pi-usereq 0.47.0 → 0.48.0

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## [0.48.0](https://github.com/Ogekuri/PI-useReq/compare/v0.47.0..v0.48.0) - 2026-07-13
+### 🐛  Bug Fixes
+- approve scripts at correct install root [useReq] *(install-static-checkers)*
+  - getConsumerInstallRoot preferred INIT_CWD over npm_config_local_prefix.
+  - pi runs 'npm install --prefix <root>' from its own cwd, so INIT_CWD is the
+  - caller cwd, not the install root; the allowScripts approval was written to
+  - the wrong project (or nowhere) and 'npm warn allow-scripts' persisted on
+  - every 'pi update --extensions'.
+  - Swap priority to prefer npm_config_local_prefix (the real install root in
+  - both --prefix and plain installs), falling back to INIT_CWD.
+  - Add reproducer unit test; update WORKFLOW.md call-trace description.
+  - Satisfies DES-020, REQ-352.
+
 ## [0.47.0](https://github.com/Ogekuri/PI-useReq/compare/v0.46.0..v0.47.0) - 2026-07-13
 ### 🐛  Bug Fixes
 - Fix packages file.
@@ -636,6 +649,7 @@
 - \[0.45.0\]: https://github.com/Ogekuri/PI-useReq/releases/tag/v0.45.0
 - \[0.46.0\]: https://github.com/Ogekuri/PI-useReq/releases/tag/v0.46.0
 - \[0.47.0\]: https://github.com/Ogekuri/PI-useReq/releases/tag/v0.47.0
+- \[0.48.0\]: https://github.com/Ogekuri/PI-useReq/releases/tag/v0.48.0
 
 [0.1.0]: https://github.com/Ogekuri/PI-useReq/releases/tag/v0.1.0
 [0.2.0]: https://github.com/Ogekuri/PI-useReq/compare/v0.1.0..v0.2.0
@@ -682,3 +696,4 @@
 [0.45.0]: https://github.com/Ogekuri/PI-useReq/compare/v0.44.0..v0.45.0
 [0.46.0]: https://github.com/Ogekuri/PI-useReq/compare/v0.45.0..v0.46.0
 [0.47.0]: https://github.com/Ogekuri/PI-useReq/compare/v0.46.0..v0.47.0
+[0.48.0]: https://github.com/Ogekuri/PI-useReq/compare/v0.47.0..v0.48.0

package/README.md

@@ -1,4 +1,4 @@
-# PI-useReq/pi-usereq (0.47.0)
+# PI-useReq/pi-usereq (0.48.0)
 
 <p align="center">
   <img src="https://img.shields.io/badge/python-3.11%2B-3776AB?style=flat-square&logo=python&logoColor=white" alt="Python 3.11+">

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-usereq",
-  "version": "0.47.0",
+  "version": "0.48.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/Ogekuri/PI-useReq.git"

package/pi-usereq/docs/WORKFLOW.md

@@ -1309,7 +1309,7 @@
 - Internal Call-Trace Tree:
   - `main(...)`: when invoked as the npm `postinstall` lifecycle, best-effort write consumer-root name-only `allowScripts` approvals, then probe each bundled npm checker, attempt best-effort install on miss, print native-checker guidance, and return `0` [`scripts/install-static-checkers.ts`]
     - `approvePendingInstallScripts(...)`: best-effort write name-only `allowScripts` approvals into the consumer-root `package.json` for installed packages declaring install lifecycle scripts before probing [`scripts/install-static-checkers.ts`]
-      - `getConsumerInstallRoot(...)`: resolve the consumer install root from the npm `INIT_CWD` or `npm_config_local_prefix` lifecycle environment [`scripts/install-static-checkers.ts`]
+      - `getConsumerInstallRoot(...)`: resolve the consumer install root preferring the npm `npm_config_local_prefix` install root (correct under pi `npm install --prefix <root>` flows) over the `INIT_CWD` caller-cwd fallback [`scripts/install-static-checkers.ts`]
       - `collectNodeModulesPackages(...)`: scan consumer-root `node_modules` and parse each readable package manifest [`scripts/install-static-checkers.ts`]
       - `selectInstallScriptPackageNames(...)`: select package names declaring `preinstall`, `install`, or `postinstall` scripts [`scripts/install-static-checkers.ts`]
       - `mergeAllowScriptsEntries(...)`: merge name-only approvals into the existing `allowScripts` map while preserving prior entries and explicit denials [`scripts/install-static-checkers.ts`]

