Honor install-script policy in custom component commands

[kriszyp]

Custom component install commands now pass Harper's lifecycle-script policy into their spawn, and the deprecated install_node_modules operation now passes its validated policy through the shared npm argument builder instead of bypassing it. Custom commands preserve their exact command line, while install_node_modules retains its historical scripts-enabled default unless the caller opts out.

For the human reviewer

1. Secure default for existing custom commands. Omitted install_allow_scripts now suppresses lifecycle hooks immediately, matching the existing automatic-install policy; the alternative was to preserve legacy custom-command behavior until an explicit false. This can break a cold install that previously relied on native-module or generation scripts, so the implementation emits a server warning naming both opt-in spellings; the warning is not streamed to the deploy caller. A “no” means changing the condition to enforce only explicit false and staging the secure default for a later release.

2. Best-effort enforcement for arbitrary commands. The child-scoped npm_config_ignore_scripts=true approach was chosen after planning review rejected appending --ignore-scripts, which fails for shell chains and corrupts non-npm argv. It reaches npm anywhere in the configured shell command, but npm 10 can still run a git dependency's prepare, and other package managers vary in whether they consume npm-style configuration; this is the boundary to inspect most closely. A “no” requires a broader design that restricts or parses arbitrary commands; that is outside this issue's instruction to leave the already-equivalent automatic paths unchanged.

3. Host policy remains authoritative. Explicit true removes Harper's restriction but does not clear an inherited npm_config_ignore_scripts=true, matching the existing automatic paths and preserving current infrastructure hardening. The alternative is to force scripts on whenever an application opts in; changing this later is mechanically small but reverses configuration precedence.

4. Deprecated-operation compatibility. install_node_modules keeps its historical scripts-enabled default, as required by the acceptance criteria, rather than inheriting each component's safer deploy default. The new validation switch accepts camelCase to match the root configuration vocabulary and snake_case to match the operations API; a request carrying both is rejected rather than resolved ambiguously.

Changes

• components/Application.ts threads a dedicated lifecycle-policy flag through nonInteractiveSpawn, scrubs case variants before setting the child-only npm configuration, and warns when a custom command relies on the new secure default.
• utility/npmUtilities.ts reads the converted request field and passes it through the shared npm argument builder instead of hard-coding scripts on.
• DESIGN.md records the operation spellings and compatibility default plus the environment propagation, package-manager caveats and migration warning.

Verification

• Selected observable route: the production installApplication() and installModules() paths spawn real npm against local file: dependencies whose lifecycle scripts write filesystem markers. npx mocha unitTests/components/applicationInstall.test.js unitTests/utility/npmUtilities.test.js reports 18 passing; the custom-command suite proves unchanged argv plus undefined/false/true marker and warning behavior, while the deprecated-operation suite proves omitted/true behavior, false suppression, both spellings and conflict rejection.
• The test fixtures use real marker-writing component dependencies and case-insensitive ambient-policy neutralization so positive controls cannot depend on the host's npm configuration.
• npm run build passes, changed-file Prettier and oxlint checks pass, and git diff --check is clean.
• npm run test:unit:windows passes all 9 groups and 3,732 tests. npm run test:unit:resources reports 2,358 passing / 32 pending.
• npm run test:unit:main reports 5,468 passing / 196 pending plus two unrelated environment failures: ambient fleet git variables in gitCredentials.test.js and a worktree-depth Unix-socket path in configValidator.test.js.
• npm run test:integration:all reaches 2,081 passing, 0 assertion failures, 20 skipped and 6 cancelled; the runner exits nonzero on Node 26's existing missing JSON import attribute in ollama-backend.test.ts. The component lifecycle integration suite passes.
• Full npm run lint remains red on 13 warnings in unrelated files; targeted lint over every changed source and test file passes.
• GitHub reports all 43 applicable main-target CI checks passing with 5 non-applicable jobs skipped. The v5.2 cherry-pick automation reports conflicts and did not run its release-line integration tests; its conflict branch and requested resolution are linked in the workflow comment.

Refs #1978

Complexity: medium

Generated by GPT-5 Codex.

_{Review-Coverage: authored=codex; ran=gemini,claude; adjudicated=domain; declined=cursor-grok,cursor-composer; rounds=4 @ 7f0d5a0}

_{Human-Review-Need: 4 (decisions: default-deny-existing-custom-installs, host-policy-precedence, arbitrary-command-enforcement, deprecated-operation-default) @ 7f0d5a0}

[github-actions]

Release cherry-pick v5.2: conflict

Cherry-pick onto v5.2 produced conflicts on commit(s): 7f0d5a08ccf15c1b44092add7fa5f6f6962790cd

The conflict markers are committed on branch cherry-pick/v5.2/pr-2572.
A pull request has been opened to land this patch: #2575

[gemini-code-assist]

Code Review

This pull request implements a lifecycle-script policy (install_allow_scripts / allowInstallScripts) to control the execution of package lifecycle scripts during automatic installations and custom install commands. When disabled, it appends --ignore-scripts or sets the npm_config_ignore_scripts=true environment variable. Feedback is provided to extract the environment manipulation logic in the application install tests into a helper function, consistent with the helper already defined in the utility tests, to reduce code duplication.

[claude]

Reviewed; no blockers found.