feat(pm): support npm approve-scripts/deny-scripts in approve-builds

[fengmk2]

Summary

npm 11.16.0 (npm/cli#9360, "Phase 1 of allowScripts opt-in install-script policy") adds npm approve-scripts and npm deny-scripts, which manage an advisory allowScripts field in package.json. This is the npm equivalent of pnpm approve-builds / bun pm trust.

vp pm approve-builds previously warned and exited 0 (no-op) on npm. It now forwards to npm's real commands when the detected npm is >= 11.16.0.

Mapping (npm >= 11.16.0)

vp pm approve-builds invocation	npm command
<pkg>... (approves)	npm approve-scripts <pkg>...
--all	npm approve-scripts --all
(no args)	npm approve-scripts --allow-scripts-pending (read-only list)
!<pkg>... (denies, ! stripped)	npm deny-scripts <pkg>...
mixed approves + !denies	rejected with an actionable error
npm < 11.16.0	warn + exit 0 (no-op), advise upgrade

Notes

• Mixed approve+deny is rejected rather than silently split: npm separates approve vs. deny into two commands, so vp pm approve-builds esbuild !core-js returns a clear message asking the user to run the two operations separately (pnpm handles the mixed case in one command). This keeps the single-command return type intact.
• Advisory caveat surfaced: npm 11.x's allowScripts is advisory only (install scripts still run; npm just warns about unreviewed packages). A one-line note is shown after an approve/deny write so users aren't misled. Not shown on the read-only --allow-scripts-pending listing.
• Version gating reuses the existing version_satisfies/node_semver pattern (npm_supports_allow_scripts = >=11.16.0), matching pnpm's prerelease semantics.
• Help text for the deny prefix and --all updated from "pnpm only" to reflect pnpm + npm support.

Tests

• 9 new unit tests in approve_builds.rs (approve-by-name, --all, pending-list, deny-only, multi-deny, mixed-rejected, pass-through, below-gate no-op, prerelease no-op). The Option return type is unchanged, so existing tests are untouched.
• New global snap test command-pm-approve-builds-npm11/ (npm@11.16.0) exercising the real npm commands end-to-end.
• 4 existing approve-builds snaps regenerated for the help-text wording change and the updated npm warn message.

Validation

• cargo test -p vite_install -p vite_pm_cli (510 passed)
• just check
• cargo clippy -p vite_install -p vite_pm_cli -- -D warnings
• pnpm bootstrap-cli + local/global approve-builds snap tests regenerated and reviewed

---

Note

Low Risk
Changes are localized to PM command resolution and user messaging; npm below 11.16.0 and yarn/pnpm/bun paths stay the same aside from help text.

Overview
vp pm approve-builds now forwards to npm on npm ≥ 11.16.0 instead of always warning and no-op’ing. Older npm still gets the legacy warn + exit 0, with copy that mentions upgrading to 11.16.0.

For supported npm versions, invocations map to npm approve-scripts (packages, --all, or no-args → --allow-scripts-pending pending list) and npm deny-scripts when only !pkg tokens are passed (! stripped). Mixed approve + deny in one call is rejected with guidance to run two separate commands. Package names passed only after -- on the pending-list path are also rejected.

After writes that change allowScripts, a note explains npm 11.x policy is advisory (scripts still run; enforcement is future). Pass-through args are forwarded on the npm path like pnpm/bun.

CLI help and the approve-builds RFC are updated for pnpm + npm parity on !pkg, --all, and no-args behavior. Coverage adds many npm 11.16 unit tests, a global snap fixture for npm@11.16.0, and regenerated snaps for help/warn text.

^{Reviewed by Cursor Bugbot for commit 2a34ce3. Configure here.}

[netlify]

✅ Deploy Preview for viteplus-preview ready!

Name	Link
🔨 Latest commit	18c50f9
🔍 Latest deploy log	https://app.netlify.com/projects/viteplus-preview/deploys/6a1e514d8a61c90008642feb
😎 Deploy Preview	https://deploy-preview-1733--viteplus-preview.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[fengmk2]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 2a34ce3. Configure here.}