aube add --allow-build does not work with --global

[iki]

Precondition

Setting strictDepBuilds is set to true

Steps to reproduce

# Set strictDepBuilds to true (default in pnpm, but not aube)
$ aube config set strictDepBuilds true

# Try using --allow-build with --global
$ aube add --global just-bash@3.0.0 --allow-build=@mongodb-js/zstd --allow-build=node-liblzma
Resolving just-bash@3.0.0...
  + just-bash@3.0.0 (specifier: 3.0.0)
Updated package.json
  x dependencies with build scripts must be reviewed before install:
  |   - @mongodb-js/zstd@7.0.0
  |   - node-liblzma@2.2.0
  | help: set them to true or false in `allowBuilds`, or set `strictDepBuilds=false`

Similarly it fails when used from mise-en-place via aube_args:

"npm:just-bash" = { version = "latest", aube_args = "--allow-build=@mongodb-js/zstd --allow-build=node-liblzma" }

Possible cause

Based on --allow-build docs, aube may only write the value to workspace and does not work with global config:

`--allow-build=<pkg>` writes `allowBuilds: { <pkg>: true }` into the workspace yaml (or `package.json#aube.allowBuilds`) before the install runs, so the named package's `preinstall` / `install` / `postinstall` scripts execute on this invocation

Additionally allowBuilds setting is only allowed in workspace yaml, or .npmrc.

• Setting allowBuilds = { "@mongodb-js/zstd" = true, "node-liblzma" = true } in global config yaml does not work.
• Neither does work setting it in global ~/.npmrc via aube config set allowBuilds.@mongodb-js/zstd true and aube config set allowBuilds.node-liblzma true

Possible solutions

Enable allowBuilds in global config AND

1. Either modify the setting internally in aube execution context
2. Or modify global config allowBuilds: { <pkg>: true }

Option 2 would be good to allow limiting the setting to particular tool install, instead of allowing it globally. On the other hand, it may be harder to implement, and also if we trust the package scripts on one place, we may trust it anywhere.

WDYT?

Workaround

I don't know any workaround for allowing global package dependencies scripts atm.

[jdx]

Thanks for the detailed write-up — root cause was exactly what you suspected: run_global_inner builds a synthetic AddArgs for the throwaway install dir and was hardcoding allow_build: Vec::new(), so the outer flag was dropped before apply_allow_build_flags ever ran.

PR #620 plumbs --allow-build through to the inner add. The approval lands in the throwaway install dir's package.json#aube.allowBuilds (no workspace yaml exists there) before the install runs, so strictDepBuilds=true no longer blocks the install when you've explicitly approved the dep on the CLI. This matches Option 1 from your write-up — it scopes the approval to the global install rather than touching the user's global config.

After this lands, your repro should work as-is:

aube config set strictDepBuilds true
aube add --global just-bash@3.0.0 --allow-build=@mongodb-js/zstd --allow-build=node-liblzma

and the mise aube_args form should follow.

This comment was generated by Claude.

[iki]

Awesome work @jdx 🔥 Thanks!

There's also one small side issue, aube config set allowBuilds.<pkg> true should IMO fail instead of writing allowBuilds.<pkg>=true to ~/.npmrc, because:

• It has no effect on aube in ~/.npmrc
• It causes the same npm warning (error with upcoming npm 12+) as discussed in Using .npmrc for settings triggers npm warnings, will break in npm 12 #513
  • Actually, it was already fixed in feat(config): store aube settings outside npmrc #517, so this may be a regression and it may be worth to check if there're still any non-npm settings being written to .npmrc

[iki]

✅ Fixed in #620, released in v1.12.0, tested OK

Notes:

• minor related issue The `aube add --global PKG --allow-build` requires appending `=PKG` on contrary to documentation #655
• mise may still use older aube when updated with mise up -y --before 0d aube: Mise uses older aube version ... when aube was updated with `--before 0d` jdx/mise#9827

Tested OK:

> aube add --global npm:hyperframes --allow-build=@google/genai --allow-build=esbuild --allow-build=onnxruntime-node --allow-build=protobufjs --allow-build=sharp --allow-build=better-sqlite3
Resolving hyperframes@latest...
  + hyperframes@0.6.4 (specifier: npm:hyperframes@0.6.4)
Updated package.json
aube 1.12.0 by en.dev
██░░░░░░░░░░░░░  171/204 pkgs · resolving
███████████████  161/161 pkgs
✓ resolved 161 · reused 160 · downloaded 1 (2.2 MB) in 2.7s
preinstall: no-op
1 transitive package has deprecation warnings. Run `aube deprecations --transitive` to see them.

dependencies:

+ hyperframes@0.6.4

> hyperframes --version
0.6.4