Thanks for the detailed write-up — root cause was exactly what you suspected: run_global_inner builds a synthetic AddArgs for the throwaway install dir and was hardcoding allow_build: Vec::new(), so the outer flag was dropped before apply_allow_build_flags ever ran.

PR #620 plumbs --allow-build through to the inner add. The approval lands in the throwaway install dir's package.json#aube.allowBuilds (no workspace yaml exists there) before the install runs, so strictDepBuilds=true no longer blocks the install when you've explicitly approved the dep on the CLI. This matches Option 1 from your write-up — it scopes the approval to the global install rather than touching the user's global config.

After this lands, your repro should work as-is:

aube config set strictDepBuilds true
aube add --global just-bash@3.0.0 --allow-build=@mongodb-js/zstd --allow-build=node-liblzma

and the mise aube_args form should follow.

This comment was generated by Claude.

Awesome work @jdx 🔥 Thanks!

There's also one small side issue, aube config set allowBuilds.<pkg> true should IMO fail instead of writing allowBuilds.<pkg>=true to ~/.npmrc, because:

• It has no effect on aube in ~/.npmrc
• It causes the same npm warning (error with upcoming npm 12+) as discussed in Using .npmrc for settings triggers npm warnings, will break in npm 12 #513
  • Actually, it was already fixed in feat(config): store aube settings outside npmrc #517, so this may be a regression and it may be worth to check if there're still any non-npm settings being written to .npmrc