fix: gate npm pack --ignore-scripts on install_allow_scripts alone

[kriszyp]

Summary

npm pack on a git-reference packageIdentifier isn't just a download — npm clones the repo and, if its manifest has a prepare/build/install script, runs npm install inside the clone and then that script. That means the repo's own code (and its dependencies' install scripts) can execute on this node during the pack step alone, before the later npm install even runs. install_allow_scripts is the operator-facing switch for whether a deployed component may run scripts on this node at all, but it never reached this pack step — so a git-reference deploy with install_allow_scripts: false still ran pack-time scripts unconditionally.

Fixes this by passing --ignore-scripts to npm pack whenever install_allow_scripts is not explicitly enabled, for any non-file: packageIdentifier.

Refs #1818

Note on scope vs. the issue text

The issue (and #1799, still open/unmerged) describes this as a gitCredentialEnv &&-gated condition. gitCredentialEnv doesn't exist on main yet — it's introduced by #1799, which isn't merged. What does exist on main today is the more fundamental gap: npm pack never passed --ignore-scripts at all, regardless of install_allow_scripts, for any git-reference deploy (credentialed or not). This PR fixes that root gap directly, unconditionally on !application.install?.allowInstallScripts — no gitCredentialEnv involved, since it isn't in scope on main.

When #1799 lands, its gitCredentialEnv-gated --ignore-scripts condition will need to be reconciled with this change — per the issue's own suggested fix, that just means dropping the application.gitCredentialEnv && prefix, since the gate this PR adds already covers it.

The issue also asks to re-examine the adjacent warn-log branch (only fires today when gitCredentialEnv is set and scripts are allowed). That branch doesn't exist on main either — it's credential-specific wording tied to #1799's still-unmerged feature, so there's nothing to change here; #1799 is the right place to decide whether that log should also fire for the uncredentialed allow-scripts case.

Test coverage

Added unitTests/components/gitPackIgnoreScripts.test.js — an end-to-end test against a real local git repo and real npm pack (no mocking of the spawn args), following the pattern already used by #1799's gitCredentialClone.test.js:

• prepare script does not run during pack when install_allow_scripts is unset (default), with no git credential involved
• prepare script does run when install_allow_scripts: true is explicitly set

Existing Application.test.js, extractApplicationSwap.test.js, applicationSpawn.test.js, and packageComponent.test.js pass unchanged, as does the full test:unit:main suite (3423 passing; the 10 globalIsolation.test.js failures are a pre-existing worktree-environment issue — a node_modules path-resolution mismatch unrelated to this change, confirmed by reproducing them against main with this diff stashed out).

Update: rebased onto main now that #1797/#1799 are merged

#1797 (git credential sessions) and #1799 (semver-range committish resolution) both merged to main after this branch was created, and both independently rewrote the same region of Application.ts (parseGitReference, packGitReferenceWithoutScripts, and the extractApplication gating logic this PR touches). A plain git rebase main applied with no conflict markers but silently discarded #1797/#1799's entire credential-threading and semver-resolution work — confirmed by diffing the rebase result against main and finding gitCredentialEnv, resolveCommittish, etc. missing entirely. Reconciled by hand instead of trusting that result; see the "Rebase onto main and reconcile..." commit message for the detailed reasoning.

The merged implementation keeps #1797's credential-threading and semver resolution, plus this PR's looksLikeGitReference/bare-URL recognition, runNpmPack dedup, and — per this PR's own note above — broadens the script-suppression gate to !allowInstallScripts alone (dropping the credential requirement). parseGitReference now rejects only #path: (still unimplemented) rather than also #semver:, since #1797 makes that form handleable.

A follow-up push addressed two Codex CLI findings from cross-model review of the rebase: parseGitReference now decodes a percent-encoded committish for the owner:repo shorthand and bare host URLs (matching hosted-git-info's actual behavior, verified by reading its source), while deliberately leaving explicit git+/git: URL forms undecoded (matching npm-package-arg's own, different behavior for those forms) — plus a test-lint fix.

Two further findings from that review are open, not fixed in this PR — pre-existing gaps in this PR's own looksLikeGitReference/BARE_GIT_HOST_URL_PREFIX design (not introduced by the rebase), each judged to need independently-risky, non-trivial changes to close properly rather than a quick guess under this rebase's scope:

• looksLikeGitReference/parseGitReference don't recognize npm's SSH shorthand forms (git@host:owner/repo.git, ssh://git@host/...) or SourceHut. Those still fall through to the plain npm pack --ignore-scripts path — still attempted (this PR's core fix does apply), just not the more robust reclone-and-strip-scripts path, so they retain the pacote/npm<11 --ignore-scripts caveat already documented above packGitReferenceWithoutScripts.
• BARE_GIT_HOST_URL_PREFIX matches any path under a known git host, including a hosted tarball archive URL (e.g. .../archive/refs/tags/v1.0.0.tar.gz), which would misclassify a previously-working tarball deploy as a git clone and attempt git clone against it. Properly distinguishing the two needs per-host path-shape rules matching hosted-git-info's own archive-URL detection — worth a focused follow-up.

Rebased test suite (gitSemverCommittish.test.js, Application.test.js, gitCredentials.test.js, gitCredentialClone.test.js, gitPackIgnoreScripts.test.js, extractApplicationSwap.test.js, applicationSpawn.test.js, packageComponent.test.js, credentials.test.js) all pass — 89 tests.

---

Generated by Claude Sonnet 5.

🤖 Generated with Claude Code

[gemini-code-assist]

Code Review

This pull request ensures that npm pack respects the allowInstallScripts configuration during git-reference deploys by conditionally appending the --ignore-scripts flag. This prevents unauthorized scripts from running during the pack step. A comprehensive regression test suite has been added to validate this behavior. The review feedback recommends using Node's native node:assert/strict instead of node:assert in the new test file to align with strict assertion standards.

[claude]

Reviewed; no blockers found. Latest push (a671efd) addresses both prior findings: decodeURIComponentOrRaw correctly matches hosted-git-info's committish decoding for owner:repo shorthand and bare host URLs while deliberately leaving git+/git: URL forms undecoded (matches npm-package-arg), and the test-lint fix switches gitPackIgnoreScripts.test.js off the require('node:assert/strict') that was evading the ESM-only lint rule. New coverage in Application.test.js's parseGitReference suite exercises the decode/no-decode asymmetry and the #path: rejection path.