@bobfrankston/npmglobalize 1.0.223 → 1.0.225

package/README.md

@@ -200,6 +200,24 @@ node_modules check:
   **name-only** (`--no-allow-scripts-pin`): a version pin would re-open the
   question on every bump. Without a terminal (piped stdin) nothing is asked;
   the pending packages are listed with the command to approve them.
+- **Each answer is remembered for every project.** A decision about `sharp`'s
+  install script is about sharp, not about the project that asked first, so
+  `y`/`n`/`a` answers are stored once per user in your userconfig `npm.json5` (the file `@bobfrankston/userconfig` names as `configPath`; the prompt prints its location):
+
+  ```json5
+  allowScripts: {
+      sharp: true,
+      koffi: true,
+      'some-pkg': false,
+  },
+  ```
+
+  The next project that meets a remembered package gets its `package.json`
+  entry written silently (`· install-script decisions applied from …npm.json5:
+  sharp allowed`). A project's own `allowScripts` entry wins over the
+  remembered one, so a per-project exception is just an edit to that
+  `package.json`. Edit or delete an entry in `npm.json5` to change your mind
+  everywhere.
 - The field is written by npm itself, so a linked dep gets the key npm wants
   for it — the `file:` spec, e.g. `"file:../../../../projects/com/com-wrapper": true`
   (relative to the link's parent directory, not the project).
@@ -207,8 +225,8 @@ node_modules check:
 The **global** install then allowlists your own packages — it just built and
 published them from your source, so they're trusted — plus whatever the
 project's `allowScripts` approved (a `file:` key is mapped to that dep's
-published name) and your user `.npmrc` `allow-scripts` list, minus anything
-the project denied. Third-party packages you never approved stay gated:
+published name), your remembered `npm.json5` approvals, and your user `.npmrc`
+`allow-scripts` list, minus anything denied. Third-party packages you never approved stay gated:
 
 ```
 > npm install -g @bobfrankston/winpos@2.0.51 --allow-scripts @bobfrankston/winpos,@bobfrankston/msger,@bobfrankston/msgcommon,sharp

package/lib.d.ts

@@ -188,8 +188,16 @@ export interface WorkspaceResult {
 }
 /** Read and parse package.json from a directory */
 export declare function readPackageJson(dir: string): any;
-/** Global npm config from %USERPROFILE%\.userconfig\npm.json5 — via @bobfrankston/userconfig */
-export type UserNpmConfig = NpmCommonConfig;
+/** Global npm config, via @bobfrankston/userconfig.
+ *
+ *  2026-09-07 — Claude Code (Fable 5.1), at Bob's direction: the fields THIS app
+ *  keeps in the store are typed here, not in userconfig. userconfig manages the
+ *  low-level store and must know nothing about apps or their field names (Bob:
+ *  "It is just the manager of the low level store"). `allowScripts` was briefly
+ *  added to userconfig's NpmCommonConfig and has been moved back here. */
+export type UserNpmConfig = NpmCommonConfig & {
+    allowScripts?: Record<string, boolean>; /** Remembered npm install-script decisions by package name: true = allow, false = deny */
+};
 /** Get the .userconfig directory path (%USERPROFILE%\.userconfig) */
 export declare function getUserConfigDir(): string;
 /** Read global npm config from %USERPROFILE%\.userconfig\npm.json5 */
@@ -571,6 +579,18 @@ export declare function projectAllowScripts(dir: string): {
     allowed: string[];
     denied: string[];
 };
+/** The user's remembered install-script decisions, by package name.
+ *  `true` = approve, `false` = deny. Read from npm.json5 via userconfig. */
+export declare function globalAllowScripts(): Record<string, boolean>;
+/** Merge new decisions into the remembered set and persist it. */
+export declare function rememberAllowScripts(decisions: Record<string, boolean>): void;
+/** Project policy layered over the remembered user policy: a name the
+ *  project decided keeps the project's answer; every other remembered
+ *  name contributes its own. */
+export declare function effectiveAllowScripts(dir: string): {
+    allowed: string[];
+    denied: string[];
+};
 /** Bring the project's package.json `allowScripts` up to date with what is
  *  installed, so `npm install` stops warning and — once npm starts enforcing
  *  the policy — keeps running the scripts this project depends on.

