@octanejs/cli 0.0.4 → 0.0.6

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@octanejs/cli",
-  "version": "0.0.4",
+  "version": "0.0.6",
   "type": "module",
   "engines": {
-    "node": ">=22"
+    "node": ">=22.22.2"
   },
   "description": "The Octane command line: diagnose, configure, and extend an Octane project.",
   "license": "MIT",

package/src/commands/add.js

@@ -90,7 +90,8 @@ export default defineCommand({
 			} else {
 				const spinner = ctx.ui.spinner(`Installing ${toInstall.join(', ')}`);
 				const ran = await installPackages(ctx, project, toInstall, { dev: input.flags.dev });
-				spinner.stop(ran);
+				spinner.stop(ran.command);
+				if (ran.warnings.length > 0) ctx.ui.note('Do this by hand', ran.warnings);
 			}
 		}
 

package/src/commands/init/index.js

@@ -3,7 +3,7 @@ import path from 'node:path';
 import { defineCommand } from '../../kernel/command.js';
 import { setCompilerOption } from '../../kernel/edit.js';
 import { CliError, EXIT } from '../../kernel/errors.js';
-import { PACKAGE_MANAGERS, installPackages } from '../../kernel/install.js';
+import { PACKAGE_MANAGERS, PNPM_ALLOWED_BUILDS, installPackages } from '../../kernel/install.js';
 import {
 	MODES,
 	PRETTIER_CONFIG_FILES,
@@ -458,6 +458,11 @@ export async function applyInit(ctx, project, options) {
 
 	/** @type {string[]} */
 	const installed = [];
+	// Every install in this run hits the same blocked build script, and the same
+	// line three times reads like three problems.
+	const warn = (/** @type {string[]} */ lines) => {
+		for (const line of lines) if (!manual.includes(line)) manual.push(line);
+	};
 	if (options.install !== false && dependencies.length + devDependencies.length > 0) {
 		const spinner = ctx.ui.spinner(`Installing with ${installing.packageManager ?? 'npm'}`);
 		try {
@@ -466,9 +471,11 @@ export async function applyInit(ctx, project, options) {
 				[devDependencies, true],
 			]) {
 				if (/** @type {string[]} */ (names).length === 0) continue;
-				await installPackages(ctx, installing, /** @type {string[]} */ (names), {
+				const ran = await installPackages(ctx, installing, /** @type {string[]} */ (names), {
 					dev: Boolean(dev),
+					allowBuilds: PNPM_ALLOWED_BUILDS,
 				});
+				warn(ran.warnings);
 				installed.push(.../** @type {string[]} */ (names));
 			}
 
@@ -481,7 +488,11 @@ export async function applyInit(ctx, project, options) {
 				if (range === null) {
 					manual.push('Install typescript, at the range @tsrx/typescript-plugin declares.');
 				} else {
-					await installPackages(ctx, installing, [`typescript@${range}`], { dev: true });
+					const ran = await installPackages(ctx, installing, [`typescript@${range}`], {
+						dev: true,
+						allowBuilds: PNPM_ALLOWED_BUILDS,
+					});
+					warn(ran.warnings);
 					installed.push('typescript');
 				}
 			}

package/src/data/octane-data.json

@@ -2,7 +2,7 @@
   "bindings": [
     {
       "name": "@octanejs/apollo-client",
-      "version": "0.1.19",
+      "version": "0.1.21",
       "category": "AI, data, and routing",
       "upstream": { "package": "@apollo/client", "version": "4.2.6" },
       "surface": "Complete published client adapter surface: all 18 @apollo/client/react runtime exports and their Apollo 4.2.6 TypeScript declarations, framework-neutral root/testing exports, an Octane MockedProvider, and the Octane-native /react/ssr prerenderStatic entry.",
@@ -16,7 +16,7 @@
     },
     {
       "name": "@octanejs/aria",
-      "version": "0.0.18",
+      "version": "0.0.20",
       "category": "UI and interaction",
       "upstream": { "package": "react-aria", "version": "3.50.0" },
       "surface": "Phases 0-5 + the Tree/Table follow-up complete. Phases 0-1: the utils foundation, SSR utilities, the complete interactions area (usePress, useHover, focus/keyboard family, useLongPress, useMove, Pressable/PressResponder), the focus area (FocusScope with containment/restore/focus managers, FocusRing, useFocusRing, useHasTabbableChild), the i18n area (I18nProvider, locale/collator/formatter/filter hooks), form validation (useFormValidation + stately useFormValidationState), and the leaf hooks: useButton/useToggleButton(+Group), useLabel/useField, useCheckbox(+Group/+Item), useRadio/useRadioGroup, useSwitch, useTextField, useSearchField, useProgressBar, useMeter, useSeparator, useLink, useDisclosure, useToolbar, VisuallyHidden. Phase 2 adds the collections + selection tier: the stately collections engine (CollectionBuilder/Item/Section/useCollection) and selection core (Selection/SelectionManager/useMultipleSelectionState), the stately state hooks (useListState/useSingleSelectListState, useTreeState, useMenuTriggerState/useSubmenuTriggerState, useOverlayTriggerState, useSelectState, useComboBoxState, useTabListState, useNumberFieldState, useSliderState), the aria selection area (useSelectableCollection/-Item/-List, useTypeSelect, ListKeyboardDelegate, DOMLayoutDelegate), and the aria hooks useListBox/useOption/useListBoxSection, useMenu/useMenuItem/useMenuSection/useMenuTrigger/useSubmenuTrigger, useTab/useTabList/useTabPanel, useSlider/useSliderThumb, useNumberField, useGridList(+Item/+Section/+SelectionCheckbox), useTag/useTagGroup, useBreadcrumbs/useBreadcrumbItem — plus the matching react-stately state hooks under `@octanejs/aria/stately`. Phase 3 adds the overlays hooks tier: the stately `useTooltipTriggerState` and the whole aria overlays area (usePreventScroll, ariaHideOutside, DismissButton, PortalProvider, useOverlay, useOverlayTrigger, useOverlayPosition + calculatePosition, Overlay/useOverlayFocusContain, useModal/ModalProvider/OverlayProvider/OverlayContainer, useModalOverlay, usePopover), plus the consumers useDialog, useTooltip/useTooltipTrigger, useSelect/useHiddenSelect/HiddenSelect, and useComboBox. Differential-verified byte-identical against the real react-aria (interactions + button/toggle/checkbox/switch/radio/textfield/progress + tabs + listbox + select + combobox fixtures); dialog/tooltip/overlay focus-trap/dismiss/scroll-lock paths are covered by behavioral tests (the differential rig shares one document, so focus/portal/positioning aren't rig-driveable). Autocomplete (useAutocomplete/useSearchAutocomplete) is deferred — useComboBox does not depend on it in 3.50.0. Phase 4 adds the react-aria-components foundation under `@octanejs/aria/components`: the collections engine re-hosted on a detached real-DOM store (BaseCollection/CollectionBuilder/createLeafComponent/createBranchComponent/Hidden/useCachedChildren + Collection/Section), the RAC plumbing (Provider, useContextProps, slotted contexts, useRenderProps/composeRenderProps with data-* state attributes), and the non-collection components: Button, ToggleButton(+Group), Checkbox(+Group/Field/Button), Switch(+Field/Button), RadioGroup(+Radio/Field/Button), TextField, SearchField, NumberField, Form, Label/Input/TextArea/FieldError, Group, Toolbar, Separator, Header, Heading, Link, ProgressBar, Meter, Slider(+Output/Track/Thumb/Fill), Disclosure(+Group/Panel), DialogTrigger/Dialog, Modal/ModalOverlay, Popover, TooltipTrigger/Tooltip, OverlayArrow, Text, Keyboard, SelectionIndicator, SharedElementTransition. Phase-4 differentials drive the REAL components on both sides byte-identical (Button hover+mid-press, ToggleButton, Checkbox, TextField typing, Disclosure expand/collapse). Phase 5 adds the RAC collection components over that engine: Autocomplete (full — aria useAutocomplete + stately useAutocompleteState now ported), ListBox(+Item/Section/LoadMoreItem), Menu(+MenuTrigger/SubmenuTrigger/MenuItem/MenuSection), Select(+SelectValue), ComboBox(+ComboBoxValue), Tabs(+TabList/Tab/TabPanels/TabPanel), TagGroup(+TagList/Tag), GridList(+Item/Section/Header/LoadMoreItem), Breadcrumbs(+Breadcrumb), and the DragAndDrop context layer (DropIndicator/contexts/DragAndDropHooks type; components' dnd branches are inert — the dnd engine and useDragAndDrop() itself arrive in a later phase, the stub throws). Phase-5 differentials drive the REAL react-aria-components byte-identical (ListBox selection + keyed reverse, Tabs switch, TagGroup multi-select, GridList row selection, Breadcrumbs, ComboBox typing); Menu/Select open-state (portal'd) carries behavioral coverage incl. keyboard-driven submenus. The Tree/Table follow-up adds the remaining collection verticals: stately grid (GridCollection/useGridState) + the full stately table area (TableCollection/useTableState/column-resize state/UNSTABLE_useTreeGridState), the aria tree hooks (useTree/useTreeItem) and the full aria table hook area (useTable family, TableKeyboardDelegate, useTableColumnResize, grid hooks it rides on), RAC Tree(+TreeItem/TreeItemContent/TreeSection/TreeHeader/TreeLoadMoreItem) and RAC Table(+TableHeader/TableBody/Column/Row/Cell/ColumnResizer/ResizableTableContainer/TableFooter/TableLoadMoreItem). Tree structure states and the interactive Table (sort cycling, row selection) are differential-verified byte-identical vs the real react-aria-components; chevron-driven Tree interaction carries behavioral coverage (the rig's virtual clicks cannot faithfully reproduce the focus-effect interplay on the React side). TableLayout lands with the Virtualizer; date/color families and the drag-and-drop engine are not started — see the migration plan.",
@@ -31,7 +31,7 @@
     },
     {
       "name": "@octanejs/base-ui",
-      "version": "0.1.22",
+      "version": "0.1.24",
       "category": "UI and interaction",
       "upstream": { "package": "@base-ui/react", "version": "1.6.0" },
       "surface": "Alpha, in progress: 34 of 43 upstream subpaths. The foundation, overlay infrastructure, hover/focus interaction layer, list-navigation/typeahead layer and popup viewport have landed, along with Dialog, AlertDialog, Popover, Tooltip, PreviewCard, the full form-control set, and the standalone Button/DirectionProvider/CSPProvider/useMediaQuery utilities — ported at full fidelity and differential-verified against the real `@base-ui/react`. Menu is COMPLETE at all 20 upstream parts — Root/Trigger/Portal/Positioner/Popup, the full item family (Item, LinkItem, CheckboxItem, RadioGroup/RadioItem and their indicators, Group/GroupLabel, Separator), Arrow, Backdrop, Viewport, and SubmenuRoot/SubmenuTrigger. Menubar and ContextMenu have landed too, so the whole menu family is complete. Toast is complete at all 11 parts, including the imperative toast manager, auto-dismiss timers with hover/focus pausing, and promise toasts; swipe-to-dismiss is covered too. Collapsible is complete at all 3 upstream parts (Root/Trigger/Panel), including upstream's <Activity> animation-resume suppression — octane's Activity has React's contract (hidden subtrees keep state and DOM while effects tear down and re-fire on reveal), so that path is ported rather than skipped and is the first component carrying a port of Base UI's OWN test file, under tests/upstream/ — 16 of its 35 upstream cases, being every case that does not require real layout measurement, CSS transition/keyframe sequencing, React.Activity, or find-in-page `beforematch`. Accordion is complete at all 5 upstream parts (Root/Item/Header/Trigger/Panel), built directly on Collapsible — each Item runs its own useCollapsibleRoot and provides CollapsibleRootContext, exactly as upstream does. It carries 18 tests: 15 ported from upstream's own suite plus 3 written to close a real gap — upstream only exercises single-vs-multiple toggling inside jsdom-skipped blocks, so removing the single-mode collapse branch passed every ported case.",
@@ -47,7 +47,7 @@
     },
     {
       "name": "@octanejs/cmdk",
-      "version": "0.1.7",
+      "version": "0.1.9",
       "category": "UI and interaction",
       "upstream": { "package": "cmdk", "version": "1.1.1" },
       "surface": "Complete against the published `cmdk@1.1.1` public surface: `Command` (the root itself) and the `CommandRoot` named export, `Command.Input`, `Command.List`, `Command.Item`, `Command.Group`, `Command.Separator`, `Command.Dialog`, `Command.Empty`, `Command.Loading`, the flat `CommandX` aliases, `useCommandState`, and `defaultFilter` — with the DOM-authoritative store and item/group registration, `useValue` text-content inference, `onInput`-driven search, score filtering plus item and group DOM sorting, keyboard navigation (arrows/Home/End/vim/Enter), controlled `value`/`onValueChange`/`loop`/`shouldFilter`/custom `filter`/`forceMount`, the `--cmdk-list-height` ResizeObserver, and a Radix-backed `Command.Dialog`. `asChild` is the one unsupported prop (see divergences).",
@@ -78,7 +78,7 @@
     },
     {
       "name": "@octanejs/devtools",
-      "version": "0.0.12",
+      "version": "0.0.14",
