fix(cli): npmInstallRuntime must allow-scripts for its own runtime deps (#10713) (#10759)

Co-authored-by: Markus Hartung <mail@hartmark.se>

bin/cli/runtime/nativeDeps.mjs

@@ -118,6 +118,11 @@ export function npmInstallRuntime(pkgs, opts = {}) {
   // install of a sibling runtime dep (e.g. systray2 from trayRuntime.ts, which writes to the
   // same runtime dir) does not prune this package as "extraneous" — that pruning otherwise
   // reproduces "No SQLite driver available" after a tray install removes better-sqlite3.
+  // npm 12+ defaults `allowScripts` to off, silently skipping lifecycle/install
+  // scripts (e.g. better-sqlite3's node-gyp/prebuild-install rebuild) unless the
+  // package has a matching `allowScripts` entry — and still exits 0, masking the
+  // failure (#10713). The runtime dir is a CLI-owned, non-user package.json, so
+  // explicitly allowing scripts for the packages we are installing here is safe.
   const npmArgs = [
     "install",
     ...pkgs,
@@ -125,6 +130,7 @@ export function npmInstallRuntime(pkgs, opts = {}) {
     "--no-fund",
     "--prefer-online",
     "--save-exact",
+    ...pkgs.map((pkg) => `--allow-scripts=${pkg}`),
   ];
   // On Windows .cmd files cannot be executed without a shell; use cmd.exe /c explicitly
   // so we never set shell:true (which would propagate env and enable injection).

changelog.d/fixes/10713-runtime-repair-npm12-allow-scripts.md

@@ -0,0 +1 @@
+- fix(cli): pass --allow-scripts for the runtime's own npm-installed dependencies, so npm 12+'s default install-scripts block no longer silently skips better-sqlite3's native build (#10713)

tests/unit/cli-npm-install-runtime-allow-scripts-10713.test.ts

@@ -0,0 +1,40 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, writeFileSync, chmodSync, readFileSync, rmSync, existsSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { npmInstallRuntime } from "../../bin/cli/runtime/nativeDeps.mjs";
+
+test("issue #10713: npmInstallRuntime requests --allow-scripts for its own fully-controlled runtime dependency", () => {
+  const fakeBinDir = mkdtempSync(join(tmpdir(), "omniroute-fakenpm-"));
+  const argvLog = join(fakeBinDir, "argv.log");
+  const npmScript = join(fakeBinDir, "npm");
+  writeFileSync(npmScript, `#!/usr/bin/env bash\nprintf '%s\\n' "$@" > "${argvLog}"\nexit 0\n`);
+  chmodSync(npmScript, 0o755);
+
+  const originalPath = process.env.PATH;
+  const originalDataDir = process.env.DATA_DIR;
+  const fakeDataDir = mkdtempSync(join(tmpdir(), "omniroute-fakedata-"));
+  try {
+    process.env.PATH = `${fakeBinDir}:${originalPath}`;
+    process.env.DATA_DIR = fakeDataDir;
+
+    const ok = npmInstallRuntime(["better-sqlite3@12.10.1"], { silent: true });
+
+    assert.equal(ok, true, "npm 12 exits 0 even when it silently skipped install scripts");
+    assert.ok(existsSync(argvLog), "fake npm should have been invoked");
+
+    const argv = readFileSync(argvLog, "utf8");
+
+    assert.ok(
+      argv.includes("--allow-scripts=better-sqlite3@12.10.1"),
+      "npm must be told to allow-scripts for its own runtime dep. argv was:\n" + argv
+    );
+  } finally {
+    process.env.PATH = originalPath;
+    if (originalDataDir === undefined) delete process.env.DATA_DIR;
+    else process.env.DATA_DIR = originalDataDir;
+    rmSync(fakeBinDir, { recursive: true, force: true });
+    rmSync(fakeDataDir, { recursive: true, force: true });
+  }
+});