package/lib.js

@@ -14,7 +14,7 @@ import os from 'os';
 import path from 'path';
 import { execSync, spawn, spawnSync } from 'child_process';
 import { builtinModules } from 'module';
-import { readConfig as readUserConfig, writeConfig as writeUserConfig, configDir } from '@bobfrankston/userconfig';
+import { readConfig as readUserConfig, writeConfig as writeUserConfig, configDir, configPath as userConfigPath } from '@bobfrankston/userconfig';
 import { freezeDependencies } from '@bobfrankston/freezepak';
 import { importgen as runImportgen } from '@bobfrankston/importgen';
 /** Wrapper for spawnSync that avoids DEP0190 (args + shell: true).
@@ -4372,18 +4372,55 @@ function npmrcAllowScripts() {
         return [];
     return r.output.split(/[,\s]+/).map(s => s.trim()).filter(Boolean);
 }
+// 2026-09-07 — Claude Code (Fable 5.1), at Bob's direction ("why not save the
+// accept scripts globally rather than asking me each time"). A yes/no about a
+// third-party package's install scripts is a decision about that PACKAGE, not
+// about the project that happened to ask first — sharp is sharp in whts and in
+// label-core. So every answer is remembered once, per user, in npm.json5
+// (`allowScripts: { sharp: true, "evil-pkg": false }`), and a project that
+// meets a remembered package gets its package.json field written without a
+// question. package.json stays the record npm itself reads; npm.json5 is the
+// memory that pre-answers it.
+/** The user's remembered install-script decisions, by package name.
+ *  `true` = approve, `false` = deny. Read from npm.json5 via userconfig. */
+export function globalAllowScripts() {
+    const policy = readUserNpmConfig().allowScripts;
+    return policy && typeof policy === 'object' ? { ...policy } : {};
+}
+/** Merge new decisions into the remembered set and persist it. */
+export function rememberAllowScripts(decisions) {
+    if (!Object.keys(decisions).length)
+        return;
+    writeUserNpmConfig({ allowScripts: { ...globalAllowScripts(), ...decisions } });
+}
 /** npm args allowing install scripts on a GLOBAL install: our own packages,
- *  whatever the project's package.json `allowScripts` approves, and the
- *  user's .npmrc list — minus anything the project denies. Empty when npm
- *  predates the policy (it runs the scripts anyway) or nothing is allowed. */
+ *  whatever the project's package.json `allowScripts` approves, the user's
+ *  remembered approvals (npm.json5), and the user's .npmrc list — minus
+ *  anything denied. A project's explicit decision wins over the remembered
+ *  one. Empty when npm predates the policy (it runs the scripts anyway) or
+ *  nothing is allowed. */
 function allowScriptsArgs(dir) {
     if (!npmSupportsAllowScripts())
         return [];
-    const project = projectAllowScripts(dir);
-    const names = [...new Set([...ownScopePackages(dir), ...project.allowed, ...npmrcAllowScripts()])]
-        .filter(n => !project.denied.includes(n));
+    const { allowed, denied } = effectiveAllowScripts(dir);
+    const names = [...new Set([...ownScopePackages(dir), ...allowed, ...npmrcAllowScripts()])]
+        .filter(n => !denied.includes(n));
     return names.length ? ['--allow-scripts', names.join(',')] : [];
 }
+/** Project policy layered over the remembered user policy: a name the
+ *  project decided keeps the project's answer; every other remembered
+ *  name contributes its own. */
+export function effectiveAllowScripts(dir) {
+    const project = projectAllowScripts(dir);
+    const allowed = new Set(project.allowed);
+    const denied = new Set(project.denied);
+    for (const [name, ok] of Object.entries(globalAllowScripts())) {
+        if (allowed.has(name) || denied.has(name))
+            continue;
+        (ok ? allowed : denied).add(name);
+    }
+    return { allowed: [...allowed], denied: [...denied] };
+}
 /** Parse the text listing of `npm approve-scripts --allow-scripts-pending`:
  *  one indented `name@version (event: cmd; event: cmd)` line per node,
  *  the same package repeated when several versions are installed. */
@@ -4435,16 +4472,23 @@ export async function ensureAllowScripts(dir, opts = {}) {
     if (!pending.length)
         return;
     const trusted = new Set([...ownScopePackages(dir), ...localDepDisplayNames(dir)]);
-    const auto = pending.filter(p => trusted.has(p.name));
-    const ask = pending.filter(p => !trusted.has(p.name));
     const label = (p) => p.versions.length ? `${p.name}@${p.versions.join('|')}` : p.name;
+    const auto = pending.filter(p => trusted.has(p.name));
+    // 2026-09-07 — Claude Code (Fable 5.1), at Bob's direction: a package already
+    // decided in npm.json5 is applied here without asking; only never-seen
+    // third-party packages reach the prompt, and their answers are remembered.
