-scripts`.
+// npmglobalize now keeps that field current (ensureAllowScripts) and feeds it back
+// into the global install's `--allow-scripts` flag (allowScriptsArgs), so a package
+// is trusted once, in one place, for both kinds of install.
+/** Names of the project's `file:` dependencies as npm displays them in the
+ *  allowScripts pending list. A linked dep has no registry identity, so npm
+ *  falls back to the link target's directory name (`com-wrapper` for
+ *  `@bobfrankston/com-wrapper` at ../../projects/com/com-wrapper); the
+ *  manifest name is included too in case that fallback ever changes. */
+function localDepDisplayNames(dir) {
+    let pkg;
+    try {
+        pkg = readPackageJson(dir);
+    }
+    catch {
+        return [];
+    }
+    const names = [];
+    for (const key of ['dependencies', 'devDependencies', 'optionalDependencies']) {
+        const deps = pkg[key];
+        if (!deps || typeof deps !== 'object')
+            continue;
+        for (const spec of Object.values(deps)) {
+            if (typeof spec !== 'string' || !spec.startsWith('file:'))
+                continue;
+            const target = path.resolve(dir, spec.slice('file:'.length));
+            names.push(path.basename(target));
+            try {
+                const name = readPackageJson(target).name;
+                if (name)
+                    names.push(name);
+            }
+            catch { /* target missing or unreadable — the basename alone still identifies it */ }
+        }
+    }
+    return names;
+}
+/** The project's recorded install-script policy, as registry names. Keys in
+ *  `allowScripts` are `name`, `name@version`, or a `file:` / absolute path;
+ *  path keys are mapped to the target's manifest name so an approval given
+ *  to a linked dep carries over to the global install, where that same dep
+ *  arrives from the registry under its published name. */
+export function projectAllowScripts(dir) {
+    const allowed = [];
+    const denied = [];
+    let pkg;
+    try {
+        pkg = readPackageJson(dir);
+    }
+    catch {
+        return { allowed, denied };
+    }
+    const policy = pkg.allowScripts;
+    if (!policy || typeof policy !== 'object')
+        return { allowed, denied };
+    // A `file:` key written by `npm approve-scripts` is the link's saved spec,
+    // which npm records relative to the LINK's parent directory — verified on
+    // whts: package.json says `file:../../projects/com/com-wrapper`, the policy
+    // key came out `file:../../../../projects/com/com-wrapper`, i.e. relative to
+    // node_modules/@bobfrankston/. A hand-written key is relative to the
+    // project. Try both bases.
+    const bases = new Set([dir]);
+    for (const key of ['dependencies', 'devDependencies', 'optionalDependencies']) {
+        for (const [name, spec] of Object.entries(pkg[key] || {})) {
+            if (typeof spec === 'string' && spec.startsWith('file:'))
+                bases.add(path.dirname(path.join(dir, 'node_modules', name)));
+        }
+    }
+    const manifestName = (rel) => {
+        for (const base of bases) {
+            try {
+                return readPackageJson(path.resolve(base, rel)).name;
+            }
+            catch { /* not this base — try the next; the caller skips the key when none has it */ }
+        }
+        return null;
+    };
+    for (const [key, value] of Object.entries(policy)) {
+        let name;
+        if (key.startsWith('file:') || path.isAbsolute(key)) {
+            name = manifestName(key.startsWith('file:') ? key.slice('file:'.length) : key);
+        }
+        else {
+            // strip a trailing @version; a scoped name keeps its leading @
+            name = key.replace(/(.)@[^@]*$/, '$1');
+        }
+        if (!name)
+            continue;
+        (value === false ? denied : allowed).push(name);
+    }
+    return { allowed, denied };
+}
+/** Names from the user's own `allow-scripts` npm config (.npmrc layers).
+ *  npm's resolver takes the FIRST layer with any config and ignores the
+ *  rest, so a CLI flag would silently suppress these — merging them into the
+ *  flag keeps `npm config set allow-scripts=… --location=user` meaningful. */
+function npmrcAllowScripts() {
+    const r = runCommand('npm', ['config', 'get', 'allow-scripts'], { silent: true });
+    if (!r.success || isUnknownConfig(r.output))
+        return [];
+    return r.output.split(/[,\s]+/).map(s => s.trim()).filter(Boolean);
+}
+/** npm args allowing install scripts on a GLOBAL install: our own packages,
+ *  whatever the project's package.json `allowScripts` approves, and the
+ *  user's .npmrc list — minus anything the project denies. Empty when npm
+ *  predates the policy (it runs the scripts anyway) or nothing is allowed. */
+function allowScriptsArgs(dir) {
     if (!npmSupportsAllowScripts())
         return [];
-    const own = ownScopePackages(dir);
-    return own.length ? ['--allow-scripts', own.join(',')] : [];
+    const project = projectAllowScripts(dir);
+    const names = [...new Set([...ownScopePackages(dir), ...project.allowed, ...npmrcAllowScripts()])]
+        .filter(n => !project.denied.includes(n));
+    return names.length ? ['--allow-scripts', names.join(',')] : [];
+}
+/** Parse the text listing of `npm approve-scripts --allow-scripts-pending`:
+ *  one indented `name@version (event: cmd; event: cmd)` line per node,
+ *  the same package repeated when several versions are installed. */
+function parsePendingScripts(output) {
+    const byName = new Map();
+    for (const line of output.split('\n')) {
+        const m = line.match(/^  (\S+?)(?:@([^@\s]+))? \((.*)\)\s*$/);
+        if (!m)
+            continue;
+        const [, name, version, scripts] = m;
+        const entry = byName.get(name) ?? { name, versions: [], scripts };
+        if (version)
+            entry.versions.push(version);
+        byName.set(name, entry);
+    }
+    return [...byName.values()];
+}
+/** Bring the project's package.json `allowScripts` up to date with what is
+ *  installed, so `npm install` stops warning and — once npm starts enforcing
+ *  the policy — keeps running the scripts this project depends on.