       "category": "Styling, tests, and devtools",
       "upstream": { "package": "octane", "version": "workspace" },
       "surface": "Octane-native DevTools plugin (not an upstream port): renders live runtime diagnostics into a TanStack Devtools host via @tanstack/devtools-event-client. P1 ships the Components tree + state inspector.",
@@ -88,7 +88,7 @@
     },
     {
       "name": "@octanejs/dexie",
-      "version": "0.1.17",
+      "version": "0.1.19",
       "category": "AI, data, and routing",
       "upstream": { "package": "dexie-react-hooks", "version": "4.4.0" },
       "surface": "Port of the public dexie-react-hooks surface: useObservable, useLiveQuery, useSuspendingObservable, useSuspendingLiveQuery, usePermissions, and useDocument, with Dexie's framework-neutral API re-exported from the package root.",
@@ -102,7 +102,7 @@
     },
     {
       "name": "@octanejs/dnd-kit",
-      "version": "0.1.19",
+      "version": "0.1.21",
       "category": "UI and interaction",
       "upstream": { "package": "@dnd-kit/react", "version": "0.5.0" },
       "surface": "Complete modern dnd-kit React-adapter surface: DragDropProvider, DragOverlay, useDraggable/useDroppable, manager/monitor/operation hooks, PointerSensor/KeyboardSensor re-exports, the public signal-hook utilities, useSortable, and all four upstream entry points.",
@@ -115,7 +115,7 @@
     },
     {
       "name": "@octanejs/electron",
-      "version": "0.0.2",
+      "version": "0.0.4",
       "category": "Desktop",
       "upstream": { "package": "electron", "version": "43.2.0" },
       "surface": "Process-split Electron bindings: ./main registers ipcMain handlers, ./main/native re-exports main-only Electron APIs (Menu, Tray, session, protocol, BrowserWindow, …), ./preload exposes Electron IPC and desktop helpers via contextBridge, and the renderer entry provides Octane hooks (useInvoke, useInvokeState, useIpcEvent, useNativeTheme, useWindowState) plus promise helpers for app/window/dialog/shell/clipboard/screen. Menu/Tray/session/protocol stay intentional main-only under contextIsolation.",
@@ -133,7 +133,7 @@
     },
     {
       "name": "@octanejs/floating-ui",
-      "version": "0.1.23",
+      "version": "0.1.25",
       "category": "UI and interaction",
       "upstream": { "package": "@floating-ui/react", "version": "0.27.19" },
       "surface": "Positioning (`useFloating`, ref-aware `arrow`, the `@floating-ui/dom` middleware re-exports, the floating tree), the full interaction-hook set (`useInteractions`, `useHover` + `safePolygon`, `useClick`, `useFocus`, `useDismiss`, `useRole`, `useClientPoint`, `useListNavigation`, `useTypeahead`), the component layer (`FloatingPortal`, `FloatingOverlay`, `FloatingFocusManager`, `FloatingArrow`, `FloatingList`, `Composite`), and transitions + `FloatingDelayGroup`.",
@@ -143,7 +143,7 @@
     },
     {
       "name": "@octanejs/hook-form",
-      "version": "0.1.21",
+      "version": "0.1.23",
       "category": "Forms and content",
       "upstream": { "package": "react-hook-form", "version": "7.81.0" },
       "surface": "Complete port of react-hook-form 7.81.0 (tag commit 46b217e034dd92f7aa3cb3a478815556b416b299). The automated parity check runs all 1,193 original tests against the pinned React package as a pristine baseline; the Octane port separately runs byte-locked, unfiltered DOM and server suites with exact collected/executed inventories containing 1,187 entries representing 1,178 unique file/full-name identities. The nine duplicate entries are repeated titles within the DOM inventory; the server inventory is disjoint. Coverage includes `useForm`, `useController`, `useFieldArray`, `useFormState`, `useWatch`, `useFormContext`/`FormProvider`, schema resolvers, and all validation modes.",
@@ -156,7 +156,7 @@
     },
     {
       "name": "@octanejs/i18next",
-      "version": "0.1.19",
+      "version": "0.1.21",
       "category": "Forms and content",
       "upstream": { "package": "react-i18next", "version": "17.0.9" },
       "surface": "Complete runtime port of react-i18next 17.0.9: useTranslation, I18nextProvider/context, Trans/TransWithoutContext, IcuTrans/IcuTransWithoutContext, Translation, the withTranslation/withSSR HOCs, useSSR, namespace reporting, initialization/default helpers, and the root ICU helper exports over the unchanged i18next core.",
@@ -171,7 +171,7 @@
     },
     {
       "name": "@octanejs/jotai",
-      "version": "0.1.21",
+      "version": "0.1.23",
       "category": "Shared state",
       "upstream": { "package": "jotai", "version": "2.20.2" },
       "surface": "Complete 1:1 port: the framework-agnostic vanilla core (`jotai/vanilla`, `/vanilla/utils`, `/vanilla/internals`) is reused verbatim; the React layer (`Provider`, `useStore`, `useAtom`, `useAtomValue`, `useSetAtom`) and `react/utils` (`useResetAtom`, `useReducerAtom`, `useAtomCallback`, `useHydrateAtoms`) are ported onto octane hooks, preserving upstream's useReducer force-update + effect-subscription implementation, async atoms via octane's `use()`.",
@@ -181,7 +181,7 @@
     },
     {
       "name": "@octanejs/lexical",
-      "version": "0.1.23",
+      "version": "0.1.25",
       "category": "Forms and content",
       "upstream": { "package": "@lexical/react", "version": "0.46.0" },
       "surface": "35 of 39 `@lexical/react` modules ported: composer + contexts, the editable surface, plain/rich text, and the full plugin/menu set (history, lists + check-list, links, tables, markdown shortcuts, the typeahead/node-menu/context-menu family, draggable-block, character-limit, …) plus the `useLexical*` hooks.",
@@ -194,7 +194,7 @@
     },
     {
       "name": "@octanejs/lucide",
-      "version": "0.1.19",
+      "version": "0.1.21",
       "category": "UI and interaction",
       "upstream": { "package": "lucide-react", "version": "1.24.0" },
       "surface": "Complete against the published `lucide-react@1.24.0` runtime surface: every canonical icon and alias, the `icons` namespace, `Icon`, `createLucideIcon`, `LucideProvider`, `useLucideContext`, `DynamicIcon`, `iconNames`, `dynamicIconImports`, and per-icon subpath imports.",
@@ -207,7 +207,7 @@
     },
     {
       "name": "@octanejs/mantine-hooks",
-      "version": "0.1.5",
+      "version": "0.1.7",
       "category": "UI and interaction",