+    const remembered = globalAllowScripts();
+    const rememberedYes = pending.filter(p => !trusted.has(p.name) && remembered[p.name] === true);
+    const rememberedNo = pending.filter(p => !trusted.has(p.name) && remembered[p.name] === false);
+    const ask = pending.filter(p => !trusted.has(p.name) && !(p.name in remembered));
     if (opts.dryRun) {
-        console.log(colors.dim(`  [dry-run] allowScripts in ${pkgName}: would approve ${auto.map(label).join(', ') || '(none)'}; would ask about ${ask.map(label).join(', ') || '(none)'}`));
+        console.log(colors.dim(`  [dry-run] allowScripts in ${pkgName}: would approve ${[...auto, ...rememberedYes].map(label).join(', ') || '(none)'}; would deny ${rememberedNo.map(label).join(', ') || '(none)'}; would ask about ${ask.map(label).join(', ') || '(none)'}`));
         return;
     }
-    const approve = auto.map(p => p.name);
-    const deny = [];
+    const approve = [...auto, ...rememberedYes].map(p => p.name);
+    const deny = rememberedNo.map(p => p.name);
     const skipped = [];
+    const decisions = {};
     if (ask.length) {
         if (!process.stdin.isTTY) {
             console.log(colors.yellow(`  ⚠ ${ask.length} third-party package(s) in ${pkgName} have install scripts not yet covered by allowScripts (no terminal to ask): ${ask.map(label).join(', ')}`));
@@ -4452,40 +4496,56 @@ export async function ensureAllowScripts(dir, opts = {}) {
             skipped.push(...ask.map(label));
         }
         else {
-            console.log(colors.cyan(`npm gates install scripts for ${ask.length} third-party package(s) in ${pkgName}. Approvals are recorded in package.json "allowScripts" (name-only) and honored on the global install too.`));
+            console.log(colors.cyan(`npm gates install scripts for ${ask.length} third-party package(s) in ${pkgName}. Each answer is recorded in package.json "allowScripts" (name-only), honored on the global install, and remembered for every project in ${userConfigPath}.`));
             let allRemaining = false;
             for (const p of ask) {
                 const prebuilt = PREBUILT_SCRIPT_RUNNERS.test(p.scripts) ? ' — prebuilt-binary fetcher, the package ships binaries' : '';
                 if (allRemaining) {
                     approve.push(p.name);
+                    decisions[p.name] = true;
                     continue;
                 }
                 const answer = await promptChoice(`  Allow install scripts for ${label(p)} (${p.scripts})${prebuilt}?  [y]es / [n]o, deny / [a]ll remaining / [s]kip for now:`, ['y', 'n', 'a', 's']);
                 switch (answer) {
                     case 'y':
                         approve.push(p.name);
+                        decisions[p.name] = true;
                         break;
                     case 'a':
                         approve.push(p.name);
+                        decisions[p.name] = true;
                         allRemaining = true;
                         break;
                     case 'n':
                         deny.push(p.name);
+                        decisions[p.name] = false;
                         break;
                     default:
                         skipped.push(label(p));
                         break; // 's', or EOF ('' from promptChoice)
                 }
             }
+            try {
+                rememberAllowScripts(decisions);
+            }
+            catch (error) {
+                // Not swallowed: the project's package.json still gets the answer below;
+                // only the cross-project memory is lost, and the user is told so.