+ *
+ *  Own-scope packages and `file:` deps are approved without asking: they are
+ *  this user's source. Anything else is asked about, one package at a time,
+ *  showing the script npm would run. "no" records a deny (npm's own
+ *  mechanism, `npm deny-scripts`) so the question isn't repeated; "skip"
+ *  leaves it pending for next time. Approvals are name-only
+ *  (`--no-allow-scripts-pin`): a version pin would re-open the question on
+ *  every bump, which is exactly the churn this exists to remove.
+ *
+ *  Runs once per project root, not per cascade dep: npm reads the policy
+ *  from the root package.json only. ~1.5s (arborist loads the actual tree). */
+export async function ensureAllowScripts(dir, opts = {}) {
+    if (!npmSupportsAllowScripts())
+        return;
+    let pkgName;
+    try {
+        pkgName = readPackageJson(dir).name;
+    }
+    catch {
+        return;
+    }
+    const listing = await runCommandAsync('npm', ['approve-scripts', '--allow-scripts-pending'], { cwd: dir, silent: true });
+    if (!listing.success) {
+        if (opts.verbose)
+            console.log(colors.dim(`  (could not list pending install scripts in ${pkgName}: ${(listing.stderr || listing.output).trim().split('\n')[0]})`));
+        return;
+    }
+    const pending = parsePendingScripts(listing.output);
+    if (!pending.length)
+        return;
+    const trusted = new Set([...ownScopePackages(dir), ...localDepDisplayNames(dir)]);
+    const auto = pending.filter(p => trusted.has(p.name));
+    const ask = pending.filter(p => !trusted.has(p.name));
+    const label = (p) => p.versions.length ? `${p.name}@${p.versions.join('|')}` : p.name;
+    if (opts.dryRun) {
+        console.log(colors.dim(`  [dry-run] allowScripts in ${pkgName}: would approve ${auto.map(label).join(', ') || '(none)'}; would ask about ${ask.map(label).join(', ') || '(none)'}`));
+        return;
+    }
+    const approve = auto.map(p => p.name);
+    const deny = [];
+    const skipped = [];
+    if (ask.length) {
+        if (!process.stdin.isTTY) {
+            console.log(colors.yellow(`  ⚠ ${ask.length} third-party package(s) in ${pkgName} have install scripts not yet covered by allowScripts (no terminal to ask): ${ask.map(label).join(', ')}`));
+            console.log(colors.dim(`    npm approve-scripts --no-allow-scripts-pin <pkg>   or   npm deny-scripts <pkg>`));
+            skipped.push(...ask.map(label));
+        }
+        else {
+            console.log(colors.cyan(`npm gates install scripts for ${ask.length} third-party package(s) in ${pkgName}. Approvals are recorded in package.json "allowScripts" (name-only) and honored on the global install too.`));
+            let allRemaining = false;
+            for (const p of ask) {
+                const prebuilt = PREBUILT_SCRIPT_RUNNERS.test(p.scripts) ? ' — prebuilt-binary fetcher, the package ships binaries' : '';
+                if (allRemaining) {
+                    approve.push(p.name);
+                    continue;
+                }
+                const answer = await promptChoice(`  Allow install scripts for ${label(p)} (${p.scripts})${prebuilt}?  [y]es / [n]o, deny / [a]ll remaining / [s]kip for now:`, ['y', 'n', 'a', 's']);
+                switch (answer) {
+                    case 'y':
+                        approve.push(p.name);
+                        break;
+                    case 'a':
+                        approve.push(p.name);
+                        allRemaining = true;
+                        break;
+                    case 'n':
+                        deny.push(p.name);
+                        break;
+                    default:
+                        skipped.push(label(p));
+                        break; // 's', or EOF ('' from promptChoice)
+                }
+            }
+        }
+    }
+    // `npm approve-scripts <name>` matches installed nodes by the same display
+    // name the pending listing used, and writes the right key for each kind
+    // (registry name, or the file: path for a linked dep).