package/scripts/install-static-checkers.ts

@@ -71,12 +71,13 @@ export interface InstallScriptApprovalDeps {
 
 /**
  * @brief Resolves the consumer install root that owns the active npm install transaction.
- * @details During an npm lifecycle script npm sets `INIT_CWD` to the invocation directory and `npm_config_local_prefix` to the resolved project prefix; both point at the true consumer root instead of the installed package directory that is the postinstall `process.cwd()`. Returns the first available value so the approval flow writes the consumer-root `package.json` allowScripts map instead of the nested `node_modules/<pkg>` directory. Runtime is O(1). No external state is mutated.
+ * @details During an npm lifecycle script npm sets `npm_config_local_prefix` to the resolved project prefix (the directory holding the `package.json` npm operates on) and `INIT_CWD` to the npm invocation directory. The pi extension host drives installs with `npm install <pkg> --prefix <installRoot>` from its own caller cwd, so in that flow `INIT_CWD` is the host caller cwd, NOT the install root, while `npm_config_local_prefix` equals the install root in both `--prefix` and plain `cd <root> && npm install` flows. Therefore `npm_config_local_prefix` MUST be selected first; `INIT_CWD` is retained only as a fallback for npm versions or flows that leave the prefix unset. Selecting `INIT_CWD` first would resolve the caller project (or a nonexistent path), so the `allowScripts` approval would be written to the wrong `package.json` (or nowhere) and the `npm warn allow-scripts` warning would persist on every extension update. Runtime is O(1). No external state is mutated.
  * @param[in] env {NodeJS.ProcessEnv} Environment map read for npm lifecycle path variables.
- * @return {string | undefined} Consumer install root, or `undefined` when not running inside an npm lifecycle.
+ * @return {string | undefined} Consumer install root, preferring `npm_config_local_prefix` then `INIT_CWD`, or `undefined` when not running inside an npm lifecycle.
+ * @satisfies DES-020, REQ-352
  */
 export function getConsumerInstallRoot(env: NodeJS.ProcessEnv = process.env): string | undefined {
-  return env.INIT_CWD || env.npm_config_local_prefix || undefined;
+  return env.npm_config_local_prefix || env.INIT_CWD || undefined;
 }
 
 /**

package/tests/static-check-bundled.test.ts

@@ -153,6 +153,32 @@ test("getConsumerInstallRoot falls back to npm_config_local_prefix and then unde
   }
 });
 
+test("getConsumerInstallRoot prefers npm_config_local_prefix over INIT_CWD for --prefix installs", () => {
+  // Reproducer for `pi update --extensions` `npm warn allow-scripts`: the pi host runs
+  // `npm install <pkg> --prefix <installRoot>` from its own caller cwd, so INIT_CWD is the
+  // caller cwd while npm_config_local_prefix is the real install root. Resolving INIT_CWD
+  // first writes the allowScripts approval to the wrong project (or nowhere) and the warning
+  // persists on every extension update.
+  const previousInitCwd = process.env.INIT_CWD;
+  const previousPrefix = process.env.npm_config_local_prefix;
+  try {
+    process.env.INIT_CWD = "/tmp/pi-usereq-caller-cwd";
+    process.env.npm_config_local_prefix = "/tmp/pi-usereq-install-root";
+    assert.equal(getConsumerInstallRoot(), "/tmp/pi-usereq-install-root");
+  } finally {
+    if (previousInitCwd === undefined) {
+      delete process.env.INIT_CWD;
+    } else {
+      process.env.INIT_CWD = previousInitCwd;
+    }
+    if (previousPrefix === undefined) {
+      delete process.env.npm_config_local_prefix;
+    } else {
+      process.env.npm_config_local_prefix = previousPrefix;
+    }
+  }
+});
+
 test("selectInstallScriptPackageNames returns only packages with lifecycle scripts", () => {
   const packages: NodeModulesPackage[] = [
     { name: "has-postinstall", scripts: { postinstall: "node install.js" } },