fix(server): allow install scripts in npm-global provider updates

[hey-jj]

Fixes #5627.

What changed

makeNpmGlobalProviderMaintenanceCapabilities now adds
--allow-scripts=<packageName> to the npm-global update args, scoped to
exactly the package being updated. A new test pins the exact argv for
@anthropic-ai/claude-code, and two existing expectations pick up the flag.
No other update path is touched.

Why

npm 12 blocks install scripts by default. The allow-scripts allowlist ships
empty, a blocked script produces only a warning, and the install exits 0. The
one-click provider update runs npm install -g <package>@latest, so on npm 12
it replaces a working global claude with a broken one and reports success. The
package's postinstall is what copies the platform-native binary over the
bin/claude stub. With the script blocked, the stub stays in place and every
claude invocation fails with claude native binary not installed. The full
diagnosis and the npm debug log from the failing update are in #5627.

Compatibility

npm 11 ships allow-scripts as a known config key and accepts the flag, which
I verified on 11.17.0. Older npm treats it as unknown config, warns, and
continues with exit 0.

Verification

On npm 12.0.2 the update completes with the postinstall run and claude
launches afterward. The touched test file passes.

The pnpm-global and bun-global paths may carry the same class of exposure, as
noted in #5627, but both managers already block install scripts by default, so
any breakage there is pre-existing rather than new with npm 12. This PR fixes
only the reproduced npm path.

---

Note

Low Risk
Narrow change to npm-global update argv only; older npm may warn on unknown config but continues, and script allowance is limited to the package being updated.

Overview
npm-global one-click provider updates now pass --allow-scripts=<packageName> so npm 12 can run that package’s install scripts during npm install -g …@latest.

Without this, npm 12’s default empty script allowlist can block postinstall (e.g. copying the native claude binary) while still exiting 0, leaving a broken global CLI after a “successful” update.

Tests were updated for advisory/update command strings and npm symlink resolution, and a new case pins argv for @anthropic-ai/claude-code. pnpm, bun, Homebrew, and native update paths are unchanged.

^{Reviewed by Cursor Bugbot for commit 70e999f. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Add --allow-scripts flag to npm-global provider update commands

In providerMaintenance.ts, the npm global update command now includes --allow-scripts=<packageName> between -g and <package>@latest, scoping install script execution to only the package being updated. This works around npm 12's default behavior of blocking install scripts. Behavioral Change: packages updated via the npm-global provider will now have their own install scripts permitted to run, where previously they were blocked.

^{Macroscope summarized 70e999f.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: fe1c1562-2749-46e5-abc0-dbab3696a257

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Approved 70e999f

Straightforward bug fix for npm 12 compatibility. The change adds --allow-scripts flag scoped to the specific package being installed, fixing silent failures in postinstall scripts while maintaining backwards compatibility. Well-documented with comprehensive test coverage.

^{You can customize Macroscope's approvability policy. Learn more.}