       "upstream": { "package": "@mantine/hooks", "version": "9.5.0" },
       "surface": "Complete @mantine/hooks 9.5.0 runtime export surface: state, timing, storage, viewport, input, focus, pointer, observer, hotkey, scrolling, collapse, drag, splitter, mask, and utility hooks.",
@@ -221,7 +221,7 @@
     },
     {
       "name": "@octanejs/mdx",
-      "version": "0.1.21",
+      "version": "0.1.23",
       "category": "Forms and content",
       "upstream": { "package": "@mdx-js/mdx", "version": "3.1.1" },
       "surface": "The full compile-don't-interpret pipeline: `.mdx`/`.md` → `@mdx-js/mdx` (reused verbatim) → octane compiler, via the `octaneMdx()` Vite plugin plus the `./compile` and `./server` entries; compiler warnings propagate through direct and Vite compile surfaces with authored `.mdx` ranges; `@mdx-js/react`'s provider layer (`MDXProvider`/`useMDXComponents`) is ported onto octane context. The octane website runs on it.",
@@ -233,7 +233,7 @@
     },
     {
       "name": "@octanejs/mobx",
-      "version": "0.1.5",
+      "version": "0.1.7",
       "category": "Shared state",
       "upstream": { "package": "mobx-react-lite", "version": "4.1.1", "core": "mobx@6.16.1" },
       "surface": "The framework-independent MobX core is re-exported verbatim. The function-component binding includes observer, Observer, useObserver, useLocalObservable, enableStaticRendering, isUsingStaticRendering, and the deprecated useStaticRendering alias.",
@@ -247,7 +247,7 @@
     },
     {
       "name": "@octanejs/motion",
-      "version": "0.1.23",
+      "version": "0.1.25",
       "category": "UI and interaction",
       "upstream": { "package": "motion", "version": "12.42.2" },
       "surface": "Core surface: `motion.<tag>` (animate, gestures, variants with propagation/stagger, drag, layout basics), `AnimatePresence`, `MotionConfig`, and the motion-value hooks (`useMotionValue`, `useScroll`, `useTransform`, `useSpring`, `useAnimate`, `useMotionValueEvent`); motion-dom's animation engine and gesture primitives are reused verbatim.",
@@ -260,7 +260,7 @@
     },
     {
       "name": "@octanejs/nuqs",
-      "version": "0.1.13",
+      "version": "0.1.15",
       "category": "AI, data, and routing",
       "upstream": { "package": "nuqs", "version": "2.9.1" },
       "surface": "Full vendored port: the framework-agnostic core (`parsers`/`parseAs*`/`createParser`, `createSerializer`, `createLoader`, `createStandardSchemaV1`, the throttle/debounce update queues, sync emitter and URL encoding) is vendored verbatim from nuqs 2.9.1; the React layer (`useQueryState`, `useQueryStates`, the `useSyncExternalStores` helper and the adapter context) is ported onto octane's hooks — same `useState`/`useEffect`/`useSyncExternalStore` implementation shape as upstream, so re-render and URL-reconciliation behaviour matches nuqs on React. Adapters ported: `@octanejs/nuqs/adapters/react` (`NuqsAdapter`, `enableHistorySync`), `/adapters/custom` (`unstable_createAdapterProvider`), `/adapters/testing` (`NuqsTestingAdapter`, `withNuqsTestingAdapter`). Server surface (`@octanejs/nuqs/server`) exposes `createLoader`/`createSerializer`/parsers/`createStandardSchemaV1`.",
@@ -275,7 +275,7 @@
     },
     {
       "name": "@octanejs/phosphor-icons",
-      "version": "0.0.4",
+      "version": "0.0.6",
       "category": "UI and interaction",
       "upstream": { "package": "@phosphor-icons/react", "version": "2.1.10" },
       "surface": "All 1,512 canonical icons from @phosphor-icons/core@2.1.1, including the upstream deprecated Icon-suffixed aliases, six weights, IconContext, IconBase, root exports, and per-icon imports.",
@@ -289,7 +289,7 @@
     },
     {
       "name": "@octanejs/radix",
-      "version": "0.1.23",
+      "version": "0.1.25",
       "category": "UI and interaction",
       "upstream": { "package": "radix-ui", "version": "1.6.4" },
       "surface": "Complete against the unified `radix-ui@1.6.4` component surface — all primitives (incl. Dialog, the Menu/DropdownMenu/ContextMenu family, Popover, Tooltip, Select, NavigationMenu, Toast, Menubar, Slider, the form controls, and OneTimePasswordField/PasswordToggleField) plus the composition/state/overlay foundations — verified by a differential suite (same fixtures through octane and the real radix-ui, byte-identical DOM).",
@@ -302,7 +302,7 @@
     },
     {
       "name": "@octanejs/rainbowkit",
-      "version": "0.0.4",
+      "version": "0.0.6",
       "category": "Web3",
       "upstream": { "package": "@rainbow-me/rainbowkit", "version": "2.2.11" },
       "surface": "Octane-native RainbowKitProvider, ConnectButton and ConnectButton.Custom, WalletButton, connect/account/chain modal hooks, connector selection, account/chain actions, native accessible dialogs, and light/dark/midnight themes.",
@@ -318,7 +318,7 @@
     },
     {
       "name": "@octanejs/react-error-boundary",
-      "version": "0.1.5",
+      "version": "0.1.7",
       "category": "UI and interaction",
       "upstream": { "package": "react-error-boundary", "version": "6.1.2" },
       "surface": "Complete against the published react-error-boundary 6.1.2 function/type surface adapted to Octane: ErrorBoundary, ErrorBoundaryContext, getErrorMessage, fallback variants, onError/onReset callbacks, resetKeys, useErrorBoundary (including error), withErrorBoundary, OnErrorCallback, and UseErrorBoundaryApi.",
@@ -332,7 +332,7 @@
     },
     {
       "name": "@octanejs/recharts",
-      "version": "0.1.21",
+      "version": "0.1.23",
       "category": "Data-heavy screens",
       "upstream": { "package": "recharts", "version": "3.9.2" },
       "surface": "Broad runtime support across cartesian, polar, hierarchical, tooltip, legend, responsive-container, shape, and chart-state surfaces. `Brush` and `Treemap` remain intentionally unsupported.",
@@ -344,7 +344,7 @@
     },
     {
       "name": "@octanejs/redux",
-      "version": "0.1.21",
+      "version": "0.1.23",
       "category": "Shared state",
       "upstream": { "package": "react-redux", "version": "9.3.0" },
       "surface": "The hooks + `Provider` surface of react-redux 9.3.0 (`useSelector`, `useDispatch`, `useStore`, and the custom-context factory variants) on octane's `useSyncExternalStore`; works with any Redux 5 / Redux Toolkit store. Export parity is pinned by test.",
@@ -357,7 +357,7 @@