+    if (approve.length) {
+        const r = await runCommandAsync('npm', ['approve-scripts', '--no-allow-scripts-pin', ...approve], { cwd: dir, silent: true });
+        if (r.success)
+            console.log(colors.green(`  ✓ allowScripts: approved ${approve.join(', ')}${auto.length ? ` (${auto.length} own/local approved automatically)` : ''}`));
+        else
+            console.log(colors.red(`  ✗ npm approve-scripts failed: ${(r.stderr || r.output).trim().split('\n').find(l => /npm error/.test(l)) ?? 'see output'}`));
+    }
+    if (deny.length) {
+        const r = await runCommandAsync('npm', ['deny-scripts', ...deny], { cwd: dir, silent: true });
+        if (r.success)
+            console.log(colors.yellow(`  ✓ allowScripts: denied ${deny.join(', ')} (remove the entry from package.json allowScripts to reconsider)`));
+        else
+            console.log(colors.red(`  ✗ npm deny-scripts failed: ${(r.stderr || r.output).trim().split('\n').find(l => /npm error/.test(l)) ?? 'see output'}`));
+    }
+    if (skipped.length)
+        console.log(colors.dim(`  · install scripts still unreviewed (asked again next run): ${skipped.join(', ')}`));
 }
 /** Install-script runners that fetch or select a prebuilt binary and only
  *  compile when no prebuild matches the platform. A package using one of these
@@ -4301,9 +4519,10 @@ async function installGlobalWithRetry(pkgSpec, cwd, isNewPackage = false, maxRet
     let attempt = 0;
     let cacheFixRounds = 0;
     // Our own packages are trusted — we just built and published them from
-    // this very directory — so their install scripts run. Everything else
-    // stays behind npm's allowScripts gate.
-    const allowArgs = allowOwnScriptsArgs(cwd);
+    // this very directory — so their install scripts run, along with whatever
+    // the project's package.json allowScripts approved (ensureAllowScripts)
+    // and the user's .npmrc list. Everything else stays behind npm's gate.
+    const allowArgs = allowScriptsArgs(cwd);
     while (true) {
         // 2026-09-01 10:15 EDT — Claude Code (Opus 5), at Bob's direction.
         // `--prefer-online`: this install always targets a version published
@@ -4623,13 +4842,15 @@ async function verifyWslGlobalBins(cwd) {
     }
 }
 export async function installInWsl(wslArgs, opts = {}) {
-    // Same trust rule as the Windows installs: allow our own packages'
-    // install scripts, leave third-party ones gated. Probed against WSL's
+    // Same trust rule as the Windows installs: our own packages plus the
+    // project's package.json approvals, minus its denies. The Windows .npmrc
+    // list is left out — WSL's npm has its own .npmrc. Probed against WSL's
     // npm, which is a separate install from the Windows one.
     if (opts.cwd && wslArgs.includes('install') && await wslNpmSupportsAllowScripts()) {
-        const own = ownScopePackages(opts.cwd);
-        if (own.length)
-            wslArgs = [...wslArgs, '--allow-scripts', own.join(',')];
+        const project = projectAllowScripts(opts.cwd);
+        const names = [...new Set([...ownScopePackages(opts.cwd), ...project.allowed])].filter(n => !project.denied.includes(n));
+        if (names.length)
+            wslArgs = [...wslArgs, '--allow-scripts', names.join(',')];
     }
     const runOnce = async () => {
         console.log(colors.cyan(`> wsl ${wslArgs.join(' ')}`));
@@ -6922,6 +7143,10 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
         }
         if (!modulesOk)
             console.log(colors.yellow('Continuing with -force despite npm install failure...'));
+        // 2026-09-07 — Claude Code (Fable 5.1): same allowScripts upkeep the CLI
+        // entrypoint does; the global install below reads the result.
+        if (modulesOk)
+            await ensureAllowScripts(cwd, { verbose });
     }
     // Run build step if package.json has a build script (skip if CLI already built)
     if (pkg.scripts?.build && !options._fromCli) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/npmglobalize",
-  "version": "1.0.220",
+  "version": "1.0.221",
   "description": "Transform file: dependencies to npm versions for publishing",
   "main": "index.js",
   "type": "module",
@@ -32,7 +32,7 @@
   },
   "dependencies": {
     "@bobfrankston/freezepak": "^0.1.9",
-    "@bobfrankston/importgen": "^0.1.40",
+    "@bobfrankston/importgen": "^0.1.42",
     "@bobfrankston/themecolors": "^0.1.9",
     "@bobfrankston/userconfig": "^1.0.11",
     "@npmcli/package-json": "^7.0.4",
@@ -60,7 +60,7 @@
   ".transformedSnapshot": {
     "dependencies": {
       "@bobfrankston/freezepak": "^0.1.9",
-      "@bobfrankston/importgen": "^0.1.40",
+      "@bobfrankston/importgen": "^0.1.42",
       "@bobfrankston/themecolors": "^0.1.9",
       "@bobfrankston/userconfig": "^1.0.11",
       "@npmcli/package-json": "^7.0.4",