From bc298d72cc344d99b1bd2bc4cba8e0aba3dbe395 Mon Sep 17 00:00:00 2001
From: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com>
Date: Wed, 19 Aug 2026 12:11:52 -0300
Subject: [PATCH] fix(cli): npmInstallRuntime must allow-scripts for its own
 runtime deps (#10713) (#10759)

Co-authored-by: Markus Hartung <mail@hartmark.se>
---
 bin/cli/runtime/nativeDeps.mjs                |  6 +++
 ...0713-runtime-repair-npm12-allow-scripts.md |  1 +
 ...nstall-runtime-allow-scripts-10713.test.ts | 40 +++++++++++++++++++
 3 files changed, 47 insertions(+)
 create mode 100644 changelog.d/fixes/10713-runtime-repair-npm12-allow-scripts.md
 create mode 100644 tests/unit/cli-npm-install-runtime-allow-scripts-10713.test.ts

diff --git a/bin/cli/runtime/nativeDeps.mjs b/bin/cli/runtime/nativeDeps.mjs
index b632e689a2..60e4d21953 100644
--- a/bin/cli/runtime/nativeDeps.mjs
+++ b/bin/cli/runtime/nativeDeps.mjs
@@ -118,6 +118,11 @@ export function npmInstallRuntime(pkgs, opts = {}) {
   // install of a sibling runtime dep (e.g. systray2 from trayRuntime.ts, which writes to the
   // same runtime dir) does not prune this package as "extraneous" — that pruning otherwise
   // reproduces "No SQLite driver available" after a tray install removes better-sqlite3.
+  // npm 12+ defaults `allowScripts` to off, silently skipping lifecycle/install
+  // scripts (e.g. better-sqlite3's node-gyp/prebuild-install rebuild) unless the
+  // package has a matching `allowScripts` entry — and still exits 0, masking the
+  // failure (#10713). The runtime dir is a CLI-owned, non-user package.json, so
+  // explicitly allowing scripts for the packages we are installing here is safe.
   const npmArgs = [
     "install",
     ...pkgs,
@@ -125,6 +130,7 @@ export function npmInstallRuntime(pkgs, opts = {}) {
     "--no-fund",
     "--prefer-online",
     "--save-exact",
+    ...pkgs.map((pkg) => `--allow-scripts=${pkg}`),
   ];
   // On Windows .cmd files cannot be executed without a shell; use cmd.exe /c explicitly
   // so we never set shell:true (which would propagate env and enable injection).
diff --git a/changelog.d/fixes/10713-runtime-repair-npm12-allow-scripts.md b/changelog.d/fixes/10713-runtime-repair-npm12-allow-scripts.md
new file mode 100644
index 0000000000..17c59d47c0
--- /dev/null
+++ b/changelog.d/fixes/10713-runtime-repair-npm12-allow-scripts.md
@@ -0,0 +1 @@
+- fix(cli): pass --allow-scripts for the runtime's own npm-installed dependencies, so npm 12+'s default install-scripts block no longer silently skips better-sqlite3's native build (#10713)
diff --git a/tests/unit/cli-npm-install-runtime-allow-scripts-10713.test.ts b/tests/unit/cli-npm-install-runtime-allow-scripts-10713.test.ts
new file mode 100644
index 0000000000..eacb1e245a
--- /dev/null
+++ b/tests/unit/cli-npm-install-runtime-allow-scripts-10713.test.ts
@@ -0,0 +1,40 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, writeFileSync, chmodSync, readFileSync, rmSync, existsSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { npmInstallRuntime } from "../../bin/cli/runtime/nativeDeps.mjs";
+
+test("issue #10713: npmInstallRuntime requests --allow-scripts for its own fully-controlled runtime dependency", () => {
+  const fakeBinDir = mkdtempSync(join(tmpdir(), "omniroute-fakenpm-"));
+  const argvLog = join(fakeBinDir, "argv.log");
+  const npmScript = join(fakeBinDir, "npm");
+  writeFileSync(npmScript, `#!/usr/bin/env bash\nprintf '%s\\n' "$@" > "${argvLog}"\nexit 0\n`);
+  chmodSync(npmScript, 0o755);
+
+  const originalPath = process.env.PATH;
+  const originalDataDir = process.env.DATA_DIR;
+  const fakeDataDir = mkdtempSync(join(tmpdir(), "omniroute-fakedata-"));
+  try {
+    process.env.PATH = `${fakeBinDir}:${originalPath}`;
+    process.env.DATA_DIR = fakeDataDir;
+
+    const ok = npmInstallRuntime(["better-sqlite3@12.10.1"], { silent: true });
+
+    assert.equal(ok, true, "npm 12 exits 0 even when it silently skipped install scripts");
+    assert.ok(existsSync(argvLog), "fake npm should have been invoked");
+
+    const argv = readFileSync(argvLog, "utf8");
+
+    assert.ok(
+      argv.includes("--allow-scripts=better-sqlite3@12.10.1"),
+      "npm must be told to allow-scripts for its own runtime dep. argv was:\n" + argv
+    );
+  } finally {
+    process.env.PATH = originalPath;
+    if (originalDataDir === undefined) delete process.env.DATA_DIR;
+    else process.env.DATA_DIR = originalDataDir;
+    rmSync(fakeBinDir, { recursive: true, force: true });
+    rmSync(fakeDataDir, { recursive: true, force: true });
+  }
+});