     },
     {
       "name": "@octanejs/redux-toolkit",
-      "version": "0.1.19",
+      "version": "0.1.21",
       "category": "Shared state",
       "upstream": { "package": "@reduxjs/toolkit", "version": "2.12.0" },
       "surface": "Complete four-entry-point port: the framework-agnostic Toolkit and RTK Query core are re-exported verbatim; `/query/react` provides generated query, lazy-query, mutation, infinite-query, prefetch hooks and `ApiProvider`; `/react` provides the dynamic-middleware dispatch-hook integration.",
@@ -370,7 +370,7 @@
     },
     {
       "name": "@octanejs/remix-router",
-      "version": "0.1.20",
+      "version": "0.1.22",
       "category": "AI, data, and routing",
       "upstream": { "package": "react-router", "version": "8.2.0" },
       "surface": "COMPLETE port (all phases shipped — full export parity, EXPECTED_MISSING is empty): the framework-agnostic router core (lib/router/* + framework-free helpers, ~12k lines) is vendored byte-close and validated by 161 ported upstream router tests plus four focused v8.2 regression pins; the data-mode React layer (createMemoryRouter, RouterProvider incl. the /dom flushSync variant, Outlet, Await, RenderErrorBoundary/errorElement, Link + useLinkClickHandler, and the full read-hook family) and the declarative layer (MemoryRouter, Routes/Route in BOTH children forms — descriptor children walked upstream-style, .tsrx block children via a registration collector — Navigate, createRoutesFromChildren/Elements, the UNSAFE_With*Props wrappers) and the DOM layer (createBrowserRouter/createHashRouter with __staticRouterHydrationData parsing, BrowserRouter/HashRouter/unstable_HistoryRouter, Link + NavLink incl. the isActive/isPending render props, useLinkClickHandler, useSearchParams) and the mutation layer (Form on octane's native delegated submit event, useSubmit incl. JSON encTypes, useFormAction with ?index resolution, useFetcher/useFetchers incl. fetcher.Form/load/submit/reset and shared keys), the guard/scroll layer (useBlocker, unstable_usePrompt, ScrollRestoration/UNSAFE_useScrollRestoration, useBeforeUnload, useViewTransitionState, unstable_useRoute/unstable_useRouterState), static SSR (StaticRouter, StaticRouterProvider, createStaticHandler/createStaticRouter rendering through octane/server — markup byte-identical to react-dom/server after marker stripping, hydration payload identical), and the vendored cookie/session server runtime (createCookie/createSession/createCookieSessionStorage/createMemorySessionStorage) are transcribed onto octane and differential-verified against real react-router. Framework-mode + RSC names (Meta/Links/Scripts, createRequestHandler, UNSAFE_ internals) exist as THROWING STUBS so parity is honest.",
@@ -386,7 +386,7 @@
     },
     {
       "name": "@octanejs/rxjs",
-      "version": "0.1.3",
+      "version": "0.1.5",
       "category": "Shared state",
       "upstream": {
         "package": "@react-rxjs/core + @react-rxjs/utils",
@@ -402,7 +402,7 @@
     },
     {
       "name": "@octanejs/shadcn",
-      "version": "0.0.9",
+      "version": "0.0.11",
       "category": "UI and interaction",
       "upstream": {
         "package": "shadcn-ui/ui (radix base)",
@@ -429,7 +429,7 @@
     },
     {
       "name": "@octanejs/sonner",
-      "version": "0.1.19",
+      "version": "0.1.21",
       "category": "UI and interaction",
       "upstream": { "package": "sonner", "version": "2.0.7" },
       "surface": "Complete against the published `sonner@2.0.7` public surface: `Toaster`, the callable `toast` API and all methods, `useSonner`, promise lifecycle, multiple toaster targeting, stacked layout, themes, styling, focus management, timers, and swipe dismissal.",
@@ -443,7 +443,7 @@
     },
     {
       "name": "@octanejs/streamdown",
-      "version": "0.1.3",
+      "version": "0.1.5",
       "category": "Forms and content",
       "upstream": { "package": "streamdown", "version": "2.5.0" },
       "surface": "Complete Streamdown 2.5.0 root runtime and public type surface, plus the official code 1.1.1, math 1.0.2, Mermaid 1.0.2, and CJK 1.0.3 plugins exposed through ./code, ./math, ./mermaid, and ./cjk.",
@@ -456,7 +456,7 @@
     },
     {
       "name": "@octanejs/styled-components",
-      "version": "0.1.16",
+      "version": "0.1.18",
       "category": "Styling, tests, and devtools",
       "upstream": { "package": "styled-components", "version": "6.4.3" },
       "surface": "Full v6 web API, ported from the upstream 6.4.3 sources: `styled` with every HTML/SVG tag shortcut, `.attrs`/`.withConfig` chaining, `css`, `keyframes`, `createGlobalStyle`, `createTheme`, `ThemeProvider`/`ThemeContext`/`ThemeConsumer`/`useTheme`/`withTheme`, `StyleSheetManager`/`StyleSheetContext`/`StyleSheetConsumer` (targets, namespaces, vendor prefixing, stylis plugins, `shouldForwardProp`), `ServerStyleSheet`, `isStyledComponent`, `version`, and `__PRIVATE__`. Component selectors, folding (`styled(Styled)`), transient `$` props, `as`/`forwardedAs`, and the grouped CSSOM sheet engine (with upstream `data-styled` rehydration) all behave as upstream. The React Native surface and the RSC-only `stylisPluginRSC` are not ported.",
@@ -475,7 +475,7 @@
     },
     {
       "name": "@octanejs/stylex",
-      "version": "0.1.23",
+      "version": "0.1.25",
       "category": "Styling, tests, and devtools",
       "upstream": { "package": "@stylexjs/stylex", "version": "0.19.0" },
       "surface": "Full compile-time integration: re-exports the StyleX runtime API (`create`, `props`, `attrs`, `keyframes`, `defineVars`, `createTheme`) and registers as an import source; the `/vite` plugin runs the StyleX compiler over octane's compiled output and emits one static atomic stylesheet (`virtual:stylex.css`) with zero StyleX runtime in the bundle.",
@@ -488,7 +488,7 @@
     },
     {
       "name": "@octanejs/tanstack-ai",
-      "version": "0.0.18",
+      "version": "0.0.20",
       "category": "AI, data, and routing",
       "upstream": { "package": "@tanstack/ai-react", "version": "0.17.0" },
       "surface": "Ports the @tanstack/ai-react 0.17.0 hook surface (useChat, useRealtimeChat, useGeneration, useGenerateImage/Audio/Speech/Video, useTranscription, useSummarize, useAudioRecorder, useMcpAppBridge) while reusing @tanstack/ai 0.41.0 and @tanstack/ai-client 0.21.0 unchanged and mirroring all 30 @tanstack/ai-client convenience re-exports from the upstream index.",