+                console.log(colors.yellow(`  ⚠ could not remember install-script decisions in ${userConfigPath}: ${error.message}`));
+            }
         }
     }
+    if (rememberedYes.length || rememberedNo.length) {
+        console.log(colors.dim(`  · install-script decisions applied from ${userConfigPath}: ${[...rememberedYes.map(p => `${p.name} allowed`), ...rememberedNo.map(p => `${p.name} denied`)].join(', ')}`));
+    }
     // `npm approve-scripts <name>` matches installed nodes by the same display
     // name the pending listing used, and writes the right key for each kind
     // (registry name, or the file: path for a linked dep).
     if (approve.length) {
         const r = await runCommandAsync('npm', ['approve-scripts', '--no-allow-scripts-pin', ...approve], { cwd: dir, silent: true });
+        const autoNote = [auto.length ? `${auto.length} own/local` : '', rememberedYes.length ? `${rememberedYes.length} remembered` : ''].filter(Boolean).join(', ');
         if (r.success)
-            console.log(colors.green(`  ✓ allowScripts: approved ${approve.join(', ')}${auto.length ? ` (${auto.length} own/local approved automatically)` : ''}`));
+            console.log(colors.green(`  ✓ allowScripts: approved ${approve.join(', ')}${autoNote ? ` (${autoNote} approved automatically)` : ''}`));
         else
             console.log(colors.red(`  ✗ npm approve-scripts failed: ${(r.stderr || r.output).trim().split('\n').find(l => /npm error/.test(l)) ?? 'see output'}`));
     }
@@ -4899,8 +4959,9 @@ export async function installInWsl(wslArgs, opts = {}) {
     // list is left out — WSL's npm has its own .npmrc. Probed against WSL's
     // npm, which is a separate install from the Windows one.
     if (opts.cwd && wslArgs.includes('install') && await wslNpmSupportsAllowScripts()) {
-        const project = projectAllowScripts(opts.cwd);
-        const names = [...new Set([...ownScopePackages(opts.cwd), ...project.allowed])].filter(n => !project.denied.includes(n));
+        // 2026-09-07 — Claude Code (Fable 5.1): remembered npm.json5 decisions apply in WSL too.
+        const policy = effectiveAllowScripts(opts.cwd);
+        const names = [...new Set([...ownScopePackages(opts.cwd), ...policy.allowed])].filter(n => !policy.denied.includes(n));
         if (names.length)
             wslArgs = [...wslArgs, '--allow-scripts', names.join(',')];
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/npmglobalize",
-  "version": "1.0.223",
+  "version": "1.0.225",
   "description": "Transform file: dependencies to npm versions for publishing",
   "main": "index.js",
   "type": "module",
@@ -34,7 +34,7 @@
     "@bobfrankston/freezepak": "^0.1.9",
     "@bobfrankston/importgen": "^0.1.43",
     "@bobfrankston/themecolors": "^0.1.10",
-    "@bobfrankston/userconfig": "^1.0.11",
+    "@bobfrankston/userconfig": "^1.0.12",
     "@npmcli/package-json": "^7.0.4",
     "json5": "^2.2.3",
     "libnpmversion": "^8.0.3",
@@ -62,7 +62,7 @@
       "@bobfrankston/freezepak": "^0.1.9",
       "@bobfrankston/importgen": "^0.1.43",
       "@bobfrankston/themecolors": "^0.1.10",
-      "@bobfrankston/userconfig": "^1.0.11",
+      "@bobfrankston/userconfig": "^1.0.12",
       "@npmcli/package-json": "^7.0.4",
       "json5": "^2.2.3",
       "libnpmversion": "^8.0.3",