@@ -507,7 +507,7 @@
     },
     {
       "name": "@octanejs/tanstack-devtools",
-      "version": "0.0.18",
+      "version": "0.0.20",
       "category": "Styling, tests, and devtools",
       "upstream": { "package": "@tanstack/react-devtools", "version": "0.10.7" },
       "surface": "Ports the @tanstack/react-devtools 0.10.7 public surface (the `TanStackDevtools` component plus its plugin/init types) onto Octane while reusing the framework-agnostic `@tanstack/devtools` 0.12.5 core (`TanStackDevtoolsCore`) unchanged. Plugin, title, and custom-trigger content authored as Octane elements is portaled into the containers the core creates.",
@@ -522,7 +522,7 @@
     },
     {
       "name": "@octanejs/tanstack-form",
-      "version": "0.0.18",
+      "version": "0.0.20",
       "category": "Forms and content",
       "upstream": { "package": "@tanstack/react-form", "version": "1.33.2" },
       "surface": "Ports the complete @tanstack/react-form 1.33.2 adapter surface (`useForm`, `useField`, form and field groups, hook contexts and component composition) while re-exporting @tanstack/form-core 1.33.2 unchanged and using @octanejs/tanstack-store for subscriptions.",
@@ -536,7 +536,7 @@
     },
     {
       "name": "@octanejs/tanstack-hotkeys",
-      "version": "0.0.13",
+      "version": "0.0.15",
       "category": "UI and interaction",
       "upstream": { "package": "@tanstack/react-hotkeys", "version": "0.10.0" },
       "surface": "Complete: the full upstream hook surface (`useHotkey`, `useHotkeys`, `useHeldKeys`, `useHeldKeyCodes`, `useKeyHold`, `useHotkeySequence`, `useHotkeySequences`, `useHotkeyRecorder`, `useHotkeySequenceRecorder`, `useHotkeyRegistrations`) plus `HotkeysProvider`/`useHotkeysContext`/`useDefaultHotkeysOptions`, re-exporting the framework-agnostic `@tanstack/hotkeys@0.8.0` core unchanged; store subscriptions go through `@octanejs/tanstack-store`.",
@@ -548,7 +548,7 @@
     },
     {
       "name": "@octanejs/tanstack-pacer",
-      "version": "0.0.13",
+      "version": "0.0.15",
       "category": "UI and interaction",
       "upstream": { "package": "@tanstack/react-pacer", "version": "0.22.1" },
       "surface": "Complete: every upstream hook family — debouncer (`useDebouncer`, `useDebouncedState`, `useDebouncedValue`, `useDebouncedCallback`), throttler, rate-limiter, queuer, batcher, and their async variants (async-debouncer, async-throttler, async-rate-limiter, async-queuer, async-batcher) — plus `PacerProvider`/`usePacerContext`/`useDefaultPacerOptions`, the per-instance `Subscribe` render-prop component, and the upstream subpath exports (`/debouncer`, `/async-retryer`, `/types`, `/utils`, ...), re-exporting the framework-agnostic `@tanstack/pacer@0.21.1` core unchanged.",
@@ -560,7 +560,7 @@
     },
     {
       "name": "@octanejs/tanstack-query",
-      "version": "0.1.23",
+      "version": "0.1.25",
       "category": "AI, data, and routing",
       "upstream": { "package": "@tanstack/react-query", "version": "5.101.3" },
       "surface": "Complete: 58/58 runtime exports plus the full TypeScript surface; the export surface is byte-identical to upstream in both directions (locked by test), and `@tanstack/query-core` is re-exported verbatim.",
@@ -572,7 +572,7 @@
     },
     {
       "name": "@octanejs/tanstack-router",
-      "version": "0.1.23",
+      "version": "0.1.25",
       "category": "AI, data, and routing",
       "upstream": { "package": "@tanstack/react-router", "version": "1.170.18" },
       "surface": "Octane's TanStack Router binding: typed route factories and hooks, the full Match pipeline and lifecycle, file routes with TSRX-aware generator integration, full Link navigation/preloading/masking behavior, blocking, Await/deferred hydration, scroll restoration, lazy routes, not-found handling, document/head assets, and client/server SSR entries.",
@@ -586,7 +586,7 @@
     },
     {
       "name": "@octanejs/tanstack-router-ssr-query",
-      "version": "0.0.13",
+      "version": "0.0.15",
       "category": "AI, data, and routing",
       "upstream": { "package": "@tanstack/react-router-ssr-query", "version": "1.167.1" },
       "surface": "Complete: `setupRouterSsrQueryIntegration` (the package's only export) delegating to `@tanstack/router-ssr-query-core@1.169.1`, with the QueryClientProvider Wrap composition on Octane.",
@@ -596,7 +596,7 @@
     },
     {
       "name": "@octanejs/tanstack-store",
-      "version": "0.0.18",
+      "version": "0.0.20",
       "category": "Shared state",
       "upstream": { "package": "@tanstack/react-store", "version": "0.11.0" },
       "surface": "Re-exports `@tanstack/store@0.11.0` unchanged and implements the stable React binding surface (`useSelector`, `useAtom`, `useCreateAtom`, `useCreateStore`, `createStoreContext`, and deprecated `useStore`) on Octane hooks.",
@@ -608,7 +608,7 @@
     },
     {
       "name": "@octanejs/tanstack-table",
-      "version": "0.1.21",
+      "version": "0.1.23",
       "category": "Data-heavy screens",
       "upstream": { "package": "@tanstack/react-table", "version": "9.0.0-beta.58" },
       "surface": "Complete port of the v9 adapter: the framework-agnostic `@tanstack/table-core` (constructTable + every tree-shakeable feature and row model) is reused verbatim, and the adapter — `useTable`, `Subscribe`, `flexRender`/`FlexRender`, `createTableHook`, `createTableHookContexts` — is transcribed onto octane hooks. Table state lives in TanStack Store atoms via the `coreReactivityFeature` bindings, and `useSelector` drives re-renders from the selected slice. Every store primitive (hooks, `createAtom`, `batch`, `shallow`, and the atom/store types) is imported from @octanejs/tanstack-store, which re-exports all of @tanstack/store — the binding takes no direct dependency on the store core, so there is only one path to it and atom identity cannot be split across duplicate copies.",
@@ -621,7 +621,7 @@
     },
     {
       "name": "@octanejs/tanstack-virtual",
-      "version": "0.1.21",
+      "version": "0.1.23",
       "category": "Data-heavy screens",
       "upstream": { "package": "@tanstack/react-virtual", "version": "3.14.5" },
       "surface": "Complete 1:1 port: the framework-agnostic `@tanstack/virtual-core` (Virtualizer + observers + windowing math) is reused verbatim; the React adapter (`useVirtualizer`, `useWindowVirtualizer`, incl. `useFlushSync` and the experimental `directDomUpdates` surface) is transcribed onto octane hooks, preserving upstream's force-update + flushSync-on-sync-scroll wiring and layout-effect lifecycle.",
@@ -633,7 +633,7 @@
     },
     {
       "name": "@octanejs/tauri",
-      "version": "0.0.7",
+      "version": "0.0.9",
       "category": "Desktop",
       "upstream": { "package": "@tauri-apps/api", "version": "2.11.1" },
       "surface": "Octane hooks over the framework-neutral Tauri IPC surface: useInvoke (suspending command), useInvokeState (pending/success/error with refetch), and useTauriEvent (event subscription with lifecycle-safe teardown). The rest of @tauri-apps/api — window, webview, menu, tray, path, dpi, image, and the plugin packages — is already framework-neutral and is imported directly rather than re-exported here.",
@@ -651,7 +651,7 @@
     },
     {
       "name": "@octanejs/testing-library",
-      "version": "0.1.21",
+      "version": "0.1.23",
       "category": "Styling, tests, and devtools",
       "upstream": { "package": "@testing-library/react", "version": "unpinned" },
       "surface": "`render`/`rerender`/`cleanup`/`renderHook` + `act` over the verbatim `@testing-library/dom` (every query, `screen`, `within`, `waitFor`, `fireEvent`, `prettyDOM`, `configure`), with commit timing wired to octane's scheduler via the dom-library's `eventWrapper`/`asyncWrapper` config.",
@@ -664,7 +664,7 @@
     },
     {
       "name": "@octanejs/three",
-      "version": "0.1.17",
+      "version": "0.1.19",
       "category": "Web 3D",
       "upstream": { "package": "@react-three/fiber", "version": "9.6.1 (2a528745)" },
       "surface": "Technical-preview Milestones 0–10 surface: renderer configuration and the DOM Canvas boundary, compiler ABI and renderer-local Three intrinsic types, catalogue and both extend forms, primitive/args construction, Three prop application, attachment, ordered placement/recreation, retained visibility, lifecycle/ref delivery, ownership-aware disposal, promise-returning HTMLCanvasElement and OffscreenCanvas roots, Octane act/flushSync scheduling, callback-aware unmountComponentAtNode, callable root state, scene/camera/raycaster and resize/DPR/viewport configuration, shadows/colors, one shared frame loop, controlled WebXR loop handoff, context-restore invalidation, compatible/reconstructing HMR, global effects, useStore/useThree/useFrame/useGraph and managed-instance helpers, the ray/pointer event system with DOM sources and custom managers, a keyed useLoader cache with preload/clear and GLTF graph augmentation, retained Suspense/Activity behavior, client Three-to-DOM pending/error projection, same-renderer createPortal targets with state/event enclaves and physical Three event bubbling, client-only Canvas shell streaming and production Vite/Rsbuild hydration adoption with the matching raw Rspack graph split, the explicit-target low-level DOMRegion boundary, a deterministic testing harness, an asynchronously acknowledged structured-clone transport proof, a checked public API/subpath matrix, Three r156/current compatibility lanes, a packed external consumer, real WebGL failure/recovery coverage, and semantic-checksummed renderer and shipped-size benchmarks.",
@@ -685,7 +685,7 @@
     },
     {
       "name": "@octanejs/tiptap",
-      "version": "0.0.18",
+      "version": "0.0.20",
       "category": "Forms and content",
       "upstream": { "package": "@tiptap/react", "version": "3.28.0" },
       "surface": "Complete @tiptap/react 3.28.0 adapter surface across the root and ./menus entries: @tiptap/core re-exports, editor hooks and contexts, the EditorContent portal bridge, compound Tiptap API, ReactRenderer, custom NodeView/MarkView renderers and helpers, BubbleMenu, and FloatingMenu.",
@@ -702,7 +702,7 @@
     },
     {
       "name": "@octanejs/usehooks-ts",
-      "version": "0.0.5",
+      "version": "0.0.7",
       "category": "UI and interaction",
       "upstream": {
         "package": "usehooks-ts",
@@ -720,7 +720,7 @@
     },
     {
       "name": "@octanejs/valtio",
-      "version": "0.1.7",
+      "version": "0.1.9",
       "category": "Shared state",
       "upstream": { "package": "valtio", "version": "2.3.2" },
       "surface": "The framework-agnostic `valtio/vanilla` core and `valtio/vanilla/utils` are re-exported verbatim; `useSnapshot` and the `useProxy` utility are ported to Octane.",
@@ -732,7 +732,7 @@
     },
     {
       "name": "@octanejs/visx",
-      "version": "0.1.18",
+      "version": "0.1.20",
       "category": "Data-heavy screens",
       "upstream": { "package": "@visx/visx", "version": "4.0.0 + master@485c035" },
       "surface": "Complete current Visx 4.x web runtime surface: the exact 35-namespace aggregate, all 40 feature entry points, and the eight public a11y/react, a11y/server, axis/react, scale/react, shape/react, theme/react, tooltip/floating, and voronoi/react subpaths. Released-only packages chord, delaunay, react-spring, sankey, and stats remain directly importable exactly as upstream specifies.",
@@ -748,7 +748,7 @@
     },
     {
       "name": "@octanejs/wagmi",
-      "version": "0.0.4",
+      "version": "0.0.6",
       "category": "Web3",
       "upstream": { "package": "wagmi", "version": "3.7.4" },
       "surface": "WagmiProvider and createConfig over @wagmi/core 3.6.4, with config, connection, connect, disconnect, switch-connection, switch-chain, connectors, connections, chains, balance, contract read/simulate/write, transaction send/wait, and message-signing hooks.",
@@ -764,7 +764,7 @@
     },
     {
       "name": "@octanejs/zustand",
-      "version": "0.1.23",
+      "version": "0.1.25",
       "category": "Shared state",
       "upstream": { "package": "zustand", "version": "5.0.14" },
       "surface": "Complete 1:1 port: the framework-agnostic vanilla store is reused verbatim; `create`/`useStore`, `shallow`/`useShallow`, the traditional equality-fn variants, and all middleware (persist, devtools, subscribeWithSelector, combine, redux).",

package/src/kernel/install.js

@@ -8,6 +8,33 @@ const MANAGERS = {
 	bun: { add: ['add'], dev: '-d' },
 };
 
+/**
+ * Dependency install scripts pnpm should be told to run.
+ *
+ * pnpm blocks them until the project records a decision, and since 11.0 an
+ * undecided script fails the whole install rather than warning: the packages
+ * land on disk and pnpm still exits non-zero. A scaffold that says nothing
+ * therefore stops partway through, with the dependencies installed and the dev
+ * dependencies missing, which leaves an app whose `dev` script cannot start.
+ *
+ * esbuild is the one the generated projects cannot run without: its install
+ * script is how vite's platform binary arrives. Only packages named here are
+ * approved, so a build script arriving through some other dependency stays the
+ * user's call to make.
+ *
+ * npm and yarn run install scripts by default and need none of this. bun blocks
+ * them like pnpm but exits zero, so it never breaks the scaffold; teaching the
+ * templates `trustedDependencies` is a separate change.
+ */
+export const PNPM_ALLOWED_BUILDS = ['esbuild'];
+
+/** What pnpm calls the failure above. */
+const IGNORED_BUILDS = 'ERR_PNPM_IGNORED_BUILDS';
+
+/** Said once per run: the build script is the same one every install trips on. */
+const APPROVE_BUILDS =
+	'pnpm blocked a dependency install script. Run `pnpm approve-builds` to decide on it.';
+
 /**
  * The managers this CLI knows how to drive. Derived rather than written out, so
  * that a flag can never offer a manager `installCommand` would silently answer
@@ -19,12 +46,18 @@ export const PACKAGE_MANAGERS = Object.keys(MANAGERS);
  * @param {import('./project.js').Project} project
  * @param {string[]} names
  * @param {boolean} dev
+ * @param {{ allowBuilds?: readonly string[] }} [options]
  * @returns {{ manager: string, args: string[] }}
  */
-export function installCommand(project, names, dev = false) {
+export function installCommand(project, names, dev = false, { allowBuilds = [] } = {}) {
 	const manager = project.packageManager ?? 'npm';
 	const recipe = MANAGERS[/** @type {keyof typeof MANAGERS} */ (manager)] ?? MANAGERS.npm;
-	return { manager, args: [...recipe.add, ...(dev ? [recipe.dev] : []), ...names] };
+	// `--allow-build` is pnpm's spelling, and npm would read it as a package name.
+	const approvals = manager === 'pnpm' ? allowBuilds.map((name) => `--allow-build=${name}`) : [];
+	return {
+		manager,
+		args: [...recipe.add, ...approvals, ...(dev ? [recipe.dev] : []), ...names],
+	};
 }
 
 /**
@@ -34,17 +67,42 @@ export function installCommand(project, names, dev = false) {
  * @param {import('./context.js').Ctx} ctx
  * @param {import('./project.js').Project} project
  * @param {string[]} names
- * @param {{ dev?: boolean }} [options]
- * @returns {Promise<string>} the command that ran
+ * @param {{ dev?: boolean, allowBuilds?: readonly string[] }} [options]
+ * @returns {Promise<{ command: string, warnings: string[] }>} the command that
+ *   ran, and anything the user has to settle themselves
  */
-export async function installPackages(ctx, project, names, { dev = false } = {}) {
-	const { manager, args } = installCommand(project, names, dev);
-	const result = await ctx.exec.run(manager, args, { cwd: project.root });
+export async function installPackages(
+	ctx,
+	project,
+	names,
+	{ dev = false, allowBuilds: approved = [] } = {},
+) {
+	const run = async (/** @type {readonly string[]} */ allowBuilds) => {
+		const { manager, args } = installCommand(project, names, dev, { allowBuilds });
+		const result = await ctx.exec.run(manager, args, { cwd: project.root });
+		return { result, command: `${manager} ${args.join(' ')}` };
+	};
+
+	let { result, command } = await run(approved);
+	let output = `${result.stdout}\n${result.stderr}`;
+
+	// `--allow-build` landed in pnpm 10.4. Older pnpm rejects the flag instead of
+	// installing, and asking it for its version first would cost a process on
+	// every run to spare one retry on almost none of them.
+	if (result.code !== 0 && /Unknown option.*allow-build/i.test(output)) {
+		({ result, command } = await run([]));
+		output = `${result.stdout}\n${result.stderr}`;
+	}
 
 	if (result.code !== 0) {
-		throw new CliError(`\`${manager} ${args.join(' ')}\` failed.`, {
+		// A blocked build script is reported by failing after the packages are
+		// already installed. Carrying on beats aborting: the install did its job,
+		// and stopping here would skip the rest of the setup over a decision that
+		// is the user's to make.
+		if (output.includes(IGNORED_BUILDS)) return { command, warnings: [APPROVE_BUILDS] };
+		throw new CliError(`\`${command}\` failed.`, {
 			hint: (result.stderr || result.stdout).trim() || 'Install the packages by hand.',
 		});
 	}
-	return `${manager} ${args.join(' ')}`;
+	return { command, warnings: [] };
 }